9992 Commits

Author	SHA1	Message	Date
Channagoud Kadabi	8810e5fa00	Merge remote-tracking branch 'origin/tmp-dcb6110' into 4.8 ... * origin/tmp-dcb6110: ANDROID: goldfish_sync: 32 max cmds to save stack ANDROID: sched/walt: use div_u64 instead of do_div Linux 4.9.9 drm/i915/execlists: Reset RING registers upon resume fs: break out of iomap_file_buffered_write on fatal signals iw_cxgb4: set correct FetchBurstMax for QPs x86/irq: Make irq activate operations symmetric irqdomain: Avoid activating interrupts more than once iio: health: max30100: fixed parenthesis around FIFO count check iio: dht11: Use usleep_range instead of msleep for start signal iio: health: afe4403: retrieve a valid iio_dev in suspend/resume iio: health: afe4404: retrieve a valid iio_dev in suspend/resume iio: adc: palmas_gpadc: retrieve a valid iio_dev in suspend/resume staging: greybus: timesync: validate platform state callback USB: serial: option: add device ID for HP lt2523 (Novatel E371) usb: gadget: f_fs: Assorted buffer overflow checks. usb: musb: Fix host mode error -71 regression USB: Add quirk for WORLDE easykey.25 MIDI keyboard USB: serial: pl2303: add ATEN device ID USB: serial: qcserial: add Dell DW5570 QDL KVM: x86: do not save guest-unsupported XSAVE state dmaengine: cppi41: Fix oops in cppi41_runtime_resume dmaengine: cppi41: Fix runtime PM timeouts with USB mass storage perf/x86/intel/uncore: Clean up hotplug conversion fallout HID: wacom: Fix poor prox handling in 'wacom_pl_irq' HID: hid-lg: Fix immediate disconnection of Logitech Rumblepad 2 HID: usbhid: Quirk a AMI virtual mouse and keyboard with ALWAYS_POLL iwlwifi: mvm: avoid crash on restart w/o reserved queues iwlwifi: fix double hyphen in MODULE_FIRMWARE for 8000 pinctrl: intel: merrifield: Add missed check in mrfld_config_set() pinctrl: baytrail: Debounce register is one per community Revert "vring: Force use of DMA API for ARM-based systems with legacy devices" Revert "bcma: init serial console directly from ChipCommon code" percpu-refcount: fix reference leak during percpu-atomic transition regulator: axp20x: AXP806: Fix dcdcb being set instead of dcdce vhost: fix initialization for vq->is_le mmc: sdhci: Ignore unexpected CARD_INT interrupts cgroup: don't online subsystems before cgroup_name/path() are operational can: bcm: fix hrtimer/tasklet termination in bcm op removal tracing: Fix hwlat kthread migration mm, fs: check for fatal signals in do_generic_file_read() base/memory, hotplug: fix a kernel oops in show_valid_zones() mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone() cifs: initialize file_info_lock zswap: disable changing params if init fails svcrpc: fix oops in absence of krb5 module NFSD: Fix a null reference case in find_or_create_lock_stateid() powerpc/mm: Use the correct pointer when setting a 2MB pte powerpc: Fix build failure with clang due to BUILD_BUG_ON() powerpc: Add missing error check to prom_find_boot_cpu() powerpc/eeh: Fix wrong flag passed to eeh_unfreeze_pe() libata: Fix ATA request sense libata: apply MAX_SEC_1024 to all CX1-JB*-HP devices ata: sata_mv:- Handle return value of devm_ioremap. perf/core: Fix PERF_RECORD_MMAP2 prot/flags for anonymous memory perf/core: Fix use-after-free bug crypto: arm64/aes-blk - honour iv_out requirement in CBC and CTR modes crypto: api - Clear CRYPTO_ALG_DEAD bit before registering an alg drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval drm/nouveau/disp/gt215: Fix HDA ELD handling (thus, HDMI audio) on gt215 drm/amdgpu/si: fix crash on headless asics pinctrl: baytrail: Add missing spinlock usage in byt_gpio_irq_handler HID: cp2112: fix gpio-callback error handling HID: cp2112: fix sleep-while-atomic xtensa: fix noMMU build on cores with MMU efi/fdt: Avoid FDT manipulation after ExitBootServices() x86/efi: Always map the first physical page into the EFI pagetables ext4: validate s_first_meta_bg at mount time PCI/ASPM: Handle PCI-to-PCIe bridges as roots of PCIe hierarchies ANDROID: sched: Add Kconfig option DEFAULT_USE_ENERGY_AWARE to set ENERGY_AWARE feature flag ANDROID: goldfish_sync: Fix sync_file_obj is NULL but dereferenced problem ANDROID: goldfish_sync: Isolate single module to fix compilation ANDROID: goldfish_sync: update defconfig for 4.9-compatible version ANDROID: goldfish_sync: upgrade to new fence sync api Linux 4.9.8 xfs: fix bmv_count confusion w/ shared extents xfs: clear _XBF_PAGES from buffers when readahead page xfs: extsize hints are not unlikely in xfs_bmap_btalloc xfs: remove racy hasattr check from attr ops xfs: verify dirblocklog correctly xfs: fix COW writeback race xfs: fix xfs_mode_to_ftype() prototype xfs: don't wrap ID in xfs_dq_get_next_id xfs: sanity check inode di_mode xfs: sanity check inode mode when creating new dentry xfs: replace xfs_mode_to_ftype table with switch statement xfs: add missing include dependencies to xfs_dir2.h xfs: sanity check directory inode di_size xfs: make the ASSERT() condition likely xfs: don't print warnings when xfs_log_force fails xfs: don't rely on ->total in xfs_alloc_space_available xfs: adjust allocation length in xfs_alloc_space_available xfs: fix bogus minleft manipulations xfs: bump up reserved blocks in xfs_alloc_set_aside net: dsa: Bring back device detaching in dsa_slave_suspend() lwtunnel: Fix oops on state free after encap module unload net: Specify the owning module for lwtunnel ops qmi_wwan/cdc_ether: add device ID for HP lt2523 (Novatel E371) WWAN card af_unix: move unix_mknod() out of bindlock r8152: don't execute runtime suspend if the tx is not empty net: mpls: Fix multipath selection for LSR use case bridge: netlink: call br_changelink() during br_dev_newlink() net/mlx5e: Do not recycle pages from emergency reserve tcp: initialize max window for a new fastopen socket ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side lock lwtunnel: fix autoload of lwt modules net: phy: bcm63xx: Utilize correct config_intr function net: fix harmonize_features() vs NETIF_F_HIGHDMA vxlan: fix byte order of vxlan-gpe port number virtio-net: restore VIRTIO_HDR_F_DATA_VALID on receiving virtio: don't set VIRTIO_NET_HDR_F_DATA_VALID on xmit net sched actions: fix refcnt when GETing of action after bind ax25: Fix segfault after sock connection timeout ip6_tunnel: Account for tunnel header in tunnel MTU ravb: do not use zero-length alignment DMA descriptor mlx4: do not call napi_schedule() without care openvswitch: maintain correct checksum state in conntrack actions tcp: fix tcp_fastopen unaligned access complaints on sparc net: systemport: Decouple flow control from __bcm_sysport_tx_reclaim net: ipv4: fix table id in getroute response net: lwtunnel: Handle lwtunnel_fill_encap failure mlxsw: pci: Fix EQE structure definition mlxsw: switchx2: Fix memory leak at skb reallocation mlxsw: spectrum: Fix memory leak at skb reallocation netvsc: add rcu_read locking to netvsc callback r8152: fix the sw rx checksum is unavailable FROMLIST: 9p: fix a potential acl leak ANDROID: sched/walt: use do_div instead of division operator ANDROID: sched: fix wrong truncation of walt_avg ANDROID: arm: Fix #if/#ifdef typo in topology.c ANDROID: arm: Fix build error "conflicting types for 'scale_cpu_capacity'" ANDROID: net: ipv6: remove unused variable ifindex in ANDROID: DEBUG: cpufreq: fix cpu_capacity tracing build for non-smp systems ANDROID: arm: topology: Define TC2 energy and provide it to the scheduler ANDROID: binder: fix format specifier for type binder_size_t Linux 4.9.7 drm/i915: Remove WaDisableLSQCROPERFforOCL KBL workaround. perf/core: Fix concurrent sys_perf_event_open() vs. 'move_group' race mm, memcg: do not retry precharge charges platform/x86: intel_mid_powerbtn: Set IRQ_ONESHOT platform/x86: mlx-platform: free first dev on error virtio_mmio: Set DMA masks appropriately memory_hotplug: make zone_can_shift() return a boolean value pinctrl: baytrail: Rectify debounce support pinctrl: uniphier: fix Ethernet (RMII) pin-mux setting for LD20 pinctrl: broxton: Use correct PADCFGLOCK offset s5k4ecgx: select CRC32 helper IB/rxe: Prevent from completer to operate on non valid QP IB/rxe: Fix rxe dev insertion to rxe_dev_list IB/umem: Release pid in error and ODP flow drm/i915: Check for NULL atomic state in intel_crtc_disable_noatomic() drm/i915: Fix calculation of rotated x and y offsets for planar formats drm/i915: Don't init hpd polling for vlv and chv from runtime_suspend() drm/i915: Don't leak edid in intel_crt_detect_ddc() drm/i915: prevent crash with .disable_display parameter drm/i915: Clear ret before unbinding in i915_gem_evict_something() v4l: tvp5150: Don't override output pinmuxing at stream on/off time v4l: tvp5150: Fix comment regarding output pin muxing v4l: tvp5150: Reset device at probe time, not in get/set format handlers pctv452e: move buffer to heap, no mutex iw_cxgb4: free EQ queue memory on last deref SUNRPC: cleanup ida information when removing sunrpc module NFSv4.0: always send mode in SETATTR after EXCLUSIVE4 NFSv4.1: Fix a deadlock in layoutget nfs: Don't increment lock sequence ID after NFS4ERR_MOVED parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header ARC: [arcompact] handle unaligned access delay slot corner case ARC: udelay: fix inline assembler by adding LP_COUNT to clobber list can: ti_hecc: add missing prepare and unprepare of the clock can: c_can_pci: fix null-pointer-deref in c_can_start() - set device pointer IB/srp: fix invalid indirect_sg_entries parameter value IB/srp: fix mr allocation when the device supports sg gaps IB/iser: Fix sg_tablesize calculation IB/cxgb3: fix misspelling in header guard s390/ptrace: Preserve previous registers for short regset write s390/mm: Fix cmma unused transfer from pgste into pte RDMA/cma: Fix unknown symbol when CONFIG_IPV6 is not enabled Btrfs: remove ->{get, set}_acl() from btrfs_dir_ro_inode_operations Btrfs: disable xattr operations on subvolume directories Btrfs: remove old tree_root case in btrfs_read_locked_inode() ISDN: eicon: silence misleading array-bounds warning xfs: prevent quotacheck from overloading inode lru sysctl: fix proc_doulongvec_ms_jiffies_minmax() userns: Make ucounts lock irq-safe vring: Force use of DMA API for ARM-based systems with legacy devices mm, page_alloc: fix premature OOM when racing with cpuset mems update mm, page_alloc: move cpuset seqcount checking to slowpath mm, page_alloc: fix fast-path race with cpuset update or removal mm, page_alloc: fix check for NULL preferred_zone mm/mempolicy.c: do not put mempolicy before using its nodemask mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp drm/atomic: clear out fence when duplicating state Revert "drm/radeon: always apply pci shutdown callbacks" drm/vc4: fix a bounds check drm/vc4: Return -EINVAL on the overflow checks failing. drm/vc4: Fix an integer overflow in temporary allocation layout. drm/vc4: Fix memory leak of the CRTC state. drm/i915: Ignore bogus plane coordinates on SKL when the plane is not visible drm: Fix broken VT switch with video=1366x768 option drm: Schedule the output_poll_work with 1s delay if we have delayed event tile/ptrace: Preserve previous registers for short regset write fbdev: color map copying bounds checking ANDROID: sched/walt: Drop arch-specific timer access ANDROID: sched/walt: include missing header for arm_timer_read_counter() ANDROID: fs: Export vfs_rmdir2 ANDROID: fs: Export free_fs_struct and set_fs_pwd ANDROID: cpufreq: interactive: Use idle-end notifiers FROMLIST: cpufreq: Add android's 'interactive' governor ANDROID: cpufreq: conservative: fix duplicate 'static' error ANDROID: sdcardfs: eliminate the offset argument to ->direct_IO ANDROID: sdcardfs: make it use new .rename i_op ANDROID: sdcardfs: Propagate dentry down to inode_change_ok() ANDROID: sdcardfs: get rid of 'parent' argument of ->d_compare() ANDROID: sdcardfs: add parent pointer into dentry name hash ANDROID: sdcardfs: use wrappers to access i_mutex ANDROID: mnt: remount should propagate to slaves of slaves ANDROID: sdcardfs: Fix locking issue with permision fix up ANDROID: sdcardfs: Switch ->d_inode to d_inode() ANDROID: sdcardfs: Change magic value ANDROID: sdcardfs: Use per mount permissions ANDROID: sdcardfs: Add gid and mask to private mount data ANDROID: sdcardfs: User new permission2 functions ANDROID: vfs: Add permission2 for filesystems with per mount permissions ANDROID: vfs: Add setattr2 for filesystems with per mount permissions ANDROID: vfs: Allow filesystems to access their private mount data ANDROID: mnt: Add filesystem private data to mount points ANDROID: sdcardfs: Move directory unlock before touch ANDROID: sdcardfs: fix external storage exporting incorrect uid ANDROID: sdcardfs: Added top to sdcardfs_inode_info ANDROID: sdcardfs: Switch package list to RCU ANDROID: sdcardfs: Fix locking for permission fix up ANDROID: sdcardfs: Check for other cases on path lookup ANDROID: sdcardfs: override umask on mkdir and create ANDROID: sched/debug: Add energy procfs interface ANDROID: cpufreq: sched: Fix kernel crash on accessing sysfs file ANDROID: FIXUP: sched/tune: add fixes missing from a previous patch ANDROID: sched: tune: Fix lacking spinlock initialization ANDROID: cgroup: Remove leftover instances of allow_attach ANDROID: FIXUP: sched: scheduler-driven cpu frequency selection ANDROID: sched/rt: Add Kconfig option to enable panicking for RT throttling ANDROID: sched/rt: print RT tasks when RT throttling is activated ANDROID: sched/fair: Favor higher cpus only for boosted tasks ANDROID: sched/fair: call OPP update when going idle after migration ANDROID: sched/cpufreq_sched: fix thermal capping events ANDROID: sched/fair: Picking cpus with low OPPs for tasks that prefer idle CPUs ANDROID: FIXUP: sched/tune: do initialization as a postcore_initicall ANDROID: DEBUG: sched: add tracepoint for RD overutilized ANDROID: sched/tune: Introducing a new schedtune attribute prefer_idle ANDROID: sched: use util instead of capacity to select busy cpu ANDROID: arch_timer: add error handling when the MPM global timer is cleared ANDROID: FIXUP: sched: Fix double-release of spinlock in move_queued_task ANDROID: FIXUP: sched/fair: Fix hang during suspend in sched_group_energy ANDROID: FIXUP: sched: fix SchedFreq integration for both PELT and WALT ANDROID: sched: EAS: Avoid causing spikes to max-freq unnecessarily ANDROID: FIXUP: sched: fix set_cfs_cpu_capacity when WALT is in use ANDROID: sched/walt: Accounting for number of irqs pending on each core ANDROID: sched: Introduce Window Assisted Load Tracking (WALT) ANDROID: sched/tune: fix PB and PC cuts indexes definition ANDROID: sched/fair: optimize idle cpu selection for boosted tasks ANDROID: FIXUP: sched/tune: fix accounting for runnable tasks ANDROID: sched/tune: use a single initialisation function ANDROID: FIXUP: sched/tune: fix payoff calculation for boost region ANDROID: sched/tune: Add support for negative boost values ANDROID: FIX: sched/tune: move schedtune_nornalize_energy into fair.c ANDROID: FIX: sched/tune: update usage of boosted task utilisation on CPU selection ANDROID: sched/fair: add tunable to set initial task load ANDROID: sched/fair: add tunable to force selection at cpu granularity ANDROID: sched: EAS: take cstate into account when selecting idle core ANDROID: sched/cpufreq_sched: Consolidated update ANDROID: FIXUP: sched: fix build for non-SMP target ANDROID: DEBUG: sched/tune: add tracepoint on P-E space filtering ANDROID: DEBUG: sched/tune: add tracepoint for energy_diff() values ANDROID: DEBUG: sched/tune: add tracepoint for task boost signal CHROMIUM: sched: update the average of nr_running ANDROID: DEBUG: schedtune: add tracepoint for schedtune_tasks_update() values ANDROID: DEBUG: schedtune: add tracepoint for CPU boost signal ANDROID: DEBUG: schedtune: add tracepoint for SchedTune configuration update ANDROID: DEBUG: sched,cpufreq: add cpu_capacity change tracepoint ANDROID: DEBUG: sched: add tracepoint for CPU load/util signals ANDROID: DEBUG: sched: add tracepoint for task load/util signals ANDROID: DEBUG: sched: add tracepoint for cpu/freq scale invariance ANDROID: sched/fair: filter energy_diff() based on energy_payoff value ANDROID: sched/tune: add support to compute normalized energy ANDROID: sched/fair: keep track of energy/capacity variations ANDROID: sched/fair: add boosted task utilization ANDROID: sched/{fair,tune}: track RUNNABLE tasks impact on per CPU boost value ANDROID: sched/tune: compute and keep track of per CPU boost value ANDROID: sched/tune: add initial support for CGroups based boosting ANDROID: sched/fair: add boosted CPU usage ANDROID: sched/fair: add function to convert boost value into "margin" ANDROID: sched/tune: add sysctl interface to define a boost value ANDROID: sched/tune: add detailed documentation ANDROID: fixup! sched: scheduler-driven cpu frequency selection ANDROID: sched: remove call of sched_avg_update from sched_rt_avg_update ANDROID: sched/cpufreq_sched: add trace events ANDROID: sched/fair: jump to max OPP when crossing UP threshold ANDROID: sched/fair: cpufreq_sched triggers for load balancing ANDROID: sched/{core,fair}: trigger OPP change request on fork() ANDROID: sched/fair: add triggers for OPP change requests ANDROID: sched: scheduler-driven cpu frequency selection ANDROID: cpufreq: introduce cpufreq_driver_is_slow ANDROID: sched: Add group_misfit_task load-balance type ANDROID: sched: Add per-cpu max capacity to sched_group_capacity ANDROID: sched: Do eas idle balance regardless of the rq avg idle value ANDROID: arm64: Enable max freq invariant scheduler load-tracking and capacity support ANDROID: arm: Enable max freq invariant scheduler load-tracking and capacity support ANDROID: sched: Update max cpu capacity in case of max frequency constraints ANDROID: cpufreq: Max freq invariant scheduler load-tracking and cpu capacity support ANDROID: sched: Disable energy-unfriendly nohz kicks ANDROID: sched: Consider a not over-utilized energy-aware system as balanced ANDROID: sched: Energy-aware wake-up task placement ANDROID: sched: Determine the current sched_group idle-state ANDROID: sched, cpuidle: Track cpuidle state index in the scheduler ANDROID: sched: Add over-utilization/tipping point indicator ANDROID: sched: Estimate energy impact of scheduling decisions ANDROID: sched: Extend sched_group_energy to test load-balancing decisions ANDROID: sched: Calculate energy consumption of sched_group ANDROID: sched: Highest energy aware balancing sched_domain level pointer ANDROID: sched: Relocated cpu_util() and change return type ANDROID: sched: Compute cpu capacity available at current frequency ANDROID: sched: Support for extracting EAS energy costs from DT ANDROID: arm64, topology: Updates to use DT bindings for EAS costing data ANDROID: arm64: Cpu invariant scheduler load-tracking and capacity support ANDROID: arm: Cpu invariant scheduler load-tracking and capacity support ANDROID: sched: Introduce SD_SHARE_CAP_STATES sched_domain flag ANDROID: sched: Initialize energy data structures ANDROID: sched: Make energy awareness a sched feature ANDROID: sched: Documentation for scheduler energy cost model ANDROID: sched: Prevent unnecessary active balance of single task in sched group ANDROID: sched: Enable idle balance to pull single task towards cpu with higher capacity ANDROID: sched: Consider spare cpu capacity at task wake-up ANDROID: sched: Add cpu capacity awareness to wakeup balancing ANDROID: arm: Update arch_scale_cpu_capacity() to reflect change to define ANDROID: arm64: Enable frequency invariant scheduler load-tracking support ANDROID: arm: Enable frequency invariant scheduler load-tracking support ANDROID: cpufreq: Frequency invariant scheduler load-tracking support ANDROID: [CPUFREQ] Don't export governors for default governor ANDROID: kernel/configs: recommended: CONFIG_ARM64_SW_TTBR0_PAN=y ANDROID: kernel/configs: base: Enable QUOTA related configs ANDROID: kernel/configs: recommended: Enable MEMORY_STATE_TIME FROMLIST: config: android-base: enable hardened usercopy and kernel ASLR FROMLIST: config: android-recommended: disable aio support ANDROID: kernel/configs: recommended: enable fstack-protector-strong ANDROID: kernel/configs: base: enable UID_CPUTIME ANDROID: kernel/configs: base: restrict access to perf events ANDROID: configs: base: enable configfs gadget functions ANDROID: configs: merge AOSP config fragments ANDROID: Implement memory_state_time, used by qcom,cpubw ANDROID: dm: rebase for 4.9 ANDROID: usb: otg-wakelock: Remove wakelock.h dependencies ANDROID: gpio_matrix: Remove wakelock.h dependencies ANDROID: fiq_debugger: Remove wakelock.h dependencies UPSTREAM: net: socket: don't set sk_uid to garbage value in ->setattr() ANDROID: trace: net: use %pK for kernel pointers UPSTREAM: net: ipv4: Don't crash if passing a null sk to ip_rt_update_pmtu. UPSTREAM: net: inet: Support UID-based routing in IP protocols. UPSTREAM: net: core: add UID to flows, rules, and routes UPSTREAM: net: core: Add a UID field to struct sock. ANDROID: fs: FS tracepoints to track IO. ANDROID: MMC/UFS IO Latency Histograms. CHROMIUM: fix warning when releasing active sync point ANDROID: goldfish_pipe: fix allmodconfig build ANDROID: goldfish: goldfish_pipe: fix locking errors ANDROID: goldfish_pipe: fix call_kern.cocci warnings ANDROID: goldfish_pipe: An implementation of more parallel pipe ANDROID: goldfish_pipe: bugfixes and performance improvements. ANDROID: goldfish: disable GOLDFISH_SYNC ANDROID: goldfish: enable CONFIG_INET_DIAG_DESTROY ANDROID: build: fix build config kernel_dir ANDROID: dm verity: add minimum prefetch size ANDROID: build: add build server configs for goldfish UPSTREAM: trace: Update documentation for mono, mono_raw and boot clock UPSTREAM: trace: Add an option for boot clock as trace clock UPSTREAM: timekeeping: Add a fast and NMI safe boot clock ANDROID: video: goldfishfb: fix platform_no_drv_owner.cocci warnings ANDROID: arm64: rename ranchu defconfig to ranchu64 ANDROID: arch: x86: disable pic for Android toolchain ANDROID: goldfish: Add goldfish sync driver ANDROID: goldfish: add ranchu defconfigs ANDROID: goldfish_audio: Clear audio read buffer status after each read ANDROID: goldfish_events: no extra EV_SYN; register goldfish ANDROID: goldfish_fb: Set pixclock = 0 ANDROID: goldfish: Enable ACPI-based enumeration for goldfish audio ANDROID: goldfish: Enable ACPI-based enumeration for goldfish framebuffer ANDROID: video: goldfishfb: add devicetree bindings ANDROID: usb: gadget: function: cleanup: Add blank line after declaration ANDROID: usb: gadget: f_mtp: simplify ptp NULL pointer check ANDROID: usb: gadget: audio_source: fix comparison of distinct pointer types ANDROID: binder: support for file-descriptor arrays. ANDROID: binder: support for scatter-gather. ANDROID: binder: add extra size to allocator. ANDROID: binder: refactor binder_transact() ANDROID: binder: support multiple /dev instances. ANDROID: binder: deal with contexts in debugfs. ANDROID: binder: support multiple context managers. ANDROID: binder: split flat_binder_object. ANDROID: [RFC]cgroup: Change from CAP_SYS_NICE to CAP_SYS_RESOURCE for cgroup migration permissions CHROMIUM: cgroups: relax permissions on moving tasks between cgroups ANDROID: dm: android-verity: Remove fec_header location constraint ANDROID: fiq_debugger: Pass task parameter to unwind_frame() ANDROID: input: keyreset: switch to orderly_reboot ANDROID: cpuset: Make cpusets restore on hotplug ANDROID: Don't show empty tag stats for unprivileged uids ANDROID: dm: android-verity: Allow android-verity to be compiled as an independent module ANDROID: dm-verity: adopt changes made to dm callbacks ANDROID: dm verity fec: pack the fec_header structure ANDROID: dm: android-verity: Verify header before fetching table ANDROID: dm: allow adb disable-verity only in userdebug ANDROID: dm: mount as linear target if eng build ANDROID: dm: use default verity public key ANDROID: dm: fix signature verification flag ANDROID: dm: use name_to_dev_t ANDROID: dm: rename dm-linear methods for dm-android-verity ANDROID: dm: Minor cleanup ANDROID: dm: Mounting root as linear device when verity disabled ANDROID: dm-android-verity: Rebase on top of 4.1 ANDROID: dm: Add android verity target ANDROID: dm: fix dm_substitute_devices() ANDROID: dm: Rebase on top of 4.9 CHROMIUM: dm: boot time specification of dm= ANDROID: usb: gadget: f_accessory: remove duplicate endpoint alloc ANDROID: sdcardfs: fix itnull.cocci warnings ANDROID: sdcardfs: Truncate packages_gid.list on overflow ANDROID: netfilter: xt_quota2: make quota2_log work well ANDROID: cpu: send KOBJ_ONLINE event when enabling cpus ANDROID: dm verity fec: initialize recursion level ANDROID: dm verity fec: add missing release from fec_ktype ANDROID: dm verity fec: limit error correction recursion FROMLIST: security,perf: Allow further restriction of perf_event_open ANDROID: ARM64: Ignore Image-dtb from git point of view ANDROID: arm64: add option to build Image-dtb ANDROID: usb: gadget: f_midi: set fi->f to NULL when free f_midi function ANDROID: xt_qtaguid: Fix panic caused by processing non-full socket. ANDROID: fiq_debugger: Add fiq_debugger.disable option FROMLIST: wlcore: Disable filtering in AP role ANDROID: fiq_debugger: Add option to apply uart overlay by FIQ_DEBUGGER_UART_OVERLAY ANDROID: usb: dual-role: make stub functions inline ANDROID: quick selinux support for tracefs ANDROID: xt_qtaguid: Fix panic caused by synack processing ANDROID: fuse: Add support for d_canonical_path ANDROID: vfs: change d_canonical_path to take two paths ANDROID: netfilter: xt_qtaguid: seq_printf fixes ANDROID: mmc: Add CONFIG_MMC_SIMULATE_MAX_SPEED ANDROID: dm verity fec: add sysfs attribute fec/corrected ANDROID: mm: Export do_munmap ANDROID: sdcardfs: remove unneeded __init and __exit ANDROID: sdcardfs: Remove unused code ANDROID: fs: Export d_absolute_path ANDROID: sdcardfs: remove effectless config option ANDROID: inotify: Fix erroneous update of bit count ANDROID: fs: sdcardfs: Declare LOOKUP_CASE_INSENSITIVE unconditionally ANDROID: trace: cpufreq: fix typo in min/max cpufreq ANDROID: sdcardfs: Add support for d_canonical_path ANDROID: vfs: add d_canonical_path for stacked filesystem support ANDROID: sdcardfs: Bring up to date with Android M permissions: ANDROID: Changed type-casting in packagelist management ANDROID: Port of sdcardfs to 4.4 ANDROID: Included sdcardfs source code for kernel 3.0 ANDROID: usb: gadget: Add support for MTP OS desc CHROMIUM: usb: gadget: f_accessory: add .raw_request callback CHROMIUM: usb: gadget: audio_source: add .free_func callback CHROMIUM: usb: gadget: f_mtp: fix usb_ss_ep_comp_descriptor CHROMIUM: usb: gadget: f_mtp: Add SuperSpeed support ANDROID: dm-crypt: run in a WQ_HIGHPRI workqueue ANDROID: power: Provide dummy log_suspend_abort_reason() if SUSPEND is disabled ANDROID: PM / suspend: Add dependency on RTC_LIB ANDROID: net: pppolac/pppopns: Replace msg.msg_iov with iov_iter_kvec() ANDROID: mmc: sdio: Disable retuning in sdio_reset_comm() ANDROID: kernel/watchdog: fix unused variable warning ANDROID: usb: gadget: f_mtp: don't use le16 for u8 field ANDROID: lowmemorykiller: fix declaration order warnings ANDROID: mmc: move to a SCHED_FIFO thread ANDROID: skip building drivers as modules ANDROID: wakeup: Add the guard condition for len in pm_get_active_wakeup_sources ANDROID: goldfish: pipe: fix platform_no_drv_owner.cocci warnings ANDROID: epoll: use freezable blocking call ANDROID: Fix for in kernel emergency remount when loop mounts are used ANDROID: kbuild: Makefile.clean: make Kbuild and Makefile optional ANDROID: kbuild: make it possible to specify the module output dir ANDROID: ext4: Add support for FIDTRIM, a best-effort ioctl for deep discard trim ANDROID: hardlockup: detect hard lockups without NMIs using secondary cpus ANDROID: rtc-palmas: correct for bcd year ANDROID: w1: ds2482: Manage SLPZ pin sleep state ANDROID: fuse: Freeze client on suspend when request sent to userspace ANDROID: serial_core: Add wake_peer uart operation ANDROID: mm: add a field to store names for private anonymous memory ANDROID: pstore/ram: Add ramoops_console_write_buf api ANDROID: pstore: Update Documentation/android.txt ANDROID: initramfs: Add skip_initramfs command line option ANDROID: of: Fix build warnings ANDROID: of: fix CONFIG_CMDLINE_EXTEND ANDROID: ARM64: copy CONFIG_CMDLINE_EXTEND from ARM ANDROID: of: Support CONFIG_CMDLINE_EXTEND config option ANDROID: ARM: decompressor: Flush tlb before swiching domain 0 to client mode ANDROID: ARM64: add option to build Image.gz/dtb combo ANDROID: ARM: convert build of appended dtb zImage to list of dtbs ANDROID: ARM: add config option to build zImage/dtb combo ANDROID: ARM: Fix dtb list when DTB_IMAGE_NAMES is empty ANDROID: arm64: pass return address to dma_common_contiguous_remap ANDROID: arch: arm64: force -fno-pic ANDROID: arm64: process: dump memory around registers when displaying regs ANDROID: arm64: check for upper PAGE_SHIFT bits in pfn_valid() ANDROID: ARM: fault: assume no context when IRQs are disabled during data abort. ANDROID: ARM: Fix "Make low-level printk work" to use a separate config option ANDROID: ARM: add option to flush console before reboot ANDROID: ARM: Make low-level printk work ANDROID: Optionally flush entire dcache from v6_dma_flush_range ANDROID: process: Add display of memory around registers when displaying regs. ANDROID: security: Add proper checks for Android specific capability checks ANDROID: uid_cputime: skip power reporting per uid for now ANDROID: uid_cputime: Check for the range while removing range of UIDs. ANDROID: uid_cputime: Iterates over all the threads instead of processes. ANDROID: uid_cputime: fix cputime overflow ANDROID: uid_cputime: Avoids double accounting of process stime, utime and cpu_power in task exit. ANDROID: uid_cputime: Extends the cputime functionality to report power per uid ANDROID: proc: uid_cputime: fix show_uid_stat permission ANDROID: proc: uid_cputime: create uids from kuids ANDROID: proc: uid: Adds accounting for the cputimes per uid. ANDROID: fixup! proc: make oom adjustment files user read-only ANDROID: proc: make oom adjustment files user read-only ANDROID: proc: smaps: Allow smaps access for CAP_SYS_RESOURCE ANDROID: wakeup_reason: use vsnprintf instead of snsprintf for vargs. ANDROID: power: wakeup_reason: fix suspend time reporting ANDROID: wakeup: Add last wake up source logging for suspend abort reason. ANDROID: Power: Report suspend times from last_suspend_time ANDROID: Make suspend abort reason logging depend on CONFIG_PM_SLEEP ANDROID: power: Add check_wakeup_reason() to verify wakeup source irq ANDROID: power: Adds functionality to log the last suspend abort reason. ANDROID: power: Avoids bogus error messages for the suspend aborts. ANDROID: power: Add property CHARGE_COUNTER_EXT and 64-bit precision properties ANDROID: Power: Changes the permission to read only for sysfs file /sys/kernel/wakeup_reasons/last_resume_reason ANDROID: power: wakeup_reason: rename irq_count to irqcount ANDROID: Power: Add guard condition for maximum wakeup reasons ANDROID: POWER: fix compile warnings in log_wakeup_reason ANDROID: Power: add an API to log wakeup reasons ANDROID: PM / Suspend: Print wall time at suspend entry and exit ANDROID: power: power_supply: add POWER_SUPPLY_PROP_CHARGE_ENABLED ANDROID: power: power_supply: add POWER_SUPPLY_PROP_USB_OTG ANDROID: power: power_supply: move POWER_SUPPLY_PROP_USB_HC to type 'int' order ANDROID: power_supply: Add custom property for USB High Current mode ANDROID: trace: power: add trace_clock_set_parent ANDROID: trace: cpufreq: Add tracing for min/max cpufreq ANDROID: trace: fix compilation for 4.1 ANDROID: trace/events: fix gpu event timestamp formatting ANDROID: trace: add non-hierarchical function_graph option ANDROID: trace: Add an option to show tgids in trace output ANDROID: trace/events: add gpu trace events ANDROID: sync: add Documentation/sync.txt ANDROID: ARM: Call idle notifiers ANDROID: Move x86_64 idle notifiers to generic ANDROID: cpuidle: governor: menu: don't use loadavg ANDROID: sched: add sched blocked tracepoint which dumps out context of sleep. ANDROID: sched: Enable might_sleep before initializing drivers. ANDROID: fiq_debugger: Build fixes for 4.1 ANDROID: fiq_debugger: Add fiq_watchdog_triggered api ANDROID: fiq_debugger: Call fiq_debugger_printf through a function pointer from cpu specific code ANDROID: fiq_debugger: add ARM64 support ANDROID: fiq_debugger: split arm support into fiq_debugger_arm.c ANDROID: fiq_debugger: use pt_regs for registers ANDROID: fiq_debugger: allow compiling without CONFIG_FIQ_GLUE ANDROID: fiq_debugger: rename debug->fiq_debugger ANDROID: fiq_debugger: move into drivers/staging/android/fiq_debugger/ ANDROID: ARM: fiq_glue: Add custom fiq return handler api. ANDROID: ARM: kgdb: ignore breakpoint instructions from user mode ANDROID: ARM: fiq_debugger: Update tty code for 3.9 ANDROID: ARM: fiq_debugger: Use kmsg_dumper to dump kernel logs ANDROID: ARM: fiq_debugger: Fix to compile on 3.7 ANDROID: ARM: fiq_debugger: fix uninitialised spin_lock. ANDROID: ARM: fiq_debugger: lock between tty and console writes ANDROID: ARM: fiq_debugger: add process context reboot command ANDROID: ARM: fiq_debugger: fix multiple consoles and make it a preferred console ANDROID: kdb: support new lines without carriage returns ANDROID: ARM: fiq_debugger: add support for kgdb ANDROID: ARM: fiq_debugger: add debug_putc ANDROID: ARM: fiq_debugger: add support for reboot commands ANDROID: ARM: fiq_debugger: fix compiling for v3.3 ANDROID: ARM: Add generic fiq serial debugger ANDROID: ARM: Add fiq_glue ANDROID: fix false disconnect due to a signal sent to the reading process ANDROID: usb: gadget: cleanup: fix unused variable and function warnings ANDROID: usb: gadget: build audio_source function only if SND is enabled ANDROID: usb: gadget: configfs: handle gadget reset request for android ANDROID: usb: gadget: create F_midi device ANDROID: usb: gadget: Add device attribute to determine gadget state ANDROID: usb: phy: fix dual role sysfs build if kernel modules are supported ANDROID: usb: phy: Dual role sysfs class definition ANDROID: usb: gadget: fix NULL ptr derefer while symlinking PTP func ANDROID: usb:gadget:Add "state" attribute to android_device ANDROID: usb: gadget: Do not disconnect unregistered dev ANDROID: usb: gadget: Relocate f_accessory ANDROID: usb: gadget: Accessory:Migrate to USB_FUNCTION API ANDROID: usb: gadget: Move gadget functions code ANDROID: usb:gadget:audio_source: Move to USB_FUNCTION API ANDROID: usb: gadget: Add function devices to the parent ANDROID: usb: gadget: f_audio_source:replace deprecated API ANDROID: usb: gadget: check for accessory device before disconnecting HIDs ANDROID: usb: gadget: Add Uevent to notify userspace ANDROID: usb: gadget: configfs: Add usb_function ptr to fi struct ANDROID: usb: gadget: mtp/ptp: Migrate functions to the USB_FUNCTION interface Linux 4.9.6 libceph: stop allocating a new cipher on every crypto request libceph: uninline ceph_crypto_key_destroy() tools/virtio/ringtest: fix run-on-all.sh for offline cpus selftest/powerpc: Wrong PMC initialized in pmc56_overflow test soc: ti: wkup_m3_ipc: Fix error return code in wkup_m3_ipc_probe() spi: pxa2xx: add missed break dmaengine: pl330: Fix runtime PM support for terminated transfers dmaengine: rcar-dmac: unmap slave resource when channel is freed s5p-mfc: Fix clock management in s5p_mfc_release() function s5p-cec: mark PM functions as __maybe_unused again st-hva: fix some error handling in hva_hw_probe() ite-cir: initialize use_demodulator before using it gs1662: drop kfree for memory allocated with devm_kzalloc platform: pxa_camera: add VIDEO_V4L2 dependency blackfin: check devm_pinctrl_get() for errors rpmsg: virtio_rpmsg_bus: fix channel creation mtd: spi-nor: Fix some error codes in cqspi_setup_flash() mtd: spi-nor: Off by one in cqspi_setup_flash() PM / devfreq: Fix the bug of devfreq_add_device when governor is NULL PM / devfreq: exynos-bus: Fix the wrong return value scsi: mpt3sas: fix hang on ata passthrough commands scsi: ses: Fix SAS device detection in enclosure swiotlb: Add swiotlb=noforce debug option swiotlb: Convert swiotlb_force from int to enum arm64: Fix swiotlb fallback allocation arm64: mm: avoid name clash in __page_to_voff() xprtrdma: Squelch "max send, max recv" messages at connect time xprtrdma: Make FRWR send queue entry accounting more accurate libceph: make sure ceph_aes_crypt() IV is aligned ceph: fix endianness bug in frag_tree_split_cmp ceph: fix endianness of getattr mask in ceph_d_revalidate ceph: fix ceph_get_caps() interruption ceph: fix scheduler warning due to nested blocking ARM: 8613/1: Fix the uaccess crash on PB11MPCore ARM: ux500: fix prcmu_is_cpu_in_wfi() calculation ARM: dts: omap3: Fix Card Detect and Write Protect on Logic PD SOM-LV ARM: dts: imx6qdl-nitrogen6_max: fix sgtl5000 pinctrl init ARM: dts: omap2: Add an empty chosen node to top level DTSI ARM: dts: omap3: Add an empty chosen node to top level DTSI ARM: dts: am4372: Add an empty chosen node to top level DTSI ARM: dts: omap5: Add an empty chosen node to top level DTSI ARM: dts: omap4: Add an empty chosen node to top level DTSI ARM: dts: am33xx: Add an empty chosen node to top level DTSI ARM: dts: dm814x: Add an empty chosen node to top level DTSI ARM: dts: dm816x: Add an empty chosen node to top level DTSI ARM: dts: dra7: Add an empty chosen node to top level DTSI libceph: remove now unused ceph_*{en,de}crypt*() functions libceph: switch ceph_x_decrypt() to ceph_crypt() libceph: switch ceph_x_encrypt() to ceph_crypt() libceph: tweak calcu_signature() a little libceph: rename and align ceph_x_authorizer::reply_buf libceph: introduce ceph_crypt() for in-place en/decryption libceph: introduce ceph_x_encrypt_offset() libceph: old_key in process_one_ticket() is redundant libceph: ceph_x_encrypt_buflen() takes in_len Input: ALPS - fix TrackStick support for SS5 hardware arm64/ptrace: Reject attempts to set incomplete hardware breakpoint fields arm64/ptrace: Avoid uninitialised struct padding in fpr_set() arm64/ptrace: Preserve previous registers for short regset write - 3 arm64/ptrace: Preserve previous registers for short regset write - 2 arm64/ptrace: Preserve previous registers for short regset write arm64: avoid returning from bad_mode ARM: dts: da850-evm: fix read access to SPI flash ARM: dts: OMAP5 / DRA7: indicate that SATA port 0 is available. ceph: fix bad endianness handling in parse_reply_info_extra ibmvscsis: Fix max transfer length ibmvscsis: Fix sleeping in interrupt context ARM: 8634/1: hw_breakpoint: blacklist Scorpion CPUs svcrdma: avoid duplicate dma unmapping during error recovery clocksource/exynos_mct: Clear interrupt when cpu is shut down ubifs: Fix journal replay wrt. xattr nodes mac80211: implement multicast forwarding on fast-RX path qla2xxx: Fix crash due to null pointer access x86/ioapic: Restore IO-APIC irq_chip retrigger callback powerpc: Ignore reserved field in DCSR and PVR reads and writes powerpc/ptrace: Preserve previous TM fprs/vsrs on short regset write powerpc/ptrace: Preserve previous fprs/vsrs on short regset write powerpc/perf: Fix PM_BRU_CMPL event code for power9 powerpc/icp-opal: Fix missing KVM case and harden replay KVM: arm/arm64: vgic: Fix deadlock on error handling KVM: s390: do not expose random data via facility bitmap mtd: nand: xway: fix build because of module functions mtd: nand: xway: disable module support mtd: nand: lpc32xx: fix invalid error handling of a requested irq ieee802154: atusb: do not use the stack for buffers to make them DMA able mmc: mxs-mmc: Fix additional cycles after transmission stop mmc: sdhci-acpi: Only powered up enabled acpi child devices HID: corsair: fix control-transfer error handling HID: corsair: fix DMA buffers on stack PCI: Enumerate switches below PCI-to-PCIe bridges PCI: designware: Check for iATU unroll only on platforms that use ATU fuse: fix time_to_jiffies nsec sanity check fuse: clear FR_PENDING flag when moving requests out of pending queue ARC: module: Fix !CONFIG_ARC_DW2_UNWIND builds libnvdimm, namespace: fix pmem namespace leak, delete when size set to zero svcrpc: don't leak contexts on PROC_DESTROY sunrpc: don't call sleeping functions from the notifier block callbacks rcu: Narrow early boot window of illegal synchronous grace periods rcu: Remove cond_resched() from Tiny synchronize_sched() x86/PCI: Ignore _CRS on Supermicro X8DTH-i/6/iF/6F tmpfs: clear S_ISGID when setting posix ACLs ARM: dts: omap3: Add DTS for Logic PD SOM-LV 37xx Dev Kit ARM: dts: imx31: fix AVIC base address ARM: dts: imx31: move CCM device node to AIPS2 bus devices ARM: dts: imx31: fix clock control module interrupts description ARM: dts: imx6q-cm-fx6: fix fec pinctrl ARM: dts: r8a7794: remove Z clock ARM: dts: r8a7794: Use SYSC "always-on" PM Domain for sound ARM: dts: bcm283x: fix typo in mailbox address perf jit: Enable jitdump support without dwarf perf scripting: Avoid leaking the scripting_context variable perf callchain: Fixup help/config for no-unwinding perf diff: Do not overwrite valid build id perf trace: Check if MAP_32BIT is defined (again) perf mem: Fix --all-user/--all-kernel options perf trace: Use the syscall raw_syscalls:sys_enter timestamp IB/IPoIB: Remove can't use GFP_NOIO warning IB/mlx4: Check if GRH is available before using it IB/mlx4: When no DMFS for IPoIB, don't allow NET_IF QPs IB/mlx4: Fix port query for 56Gb Ethernet links IB/mlx4: Handle well-known-gid in mad_demux processing IB/mlx4: Fix out-of-range array index in destroy qp flow IB/mlx4: Set traffic class in AH IB/mlx5: Wait for all async command completions to complete IB/mlx5: Assign SRQ type earlier IB/mlx5: Fix reported max SGE calculation IB/mlx5: Avoid system crash when enabling many VFs IB/rxe: avoid putting a large struct rxe_qp on stack IB/rxe: Increase max number of completions to 32k IB/core: Release allocated memory in cache setup failure Linux 4.9.5 ANDROID: usb: gadget: f_audio_source: Fixed USB Audio Class Interface Descriptor ANDROID: usb: gadget: f_audio_source: change max ISO packet size ANDROID: usb: gadget: f_accessory: Enabled Zero Length Packet (ZLP) for acc_write ANDROID: drivers: usb: gadget: 64-bit related type fixes ANDROID: usb: gadget: f_accessory: move userspace interface to uapi ANDROID: usb: gadget: f_mtp: move userspace interface to uapi ANDROID: USB: remove duplicate out endpoint creation in MTP mode ANDROID: usb: gadget: Fix android gadget driver build ANDROID: usb: gadget: Fixes and hacks to make android usb gadget compile on 3.8 ANDROID: usb: otg: otg-wakelock: Fix build for 3.7 ANDROID: usb: gadget: accessory: Fix section mismatch (again) ANDROID: USB: gadget: f_audio_source: New gadget driver for audio output ANDROID: USB: gadget: f_accessory: Add support for HID input devices ANDROID: USB: gadget: Add ACCESSORY_SET_AUDIO_MODE control request and ioctl ANDROID: usb: gadget: accessory: Fix section mismatch ANDROID: usb: otg: otg-wakelock: Fix build for 3.4 ANDROID: usb: gadget: adb: Only enable the gadget when adbd is ready ANDROID: usb: gadget: adb: do not set error flag when dequeuing req ANDROID: usb: gadget: adb: allow freezing in adb_read ANDROID: usb: gadget: accessory: Add Android Accessory function ANDROID: usb: gadget: adb: Add ADB function ANDROID: usb: gadget: mtp: Add MTP/PTP function ANDROID: usb: otg: otg-wakelock: fix build for 3.3 ANDROID: usb: otg: Temporarily grab wakelock on charger and disconnect events ANDROID: USB: OTG: Take wakelock when VBUS present ANDROID: wlan: Add get_wake_irq functionality ANDROID: Add flags parameter to get_country_code template ANDROID: net: wireless: Add get_country_code functionality to platform ANDROID: network: wireless: Add get_mac_addr functionality to platform ANDROID: wlan: Create generic wlan platform data header ANDROID: net: wireless: Decrease scan entry expiration to avoid stall results ANDROID: bridge: Have tx_bytes count headers like rx_bytes. ANDROID: rfkill: Introduce CONFIG_RFKILL_PM and use instead of CONFIG_PM to power down ANDROID: net: ipv6: fix virtual tunneling build ANDROID: tcp: fix tcp_default_init_rwnd() for 4.1 ANDROID: net: support marking accepting TCP sockets ANDROID: tcp: add a sysctl to config the tcp_default_init_rwnd ANDROID: xt_qtaguid: fix a race condition in if_tag_stat_update ANDROID: netfilter: xt_qtaguid/socket: build fixes for 4.4 ANDROID: netfilter: xt_qtaguid: xt_socket: build fixes ANDROID: net: xt_qtaguid/xt_socket: fix refcount underflow and crash ANDROID: xt_qtaguid: use sock_gen_put() instead of xt_socket_put_sk() ANDROID: xt_qtaguid: Use sk_callback_lock read locks before reading sk->sk_socket ANDROID: xt_qtaguid: fix broken uid/gid range check ANDROID: netfilter: Build fixups - kuid/kguid changes & xt_socket_get/put_sk ANDROID: net: ipv6: autoconf routes into per-device tables ANDROID: nf: IDLETIMER: Fix broken uid field in the msg ANDROID: nf: IDLETIMER: Adds the uid field in the msg ANDROID: netfilter: fix seq_printf type mismatch warning ANDROID: nf: Remove compilation error caused by e8430cbed3ef15fdb1ac26cfd020e010aa5f1c35 ANDROID: nf: IDLETIMER: time-stamp and suspend/resume handling. ANDROID: xt_qtaguid: Fix boot panic ANDROID: net: kuid/kguid build fixes ANDROID: netfilter: ipv6: fix crash caused by ipv6_find_hdr() ANDROID: netfilter: xt_qtaguid: 64-bit warning fixes ANDROID: netfilter: xt_qtaguid: fix memory leak in seq_file handlers ANDROID: netfilter: xt_qtaguid: fix bad tcp_time_wait sock handling ANDROID: netfilter: xt_qtaguid: 3.10 fixes ANDROID: netfilter: xt_quota2: 3.10 fixes. ANDROID: netfilter: qtaguid: rate limit some of the printks ANDROID: netfilter: xt_qtaguid: Allow tracking loopback ANDROID: netfilter: xt_qtaguid: extend iface stat to report protocols ANDROID: netfilter: xt_qtaguid: remove AID_* dependency for access control ANDROID: netfilter: qtaguid: Don't BUG_ON if create_if_tag_stat fails ANDROID: netfilter: xt_qtaguid: fix error exit that would keep a spinlock. ANDROID: netfilter: xt_qtaguid: report only uid tags to non-privileged processes ANDROID: netfilter: xt_qtaguid: start tracking iface rx/tx at low level ANDROID: netfilter: xt_IDLETIMER: Add new netlink msg type ANDROID: netfilter: xt_qtaguid: fix ipv6 protocol lookup ANDROID: netfilter: qtaguid: initialize a local var to keep compiler happy. ANDROID: netfilter: fixup the quota2, and enable. ANDROID: netfilter: adding the original quota2 from xtables-addons ANDROID: netfilter: add xt_qtaguid matching module ANDROID: net: PPPoPNS and PPPoLAC build fixes for 4.4 ANDROID: Hack: net: PPPoPNS and PPPoLAC build fixes for 4.1 ANDROID: net: pppopns: pppolac: fix sendmsg function calls ANDROID: net: PPPoPNS: Remove length argument from data_ready ANDROID: net: move PPPoLAC and PPPoPNS headers to uapi ANDROID: Include if_pppolac.h and if_pppopns.h into header-y target ANDROID: net: PPPoPNS and PPPoLAC update to use PPP_MRU instead of PPP_MRU ANDROID: net: Reorder incoming packets in PPPoLAC and PPPoPNS. ANDROID: net: PPPoPNS and PPPoLAC fixes. ANDROID: net: add PPP on PPTP Network Server (PPPoPNS) driver. ANDROID: net: add PPP on L2TP Access Concentrator (PPPoLAC) driver. ANDROID: sysfs_net_ipv4: Add sysfs-based knobs for controlling TCP window size ANDROID: net: Only NET_ADMIN is allowed to fully control TUN interfaces. ANDROID: net: Replace AID_NET_RAW checks with capable(CAP_NET_RAW). ANDROID: security: Add AID_NET_RAW and AID_NET_ADMIN capability check in cap_capable(). ANDROID: Paranoid network. ANDROID: Add android_aid.h ANDROID: fs: block_dump: Don't display inode changes if block_dump < 2 ANDROID: mmc: core: Remove stray CONFIG_EXPERIMENTAL dependencies ANDROID: mmc: Add "ignore mmc pm notify" functionality ANDROID: mmc: sdio: Fix sdio_reset_comm for sync ANDROID: mmc: sdio: fix sdio_reset_comm() voltage selection ANDROID: mmc: sdio: Fix enable_hs and enable_wide in sdio_reset_comm() ANDROID: mmc: sdio: Add high speed support to sdio_reset_comm() ANDROID: mmc: sdio: Claim host in sdio_reset_comm() ANDROID: mmc: Add new API call 'sdio_reset_comm' for resetting communication with an SDIO device ANDROID: mmc: Add sdio_readb_ext() function ANDROID: mmc: Add concept of an 'embedded' SDIO device. ANDROID: mmc: sd: Add retries in re-detection ANDROID: mmc: sd: When resuming, try a little harder to init the card ANDROID: mmc: sd: Add new CONFIG_MMC_PARANOID_SD_INIT for enabling retries during SD detection ANDROID: mtd: nand: Allow NAND chip ids to be included standalone. ANDROID: gpio_input: convert from wakelocks to wakeup sources ANDROID: input: Made keyreset more robust ANDROID: input: Changed keyreset to act as a wrapper for keycombo. ANDROID: input: add keycombo, a general key combo driver. ANDROID: input: misc: keychord: move header to uapi ANDROID: input: misc: keychord: log when keychord triggered ANDROID: input: keychord: Add keychord driver ANDROID: input: Add keyreset driver. ANDROID: input: misc: gpio_event: remove early suspend ANDROID: Input: Generic GPIO Input device. ANDROID: lowmemorykiller: use module_param_cb instead of __module_param_call ANDROID: lowmemorykiller: trace kill events. ANDROID: staging: lowmemorykiller: Add config option to support oom_adj values pinctrl: sh-pfc: Do not unconditionally support PIN_CONFIG_BIAS_DISABLE arm64: hugetlb: fix the wrong return value for huge_ptep_set_access_flags arm64: hugetlb: remove the wrong pmd check in find_num_contig() arm64: hugetlb: fix the wrong address for several functions powerpc/powernv: Don't warn on PE init if unfreeze is unsupported powerpc/ibmebus: Fix device reference leaks in sysfs interface powerpc/ibmebus: Fix further device reference leaks powerpc/mm: Correct process and partition table max size bus: vexpress-config: fix device reference leak blk-mq: Always schedule hctx->next_cpu power: supply: bq27xxx_battery: Fix register map for BQ27510 and BQ27520 bq24190_charger: Fix PM runtime use for bq24190_battery_set_property iw_cxgb4: Fix error return code in c4iw_rdev_open() powercap/intel_rapl: fix and tidy up error handling ACPI / APEI: Fix NMI notification handling block: cfq_cpd_alloc() should use @gfp block: Change extern inline to static inline ACPI / CPPC: set an error code on probe error path regulators: helpers: Fix handling of bypass_val_on in get_bypass_regmap cpufreq: powernv: Disable preemption while checking CPU throttling state powerpc/64: Simplify adaptation to new ISA v3.00 HPTE format remoteproc: st: Fix error return code in st_rproc_probe() remoteproc: qcom_wcnss: Fix circular module dependency drm: Initialise drm_mm.head_node.allocated drm/i915: Move the min_pixclk[] handling to the end of readout drm/panel: simple: Check against num_timings when setting preferred for timing drm: avoid uninitialized timestamp use in wait_vblank drm/i915/gen9: Fix PCODE polling during SAGV disabling i2c: mux: pca954x: fix i2c mux selection caching NFSv4.1: nfs4_fl_prepare_ds must be careful about reporting success. NFS: Fix a performance regression in readdir pNFS: Fix race in pnfs_wait_on_layoutreturn NFS: fix typo in parameter description pinctrl: meson: fix gpio request disabling other modes btrfs: fix error handling when run_delayed_extent_op fails btrfs: fix locking when we put back a delayed ref that's too new nvme: apply DELAY_BEFORE_CHK_RDY quirk at probe time too x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option i2c: piix4: Avoid race conditions with IMC net/mlx5: Only cancel recovery work when cleaning up device USB: serial: ch341: fix modem-control and B0 handling drm/amdgpu: drop verde dpm quirks drm/amdgpu: update si kicker smc firmware drm/radeon: drop verde dpm quirks drm/radeon: update smc firmware selection for SI drm: Clean up planes in atomic commit helper failure path drm/i915/gen9: Fix PCODE polling timeout in stable backport net/af_iucv: don't use paged skbs for TX on HiperSockets sysctl: Drop reference added by grab_header in proc_sys_readdir Clearing FIFOs in RS485 emulation mode causes subsequent transmits to break extcon: return error code on failure sysrq: attach sysrq handler correctly for 32-bit kernel orinoco: Use shash instead of ahash for MIC calculations ibmvscsis: Fix srp_transfer_data fail return code tty/serial: atmel_serial: BUG: stop DMA from transmitting in stop_tx tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done virtio_blk: avoid DMA to stack for the sense buffer dmaengine: omap-dma: Fix dynamic lch_map allocation drivers: char: mem: Fix thinkos in kmem address checks mnt: Protect the mountpoint hashtable with mount_lock pid: fix lockdep deadlock warning due to ucount_lock vme: Fix wrong pointer utilization in ca91cx42_slave_get Revert "tty: serial: 8250: add CON_CONSDEV to flags" ASoC: hdmi-codec: use unsigned type to structure members with bit-field btrfs: fix crash when tracepoint arguments are freed by wq callbacks xhci: fix deadlock at host remove by running watchdog correctly fix a fencepost error in pipe_advance() i2c: fix kernel memory disclosure in dev interface i2c: print correct device invalid address Input: elants_i2c - avoid divide by 0 errors on bad touchscreen data USB: serial: ch341: fix open and resume after B0 USB: serial: ch341: fix control-message error handling USB: serial: ch341: fix open error handling USB: serial: ch341: fix resume after reset USB: serial: ch341: fix initial modem-control state USB: serial: kl5kusb105: fix line-state error handling usb: musb: fix runtime PM in debugfs wusbcore: Fix one more crypto-on-the-stack bug x86/CPU/AMD: Fix Bulldozer topology x86/bugs: Separate AMD E400 erratum and C1E bug x86/cpu/AMD: Clean up cpu_llc_id assignment per topology feature bridge: netfilter: Fix dropping packets that moving through bridge interface xfs: Timely free truncated dirty pages gpio: Move freeing of GPIO hogs before numbing of the device nl80211: fix sched scan netlink socket owner destruction x86/efi: Don't allocate memmap through memblock after mm_init() efi/x86: Prune invalid memory map entries and fix boot regression efi/libstub/arm*: Pass latest memory map to the kernel KVM: x86: Introduce segmented_write_std KVM: x86: emulate FXSAVE and FXRSTOR KVM: x86: add asm_safe wrapper KVM: x86: add Align16 instruction flag KVM: x86: fix NULL deref in vcpu_scan_ioapic KVM: x86: flush pending lapic jump label updates on module unload jump_labels: API for flushing deferred jump label updates KVM: eventfd: fix NULL deref irqbypass consumer KVM: x86: fix emulation of "MOV SS, null selector" mm/hugetlb.c: fix reservation race when freeing surplus pages mm/slab.c: fix SLAB freelist randomization duplicate entries mm: support anonymous stable page mm, memcg: fix the active list aging for lowmem requests when memcg is enabled ocfs2: fix crash caused by stale lvb with fsdlm plugin mm: fix devm_memremap_pages crash, use mem_hotplug_{begin, done} mm: pmd dirty emulation in page fault handler dax: fix deadlock with DAX 4k holes zram: support BDI_CAP_STABLE_WRITES zram: revalidate disk under init_lock selftests: do not require bash for the generated test selftests: do not require bash to run netsocktests testcase drm/savage: dereferencing an error pointer drm/vc4: Fix a couple error codes in vc4_cl_lookup_bos() drm/tegra: dpaux: Fix error handling regulator: axp20x: Fix axp809 ldo_io registration error on cold boot regulator: tps65086: Fix 25mV ranges for BUCK regulators pinctrl: sh-pfc: Add helper to handle bias lookup table pinctrl: sh-pfc: r8a7795: Use lookup function for bias data pinctrl: imx: fix imx_pinctrl_desc initialization Input: i8042 - add Pegatron touchpad to noloop table Input: xpad - use correct product id for x360w controllers Linux 4.9.4 rtlwifi: rtl_usb: Fix missing entry in USB driver's private data rtlwifi: Fix enter/exit power_save drm/i915/gen9: Fix PCODE polling during CDCLK change notification ALSA: usb-audio: Add a quirk for Plantronics BT600 spi: mvebu: fix baudrate calculation for armada variant ARM: omap2+: am437x: rollback to use omap3_gptimer_timer_init() ARM: 8631/1: clkdev: Detect errors in clk_hw_register_clkdev() for mass registration ARM: OMAP4+: Fix bad fallthrough for cpuidle ARM: OMAP5: Fix build for PM code ARM: OMAP5: Fix mpuss_early_init bus: arm-ccn: Prevent hotplug callback leak svcrdma: Clear xpt_bc_xps in xprt_setup_rdma_bc() error exit arm ARM: qcom_defconfig: Fix MDM9515 LCC and GCC config ARM: zynq: Reserve correct amount of non-DMA RAM ARM: pxa: fix pxa25x interrupt init ARM64: dts: bcm2835: Fix bcm2837 compatible string ARM64: dts: bcm2837-rpi-3-b: remove incorrect pwr LED arm64: dts: mt8173: Fix auxadc node tools/virtio: fix READ_ONCE() powerpc: Fix build warning on 32-bit PPC ALSA: firewire-tascam: Fix to handle error from initialization of stream data HID: hid-cypress: validate length of report net: vrf: do not allow table id 0 net: ipv4: Fix multipath selection with vrf net/mlx5e: Remove WARN_ONCE from adaptive moderation code gro: Disable frag0 optimization on IPv6 ext headers gro: use min_t() in skb_gro_reset_offset() gro: Enter slow-path if there is no tailroom net: add the AF_QIPCRTR entries to family name tables net: dsa: Ensure validity of dst->ds[0] r8152: fix rx issue for runtime suspend r8152: split rtl8152_suspend function net: dsa: bcm_sf2: Utilize nested MDIO read/write net: dsa: bcm_sf2: Do not clobber b53_switch_ops bpf: change back to orig prog on too many passes net: vrf: Add missing Rx counters ipv4: Do not allow MAIN to be alias for new LOCAL w/ custom rules igmp: Make igmp group member RFC 3376 compliant flow_dissector: Update pptp handling to avoid null pointer deref. drop_monitor: consider inserted data in genlmsg_end drop_monitor: add missing call to genlmsg_end net: ipv4: dst for local input routes should use l3mdev if relevant net: fix incorrect original ingress device index in PKTINFO rtnl: stats - add missing netlink message size checks net/mlx5e: Disable netdev after close net/mlx5e: Don't sync netdev state when not registered net/mlx5: Prevent setting multicast macs for VFs net/mlx5: Mask destination mac value in ethtool steering rules net/mlx5: Avoid shadowing numa_node net/mlx5: Cancel recovery work in remove flow net/mlx5: Check FW limitations on log_max_qp before setting it net/sched: cls_flower: Fix missing addr_type in classify net: stmmac: Fix race between stmmac_drv_probe and stmmac_open net, sched: fix soft lockup in tc_classify ipv6: handle -EFAULT from skb_copy_bits inet: fix IP(V6)_RECVORIGDSTADDR for udp sockets sctp: sctp_transport_lookup_process should rcu_read_unlock when transport is null net: vrf: Drop conntrack data after pass through VRF device on Tx net: vrf: Fix NAT within a VRF Linux 4.9.3 usb: gadget: composite: always set ep->mult to a sensible value Revert "usb: gadget: composite: always set ep->mult to a sensible value" Revert "rtlwifi: Fix enter/exit power_save" tick/broadcast: Prevent NULL pointer dereference clocksource/dummy_timer: Move hotplug callback after the real timers xfs: fix max_retries _show and _store functions xfs: fix crash and data corruption due to removal of busy COW extents xfs: use the actual AG length when reserving blocks xfs: fix double-cleanup when CUI recovery fails xfs: use GPF_NOFS when allocating btree cursors xfs: ignore leaf attr ichdr.count in verifier during log replay xfs: don't cap maximum dedupe request length xfs: don't allow di_size with high bit set xfs: error out if trying to add attrs and anextents > 0 xfs: don't crash if reading a directory results in an unexpected hole xfs: complain if we don't get nextents bmap records xfs: check for bogus values in btree block headers xfs: forbid AG btrees with level == 0 xfs: handle cow fork in xfs_bmap_trace_exlist xfs: pass state not whichfork to trace_xfs_extlist xfs: Move AGI buffer type setting to xfs_read_agi xfs: pass post-eof speculative prealloc blocks to bmapi xfs: use new extent lookup helpers xfs_file_iomap_begin_delay xfs: clean up cow fork reservation and tag inodes correctly xfs: use new extent lookup helpers in __xfs_reflink_reserve_cow xfs: track preallocation separately in xfs_bmapi_reserve_delalloc() xfs: remove prev argument to xfs_bmapi_reserve_delalloc xfs: always succeed when deduping zero bytes xfs: factor rmap btree size into the indlen calculations xfs: new inode extent list lookup helpers xfs: fix unbalanced inode reclaim flush locking xfs: check minimum block size for CRC filesystems xfs: provide helper for counting extents from if_bytes xfs: don't BUG() on mixed direct and mapped I/O xfs: don't skip cow forks w/ delalloc blocks in cowblocks scan xfs: check return value of _trans_reserve_quota_nblks xfs: don't call xfs_sb_quota_from_disk twice tpm_tis: Check return values from get_burstcount. drm/i915/gen9: fix the WM memory bandwidth WA for Y tiling cases drm/i915/gen9: unconditionally apply the memory bandwidth WA drm/i915: disable PSR by default on HSW/BDW drm/radeon: Always store CRTC relative radeon_crtc->cursor_x/y values s390/pci: fix dma address calculation in map_sg s390/topology: always use s390 specific sched_domain_topology_level powerpc/pci/rpadlpar: Fix device reference leaks PCI: Enable access to non-standard VPD for Chelsio devices (cxgb3) PCI: Support INTx masking on ConnectX-4 with firmware x.14.1100+ PCI: Convert Mellanox broken INTx quirks to be for listed devices only PCI: Convert broken INTx masking quirks from HEADER to FINAL PCI: Add Mellanox device IDs PCI: rockchip: Correct the use of FTS mask PCI: rockchip: Fix negotiated lanes calculation staging: media: davinci_vpfe: unlock on error in vpfe_reqbufs() f2fs: hide a maybe-uninitialized warning f2fs: remove percpu_count due to performance regression md: fix refcount problem on mddev when stopping array. md: MD_RECOVERY_NEEDED is set for mddev->recovery crypto: arm64/aes-ce - fix for big endian crypto: arm64/aes-xts-ce: fix for big endian crypto: arm64/sha1-ce - fix for big endian crypto: arm64/aes-neon - fix for big endian crypto: arm64/aes-ccm-ce: fix for big endian crypto: arm/aes-ce - fix for big endian crypto: arm64/ghash-ce - fix for big endian crypto: arm64/sha2-ce - fix for big endian s390/crypto: unlock on error in prng_tdes_read() mm, compaction: fix NR_ISOLATED_* stats for pfn based migration mm: khugepaged: fix radix tree node leak in shmem collapse error path mm: khugepaged: close use-after-free race during shmem collapsing docs-rst: fix LaTeX \DURole renewcommand with Sphinx 1.3+ mm/hugetlb.c: use the right pte val for compare in hugetlb_cow rpmsg: qcom_smd: Correct return value for O_NONBLOCK mmc: mmc_test: Uninitialized return value genirq/affinity: Fix node generation from cpumask PM / wakeirq: Fix dedicated wakeirq for drivers not using autosuspend irqchip/bcm7038-l1: Implement irq_cpu_offline() callback PCI/MSI: Check for NULL affinity mask in pci_irq_get_affinity() ima: fix memory leak in ima_release_policy relay: check array offset before using it sbp-target: Fix second argument of percpu_ida_alloc() target/iscsi: Fix double free in lio_target_tiqn_addtpg() scsi: mvsas: fix command_active typo scsi: g_NCR5380: Fix release_region in error handling ASoC: samsung: i2s: Fixup last IRQ unsafe spin lock call ASoC: Intel: Skylake: Fix a shift wrapping bug ASoC: cht_bsw_rt5645: Fix leftover kmalloc ASoC: lpass-platform: initialize dma channel number iommu/vt-d: Flush old iommu caches for kdump when the device gets context mapped iommu/vt-d: Fix pasid table size encoding iommu/amd: Fix the left value check of cmd buffer iommu/amd: Missing error code in amd_iommu_init_device() clk: renesas: mstp: Support 8-bit registers for r7s72100 clk: imx31: fix rewritten input argument of mx31_clocks_init() clk: sunxi-ng: sun8i-h3: Set CLK_SET_RATE_PARENT for audio module clocks clk: sunxi-ng: sun8i-a23: Set CLK_SET_RATE_PARENT for audio module clocks clk: ti: dra7: fix "failed to lookup clock node gmac_gmii_ref_clk_div" boot message clk: clk-wm831x: fix a logic error clk: qcom: ipq806x: Fix board clk rates Input: synaptics-rmi4 - unlock on error hwmon: (lm90) fix temp1_max_alarm attribute hwmon: (g762) Fix overflows and crash seen when writing limit attributes hwmon: (nct7802) Fix overflows seen when writing into limit attributes hwmon: (ds620) Fix overflows seen when writing temperature limits hwmon: (amc6821) sign extension temperature hwmon: (scpi) Fix module autoload platform/x86: fujitsu-laptop: use brightness_set_blocking for LED-setting callbacks x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6 x86/prctl/uapi: Remove #ifdef for CHECKPOINT_RESTORE debugfs: improve DEFINE_DEBUGFS_ATTRIBUTE for !CONFIG_DEBUG_FS clk: renesas: cpg-mssr: Fix inverted debug check efi/efivar_ssdt_load: Don't return success on allocation failure cris: Only build flash rescue image if CONFIG_ETRAX_AXISFLASHMAP is selected ath10k: use the right length of "background" mfd: tps65217: Fix page fault on unloading modules ath10k: fix failure to send NULL func frame for 10.4 nl80211: Use different attrs for BSSID and random MAC addr in scan req mac80211: fix tid_agg_rx NULL dereference drm/i915: tune down the fast link training vs boot fail drm/i915/dp: add lane_count check in intel_dp_check_link_status usb: dwc3: gadget: always unmap EP0 requests usb: dwc3: ep0: explicitly call dwc3_ep0_prepare_one_trb() usb: dwc3: ep0: add dwc3_ep0_prepare_one_trb() iio: accel: st_accel: fix LIS3LV02 reading and scaling staging: iio: ad7606: fix improper setting of oversampling pins mei: move write cb to completion on credentials failures mei: bus: fix mei_cldev_enable KDoc mei: fix parameter rename KDoc USB: serial: io_ti: bind to interface after fw download dibusb: fix possible memory leak in dibusb_rc_query() ARM: dts: sun7i: bananapi-m1-plus: Enable USB PHY for USB host support arm64: dts: hip06: Correct hardware pin number of usb node USB: phy: am335x-control: fix device and of_node leaks ARM: dts: r8a7794: Correct hsusb parent clock usb: gadget: fix request length error for isoc transfer usb: gadget: Fix second argument of percpu_ida_alloc() USB: serial: kl5kusb105: abort on open exception path ALSA: usb-audio: Fix bogus error return in snd_usb_create_stream() usb: musb: blackfin: add bfin_fifo_offset in bfin_ops usb: gadget: udc: core: fix return code of usb_gadget_probe_driver() usb: hub: Move hub_port_disable() to fix warning if PM is disabled usb: musb: Fix trying to free already-free IRQ 4 usb: dwc3: gadget: Fix full speed mode usb: dwc3: pci: Fix dr_mode misspelling usb: dwc3: pci: add Intel Gemini Lake PCI ID xhci: Fix race related to abort operation xhci: Use delayed_work instead of timer for command timeout usb: xhci-mem: use passed in GFP flags instead of GFP_KERNEL USB: serial: mos7720: fix parallel probe USB: serial: mos7720: fix parport use-after-free on probe errors USB: serial: mos7720: fix use-after-free on probe errors USB: serial: mos7720: fix NULL-deref at open USB: serial: mos7840: fix NULL-deref at open USB: serial: kobil_sct: fix NULL-deref in write USB: serial: cyberjack: fix NULL-deref at open USB: serial: oti6858: fix NULL-deref at open USB: serial: io_edgeport: fix NULL-deref at open USB: serial: ti_usb_3410_5052: fix NULL-deref at open USB: serial: garmin_gps: fix memory leak on failed URB submit USB: serial: iuu_phoenix: fix NULL-deref at open USB: serial: io_ti: fix I/O after disconnect USB: serial: io_ti: fix another NULL-deref at open USB: serial: io_ti: fix NULL-deref at open USB: serial: spcp8x5: fix NULL-deref at open USB: serial: keyspan_pda: verify endpoints at probe USB: serial: pl2303: fix NULL-deref at open USB: serial: quatech2: fix sleep-while-atomic in close USB: serial: omninet: fix NULL-derefs at open and disconnect usb: return error code when platform_get_irq fails usb: xhci: hold lock over xhci_abort_cmd_ring() xhci: Handle command completion and timeout race usb: host: xhci: Fix possible wild pointer when handling abort command usb: xhci: fix return value of xhci_setup_device() xhci: free xhci virtual devices with leaf nodes first usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Apollo Lake usb: xhci: fix possible wild pointer usb: dwc3: core: avoid Overflow events usb: gadget: composite: Test get_alt() presence instead of set_alt() USB: dummy-hcd: fix bug in stop_activity (handle ep0) USB: fix problems with duplicate endpoint addresses USB: gadgetfs: fix checks of wTotalLength in config descriptors USB: gadgetfs: fix use-after-free bug USB: gadgetfs: fix unbounded memory allocation bug usb: gadgetfs: restrict upper bound on device configuration size usb: storage: unusual_uas: Add JMicron JMS56x to unusual device usb: musb: dsps: implement clear_ep_rxintr() callback usb: musb: core: add clear_ep_rxintr() to musb_platform_ops KVM: MIPS: Flush KVM entry code from icache globally KVM: MIPS: Don't clobber CP0_Status.UX KVM: x86: reset MMU on KVM_SET_VCPU_EVENTS drm/i915: Initialize overlay->last_flip properly drm/i915: Force VDD off on the new power seqeuencer before starting to use it drm/i915: Fix oops in overlay due to frontbuffer tracking drm/i915: Fix oopses in the overlay code due to i915_gem_active stuff gcc-plugins: update gcc-common.h for gcc-7 asm-prototypes: Clear any CPP defines before declaring the functions mac80211: initialize fast-xmit 'info' later pinctrl/amd: Set the level based on ACPI tables ARM: davinci: da850: don't add emac clock to lookup table twice HID: sensor-hub: Move the memset to sensor_hub_get_feature() parisc: Mark cr16 clocksource unstable on SMP systems parisc: Add line-break when printing segfault info fscrypt: fix renaming and linking special files ALSA: usb-audio: Fix irq/process data synchronization ALSA: hda - Apply asus-mode8 fixup to ASUS X71SL ALSA: hda - Fix up GPIO for ASUS ROG Ranger staging: octeon: Call SET_NETDEV_DEV() iio: bmi160: Fix time needed to sleep after command execution iio: max44000: correct value in illuminance_integration_time_available iio: common: st_sensors: fix channel data parsing Linux 4.9.2 drm/i915: Fix setting of boost freq tunable drm/i915: skip the first 4k of stolen memory on everything >= gen8 drm/i915: Initialize dev_priv->atomic_cdclk_freq at init time drm/i915: Fix cdclk vs. dev_cdclk mess when not recomputing things drm/i915/dsi: Do not clear DPOUNIT_CLOCK_GATE_DISABLE from vlv_init_display_clock_gating drm/i915/dsi: Fix chv_exec_gpio disabling the GPIOs it is setting net: mvpp2: fix dma unmapping of TX buffers for fragments sg_write()/bsg_write() is not fit to be called under KERNEL_DS kconfig/nconf: Fix hang when editing symbol with a long prompt target/user: Fix use-after-free of tcmu_cmds if they are expired libnvdimm, pfn: fix align attribute of, numa: Return NUMA_NO_NODE from disable of_node_to_nid() if nid not possible. powerpc/boot: Request no dynamic linker for boot wrapper powerpc/ps3: Fix system hang with GCC 5 builds powerpc/64e: Convert cmpi to cmpwi in head_64.S SUNRPC: fix refcounting problems with auth_gss messages. pNFS: Fix a deadlock between read resends and layoutreturn pNFS: Clear NFS_LAYOUT_RETURN_REQUESTED when invalidating the layout stateid pNFS: Don't clear the layout stateid if a layout return is outstanding pNFS: On error, do not send LAYOUTGET until the LAYOUTRETURN has completed nfs_write_end(): fix handling of short copies libceph: verify authorize reply on connect PCI: Check for PME in targeted sleep state i40iw: Use correct src address in memcpy to rdma stats counters bad_inode: add missing i_op initializers Input: drv260x - fix input device's parent assignment v4l: tvp5150: Add missing break in set control handler media: solo6x10: fix lockup by avoiding delayed register write s5p-mfc: fix failure path of s5p_mfc_alloc_memdev() mn88473: fix chip id check on probe mn88472: fix chip id check on probe IB/cma: Fix a race condition in iboe_addr_get_sgid() IB/rxe: Fix a memory leak in rxe_qp_cleanup() IB/multicast: Check ib_find_pkey() return value IPoIB: Avoid reading an uninitialized member variable IB/mad: Fix an array index check fgraph: Handle a case where a tracer ignores set_graph_notrace x86/smpboot: Make logical package management more robust platform/x86: asus-nb-wmi.c: Add X45U quirk ftrace/x86_32: Set ftrace_stub to weak to prevent gcc from using short jumps to it vsock/virtio: fix src/dst cid format fsnotify: Fix possible use-after-free in inode iteration on umount kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) KVM: PPC: Book3S HV: Don't lose hardware R/C bit updates in H_PROTECT KVM: PPC: Book3S HV: Save/restore XER in checkpointed register state scsi: aacraid: remove wildcard for series 9 controllers md/raid5: limit request size according to implementation limits sc16is7xx: Drop bogus use of IRQF_ONESHOT latent_entropy: fix ARM build error on earlier gcc arm64: KVM: pmu: Reset PMSELR_EL0.SEL to a sane value before entering the guest s390/kexec: use node 0 when re-adding crash kernel memory s390/vmlogrdr: fix IUCV buffer allocation firmware: fix usermode helper fallback loading ARC: mm: arc700: Don't assume 2 colours for aliasing VIPT dcache scsi: avoid a permanent stop of the scsi device's request queue scsi: zfcp: fix rport unblock race with LUN recovery scsi: zfcp: do not trace pure benign residual HBA responses at default level scsi: zfcp: fix use-after-"free" in FC ingress path after TMF iscsi-target: Return error if unable to add network portal scsi: megaraid_sas: Do not set MPI2_TYPE_CUDA for JBOD FP path for FW which does not support JBOD sequence map scsi: megaraid_sas: For SRIOV enabled firmware, ensure VF driver waits for 30secs before reset stm class: Fix device leak in open error path vt: fix Scroll Lock LED trigger name block: protect iterate_bdevs() against concurrent close mei: me: add lewisburg device ids mei: request async autosuspend at the end of enumeration drivers/gpu/drm/ast: Fix infinite loop if read fails drm/amdgpu: fix init save/restore list in gfx_v8.0 drm/amdgpu: fix enable_cp_power_gating in gfx_v8.0. drm/amd/powerplay: bypass fan table setup if no fan connected drm/gma500: Add compat ioctl drm/radeon/si: load the proper firmware on 0x87 oland boards drm/radeon: add additional pci revision to dpm workaround drm/radeon: Hide the HW cursor while it's out of bounds drm/radeon: Also call cursor_move_locked when the cursor size changes drm/nouveau/fifo/gf100-: protect channel preempt with subdev mutex drm/nouveau/i2c/gk110b,gm10x: use the correct implementation drm/nouveau/ttm: wait for bo fence to signal before unmapping vmas drm/nouveau/ltc: protect clearing of comptags with mutex drm/nouveau/bios: require checksum to match for fast acpi shadow method drm/nouveau/kms: lvds panel strap moved again on maxwell drm/nouveau/gr: fallback to legacy paths during firmware lookup drm/amd/amdgpu: enable GUI idle INT after enabling CGCG drm/amdgpu: Also call cursor_move_locked when the cursor size changes drm/amdgpu: Store CRTC relative amdgpu_crtc->cursor_x/y values drm/amdgpu: add additional pci revision to dpm workaround drm/amdgpu/si: load the proper firmware on 0x87 oland boards ACPI / video: Add force_native quirk for HP Pavilion dv6 ACPI / video: Add force_native quirk for Dell XPS 17 L702X staging: comedi: ni_mio_common: fix E series ni_ai_insn_read() data staging: comedi: ni_mio_common: fix M Series ni_ai_insn_read() data mask staging: lustre: ldlm: pl_recalc time handling is wrong staging/lustre/osc: Revert erroneous list_for_each_entry_safe use hv: acquire vmbus_connection.channel_mutex in vmbus_free_channels() docs: sphinx-extensions: make rstFlatTable work with docutils 0.13 thermal: hwmon: Properly report critical temperature in sysfs clk: bcm2835: Avoid overwriting the div info when disabling a pll_div clk arm64: tegra: Add VDD_GPU regulator to Jetson TX1 gpio: chardev: Return error for seek operations gpio: stmpe: fix interrupt handling bug timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion mmc: sd: Meet alignment requirements for raw_ssr DMA regulator: stw481x-vmmc: fix ages old enable error mmc: sdhci: Fix recovery from tuning timeout Revert "mmc: sdhci: Reset cmd and data circuits after tuning failure" ath9k: do not return early to fix rcu unlocking ath9k: Really fix LED polarity for some Mini PCI AR9220 MB92 cards. ath9k: fix ath9k_hw_gpio_get() to return 0 or 1 on success cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts rtl8xxxu: Work around issue with 8192eu and 8723bu devices not reconnecting perf/x86/intel/cstate: Prevent hotplug callback leak perf annotate: Don't throw error for zero length symbols perf/x86: Fix exclusion of BTS and LBR for Goldmont rtlwifi: Fix enter/exit power_save ath10k: fix soft lockup during firmware crash/hw-restart ssb: Fix error routine when fallback SPROM fails Linux 4.9.1 x86/kbuild: enable modversions for symbols exported from asm builddeb: fix cross-building to arm64 producing host-arch debs xfs: set AGI buffer type in xlog_recover_clear_agi_bucket xfs: fix up xfs_swap_extent_forks inline extent handling arm/xen: Use alloc_percpu rather than __alloc_percpu xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing tpm xen: Remove bogus tpm_chip_unregister kernel/debug/debug_core.c: more properly delay for secondary CPUs watchdog: qcom: fix kernel panic due to external abort on non-linefetch watchdog: mei_wdt: request stop on reboot to prevent false positive event kernel/watchdog: use nmi registers snapshot in hardlockup handler CIFS: Fix a possible memory corruption in push locks CIFS: Decrease verbosity of ioctl call CIFS: Fix a possible double locking of mutex during reconnect CIFS: Fix missing nls unload in smb2_reconnect() CIFS: Fix a possible memory corruption during reconnect cifs: Fix smbencrypt() to stop pointing a scatterlist at the stack ASoC: intel: Fix crash at suspend/resume without card registration dm space map metadata: fix 'struct sm_metadata' leak on failed create dm raid: fix discard support regression dm rq: fix a race condition in rq_completed() dm crypt: mark key as invalid until properly loaded dm flakey: return -EINVAL on interval bounds error in flakey_ctr() dm table: an 'all_blk_mq' table must be loaded for a blk-mq DM device dm table: fix 'all_blk_mq' inconsistency when an empty table is loaded blk-mq: Do not invoke .queue_rq() for a stopped queue PM / OPP: Don't use OPP structure outside of rcu protected section PM / OPP: Pass opp_table to dev_pm_opp_put_regulator() usb: gadget: composite: always set ep->mult to a sensible value mm, page_alloc: keep pcp count and list contents in sync if struct page is corrupted mm/vmscan.c: set correct defer count for shrinker nvmet: Fix possible infinite loop triggered on hot namespace removal loop: return proper error from loop_queue_rq() f2fs: fix to determine start_cp_addr by sbi->cur_cp_pack f2fs: fix overflow due to condition check order f2fs: set ->owner for debugfs status file's file_operations Revert "f2fs: use percpu_counter for # of dirty pages in inode" ext4: do not perform data journaling when data is encrypted ext4: return -ENOMEM instead of success ext4: reject inodes with negative size ext4: add sanity checking to count_overhead() ext4: fix in-superblock mount options processing ext4: use more strict checks for inodes_per_block on mount ext4: fix stack memory corruption with 64k block size ext4: fix mballoc breakage with 64k block size ext4: don't lock buffer in ext4_commit_super if holding spinlock crypto: caam - fix AEAD givenc descriptors ptrace: Don't allow accessing an undumpable mm ptrace: Capture the ptracer's creds not PT_PTRACE_CAP vfs,mm: fix return value of read() at s_maxbytes mm: Add a user_ns owner to mm_struct and fix ptrace permission checks block_dev: don't test bdev->bd_contains when it is not stable splice: reinstate SIGPIPE/EPIPE handling fs: exec: apply CLOEXEC before changing dumpable task flags exec: Ensure mm->user_ns contains the execed files clk: ti: omap36xx: Work around sprz319 advisory 2.1 ALSA: hda: when comparing pin configurations, ignore assoc in addition to seq ALSA: hda - Gate the mic jack on HP Z1 Gen3 AiO ALSA: hda - fix headset-mic problem on a Dell laptop ALSA: hda - ignore the assoc and seq when comparing pin configurations ALSA: hda/ca0132 - Add quirk for Alienware 15 R2 2016 ALSA: hiface: Fix M2Tech hiFace driver sampling rate change ALSA: usb-audio: Add QuickCam Communicate Deluxe/S7500 to volume_control_quirks usbip: vudc: fix: Clear already_seen flag also for ep0 USB: UHCI: report non-PME wakeup signalling for Intel hardware usb: gadget: composite: correctly initialize ep->maxpacket usb: gadget: f_uac2: fix error handling at afunc_bind usb: core: usbport: Use proper LED API to fix potential crash usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices usb: dwc3: gadget: set PCM1 field of isochronous-first TRBs USB: cdc-acm: add device id for GW Instek AFG-125 USB: serial: kl5kusb105: fix open error path USB: serial: option: add dlink dwm-158 USB: serial: option: add support for Telit LE922A PIDs 0x1040, 0x1041 Btrfs: fix qgroup rescan worker initialization Btrfs: fix emptiness check for dirtied extent buffers at check_leaf() btrfs: store and load values of stripes_min/stripes_max in balance status item Btrfs: fix relocation incorrectly dropping data references Btrfs: fix tree search logic when replaying directory entry deletes Btrfs: fix deadlock caused by fsync when logging directory entries Btrfs: fix BUG_ON in btrfs_mark_buffer_dirty btrfs: limit async_work allocation and worker func duration hotplug: Make register and unregister notifier API symmetric ANDROID: Shrink ashmem directly through shmem_fallocate ANDROID: ashmem: Add shmem_set_file to mm/shmem.c ANDROID: Add android config documentation to boot framework. Conflicts: Documentation/android.txt Documentation/cpu-freq/governors.txt Documentation/networking/ip-sysctl.txt arch/arm64/boot/Makefile arch/arm64/kernel/process.c arch/arm64/kernel/topology.c arch/arm64/mm/dma-mapping.c drivers/cpufreq/cpufreq_interactive.c drivers/input/misc/gpio_matrix.c drivers/md/Kconfig drivers/md/dm-android-verity.c drivers/md/dm-android-verity.h drivers/md/dm-linear.c drivers/md/dm-verity-fec.h drivers/mmc/core/host.c drivers/platform/goldfish/goldfish_pipe.c drivers/power/supply/power_supply_sysfs.c drivers/scsi/ufs/ufshcd.c drivers/scsi/ufs/ufshcd.h drivers/staging/android/fiq_debugger/fiq_debugger.c drivers/staging/android/lowmemorykiller.c drivers/usb/dwc3/core.h drivers/usb/gadget/Kconfig drivers/usb/gadget/configfs.c drivers/usb/gadget/function/Makefile drivers/usb/gadget/function/f_accessory.c drivers/usb/gadget/function/f_audio_source.c drivers/usb/gadget/function/f_fs.c drivers/usb/gadget/function/f_mtp.c drivers/usb/phy/Kconfig drivers/usb/phy/otg-wakelock.c fs/ext4/inode.c fs/ext4/ioctl.c fs/f2fs/data.c fs/proc/task_mmu.c fs/sdcardfs/derived_perm.c fs/sdcardfs/file.c fs/sdcardfs/inode.c fs/sdcardfs/lookup.c fs/sdcardfs/main.c fs/sdcardfs/packagelist.c fs/sdcardfs/sdcardfs.h fs/sdcardfs/super.c include/linux/mmc/core.h include/linux/power_supply.h include/linux/sched.h include/linux/usb/f_mtp.h include/net/fib_rules.h include/net/route.h include/trace/events/cpufreq_interactive.h include/trace/events/power.h include/trace/events/sched.h include/uapi/linux/magic.h include/uapi/linux/prctl.h init/Kconfig kernel/cgroup.c kernel/configs/android-base.config kernel/power/process.c kernel/sched/Makefile kernel/sched/core.c kernel/sched/cputime.c kernel/sched/fair.c kernel/sched/rt.c kernel/sched/sched.h kernel/sched/stop_task.c kernel/sched/tune.c lib/Kconfig.debug net/core/fib_rules.c net/ipv4/inet_connection_sock.c net/ipv4/ping.c net/ipv4/raw.c net/ipv4/route.c net/ipv4/syncookies.c net/ipv4/udp.c net/ipv6/af_inet6.c net/ipv6/ah6.c net/ipv6/datagram.c net/ipv6/esp6.c net/ipv6/icmp.c net/ipv6/inet6_connection_sock.c net/ipv6/ip6_vti.c net/ipv6/ipcomp6.c net/ipv6/ping.c net/ipv6/raw.c net/ipv6/route.c net/ipv6/syncookies.c net/ipv6/tcp_ipv6.c net/ipv6/udp.c Change-Id: I82455dc7b564fc5d3ad2b784a0eb8f96c6b05d4c Signed-off-by: Channagoud Kadabi <ckadabi@codeaurora.org>	2017-02-17 16:14:38 -08:00
Dmitry Shmidt	e37704d2d0	Merge tag 'v4.9.8' into android-4.9 ... This is the 4.9.8 stable release	2017-02-06 13:13:30 -08:00
Robert Shearman	e972cce0c8	lwtunnel: Fix oops on state free after encap module unload ... [ Upstream commit 85c814016ce3b371016c2c054a905fa2492f5a65 ] When attempting to free lwtunnel state after the module for the encap has been unloaded an oops occurs: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: lwtstate_free+0x18/0x40 [..] task: ffff88003e372380 task.stack: ffffc900001fc000 RIP: 0010:lwtstate_free+0x18/0x40 RSP: 0018:ffff88003fd83e88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88002bbb3380 RCX: ffff88000c91a300 [..] Call Trace: <IRQ> free_fib_info_rcu+0x195/0x1a0 ? rt_fibinfo_free+0x50/0x50 rcu_process_callbacks+0x2d3/0x850 ? rcu_process_callbacks+0x296/0x850 __do_softirq+0xe4/0x4cb irq_exit+0xb0/0xc0 smp_apic_timer_interrupt+0x3d/0x50 apic_timer_interrupt+0x93/0xa0 [..] Code: e8 6e c6 fc ff 89 d8 5b 5d c3 bb de ff ff ff eb f4 66 90 66 66 66 66 90 55 48 89 e5 53 0f b7 07 48 89 fb 48 8b 04 c5 00 81 d5 81 <48> 8b 40 08 48 85 c0 74 13 ff d0 48 8d 7b 20 be 20 00 00 00 e8 The problem is after the module for the encap can be unloaded the corresponding ops is removed and is thus NULL here. Modules implementing lwtunnel ops should not be allowed to unload while there is state alive using those ops, so grab the module reference for the ops on creating lwtunnel state and of course release the reference when freeing the state. Fixes: 1104d9ba443a ("lwtunnel: Add destroy state operation") Signed-off-by: Robert Shearman <rshearma@brocade.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2017-02-04 09:47:11 +01:00
Robert Shearman	89c2588627	net: Specify the owning module for lwtunnel ops ... [ Upstream commit 88ff7334f25909802140e690c0e16433e485b0a0 ] Modules implementing lwtunnel ops should not be allowed to unload while there is state alive using those ops, so specify the owning module for all lwtunnel ops. Signed-off-by: Robert Shearman <rshearma@brocade.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2017-02-04 09:47:11 +01:00
David Ahern	e9db042dca	lwtunnel: fix autoload of lwt modules ... [ Upstream commit 9ed59592e3e379b2e9557dc1d9e9ec8fcbb33f16] Trying to add an mpls encap route when the MPLS modules are not loaded hangs. For example: CONFIG_MPLS=y CONFIG_NET_MPLS_GSO=m CONFIG_MPLS_ROUTING=m CONFIG_MPLS_IPTUNNEL=m $ ip route add 10.10.10.10/32 encap mpls 100 via inet 10.100.1.2 The ip command hangs: root 880 826 0 21:25 pts/0 00:00:00 ip route add 10.10.10.10/32 encap mpls 100 via inet 10.100.1.2 $ cat /proc/880/stack [<ffffffff81065a9b>] call_usermodehelper_exec+0xd6/0x134 [<ffffffff81065efc>] __request_module+0x27b/0x30a [<ffffffff814542f6>] lwtunnel_build_state+0xe4/0x178 [<ffffffff814aa1e4>] fib_create_info+0x47f/0xdd4 [<ffffffff814ae451>] fib_table_insert+0x90/0x41f [<ffffffff814a8010>] inet_rtm_newroute+0x4b/0x52 ... modprobe is trying to load rtnl-lwt-MPLS: root 881 5 0 21:25 ? 00:00:00 /sbin/modprobe -q -- rtnl-lwt-MPLS and it hangs after loading mpls_router: $ cat /proc/881/stack [<ffffffff81441537>] rtnl_lock+0x12/0x14 [<ffffffff8142ca2a>] register_netdevice_notifier+0x16/0x179 [<ffffffffa0033025>] mpls_init+0x25/0x1000 [mpls_router] [<ffffffff81000471>] do_one_initcall+0x8e/0x13f [<ffffffff81119961>] do_init_module+0x5a/0x1e5 [<ffffffff810bd070>] load_module+0x13bd/0x17d6 ... The problem is that lwtunnel_build_state is called with rtnl lock held preventing mpls_init from registering. Given the potential references held by the time lwtunnel_build_state it can not drop the rtnl lock to the load module. So, extract the module loading code from lwtunnel_build_state into a new function to validate the encap type. The new function is called while converting the user request into a fib_config which is well before any table, device or fib entries are examined. Fixes: 745041e2aa ("lwtunnel: autoload of lwt modules") Signed-off-by: David Ahern <dsa@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2017-02-04 09:47:10 +01:00
Dmitry Shmidt	cd08287396	Merge tag 'v4.9.6' into android-4.9 ... This is the 4.9.6 stable release Change-Id: I318df4b9d706d50c13fe3969d734117c25fc94bc	2017-01-31 13:55:27 -08:00
Lorenzo Colitti	5044292c36	UPSTREAM: net: inet: Support UID-based routing in IP protocols. ... - Use the UID in routing lookups made by protocol connect() and sendmsg() functions. - Make sure that routing lookups triggered by incoming packets (e.g., Path MTU discovery) take the UID of the socket into account. - For packets not associated with a userspace socket, (e.g., ping replies) use UID 0 inside the user namespace corresponding to the network namespace the socket belongs to. This allows all namespaces to apply routing and iptables rules to kernel-originated traffic in that namespaces by matching UID 0. This is better than using the UID of the kernel socket that is sending the traffic, because the UID of kernel sockets created at namespace creation time (e.g., the per-processor ICMP and TCP sockets) is the UID of the user that created the socket, which might not be mapped in the namespace. Change-Id: Ie35761630d9a77746399d6808ff0efb143efabb8 Tested: compiles allnoconfig, allyesconfig, allmodconfig Tested: https://android-review.googlesource.com/253302 Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-01-27 13:55:59 -08:00
Lorenzo Colitti	2ec93fec40	UPSTREAM: net: core: add UID to flows, rules, and routes ... - Define a new FIB rule attributes, FRA_UID_RANGE, to describe a range of UIDs. - Define a RTA_UID attribute for per-UID route lookups and dumps. - Support passing these attributes to and from userspace via rtnetlink. The value INVALID_UID indicates no UID was specified. - Add a UID field to the flow structures. Change-Id: I4d9d03e357ed5f35a65751b6d8ad919f0336dbfb Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-01-27 13:55:58 -08:00
Lorenzo Colitti	81a159106e	UPSTREAM: net: core: Add a UID field to struct sock. ... Protocol sockets (struct sock) don't have UIDs, but most of the time, they map 1:1 to userspace sockets (struct socket) which do. Various operations such as the iptables xt_owner match need access to the "UID of a socket", and do so by following the backpointer to the struct socket. This involves taking sk_callback_lock and doesn't work when there is no socket because userspace has already called close(). Simplify this by adding a sk_uid field to struct sock whose value matches the UID of the corresponding struct socket. The semantics are as follows: 1. Whenever sk_socket is non-null: sk_uid is the same as the UID in sk_socket, i.e., matches the return value of sock_i_uid. Specifically, the UID is set when userspace calls socket(), fchown(), or accept(). 2. When sk_socket is NULL, sk_uid is defined as follows: - For a socket that no longer has a sk_socket because userspace has called close(): the previous UID. - For a cloned socket (e.g., an incoming connection that is established but on which userspace has not yet called accept): the UID of the socket it was cloned from. - For a socket that has never had an sk_socket: UID 0 inside the user namespace corresponding to the network namespace the socket belongs to. Kernel sockets created by sock_create_kern are a special case of #1 and sk_uid is the user that created them. For kernel sockets created at network namespace creation time, such as the per-processor ICMP and TCP sockets, this is the user that created the network namespace. Change-Id: Id890c6ea724b6929cc543a474ab37ec2d9e3f815 Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2017-01-27 13:55:58 -08:00
JP Abgrall	7220b97d37	ANDROID: tcp: add a sysctl to config the tcp_default_init_rwnd ... The default initial rwnd is hardcoded to 10. Now we allow it to be controlled via /proc/sys/net/ipv4/tcp_default_init_rwnd which limits the values from 3 to 100 This is somewhat needed because ipv6 routes are autoconfigured by the kernel. See "An Argument for Increasing TCP's Initial Congestion Window" in https://developers.google.com/speed/articles/tcp_initcwnd_paper.pdf Change-Id: I386b2a9d62de0ebe05c1ebe1b4bd91b314af5c54 Signed-off-by: JP Abgrall <jpa@google.com> Conflicts: net/ipv4/sysctl_net_ipv4.c net/ipv4/tcp_input.c	2017-01-19 13:32:34 -08:00
Lorenzo Colitti	6b1064db6e	ANDROID: net: ipv6: autoconf routes into per-device tables ... Currently, IPv6 router discovery always puts routes into RT6_TABLE_MAIN. This causes problems for connection managers that want to support multiple simultaneous network connections and want control over which one is used by default (e.g., wifi and wired). To work around this connection managers typically take the routes they prefer and copy them to static routes with low metrics in the main table. This puts the burden on the connection manager to watch netlink to see if the routes have changed, delete the routes when their lifetime expires, etc. Instead, this patch adds a per-interface sysctl to have the kernel put autoconf routes into different tables. This allows each interface to have its own autoconf table, and choosing the default interface (or using different interfaces at the same time for different types of traffic) can be done using appropriate ip rules. The sysctl behaves as follows: - = 0: default. Put routes into RT6_TABLE_MAIN as before. - > 0: manual. Put routes into the specified table. - < 0: automatic. Add the absolute value of the sysctl to the device's ifindex, and use that table. The automatic mode is most useful in conjunction with net.ipv6.conf.default.accept_ra_rt_table. A connection manager or distribution could set it to, say, -100 on boot, and thereafter just use IP rules. Change-Id: I82d16e3737d9cdfa6489e649e247894d0d60cbb1 Signed-off-by: Lorenzo Colitti <lorenzo@google.com> [AmitP: Refactored original changes to align with the changes introduced by upstream commit 830218c1ad ("net: ipv6: Fix processing of RAs in presence of VRF")] Signed-off-by: Amit Pundir <amit.pundir@linaro.org>	2017-01-19 13:32:28 -08:00
Johannes Berg	1976c7689a	cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts ... commit e6f462df9acd2a3295e5d34eb29e2823220cf129 upstream. When mac80211 abandons an association attempt, it may free all the data structures, but inform cfg80211 and userspace about it only by sending the deauth frame it received, in which case cfg80211 has no link to the BSS struct that was used and will not cfg80211_unhold_bss() it. Fix this by providing a way to inform cfg80211 of this with the BSS entry passed, so that it can clean up properly, and use this ability in the appropriate places in mac80211. This isn't ideal: some code is more or less duplicated and tracing is missing. However, it's a fairly small change and it's thus easier to backport - cleanups can come later. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2017-01-09 08:32:17 +01:00
Kyle Yan	a1706c3196	Merge "cfg80211: Add AP stopped interface" into msm-4.8	2016-12-09 15:04:48 -08:00
Kyle Yan	73bc96794f	Merge "cnss_prealloc: Add cnss_prealloc driver" into msm-4.8	2016-12-09 15:04:41 -08:00
Sameer Thalappil	faa4c4ae62	cfg80211: Add AP stopped interface ... AP stopped interface can be used to indicate that the AP mode has stopped functioning, WLAN driver may have encountered errors that has forced the driver to stop the AP mode. When the driver is in P2P-Go mode, and when it goes thru automatic recovery from firmware crashes, it uses this interface to notify the userspace that the group has been deleted. CRs-Fixed: 1078172 Change-Id: Ifcd8d4f0c0b26f56a56fb8560aa474297b7521d4 Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>	2016-12-08 09:05:06 -08:00
Yuanyuan Liu	a73d1c684c	cnss_prealloc: Add cnss_prealloc driver ... This is a snapshot of the cnss_prealloc driver and associated files as of msm-4.4 commit: commit 3c45c2a8a2a07a76e2d129d02561d061211e70c8 ("Promotion of kernel.lnx.4.4-161119.") CRs-Fixed: 1094870 Change-Id: Ic98572cf8b66ec936526facd372d04a25a930d75 Signed-off-by: Yuanyuan Liu <yuanliu@codeaurora.org>	2016-12-07 15:53:33 -08:00
Kyle Yan	ef23582208	Merge "mac80211: implement HS2.0 gratuitous ARP/unsolicited NA dropping" into msm-4.8	2016-12-07 11:56:06 -08:00
Kyle Yan	ef5ecfe4fe	Merge remote-tracking branch 'origin/tmp-3e5de27' into msm-4.8 ... * origin/tmp-3e5de27: Linux 4.9-rc8 mm, vmscan: add cond_resched() into shrink_node_memcg() mm: workingset: fix NULL ptr in count_shadow_nodes kbuild: fix building bzImage with CONFIG_TRIM_UNUSED_KSYMS enabled net: avoid signed overflows for SO_{SND|RCV}BUFFORCE geneve: avoid use-after-free of skb->data tipc: check minimum bearer MTU net: renesas: ravb: unintialized return value sh_eth: remove unchecked interrupts for RZ/A1 net: bcmgenet: Utilize correct struct device for all DMA operations Fix up a couple of field names in the CREDITS file NET: usb: qmi_wwan: add support for Telit LE922A PID 0x1040 cdc_ether: Fix handling connection notification ip6_offload: check segs for NULL in ipv6_gso_segment. RDS: TCP: unregister_netdevice_notifier() in error path of rds_tcp_init_net Revert: "ip6_tunnel: Update skb->protocol to ETH_P_IPV6 in ip6_tnl_xmit()" ipv6: Set skb->protocol properly for local output ipv4: Set skb->protocol properly for local output packet: fix race condition in packet_set_ring net: ethernet: altera: TSE: do not use tx queue lock in tx completion handler net: ethernet: altera: TSE: Remove unneeded dma sync for tx buffers default exported asm symbols to zero arm64: dts: juno: fix cluster sleep state entry latency on all SoC versions net: ethernet: stmmac: fix of-node and fixed-link-phydev leaks net: ethernet: stmmac: platform: fix outdated function header net: ethernet: stmmac: dwmac-meson8b: fix probe error path net: ethernet: stmmac: dwmac-generic: fix probe error path net: ethernet: stmmac: dwmac-rk: fix probe error path net: ethernet: stmmac: dwmac-sti: fix probe error path net: ethernet: stmmac: dwmac-socfpga: fix use-after-free on probe errors net/rtnetlink: fix attribute name in nlmsg_size() comments ixgbe/ixgbevf: Don't use lco_csum to compute IPv4 checksum igb/igbvf: Don't use lco_csum to compute IPv4 checksum net: asix: Fix AX88772_suspend() USB vendor commands failure issues kbuild: make sure autoksyms.h exists early KVM: use after free in kvm_ioctl_create_device() can: peak: Add support for PCAN-USB X6 USB interface can: peak: Fix bittiming fields size in bits mm: fix false-positive WARN_ON() in truncate/invalidate for hugetlb kasan: support use-after-scope detection kasan: update kasan_global for gcc 7 lib/debugobjects: export for use in modules zram: fix unbalanced idr management at hot removal thp: fix corner case of munlock() of PTE-mapped THPs mm, thp: propagation of conditional compilation in khugepaged.c arm64: dts: juno: Correct PCI IO window macvtap: handle ubuf refcount correctly when meet errors tun: handle ubuf refcount correctly when meet errors net: ethernet: ti: cpsw: fix ASSERT_RTNL() warning during resume bpf: fix states equal logic for varlen access netfilter: arp_tables: fix invoking 32bit "iptable -P INPUT ACCEPT" failed in 64bit kernel l2tp: fix address test in __l2tp_ip6_bind_lookup() l2tp: fix lookup for sockets not bound to a device in l2tp_ip l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind() l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv() l2tp: lock socket before checking flags in connect() cxgb4: Add PCI device ID for new adapter isofs: add KERN_CONT to printing of ER records net: fec: cache statistics while device is down vxlan: fix a potential issue when create a new vxlan fdb entry. Input: change KEY_DATA from 0x275 to 0x277 openvswitch: Fix skb leak in IPv6 reassembly. esp6: Fix integrity verification when ESN are used esp4: Fix integrity verification when ESN are used drm/i915: drop the struct_mutex when wedged or trying to reset drm/i915: Don't touch NULL sg on i915_gem_object_get_pages_gtt() error xfrm_user: fix return value from xfrm_user_rcv_msg drm: Don't call drm_for_each_crtc with a non-KMS driver net: dsa: slave: fix fixed-link phydev leaks net: ethernet: ti: davinci_emac: fix fixed-link phydev and of-node leaks net: ethernet: dwc_eth_qos: fix fixed-link phydev leaks net: ethernet: renesas: ravb: fix fixed-link phydev leaks net: ethernet: mediatek: fix fixed-link phydev leaks net: ethernet: marvell: mvneta: fix fixed-link phydev leaks net: ethernet: ucc_geth: fix fixed-link phydev leaks net: ethernet: gianfar: fix fixed-link phydev leaks net: ethernet: fs_enet: fix fixed-link phydev leaks net: ethernet: fec: fix fixed-link phydev leaks net: ethernet: bcmgenet: fix fixed-link phydev leaks net: ethernet: bcmsysport: fix fixed-link phydev leaks net: ethernet: aurora: nb8800: fix fixed-link phydev leaks net: ethernet: altera: fix fixed-link phydev leaks of_mdio: add helper to deregister fixed-link PHYs net: dsa: slave: fix of-node leak and phy priority GSO: Reload iph after pskb_may_pull sched: cls_flower: remove from hashtable only in case skip sw flag is not set net/dccp: fix use-after-free in dccp_invalid_packet net: macb: ensure ordering write to re-enable RX smoothly net: macb: fix the RX queue reset in macb_rx() netlink: Call cb->done from a worker thread net/sched: pedit: make sure that offset is valid Re-enable CONFIG_MODVERSIONS in a slightly weaker form netfilter: ipv6: nf_defrag: drop mangled skb on ream error Revert "i2c: octeon: thunderx: Limit register access retries" ARC: mm: PAE40: Fix crash at munmap mremap: move_ptes: check pte dirty after its removal pwm: Fix device reference leak drm/radeon: fix check for port PM availability drm/amdgpu: fix check for port PM availability ovl: fix d_real() for stacked fs CIFS: iterate over posix acl xattr entry correctly in ACL_to_cifs_posix() Call echo service immediately after socket reconnect CIFS: Fix BUG() in calc_seckey() drm/amd/powerplay: initialize the soft_regs offset in struct smu7_hwmgr bpf/samples: Fix PT_REGS_IP on s390x and use it net: dsa: fix unbalanced dsa_switch_tree reference counting net: handle no dst on skb in icmp6_send dbri: Fix compiler warning qlogicpti: Fix compiler warnings net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering Revert "net/mlx4_en: Avoid unregister_netdev at shutdown flow" net/sched: Export tc_tunnel_key so its UAPI accessible amd-xgbe: Fix unused suspend handlers build warning ARC: mm: IOC: Don't enable IOC by default ARC: Don't use "+l" inline asm constraint tcp: Set DEFAULT_TCP_CONG to bbr if DEFAULT_BBR is set net: phy: realtek: fix enabling of the TX-delay for RTL8211F Documentation: devicetree: clarify usage of the RGMII phy-modes net, sched: respect rcu grace period on cls destruction tipc: fix link statistics counter errors driver: macvtap: Unregister netdev rx_handler if macvtap_newlink fails net: qcom/emac: fix of_node and phydev leaks net: fsl/fman: fix fixed-link-phydev reference leak net: fsl/fman: fix phydev reference leak net: bcmgenet: fix phydev reference leak net: dsa: fix fixed-link-phy device leaks irda: fix overly long udelay() driver: ipvlan: Fix one possible memleak in ipvlan_link_new drm: hdlcd: Fix cleanup order netfilter: nat: fix crash when conntrack entry is re-used netfilter: nft_range: add the missing NULL pointer check netfilter: nf_tables: fix inconsistent element expiration calculation netfilter: nat: switch to new rhlist interface netfilter: nat: fix cmp return value netfilter: nft_hash: validate maximum value of u32 netlink hash attribute KVM: arm/arm64: vgic: Don't notify EOI for non-SPIs netfilter: fix nf_conntrack_helper documentation netfilter: Update nf_send_reset6 to consider L3 domain netfilter: Update ip_route_me_harder to consider L3 domain clk: bcm: Fix unmet Kconfig dependencies for CLK_BCM_63XX PCI: Set Read Completion Boundary to 128 iff Root Port supports it (_HPX) PCI: Export pcie_find_root_port clk: sunxi-ng: enable so-said LDOs for A33 SoC's pll-mipi clock ARM: dts: STiH407-family: fix i2c nodes flowcache: Increase threshold for refusing new allocations scsi: be2iscsi: allocate enough memory in beiscsi_boot_get_sinfo() scsi: mpt3sas: Unblock device after controller reset scsi: hpsa: use bus '3' for legacy HBA devices ARM: gr8: Rename the DTSI and relevant DTS clk: sunxi-ng: sun6i-a31: Enable PLL-MIPI LDOs when ungating it ahci: always fall back to single-MSI mode xfrm: unbreak xfrm_sk_policy_lookup scsi: libfc: fix seconds_since_last_reset miscalculation mwifiex: printk() overflow with 32-byte SSIDs Input: psmouse - disable automatic probing of BYD touchpads PCI: designware-plat: Update author email PCI: designware: Change maintainer to Joao Pinto MAINTAINERS: Add devicetree binding to PCI i.MX6 entry MAINTAINERS: Update Richard Zhu's email address libata-scsi: Fixup ata_gen_passthru_sense() mvsas: fix error return code in mvs_task_prep() pwm: meson: Add missing spin_lock_init() vti6: flush x-netns xfrm cache when vti interface is removed Change-Id: I055dd31e2827d41c82aa2c23ec9772ec536e0c0b Signed-off-by: Kyle Yan <kyan@codeaurora.org>	2016-12-06 14:06:47 -08:00
Johannes Berg	7c62e27a6b	mac80211: implement HS2.0 gratuitous ARP/unsolicited NA dropping ... Taking the gratuitous ARP/unsolicited NA detection code from mwifiex (but fixing it up to not have read-after-skb-end bugs), implement the ability for userspace to request the behaviour required by HS2.0 to drop gratuitous ARP and unsolicited NA frames when proxy ARP service is enabled on the AP. Since this behaviour is only mandatory for HS2.0 and may not always be desired, make it optional - modify cfg80211/nl80211 for that. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Git-commit: be9efdecf8ecdcc6d2221845482e7359b33a603b Git-repo : git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git Change-Id: I1e4083a2327c121073226aa6b75bb6b5b97cec00 CRs-fixed: 1079453 [akholaif@codeaurora.org: only picked up the declaration and definition of cfg80211_is_gratuitous_arp_unsolicited_na()] Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>	2016-12-06 11:27:15 -08:00
Kyle Yan	7ace5b948c	Merge "cfg80211: Add new wiphy flag WIPHY_FLAG_DFS_OFFLOAD" into msm-4.8	2016-12-06 10:48:19 -08:00
Kyle Yan	5044bbd0f3	Merge remote-tracking branch '4.4/tmp-e5517c2' into 4.8 ... * 4.4/tmp-e5517c2: Linux 4.9-rc7 fix default_file_splice_read() tipc: resolve connection flow control compatibility problem mvpp2: use correct size for memset net/mlx5: drop duplicate header delay.h net: ieee802154: drop duplicate header delay.h ibmvnic: drop duplicate header seq_file.h fsl/fman: fix a leak in tgec_free() net: ethtool: don't require CAP_NET_ADMIN for ETHTOOL_GLINKSETTINGS tipc: improve sanity check for received domain records tipc: fix compatibility bug in link monitoring net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented Fix subtle CONFIG_MODVERSIONS problems MAINTAINERS: Add bug tracking system location entry type Revert "i2c: designware: do not disable adapter after transfer" dwc_eth_qos: drop duplicate headers parisc: Also flush data TLB in flush_icache_page_asm parisc: Fix race in pci-dma.c parisc: Switch to generic sched_clock implementation parisc: Fix races in parisc_setup_cache_timing() mfd: wm8994-core: Don't use managed regulator bulk get API mfd: wm8994-core: Disable regulators before removing them MIPS: mm: Fix output of __do_page_fault mfd: syscon: Support native-endian regmaps powerpc/mm: Fixup kernel read only mapping mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] X.509: Fix double free in x509_cert_parse() [ver #3] gpu/drm/exynos/exynos_hdmi - Unmap region obtained by of_iomap net sched filters: fix filter handle ID in tfilter_notify_chain() net: dsa: bcm_sf2: Ensure we re-negotiate EEE during after link change bnxt: do not busy-poll when link is down udplite: call proper backlog handlers KVM: x86: check for pic and ioapic presence before use KVM: x86: fix out-of-bounds accesses of rtc_eoi map KVM: x86: drop error recovery in em_jmp_far and em_ret_far KVM: x86: fix out-of-bounds access in lapic init: use pr_cont() when displaying rotator during ramdisk loading. ipv6: bump genid when the IFA_F_TENTATIVE flag is clear MIPS: Mask out limit field when calculating wired entry count i2c: designware: fix rx fifo depth tracking i2c: designware: report short transfers drm/mediatek: fix null pointer dereference drm/mediatek: fixed the calc method of data rate per lane drm/mediatek: fix a typo of DISP_OD_CFG to OD_RELAYMODE powerpc/boot: Fix the early OPAL console wrappers net/mlx4_en: Free netdev resources under state lock net: revert "net: l2tp: Treat NET_XMIT_CN as success in l2tp_eth_dev_xmit" rtnetlink: fix the wrong minimal dump size getting from rtnl_calcit() bnxt_en: Fix a VXLAN vs GENEVE issue netdevice.h: fix kernel-doc warning driver: macvlan: Check if need rollback multicast setting in macvlan_open net: phy: micrel: fix KSZ8041FTL supported value xc2028: Fix use-after-free bug properly tile: avoid using clocksource_cyc2ns with absolute cycle count drm/radeon: fix power state when port pm is unavailable (v2) drm/amdgpu: fix power state when port pm is unavailable HID: hid-sensor-hub: clear memory to avoid random data HID: rmi: make transfer buffers DMA capable HID: magicmouse: make transfer buffers DMA capable HID: lg: make transfer buffers DMA capable HID: cp2112: make transfer buffers DMA capable can: bcm: fix support for CAN FD frames Revert "arm: move exports to definitions" Bluetooth: Fix using the correct source address type NFSv4.x: hide array-bounds warning flow_dissect: call init_default_flow_dissectors() earlier parisc: Fix printk continuations in system detection drm/arm: hdlcd: fix plane base address update perf/x86/intel/uncore: Allow only a single PMU/box within an events group perf/x86/intel: Cure bogus unwind from PEBS entries perf/x86: Restore TASK_SIZE check on frame pointer sched/autogroup: Do not use autogroup->tg in zombie threads sched/autogroup: Fix autogroup_move_group() to never skip sched_move_task() powerpc: Fix missing CRCs, add more asm-prototypes.h declarations crypto: scatterwalk - Remove unnecessary aliasing check in map_and_copy crypto: algif_hash - Fix result clobbering in recvmsg powerpc: Set missing wakeup bit in LPCR on POWER9 watchdog: wdat_wdt: Select WATCHDOG_CORE tcp: zero ca_priv area when switching cc algorithms net: l2tp: Treat NET_XMIT_CN as success in l2tp_eth_dev_xmit NFSv4.1: Keep a reference on lock states while checking ethernet: stmmac: make DWMAC_STM32 depend on it's associated SoC Revert "ACPI: Execute _PTS before system reboot" thermal/powerclamp: add back module device table perf/core: Fix address filter parser mmc: dw_mmc: fix the error handling for dma operation x86/platform/intel-mid: Rename platform_wdt to platform_mrfld_wdt x86/build: Build compressed x86 kernels as PIE when !CONFIG_RELOCATABLE as well x86/platform/intel-mid: Register watchdog device after SCU x86/fpu: Fix invalid FPU ptrace state after execve() x86/boot: Fail the boot if !M486 and CPUID is missing x86/traps: Ignore high word of regs->cs in early_fixup_exception() apparmor: fix change_hat not finding hat after policy replacement tipc: eliminate obsolete socket locking policy description rtnl: fix the loop index update error in rtnl_dump_ifinfo() l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() iommu/vt-d: Fix PASID table allocation sparc: drop duplicate header scatterlist.h net: macb: add check for dma mapping error in start_xmit() lockdep: Limit static allocations if PROVE_LOCKING_SMALL is defined config: Adding the new config parameter CONFIG_PROVE_LOCKING_SMALL for sparc NFSv4.1: Handle NFS4ERR_OLD_STATEID in nfs4_reclaim_open_state sunbmac: Fix compiler warning sunqe: Fix compiler warnings NFSv4: Don't call close if the open stateid has already been cleared sparc64: Enable 64-bit DMA sparc64: Enable sun4v dma ops to use IOMMU v2 APIs sparc64: Bind PCIe devices to use IOMMU v2 service sparc64: Initialize iommu_map_table and iommu_pool sparc64: Add ATU (new IOMMU) support sparc64: Add FORCE_MAX_ZONEORDER and default to 13 rtnetlink: fix FDB size computation netns: fix get_net_ns_by_fd(int pid) typo af_unix: conditionally use freezable blocking calls in read net: ethernet: ti: cpsw: fix fixed-link phy probe deferral net: ethernet: ti: cpsw: add missing sanity check net: ethernet: ti: cpsw: fix secondary-emac probe error path net: ethernet: ti: cpsw: fix of_node and phydev leaks net: ethernet: ti: cpsw: fix deferred probe net: ethernet: ti: cpsw: fix mdio device reference leak net: ethernet: ti: cpsw: fix bad register access in probe error path net: sky2: Fix shutdown crash NFSv4: Fix CLOSE races with OPEN NFSv4.1: Fix a regression in DELEGRETURN mmc: sdhci-of-esdhc: fixup PRESENT_STATE read usb: gadget: f_fs: fix wrong parenthesis in ffs_func_req_match() perf/x86: Add perf support for AMD family-17h processors x86/dumpstack: Prevent KASAN false positive warnings x86/unwind: Prevent KASAN false positive warnings in guess unwinder cfg80211: limit scan results cache size net sched filters: pass netlink message flags in event notification ip6_tunnel: disable caching when the traffic class is inherited net: phy: fixed_phy: fix of_node leak in fixed_phy_unregister of_mdio: fix device reference leak in of_phy_find_device of_mdio: fix node leak in of_phy_register_fixed_link error path net: check dead netns for peernet2id_alloc() phy: twl4030-usb: Fix for musb session bit based PM usb: musb: Drop pointless PM runtime code for dsps glue usb: musb: Add missing pm_runtime_disable and drop 2430 PM timeout usb: musb: Fix PM for hub disconnect usb: musb: Fix sleeping function called from invalid context for hdrc glue usb: musb: Fix broken use of static variable for multiple instances x86/boot: Avoid warning for zero-filling .bss bnxt: add a missing rcu synchronization net: dsa: b53: Fix VLAN usage and how we treat CPU port net/phy/vitesse: Configure RGMII skew on VSC8601, if needed cxgb4: do not call napi_hash_del() be2net: do not call napi_hash_del() virtio-net: add a missing synchronize_net() drm/amd/powerplay: avoid out of bounds access on array ps. clk: efm32gg: Pass correct type to hw provider registration clk: berlin: Pass correct type to hw provider registration net: thunderx: Fix memory leak and other issues upon interface toggle net: thunderx: Fix VF driver's interface statistics net: thunderx: Fix configuration of L3/L4 length checking net: thunderx: Program LMAC credits based on MTU net: thunderx: Introduce BGX_ID_MASK macro to extract bgx_id ipv4: Fix memory leak in exception case for splitting tries ipv4: Restore fib_trie_flush_external function and fix call ordering bpf: fix range arithmetic for bpf map access device-dax: fail all private mapping attempts USB: serial: cp210x: add ID for the Zone DPMX perf/x86/uncore: Fix crash by removing bogus event_list[] handling for SNB client uncore IMC x86/sysfb: Fix lfb_size calculation x86/sysfb: Add support for 64bit EFI lfb_base rtnetlink: fix rtnl message size computation for XDP rtnetlink: fix rtnl_vfinfo_size gro_cells: mark napi struct as not busy poll candidates udp: restore UDPlite many-cast delivery net: arc_emac: don't pass multicast packets to kernel in non-multicast mode net: arc_emac: annonce IFF_MULTICAST support stmmac: fix PTP type ethtool stats stmmac: fix PTP support for GMAC4 stmmac: update the PTP header file igmp: do not remove igmp souce list info when set link down usb: chipidea: move the lock initialization to core file net: ethernet: Fix SGMII unable to switch speed and autonego failure mac80211_hwsim: fix beacon delta calculation mac80211: fix A-MSDU aggregation with fast-xmit + txq mac80211: remove bogus skb vif assignment mac80211: update A-MPDU flag on tx dequeue cfg80211: add bitrate for 20MHz MCS 9 Revert "mac80211: allow using AP_LINK_PS with mac80211-generated TIM IE" mac80211: Ignore VHT IE from peer with wrong rx_mcs_map perf/core: Do not set cpuctx->cgrp for unscheduled cgroups Fix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y scsi: qla2xxx: do not abort all commands in the adapter during EEH recovery sparc64: fix compile warning section mismatch in find_node() scsi: mpt3sas: Fix secure erase premature termination sparc32: Fix inverted invalid_frame_pointer checks on sigreturns sparc64: Fix find_node warning if numa node cannot be found USB: serial: ftdi_sio: add support for TI CC3200 LaunchPad batman-adv: Detect missing primaryif during tp_send as error batman-adv: Revert "fix splat on disabling an interface" clk: sunxi: Fix M factor computation for APB1 iommu/vt-d: Fix IOMMU lookup for SR-IOV Virtual Functions device-dax: check devm_nsio_enable() return value clk: sunxi-ng: sun6i-a31: Force AHB1 clock to use PLL6 as parent Conflicts: net/wireless/scan.c Change-Id: I1371442c0867c8680282c344fb6ecdba7eb032d4 Signed-off-by: Kyle Yan <kyan@codeaurora.org>	2016-12-05 16:08:42 -08:00
Amar Singhal	aea474ed9c	cfg80211: Add new wiphy flag WIPHY_FLAG_DFS_OFFLOAD ... Add new flag WIPHY_FLAG_DFS_OFFLOAD to the wiphy structure. When this flag is defined, the driver would handle all the DFS related operations. CRs-Fixed: 1078935 Change-Id: I592722607788dc4e2167c90bb684071cc9fb6986 Signed-off-by: Amar Singhal <asinghal@codeaurora.org>	2016-12-05 13:53:01 -08:00
David S. Miller	3d2dd617fb	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf ... Pablo Neira Ayuso says: ==================== Netfilter fixes for net This is a large batch of Netfilter fixes for net, they are: 1) Three patches to fix NAT conversion to rhashtable: Switch to rhlist structure that allows to have several objects with the same key. Moreover, fix wrong comparison logic in nf_nat_bysource_cmp() as this is expecting a return value similar to memcmp(). Change location of the nat_bysource field in the nf_conn structure to avoid zeroing this as it breaks interaction with SLAB_DESTROY_BY_RCU and lead us to crashes. From Florian Westphal. 2) Don't allow malformed fragments go through in IPv6, drop them, otherwise we hit GPF, patch from Florian Westphal. 3) Fix crash if attributes are missing in nft_range, from Liping Zhang. 4) Fix arptables 32-bits userspace 64-bits kernel compat, from Hongxu Jia. 5) Two patches from David Ahern to fix netfilter interaction with vrf. From David Ahern. 6) Fix element timeout calculation in nf_tables, we take milliseconds from userspace, but we use jiffies from kernelspace. Patch from Anders K. Pedersen. 7) Missing validation length netlink attribute for nft_hash, from Laura Garcia. 8) Fix nf_conntrack_helper documentation, we don't default to off anymore for a bit of time so let's get this in sync with the code. I know is late but I think these are important, specifically the NAT bits, as they are mostly addressing fallout from recent changes. I also read there are chances to have -rc8, if that is the case, that would also give us a bit more time to test this. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>	2016-12-01 11:04:41 -05:00
Guillaume Nault	0382a25af3	l2tp: lock socket before checking flags in connect() ... Socket flags aren't updated atomically, so the socket must be locked while reading the SOCK_ZAPPED flag. This issue exists for both l2tp_ip and l2tp_ip6. For IPv6, this patch also brings error handling for __ip6_datagram_connect() failures. Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-11-30 14:14:07 -05:00
Florian Westphal	5173bc679d	netfilter: nat: fix crash when conntrack entry is re-used ... Stas Nichiporovich reports oops in nf_nat_bysource_cmp(), trying to access nf_conn struct at address 0xffffffffffffff50. This is the result of fetching a null rhash list (struct embedded at offset 176; 0 - 176 gets us ...fff50). The problem is that conntrack entries are allocated from a SLAB_DESTROY_BY_RCU cache, i.e. entries can be free'd and reused on another cpu while nf nat bysource hash access the same conntrack entry. Freeing is fine (we hold rcu read lock); zeroing rhlist_head isn't. -> Move the rhlist struct outside of the memset()-inited area. Fixes: 7c96643519 ("netfilter: move nat hlist_head to nf_conn") Reported-by: Stas Nichiporovich <stasn77@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2016-11-24 14:43:35 +01:00
Anders K. Pedersen	d3e2a1110c	netfilter: nf_tables: fix inconsistent element expiration calculation ... As Liping Zhang reports, after commit a8b1e36d0d ("netfilter: nft_dynset: fix element timeout for HZ != 1000"), priv->timeout was stored in jiffies, while set->timeout was stored in milliseconds. This is inconsistent and incorrect. Firstly, we already call msecs_to_jiffies in nft_set_elem_init, so priv->timeout will be converted to jiffies twice. Secondly, if the user did not specify the NFTA_DYNSET_TIMEOUT attr, set->timeout will be used, but we forget to call msecs_to_jiffies when do update elements. Fix this by using jiffies internally for traditional sets and doing the conversions to/from msec when interacting with userspace - as dynset already does. This is preferable to doing the conversions, when elements are inserted or updated, because this can happen very frequently on busy dynsets. Fixes: a8b1e36d0d ("netfilter: nft_dynset: fix element timeout for HZ != 1000") Reported-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Acked-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2016-11-24 14:43:34 +01:00
Florian Westphal	7223ecd466	netfilter: nat: switch to new rhlist interface ... I got offlist bug report about failing connections and high cpu usage. This happens because we hit 'elasticity' checks in rhashtable that refuses bucket list exceeding 16 entries. The nat bysrc hash unfortunately needs to insert distinct objects that share same key and are identical (have same source tuple), this cannot be avoided. Switch to the rhlist interface which is designed for this. The nulls_base is removed here, I don't think its needed: A (unlikely) false positive results in unneeded port clash resolution, a false negative results in packet drop during conntrack confirmation, when we try to insert the duplicate into main conntrack hash table. Tested by adding multiple ip addresses to host, then adding iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE ... and then creating multiple connections, from same source port but different addresses: for i in $(seq 2000 2032);do nc -p 1234 192.168.7.1 $i > /dev/null & done (all of these then get hashed to same bysource slot) Then, to test that nat conflict resultion is working: nc -s 10.0.0.1 -p 1234 192.168.7.1 2000 nc -s 10.0.0.2 -p 1234 192.168.7.1 2000 tcp .. src=10.0.0.1 dst=192.168.7.1 sport=1234 dport=2000 src=192.168.7.1 dst=192.168.7.10 sport=2000 dport=1024 [ASSURED] tcp .. src=10.0.0.2 dst=192.168.7.1 sport=1234 dport=2000 src=192.168.7.1 dst=192.168.7.10 sport=2000 dport=1025 [ASSURED] tcp .. src=192.168.7.10 dst=192.168.7.1 sport=1234 dport=2000 src=192.168.7.1 dst=192.168.7.10 sport=2000 dport=1234 [ASSURED] tcp .. src=192.168.7.10 dst=192.168.7.1 sport=1234 dport=2001 src=192.168.7.1 dst=192.168.7.10 sport=2001 dport=1234 [ASSURED] [..] -> nat altered source ports to 1024 and 1025, respectively. This can also be confirmed on destination host which shows ESTAB 0 0 192.168.7.1:2000 192.168.7.10:1024 ESTAB 0 0 192.168.7.1:2000 192.168.7.10:1025 ESTAB 0 0 192.168.7.1:2000 192.168.7.10:1234 Cc: Herbert Xu <herbert@gondor.apana.org.au> Fixes: 870190a9ec ("netfilter: nat: convert nat bysrc hash to rhashtable") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2016-11-24 14:43:34 +01:00
Johan Hedberg	39385cb5f3	Bluetooth: Fix using the correct source address type ... The hci_get_route() API is used to look up local HCI devices, however so far it has been incapable of dealing with anything else than the public address of HCI devices. This completely breaks with LE-only HCI devices that do not come with a public address, but use a static random address instead. This patch exteds the hci_get_route() API with a src_type parameter that's used for comparing with the right address of each HCI device. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>	2016-11-22 22:50:46 +01:00
Kyle Yan	f2cf423ddb	Merge remote-tracking branch 'origin/tmp-9c76358' into msm-4.8 ... * origin/tmp-9c76358: Linux 4.9-rc6 ext4: sanity check the block and cluster size at mount time fscrypto: don't use on-stack buffer for key derivation fscrypto: don't use on-stack buffer for filename encryption i2c: i2c-mux-pca954x: fix deselect enabling for device-tree kvm: x86: merge kvm_arch_set_irq and kvm_arch_set_irq_inatomic KVM: x86: fix missed SRCU usage in kvm_lapic_set_vapic_addr KVM: async_pf: avoid recursive flushing of work items kvm: kvmclock: let KVM_GET_CLOCK return whether the master clock is in use KVM: Disable irq while unregistering user notifier KVM: x86: do not go through vcpu in __get_kvmclock_ns MAINTAINERS: Add LED subsystem co-maintainer crypto: algif_hash - Fix NULL hash crash with shash powerpc/mm: Fix missing update of HID register on secondary CPUs KVM: arm64: Fix the issues when guest PMCCFILTR is configured arm64: KVM: pmu: Fix AArch32 cycle counter access powerpc/mm/radix: Invalidate ERAT on tlbiel for POWER9 DD1 i2c: digicolor: use clk_disable_unprepare instead of clk_unprepare ipmi/bt-bmc: change compatible node to 'aspeed, ast2400-ibt-bmc' Revert "drm/mediatek: set vblank_disable_allowed to true" Revert "drm/mediatek: fix a typo of OD_CFG to OD_RELAYMODE" mremap: fix race between mremap() and page cleanning crypto: caam - fix type mismatch warning dmaengine: cppi41: More PM runtime fixes fix iov_iter_advance() for ITER_PIPE xattr: Fix setting security xattrs on sockfs iw_cxgb4: invalidate the mr when posting a read_w_inv wr iw_cxgb4: set *bad_wr for post_send/post_recv errors IB/rxe: Update qp state for user query IB/rxe: Clear queue buffer when modifying QP to reset IB/rxe: Fix handling of erroneous WR IB/rxe: Fix kernel panic in UDP tunnel with GRO and RX checksum IB/mlx4: Fix create CQ error flow IB/mlx4: Check gid_index return value IB/mlx5: Fix NULL pointer dereference on debug print IB/mlx5: Fix fatal error dispatching IB/mlx5: Resolve soft lock on massive reg MRs IB/mlx5: Use cache line size to select CQE stride IB/mlx5: Validate requested RQT size IB/mlx5: Fix memory leak in query device IB/core: Avoid unsigned int overflow in sg_alloc_table IB/core: Add missing check for addr_resolve callback return value IB/core: Set routable RoCE gid type for ipv4/ipv6 networks IB/cm: Mark stale CM id's whenever the mad agent was unregistered IB/uverbs: Fix leak of XRC target QPs ARM: Fix XIP kernels tools/power/acpi: Remove direct kernel source include reference gpio: Remove GPIO_DEVRES option nvme/pci: Don't free queues on error orangefs: add .owner to debugfs file_operations mfd: core: Fix device reference leak in mfd_clone_cell mfd: stmpe: Fix RESET regression on STMPE2401 mfd: intel_soc_pmic_bxtwc: Fix usbc interrupt mfd: intel-lpss: Do not put device in reset state on suspend mfd: lpss: Fix Intel Kaby Lake PCH-H properties drm/i915: Assume non-DP++ port if dvo_port is HDMI and there's no AUX ch specified in the VBT IB/hfi1: Remove incorrect IS_ERR check IB/hfi1: Prevent hardware counter names from being cut off IB/hfi1: Fix ECN processing in prescan_rxq IB/hfi1: Fix status error code for unsupported packets IB/hfi1: Relocate rcvhdrcnt module parameter check. IB/hfi1: Fix rnr_timer addition IB/hfi1: Delete unused lock IB/hfi1: Clean up unused argument IB/hfi1: Remove leftover snoop references IB/hfi1: Fix a potential memory leak in hfi1_create_ctxts() IB/hfi1: Return ENODEV for unsupported PCI device ids. IB/hfi1: Fix an Oops on pci device force remove IB/hfi1: Fix integrity check flags default values IB/hfi1: Remove redundant sysfs irq affinity entry IB/rdmavt: rdmavt can handle non aligned page maps drm/amdgpu:fix vpost_needed routine drm/amdgpu/powerplay: drop a redundant NULL check kbuild: Steal gcc's pie from the very beginning ARM: 8628/1: dma-mapping: preallocate DMA-debug hash tables in core_initcall ARM: 8624/1: proc-v7m.S: fix init section name ARM: fix backtrace fuse: fix fuse_write_end() if zero bytes were copied ARM: dts: STiH410-b2260: Fix typo in spi0 chipselect definition powerpc/64: Fix setting of AIL in hypervisor mode gpio: tc3589x: fix up .get_direction() gpio: do not double-check direction on sleeping chips tile: handle __ro_after_init like parisc does mlxsw: spectrum_router: Flush FIB tables during fini net: stmmac: Fix lack of link transition for fixed PHYs ftrace: Add more checks for FTRACE_FL_DISABLED in processing ip records ftrace: Ignore FTRACE_FL_DISABLED while walking dyn_ftrace records sctp: change sk state only when it has assocs in sctp_shutdown bnx2: Wait for in-flight DMA to complete at probe stage Revert "bnx2: Reset device during driver initialization" mailbox: PCC: Fix lockdep warning when request PCC channel ALSA: usb-audio: Fix use-after-free of usb_device at disconnect ARM: dts: omap5: board-common: fix wrong SMPS6 (VDD-DDR3) voltage xtensa: wire up new pkey_{mprotect,alloc,free} syscalls Revert "ACPICA: FADT support cleanup" ps3_gelic: fix spelling mistake in debug message ASoC: lpass-platform: fix uninitialized variable Revert "printk: make reading the kernel log flush pending lines" i2c: mux: fix up dependencies gp8psk-fe: add missing MODULE_foo() macros sunrpc: svc_age_temp_xprts_now should not call setsockopt non-tcp transports dmaengine: cpp41: Fix handling of error path dmaengine: cppi41: Fix unpaired pm runtime when only a USB hub is connected dmaengine: cppi41: Fix list not empty warning on module removal dmaengine: sun6i: fix the uninitialized value for v_lli nvmet-rdma: drain the queue-pair just before freeing it nvme-rdma: stop and free io queues on connect failure nvmet-rdma: don't forget to delete a queue from the list of connection failed nvmet: Don't queue fatal error work if csts.cfs is set nvme-rdma: reject non-connect commands before the queue is live nvmet-rdma: Fix possible NULL deref when handling rdma cm events ntb_perf: potential info leak in debugfs ntb: ntb_hw_intel: init peer_addr in struct intel_ntb_dev ntb: make DMA_OUT_RESOURCE_TO HZ independent ntb_transport: make DMA_OUT_RESOURCE_TO HZ independent NTB: ntb_hw_intel: Fix typo in module parameter descriptions ntb_pingpong: Fix db_init parameter description net: ethernet: ixp4xx_eth: fix spelling mistake in debug message ibmvnic: Fix size of debugfs name buffer ibmvnic: Unmap ibmvnic_statistics structure sfc: clear napi_hash state when copying channels mlxsw: spectrum_router: Correctly dump neighbour activity mlxsw: spectrum: Fix refcount bug on span entries bnxt_en: Fix VF virtual link state. bnxt_en: Fix ring arithmetic in bnxt_setup_tc(). Revert "include/uapi/linux/atm_zatm.h: include linux/time.h" tcp: take care of truncations done by sk_filter() ipv4: use new_gw for redirect neigh lookup r8152: Fix error path in open function crypto: caam - do not register AES-XTS mode on LP units x86/efi: Prevent mixed mode boot corruption with CONFIG_VMAP_STACK=y x86/efi: Fix EFI memmap pointer size warning net: bpqether.h: remove if_ether.h guard net: __skb_flow_dissect() must cap its return value bpf: Add test for bpf_redirect to ipip/ip6tnl bpf: Fix bpf_redirect to an ipip/ip6tnl dev powerpc/oops: Fix missing pr_cont()s in instruction dump powerpc/oops: Fix missing pr_cont()s in show_regs() powerpc/oops: Fix missing pr_cont()s in print_msr_bits() et. al. powerpc/oops: Fix missing pr_cont()s in show_stack() powerpc: Fix exception vector build with 2.23 era binutils powerpc/64s: Fix system reset interrupt winkle wakeups drm/amdgpu: Attach exclusive fence to prime exported bo's. (v5) ALSA: hda - Fix mic regression by ASRock mobo fixup drm/i915: Refresh that status of MST capable connectors in ->detect() drm/i915: Grab the rotation from the passed plane state for VLV sprites drm/i915: Mark CPU cache as dirty when used for rendering perf/x86/intel/uncore: Add more Intel uncore IMC PCI IDs for SkyLake drm/arcpgu: Accommodate adv7511 switch to DRM bridge i2c: Documentation: i2c-topology: fix minor whitespace nit i2c: mux: demux-pinctrl: make drivers with no pinctrl work again mlxsw: spectrum_router: Ignore FIB notification events for non-init namespaces mlxsw: spectrum_router: Fix handling of neighbour structure qed: Correct rdma params configuration qed: configure ll2 RoCE v1/v2 flavor correctly ipv4: update comment to document GSO fragmentation cases. ALSA: hda - add a new condition to check if it is thinkpad net: tcp response should set oif only if it is L3 master Net Driver: Add Cypress GX3 VID=04b4 PID=3610. rtnl: reset calcit fptr in rtnl_unregister() vxlan: hide unused local variable ibmvnic: Start completion queue negotiation at server-provided optimum values net: icmp_route_lookup should use rt dev to determine L3 domain net: qcom/emac: enable flow control if requested net: qcom/emac: configure the external phy to allow pause frames ARM: omap3: Add missing memory node in SOM-LV kbuild: be more careful about matching preprocessed asm ___EXPORT_SYMBOL x86/kexec: add -fno-PIE scripts/has-stack-protector: add -fno-PIE x86/cpu: Deal with broken firmware (VMWare/XEN) net: bgmac: fix reversed checks for clock control flag bna: Add synchronization for tx ring. Revert "net/mlx4_en: Fix panic during reboot" net-ipv6: on device mtu change do not add mtu to mtu-less routes sock: fix sendmmsg for partial sendmsg driver: macvlan: Destroy new macvlan port if macvlan_common_newlink failed. x86/cpu/AMD: Fix cpu_llc_id for AMD Fam17h systems perf hists: Fix column length on --hierarchy perf hists browser: Fix column indentation on --hierarchy perf hists browser: Show folded sign properly on --hierarchy perf hists browser: Fix indentation of folded sign on --hierarchy perf hist browser: Fix hierarchy column counts arm64: dts: marvell: add unique identifiers for Armada A8k SPI controllers arm64: dts: marvell: fix clocksource for CP110 slave SPI0 arm64: dts: marvell: Fix typo in label name on Armada 37xx drm/fsl-dcu: disable planes before disabling CRTC drm/fsl-dcu: update all registers on flush drm/fsl-dcu: do not update when modifying irq registers netfilter: nf_tables: fix oops when inserting an element into a verdict map netfilter: conntrack: refine gc worker heuristics netfilter: conntrack: fix CT target for UNSPEC helpers netfilter: connmark: ignore skbs with magic untracked conntrack objects ipvs: use IPVS_CMD_ATTR_MAX for family.maxattr kbuild: add -fno-PIE genirq: Use irq type from irqdata instead of irqdesc gpio: pca953x: Move memcpy into mutex lock for set multiple gpio: pca953x: Fix corruption of other gpios in set_multiple. fib_trie: Correct /proc/net/route off by one error Documentation: networking: dsa: Update tagging protocols virtio-net: drop legacy features in virtio 1 mode net: icmp6_send should use dst dev to determine L3 domain ASoC: omap-abe-twl6040: fix typo in bindings documentation dts: omap5: board-common: enable twl6040 headset jack detection dts: omap5: board-common: add phandle to reference Palmas gpadc ARM: OMAP2+: avoid NULL pointer dereference ARM: OMAP2+: PRM: initialize en_uart4_mask and grpsel_uart4_mask ARM: dts: omap3: Fix memory node in Torpedo board ARM: AM43XX: Select OMAP_INTERCONNECT in Kconfig ARM: OMAP3: Fix formatting of features printed bpf: fix map not being uncharged during map creation failure bpf: fix htab map destruction when extra reserve is in use sctp: assign assoc_id earlier in __sctp_connect net: hns: fix device reference leaks net: ethernet: ti: davinci_emac: fix device reference leak net: ethernet: ti: cpsw: fix device and of_node leaks phy: fix device reference leaks drm/sun4i: Propagate error to the caller x86/platform/intel-mid: Retrofit pci_platform_pm_ops ->get_state hook xtensa: clean up printk usage for boot/crash logging ARM: dts: imx53-qsb: Fix regulator constraints rtc: omap: prevent disabling of clock/module during suspend rtc: omap: Fix selecting external osc net/mlx5: Fix invalid pointer reference when prof_sel parameter is invalid net/mlx5: E-Switch, Set the actions for offloaded rules properly net/mlx5e: Handle matching on vlan priority for offloaded TC rules net/mlx5e: Disallow changing name-space for VF representors net/mlx5e: Re-arrange XDP SQ/CQ creation net/mlx5e: Fix XDP error path of mlx5e_open_channel() taskstats: fix the length of cgroupstats_cmd_get_policy genetlink: fix a memory leak on error path ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped ehea: fix operation state report ipv6: dccp: fix out of bound access in dccp_v6_err() netlink: netlink_diag_dump() runs without locks dccp: fix out of bound access in dccp_v4_err() dccp: do not send reset to already closed sockets dccp: do not release listeners too soon tcp: fix return value for partial writes ipv4: allow local fragmentation in ip_finish_output_gso() net: tcp: check skb is non-NULL for exact match on lookups tcp: fix potential memory corruption qede: Correctly map aggregation replacement pages cxgb4: correct device ID of T6 adapter inet: fix sleeping inside inet_wait_for_connect() video: ARM CLCD: fix Vexpress regression xen-netfront: cast grant table reference first to type int ip6_udp_tunnel: remove unused IPCB related codes ip6_tunnel: Clear IP6CB in ip6tunnel_xmit() MAINTAINERS: Update MELLANOX MLX5 core VPI driver maintainers drm/sun4i: Fix error handling net: mv643xx_eth: ensure coalesce settings survive read-modify-write net/mlx5: Simplify a test unix: escape all null bytes in abstract unix domain socket net: qcom/emac: use correct value for SGMII_LN_UCDR_SO_GAIN_MODE0 drivers: net: xgene: fix: Coalescing values for v2 hardware drivers: net: xgene: fix: Disable coalescing on v1 hardware kbuild: modversions for EXPORT_SYMBOL() for asm bgmac: stop clearing DMA receive control register right after it is set sctp: hold transport instead of assoc when lookup assoc in rx path sctp: return back transport in __sctp_rcv_init_lookup sctp: hold transport instead of assoc in sctp_diag xen-netfront: do not cast grant table reference to signed short can: bcm: fix warning in bcm_connect/proc_register can: sja1000: plx_pci: Add support for Moxa CAN devices mlxsw: spectrum: Fix incorrect reuse of MID entries qede: Fix statistics' strings for Tx/Rx queues net: mangle zero checksum in skb_checksum_help() net: clear sk_err_soft in sk_clone_lock() dctcp: avoid bogus doubling of cwnd after loss ipv6: add mtu lock check in __ip6_rt_update_pmtu ipv6: Don't use ufo handling on later transformed packets netfilter: nft_dup: do not use sreg_dev if the user doesn't specify it netfilter: nf_tables: destroy the set if fail to add transaction r8152: Fix broken RX checksums. netfilter: ip_vs_sync: fix bogus maybe-uninitialized warning netfilter: conntrack: avoid excess memory allocation netfilter: nf_tables: fix type mismatch with error return from nft_parse_u32_check netfilter: nf_conntrack_sip: extend request line validation netfilter: nf_tables: fix race when create new element in dynset netfilter: nf_tables: fix *leak* when expr clone fail netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled brcmfmac: avoid maybe-uninitialized warning in brcmf_cfg80211_start_ap ARM: dts: sun8i: fix the pinmux for UART1 kbuild: prevent lib-ksyms.o rebuilds rtc: cmos: Don't enable interrupts in the middle of the interrupt handler iwlwifi: mvm: fix netdetect starting/stopping for unified images iwlwifi: pcie: fix SPLC structure parsing rtc: cmos: remove all __exit_p annotations rtc: asm9260: fix module autoload iwlwifi: mvm: wake the wait queue when the RX sync counter is zero iwlwifi: mvm: comply with fw_restart mod param on suspend iwlwifi: mvm: fix d3_test with unified D0/D3 images iwlwifi: mvm: use ssize_t for len in iwl_debugfs_mem_read() iwlwifi: pcie: mark command queue lock with separate lockdep class drm/mediatek: modify the factor to make the pll_rate set in the 1G-2G range drm/mediatek: enhance the HDMI driving current drm/mediatek: do mtk_hdmi_send_infoframe after HDMI clock enable drm/mediatek: clear IRQ status before enable OVL interrupt drm/mediatek: set vblank_disable_allowed to true drm/mediatek: fix a typo of OD_CFG to OD_RELAYMODE dmaengine: mmp_tdma: add missing select GENERIC_ALLOCATOR in Kconfig dmaengine: edma: Fix error return code in edma_alloc_chan_resources() fuse: fix root dentry initialization drm/sun4i: rgb: Remove the bridge enable/disable functions drm/sun4i: rgb: Enable panel after controller Change-Id: I1fab8716aff3b316b38add803837e6bb49fa8422 Signed-off-by: Kyle Yan <kyan@codeaurora.org>	2016-11-20 15:03:58 -08:00
Stefan Hajnoczi	0f5258cd91	netns: fix get_net_ns_by_fd(int pid) typo ... The argument to get_net_ns_by_fd() is a /proc/$PID/ns/net file descriptor not a pid. Fix the typo. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Acked-by: Rami Rosen <roszenrami@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-11-18 14:01:58 -05:00
Alexander Duyck	3b7093346b	ipv4: Restore fib_trie_flush_external function and fix call ordering ... The patch that removed the FIB offload infrastructure was a bit too aggressive and also removed code needed to clean up us splitting the table if additional rules were added. Specifically the function fib_trie_flush_external was called at the end of a new rule being added to flush the foreign trie entries from the main trie. I updated the code so that we only call fib_trie_flush_external on the main table so that we flush the entries for local from main. This way we don't call it for every rule change which is what was happening previously. Fixes: 347e3b28c1 ("switchdev: remove FIB offload infrastructure") Reported-by: Eric Dumazet <edumazet@google.com> Cc: Jiri Pirko <jiri@mellanox.com> Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-11-16 13:24:50 -05:00
Eric Dumazet	e88a276614	gro_cells: mark napi struct as not busy poll candidates ... Rolf Neugebauer reported very long delays at netns dismantle. Eric W. Biederman was kind enough to look at this problem and noticed synchronize_net() occurring from netif_napi_del() that was added in linux-4.5 Busy polling makes no sense for tunnels NAPI. If busy poll is used for sessions over tunnels, the poller will need to poll the physical device queue anyway. netif_tx_napi_add() could be used here, but function name is misleading, and renaming it is not stable material, so set NAPI_STATE_NO_BUSY_POLL bit directly. This will avoid inserting gro_cells napi structures in napi_hash[] and avoid the problematic synchronize_net() (per possible cpu) that Rolf reported. Fixes: 93d05d4a32 ("net: provide generic busy polling to all NAPI drivers") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Rolf Neugebauer <rolf.neugebauer@docker.com> Reported-by: Eric W. Biederman <ebiederm@xmission.com> Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Tested-by: Rolf Neugebauer <rolf.neugebauer@docker.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-11-15 22:27:27 -05:00
Eric Dumazet	ac6e780070	tcp: take care of truncations done by sk_filter() ... With syzkaller help, Marco Grassi found a bug in TCP stack, crashing in tcp_collapse() Root cause is that sk_filter() can truncate the incoming skb, but TCP stack was not really expecting this to happen. It probably was expecting a simple DROP or ACCEPT behavior. We first need to make sure no part of TCP header could be removed. Then we need to adjust TCP_SKB_CB(skb)->end_seq Many thanks to syzkaller team and Marco for giving us a reproducer. Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Marco Grassi <marco.gra@gmail.com> Reported-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-11-13 12:30:02 -05:00
David S. Miller	9fa684ec86	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf ... Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains a larger than usual batch of Netfilter fixes for your net tree. This series contains a mixture of old bugs and recently introduced bugs, they are: 1) Fix a crash when using nft_dynset with nft_set_rbtree, which doesn't support the set element updates from the packet path. From Liping Zhang. 2) Fix leak when nft_expr_clone() fails, from Liping Zhang. 3) Fix a race when inserting new elements to the set hash from the packet path, also from Liping. 4) Handle segmented TCP SIP packets properly, basically avoid that the INVITE in the allow header create bogus expectations by performing stricter SIP message parsing, from Ulrich Weber. 5) nft_parse_u32_check() should return signed integer for errors, from John Linville. 6) Fix wrong allocation instead of connlabels, allocate 16 instead of 32 bytes, from Florian Westphal. 7) Fix compilation breakage when building the ip_vs_sync code with CONFIG_OPTIMIZE_INLINING on x86, from Arnd Bergmann. 8) Destroy the new set if the transaction object cannot be allocated, also from Liping Zhang. 9) Use device to route duplicated packets via nft_dup only when set by the user, otherwise packets may not follow the right route, again from Liping. 10) Fix wrong maximum genetlink attribute definition in IPVS, from WANG Cong. 11) Ignore untracked conntrack objects from xt_connmark, from Florian Westphal. 12) Allow to use conntrack helpers that are registered NFPROTO_UNSPEC via CT target, otherwise we cannot use the h.245 helper, from Florian. 13) Revisit garbage collection heuristic in the new workqueue-based timer approach for conntrack to evict objects earlier, again from Florian. 14) Fix crash in nf_tables when inserting an element into a verdict map, from Liping Zhang. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>	2016-11-09 20:38:18 -05:00
Channagoud Kadabi	dd5e9ddd9c	Merge remote-tracking branch 'origin/tmp-bc33b0c' into 4.8 ... * origin/tmp-bc33b0c: Linux 4.9-rc4 PCI: designware: Check for iATU unroll support after initializing host i2c: core: fix NULL pointer dereference under race condition MIPS: Fix max_low_pfn with disabled highmem MIPS: Correct MIPS I FP sigcontext layout MIPS: Fix ISA I/II FP signal context offsets MIPS: Remove FIR from ISA I FP signal context MIPS: Fix ISA I FP sigcontext access violation handling MIPS: Fix FCSR Cause bit handling for correct SIGFPE issue MIPS: ptrace: Also initialize the FP context on individual FCSR writes MIPS: dump_tlb: Fix printk continuations MIPS: Fix __show_regs() output MIPS: traps: Fix output of show_code MIPS: traps: Fix output of show_stacktrace MIPS: traps: Fix output of show_backtrace MIPS: Fix build of compressed image MIPS: generic: Fix KASLR for generic kernel. MIPS: KASLR: Fix handling of NULL FDT MIPS: Malta: Fixup reboot MIPS: CPC: Provide default mips_cpc_default_phys_base to ignore CPC firewire: net: fix fragmented datagram_size off-by-one firewire: net: guard against rx buffer overflows sched/core: Remove pointless printout in sched_show_task() sched/core: Fix oops in sched_show_task() virtio-gpu: fix vblank events parisc: Ignore the pkey system calls for now parisc: Use LINUX_GATEWAY_ADDR define instead of hardcoded value parisc: Ensure consistent state when switching to kernel stack at syscall entry parisc: Avoid trashing sr2 and sr3 in LWS code parisc: use KERN_CONT when printing device inventory kvm: x86: Check memopp before dereference (CVE-2016-8630) kvm: nVMX: VMCLEAR an active shadow VMCS after last use KVM: x86: drop TSC offsetting kvm_x86_ops to fix KVM_GET/SET_CLOCK nfsd: Fix general protection fault in release_lock_stateid() svcrdma: backchannel cannot share a page for send and rcv buffers gpio/mvebu: Use irq_domain_add_linear fork: Add task stack refcounting sanity check and prevent premature task stack freeing drm/nouveau/acpi: fix check for power resources support gpio: of: fix GPIO drivers with multiple gpio_chip for a single node gpio: GPIO_GET_LINE{HANDLE,EVENT}_IOCTL: Fix file descriptor leak latent_entropy: Fix wrong gcc code generation with 64 bit variables gcc-plugins: Export symbols needed by gcc tpm: remove invalid min length check from tpm_do_selftest() ovl: fsync after copy-up ovl: fix get_acl() on tmpfs ovl: update S_ISGID when setting posix ACLs virtio_ring: mark vring_dma_dev inline virtio/vhost: add Jason to list of maintainers virtio_blk: Delete an unnecessary initialisation in init_vq() virtio_blk: Use kmalloc_array() in init_vq() virtio: remove config.c virtio: console: Unlock vqs while freeing buffers ringtest: poll for new buffers once before updating event index ringtest: commonize implementation of poll_avail/poll_used ringtest: use link-time optimization virtio: update balloon size in balloon "probe" virtio_ring: Make interrupt suppression spec compliant virtio_pci: Limit DMA mask to 44 bits for legacy virtio devices geneve: avoid using stale geneve socket. vxlan: avoid using stale vxlan socket. qede: Fix out-of-bound fastpath memory access net: phy: dp83848: add dp83822 PHY support enic: fix rq disable tipc: fix broadcast link synchronization problem ibmvnic: Fix missing brackets in init_sub_crq_irqs ibmvnic: Fix releasing of sub-CRQ IRQs in interrupt context Revert "ibmvnic: Fix releasing of sub-CRQ IRQs in interrupt context" arch/powerpc: Update parameters for csum_tcpudp_magic & csum_tcpudp_nofold net/mlx4_en: Save slave ethtool stats command net/mlx4_en: Fix potential deadlock in port statistics flow net/mlx4: Fix firmware command timeout during interrupt test net/mlx4_core: Do not access comm channel if it has not yet been initialized net/mlx4_en: Fix panic during reboot net/mlx4_en: Process all completions in RX rings after port goes up net/mlx4_en: Resolve dividing by zero in 32-bit system net/mlx4_core: Change the default value of enable_qos net/mlx4_core: Avoid setting ports to auto when only one port type is supported net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec rds: debug messages are enabled by default ibmvnic: Fix releasing of sub-CRQ IRQs in interrupt context net: mv643xx_eth: Fetch the phy connection type from DT Revert "hv_netvsc: report vmbus name in ethtool" packet: on direct_xmit, limit tso and csum to supported devices net_sched actions: use nla_parse_nested() cxgb4: Fix error handling in alloc_uld_rxqs(). IB/mlx4: avoid a -Wmaybe-uninitialize warning spi: dspi: clear SPI_SR before enable interrupt ip6_tunnel: Update skb->protocol to ETH_P_IPV6 in ip6_tnl_xmit() bpf: fix samples to add fake KBUILD_MODNAME inet: Fix missing return value in inet6_hash net/mlx5: Avoid passing dma address 0 to firmware net/mlx5: PCI error recovery health care simulation net/mlx5: Fix race between PCI error handlers and health work net/mlx5: Clear health sick bit when starting health poll net/mlx5: Change the acl enable prototype to return status net/mlx5e: Unregister netdev before detaching it net/mlx5e: Choose best nearest LRO timeout net/mlx5: Correctly initialize last use of flow counters net/mlx5: Fix autogroups groups num not decreasing net/mlx5: Keep autogroups list ordered net/mlx5: Always Query HCA caps after setting them {net, ib}/mlx5: Make cache line size determination at runtime. sctp: validate chunk len before actually using it md: be careful not lot leak internal curr_resync value into metadata. -- (all) raid1: handle read error also in readonly mode raid5-cache: correct condition for empty metadata write sunrpc: fix some missing rq_rbuffer assignments mlxsw: spectrum_router: Compare only trees which are in use during tree get mlxsw: spectrum_router: Save requested prefix bitlist when creating tree regulator: core: silence warning: "VDD1: ramp_delay not set" regmap: Rename ret variable in regmap_read_poll_timeout drm/i915: Fix SKL+ 90/270 degree rotated plane coordinate computation drm/i915: Remove two invalid warns drm/i915: Rotated view does not need a fence drm/i915/fbc: fix CFB size calculation for gen8+ drm: i915: Wait for fences on new fb, not old drm/i915: Clean up DDI DDC/AUX CH sanitation drm/i915: Respect alternate_aux_channel for all DDI ports drm/i915/gen9: fix watermarks when using the pipe scaler drm/i915: Fix mismatched INIT power domain disabling during suspend drm/i915: fix a read size argument drm/i915: Use fence_write() from rpm resume drm/i915/gen9: fix DDB partitioning for multi-screen cases drm/i915: workaround sparse warning on variable length arrays drm/i915: keep declarations in i915_drv.h KVM: x86: fix wbinvd_dirty_mask use-after-free mtd: mtk: avoid warning in mtk_ecc_encode mtd: nand: Fix data interface configuration logic mtd: nand: gpmi: disable the clocks on errors i40e: fix call of ndo_dflt_bridge_getlink() net sched filters: fix notification of filter delete with proper handle i40e: disable MSI-X interrupts if we cannot reserve enough vectors i40e: Fix configure TCs after initial DCB disable ixgbe: fix panic when using macvlan with l2-fwd-offload enabled net: bgmac: fix spelling mistake: "connecton" -> "connection" flow_dissector: fix vlan tag handling net: ipv6: Do not consider link state for nexthop validation net: ipv6: Fix processing of RAs in presence of VRF kalmia: avoid potential uninitialized variable use MAINTAINERS: add more people to the MTD maintainer team macsec: Fix header length if SCI is added if explicitly disabled MAINTAINERS: add a maintainer for the SPI NOR subsystem at803x: double check SGMII side autoneg Revert "at803x: fix suspend/resume for SGMII link" kvm/x86: Show WRMSR data is in hex drm/amd/powerplay: fix bug get wrong evv voltage of Polaris. drm/amdgpu/si_dpm: workaround for SI kickers sparc64: Handle extremely large kernel TLB range flushes more gracefully. kvm: nVMX: Fix kernel panics induced by illegal INVEPT/INVVPID types KVM: document lock orders mmc: sdhci-msm: Fix error return code in sdhci_msm_probe() MAINTAINERS: Update qlogic networking drivers netvsc: fix incorrect receive checksum offloading scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware scsi: scsi_debug: Fix memory leak if LBP enabled and module is unloaded udp: fix IP_CHECKSUM handling sctp: fix the panic caused by route update doc: update docbook annotations for socket and skb rocker: fix error return code in rocker_world_check_init() sunrpc: don't pass on-stack memory to sg_set_buf vfio/pci: Fix integer overflows, bitmask check PCI: qcom: Fix pp->dev usage before assignment drm/radeon/si_dpm: workaround for SI kickers drm/amdgpu: fix s3 resume back, uvd dpm randomly can't disable. sparc64: Fix illegal relative branches in hypervisor patched TLB cross-call code. sparc64: Fix instruction count in comment for __hypervisor_flush_tlb_pending. drm/dp/mst: Check peer device type before attempting EDID read drm/dp/mst: Clear port->pdt when tearing down the i2c adapter drm/fb-helper: Keep references for the current set of used connectors drm: Don't force all planes to be added to the state due to zpos drm/fb-helper: Fix connector ref leak on error KVM: fix OOPS on flush_work KVM: s390: Fix STHYI buffer alignment for diag224 KVM: MIPS: Precalculate MMIO load resume PC KVM: MIPS: Make ERET handle ERL before EXL KVM: MIPS: Fix lazy user ASID regenerate for SMP spi: fsl-espi: avoid processing uninitalized data on error drm/fb-helper: Don't call dirty callback for untouched clips drm: Release reference from blob lookup after replacing property mac80211: fix some sphinx warnings cfg80211: process events caused by suspend before suspending sparc64: Handle extremely large kernel TSB range flushes sanely. sparc: Handle negative offsets in arch_jump_label_transform sparc64: Fix illegal relative branches in hypervisor patched TLB code. drm/radeon: drop register readback in cayman_cp_int_cntl_setup drm/amdgpu/vce3: only enable 3 rings on new enough firmware (v2) mmc: dw_mmc-pltfm: fix the potential NULL pointer dereference sparc64: Delete now unused user copy fixup functions. sparc64: Delete now unused user copy assembler helpers. sparc64: Convert U3copy_{from,to}_user to accurate exception reporting. sparc64: Convert NG2copy_{from,to}_user to accurate exception reporting. sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting. sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting. scsi: megaraid_sas: Fix data integrity failure for JBOD (passthrough) devices Input: psmouse - cleanup Focaltech code md: report 'write_pending' state when array in sync md/raid5: write an empty meta-block when creating log super-block md/raid5: initialize next_checkpoint field before use RAID10: ignore discard error RAID1: ignore discard error drm/amdgpu: fix fence slab teardown drm/amdgpu: update kernel-doc for some functions drm/amdgpu: fix a vm_flush fence leak drm/amdgpu: fix sched fence slab teardown Revert "drm/radeon: fix DP link training issue with second 4K monitor" drm/amdgpu/dpm: flush any thermal work on fini drm/amdgpu: cancel reset work on fini nfsd: move blocked lock handling under a dedicated spinlock sparc64: Convert U1copy_{from,to}_user to accurate exception reporting. sparc64: Convert GENcopy_{from,to}_user to accurate exception reporting. sparc64: Convert copy_in_user to accurate exception reporting. sparc64: Prepare to move to more saner user copy exception handling. sparc64: Delete __ret_efault. sparc32: Fix old style declaration GCC warnings sparc64: Fix old style declaration GCC warnings sparc64: Setup a scheduling domain for highest level cache. spi: mark device nodes only in case of successful instantiation btrfs: fix WARNING in btrfs_select_ref_head() Btrfs: remove some no-op casts btrfs: pass correct args to btrfs_async_run_delayed_refs() btrfs: make file clone aware of fatal signals btrfs: qgroup: Prevent qgroup->reserved from going subzero net: sctp, forbid negative length net: fec: Call swap_buffer() prior to IP header alignment ipv6: do not increment mac header when it's unset bnx2x: Use the correct divisor value for PHC clock readings. qede: Fix incorrrect usage of APIs for un-mapping DMA memory qed: Zero-out the buffer paased to dcbx_query() API qede: Reconfigure rss indirection direction table when rss count is updated qed*: Reduce the memory footprint for Rx path qede: Loopback implementation should ignore the normal traffic qede: Do not allow RSS config for 100G devices qede: get_channels() need to populate max tx/rx coalesce values ipv4: use the right lock for ping_group_range net: dsa: bcm_sf2: Do not rely on kexec_in_progress Revert "kexec: Export kexec_in_progress to modules" netns: revert "netns: avoid disabling irq for netns id" ipv6: fix a potential deadlock in do_ipv6_setsockopt() drm/amd/powerplay: don't give up if DPM is already running drm/amd/powerplay: fix static checker warning in process_pptables_v1_0.c drm/amdgpu: avoid drm error log during S3 on RHEL7.3 drm/amdgpu: explicitly set pg_flags for ST drm/amdgpu/st: move ATC CG golden init from gfx to mc drm/amd/amdgpu: expose max engine and memory clock for powerplay enabled case drm/amdgpu: move atom scratch register save/restore to common code drm/amdgpu: drop atom scratch save/restore in gpu reset drm/radeon/si_dpm: Limit clocks on HD86xx part drm/amdgpu/powerplay/smu7: fix static checker warning batman-adv: fix splat on disabling an interface kexec: Export kexec_in_progress to modules ipv4: disable BH in set_ping_group_range() udp: must lock the socket in udp_disconnect() net: dsa: bcm_sf2: Prevent GPHY shutdown for kexec'd kernels bpf, test: fix ld_abs + vlan push/pop stress test net: add recursion limit to GRO ipv6: properly prevent temp_prefered_lft sysctl race netfilter: fix nf_queue handling netfilter: conntrack: restart gc immediately if GC_MAX_EVICTS is reached stmmac: display the descriptors if DES0 = 0 net/ncsi: Improve HNCDSC AEN handler net/ncsi: Choose hot channel as active one if necessary net/ncsi: Fix stale link state of inactive channels on failover net/ncsi: Avoid if statements in ncsi_suspend_channel() net/sched: act_mirred: Use passed lastuse argument mlxsw: pci: Fix reset wait for SwitchX2 mlxsw: switchx2: Fix ethernet port initialization mlxsw: spectrum_router: Make mlxsw_sp_router_fib4_del return void and remove warn mlxsw: spectrum_router: Use correct tree index for binding drm/imx: ipuv3-plane: disable local alpha for planes without alpha channel drm/imx: ipuv3-plane: make sure x/y offsets are even in case of chroma subsampling Bluetooth: btwilink: Fix probe return value stmmac: fix and review the ptp registration. Input: i8042 - add XMG C504 to keyboard reset table Bluetooth: Fix append max 11 bytes of name to scan rsp data netfilter: x_tables: suppress kmemcheck warning tcp: do not export sysctl_tcp_low_latency rtnetlink: Add rtnexthop offload flag to compare mask switchdev: Execute bridge ndos only for bridge ports net: core: Correctly iterate over lower adjacency list flow_dissector: Check skb for VLAN only if skb specified. ARM: wire up new pkey syscalls ARM: fix oops when using older ARMv4T CPUs qed: Use list_move_tail instead of list_del/list_add_tail rocker: fix maybe-uninitialized warning net/hyperv: avoid uninitialized variable net: bcm63xx: avoid referencing uninitialized variable soreuseport: do not export reuseport_add_sock() ibmvnic: Update MTU after device initialization ibmvnic: Fix GFP_KERNEL allocation in interrupt context ibmvnic: Driver Version 1.0.1 bridge: multicast: restore perm router ports on multicast enable netfilter: nf_tables: avoid uninitialized variable warning tcp: Remove unused but set variable cxgb4: Fix number of queue sets corssing the limit ipv4: Remove unused but set variable dwc_eth_qos: enable flow control by default dwc_eth_qos: do not clear pause flags from phy_device->supported net/hsr: Remove unused but set variable bnx2: fix locking when netconsole is used drm/imx: ipuv3-plane: Access old u/vbo properly in ->atomic_check for YU12/YV12 drm/imx: drm_dev_alloc() returns error pointers drm/imx: ipuv3-plane: Skip setting u/vbo only when we don't need modeset drm/imx: ipuv3-plane: Switch EBA buffer only when we don't need modeset net: dsa: bcm_sf2: Fix module autoload for OF registration net: dsa: b53: Fix module autoload net: hisilicon: Fix hns_mdio module autoload for OF registration net: qcom/emac: Fix module autoload for OF registration net: hns: Fix hns_dsaf module autoload for OF registration net: ethernet: nb8800: Fix module autoload net: nps_enet: Fix module autoload netfilter: nft_range: validate operation netlink attribute netfilter: nft_exthdr: fix error handling in nft_exthdr_init() netfilter: nf_tables: underflow in nft_parse_u32_check() netfilter: nft_hash: add missing NFTA_HASH_OFFSET's nla_policy netfilter: xt_ipcomp: add "ip[6]t_ipcomp" module alias name netfilter: xt_NFLOG: fix unexpected truncated packet netfilter: conntrack: remove obsolete sysctl (nf_conntrack_events_retry_timeout) netfilter: nft_dynset: fix element timeout for HZ != 1000 netfilter: xt_hashlimit: Add missing ULL suffixes for 64-bit constants cxgb4: fix memory leak of qe on error exit path net: pktgen: remove rcu locking in pktgen_change_name() net: Require exact match for TCP socket lookups if dif is l3mdev mac80211: move struct aead_req off the stack [media] radio-bcm2048: don't ignore errors batman-adv: Add BATADV_DBG_TP_METER to BATADV_DBG_ALL batman-adv: Modify neigh_list only with rcu-list functions Btrfs: kill BUG_ON in do_relocation gpu: ipu-v3: Use ERR_CAST instead of ERR_PTR(PTR_ERR()) drm/imx: hide an unused label vmxnet3: avoid assumption about invalid dma_pa in vmxnet3_set_mc() stmmac: fix an error code in stmmac_ptp_register() net: qcom/emac: disable interrupts before calling phy_disconnect r8169: set coherent DMA mask as well as streaming DMA mask net: asix: Avoid looping when the device does not respond ethtool: silence warning on bit loss [media] pctv452e: fix semicolon.cocci warnings [media] flexcop-usb: don't use stack for DMA [media] stk-webcam: don't use stack for DMA [media] s2255drv: don't use stack for DMA [media] cpia2_usb: don't use stack for DMA [media] digitv: handle error code on RC query [media] dw2102: return error if su3000_power_ctrl() fails [media] nova-t-usb2: handle error code on RC query [media] technisat-usb2: use DMA buffers for I2C transfers [media] pctv452e: don't call BUG_ON() on non-fatal error [media] pctv452e: don't do DMA on stack [media] nova-t-usb2: don't do DMA on stack [media] gp8psk: don't go past the buffer size [media] gp8psk: don't do DMA on stack [media] dtv5100: don't do DMA on stack [media] dtt200u: handle USB control message errors [media] dtt200u: don't do DMA on stack [media] dtt200u-fe: handle errors on USB control messages [media] dtt200u-fe: don't do DMA on stack [media] dtt200u-fe: don't keep waiting for lock at set_frontend() [media] digitv: don't do DMA on stack [media] dibusb: handle error code on RC query [media] dibusb: don't do DMA on stack [media] dib0700_core: don't use stack on I2C reads [media] dib0700: be sure that dib0700_ctrl_rd() users can do DMA [media] cxusb: don't do DMA on stack [media] cinergyT2-fe: don't do DMA on stack [media] cinergyT2-fe: cache stats at cinergyt2_fe_read_status() [media] cinergyT2-core: handle error code on RC query [media] cinergyT2-core: don't do DMA on stack [media] af9005: don't do DMA on stack net/mlx4_en: fixup xdp tx irq to match rx qed: Additional work toward cleaning C=1 qed*: Fix Kconfig dependencies with INFINIBAND_QEDR qed: Fix static checker warning. IPv6: fix DESYNC_FACTOR IPv6: Drop the temporary address regen_timer IB/ipoib: move back IB LL address into the hard header Documentation/networking: update git urls to use https over http net: wan: slic_ds26522: Allow driver to built if COMPILE_TEST is enabled net: wan: slic_ds26522: Export OF module alias information net: wan: slic_ds26522: add SPI device ID table to fix module autoload ipv6: correctly add local routes when lo goes up ip6_tunnel: fix ip6_tnl_lookup afs: call->operation_ID sometimes used as __be32 sometimes as u32 regmap: include <linux/delay.h> from include/linux/regmap.h ath6kl: add Dell OEM SDIO I/O for the Venue 8 Pro Revert "ath9k_hw: implement temperature compensation support for AR9003+" ath10k: cache calibration data when the core is stopped rtlwifi: Fix regression caused by commit d86e647688 rxrpc: Fix checking of error from ip6_route_output() rxrpc: Fix checker warning by not passing always-zero value to ERR_PTR() afs: unmapping the wrong buffer Bluetooth: hci_bcm: Fix autosuspend PM for Lenovo ThinkPad 8 mac80211: fix CMD_FRAME for AP_VLAN mac80211: validate DA/SA during A-MSDU decapsulation cfg80211: add ability to check DA/SA in A-MSDU decapsulation cfg80211: let ieee80211_amsdu_to_8023s() take only header-less SKB mac80211: discard multicast and 4-addr A-MSDUs rtl8xxxu: Fix rtl8192eu driver reload issue rtl8xxxu: Fix rtl8723bu driver reload issue rtl8xxxu: Fix big-endian problem reporting mactime rtl8xxxu: Fix memory leak in handling rxdesc16 packets wlcore: sdio: drop kfree for memory allocated with devm_kzalloc Conflicts: net/ipv6/route.c Signed-off-by: Channagoud Kadabi <ckadabi@codeaurora.org> Change-Id: I217e64cee0157f80c45e63acd3311e138e33b949	2016-11-07 20:12:20 -08:00
Eric Dumazet	c3f24cfb3e	dccp: do not release listeners too soon ... Andrey Konovalov reported following error while fuzzing with syzkaller : IPv4: Attempt to release alive inet socket ffff880068e98940 kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN Modules linked in: CPU: 1 PID: 3905 Comm: a.out Not tainted 4.9.0-rc3+ #333 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88006b9e0000 task.stack: ffff880068770000 RIP: 0010:[<ffffffff819ead5f>] [<ffffffff819ead5f>] selinux_socket_sock_rcv_skb+0xff/0x6a0 security/selinux/hooks.c:4639 RSP: 0018:ffff8800687771c8 EFLAGS: 00010202 RAX: ffff88006b9e0000 RBX: 1ffff1000d0eee3f RCX: 1ffff1000d1d312a RDX: 1ffff1000d1d31a6 RSI: dffffc0000000000 RDI: 0000000000000010 RBP: ffff880068777360 R08: 0000000000000000 R09: 0000000000000002 R10: dffffc0000000000 R11: 0000000000000006 R12: ffff880068e98940 R13: 0000000000000002 R14: ffff880068777338 R15: 0000000000000000 FS: 00007f00ff760700(0000) GS:ffff88006cd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020008000 CR3: 000000006a308000 CR4: 00000000000006e0 Stack: ffff8800687771e0 ffffffff812508a5 ffff8800686f3168 0000000000000007 ffff88006ac8cdfc ffff8800665ea500 0000000041b58ab3 ffffffff847b5480 ffffffff819eac60 ffff88006b9e0860 ffff88006b9e0868 ffff88006b9e07f0 Call Trace: [<ffffffff819c8dd5>] security_sock_rcv_skb+0x75/0xb0 security/security.c:1317 [<ffffffff82c2a9e7>] sk_filter_trim_cap+0x67/0x10e0 net/core/filter.c:81 [<ffffffff82b81e60>] __sk_receive_skb+0x30/0xa00 net/core/sock.c:460 [<ffffffff838bbf12>] dccp_v4_rcv+0xdb2/0x1910 net/dccp/ipv4.c:873 [<ffffffff83069d22>] ip_local_deliver_finish+0x332/0xad0 net/ipv4/ip_input.c:216 [< inline >] NF_HOOK_THRESH ./include/linux/netfilter.h:232 [< inline >] NF_HOOK ./include/linux/netfilter.h:255 [<ffffffff8306abd2>] ip_local_deliver+0x1c2/0x4b0 net/ipv4/ip_input.c:257 [< inline >] dst_input ./include/net/dst.h:507 [<ffffffff83068500>] ip_rcv_finish+0x750/0x1c40 net/ipv4/ip_input.c:396 [< inline >] NF_HOOK_THRESH ./include/linux/netfilter.h:232 [< inline >] NF_HOOK ./include/linux/netfilter.h:255 [<ffffffff8306b82f>] ip_rcv+0x96f/0x12f0 net/ipv4/ip_input.c:487 [<ffffffff82bd9fb7>] __netif_receive_skb_core+0x1897/0x2a50 net/core/dev.c:4213 [<ffffffff82bdb19a>] __netif_receive_skb+0x2a/0x170 net/core/dev.c:4251 [<ffffffff82bdb493>] netif_receive_skb_internal+0x1b3/0x390 net/core/dev.c:4279 [<ffffffff82bdb6b8>] netif_receive_skb+0x48/0x250 net/core/dev.c:4303 [<ffffffff8241fc75>] tun_get_user+0xbd5/0x28a0 drivers/net/tun.c:1308 [<ffffffff82421b5a>] tun_chr_write_iter+0xda/0x190 drivers/net/tun.c:1332 [< inline >] new_sync_write fs/read_write.c:499 [<ffffffff8151bd44>] __vfs_write+0x334/0x570 fs/read_write.c:512 [<ffffffff8151f85b>] vfs_write+0x17b/0x500 fs/read_write.c:560 [< inline >] SYSC_write fs/read_write.c:607 [<ffffffff81523184>] SyS_write+0xd4/0x1a0 fs/read_write.c:599 [<ffffffff83fc02c1>] entry_SYSCALL_64_fastpath+0x1f/0xc2 It turns out DCCP calls __sk_receive_skb(), and this broke when lookups no longer took a reference on listeners. Fix this issue by adding a @refcounted parameter to __sk_receive_skb(), so that sock_put() is used only when needed. Fixes: 3b24d854cb ("tcp/dccp: do not touch listener sk_refcnt under synflood") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-11-03 16:16:50 -04:00
Lance Richardson	9ee6c5dc81	ipv4: allow local fragmentation in ip_finish_output_gso() ... Some configurations (e.g. geneve interface with default MTU of 1500 over an ethernet interface with 1500 MTU) result in the transmission of packets that exceed the configured MTU. While this should be considered to be a "bad" configuration, it is still allowed and should not result in the sending of packets that exceed the configured MTU. Fix by dropping the assumption in ip_finish_output_gso() that locally originated gso packets will never need fragmentation. Basic testing using iperf (observing CPU usage and bandwidth) have shown no measurable performance impact for traffic not requiring fragmentation. Fixes: c7ba65d7b6 ("net: ip: push gso skb forwarding handling down the stack") Reported-by: Jan Tluka <jtluka@redhat.com> Signed-off-by: Lance Richardson <lrichard@redhat.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-11-03 16:10:26 -04:00
David Ahern	da96786e26	net: tcp: check skb is non-NULL for exact match on lookups ... Andrey reported the following error report while running the syzkaller fuzzer: general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 648 Comm: syz-executor Not tainted 4.9.0-rc3+ #333 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff8800398c4480 task.stack: ffff88003b468000 RIP: 0010:[<ffffffff83091106>] [< inline >] inet_exact_dif_match include/net/tcp.h:808 RIP: 0010:[<ffffffff83091106>] [<ffffffff83091106>] __inet_lookup_listener+0xb6/0x500 net/ipv4/inet_hashtables.c:219 RSP: 0018:ffff88003b46f270 EFLAGS: 00010202 RAX: 0000000000000004 RBX: 0000000000004242 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffc90000e3c000 RDI: 0000000000000054 RBP: ffff88003b46f2d8 R08: 0000000000004000 R09: ffffffff830910e7 R10: 0000000000000000 R11: 000000000000000a R12: ffffffff867fa0c0 R13: 0000000000004242 R14: 0000000000000003 R15: dffffc0000000000 FS: 00007fb135881700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020cc3000 CR3: 000000006d56a000 CR4: 00000000000006f0 Stack: 0000000000000000 000000000601a8c0 0000000000000000 ffffffff00004242 424200003b9083c2 ffff88003def4041 ffffffff84e7e040 0000000000000246 ffff88003a0911c0 0000000000000000 ffff88003a091298 ffff88003b9083ae Call Trace: [<ffffffff831100f4>] tcp_v4_send_reset+0x584/0x1700 net/ipv4/tcp_ipv4.c:643 [<ffffffff83115b1b>] tcp_v4_rcv+0x198b/0x2e50 net/ipv4/tcp_ipv4.c:1718 [<ffffffff83069d22>] ip_local_deliver_finish+0x332/0xad0 net/ipv4/ip_input.c:216 ... MD5 has a code path that calls __inet_lookup_listener with a null skb, so inet{6}_exact_dif_match needs to check skb against null before pulling the flag. Fixes: a04a480d43 ("net: Require exact match for TCP socket lookups if dif is l3mdev") Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David Ahern <dsa@cumulusnetworks.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-11-03 16:05:44 -04:00
Eli Cooper	23f4ffedb7	ip6_tunnel: Clear IP6CB in ip6tunnel_xmit() ... skb->cb may contain data from previous layers. In the observed scenario, the garbage data were misinterpreted as IP6CB(skb)->frag_max_size, so that small packets sent through the tunnel are mistakenly fragmented. This patch unconditionally clears the control buffer in ip6tunnel_xmit(), which affects ip6_tunnel, ip6_udp_tunnel and ip6_gre. Currently none of these tunnels set IP6CB(skb)->flags, otherwise it needs to be done earlier. Cc: stable@vger.kernel.org Signed-off-by: Eli Cooper <elicooper@gmx.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-11-02 15:18:36 -04:00
Subash Abhinov Kasiviswanathan	2139ce8a5c	net: rmnet_data: Add snapshot of rmnet_data driver ... This is a snapshot of the rmnet_data driver taken as of msm-4.4. commit 5da00923b1544ba ("rmnet_data: Changing format specifier to %pK"). Additionally, fix some style issues reported by checkpatch. CRs-Fixed: 1078373 Change-Id: Idb2df22e61803e04a01db64ea5e9d1e93ae92e09 Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>	2016-11-01 20:02:26 -06:00
Xin Long	dae399d7fd	sctp: hold transport instead of assoc when lookup assoc in rx path ... Prior to this patch, in rx path, before calling lock_sock, it needed to hold assoc when got it by __sctp_lookup_association, in case other place would free/put assoc. But in __sctp_lookup_association, it lookup and hold transport, then got assoc by transport->assoc, then hold assoc and put transport. It means it didn't hold transport, yet it was returned and later on directly assigned to chunk->transport. Without the protection of sock lock, the transport may be freed/put by other places, which would cause a use-after-free issue. This patch is to fix this issue by holding transport instead of assoc. As holding transport can make sure to access assoc is also safe, and actually it looks up assoc by searching transport rhashtable, to hold transport here makes more sense. Note that the function will be renamed later on on another patch. Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-10-31 16:20:33 -04:00
Linus Torvalds	2a26d99b25	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net ... Pull networking fixes from David Miller: "Lots of fixes, mostly drivers as is usually the case. 1) Don't treat zero DMA address as invalid in vmxnet3, from Alexey Khoroshilov. 2) Fix element timeouts in netfilter's nft_dynset, from Anders K. Pedersen. 3) Don't put aead_req crypto struct on the stack in mac80211, from Ard Biesheuvel. 4) Several uninitialized variable warning fixes from Arnd Bergmann. 5) Fix memory leak in cxgb4, from Colin Ian King. 6) Fix bpf handling of VLAN header push/pop, from Daniel Borkmann. 7) Several VRF semantic fixes from David Ahern. 8) Set skb->protocol properly in ip6_tnl_xmit(), from Eli Cooper. 9) Socket needs to be locked in udp_disconnect(), from Eric Dumazet. 10) Div-by-zero on 32-bit fix in mlx4 driver, from Eugenia Emantayev. 11) Fix stale link state during failover in NCSCI driver, from Gavin Shan. 12) Fix netdev lower adjacency list traversal, from Ido Schimmel. 13) Propvide proper handle when emitting notifications of filter deletes, from Jamal Hadi Salim. 14) Memory leaks and big-endian issues in rtl8xxxu, from Jes Sorensen. 15) Fix DESYNC_FACTOR handling in ipv6, from Jiri Bohac. 16) Several routing offload fixes in mlxsw driver, from Jiri Pirko. 17) Fix broadcast sync problem in TIPC, from Jon Paul Maloy. 18) Validate chunk len before using it in SCTP, from Marcelo Ricardo Leitner. 19) Revert a netns locking change that causes regressions, from Paul Moore. 20) Add recursion limit to GRO handling, from Sabrina Dubroca. 21) GFP_KERNEL in irq context fix in ibmvnic, from Thomas Falcon. 22) Avoid accessing stale vxlan/geneve socket in data path, from Pravin Shelar" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (189 commits) geneve: avoid using stale geneve socket. vxlan: avoid using stale vxlan socket. qede: Fix out-of-bound fastpath memory access net: phy: dp83848: add dp83822 PHY support enic: fix rq disable tipc: fix broadcast link synchronization problem ibmvnic: Fix missing brackets in init_sub_crq_irqs ibmvnic: Fix releasing of sub-CRQ IRQs in interrupt context Revert "ibmvnic: Fix releasing of sub-CRQ IRQs in interrupt context" arch/powerpc: Update parameters for csum_tcpudp_magic & csum_tcpudp_nofold net/mlx4_en: Save slave ethtool stats command net/mlx4_en: Fix potential deadlock in port statistics flow net/mlx4: Fix firmware command timeout during interrupt test net/mlx4_core: Do not access comm channel if it has not yet been initialized net/mlx4_en: Fix panic during reboot net/mlx4_en: Process all completions in RX rings after port goes up net/mlx4_en: Resolve dividing by zero in 32-bit system net/mlx4_core: Change the default value of enable_qos net/mlx4_core: Avoid setting ports to auto when only one port type is supported net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec ...	2016-10-29 20:33:20 -07:00
pravin shelar	c6fcc4fc5f	vxlan: avoid using stale vxlan socket. ... When vxlan device is closed vxlan socket is freed. This operation can race with vxlan-xmit function which dereferences vxlan socket. Following patch uses RCU mechanism to avoid this situation. Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-10-29 20:56:31 -04:00
David S. Miller	880b583ce1	Merge tag 'mac80211-for-davem-2016-10-27' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 ... Johannes Berg says: ==================== Just two fixes: * a fix to process all events while suspending, so any potential calls into the driver are done before it is suspended * small markup fixes for the sphinx documentation conversion that's coming into the tree via the doc tree ==================== Signed-off-by: David S. Miller <davem@davemloft.net>	2016-10-29 15:54:16 -04:00
David Ahern	d5d32e4b76	net: ipv6: Do not consider link state for nexthop validation ... Similar to IPv4, do not consider link state when validating next hops. Currently, if the link is down default routes can fail to insert: $ ip -6 ro add vrf blue default via 2100:2::64 dev eth2 RTNETLINK answers: No route to host With this patch the command succeeds. Fixes: 8c14586fc3 ("net: ipv6: Use passed in table for nexthop lookups") Signed-off-by: David Ahern <dsa@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-10-27 16:33:12 -04:00
David Ahern	830218c1ad	net: ipv6: Fix processing of RAs in presence of VRF ... rt6_add_route_info and rt6_add_dflt_router were updated to pull the FIB table from the device index, but the corresponding rt6_get_route_info and rt6_get_dflt_router functions were not leading to the failure to process RA's: ICMPv6: RA: ndisc_router_discovery failed to add default route Fix the 'get' functions by using the table id associated with the device when applicable. Also, now that default routes can be added to tables other than the default table, rt6_purge_dflt_routers needs to be updated as well to look at all tables. To handle that efficiently, add a flag to the table denoting if it is has a default route via RA. Fixes: ca254490c8 ("net: Add VRF support to IPv6 stack") Signed-off-by: David Ahern <dsa@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-10-27 16:30:52 -04:00
Florian Westphal	cdb436d181	netfilter: conntrack: avoid excess memory allocation ... This is now a fixed-size extension, so we don't need to pass a variable alloc size. This (harmless) error results in allocating 32 instead of the needed 16 bytes for this extension as the size gets passed twice. Fixes: 23014011ba ("netfilter: conntrack: support a fixed size of 128 distinct labels") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2016-10-27 18:29:02 +02:00
John W. Linville	f1d505bb76	netfilter: nf_tables: fix type mismatch with error return from nft_parse_u32_check ... Commit 36b701fae1 ("netfilter: nf_tables: validate maximum value of u32 netlink attributes") introduced nft_parse_u32_check with a return value of "unsigned int", yet on error it returns "-ERANGE". This patch corrects the mismatch by changing the return value to "int", which happens to match the actual users of nft_parse_u32_check already. Found by Coverity, CID 1373930. Note that commit 21a9e0f156 ("netfilter: nft_exthdr: fix error handling in nft_exthdr_init()) attempted to address the issue, but did not address the return type of nft_parse_u32_check. Signed-off-by: John W. Linville <linville@tuxdriver.com> Cc: Laura Garcia Liebana <nevola@gmail.com> Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Dan Carpenter <dan.carpenter@oracle.com> Fixes: 36b701fae1 ("netfilter: nf_tables: validate maximum value...") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2016-10-27 18:29:01 +02:00
Liping Zhang	61f9e2924f	netfilter: nf_tables: fix *leak* when expr clone fail ... When nft_expr_clone failed, a series of problems will happen: 1. module refcnt will leak, we call __module_get at the beginning but we forget to put it back if ops->clone returns fail 2. memory will be leaked, if clone fail, we just return NULL and forget to free the alloced element 3. set->nelems will become incorrect when set->size is specified. If clone fail, we should decrease the set->nelems Now this patch fixes these problems. And fortunately, clone fail will only happen on counter expression when memory is exhausted. Fixes: 086f332167 ("netfilter: nf_tables: add clone interface to expression operations") Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2016-10-27 18:20:45 +02:00
Eric Dumazet	10df8e6152	udp: fix IP_CHECKSUM handling ... First bug was added in commit ad6f939ab1 ("ip: Add offset parameter to ip_cmsg_recv") : Tom missed that ipv4 udp messages could be received on AF_INET6 socket. ip_cmsg_recv(msg, skb) should have been replaced by ip_cmsg_recv_offset(msg, skb, sizeof(struct udphdr)); Then commit e6afc8ace6 ("udp: remove headers from UDP packets before queueing") forgot to adjust the offsets now UDP headers are pulled before skb are put in receive queue. Fixes: ad6f939ab1 ("ip: Add offset parameter to ip_cmsg_recv") Fixes: e6afc8ace6 ("udp: remove headers from UDP packets before queueing") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Sam Kumar <samanthakumar@google.com> Cc: Willem de Bruijn <willemb@google.com> Tested-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2016-10-26 17:33:22 -04:00