Rmys
GitHub
@@ -11,7 +11,7 @@
|
||||
<Summary>Kernel module allowing to switch dedicated graphics card on Optimus laptops</Summary>
|
||||
<Description>kernel module allowing to switch dedicated graphics card on Optimus laptops</Description>
|
||||
<BuildDependencies>
|
||||
<Dependency version="4.9.35">kernel-module-headers</Dependency>
|
||||
<Dependency version="4.9.44">kernel-module-headers</Dependency>
|
||||
</BuildDependencies>
|
||||
<Archive sha1sum="e282ee682d794e3962baa4dead01917c42571e78" type="targz">https://github.com/Bumblebee-Project/bbswitch/archive/v0.8.tar.gz</Archive>
|
||||
<Patches>
|
||||
@@ -20,7 +20,7 @@
|
||||
<Package>
|
||||
<Name>module-bbswitch</Name>
|
||||
<RuntimeDependencies>
|
||||
<Dependency version="4.9.35">kernel</Dependency>
|
||||
<Dependency version="4.9.44">kernel</Dependency>
|
||||
</RuntimeDependencies>
|
||||
<Files>
|
||||
<Path fileType="library" permanent="true">/lib/modules</Path>
|
||||
@@ -34,6 +34,13 @@
|
||||
</Package>
|
||||
|
||||
<History>
|
||||
<Update release="10">
|
||||
<Date>2017-08-21</Date>
|
||||
<Version>0.8</Version>
|
||||
<Comment>Rebuild for new kernel.</Comment>
|
||||
<Name>Kamil Atlı</Name>
|
||||
<Email>suvari@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="9">
|
||||
<Date>2017-07-04</Date>
|
||||
<Version>0.8</Version>
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
<Archive sha1sum="8acbdbb4ab4ab4123d1773b616904798fbef9277" type="targz" target="i686">https://docs.broadcom.com/docs-and-downloads/docs/linux_sta/hybrid-v35-nodebug-pcoem-6_30_223_271.tar.gz</Archive>
|
||||
<Archive sha1sum="1f568bb989d175813c5631c6629d9479eae6f3be" type="targz" target="x86_64">https://docs.broadcom.com/docs-and-downloads/docs/linux_sta/hybrid-v35_64-nodebug-pcoem-6_30_223_271.tar.gz</Archive>
|
||||
<BuildDependencies>
|
||||
<Dependency version="4.9.35">kernel-module-headers</Dependency>
|
||||
<Dependency version="4.9.44">kernel-module-headers</Dependency>
|
||||
</BuildDependencies>
|
||||
<Patches>
|
||||
<Patch level="1">patch/license.patch</Patch>
|
||||
@@ -28,7 +28,7 @@
|
||||
<Package>
|
||||
<Name>module-broadcom-wl</Name>
|
||||
<RuntimeDependencies>
|
||||
<Dependency version="4.9.35">kernel</Dependency>
|
||||
<Dependency version="4.9.44">kernel</Dependency>
|
||||
<Dependency release="current">module-broadcom-wl-userspace</Dependency>
|
||||
</RuntimeDependencies>
|
||||
<Files>
|
||||
@@ -57,6 +57,13 @@
|
||||
</Package>
|
||||
|
||||
<History>
|
||||
<Update release="10">
|
||||
<Date>2017-08-21</Date>
|
||||
<Version>6.30.223.271</Version>
|
||||
<Comment>Rebuild for new kernel.</Comment>
|
||||
<Name>Kamil Atlı</Name>
|
||||
<Email>suvari@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="9">
|
||||
<Date>2017-07-04</Date>
|
||||
<Version>6.30.223.271</Version>
|
||||
|
||||
@@ -14,14 +14,14 @@
|
||||
<Description>This package provides the kernel modules needed for mouse integration and shared folder support between VirtualBox host and guest systems.</Description>
|
||||
<Archive sha1sum="87b355193a306ed5516e8d348f7eb83854e08ac1" type="tarxz">https://sourceforge.net/projects/pisilinux/files/source/module-virtualbox-guest-5.1.14.tar.xz</Archive>
|
||||
<BuildDependencies>
|
||||
<Dependency version="4.9.35">kernel-module-headers</Dependency>
|
||||
<Dependency version="4.9.44">kernel-module-headers</Dependency>
|
||||
</BuildDependencies>
|
||||
</Source>
|
||||
|
||||
<Package>
|
||||
<Name>module-virtualbox-guest</Name>
|
||||
<RuntimeDependencies>
|
||||
<Dependency version="4.9.35">kernel</Dependency>
|
||||
<Dependency version="4.9.44">kernel</Dependency>
|
||||
<Dependency>baselayout</Dependency>
|
||||
<Dependency version="current">module-virtualbox-guest-userspace</Dependency>
|
||||
</RuntimeDependencies>
|
||||
@@ -52,6 +52,13 @@
|
||||
</Package>
|
||||
|
||||
<History>
|
||||
<Update release="16">
|
||||
<Date>2017-08-21</Date>
|
||||
<Version>5.1.14</Version>
|
||||
<Comment>Rebuild for new kernel.</Comment>
|
||||
<Name>Kamil Atlı</Name>
|
||||
<Email>suvari@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="15">
|
||||
<Date>2017-07-04</Date>
|
||||
<Version>5.1.14</Version>
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
<Description>This package provides the kernel support for VirtualBox.</Description>
|
||||
<Archive sha1sum="7489ae3b501407d5ca2826e6ef1d5b2000e06154" type="tarxz">https://sourceforge.net/projects/pisilinux/files/source/module-virtualbox-5.1.14.tar.xz</Archive>
|
||||
<BuildDependencies>
|
||||
<Dependency version="4.9.35">kernel-module-headers</Dependency>
|
||||
<Dependency version="4.9.44">kernel-module-headers</Dependency>
|
||||
</BuildDependencies>
|
||||
<!--Patches>
|
||||
<Patch>vbox_linux-4.3.diff</Patch>
|
||||
@@ -24,7 +24,7 @@
|
||||
<Package>
|
||||
<Name>module-virtualbox</Name>
|
||||
<RuntimeDependencies>
|
||||
<Dependency version="4.9.35">kernel</Dependency>
|
||||
<Dependency version="4.9.44">kernel</Dependency>
|
||||
<Dependency version="current">module-virtualbox-userspace</Dependency>
|
||||
</RuntimeDependencies>
|
||||
<Files>
|
||||
@@ -50,6 +50,13 @@
|
||||
</Package>
|
||||
|
||||
<History>
|
||||
<Update release="16">
|
||||
<Date>2017-08-21</Date>
|
||||
<Version>5.1.14</Version>
|
||||
<Comment>Rebuild for new kernel.</Comment>
|
||||
<Name>Kamil Atlı</Name>
|
||||
<Email>suvari@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="15">
|
||||
<Date>2017-07-04</Date>
|
||||
<Version>5.1.14</Version>
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
<Description>module-ndiswrapper allows you to use Windows XP drivers for WLAN cards without proper Linux drivers.</Description>
|
||||
<Archive sha1sum="20998237cf6d37b86391dc8736c10031110db578" type="targz">http://download.sourceforge.net/ndiswrapper/ndiswrapper-1.60.tar.gz</Archive>
|
||||
<BuildDependencies>
|
||||
<Dependency version="4.9.35">kernel-module-headers</Dependency>
|
||||
<Dependency version="4.9.44">kernel-module-headers</Dependency>
|
||||
</BuildDependencies>
|
||||
<Patches>
|
||||
<Patch>upstream.patch</Patch>
|
||||
@@ -25,7 +25,7 @@
|
||||
<Package>
|
||||
<Name>ndiswrapper</Name>
|
||||
<RuntimeDependencies>
|
||||
<Dependency version="4.9.35">kernel</Dependency>
|
||||
<Dependency version="4.9.44">kernel</Dependency>
|
||||
</RuntimeDependencies>
|
||||
<Files>
|
||||
<Path fileType="library" permanent="true">/lib/modules</Path>
|
||||
@@ -41,6 +41,13 @@
|
||||
</Package>
|
||||
|
||||
<History>
|
||||
<Update release="9">
|
||||
<Date>2017-08-21</Date>
|
||||
<Version>1.60</Version>
|
||||
<Comment>Rebuild for new kernel.</Comment>
|
||||
<Name>PisiLinux Community</Name>
|
||||
<Email>admin@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="8">
|
||||
<Date>2017-07-04</Date>
|
||||
<Version>1.60</Version>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#
|
||||
# Automatically generated file; DO NOT EDIT.
|
||||
# Linux/x86_64 4.9.35 Kernel Configuration
|
||||
# Linux/x86_64 4.9.44 Kernel Configuration
|
||||
#
|
||||
CONFIG_64BIT=y
|
||||
CONFIG_X86_64=y
|
||||
|
||||
Binary file not shown.
-46
@@ -1,46 +0,0 @@
|
||||
From 2638fd0f92d4397884fd991d8f4925cb3f081901 Mon Sep 17 00:00:00 2001
|
||||
From: Eric Dumazet <edumazet@google.com>
|
||||
Date: Mon, 3 Apr 2017 10:55:11 -0700
|
||||
Subject: [PATCH] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
|
||||
|
||||
Denys provided an awesome KASAN report pointing to an use
|
||||
after free in xt_TCPMSS
|
||||
|
||||
I have provided three patches to fix this issue, either in xt_TCPMSS or
|
||||
in xt_tcpudp.c. It seems xt_TCPMSS patch has the smallest possible
|
||||
impact.
|
||||
|
||||
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
||||
Reported-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
---
|
||||
net/netfilter/xt_TCPMSS.c | 6 +++++-
|
||||
1 file changed, 5 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
|
||||
index 27241a767f17..c64aca611ac5 100644
|
||||
--- a/net/netfilter/xt_TCPMSS.c
|
||||
+++ b/net/netfilter/xt_TCPMSS.c
|
||||
@@ -104,7 +104,7 @@ tcpmss_mangle_packet(struct sk_buff *skb,
|
||||
tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
|
||||
tcp_hdrlen = tcph->doff * 4;
|
||||
|
||||
- if (len < tcp_hdrlen)
|
||||
+ if (len < tcp_hdrlen || tcp_hdrlen < sizeof(struct tcphdr))
|
||||
return -1;
|
||||
|
||||
if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
|
||||
@@ -152,6 +152,10 @@ tcpmss_mangle_packet(struct sk_buff *skb,
|
||||
if (len > tcp_hdrlen)
|
||||
return 0;
|
||||
|
||||
+ /* tcph->doff has 4 bits, do not wrap it to 0 */
|
||||
+ if (tcp_hdrlen >= 15 * 4)
|
||||
+ return 0;
|
||||
+
|
||||
/*
|
||||
* MSS Option not found ?! add it..
|
||||
*/
|
||||
--
|
||||
2.13.2
|
||||
|
||||
+37
@@ -0,0 +1,37 @@
|
||||
From f35823619db8bbaa2afea8705f239c3cecb9d22f Mon Sep 17 00:00:00 2001
|
||||
From: Santeri Toivonen <santeri.toivonen@vatsul.com>
|
||||
Date: Tue, 4 Apr 2017 21:09:00 +0300
|
||||
Subject: [PATCH] platform/x86: asus-nb-wmi: Add wapf4 quirk for the X302UA
|
||||
|
||||
Asus laptop X302UA starts up with Wi-Fi disabled,
|
||||
without a way to enable it. Set wapf=4 to fix the problem.
|
||||
|
||||
Signed-off-by: Santeri Toivonen <santeri.toivonen@vatsul.com>
|
||||
Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
|
||||
---
|
||||
drivers/platform/x86/asus-nb-wmi.c | 9 +++++++++
|
||||
1 file changed, 9 insertions(+)
|
||||
|
||||
diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
|
||||
index dea98ffb6f60..1ae58d906536 100644
|
||||
--- a/drivers/platform/x86/asus-nb-wmi.c
|
||||
+++ b/drivers/platform/x86/asus-nb-wmi.c
|
||||
@@ -144,6 +144,15 @@ static const struct dmi_system_id asus_quirks[] = {
|
||||
},
|
||||
{
|
||||
.callback = dmi_matched,
|
||||
+ .ident = "ASUSTeK COMPUTER INC. X302UA",
|
||||
+ .matches = {
|
||||
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
|
||||
+ DMI_MATCH(DMI_PRODUCT_NAME, "X302UA"),
|
||||
+ },
|
||||
+ .driver_data = &quirk_asus_wapf4,
|
||||
+ },
|
||||
+ {
|
||||
+ .callback = dmi_matched,
|
||||
.ident = "ASUSTeK COMPUTER INC. X401U",
|
||||
.matches = {
|
||||
DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
|
||||
--
|
||||
2.13.2
|
||||
|
||||
@@ -14,31 +14,6 @@
|
||||
###
|
||||
### Stable Queue
|
||||
###
|
||||
stable-ipv6-release-dst-on-error-in-ip6_dst_lookup_tail.patch
|
||||
stable-net-don-t-call-strlen-on-non-terminated-string-in-dev_set_alias.patch
|
||||
stable-decnet-dn_rtmsg-improve-input-length-sanitization-in-dnrmg_receive_user_skb.patch
|
||||
stable-net-zero-ifla_vf_info-in-rtnl_fill_vfinfo.patch
|
||||
stable-net-vrf-make-add_fib_rules-per-network-namespace-flag.patch
|
||||
stable-af_unix-add-sockaddr-length-checks-before-accessing-sa_family-in-bind-and-connect-handlers.patch
|
||||
stable-fix-an-intermittent-pr_emerg-warning-about-lo-becoming-free.patch
|
||||
stable-sctp-disable-bh-in-sctp_for_each_endpoint.patch
|
||||
stable-net-caif-fix-a-sleep-in-atomic-bug-in-cfpkt_create_pfx.patch
|
||||
stable-net-tipc-fix-a-sleep-in-atomic-bug-in-tipc_msg_reverse.patch
|
||||
stable-net-mlx5e-added-bw-check-for-dim-decision-mechanism.patch
|
||||
stable-net-mlx5e-fix-wrong-indications-in-dim-due-to-counter-wraparound.patch
|
||||
stable-proc-snmp6-use-correct-type-in-memset.patch
|
||||
stable-igmp-acquire-pmc-lock-for-ip_mc_clear_src.patch
|
||||
stable-igmp-add-a-missing-spin_lock_init.patch
|
||||
stable-ipv6-fix-calling-in6_ifa_hold-incorrectly-for-dad-work.patch
|
||||
stable-sctp-return-next-obj-by-passing-pos-1-into-sctp_transport_get_idx.patch
|
||||
stable-net-mlx5e-avoid-doing-a-cleanup-call-if-the-profile-doesn-t-have-it.patch
|
||||
stable-net-mlx5-wait-for-fw-readiness-before-initializing-command-interface.patch
|
||||
stable-net-mlx5e-fix-timestamping-capabilities-reporting.patch
|
||||
stable-decnet-always-not-take-dst-__refcnt-when-inserting-dst-into-hash-table.patch
|
||||
stable-net-8021q-fix-one-possible-panic-caused-by-bug_on-in-free_netdev.patch
|
||||
stable-sfc-provide-dummy-definitions-of-vswitch-functions.patch
|
||||
stable-ipv6-do-not-leak-throw-route-references.patch
|
||||
stable-rtnetlink-add-ifla_group-to-ifla_policy.patch
|
||||
|
||||
###
|
||||
### Arch x86
|
||||
@@ -297,9 +272,6 @@ net-wireless-rtlwifi-Fix-kernel-oops-introduced-with-commit-e4965.patch
|
||||
# update rtl8xxxu for mga#20508
|
||||
net-wireless-realtek-rtl8xxxu-linux-4.11-rc.patch
|
||||
|
||||
# fixes issue triggable by remote peers
|
||||
net-netfilter-xt_TCPMSS-add-more-sanity-tests-on-tcph-do.patch
|
||||
|
||||
###
|
||||
### pinctrl
|
||||
###
|
||||
@@ -317,6 +289,9 @@ platform-x86-add-shuttle-wmi-driver.patch
|
||||
platform-x86-shuttle-wmi-drop-devinit-exit.patch
|
||||
platform-x86-shuttle-wmi-4.2-buildfix.patch
|
||||
|
||||
# X302UA no wifi
|
||||
platform-x86-asus-nb-wmi-Add-wapf4-quirk-for-the-X30.patch
|
||||
|
||||
###
|
||||
### RTC
|
||||
###
|
||||
@@ -335,6 +310,9 @@ include-kbuild-export-pci_ids.patch
|
||||
# new codecs
|
||||
sound-ALSA-hda-realtek-Add-new-codec-ID-ALC299.patch
|
||||
sound-ALSA-hda-realtek-New-codec-support-of-ALC1220.patch
|
||||
sound-ALSA-hda-realtek-new-id-for-alc1220.patch
|
||||
sound-ALSA-hda-realtek-Remove-ALC285-device-ID.patch
|
||||
sound-ALSA-hda-realtek-New-codecs-support-for-ALC215-ALC28.patch
|
||||
|
||||
# add support for Gigabyte GA-AX370 Gaming 5 with dual codecs (TTL: 4.12)
|
||||
sound-ALSA-hda-A-new-flag-to-enforce-prefix-to-each-pin.patch
|
||||
@@ -372,9 +350,6 @@ hid-usbhid-IBM-BladeCenterHS20-quirk.patch
|
||||
usb-storage-unusual_devs-add-id.patch
|
||||
usb-storage-unusual_devs-add-id-2.6.37-buildfix.patch
|
||||
|
||||
# amd xhci fix
|
||||
usb-xhci-Limit-USB2-port-wake-support-for-AMD-Promontory-hosts.patch
|
||||
|
||||
###
|
||||
### V4L
|
||||
###
|
||||
|
||||
+85
@@ -0,0 +1,85 @@
|
||||
From 0a6f0600efc3df0179a33188c30b5026bd9d1c27 Mon Sep 17 00:00:00 2001
|
||||
From: Kailang Yang <kailang@realtek.com>
|
||||
Date: Fri, 30 Jun 2017 16:00:48 +0800
|
||||
Subject: [PATCH] ALSA: hda/realtek - New codecs support for
|
||||
ALC215/ALC285/ALC289
|
||||
|
||||
Add new codecs support for ALC215 ALC285 ALC289.
|
||||
|
||||
Signed-off-by: Kailang Yang <kailang@realtek.com>
|
||||
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
||||
---
|
||||
sound/pci/hda/patch_realtek.c | 14 ++++++++++++++
|
||||
1 file changed, 14 insertions(+)
|
||||
|
||||
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
|
||||
index 80c7c832d442..c39bc497650c 100644
|
||||
--- a/sound/pci/hda/patch_realtek.c
|
||||
+++ b/sound/pci/hda/patch_realtek.c
|
||||
@@ -327,6 +327,7 @@ static void alc_fill_eapd_coef(struct hd
|
||||
case 0x10ec0292:
|
||||
alc_update_coef_idx(codec, 0x4, 1<<15, 0);
|
||||
break;
|
||||
+ case 0x10ec0215:
|
||||
case 0x10ec0225:
|
||||
case 0x10ec0233:
|
||||
case 0x10ec0255:
|
||||
@@ -335,8 +336,10 @@ static void alc_fill_eapd_coef(struct hd
|
||||
case 0x10ec0283:
|
||||
case 0x10ec0286:
|
||||
case 0x10ec0288:
|
||||
+ case 0x10ec0285:
|
||||
case 0x10ec0295:
|
||||
case 0x10ec0298:
|
||||
+ case 0x10ec0289:
|
||||
case 0x10ec0299:
|
||||
alc_update_coef_idx(codec, 0x10, 1<<9, 0);
|
||||
break;
|
||||
@@ -2723,6 +2726,7 @@ enum {
|
||||
ALC269_TYPE_ALC298,
|
||||
ALC269_TYPE_ALC255,
|
||||
ALC269_TYPE_ALC256,
|
||||
+ ALC269_TYPE_ALC215,
|
||||
ALC269_TYPE_ALC225,
|
||||
ALC269_TYPE_ALC294,
|
||||
ALC269_TYPE_ALC700,
|
||||
@@ -2755,6 +2759,7 @@ static int alc269_parse_auto_config(stru
|
||||
case ALC269_TYPE_ALC298:
|
||||
case ALC269_TYPE_ALC255:
|
||||
case ALC269_TYPE_ALC256:
|
||||
+ case ALC269_TYPE_ALC215:
|
||||
case ALC269_TYPE_ALC225:
|
||||
case ALC269_TYPE_ALC294:
|
||||
case ALC269_TYPE_ALC700:
|
||||
@@ -6298,6 +6303,12 @@ static int patch_alc269(struct hda_codec
|
||||
spec->gen.mixer_nid = 0; /* ALC256 does not have any loopback mixer path */
|
||||
alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/
|
||||
break;
|
||||
+ case 0x10ec0215:
|
||||
+ case 0x10ec0285:
|
||||
+ case 0x10ec0289:
|
||||
+ spec->codec_variant = ALC269_TYPE_ALC215;
|
||||
+ spec->gen.mixer_nid = 0;
|
||||
+ break;
|
||||
case 0x10ec0225:
|
||||
case 0x10ec0295:
|
||||
case 0x10ec0299:
|
||||
@@ -7267,6 +7278,7 @@ static int patch_alc680(struct hda_codec
|
||||
* patch entries
|
||||
*/
|
||||
static const struct hda_device_id snd_hda_id_realtek[] = {
|
||||
+ HDA_CODEC_ENTRY(0x10ec0215, "ALC215", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0221, "ALC221", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0225, "ALC225", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0231, "ALC231", patch_alc269),
|
||||
@@ -7289,8 +7301,10 @@ static const struct hda_device_id snd_hd
|
||||
HDA_CODEC_ENTRY(0x10ec0282, "ALC282", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0283, "ALC283", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0284, "ALC284", patch_alc269),
|
||||
+ HDA_CODEC_ENTRY(0x10ec0285, "ALC285", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0286, "ALC286", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0288, "ALC288", patch_alc269),
|
||||
+ HDA_CODEC_ENTRY(0x10ec0289, "ALC289", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0290, "ALC290", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0292, "ALC292", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0293, "ALC293", patch_alc269),
|
||||
+68
@@ -0,0 +1,68 @@
|
||||
From 4731d5de4b1ca8d2565782cc3aeac392db07c075 Mon Sep 17 00:00:00 2001
|
||||
From: Kailang Yang <kailang@realtek.com>
|
||||
Date: Fri, 30 Jun 2017 15:22:57 +0800
|
||||
Subject: [PATCH] ALSA: hda/realtek - Remove ALC285 device ID
|
||||
|
||||
0x0285 Device ID was not used.
|
||||
It just assigned for alias of ALC293 as backup.
|
||||
So, remove it first.
|
||||
Because our new codec will use this device ID.
|
||||
|
||||
Signed-off-by: Kailang Yang <kailang@realtek.com>
|
||||
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
||||
---
|
||||
sound/pci/hda/patch_realtek.c | 9 +++------
|
||||
1 file changed, 3 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
|
||||
index c79491a1cd47..80c7c832d442 100644
|
||||
--- a/sound/pci/hda/patch_realtek.c
|
||||
+++ b/sound/pci/hda/patch_realtek.c
|
||||
@@ -340,7 +340,6 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
|
||||
case 0x10ec0299:
|
||||
alc_update_coef_idx(codec, 0x10, 1<<9, 0);
|
||||
break;
|
||||
- case 0x10ec0285:
|
||||
case 0x10ec0293:
|
||||
alc_update_coef_idx(codec, 0xa, 1<<13, 0);
|
||||
break;
|
||||
@@ -2738,7 +2737,7 @@ enum {
|
||||
ALC269_TYPE_ALC282,
|
||||
ALC269_TYPE_ALC283,
|
||||
ALC269_TYPE_ALC284,
|
||||
- ALC269_TYPE_ALC285,
|
||||
+ ALC269_TYPE_ALC293,
|
||||
ALC269_TYPE_ALC286,
|
||||
ALC269_TYPE_ALC298,
|
||||
ALC269_TYPE_ALC255,
|
||||
@@ -2764,7 +2763,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
|
||||
case ALC269_TYPE_ALC269VC:
|
||||
case ALC269_TYPE_ALC280:
|
||||
case ALC269_TYPE_ALC284:
|
||||
- case ALC269_TYPE_ALC285:
|
||||
+ case ALC269_TYPE_ALC293:
|
||||
ssids = alc269va_ssids;
|
||||
break;
|
||||
case ALC269_TYPE_ALC269VB:
|
||||
@@ -6678,9 +6677,8 @@ static int patch_alc269(struct hda_codec *codec)
|
||||
case 0x10ec0292:
|
||||
spec->codec_variant = ALC269_TYPE_ALC284;
|
||||
break;
|
||||
- case 0x10ec0285:
|
||||
case 0x10ec0293:
|
||||
- spec->codec_variant = ALC269_TYPE_ALC285;
|
||||
+ spec->codec_variant = ALC269_TYPE_ALC293;
|
||||
break;
|
||||
case 0x10ec0286:
|
||||
case 0x10ec0288:
|
||||
@@ -7752,7 +7750,6 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
|
||||
HDA_CODEC_ENTRY(0x10ec0282, "ALC282", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0283, "ALC283", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0284, "ALC284", patch_alc269),
|
||||
- HDA_CODEC_ENTRY(0x10ec0285, "ALC285", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0286, "ALC286", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0288, "ALC288", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0290, "ALC290", patch_alc269),
|
||||
--
|
||||
2.13.2
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
From a7498943b45d43f4a1abf37b75908c1edf840230 Mon Sep 17 00:00:00 2001
|
||||
From: Kailang Yang <kailang@realtek.com>
|
||||
Date: Tue, 11 Jul 2017 15:15:47 +0800
|
||||
Subject: [PATCH] ALSA: hda/realtek - New codec device ID for ALC1220
|
||||
|
||||
Codec ID is 0x1168.
|
||||
It is another ALC1220 codec.
|
||||
|
||||
Signed-off-by: Kailang Yang <kailang@realtek.com>
|
||||
|
||||
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
|
||||
index e2116d2..45d58fc 100644
|
||||
--- a/sound/pci/hda/patch_realtek.c
|
||||
+++ b/sound/pci/hda/patch_realtek.c
|
||||
@@ -380,6 +380,7 @@ static void alc_fill_eapd_coef(struct hd
|
||||
break;
|
||||
case 0x10ec0899:
|
||||
case 0x10ec0900:
|
||||
+ case 0x10ec1168:
|
||||
case 0x10ec1220:
|
||||
alc_update_coef_idx(codec, 0x7, 1<<1, 0);
|
||||
break;
|
||||
@@ -7331,6 +7332,7 @@ static const struct hda_device_id snd_hd
|
||||
HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662),
|
||||
HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882),
|
||||
HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882),
|
||||
+ HDA_CODEC_ENTRY(0x10ec1168, "ALC1220", patch_alc882),
|
||||
HDA_CODEC_ENTRY(0x10ec1220, "ALC1220", patch_alc882),
|
||||
{} /* terminator */
|
||||
};
|
||||
-47
@@ -1,47 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Mateusz Jurczyk <mjurczyk@google.com>
|
||||
Date: Thu, 8 Jun 2017 11:13:36 +0200
|
||||
Subject: af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers
|
||||
|
||||
From: Mateusz Jurczyk <mjurczyk@google.com>
|
||||
|
||||
|
||||
[ Upstream commit defbcf2decc903a28d8398aa477b6881e711e3ea ]
|
||||
|
||||
Verify that the caller-provided sockaddr structure is large enough to
|
||||
contain the sa_family field, before accessing it in bind() and connect()
|
||||
handlers of the AF_UNIX socket. Since neither syscall enforces a minimum
|
||||
size of the corresponding memory region, very short sockaddrs (zero or
|
||||
one byte long) result in operating on uninitialized memory while
|
||||
referencing .sa_family.
|
||||
|
||||
Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/unix/af_unix.c | 7 ++++++-
|
||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/net/unix/af_unix.c
|
||||
+++ b/net/unix/af_unix.c
|
||||
@@ -998,7 +998,8 @@ static int unix_bind(struct socket *sock
|
||||
struct path path = { NULL, NULL };
|
||||
|
||||
err = -EINVAL;
|
||||
- if (sunaddr->sun_family != AF_UNIX)
|
||||
+ if (addr_len < offsetofend(struct sockaddr_un, sun_family) ||
|
||||
+ sunaddr->sun_family != AF_UNIX)
|
||||
goto out;
|
||||
|
||||
if (addr_len == sizeof(short)) {
|
||||
@@ -1109,6 +1110,10 @@ static int unix_dgram_connect(struct soc
|
||||
unsigned int hash;
|
||||
int err;
|
||||
|
||||
+ err = -EINVAL;
|
||||
+ if (alen < offsetofend(struct sockaddr, sa_family))
|
||||
+ goto out;
|
||||
+
|
||||
if (addr->sa_family != AF_UNSPEC) {
|
||||
err = unix_mkname(sunaddr, alen, &hash);
|
||||
if (err < 0)
|
||||
-89
@@ -1,89 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Wei Wang <weiwan@google.com>
|
||||
Date: Fri, 16 Jun 2017 10:46:37 -0700
|
||||
Subject: decnet: always not take dst->__refcnt when inserting dst into hash table
|
||||
|
||||
From: Wei Wang <weiwan@google.com>
|
||||
|
||||
|
||||
[ Upstream commit 76371d2e3ad1f84426a30ebcd8c3b9b98f4c724f ]
|
||||
|
||||
In the existing dn_route.c code, dn_route_output_slow() takes
|
||||
dst->__refcnt before calling dn_insert_route() while dn_route_input_slow()
|
||||
does not take dst->__refcnt before calling dn_insert_route().
|
||||
This makes the whole routing code very buggy.
|
||||
In dn_dst_check_expire(), dnrt_free() is called when rt expires. This
|
||||
makes the routes inserted by dn_route_output_slow() not able to be
|
||||
freed as the refcnt is not released.
|
||||
In dn_dst_gc(), dnrt_drop() is called to release rt which could
|
||||
potentially cause the dst->__refcnt to be dropped to -1.
|
||||
In dn_run_flush(), dst_free() is called to release all the dst. Again,
|
||||
it makes the dst inserted by dn_route_output_slow() not able to be
|
||||
released and also, it does not wait on the rcu and could potentially
|
||||
cause crash in the path where other users still refer to this dst.
|
||||
|
||||
This patch makes sure both input and output path do not take
|
||||
dst->__refcnt before calling dn_insert_route() and also makes sure
|
||||
dnrt_free()/dst_free() is called when removing dst from the hash table.
|
||||
The only difference between those 2 calls is that dnrt_free() waits on
|
||||
the rcu while dst_free() does not.
|
||||
|
||||
Signed-off-by: Wei Wang <weiwan@google.com>
|
||||
Acked-by: Martin KaFai Lau <kafai@fb.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/decnet/dn_route.c | 14 ++++----------
|
||||
1 file changed, 4 insertions(+), 10 deletions(-)
|
||||
|
||||
--- a/net/decnet/dn_route.c
|
||||
+++ b/net/decnet/dn_route.c
|
||||
@@ -188,12 +188,6 @@ static inline void dnrt_free(struct dn_r
|
||||
call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
|
||||
}
|
||||
|
||||
-static inline void dnrt_drop(struct dn_route *rt)
|
||||
-{
|
||||
- dst_release(&rt->dst);
|
||||
- call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
|
||||
-}
|
||||
-
|
||||
static void dn_dst_check_expire(unsigned long dummy)
|
||||
{
|
||||
int i;
|
||||
@@ -248,7 +242,7 @@ static int dn_dst_gc(struct dst_ops *ops
|
||||
}
|
||||
*rtp = rt->dst.dn_next;
|
||||
rt->dst.dn_next = NULL;
|
||||
- dnrt_drop(rt);
|
||||
+ dnrt_free(rt);
|
||||
break;
|
||||
}
|
||||
spin_unlock_bh(&dn_rt_hash_table[i].lock);
|
||||
@@ -350,7 +344,7 @@ static int dn_insert_route(struct dn_rou
|
||||
dst_use(&rth->dst, now);
|
||||
spin_unlock_bh(&dn_rt_hash_table[hash].lock);
|
||||
|
||||
- dnrt_drop(rt);
|
||||
+ dst_free(&rt->dst);
|
||||
*rp = rth;
|
||||
return 0;
|
||||
}
|
||||
@@ -380,7 +374,7 @@ static void dn_run_flush(unsigned long d
|
||||
for(; rt; rt = next) {
|
||||
next = rcu_dereference_raw(rt->dst.dn_next);
|
||||
RCU_INIT_POINTER(rt->dst.dn_next, NULL);
|
||||
- dst_free((struct dst_entry *)rt);
|
||||
+ dnrt_free(rt);
|
||||
}
|
||||
|
||||
nothing_to_declare:
|
||||
@@ -1187,7 +1181,7 @@ make_route:
|
||||
if (dev_out->flags & IFF_LOOPBACK)
|
||||
flags |= RTCF_LOCAL;
|
||||
|
||||
- rt = dst_alloc(&dn_dst_ops, dev_out, 1, DST_OBSOLETE_NONE, DST_HOST);
|
||||
+ rt = dst_alloc(&dn_dst_ops, dev_out, 0, DST_OBSOLETE_NONE, DST_HOST);
|
||||
if (rt == NULL)
|
||||
goto e_nobufs;
|
||||
|
||||
-42
@@ -1,42 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Mateusz Jurczyk <mjurczyk@google.com>
|
||||
Date: Wed, 7 Jun 2017 16:14:29 +0200
|
||||
Subject: decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb
|
||||
|
||||
From: Mateusz Jurczyk <mjurczyk@google.com>
|
||||
|
||||
|
||||
[ Upstream commit dd0da17b209ed91f39872766634ca967c170ada1 ]
|
||||
|
||||
Verify that the length of the socket buffer is sufficient to cover the
|
||||
nlmsghdr structure before accessing the nlh->nlmsg_len field for further
|
||||
input sanitization. If the client only supplies 1-3 bytes of data in
|
||||
sk_buff, then nlh->nlmsg_len remains partially uninitialized and
|
||||
contains leftover memory from the corresponding kernel allocation.
|
||||
Operating on such data may result in indeterminate evaluation of the
|
||||
nlmsg_len < sizeof(*nlh) expression.
|
||||
|
||||
The bug was discovered by a runtime instrumentation designed to detect
|
||||
use of uninitialized memory in the kernel. The patch prevents this and
|
||||
other similar tools (e.g. KMSAN) from flagging this behavior in the future.
|
||||
|
||||
Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/decnet/netfilter/dn_rtmsg.c | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/net/decnet/netfilter/dn_rtmsg.c
|
||||
+++ b/net/decnet/netfilter/dn_rtmsg.c
|
||||
@@ -102,7 +102,9 @@ static inline void dnrmg_receive_user_sk
|
||||
{
|
||||
struct nlmsghdr *nlh = nlmsg_hdr(skb);
|
||||
|
||||
- if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
|
||||
+ if (skb->len < sizeof(*nlh) ||
|
||||
+ nlh->nlmsg_len < sizeof(*nlh) ||
|
||||
+ skb->len < nlh->nlmsg_len)
|
||||
return;
|
||||
|
||||
if (!netlink_capable(skb, CAP_NET_ADMIN))
|
||||
-76
@@ -1,76 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Krister Johansen <kjlx@templeofstupid.com>
|
||||
Date: Thu, 8 Jun 2017 13:12:38 -0700
|
||||
Subject: Fix an intermittent pr_emerg warning about lo becoming free.
|
||||
|
||||
From: Krister Johansen <kjlx@templeofstupid.com>
|
||||
|
||||
|
||||
[ Upstream commit f186ce61bb8235d80068c390dc2aad7ca427a4c2 ]
|
||||
|
||||
It looks like this:
|
||||
|
||||
Message from syslogd@flamingo at Apr 26 00:45:00 ...
|
||||
kernel:unregister_netdevice: waiting for lo to become free. Usage count = 4
|
||||
|
||||
They seem to coincide with net namespace teardown.
|
||||
|
||||
The message is emitted by netdev_wait_allrefs().
|
||||
|
||||
Forced a kdump in netdev_run_todo, but found that the refcount on the lo
|
||||
device was already 0 at the time we got to the panic.
|
||||
|
||||
Used bcc to check the blocking in netdev_run_todo. The only places
|
||||
where we're off cpu there are in the rcu_barrier() and msleep() calls.
|
||||
That behavior is expected. The msleep time coincides with the amount of
|
||||
time we spend waiting for the refcount to reach zero; the rcu_barrier()
|
||||
wait times are not excessive.
|
||||
|
||||
After looking through the list of callbacks that the netdevice notifiers
|
||||
invoke in this path, it appears that the dst_dev_event is the most
|
||||
interesting. The dst_ifdown path places a hold on the loopback_dev as
|
||||
part of releasing the dev associated with the original dst cache entry.
|
||||
Most of our notifier callbacks are straight-forward, but this one a)
|
||||
looks complex, and b) places a hold on the network interface in
|
||||
question.
|
||||
|
||||
I constructed a new bcc script that watches various events in the
|
||||
liftime of a dst cache entry. Note that dst_ifdown will take a hold on
|
||||
the loopback device until the invalidated dst entry gets freed.
|
||||
|
||||
[ __dst_free] on DST: ffff883ccabb7900 IF tap1008300eth0 invoked at 1282115677036183
|
||||
__dst_free
|
||||
rcu_nocb_kthread
|
||||
kthread
|
||||
ret_from_fork
|
||||
Acked-by: Eric Dumazet <edumazet@google.com>
|
||||
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/core/dst.c | 14 ++++++++++++++
|
||||
1 file changed, 14 insertions(+)
|
||||
|
||||
--- a/net/core/dst.c
|
||||
+++ b/net/core/dst.c
|
||||
@@ -470,6 +470,20 @@ static int dst_dev_event(struct notifier
|
||||
spin_lock_bh(&dst_garbage.lock);
|
||||
dst = dst_garbage.list;
|
||||
dst_garbage.list = NULL;
|
||||
+ /* The code in dst_ifdown places a hold on the loopback device.
|
||||
+ * If the gc entry processing is set to expire after a lengthy
|
||||
+ * interval, this hold can cause netdev_wait_allrefs() to hang
|
||||
+ * out and wait for a long time -- until the the loopback
|
||||
+ * interface is released. If we're really unlucky, it'll emit
|
||||
+ * pr_emerg messages to console too. Reset the interval here,
|
||||
+ * so dst cleanups occur in a more timely fashion.
|
||||
+ */
|
||||
+ if (dst_garbage.timer_inc > DST_GC_INC) {
|
||||
+ dst_garbage.timer_inc = DST_GC_INC;
|
||||
+ dst_garbage.timer_expires = DST_GC_MIN;
|
||||
+ mod_delayed_work(system_wq, &dst_gc_work,
|
||||
+ dst_garbage.timer_expires);
|
||||
+ }
|
||||
spin_unlock_bh(&dst_garbage.lock);
|
||||
|
||||
if (last)
|
||||
-82
@@ -1,82 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: WANG Cong <xiyou.wangcong@gmail.com>
|
||||
Date: Mon, 12 Jun 2017 09:52:26 -0700
|
||||
Subject: igmp: acquire pmc lock for ip_mc_clear_src()
|
||||
|
||||
From: WANG Cong <xiyou.wangcong@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit c38b7d327aafd1e3ad7ff53eefac990673b65667 ]
|
||||
|
||||
Andrey reported a use-after-free in add_grec():
|
||||
|
||||
for (psf = *psf_list; psf; psf = psf_next) {
|
||||
...
|
||||
psf_next = psf->sf_next;
|
||||
|
||||
where the struct ip_sf_list's were already freed by:
|
||||
|
||||
kfree+0xe8/0x2b0 mm/slub.c:3882
|
||||
ip_mc_clear_src+0x69/0x1c0 net/ipv4/igmp.c:2078
|
||||
ip_mc_dec_group+0x19a/0x470 net/ipv4/igmp.c:1618
|
||||
ip_mc_drop_socket+0x145/0x230 net/ipv4/igmp.c:2609
|
||||
inet_release+0x4e/0x1c0 net/ipv4/af_inet.c:411
|
||||
sock_release+0x8d/0x1e0 net/socket.c:597
|
||||
sock_close+0x16/0x20 net/socket.c:1072
|
||||
|
||||
This happens because we don't hold pmc->lock in ip_mc_clear_src()
|
||||
and a parallel mr_ifc_timer timer could jump in and access them.
|
||||
|
||||
The RCU lock is there but it is merely for pmc itself, this
|
||||
spinlock could actually ensure we don't access them in parallel.
|
||||
|
||||
Thanks to Eric and Long for discussion on this bug.
|
||||
|
||||
Reported-by: Andrey Konovalov <andreyknvl@google.com>
|
||||
Cc: Eric Dumazet <edumazet@google.com>
|
||||
Cc: Xin Long <lucien.xin@gmail.com>
|
||||
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
|
||||
Reviewed-by: Xin Long <lucien.xin@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/ipv4/igmp.c | 21 +++++++++++++--------
|
||||
1 file changed, 13 insertions(+), 8 deletions(-)
|
||||
|
||||
--- a/net/ipv4/igmp.c
|
||||
+++ b/net/ipv4/igmp.c
|
||||
@@ -2071,21 +2071,26 @@ static int ip_mc_add_src(struct in_devic
|
||||
|
||||
static void ip_mc_clear_src(struct ip_mc_list *pmc)
|
||||
{
|
||||
- struct ip_sf_list *psf, *nextpsf;
|
||||
+ struct ip_sf_list *psf, *nextpsf, *tomb, *sources;
|
||||
|
||||
- for (psf = pmc->tomb; psf; psf = nextpsf) {
|
||||
+ spin_lock_bh(&pmc->lock);
|
||||
+ tomb = pmc->tomb;
|
||||
+ pmc->tomb = NULL;
|
||||
+ sources = pmc->sources;
|
||||
+ pmc->sources = NULL;
|
||||
+ pmc->sfmode = MCAST_EXCLUDE;
|
||||
+ pmc->sfcount[MCAST_INCLUDE] = 0;
|
||||
+ pmc->sfcount[MCAST_EXCLUDE] = 1;
|
||||
+ spin_unlock_bh(&pmc->lock);
|
||||
+
|
||||
+ for (psf = tomb; psf; psf = nextpsf) {
|
||||
nextpsf = psf->sf_next;
|
||||
kfree(psf);
|
||||
}
|
||||
- pmc->tomb = NULL;
|
||||
- for (psf = pmc->sources; psf; psf = nextpsf) {
|
||||
+ for (psf = sources; psf; psf = nextpsf) {
|
||||
nextpsf = psf->sf_next;
|
||||
kfree(psf);
|
||||
}
|
||||
- pmc->sources = NULL;
|
||||
- pmc->sfmode = MCAST_EXCLUDE;
|
||||
- pmc->sfcount[MCAST_INCLUDE] = 0;
|
||||
- pmc->sfcount[MCAST_EXCLUDE] = 1;
|
||||
}
|
||||
|
||||
/* Join a multicast group
|
||||
@@ -1,57 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: WANG Cong <xiyou.wangcong@gmail.com>
|
||||
Date: Tue, 20 Jun 2017 10:46:27 -0700
|
||||
Subject: igmp: add a missing spin_lock_init()
|
||||
|
||||
From: WANG Cong <xiyou.wangcong@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit b4846fc3c8559649277e3e4e6b5cec5348a8d208 ]
|
||||
|
||||
Andrey reported a lockdep warning on non-initialized
|
||||
spinlock:
|
||||
|
||||
INFO: trying to register non-static key.
|
||||
the code is fine but needs lockdep annotation.
|
||||
turning off the locking correctness validator.
|
||||
CPU: 1 PID: 4099 Comm: a.out Not tainted 4.12.0-rc6+ #9
|
||||
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
|
||||
Call Trace:
|
||||
__dump_stack lib/dump_stack.c:16
|
||||
dump_stack+0x292/0x395 lib/dump_stack.c:52
|
||||
register_lock_class+0x717/0x1aa0 kernel/locking/lockdep.c:755
|
||||
? 0xffffffffa0000000
|
||||
__lock_acquire+0x269/0x3690 kernel/locking/lockdep.c:3255
|
||||
lock_acquire+0x22d/0x560 kernel/locking/lockdep.c:3855
|
||||
__raw_spin_lock_bh ./include/linux/spinlock_api_smp.h:135
|
||||
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:175
|
||||
spin_lock_bh ./include/linux/spinlock.h:304
|
||||
ip_mc_clear_src+0x27/0x1e0 net/ipv4/igmp.c:2076
|
||||
igmpv3_clear_delrec+0xee/0x4f0 net/ipv4/igmp.c:1194
|
||||
ip_mc_destroy_dev+0x4e/0x190 net/ipv4/igmp.c:1736
|
||||
|
||||
We miss a spin_lock_init() in igmpv3_add_delrec(), probably
|
||||
because previously we never use it on this code path. Since
|
||||
we already unlink it from the global mc_tomb list, it is
|
||||
probably safe not to acquire this spinlock here. It does not
|
||||
harm to have it although, to avoid conditional locking.
|
||||
|
||||
Fixes: c38b7d327aaf ("igmp: acquire pmc lock for ip_mc_clear_src()")
|
||||
Reported-by: Andrey Konovalov <andreyknvl@google.com>
|
||||
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/ipv4/igmp.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
--- a/net/ipv4/igmp.c
|
||||
+++ b/net/ipv4/igmp.c
|
||||
@@ -1112,6 +1112,7 @@ static void igmpv3_add_delrec(struct in_
|
||||
pmc = kzalloc(sizeof(*pmc), GFP_KERNEL);
|
||||
if (!pmc)
|
||||
return;
|
||||
+ spin_lock_init(&pmc->lock);
|
||||
spin_lock_bh(&im->lock);
|
||||
pmc->interface = im->interface;
|
||||
in_dev_hold(in_dev);
|
||||
-95
@@ -1,95 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Serhey Popovych <serhe.popovych@gmail.com>
|
||||
Date: Tue, 20 Jun 2017 13:29:25 +0300
|
||||
Subject: ipv6: Do not leak throw route references
|
||||
|
||||
From: Serhey Popovych <serhe.popovych@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit 07f615574f8ac499875b21c1142f26308234a92c ]
|
||||
|
||||
While commit 73ba57bfae4a ("ipv6: fix backtracking for throw routes")
|
||||
does good job on error propagation to the fib_rules_lookup()
|
||||
in fib rules core framework that also corrects throw routes
|
||||
handling, it does not solve route reference leakage problem
|
||||
happened when we return -EAGAIN to the fib_rules_lookup()
|
||||
and leave routing table entry referenced in arg->result.
|
||||
|
||||
If rule with matched throw route isn't last matched in the
|
||||
list we overwrite arg->result losing reference on throw
|
||||
route stored previously forever.
|
||||
|
||||
We also partially revert commit ab997ad40839 ("ipv6: fix the
|
||||
incorrect return value of throw route") since we never return
|
||||
routing table entry with dst.error == -EAGAIN when
|
||||
CONFIG_IPV6_MULTIPLE_TABLES is on. Also there is no point
|
||||
to check for RTF_REJECT flag since it is always set throw
|
||||
route.
|
||||
|
||||
Fixes: 73ba57bfae4a ("ipv6: fix backtracking for throw routes")
|
||||
Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/ipv6/fib6_rules.c | 22 ++++++----------------
|
||||
net/ipv6/ip6_fib.c | 3 +--
|
||||
2 files changed, 7 insertions(+), 18 deletions(-)
|
||||
|
||||
--- a/net/ipv6/fib6_rules.c
|
||||
+++ b/net/ipv6/fib6_rules.c
|
||||
@@ -32,7 +32,6 @@ struct fib6_rule {
|
||||
struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
|
||||
int flags, pol_lookup_t lookup)
|
||||
{
|
||||
- struct rt6_info *rt;
|
||||
struct fib_lookup_arg arg = {
|
||||
.lookup_ptr = lookup,
|
||||
.flags = FIB_LOOKUP_NOREF,
|
||||
@@ -44,21 +43,11 @@ struct dst_entry *fib6_rule_lookup(struc
|
||||
fib_rules_lookup(net->ipv6.fib6_rules_ops,
|
||||
flowi6_to_flowi(fl6), flags, &arg);
|
||||
|
||||
- rt = arg.result;
|
||||
+ if (arg.result)
|
||||
+ return arg.result;
|
||||
|
||||
- if (!rt) {
|
||||
- dst_hold(&net->ipv6.ip6_null_entry->dst);
|
||||
- return &net->ipv6.ip6_null_entry->dst;
|
||||
- }
|
||||
-
|
||||
- if (rt->rt6i_flags & RTF_REJECT &&
|
||||
- rt->dst.error == -EAGAIN) {
|
||||
- ip6_rt_put(rt);
|
||||
- rt = net->ipv6.ip6_null_entry;
|
||||
- dst_hold(&rt->dst);
|
||||
- }
|
||||
-
|
||||
- return &rt->dst;
|
||||
+ dst_hold(&net->ipv6.ip6_null_entry->dst);
|
||||
+ return &net->ipv6.ip6_null_entry->dst;
|
||||
}
|
||||
|
||||
static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
|
||||
@@ -121,7 +110,8 @@ static int fib6_rule_action(struct fib_r
|
||||
flp6->saddr = saddr;
|
||||
}
|
||||
err = rt->dst.error;
|
||||
- goto out;
|
||||
+ if (err != -EAGAIN)
|
||||
+ goto out;
|
||||
}
|
||||
again:
|
||||
ip6_rt_put(rt);
|
||||
--- a/net/ipv6/ip6_fib.c
|
||||
+++ b/net/ipv6/ip6_fib.c
|
||||
@@ -289,8 +289,7 @@ struct dst_entry *fib6_rule_lookup(struc
|
||||
struct rt6_info *rt;
|
||||
|
||||
rt = lookup(net, net->ipv6.fib6_main_tbl, fl6, flags);
|
||||
- if (rt->rt6i_flags & RTF_REJECT &&
|
||||
- rt->dst.error == -EAGAIN) {
|
||||
+ if (rt->dst.error == -EAGAIN) {
|
||||
ip6_rt_put(rt);
|
||||
rt = net->ipv6.ip6_null_entry;
|
||||
dst_hold(&rt->dst);
|
||||
-64
@@ -1,64 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Xin Long <lucien.xin@gmail.com>
|
||||
Date: Thu, 15 Jun 2017 16:33:58 +0800
|
||||
Subject: ipv6: fix calling in6_ifa_hold incorrectly for dad work
|
||||
|
||||
From: Xin Long <lucien.xin@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit f8a894b218138888542a5058d0e902378fd0d4ec ]
|
||||
|
||||
Now when starting the dad work in addrconf_mod_dad_work, if the dad work
|
||||
is idle and queued, it needs to hold ifa.
|
||||
|
||||
The problem is there's one gap in [1], during which if the pending dad work
|
||||
is removed elsewhere. It will miss to hold ifa, but the dad word is still
|
||||
idea and queue.
|
||||
|
||||
if (!delayed_work_pending(&ifp->dad_work))
|
||||
in6_ifa_hold(ifp);
|
||||
<--------------[1]
|
||||
mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
|
||||
|
||||
An use-after-free issue can be caused by this.
|
||||
|
||||
Chen Wei found this issue when WARN_ON(!hlist_unhashed(&ifp->addr_lst)) in
|
||||
net6_ifa_finish_destroy was hit because of it.
|
||||
|
||||
As Hannes' suggestion, this patch is to fix it by holding ifa first in
|
||||
addrconf_mod_dad_work, then calling mod_delayed_work and putting ifa if
|
||||
the dad_work is already in queue.
|
||||
|
||||
Note that this patch did not choose to fix it with:
|
||||
|
||||
if (!mod_delayed_work(delay))
|
||||
in6_ifa_hold(ifp);
|
||||
|
||||
As with it, when delay == 0, dad_work would be scheduled immediately, all
|
||||
addrconf_mod_dad_work(0) callings had to be moved under ifp->lock.
|
||||
|
||||
Reported-by: Wei Chen <weichen@redhat.com>
|
||||
Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
|
||||
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
|
||||
Signed-off-by: Xin Long <lucien.xin@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/ipv6/addrconf.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
--- a/net/ipv6/addrconf.c
|
||||
+++ b/net/ipv6/addrconf.c
|
||||
@@ -315,9 +315,9 @@ static void addrconf_mod_rs_timer(struct
|
||||
static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
|
||||
unsigned long delay)
|
||||
{
|
||||
- if (!delayed_work_pending(&ifp->dad_work))
|
||||
- in6_ifa_hold(ifp);
|
||||
- mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
|
||||
+ in6_ifa_hold(ifp);
|
||||
+ if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay))
|
||||
+ in6_ifa_put(ifp);
|
||||
}
|
||||
|
||||
static int snmp6_alloc_dev(struct inet6_dev *idev)
|
||||
-38
@@ -1,38 +0,0 @@
|
||||
From 00ea1ceebe0d9f2dc1cc2b7bd575a00100c27869 Mon Sep 17 00:00:00 2001
|
||||
From: Willem de Bruijn <willemb@google.com>
|
||||
Date: Sat, 18 Feb 2017 19:00:45 -0500
|
||||
Subject: ipv6: release dst on error in ip6_dst_lookup_tail
|
||||
|
||||
From: Willem de Bruijn <willemb@google.com>
|
||||
|
||||
commit 00ea1ceebe0d9f2dc1cc2b7bd575a00100c27869 upstream.
|
||||
|
||||
If ip6_dst_lookup_tail has acquired a dst and fails the IPv4-mapped
|
||||
check, release the dst before returning an error.
|
||||
|
||||
Fixes: ec5e3b0a1d41 ("ipv6: Inhibit IPv4-mapped src address on the wire.")
|
||||
Signed-off-by: Willem de Bruijn <willemb@google.com>
|
||||
Acked-by: Eric Dumazet <edumazet@google.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
|
||||
---
|
||||
net/ipv6/ip6_output.c | 6 ++++--
|
||||
1 file changed, 4 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/net/ipv6/ip6_output.c
|
||||
+++ b/net/ipv6/ip6_output.c
|
||||
@@ -1020,8 +1020,10 @@ static int ip6_dst_lookup_tail(struct ne
|
||||
}
|
||||
#endif
|
||||
if (ipv6_addr_v4mapped(&fl6->saddr) &&
|
||||
- !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr)))
|
||||
- return -EAFNOSUPPORT;
|
||||
+ !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) {
|
||||
+ err = -EAFNOSUPPORT;
|
||||
+ goto out_err_release;
|
||||
+ }
|
||||
|
||||
return 0;
|
||||
|
||||
-73
@@ -1,73 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Gao Feng <gfree.wind@vip.163.com>
|
||||
Date: Fri, 16 Jun 2017 15:00:02 +0800
|
||||
Subject: net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
|
||||
|
||||
From: Gao Feng <gfree.wind@vip.163.com>
|
||||
|
||||
|
||||
[ Upstream commit 9745e362add89432d2c951272a99b0a5fe4348a9 ]
|
||||
|
||||
The register_vlan_device would invoke free_netdev directly, when
|
||||
register_vlan_dev failed. It would trigger the BUG_ON in free_netdev
|
||||
if the dev was already registered. In this case, the netdev would be
|
||||
freed in netdev_run_todo later.
|
||||
|
||||
So add one condition check now. Only when dev is not registered, then
|
||||
free it directly.
|
||||
|
||||
The following is the part coredump when netdev_upper_dev_link failed
|
||||
in register_vlan_dev. I removed the lines which are too long.
|
||||
|
||||
[ 411.237457] ------------[ cut here ]------------
|
||||
[ 411.237458] kernel BUG at net/core/dev.c:7998!
|
||||
[ 411.237484] invalid opcode: 0000 [#1] SMP
|
||||
[ 411.237705] [last unloaded: 8021q]
|
||||
[ 411.237718] CPU: 1 PID: 12845 Comm: vconfig Tainted: G E 4.12.0-rc5+ #6
|
||||
[ 411.237737] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015
|
||||
[ 411.237764] task: ffff9cbeb6685580 task.stack: ffffa7d2807d8000
|
||||
[ 411.237782] RIP: 0010:free_netdev+0x116/0x120
|
||||
[ 411.237794] RSP: 0018:ffffa7d2807dbdb0 EFLAGS: 00010297
|
||||
[ 411.237808] RAX: 0000000000000002 RBX: ffff9cbeb6ba8fd8 RCX: 0000000000001878
|
||||
[ 411.237826] RDX: 0000000000000001 RSI: 0000000000000282 RDI: 0000000000000000
|
||||
[ 411.237844] RBP: ffffa7d2807dbdc8 R08: 0002986100029841 R09: 0002982100029801
|
||||
[ 411.237861] R10: 0004000100029980 R11: 0004000100029980 R12: ffff9cbeb6ba9000
|
||||
[ 411.238761] R13: ffff9cbeb6ba9060 R14: ffff9cbe60f1a000 R15: ffff9cbeb6ba9000
|
||||
[ 411.239518] FS: 00007fb690d81700(0000) GS:ffff9cbebb640000(0000) knlGS:0000000000000000
|
||||
[ 411.239949] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
|
||||
[ 411.240454] CR2: 00007f7115624000 CR3: 0000000077cdf000 CR4: 00000000003406e0
|
||||
[ 411.240936] Call Trace:
|
||||
[ 411.241462] vlan_ioctl_handler+0x3f1/0x400 [8021q]
|
||||
[ 411.241910] sock_ioctl+0x18b/0x2c0
|
||||
[ 411.242394] do_vfs_ioctl+0xa1/0x5d0
|
||||
[ 411.242853] ? sock_alloc_file+0xa6/0x130
|
||||
[ 411.243465] SyS_ioctl+0x79/0x90
|
||||
[ 411.243900] entry_SYSCALL_64_fastpath+0x1e/0xa9
|
||||
[ 411.244425] RIP: 0033:0x7fb69089a357
|
||||
[ 411.244863] RSP: 002b:00007ffcd04e0fc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
|
||||
[ 411.245445] RAX: ffffffffffffffda RBX: 00007ffcd04e2884 RCX: 00007fb69089a357
|
||||
[ 411.245903] RDX: 00007ffcd04e0fd0 RSI: 0000000000008983 RDI: 0000000000000003
|
||||
[ 411.246527] RBP: 00007ffcd04e0fd0 R08: 0000000000000000 R09: 1999999999999999
|
||||
[ 411.246976] R10: 000000000000053f R11: 0000000000000202 R12: 0000000000000004
|
||||
[ 411.247414] R13: 00007ffcd04e1128 R14: 00007ffcd04e2888 R15: 0000000000000001
|
||||
[ 411.249129] RIP: free_netdev+0x116/0x120 RSP: ffffa7d2807dbdb0
|
||||
|
||||
Signed-off-by: Gao Feng <gfree.wind@vip.163.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/8021q/vlan.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/net/8021q/vlan.c
|
||||
+++ b/net/8021q/vlan.c
|
||||
@@ -277,7 +277,8 @@ static int register_vlan_device(struct n
|
||||
return 0;
|
||||
|
||||
out_free_newdev:
|
||||
- free_netdev(new_dev);
|
||||
+ if (new_dev->reg_state == NETREG_UNINITIALIZED)
|
||||
+ free_netdev(new_dev);
|
||||
return err;
|
||||
}
|
||||
|
||||
-50
@@ -1,50 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Jia-Ju Bai <baijiaju1990@163.com>
|
||||
Date: Sat, 10 Jun 2017 16:49:39 +0800
|
||||
Subject: net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
|
||||
|
||||
From: Jia-Ju Bai <baijiaju1990@163.com>
|
||||
|
||||
|
||||
[ Upstream commit f146e872eb12ebbe92d8e583b2637e0741440db3 ]
|
||||
|
||||
The kernel may sleep under a rcu read lock in cfpkt_create_pfx, and the
|
||||
function call path is:
|
||||
cfcnfg_linkup_rsp (acquire the lock by rcu_read_lock)
|
||||
cfctrl_linkdown_req
|
||||
cfpkt_create
|
||||
cfpkt_create_pfx
|
||||
alloc_skb(GFP_KERNEL) --> may sleep
|
||||
cfserl_receive (acquire the lock by rcu_read_lock)
|
||||
cfpkt_split
|
||||
cfpkt_create_pfx
|
||||
alloc_skb(GFP_KERNEL) --> may sleep
|
||||
|
||||
There is "in_interrupt" in cfpkt_create_pfx to decide use "GFP_KERNEL" or
|
||||
"GFP_ATOMIC". In this situation, "GFP_KERNEL" is used because the function
|
||||
is called under a rcu read lock, instead in interrupt.
|
||||
|
||||
To fix it, only "GFP_ATOMIC" is used in cfpkt_create_pfx.
|
||||
|
||||
Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/caif/cfpkt_skbuff.c | 6 +-----
|
||||
1 file changed, 1 insertion(+), 5 deletions(-)
|
||||
|
||||
--- a/net/caif/cfpkt_skbuff.c
|
||||
+++ b/net/caif/cfpkt_skbuff.c
|
||||
@@ -81,11 +81,7 @@ static struct cfpkt *cfpkt_create_pfx(u1
|
||||
{
|
||||
struct sk_buff *skb;
|
||||
|
||||
- if (likely(in_interrupt()))
|
||||
- skb = alloc_skb(len + pfx, GFP_ATOMIC);
|
||||
- else
|
||||
- skb = alloc_skb(len + pfx, GFP_KERNEL);
|
||||
-
|
||||
+ skb = alloc_skb(len + pfx, GFP_ATOMIC);
|
||||
if (unlikely(skb == NULL))
|
||||
return NULL;
|
||||
|
||||
-34
@@ -1,34 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Alexander Potapenko <glider@google.com>
|
||||
Date: Tue, 6 Jun 2017 15:56:54 +0200
|
||||
Subject: net: don't call strlen on non-terminated string in dev_set_alias()
|
||||
|
||||
From: Alexander Potapenko <glider@google.com>
|
||||
|
||||
|
||||
[ Upstream commit c28294b941232931fbd714099798eb7aa7e865d7 ]
|
||||
|
||||
KMSAN reported a use of uninitialized memory in dev_set_alias(),
|
||||
which was caused by calling strlcpy() (which in turn called strlen())
|
||||
on the user-supplied non-terminated string.
|
||||
|
||||
Signed-off-by: Alexander Potapenko <glider@google.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/core/dev.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/net/core/dev.c
|
||||
+++ b/net/core/dev.c
|
||||
@@ -1250,8 +1250,9 @@ int dev_set_alias(struct net_device *dev
|
||||
if (!new_ifalias)
|
||||
return -ENOMEM;
|
||||
dev->ifalias = new_ifalias;
|
||||
+ memcpy(dev->ifalias, alias, len);
|
||||
+ dev->ifalias[len] = 0;
|
||||
|
||||
- strlcpy(dev->ifalias, alias, len+1);
|
||||
return len;
|
||||
}
|
||||
|
||||
-56
@@ -1,56 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Eli Cohen <eli@mellanox.com>
|
||||
Date: Thu, 8 Jun 2017 11:33:16 -0500
|
||||
Subject: net/mlx5: Wait for FW readiness before initializing command interface
|
||||
|
||||
From: Eli Cohen <eli@mellanox.com>
|
||||
|
||||
|
||||
[ Upstream commit 6c780a0267b8a1075f40b39851132eeaefefcff5 ]
|
||||
|
||||
Before attempting to initialize the command interface we must wait till
|
||||
the fw_initializing bit is clear.
|
||||
|
||||
If we fail to meet this condition the hardware will drop our
|
||||
configuration, specifically the descriptors page address. This scenario
|
||||
can happen when the firmware is still executing an FLR flow and did not
|
||||
finish yet so the driver needs to wait for that to finish.
|
||||
|
||||
Fixes: e3297246c2c8 ('net/mlx5_core: Wait for FW readiness on startup')
|
||||
Signed-off-by: Eli Cohen <eli@mellanox.com>
|
||||
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/ethernet/mellanox/mlx5/core/main.c | 14 ++++++++++++--
|
||||
1 file changed, 12 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
|
||||
@@ -155,8 +155,9 @@ static struct mlx5_profile profile[] = {
|
||||
},
|
||||
};
|
||||
|
||||
-#define FW_INIT_TIMEOUT_MILI 2000
|
||||
-#define FW_INIT_WAIT_MS 2
|
||||
+#define FW_INIT_TIMEOUT_MILI 2000
|
||||
+#define FW_INIT_WAIT_MS 2
|
||||
+#define FW_PRE_INIT_TIMEOUT_MILI 10000
|
||||
|
||||
static int wait_fw_init(struct mlx5_core_dev *dev, u32 max_wait_mili)
|
||||
{
|
||||
@@ -956,6 +957,15 @@ static int mlx5_load_one(struct mlx5_cor
|
||||
*/
|
||||
dev->state = MLX5_DEVICE_STATE_UP;
|
||||
|
||||
+ /* wait for firmware to accept initialization segments configurations
|
||||
+ */
|
||||
+ err = wait_fw_init(dev, FW_PRE_INIT_TIMEOUT_MILI);
|
||||
+ if (err) {
|
||||
+ dev_err(&dev->pdev->dev, "Firmware over %d MS in pre-initializing state, aborting\n",
|
||||
+ FW_PRE_INIT_TIMEOUT_MILI);
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
err = mlx5_cmd_init(dev);
|
||||
if (err) {
|
||||
dev_err(&pdev->dev, "Failed initializing command interface, aborting\n");
|
||||
-130
@@ -1,130 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Tal Gilboa <talgi@mellanox.com>
|
||||
Date: Mon, 15 May 2017 14:13:16 +0300
|
||||
Subject: net/mlx5e: Added BW check for DIM decision mechanism
|
||||
|
||||
From: Tal Gilboa <talgi@mellanox.com>
|
||||
|
||||
|
||||
[ Upstream commit c3164d2fc48fd4fa0477ab658b644559c3fe9073 ]
|
||||
|
||||
DIM (Dynamically-tuned Interrupt Moderation) is a mechanism designed for
|
||||
changing the channel interrupt moderation values in order to reduce CPU
|
||||
overhead for all traffic types.
|
||||
Until now only interrupt and packet rate were sampled.
|
||||
We found a scenario on which we get a false indication since a change in
|
||||
DIM caused more aggregation and reduced packet rate while increasing BW.
|
||||
|
||||
We now regard a change as succesfull iff:
|
||||
current_BW > (prev_BW + threshold) or
|
||||
current_BW ~= prev_BW and current_PR > (prev_PR + threshold) or
|
||||
current_BW ~= prev_BW and current_PR ~= prev_PR and
|
||||
current_IR < (prev_IR - threshold)
|
||||
Where BW = Bandwidth, PR = Packet rate and IR = Interrupt rate
|
||||
|
||||
Improvements (ConnectX-4Lx 25GbE, single RX queue, LRO off)
|
||||
--------------------------------------------------
|
||||
packet size | before[Mb/s] | after[Mb/s] | gain |
|
||||
2B | 343.4 | 359.4 | 4.5% |
|
||||
16B | 2739.7 | 2814.8 | 2.7% |
|
||||
64B | 9739 | 10185.3 | 4.5% |
|
||||
|
||||
Fixes: cb3c7fd4f839 ("net/mlx5e: Support adaptive RX coalescing")
|
||||
Signed-off-by: Tal Gilboa <talgi@mellanox.com>
|
||||
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +
|
||||
drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c | 41 +++++++++++----------
|
||||
2 files changed, 24 insertions(+), 19 deletions(-)
|
||||
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
|
||||
@@ -283,12 +283,14 @@ struct mlx5e_dma_info {
|
||||
|
||||
struct mlx5e_rx_am_stats {
|
||||
int ppms; /* packets per msec */
|
||||
+ int bpms; /* bytes per msec */
|
||||
int epms; /* events per msec */
|
||||
};
|
||||
|
||||
struct mlx5e_rx_am_sample {
|
||||
ktime_t time;
|
||||
unsigned int pkt_ctr;
|
||||
+ unsigned int byte_ctr;
|
||||
u16 event_ctr;
|
||||
};
|
||||
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
|
||||
@@ -183,28 +183,27 @@ static void mlx5e_am_exit_parking(struct
|
||||
mlx5e_am_step(am);
|
||||
}
|
||||
|
||||
+#define IS_SIGNIFICANT_DIFF(val, ref) \
|
||||
+ (((100 * abs((val) - (ref))) / (ref)) > 10) /* more than 10% difference */
|
||||
+
|
||||
static int mlx5e_am_stats_compare(struct mlx5e_rx_am_stats *curr,
|
||||
struct mlx5e_rx_am_stats *prev)
|
||||
{
|
||||
- int diff;
|
||||
-
|
||||
- if (!prev->ppms)
|
||||
- return curr->ppms ? MLX5E_AM_STATS_BETTER :
|
||||
- MLX5E_AM_STATS_SAME;
|
||||
-
|
||||
- diff = curr->ppms - prev->ppms;
|
||||
- if (((100 * abs(diff)) / prev->ppms) > 10) /* more than 10% diff */
|
||||
- return (diff > 0) ? MLX5E_AM_STATS_BETTER :
|
||||
- MLX5E_AM_STATS_WORSE;
|
||||
-
|
||||
- if (!prev->epms)
|
||||
- return curr->epms ? MLX5E_AM_STATS_WORSE :
|
||||
+ if (!prev->bpms)
|
||||
+ return curr->bpms ? MLX5E_AM_STATS_BETTER :
|
||||
MLX5E_AM_STATS_SAME;
|
||||
|
||||
- diff = curr->epms - prev->epms;
|
||||
- if (((100 * abs(diff)) / prev->epms) > 10) /* more than 10% diff */
|
||||
- return (diff < 0) ? MLX5E_AM_STATS_BETTER :
|
||||
- MLX5E_AM_STATS_WORSE;
|
||||
+ if (IS_SIGNIFICANT_DIFF(curr->bpms, prev->bpms))
|
||||
+ return (curr->bpms > prev->bpms) ? MLX5E_AM_STATS_BETTER :
|
||||
+ MLX5E_AM_STATS_WORSE;
|
||||
+
|
||||
+ if (IS_SIGNIFICANT_DIFF(curr->ppms, prev->ppms))
|
||||
+ return (curr->ppms > prev->ppms) ? MLX5E_AM_STATS_BETTER :
|
||||
+ MLX5E_AM_STATS_WORSE;
|
||||
+
|
||||
+ if (IS_SIGNIFICANT_DIFF(curr->epms, prev->epms))
|
||||
+ return (curr->epms < prev->epms) ? MLX5E_AM_STATS_BETTER :
|
||||
+ MLX5E_AM_STATS_WORSE;
|
||||
|
||||
return MLX5E_AM_STATS_SAME;
|
||||
}
|
||||
@@ -266,6 +265,7 @@ static void mlx5e_am_sample(struct mlx5e
|
||||
{
|
||||
s->time = ktime_get();
|
||||
s->pkt_ctr = rq->stats.packets;
|
||||
+ s->byte_ctr = rq->stats.bytes;
|
||||
s->event_ctr = rq->cq.event_ctr;
|
||||
}
|
||||
|
||||
@@ -278,12 +278,15 @@ static void mlx5e_am_calc_stats(struct m
|
||||
/* u32 holds up to 71 minutes, should be enough */
|
||||
u32 delta_us = ktime_us_delta(end->time, start->time);
|
||||
unsigned int npkts = end->pkt_ctr - start->pkt_ctr;
|
||||
+ unsigned int nbytes = end->byte_ctr - start->byte_ctr;
|
||||
|
||||
if (!delta_us)
|
||||
return;
|
||||
|
||||
- curr_stats->ppms = (npkts * USEC_PER_MSEC) / delta_us;
|
||||
- curr_stats->epms = (MLX5E_AM_NEVENTS * USEC_PER_MSEC) / delta_us;
|
||||
+ curr_stats->ppms = DIV_ROUND_UP(npkts * USEC_PER_MSEC, delta_us);
|
||||
+ curr_stats->bpms = DIV_ROUND_UP(nbytes * USEC_PER_MSEC, delta_us);
|
||||
+ curr_stats->epms = DIV_ROUND_UP(MLX5E_AM_NEVENTS * USEC_PER_MSEC,
|
||||
+ delta_us);
|
||||
}
|
||||
|
||||
void mlx5e_rx_am_work(struct work_struct *work)
|
||||
-38
@@ -1,38 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Or Gerlitz <ogerlitz@mellanox.com>
|
||||
Date: Thu, 15 Jun 2017 20:08:32 +0300
|
||||
Subject: net/mlx5e: Avoid doing a cleanup call if the profile doesn't have it
|
||||
|
||||
From: Or Gerlitz <ogerlitz@mellanox.com>
|
||||
|
||||
|
||||
[ Upstream commit 31ac93386d135a6c96de9c8bab406f5ccabf5a4d ]
|
||||
|
||||
The error flow of mlx5e_create_netdev calls the cleanup call
|
||||
of the given profile without checking if it exists, fix that.
|
||||
|
||||
Currently the VF reps don't register that callback and we crash
|
||||
if getting into error -- can be reproduced by the user doing ctrl^C
|
||||
while attempting to change the sriov mode from legacy to switchdev.
|
||||
|
||||
Fixes: 26e59d8077a3 '(net/mlx5e: Implement mlx5e interface attach/detach callbacks')
|
||||
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
|
||||
Reported-by: Sabrina Dubroca <sdubroca@redhat.com>
|
||||
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
|
||||
@@ -3846,7 +3846,8 @@ struct net_device *mlx5e_create_netdev(s
|
||||
return netdev;
|
||||
|
||||
err_cleanup_nic:
|
||||
- profile->cleanup(priv);
|
||||
+ if (profile->cleanup)
|
||||
+ profile->cleanup(priv);
|
||||
free_netdev(netdev);
|
||||
|
||||
return NULL;
|
||||
-40
@@ -1,40 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Maor Dickman <maord@mellanox.com>
|
||||
Date: Thu, 18 May 2017 15:15:08 +0300
|
||||
Subject: net/mlx5e: Fix timestamping capabilities reporting
|
||||
|
||||
From: Maor Dickman <maord@mellanox.com>
|
||||
|
||||
|
||||
[ Upstream commit f0b381178b01b831f9907d72f467d6443afdea67 ]
|
||||
|
||||
Misuse of (BIT) macro caused to report wrong flags for
|
||||
"Hardware Transmit Timestamp Modes" and "Hardware Receive
|
||||
Filter Modes"
|
||||
|
||||
Fixes: ef9814deafd0 ('net/mlx5e: Add HW timestamping (TS) support')
|
||||
Signed-off-by: Maor Dickman <maord@mellanox.com>
|
||||
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 8 ++++----
|
||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
|
||||
@@ -1183,11 +1183,11 @@ static int mlx5e_get_ts_info(struct net_
|
||||
SOF_TIMESTAMPING_RX_HARDWARE |
|
||||
SOF_TIMESTAMPING_RAW_HARDWARE;
|
||||
|
||||
- info->tx_types = (BIT(1) << HWTSTAMP_TX_OFF) |
|
||||
- (BIT(1) << HWTSTAMP_TX_ON);
|
||||
+ info->tx_types = BIT(HWTSTAMP_TX_OFF) |
|
||||
+ BIT(HWTSTAMP_TX_ON);
|
||||
|
||||
- info->rx_filters = (BIT(1) << HWTSTAMP_FILTER_NONE) |
|
||||
- (BIT(1) << HWTSTAMP_FILTER_ALL);
|
||||
+ info->rx_filters = BIT(HWTSTAMP_FILTER_NONE) |
|
||||
+ BIT(HWTSTAMP_FILTER_ALL);
|
||||
|
||||
return 0;
|
||||
}
|
||||
-87
@@ -1,87 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Tal Gilboa <talgi@mellanox.com>
|
||||
Date: Mon, 29 May 2017 17:02:55 +0300
|
||||
Subject: net/mlx5e: Fix wrong indications in DIM due to counter wraparound
|
||||
|
||||
From: Tal Gilboa <talgi@mellanox.com>
|
||||
|
||||
|
||||
[ Upstream commit 53acd76ce571e3b71f9205f2d49ab285a9f1aad8 ]
|
||||
|
||||
DIM (Dynamically-tuned Interrupt Moderation) is a mechanism designed for
|
||||
changing the channel interrupt moderation values in order to reduce CPU
|
||||
overhead for all traffic types.
|
||||
Each iteration of the algorithm, DIM calculates the difference in
|
||||
throughput, packet rate and interrupt rate from last iteration in order
|
||||
to make a decision. DIM relies on counters for each metric. When these
|
||||
counters get to their type's max value they wraparound. In this case
|
||||
the delta between 'end' and 'start' samples is negative and when
|
||||
translated to unsigned integers - very high. This results in a false
|
||||
indication to the algorithm and might result in a wrong decision.
|
||||
|
||||
The fix calculates the 'distance' between 'end' and 'start' samples in a
|
||||
cyclic way around the relevant type's max value. It can also be viewed as
|
||||
an absolute value around the type's max value instead of around 0.
|
||||
|
||||
Testing show higher stability in DIM profile selection and no wraparound
|
||||
issues.
|
||||
|
||||
Fixes: cb3c7fd4f839 ("net/mlx5e: Support adaptive RX coalescing")
|
||||
Signed-off-by: Tal Gilboa <talgi@mellanox.com>
|
||||
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/ethernet/mellanox/mlx5/core/en.h | 8 ++++----
|
||||
drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c | 10 +++++++---
|
||||
2 files changed, 11 insertions(+), 7 deletions(-)
|
||||
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
|
||||
@@ -288,10 +288,10 @@ struct mlx5e_rx_am_stats {
|
||||
};
|
||||
|
||||
struct mlx5e_rx_am_sample {
|
||||
- ktime_t time;
|
||||
- unsigned int pkt_ctr;
|
||||
- unsigned int byte_ctr;
|
||||
- u16 event_ctr;
|
||||
+ ktime_t time;
|
||||
+ u32 pkt_ctr;
|
||||
+ u32 byte_ctr;
|
||||
+ u16 event_ctr;
|
||||
};
|
||||
|
||||
struct mlx5e_rx_am { /* Adaptive Moderation */
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
|
||||
@@ -270,6 +270,8 @@ static void mlx5e_am_sample(struct mlx5e
|
||||
}
|
||||
|
||||
#define MLX5E_AM_NEVENTS 64
|
||||
+#define BITS_PER_TYPE(type) (sizeof(type) * BITS_PER_BYTE)
|
||||
+#define BIT_GAP(bits, end, start) ((((end) - (start)) + BIT_ULL(bits)) & (BIT_ULL(bits) - 1))
|
||||
|
||||
static void mlx5e_am_calc_stats(struct mlx5e_rx_am_sample *start,
|
||||
struct mlx5e_rx_am_sample *end,
|
||||
@@ -277,8 +279,9 @@ static void mlx5e_am_calc_stats(struct m
|
||||
{
|
||||
/* u32 holds up to 71 minutes, should be enough */
|
||||
u32 delta_us = ktime_us_delta(end->time, start->time);
|
||||
- unsigned int npkts = end->pkt_ctr - start->pkt_ctr;
|
||||
- unsigned int nbytes = end->byte_ctr - start->byte_ctr;
|
||||
+ u32 npkts = BIT_GAP(BITS_PER_TYPE(u32), end->pkt_ctr, start->pkt_ctr);
|
||||
+ u32 nbytes = BIT_GAP(BITS_PER_TYPE(u32), end->byte_ctr,
|
||||
+ start->byte_ctr);
|
||||
|
||||
if (!delta_us)
|
||||
return;
|
||||
@@ -311,7 +314,8 @@ void mlx5e_rx_am(struct mlx5e_rq *rq)
|
||||
|
||||
switch (am->state) {
|
||||
case MLX5E_AM_MEASURE_IN_PROGRESS:
|
||||
- nevents = rq->cq.event_ctr - am->start_sample.event_ctr;
|
||||
+ nevents = BIT_GAP(BITS_PER_TYPE(u16), rq->cq.event_ctr,
|
||||
+ am->start_sample.event_ctr);
|
||||
if (nevents < MLX5E_AM_NEVENTS)
|
||||
break;
|
||||
mlx5e_am_sample(rq, &end_sample);
|
||||
-44
@@ -1,44 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Jia-Ju Bai <baijiaju1990@163.com>
|
||||
Date: Sat, 10 Jun 2017 17:03:35 +0800
|
||||
Subject: net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse
|
||||
|
||||
From: Jia-Ju Bai <baijiaju1990@163.com>
|
||||
|
||||
|
||||
[ Upstream commit 343eba69c6968190d8654b857aea952fed9a6749 ]
|
||||
|
||||
The kernel may sleep under a rcu read lock in tipc_msg_reverse, and the
|
||||
function call path is:
|
||||
tipc_l2_rcv_msg (acquire the lock by rcu_read_lock)
|
||||
tipc_rcv
|
||||
tipc_sk_rcv
|
||||
tipc_msg_reverse
|
||||
pskb_expand_head(GFP_KERNEL) --> may sleep
|
||||
tipc_node_broadcast
|
||||
tipc_node_xmit_skb
|
||||
tipc_node_xmit
|
||||
tipc_sk_rcv
|
||||
tipc_msg_reverse
|
||||
pskb_expand_head(GFP_KERNEL) --> may sleep
|
||||
|
||||
To fix it, "GFP_KERNEL" is replaced with "GFP_ATOMIC".
|
||||
|
||||
Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/tipc/msg.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
--- a/net/tipc/msg.c
|
||||
+++ b/net/tipc/msg.c
|
||||
@@ -508,7 +508,7 @@ bool tipc_msg_reverse(u32 own_node, str
|
||||
}
|
||||
|
||||
if (skb_cloned(_skb) &&
|
||||
- pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_KERNEL))
|
||||
+ pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))
|
||||
goto exit;
|
||||
|
||||
/* Now reverse the concerned fields */
|
||||
-110
@@ -1,110 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: David Ahern <dsahern@gmail.com>
|
||||
Date: Thu, 8 Jun 2017 11:31:11 -0600
|
||||
Subject: net: vrf: Make add_fib_rules per network namespace flag
|
||||
|
||||
From: David Ahern <dsahern@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit 097d3c9508dc58286344e4a22b300098cf0c1566 ]
|
||||
|
||||
Commit 1aa6c4f6b8cd8 ("net: vrf: Add l3mdev rules on first device create")
|
||||
adds the l3mdev FIB rule the first time a VRF device is created. However,
|
||||
it only creates the rule once and only in the namespace the first device
|
||||
is created - which may not be init_net. Fix by using the net_generic
|
||||
capability to make the add_fib_rules flag per network namespace.
|
||||
|
||||
Fixes: 1aa6c4f6b8cd8 ("net: vrf: Add l3mdev rules on first device create")
|
||||
Reported-by: Petr Machata <petrm@mellanox.com>
|
||||
Signed-off-by: David Ahern <dsahern@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/vrf.c | 36 ++++++++++++++++++++++++++++++++----
|
||||
1 file changed, 32 insertions(+), 4 deletions(-)
|
||||
|
||||
--- a/drivers/net/vrf.c
|
||||
+++ b/drivers/net/vrf.c
|
||||
@@ -36,12 +36,14 @@
|
||||
#include <net/addrconf.h>
|
||||
#include <net/l3mdev.h>
|
||||
#include <net/fib_rules.h>
|
||||
+#include <net/netns/generic.h>
|
||||
|
||||
#define DRV_NAME "vrf"
|
||||
#define DRV_VERSION "1.0"
|
||||
|
||||
#define FIB_RULE_PREF 1000 /* default preference for FIB rules */
|
||||
-static bool add_fib_rules = true;
|
||||
+
|
||||
+static unsigned int vrf_net_id;
|
||||
|
||||
struct net_vrf {
|
||||
struct rtable __rcu *rth;
|
||||
@@ -1237,6 +1239,8 @@ static int vrf_newlink(struct net *src_n
|
||||
struct nlattr *tb[], struct nlattr *data[])
|
||||
{
|
||||
struct net_vrf *vrf = netdev_priv(dev);
|
||||
+ bool *add_fib_rules;
|
||||
+ struct net *net;
|
||||
int err;
|
||||
|
||||
if (!data || !data[IFLA_VRF_TABLE])
|
||||
@@ -1252,13 +1256,15 @@ static int vrf_newlink(struct net *src_n
|
||||
if (err)
|
||||
goto out;
|
||||
|
||||
- if (add_fib_rules) {
|
||||
+ net = dev_net(dev);
|
||||
+ add_fib_rules = net_generic(net, vrf_net_id);
|
||||
+ if (*add_fib_rules) {
|
||||
err = vrf_add_fib_rules(dev);
|
||||
if (err) {
|
||||
unregister_netdevice(dev);
|
||||
goto out;
|
||||
}
|
||||
- add_fib_rules = false;
|
||||
+ *add_fib_rules = false;
|
||||
}
|
||||
|
||||
out:
|
||||
@@ -1341,16 +1347,38 @@ static struct notifier_block vrf_notifie
|
||||
.notifier_call = vrf_device_event,
|
||||
};
|
||||
|
||||
+/* Initialize per network namespace state */
|
||||
+static int __net_init vrf_netns_init(struct net *net)
|
||||
+{
|
||||
+ bool *add_fib_rules = net_generic(net, vrf_net_id);
|
||||
+
|
||||
+ *add_fib_rules = true;
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+static struct pernet_operations vrf_net_ops __net_initdata = {
|
||||
+ .init = vrf_netns_init,
|
||||
+ .id = &vrf_net_id,
|
||||
+ .size = sizeof(bool),
|
||||
+};
|
||||
+
|
||||
static int __init vrf_init_module(void)
|
||||
{
|
||||
int rc;
|
||||
|
||||
register_netdevice_notifier(&vrf_notifier_block);
|
||||
|
||||
- rc = rtnl_link_register(&vrf_link_ops);
|
||||
+ rc = register_pernet_subsys(&vrf_net_ops);
|
||||
if (rc < 0)
|
||||
goto error;
|
||||
|
||||
+ rc = rtnl_link_register(&vrf_link_ops);
|
||||
+ if (rc < 0) {
|
||||
+ unregister_pernet_subsys(&vrf_net_ops);
|
||||
+ goto error;
|
||||
+ }
|
||||
+
|
||||
return 0;
|
||||
|
||||
error:
|
||||
-42
@@ -1,42 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: "Mintz, Yuval" <Yuval.Mintz@cavium.com>
|
||||
Date: Wed, 7 Jun 2017 21:00:33 +0300
|
||||
Subject: net: Zero ifla_vf_info in rtnl_fill_vfinfo()
|
||||
|
||||
From: "Mintz, Yuval" <Yuval.Mintz@cavium.com>
|
||||
|
||||
|
||||
[ Upstream commit 0eed9cf58446b28b233388b7f224cbca268b6986 ]
|
||||
|
||||
Some of the structure's fields are not initialized by the
|
||||
rtnetlink. If driver doesn't set those in ndo_get_vf_config(),
|
||||
they'd leak memory to user.
|
||||
|
||||
Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com>
|
||||
CC: Michal Schmidt <mschmidt@redhat.com>
|
||||
Reviewed-by: Greg Rose <gvrose8192@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/core/rtnetlink.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/net/core/rtnetlink.c
|
||||
+++ b/net/core/rtnetlink.c
|
||||
@@ -1130,6 +1130,8 @@ static noinline_for_stack int rtnl_fill_
|
||||
struct ifla_vf_mac vf_mac;
|
||||
struct ifla_vf_info ivi;
|
||||
|
||||
+ memset(&ivi, 0, sizeof(ivi));
|
||||
+
|
||||
/* Not all SR-IOV capable drivers support the
|
||||
* spoofcheck and "RSS query enable" query. Preset to
|
||||
* -1 so the user space tool can detect that the driver
|
||||
@@ -1138,7 +1140,6 @@ static noinline_for_stack int rtnl_fill_
|
||||
ivi.spoofchk = -1;
|
||||
ivi.rss_query_en = -1;
|
||||
ivi.trusted = -1;
|
||||
- memset(ivi.mac, 0, sizeof(ivi.mac));
|
||||
/* The default value for VF link state is "auto"
|
||||
* IFLA_VF_LINK_STATE_AUTO which equals zero
|
||||
*/
|
||||
@@ -1,32 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Christian Perle <christian.perle@secunet.com>
|
||||
Date: Mon, 12 Jun 2017 10:06:57 +0200
|
||||
Subject: proc: snmp6: Use correct type in memset
|
||||
|
||||
From: Christian Perle <christian.perle@secunet.com>
|
||||
|
||||
|
||||
[ Upstream commit 3500cd73dff48f28f4ba80c171c4c80034d40f76 ]
|
||||
|
||||
Reading /proc/net/snmp6 yields bogus values on 32 bit kernels.
|
||||
Use "u64" instead of "unsigned long" in sizeof().
|
||||
|
||||
Fixes: 4a4857b1c81e ("proc: Reduce cache miss in snmp6_seq_show")
|
||||
Signed-off-by: Christian Perle <christian.perle@secunet.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/ipv6/proc.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
--- a/net/ipv6/proc.c
|
||||
+++ b/net/ipv6/proc.c
|
||||
@@ -219,7 +219,7 @@ static void snmp6_seq_show_item64(struct
|
||||
u64 buff64[SNMP_MIB_MAX];
|
||||
int i;
|
||||
|
||||
- memset(buff64, 0, sizeof(unsigned long) * SNMP_MIB_MAX);
|
||||
+ memset(buff64, 0, sizeof(u64) * SNMP_MIB_MAX);
|
||||
|
||||
snmp_get_cpu_field64_batch(buff64, itemlist, mib, syncpoff);
|
||||
for (i = 0; itemlist[i].name; i++)
|
||||
-42
@@ -1,42 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Serhey Popovych <serhe.popovych@gmail.com>
|
||||
Date: Tue, 20 Jun 2017 14:35:23 +0300
|
||||
Subject: rtnetlink: add IFLA_GROUP to ifla_policy
|
||||
|
||||
From: Serhey Popovych <serhe.popovych@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit db833d40ad3263b2ee3b59a1ba168bb3cfed8137 ]
|
||||
|
||||
Network interface groups support added while ago, however
|
||||
there is no IFLA_GROUP attribute description in policy
|
||||
and netlink message size calculations until now.
|
||||
|
||||
Add IFLA_GROUP attribute to the policy.
|
||||
|
||||
Fixes: cbda10fa97d7 ("net_device: add support for network device groups")
|
||||
Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/core/rtnetlink.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
--- a/net/core/rtnetlink.c
|
||||
+++ b/net/core/rtnetlink.c
|
||||
@@ -937,6 +937,7 @@ static noinline size_t if_nlmsg_size(con
|
||||
+ nla_total_size(1) /* IFLA_LINKMODE */
|
||||
+ nla_total_size(4) /* IFLA_CARRIER_CHANGES */
|
||||
+ nla_total_size(4) /* IFLA_LINK_NETNSID */
|
||||
+ + nla_total_size(4) /* IFLA_GROUP */
|
||||
+ nla_total_size(ext_filter_mask
|
||||
& RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
|
||||
+ rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
|
||||
@@ -1465,6 +1466,7 @@ static const struct nla_policy ifla_poli
|
||||
[IFLA_LINK_NETNSID] = { .type = NLA_S32 },
|
||||
[IFLA_PROTO_DOWN] = { .type = NLA_U8 },
|
||||
[IFLA_XDP] = { .type = NLA_NESTED },
|
||||
+ [IFLA_GROUP] = { .type = NLA_U32 },
|
||||
};
|
||||
|
||||
static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
|
||||
-49
@@ -1,49 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Xin Long <lucien.xin@gmail.com>
|
||||
Date: Sat, 10 Jun 2017 14:48:14 +0800
|
||||
Subject: sctp: disable BH in sctp_for_each_endpoint
|
||||
|
||||
From: Xin Long <lucien.xin@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit 581409dacc9176b0de1f6c4ca8d66e13aa8e1b29 ]
|
||||
|
||||
Now sctp holds read_lock when foreach sctp_ep_hashtable without disabling
|
||||
BH. If CPU schedules to another thread A at this moment, the thread A may
|
||||
be trying to hold the write_lock with disabling BH.
|
||||
|
||||
As BH is disabled and CPU cannot schedule back to the thread holding the
|
||||
read_lock, while the thread A keeps waiting for the read_lock. A dead
|
||||
lock would be triggered by this.
|
||||
|
||||
This patch is to fix this dead lock by calling read_lock_bh instead to
|
||||
disable BH when holding the read_lock in sctp_for_each_endpoint.
|
||||
|
||||
Fixes: 626d16f50f39 ("sctp: export some apis or variables for sctp_diag and reuse some for proc")
|
||||
Reported-by: Xiumei Mu <xmu@redhat.com>
|
||||
Signed-off-by: Xin Long <lucien.xin@gmail.com>
|
||||
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/sctp/socket.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/net/sctp/socket.c
|
||||
+++ b/net/sctp/socket.c
|
||||
@@ -4460,13 +4460,13 @@ int sctp_for_each_endpoint(int (*cb)(str
|
||||
|
||||
for (head = sctp_ep_hashtable; hash < sctp_ep_hashsize;
|
||||
hash++, head++) {
|
||||
- read_lock(&head->lock);
|
||||
+ read_lock_bh(&head->lock);
|
||||
sctp_for_each_hentry(epb, &head->chain) {
|
||||
err = cb(sctp_ep(epb), p);
|
||||
if (err)
|
||||
break;
|
||||
}
|
||||
- read_unlock(&head->lock);
|
||||
+ read_unlock_bh(&head->lock);
|
||||
}
|
||||
|
||||
return err;
|
||||
-46
@@ -1,46 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Xin Long <lucien.xin@gmail.com>
|
||||
Date: Thu, 15 Jun 2017 17:49:08 +0800
|
||||
Subject: sctp: return next obj by passing pos + 1 into sctp_transport_get_idx
|
||||
|
||||
From: Xin Long <lucien.xin@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit 988c7322116970696211e902b468aefec95b6ec4 ]
|
||||
|
||||
In sctp_for_each_transport, pos is used to save how many objs it has
|
||||
dumped. Now it gets the last obj by sctp_transport_get_idx, then gets
|
||||
the next obj by sctp_transport_get_next.
|
||||
|
||||
The issue is that in the meanwhile if some objs in transport hashtable
|
||||
are removed and the objs nums are less than pos, sctp_transport_get_idx
|
||||
would return NULL and hti.walker.tbl is NULL as well. At this moment
|
||||
it should stop hti, instead of continue getting the next obj. Or it
|
||||
would cause a NULL pointer dereference in sctp_transport_get_next.
|
||||
|
||||
This patch is to pass pos + 1 into sctp_transport_get_idx to get the
|
||||
next obj directly, even if pos > objs nums, it would return NULL and
|
||||
stop hti.
|
||||
|
||||
Fixes: 626d16f50f39 ("sctp: export some apis or variables for sctp_diag and reuse some for proc")
|
||||
Signed-off-by: Xin Long <lucien.xin@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/sctp/socket.c | 5 ++---
|
||||
1 file changed, 2 insertions(+), 3 deletions(-)
|
||||
|
||||
--- a/net/sctp/socket.c
|
||||
+++ b/net/sctp/socket.c
|
||||
@@ -4506,9 +4506,8 @@ int sctp_for_each_transport(int (*cb)(st
|
||||
if (err)
|
||||
return err;
|
||||
|
||||
- sctp_transport_get_idx(net, &hti, pos);
|
||||
- obj = sctp_transport_get_next(net, &hti);
|
||||
- for (; obj && !IS_ERR(obj); obj = sctp_transport_get_next(net, &hti)) {
|
||||
+ obj = sctp_transport_get_idx(net, &hti, pos + 1);
|
||||
+ for (; !IS_ERR_OR_NULL(obj); obj = sctp_transport_get_next(net, &hti)) {
|
||||
struct sctp_transport *transport = obj;
|
||||
|
||||
if (!sctp_transport_hold(transport))
|
||||
-50
@@ -1,50 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Bert Kenward <bkenward@solarflare.com>
|
||||
Date: Fri, 16 Jun 2017 09:45:08 +0100
|
||||
Subject: sfc: provide dummy definitions of vswitch functions
|
||||
|
||||
From: Bert Kenward <bkenward@solarflare.com>
|
||||
|
||||
|
||||
efx_probe_all() calls efx->type->vswitching_probe during probe. For
|
||||
SFC4000 (Falcon) NICs this function is not defined, leading to a BUG
|
||||
with the top of the call stack similar to:
|
||||
? efx_pci_probe_main+0x29a/0x830
|
||||
efx_pci_probe+0x7d3/0xe70
|
||||
|
||||
vswitching_restore and vswitching_remove also need to be defined.
|
||||
|
||||
Fixed in mainline by:
|
||||
commit 5a6681e22c14 ("sfc: separate out SFC4000 ("Falcon") support into new sfc-falcon driver")
|
||||
|
||||
Fixes: 6d8aaaf6f798 ("sfc: create VEB vswitch and vport above default firmware setup")
|
||||
Signed-off-by: Bert Kenward <bkenward@solarflare.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/ethernet/sfc/falcon.c | 10 ++++++++++
|
||||
1 file changed, 10 insertions(+)
|
||||
|
||||
--- a/drivers/net/ethernet/sfc/falcon.c
|
||||
+++ b/drivers/net/ethernet/sfc/falcon.c
|
||||
@@ -2801,6 +2801,11 @@ const struct efx_nic_type falcon_a1_nic_
|
||||
.timer_period_max = 1 << FRF_AB_TC_TIMER_VAL_WIDTH,
|
||||
.offload_features = NETIF_F_IP_CSUM,
|
||||
.mcdi_max_ver = -1,
|
||||
+#ifdef CONFIG_SFC_SRIOV
|
||||
+ .vswitching_probe = efx_port_dummy_op_int,
|
||||
+ .vswitching_restore = efx_port_dummy_op_int,
|
||||
+ .vswitching_remove = efx_port_dummy_op_void,
|
||||
+#endif
|
||||
};
|
||||
|
||||
const struct efx_nic_type falcon_b0_nic_type = {
|
||||
@@ -2902,4 +2907,9 @@ const struct efx_nic_type falcon_b0_nic_
|
||||
.offload_features = NETIF_F_IP_CSUM | NETIF_F_RXHASH | NETIF_F_NTUPLE,
|
||||
.mcdi_max_ver = -1,
|
||||
.max_rx_ip_filters = FR_BZ_RX_FILTER_TBL0_ROWS,
|
||||
+#ifdef CONFIG_SFC_SRIOV
|
||||
+ .vswitching_probe = efx_port_dummy_op_int,
|
||||
+ .vswitching_restore = efx_port_dummy_op_int,
|
||||
+ .vswitching_remove = efx_port_dummy_op_void,
|
||||
+#endif
|
||||
};
|
||||
-84
@@ -1,84 +0,0 @@
|
||||
From dec08194ffeccfa1cf085906b53d301930eae18f Mon Sep 17 00:00:00 2001
|
||||
From: Jiahau Chang <jiahau@gmail.com>
|
||||
Date: Mon, 19 Jun 2017 13:08:30 +0300
|
||||
Subject: xhci: Limit USB2 port wake support for AMD Promontory hosts
|
||||
|
||||
For AMD Promontory xHCI host, although you can disable USB 2.0 ports in
|
||||
BIOS settings, those ports will be enabled anyway after you remove a
|
||||
device on that port and re-plug it in again. It's a known limitation of
|
||||
the chip. As a workaround we can clear the PORT_WAKE_BITS.
|
||||
|
||||
This will disable wake on connect, disconnect and overcurrent on
|
||||
AMD Promontory USB2 ports
|
||||
|
||||
[checkpatch cleanup and commit message reword -Mathias]
|
||||
Cc: <stable@vger.kernel.org>
|
||||
Cc: Tsai Nicholas <nicholas.tsai@amd.com>
|
||||
Signed-off-by: Jiahau Chang <Lars_Chang@asmedia.com.tw>
|
||||
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/usb/host/xhci-hub.c | 3 +++
|
||||
drivers/usb/host/xhci-pci.c | 12 ++++++++++++
|
||||
drivers/usb/host/xhci.h | 1 +
|
||||
3 files changed, 16 insertions(+)
|
||||
|
||||
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
|
||||
index 0dde49c..1adae9e 100644
|
||||
--- a/drivers/usb/host/xhci-hub.c
|
||||
+++ b/drivers/usb/host/xhci-hub.c
|
||||
@@ -1461,6 +1461,9 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
|
||||
t2 |= PORT_WKOC_E | PORT_WKCONN_E;
|
||||
t2 &= ~PORT_WKDISC_E;
|
||||
}
|
||||
+ if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) &&
|
||||
+ (hcd->speed < HCD_USB3))
|
||||
+ t2 &= ~PORT_WAKE_BITS;
|
||||
} else
|
||||
t2 &= ~PORT_WAKE_BITS;
|
||||
|
||||
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
|
||||
index 1bcf971..0965bae 100644
|
||||
--- a/drivers/usb/host/xhci-pci.c
|
||||
+++ b/drivers/usb/host/xhci-pci.c
|
||||
@@ -54,6 +54,11 @@
|
||||
#define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8
|
||||
#define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0
|
||||
|
||||
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9
|
||||
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba
|
||||
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb
|
||||
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc
|
||||
+
|
||||
static const char hcd_name[] = "xhci_hcd";
|
||||
|
||||
static struct hc_driver __read_mostly xhci_pci_hc_driver;
|
||||
@@ -135,6 +140,13 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
|
||||
if (pdev->vendor == PCI_VENDOR_ID_AMD)
|
||||
xhci->quirks |= XHCI_TRUST_TX_LENGTH;
|
||||
|
||||
+ if ((pdev->vendor == PCI_VENDOR_ID_AMD) &&
|
||||
+ ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
|
||||
+ (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) ||
|
||||
+ (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) ||
|
||||
+ (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1)))
|
||||
+ xhci->quirks |= XHCI_U2_DISABLE_WAKE;
|
||||
+
|
||||
if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
|
||||
xhci->quirks |= XHCI_LPM_SUPPORT;
|
||||
xhci->quirks |= XHCI_INTEL_HOST;
|
||||
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
|
||||
index 73a28a9..dcd9649 100644
|
||||
--- a/drivers/usb/host/xhci.h
|
||||
+++ b/drivers/usb/host/xhci.h
|
||||
@@ -1819,6 +1819,7 @@ struct xhci_hcd {
|
||||
/* For controller with a broken Port Disable implementation */
|
||||
#define XHCI_BROKEN_PORT_PED (1 << 25)
|
||||
#define XHCI_LIMIT_ENDPOINT_INTERVAL_7 (1 << 26)
|
||||
+#define XHCI_U2_DISABLE_WAKE (1 << 27)
|
||||
|
||||
unsigned int num_active_eps;
|
||||
unsigned int limit_active_eps;
|
||||
--
|
||||
cgit v1.1
|
||||
|
||||
+17
-30
@@ -28,35 +28,9 @@
|
||||
</BuildDependencies>
|
||||
<Patches>
|
||||
<!-- Linux patches -->
|
||||
<Patch level="1" compressionType="xz">patches/linux/patch-4.9.35.xz</Patch>
|
||||
<!-- Mageia Linux patches // compatible with http://svnweb.mageia.org/packages/cauldron/kernel/releases/4.9.35/1.mga6/PATCHES/patches/series-->
|
||||
<Patch level="1" compressionType="xz">patches/linux/patch-4.9.44.xz</Patch>
|
||||
<!-- Mageia Linux patches // compatible with http://svnweb.mageia.org/packages/cauldron/kernel/releases/4.9.40/1.mga7/PATCHES/patches/series-->
|
||||
<!--stable patches-->
|
||||
<Patch level="1">patches/mageia/stable-ipv6-release-dst-on-error-in-ip6_dst_lookup_tail.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-don-t-call-strlen-on-non-terminated-string-in-dev_set_alias.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-decnet-dn_rtmsg-improve-input-length-sanitization-in-dnrmg_receive_user_skb.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-zero-ifla_vf_info-in-rtnl_fill_vfinfo.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-vrf-make-add_fib_rules-per-network-namespace-flag.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-af_unix-add-sockaddr-length-checks-before-accessing-sa_family-in-bind-and-connect-handlers.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-fix-an-intermittent-pr_emerg-warning-about-lo-becoming-free.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-sctp-disable-bh-in-sctp_for_each_endpoint.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-caif-fix-a-sleep-in-atomic-bug-in-cfpkt_create_pfx.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-tipc-fix-a-sleep-in-atomic-bug-in-tipc_msg_reverse.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-mlx5e-added-bw-check-for-dim-decision-mechanism.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-mlx5e-fix-wrong-indications-in-dim-due-to-counter-wraparound.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-proc-snmp6-use-correct-type-in-memset.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-igmp-acquire-pmc-lock-for-ip_mc_clear_src.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-igmp-add-a-missing-spin_lock_init.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-ipv6-fix-calling-in6_ifa_hold-incorrectly-for-dad-work.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-sctp-return-next-obj-by-passing-pos-1-into-sctp_transport_get_idx.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-mlx5e-avoid-doing-a-cleanup-call-if-the-profile-doesn-t-have-it.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-mlx5-wait-for-fw-readiness-before-initializing-command-interface.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-mlx5e-fix-timestamping-capabilities-reporting.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-decnet-always-not-take-dst-__refcnt-when-inserting-dst-into-hash-table.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-8021q-fix-one-possible-panic-caused-by-bug_on-in-free_netdev.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-sfc-provide-dummy-definitions-of-vswitch-functions.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-ipv6-do-not-leak-throw-route-references.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-rtnetlink-add-ifla_group-to-ifla_policy.patch</Patch>
|
||||
|
||||
<!--CVE-2016-8405-->
|
||||
<!--other patches-->
|
||||
<Patch level="1">patches/mageia/Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch</Patch>
|
||||
@@ -143,14 +117,17 @@
|
||||
<Patch level="1">patches/mageia/net-wireless-rtlwifi-Use-dev_kfree_skb_irq-instead-of-kfree_skb.patch</Patch>
|
||||
<Patch level="1">patches/mageia/net-wireless-rtlwifi-Fix-kernel-oops-introduced-with-commit-e4965.patch</Patch>
|
||||
<Patch level="1">patches/mageia/net-wireless-realtek-rtl8xxxu-linux-4.11-rc.patch</Patch>
|
||||
<Patch level="1">patches/mageia/net-netfilter-xt_TCPMSS-add-more-sanity-tests-on-tcph-do.patch</Patch>
|
||||
<Patch level="1">patches/mageia/pinctrl_amd-Use-regular-interrupt-instead-of-chained.patch</Patch>
|
||||
<Patch level="1">patches/mageia/platform-x86-add-shuttle-wmi-driver.patch</Patch>
|
||||
<Patch level="1">patches/mageia/platform-x86-shuttle-wmi-drop-devinit-exit.patch</Patch>
|
||||
<Patch level="1">patches/mageia/platform-x86-shuttle-wmi-4.2-buildfix.patch</Patch>
|
||||
<Patch level="1">patches/mageia/platform-x86-asus-nb-wmi-Add-wapf4-quirk-for-the-X30.patch</Patch>
|
||||
<Patch level="1">patches/mageia/include-kbuild-export-pci_ids.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-realtek-Add-new-codec-ID-ALC299.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-realtek-New-codec-support-of-ALC1220.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-realtek-new-id-for-alc1220.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-realtek-Remove-ALC285-device-ID.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-realtek-New-codecs-support-for-ALC215-ALC28.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-A-new-flag-to-enforce-prefix-to-each-pin.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-Allow-to-enable-disable-vmaster-build-expli.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-Support-Gigabyte-Gaming-board-with-dual-Rea.patch</Patch>
|
||||
@@ -163,7 +140,6 @@
|
||||
<Patch level="1">patches/mageia/hid-usbhid-IBM-BladeCenterHS20-quirk.patch</Patch>
|
||||
<Patch level="1">patches/mageia/usb-storage-unusual_devs-add-id.patch</Patch>
|
||||
<Patch level="1">patches/mageia/usb-storage-unusual_devs-add-id-2.6.37-buildfix.patch</Patch>
|
||||
<Patch level="1">patches/mageia/usb-xhci-Limit-USB2-port-wake-support-for-AMD-Promontory-hosts.patch</Patch>
|
||||
<Patch level="1">patches/mageia/media-usb-pwc-lie-in-proc-usb-devices.patch</Patch>
|
||||
<Patch level="1">patches/mageia/3rd-3rdparty-1.0-tree.patch</Patch>
|
||||
<Patch level="1">patches/mageia/3rd-3rdparty-merge.patch</Patch>
|
||||
@@ -249,6 +225,17 @@
|
||||
</Package>
|
||||
|
||||
<History>
|
||||
<Update release="11">
|
||||
<Date>2017-08-21</Date>
|
||||
<Version>4.9.44</Version>
|
||||
<Comment>Version Bump.</Comment>
|
||||
<Type package="kernel">security</Type>
|
||||
<Requires>
|
||||
<Action package="kernel">systemRestart</Action>
|
||||
</Requires>
|
||||
<Name>Ertuğrul Erata</Name>
|
||||
<Email>ertugrulerata@gmail.com</Email>
|
||||
</Update>
|
||||
<Update release="10">
|
||||
<Date>2017-07-04</Date>
|
||||
<Version>4.9.35</Version>
|
||||
|
||||
Binary file not shown.
-46
@@ -1,46 +0,0 @@
|
||||
From 2638fd0f92d4397884fd991d8f4925cb3f081901 Mon Sep 17 00:00:00 2001
|
||||
From: Eric Dumazet <edumazet@google.com>
|
||||
Date: Mon, 3 Apr 2017 10:55:11 -0700
|
||||
Subject: [PATCH] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
|
||||
|
||||
Denys provided an awesome KASAN report pointing to an use
|
||||
after free in xt_TCPMSS
|
||||
|
||||
I have provided three patches to fix this issue, either in xt_TCPMSS or
|
||||
in xt_tcpudp.c. It seems xt_TCPMSS patch has the smallest possible
|
||||
impact.
|
||||
|
||||
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
||||
Reported-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
---
|
||||
net/netfilter/xt_TCPMSS.c | 6 +++++-
|
||||
1 file changed, 5 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
|
||||
index 27241a767f17..c64aca611ac5 100644
|
||||
--- a/net/netfilter/xt_TCPMSS.c
|
||||
+++ b/net/netfilter/xt_TCPMSS.c
|
||||
@@ -104,7 +104,7 @@ tcpmss_mangle_packet(struct sk_buff *skb,
|
||||
tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
|
||||
tcp_hdrlen = tcph->doff * 4;
|
||||
|
||||
- if (len < tcp_hdrlen)
|
||||
+ if (len < tcp_hdrlen || tcp_hdrlen < sizeof(struct tcphdr))
|
||||
return -1;
|
||||
|
||||
if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
|
||||
@@ -152,6 +152,10 @@ tcpmss_mangle_packet(struct sk_buff *skb,
|
||||
if (len > tcp_hdrlen)
|
||||
return 0;
|
||||
|
||||
+ /* tcph->doff has 4 bits, do not wrap it to 0 */
|
||||
+ if (tcp_hdrlen >= 15 * 4)
|
||||
+ return 0;
|
||||
+
|
||||
/*
|
||||
* MSS Option not found ?! add it..
|
||||
*/
|
||||
--
|
||||
2.13.2
|
||||
|
||||
+37
@@ -0,0 +1,37 @@
|
||||
From f35823619db8bbaa2afea8705f239c3cecb9d22f Mon Sep 17 00:00:00 2001
|
||||
From: Santeri Toivonen <santeri.toivonen@vatsul.com>
|
||||
Date: Tue, 4 Apr 2017 21:09:00 +0300
|
||||
Subject: [PATCH] platform/x86: asus-nb-wmi: Add wapf4 quirk for the X302UA
|
||||
|
||||
Asus laptop X302UA starts up with Wi-Fi disabled,
|
||||
without a way to enable it. Set wapf=4 to fix the problem.
|
||||
|
||||
Signed-off-by: Santeri Toivonen <santeri.toivonen@vatsul.com>
|
||||
Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
|
||||
---
|
||||
drivers/platform/x86/asus-nb-wmi.c | 9 +++++++++
|
||||
1 file changed, 9 insertions(+)
|
||||
|
||||
diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
|
||||
index dea98ffb6f60..1ae58d906536 100644
|
||||
--- a/drivers/platform/x86/asus-nb-wmi.c
|
||||
+++ b/drivers/platform/x86/asus-nb-wmi.c
|
||||
@@ -144,6 +144,15 @@ static const struct dmi_system_id asus_quirks[] = {
|
||||
},
|
||||
{
|
||||
.callback = dmi_matched,
|
||||
+ .ident = "ASUSTeK COMPUTER INC. X302UA",
|
||||
+ .matches = {
|
||||
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
|
||||
+ DMI_MATCH(DMI_PRODUCT_NAME, "X302UA"),
|
||||
+ },
|
||||
+ .driver_data = &quirk_asus_wapf4,
|
||||
+ },
|
||||
+ {
|
||||
+ .callback = dmi_matched,
|
||||
.ident = "ASUSTeK COMPUTER INC. X401U",
|
||||
.matches = {
|
||||
DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
|
||||
--
|
||||
2.13.2
|
||||
|
||||
@@ -14,31 +14,6 @@
|
||||
###
|
||||
### Stable Queue
|
||||
###
|
||||
stable-ipv6-release-dst-on-error-in-ip6_dst_lookup_tail.patch
|
||||
stable-net-don-t-call-strlen-on-non-terminated-string-in-dev_set_alias.patch
|
||||
stable-decnet-dn_rtmsg-improve-input-length-sanitization-in-dnrmg_receive_user_skb.patch
|
||||
stable-net-zero-ifla_vf_info-in-rtnl_fill_vfinfo.patch
|
||||
stable-net-vrf-make-add_fib_rules-per-network-namespace-flag.patch
|
||||
stable-af_unix-add-sockaddr-length-checks-before-accessing-sa_family-in-bind-and-connect-handlers.patch
|
||||
stable-fix-an-intermittent-pr_emerg-warning-about-lo-becoming-free.patch
|
||||
stable-sctp-disable-bh-in-sctp_for_each_endpoint.patch
|
||||
stable-net-caif-fix-a-sleep-in-atomic-bug-in-cfpkt_create_pfx.patch
|
||||
stable-net-tipc-fix-a-sleep-in-atomic-bug-in-tipc_msg_reverse.patch
|
||||
stable-net-mlx5e-added-bw-check-for-dim-decision-mechanism.patch
|
||||
stable-net-mlx5e-fix-wrong-indications-in-dim-due-to-counter-wraparound.patch
|
||||
stable-proc-snmp6-use-correct-type-in-memset.patch
|
||||
stable-igmp-acquire-pmc-lock-for-ip_mc_clear_src.patch
|
||||
stable-igmp-add-a-missing-spin_lock_init.patch
|
||||
stable-ipv6-fix-calling-in6_ifa_hold-incorrectly-for-dad-work.patch
|
||||
stable-sctp-return-next-obj-by-passing-pos-1-into-sctp_transport_get_idx.patch
|
||||
stable-net-mlx5e-avoid-doing-a-cleanup-call-if-the-profile-doesn-t-have-it.patch
|
||||
stable-net-mlx5-wait-for-fw-readiness-before-initializing-command-interface.patch
|
||||
stable-net-mlx5e-fix-timestamping-capabilities-reporting.patch
|
||||
stable-decnet-always-not-take-dst-__refcnt-when-inserting-dst-into-hash-table.patch
|
||||
stable-net-8021q-fix-one-possible-panic-caused-by-bug_on-in-free_netdev.patch
|
||||
stable-sfc-provide-dummy-definitions-of-vswitch-functions.patch
|
||||
stable-ipv6-do-not-leak-throw-route-references.patch
|
||||
stable-rtnetlink-add-ifla_group-to-ifla_policy.patch
|
||||
|
||||
###
|
||||
### Arch x86
|
||||
@@ -297,9 +272,6 @@ net-wireless-rtlwifi-Fix-kernel-oops-introduced-with-commit-e4965.patch
|
||||
# update rtl8xxxu for mga#20508
|
||||
net-wireless-realtek-rtl8xxxu-linux-4.11-rc.patch
|
||||
|
||||
# fixes issue triggable by remote peers
|
||||
net-netfilter-xt_TCPMSS-add-more-sanity-tests-on-tcph-do.patch
|
||||
|
||||
###
|
||||
### pinctrl
|
||||
###
|
||||
@@ -317,6 +289,9 @@ platform-x86-add-shuttle-wmi-driver.patch
|
||||
platform-x86-shuttle-wmi-drop-devinit-exit.patch
|
||||
platform-x86-shuttle-wmi-4.2-buildfix.patch
|
||||
|
||||
# X302UA no wifi
|
||||
platform-x86-asus-nb-wmi-Add-wapf4-quirk-for-the-X30.patch
|
||||
|
||||
###
|
||||
### RTC
|
||||
###
|
||||
@@ -335,6 +310,9 @@ include-kbuild-export-pci_ids.patch
|
||||
# new codecs
|
||||
sound-ALSA-hda-realtek-Add-new-codec-ID-ALC299.patch
|
||||
sound-ALSA-hda-realtek-New-codec-support-of-ALC1220.patch
|
||||
sound-ALSA-hda-realtek-new-id-for-alc1220.patch
|
||||
sound-ALSA-hda-realtek-Remove-ALC285-device-ID.patch
|
||||
sound-ALSA-hda-realtek-New-codecs-support-for-ALC215-ALC28.patch
|
||||
|
||||
# add support for Gigabyte GA-AX370 Gaming 5 with dual codecs (TTL: 4.12)
|
||||
sound-ALSA-hda-A-new-flag-to-enforce-prefix-to-each-pin.patch
|
||||
@@ -372,9 +350,6 @@ hid-usbhid-IBM-BladeCenterHS20-quirk.patch
|
||||
usb-storage-unusual_devs-add-id.patch
|
||||
usb-storage-unusual_devs-add-id-2.6.37-buildfix.patch
|
||||
|
||||
# amd xhci fix
|
||||
usb-xhci-Limit-USB2-port-wake-support-for-AMD-Promontory-hosts.patch
|
||||
|
||||
###
|
||||
### V4L
|
||||
###
|
||||
|
||||
+85
@@ -0,0 +1,85 @@
|
||||
From 0a6f0600efc3df0179a33188c30b5026bd9d1c27 Mon Sep 17 00:00:00 2001
|
||||
From: Kailang Yang <kailang@realtek.com>
|
||||
Date: Fri, 30 Jun 2017 16:00:48 +0800
|
||||
Subject: [PATCH] ALSA: hda/realtek - New codecs support for
|
||||
ALC215/ALC285/ALC289
|
||||
|
||||
Add new codecs support for ALC215 ALC285 ALC289.
|
||||
|
||||
Signed-off-by: Kailang Yang <kailang@realtek.com>
|
||||
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
||||
---
|
||||
sound/pci/hda/patch_realtek.c | 14 ++++++++++++++
|
||||
1 file changed, 14 insertions(+)
|
||||
|
||||
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
|
||||
index 80c7c832d442..c39bc497650c 100644
|
||||
--- a/sound/pci/hda/patch_realtek.c
|
||||
+++ b/sound/pci/hda/patch_realtek.c
|
||||
@@ -327,6 +327,7 @@ static void alc_fill_eapd_coef(struct hd
|
||||
case 0x10ec0292:
|
||||
alc_update_coef_idx(codec, 0x4, 1<<15, 0);
|
||||
break;
|
||||
+ case 0x10ec0215:
|
||||
case 0x10ec0225:
|
||||
case 0x10ec0233:
|
||||
case 0x10ec0255:
|
||||
@@ -335,8 +336,10 @@ static void alc_fill_eapd_coef(struct hd
|
||||
case 0x10ec0283:
|
||||
case 0x10ec0286:
|
||||
case 0x10ec0288:
|
||||
+ case 0x10ec0285:
|
||||
case 0x10ec0295:
|
||||
case 0x10ec0298:
|
||||
+ case 0x10ec0289:
|
||||
case 0x10ec0299:
|
||||
alc_update_coef_idx(codec, 0x10, 1<<9, 0);
|
||||
break;
|
||||
@@ -2723,6 +2726,7 @@ enum {
|
||||
ALC269_TYPE_ALC298,
|
||||
ALC269_TYPE_ALC255,
|
||||
ALC269_TYPE_ALC256,
|
||||
+ ALC269_TYPE_ALC215,
|
||||
ALC269_TYPE_ALC225,
|
||||
ALC269_TYPE_ALC294,
|
||||
ALC269_TYPE_ALC700,
|
||||
@@ -2755,6 +2759,7 @@ static int alc269_parse_auto_config(stru
|
||||
case ALC269_TYPE_ALC298:
|
||||
case ALC269_TYPE_ALC255:
|
||||
case ALC269_TYPE_ALC256:
|
||||
+ case ALC269_TYPE_ALC215:
|
||||
case ALC269_TYPE_ALC225:
|
||||
case ALC269_TYPE_ALC294:
|
||||
case ALC269_TYPE_ALC700:
|
||||
@@ -6298,6 +6303,12 @@ static int patch_alc269(struct hda_codec
|
||||
spec->gen.mixer_nid = 0; /* ALC256 does not have any loopback mixer path */
|
||||
alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/
|
||||
break;
|
||||
+ case 0x10ec0215:
|
||||
+ case 0x10ec0285:
|
||||
+ case 0x10ec0289:
|
||||
+ spec->codec_variant = ALC269_TYPE_ALC215;
|
||||
+ spec->gen.mixer_nid = 0;
|
||||
+ break;
|
||||
case 0x10ec0225:
|
||||
case 0x10ec0295:
|
||||
case 0x10ec0299:
|
||||
@@ -7267,6 +7278,7 @@ static int patch_alc680(struct hda_codec
|
||||
* patch entries
|
||||
*/
|
||||
static const struct hda_device_id snd_hda_id_realtek[] = {
|
||||
+ HDA_CODEC_ENTRY(0x10ec0215, "ALC215", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0221, "ALC221", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0225, "ALC225", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0231, "ALC231", patch_alc269),
|
||||
@@ -7289,8 +7301,10 @@ static const struct hda_device_id snd_hd
|
||||
HDA_CODEC_ENTRY(0x10ec0282, "ALC282", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0283, "ALC283", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0284, "ALC284", patch_alc269),
|
||||
+ HDA_CODEC_ENTRY(0x10ec0285, "ALC285", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0286, "ALC286", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0288, "ALC288", patch_alc269),
|
||||
+ HDA_CODEC_ENTRY(0x10ec0289, "ALC289", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0290, "ALC290", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0292, "ALC292", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0293, "ALC293", patch_alc269),
|
||||
+68
@@ -0,0 +1,68 @@
|
||||
From 4731d5de4b1ca8d2565782cc3aeac392db07c075 Mon Sep 17 00:00:00 2001
|
||||
From: Kailang Yang <kailang@realtek.com>
|
||||
Date: Fri, 30 Jun 2017 15:22:57 +0800
|
||||
Subject: [PATCH] ALSA: hda/realtek - Remove ALC285 device ID
|
||||
|
||||
0x0285 Device ID was not used.
|
||||
It just assigned for alias of ALC293 as backup.
|
||||
So, remove it first.
|
||||
Because our new codec will use this device ID.
|
||||
|
||||
Signed-off-by: Kailang Yang <kailang@realtek.com>
|
||||
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
||||
---
|
||||
sound/pci/hda/patch_realtek.c | 9 +++------
|
||||
1 file changed, 3 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
|
||||
index c79491a1cd47..80c7c832d442 100644
|
||||
--- a/sound/pci/hda/patch_realtek.c
|
||||
+++ b/sound/pci/hda/patch_realtek.c
|
||||
@@ -340,7 +340,6 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
|
||||
case 0x10ec0299:
|
||||
alc_update_coef_idx(codec, 0x10, 1<<9, 0);
|
||||
break;
|
||||
- case 0x10ec0285:
|
||||
case 0x10ec0293:
|
||||
alc_update_coef_idx(codec, 0xa, 1<<13, 0);
|
||||
break;
|
||||
@@ -2738,7 +2737,7 @@ enum {
|
||||
ALC269_TYPE_ALC282,
|
||||
ALC269_TYPE_ALC283,
|
||||
ALC269_TYPE_ALC284,
|
||||
- ALC269_TYPE_ALC285,
|
||||
+ ALC269_TYPE_ALC293,
|
||||
ALC269_TYPE_ALC286,
|
||||
ALC269_TYPE_ALC298,
|
||||
ALC269_TYPE_ALC255,
|
||||
@@ -2764,7 +2763,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
|
||||
case ALC269_TYPE_ALC269VC:
|
||||
case ALC269_TYPE_ALC280:
|
||||
case ALC269_TYPE_ALC284:
|
||||
- case ALC269_TYPE_ALC285:
|
||||
+ case ALC269_TYPE_ALC293:
|
||||
ssids = alc269va_ssids;
|
||||
break;
|
||||
case ALC269_TYPE_ALC269VB:
|
||||
@@ -6678,9 +6677,8 @@ static int patch_alc269(struct hda_codec *codec)
|
||||
case 0x10ec0292:
|
||||
spec->codec_variant = ALC269_TYPE_ALC284;
|
||||
break;
|
||||
- case 0x10ec0285:
|
||||
case 0x10ec0293:
|
||||
- spec->codec_variant = ALC269_TYPE_ALC285;
|
||||
+ spec->codec_variant = ALC269_TYPE_ALC293;
|
||||
break;
|
||||
case 0x10ec0286:
|
||||
case 0x10ec0288:
|
||||
@@ -7752,7 +7750,6 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
|
||||
HDA_CODEC_ENTRY(0x10ec0282, "ALC282", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0283, "ALC283", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0284, "ALC284", patch_alc269),
|
||||
- HDA_CODEC_ENTRY(0x10ec0285, "ALC285", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0286, "ALC286", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0288, "ALC288", patch_alc269),
|
||||
HDA_CODEC_ENTRY(0x10ec0290, "ALC290", patch_alc269),
|
||||
--
|
||||
2.13.2
|
||||
|
||||
+30
@@ -0,0 +1,30 @@
|
||||
From a7498943b45d43f4a1abf37b75908c1edf840230 Mon Sep 17 00:00:00 2001
|
||||
From: Kailang Yang <kailang@realtek.com>
|
||||
Date: Tue, 11 Jul 2017 15:15:47 +0800
|
||||
Subject: [PATCH] ALSA: hda/realtek - New codec device ID for ALC1220
|
||||
|
||||
Codec ID is 0x1168.
|
||||
It is another ALC1220 codec.
|
||||
|
||||
Signed-off-by: Kailang Yang <kailang@realtek.com>
|
||||
|
||||
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
|
||||
index e2116d2..45d58fc 100644
|
||||
--- a/sound/pci/hda/patch_realtek.c
|
||||
+++ b/sound/pci/hda/patch_realtek.c
|
||||
@@ -380,6 +380,7 @@ static void alc_fill_eapd_coef(struct hd
|
||||
break;
|
||||
case 0x10ec0899:
|
||||
case 0x10ec0900:
|
||||
+ case 0x10ec1168:
|
||||
case 0x10ec1220:
|
||||
alc_update_coef_idx(codec, 0x7, 1<<1, 0);
|
||||
break;
|
||||
@@ -7331,6 +7332,7 @@ static const struct hda_device_id snd_hd
|
||||
HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662),
|
||||
HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882),
|
||||
HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882),
|
||||
+ HDA_CODEC_ENTRY(0x10ec1168, "ALC1220", patch_alc882),
|
||||
HDA_CODEC_ENTRY(0x10ec1220, "ALC1220", patch_alc882),
|
||||
{} /* terminator */
|
||||
};
|
||||
-47
@@ -1,47 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Mateusz Jurczyk <mjurczyk@google.com>
|
||||
Date: Thu, 8 Jun 2017 11:13:36 +0200
|
||||
Subject: af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers
|
||||
|
||||
From: Mateusz Jurczyk <mjurczyk@google.com>
|
||||
|
||||
|
||||
[ Upstream commit defbcf2decc903a28d8398aa477b6881e711e3ea ]
|
||||
|
||||
Verify that the caller-provided sockaddr structure is large enough to
|
||||
contain the sa_family field, before accessing it in bind() and connect()
|
||||
handlers of the AF_UNIX socket. Since neither syscall enforces a minimum
|
||||
size of the corresponding memory region, very short sockaddrs (zero or
|
||||
one byte long) result in operating on uninitialized memory while
|
||||
referencing .sa_family.
|
||||
|
||||
Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/unix/af_unix.c | 7 ++++++-
|
||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/net/unix/af_unix.c
|
||||
+++ b/net/unix/af_unix.c
|
||||
@@ -998,7 +998,8 @@ static int unix_bind(struct socket *sock
|
||||
struct path path = { NULL, NULL };
|
||||
|
||||
err = -EINVAL;
|
||||
- if (sunaddr->sun_family != AF_UNIX)
|
||||
+ if (addr_len < offsetofend(struct sockaddr_un, sun_family) ||
|
||||
+ sunaddr->sun_family != AF_UNIX)
|
||||
goto out;
|
||||
|
||||
if (addr_len == sizeof(short)) {
|
||||
@@ -1109,6 +1110,10 @@ static int unix_dgram_connect(struct soc
|
||||
unsigned int hash;
|
||||
int err;
|
||||
|
||||
+ err = -EINVAL;
|
||||
+ if (alen < offsetofend(struct sockaddr, sa_family))
|
||||
+ goto out;
|
||||
+
|
||||
if (addr->sa_family != AF_UNSPEC) {
|
||||
err = unix_mkname(sunaddr, alen, &hash);
|
||||
if (err < 0)
|
||||
-89
@@ -1,89 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Wei Wang <weiwan@google.com>
|
||||
Date: Fri, 16 Jun 2017 10:46:37 -0700
|
||||
Subject: decnet: always not take dst->__refcnt when inserting dst into hash table
|
||||
|
||||
From: Wei Wang <weiwan@google.com>
|
||||
|
||||
|
||||
[ Upstream commit 76371d2e3ad1f84426a30ebcd8c3b9b98f4c724f ]
|
||||
|
||||
In the existing dn_route.c code, dn_route_output_slow() takes
|
||||
dst->__refcnt before calling dn_insert_route() while dn_route_input_slow()
|
||||
does not take dst->__refcnt before calling dn_insert_route().
|
||||
This makes the whole routing code very buggy.
|
||||
In dn_dst_check_expire(), dnrt_free() is called when rt expires. This
|
||||
makes the routes inserted by dn_route_output_slow() not able to be
|
||||
freed as the refcnt is not released.
|
||||
In dn_dst_gc(), dnrt_drop() is called to release rt which could
|
||||
potentially cause the dst->__refcnt to be dropped to -1.
|
||||
In dn_run_flush(), dst_free() is called to release all the dst. Again,
|
||||
it makes the dst inserted by dn_route_output_slow() not able to be
|
||||
released and also, it does not wait on the rcu and could potentially
|
||||
cause crash in the path where other users still refer to this dst.
|
||||
|
||||
This patch makes sure both input and output path do not take
|
||||
dst->__refcnt before calling dn_insert_route() and also makes sure
|
||||
dnrt_free()/dst_free() is called when removing dst from the hash table.
|
||||
The only difference between those 2 calls is that dnrt_free() waits on
|
||||
the rcu while dst_free() does not.
|
||||
|
||||
Signed-off-by: Wei Wang <weiwan@google.com>
|
||||
Acked-by: Martin KaFai Lau <kafai@fb.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/decnet/dn_route.c | 14 ++++----------
|
||||
1 file changed, 4 insertions(+), 10 deletions(-)
|
||||
|
||||
--- a/net/decnet/dn_route.c
|
||||
+++ b/net/decnet/dn_route.c
|
||||
@@ -188,12 +188,6 @@ static inline void dnrt_free(struct dn_r
|
||||
call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
|
||||
}
|
||||
|
||||
-static inline void dnrt_drop(struct dn_route *rt)
|
||||
-{
|
||||
- dst_release(&rt->dst);
|
||||
- call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
|
||||
-}
|
||||
-
|
||||
static void dn_dst_check_expire(unsigned long dummy)
|
||||
{
|
||||
int i;
|
||||
@@ -248,7 +242,7 @@ static int dn_dst_gc(struct dst_ops *ops
|
||||
}
|
||||
*rtp = rt->dst.dn_next;
|
||||
rt->dst.dn_next = NULL;
|
||||
- dnrt_drop(rt);
|
||||
+ dnrt_free(rt);
|
||||
break;
|
||||
}
|
||||
spin_unlock_bh(&dn_rt_hash_table[i].lock);
|
||||
@@ -350,7 +344,7 @@ static int dn_insert_route(struct dn_rou
|
||||
dst_use(&rth->dst, now);
|
||||
spin_unlock_bh(&dn_rt_hash_table[hash].lock);
|
||||
|
||||
- dnrt_drop(rt);
|
||||
+ dst_free(&rt->dst);
|
||||
*rp = rth;
|
||||
return 0;
|
||||
}
|
||||
@@ -380,7 +374,7 @@ static void dn_run_flush(unsigned long d
|
||||
for(; rt; rt = next) {
|
||||
next = rcu_dereference_raw(rt->dst.dn_next);
|
||||
RCU_INIT_POINTER(rt->dst.dn_next, NULL);
|
||||
- dst_free((struct dst_entry *)rt);
|
||||
+ dnrt_free(rt);
|
||||
}
|
||||
|
||||
nothing_to_declare:
|
||||
@@ -1187,7 +1181,7 @@ make_route:
|
||||
if (dev_out->flags & IFF_LOOPBACK)
|
||||
flags |= RTCF_LOCAL;
|
||||
|
||||
- rt = dst_alloc(&dn_dst_ops, dev_out, 1, DST_OBSOLETE_NONE, DST_HOST);
|
||||
+ rt = dst_alloc(&dn_dst_ops, dev_out, 0, DST_OBSOLETE_NONE, DST_HOST);
|
||||
if (rt == NULL)
|
||||
goto e_nobufs;
|
||||
|
||||
-42
@@ -1,42 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Mateusz Jurczyk <mjurczyk@google.com>
|
||||
Date: Wed, 7 Jun 2017 16:14:29 +0200
|
||||
Subject: decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb
|
||||
|
||||
From: Mateusz Jurczyk <mjurczyk@google.com>
|
||||
|
||||
|
||||
[ Upstream commit dd0da17b209ed91f39872766634ca967c170ada1 ]
|
||||
|
||||
Verify that the length of the socket buffer is sufficient to cover the
|
||||
nlmsghdr structure before accessing the nlh->nlmsg_len field for further
|
||||
input sanitization. If the client only supplies 1-3 bytes of data in
|
||||
sk_buff, then nlh->nlmsg_len remains partially uninitialized and
|
||||
contains leftover memory from the corresponding kernel allocation.
|
||||
Operating on such data may result in indeterminate evaluation of the
|
||||
nlmsg_len < sizeof(*nlh) expression.
|
||||
|
||||
The bug was discovered by a runtime instrumentation designed to detect
|
||||
use of uninitialized memory in the kernel. The patch prevents this and
|
||||
other similar tools (e.g. KMSAN) from flagging this behavior in the future.
|
||||
|
||||
Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/decnet/netfilter/dn_rtmsg.c | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/net/decnet/netfilter/dn_rtmsg.c
|
||||
+++ b/net/decnet/netfilter/dn_rtmsg.c
|
||||
@@ -102,7 +102,9 @@ static inline void dnrmg_receive_user_sk
|
||||
{
|
||||
struct nlmsghdr *nlh = nlmsg_hdr(skb);
|
||||
|
||||
- if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
|
||||
+ if (skb->len < sizeof(*nlh) ||
|
||||
+ nlh->nlmsg_len < sizeof(*nlh) ||
|
||||
+ skb->len < nlh->nlmsg_len)
|
||||
return;
|
||||
|
||||
if (!netlink_capable(skb, CAP_NET_ADMIN))
|
||||
-76
@@ -1,76 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Krister Johansen <kjlx@templeofstupid.com>
|
||||
Date: Thu, 8 Jun 2017 13:12:38 -0700
|
||||
Subject: Fix an intermittent pr_emerg warning about lo becoming free.
|
||||
|
||||
From: Krister Johansen <kjlx@templeofstupid.com>
|
||||
|
||||
|
||||
[ Upstream commit f186ce61bb8235d80068c390dc2aad7ca427a4c2 ]
|
||||
|
||||
It looks like this:
|
||||
|
||||
Message from syslogd@flamingo at Apr 26 00:45:00 ...
|
||||
kernel:unregister_netdevice: waiting for lo to become free. Usage count = 4
|
||||
|
||||
They seem to coincide with net namespace teardown.
|
||||
|
||||
The message is emitted by netdev_wait_allrefs().
|
||||
|
||||
Forced a kdump in netdev_run_todo, but found that the refcount on the lo
|
||||
device was already 0 at the time we got to the panic.
|
||||
|
||||
Used bcc to check the blocking in netdev_run_todo. The only places
|
||||
where we're off cpu there are in the rcu_barrier() and msleep() calls.
|
||||
That behavior is expected. The msleep time coincides with the amount of
|
||||
time we spend waiting for the refcount to reach zero; the rcu_barrier()
|
||||
wait times are not excessive.
|
||||
|
||||
After looking through the list of callbacks that the netdevice notifiers
|
||||
invoke in this path, it appears that the dst_dev_event is the most
|
||||
interesting. The dst_ifdown path places a hold on the loopback_dev as
|
||||
part of releasing the dev associated with the original dst cache entry.
|
||||
Most of our notifier callbacks are straight-forward, but this one a)
|
||||
looks complex, and b) places a hold on the network interface in
|
||||
question.
|
||||
|
||||
I constructed a new bcc script that watches various events in the
|
||||
liftime of a dst cache entry. Note that dst_ifdown will take a hold on
|
||||
the loopback device until the invalidated dst entry gets freed.
|
||||
|
||||
[ __dst_free] on DST: ffff883ccabb7900 IF tap1008300eth0 invoked at 1282115677036183
|
||||
__dst_free
|
||||
rcu_nocb_kthread
|
||||
kthread
|
||||
ret_from_fork
|
||||
Acked-by: Eric Dumazet <edumazet@google.com>
|
||||
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/core/dst.c | 14 ++++++++++++++
|
||||
1 file changed, 14 insertions(+)
|
||||
|
||||
--- a/net/core/dst.c
|
||||
+++ b/net/core/dst.c
|
||||
@@ -470,6 +470,20 @@ static int dst_dev_event(struct notifier
|
||||
spin_lock_bh(&dst_garbage.lock);
|
||||
dst = dst_garbage.list;
|
||||
dst_garbage.list = NULL;
|
||||
+ /* The code in dst_ifdown places a hold on the loopback device.
|
||||
+ * If the gc entry processing is set to expire after a lengthy
|
||||
+ * interval, this hold can cause netdev_wait_allrefs() to hang
|
||||
+ * out and wait for a long time -- until the the loopback
|
||||
+ * interface is released. If we're really unlucky, it'll emit
|
||||
+ * pr_emerg messages to console too. Reset the interval here,
|
||||
+ * so dst cleanups occur in a more timely fashion.
|
||||
+ */
|
||||
+ if (dst_garbage.timer_inc > DST_GC_INC) {
|
||||
+ dst_garbage.timer_inc = DST_GC_INC;
|
||||
+ dst_garbage.timer_expires = DST_GC_MIN;
|
||||
+ mod_delayed_work(system_wq, &dst_gc_work,
|
||||
+ dst_garbage.timer_expires);
|
||||
+ }
|
||||
spin_unlock_bh(&dst_garbage.lock);
|
||||
|
||||
if (last)
|
||||
-82
@@ -1,82 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: WANG Cong <xiyou.wangcong@gmail.com>
|
||||
Date: Mon, 12 Jun 2017 09:52:26 -0700
|
||||
Subject: igmp: acquire pmc lock for ip_mc_clear_src()
|
||||
|
||||
From: WANG Cong <xiyou.wangcong@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit c38b7d327aafd1e3ad7ff53eefac990673b65667 ]
|
||||
|
||||
Andrey reported a use-after-free in add_grec():
|
||||
|
||||
for (psf = *psf_list; psf; psf = psf_next) {
|
||||
...
|
||||
psf_next = psf->sf_next;
|
||||
|
||||
where the struct ip_sf_list's were already freed by:
|
||||
|
||||
kfree+0xe8/0x2b0 mm/slub.c:3882
|
||||
ip_mc_clear_src+0x69/0x1c0 net/ipv4/igmp.c:2078
|
||||
ip_mc_dec_group+0x19a/0x470 net/ipv4/igmp.c:1618
|
||||
ip_mc_drop_socket+0x145/0x230 net/ipv4/igmp.c:2609
|
||||
inet_release+0x4e/0x1c0 net/ipv4/af_inet.c:411
|
||||
sock_release+0x8d/0x1e0 net/socket.c:597
|
||||
sock_close+0x16/0x20 net/socket.c:1072
|
||||
|
||||
This happens because we don't hold pmc->lock in ip_mc_clear_src()
|
||||
and a parallel mr_ifc_timer timer could jump in and access them.
|
||||
|
||||
The RCU lock is there but it is merely for pmc itself, this
|
||||
spinlock could actually ensure we don't access them in parallel.
|
||||
|
||||
Thanks to Eric and Long for discussion on this bug.
|
||||
|
||||
Reported-by: Andrey Konovalov <andreyknvl@google.com>
|
||||
Cc: Eric Dumazet <edumazet@google.com>
|
||||
Cc: Xin Long <lucien.xin@gmail.com>
|
||||
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
|
||||
Reviewed-by: Xin Long <lucien.xin@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/ipv4/igmp.c | 21 +++++++++++++--------
|
||||
1 file changed, 13 insertions(+), 8 deletions(-)
|
||||
|
||||
--- a/net/ipv4/igmp.c
|
||||
+++ b/net/ipv4/igmp.c
|
||||
@@ -2071,21 +2071,26 @@ static int ip_mc_add_src(struct in_devic
|
||||
|
||||
static void ip_mc_clear_src(struct ip_mc_list *pmc)
|
||||
{
|
||||
- struct ip_sf_list *psf, *nextpsf;
|
||||
+ struct ip_sf_list *psf, *nextpsf, *tomb, *sources;
|
||||
|
||||
- for (psf = pmc->tomb; psf; psf = nextpsf) {
|
||||
+ spin_lock_bh(&pmc->lock);
|
||||
+ tomb = pmc->tomb;
|
||||
+ pmc->tomb = NULL;
|
||||
+ sources = pmc->sources;
|
||||
+ pmc->sources = NULL;
|
||||
+ pmc->sfmode = MCAST_EXCLUDE;
|
||||
+ pmc->sfcount[MCAST_INCLUDE] = 0;
|
||||
+ pmc->sfcount[MCAST_EXCLUDE] = 1;
|
||||
+ spin_unlock_bh(&pmc->lock);
|
||||
+
|
||||
+ for (psf = tomb; psf; psf = nextpsf) {
|
||||
nextpsf = psf->sf_next;
|
||||
kfree(psf);
|
||||
}
|
||||
- pmc->tomb = NULL;
|
||||
- for (psf = pmc->sources; psf; psf = nextpsf) {
|
||||
+ for (psf = sources; psf; psf = nextpsf) {
|
||||
nextpsf = psf->sf_next;
|
||||
kfree(psf);
|
||||
}
|
||||
- pmc->sources = NULL;
|
||||
- pmc->sfmode = MCAST_EXCLUDE;
|
||||
- pmc->sfcount[MCAST_INCLUDE] = 0;
|
||||
- pmc->sfcount[MCAST_EXCLUDE] = 1;
|
||||
}
|
||||
|
||||
/* Join a multicast group
|
||||
-57
@@ -1,57 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: WANG Cong <xiyou.wangcong@gmail.com>
|
||||
Date: Tue, 20 Jun 2017 10:46:27 -0700
|
||||
Subject: igmp: add a missing spin_lock_init()
|
||||
|
||||
From: WANG Cong <xiyou.wangcong@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit b4846fc3c8559649277e3e4e6b5cec5348a8d208 ]
|
||||
|
||||
Andrey reported a lockdep warning on non-initialized
|
||||
spinlock:
|
||||
|
||||
INFO: trying to register non-static key.
|
||||
the code is fine but needs lockdep annotation.
|
||||
turning off the locking correctness validator.
|
||||
CPU: 1 PID: 4099 Comm: a.out Not tainted 4.12.0-rc6+ #9
|
||||
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
|
||||
Call Trace:
|
||||
__dump_stack lib/dump_stack.c:16
|
||||
dump_stack+0x292/0x395 lib/dump_stack.c:52
|
||||
register_lock_class+0x717/0x1aa0 kernel/locking/lockdep.c:755
|
||||
? 0xffffffffa0000000
|
||||
__lock_acquire+0x269/0x3690 kernel/locking/lockdep.c:3255
|
||||
lock_acquire+0x22d/0x560 kernel/locking/lockdep.c:3855
|
||||
__raw_spin_lock_bh ./include/linux/spinlock_api_smp.h:135
|
||||
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:175
|
||||
spin_lock_bh ./include/linux/spinlock.h:304
|
||||
ip_mc_clear_src+0x27/0x1e0 net/ipv4/igmp.c:2076
|
||||
igmpv3_clear_delrec+0xee/0x4f0 net/ipv4/igmp.c:1194
|
||||
ip_mc_destroy_dev+0x4e/0x190 net/ipv4/igmp.c:1736
|
||||
|
||||
We miss a spin_lock_init() in igmpv3_add_delrec(), probably
|
||||
because previously we never use it on this code path. Since
|
||||
we already unlink it from the global mc_tomb list, it is
|
||||
probably safe not to acquire this spinlock here. It does not
|
||||
harm to have it although, to avoid conditional locking.
|
||||
|
||||
Fixes: c38b7d327aaf ("igmp: acquire pmc lock for ip_mc_clear_src()")
|
||||
Reported-by: Andrey Konovalov <andreyknvl@google.com>
|
||||
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/ipv4/igmp.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
--- a/net/ipv4/igmp.c
|
||||
+++ b/net/ipv4/igmp.c
|
||||
@@ -1112,6 +1112,7 @@ static void igmpv3_add_delrec(struct in_
|
||||
pmc = kzalloc(sizeof(*pmc), GFP_KERNEL);
|
||||
if (!pmc)
|
||||
return;
|
||||
+ spin_lock_init(&pmc->lock);
|
||||
spin_lock_bh(&im->lock);
|
||||
pmc->interface = im->interface;
|
||||
in_dev_hold(in_dev);
|
||||
-95
@@ -1,95 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Serhey Popovych <serhe.popovych@gmail.com>
|
||||
Date: Tue, 20 Jun 2017 13:29:25 +0300
|
||||
Subject: ipv6: Do not leak throw route references
|
||||
|
||||
From: Serhey Popovych <serhe.popovych@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit 07f615574f8ac499875b21c1142f26308234a92c ]
|
||||
|
||||
While commit 73ba57bfae4a ("ipv6: fix backtracking for throw routes")
|
||||
does good job on error propagation to the fib_rules_lookup()
|
||||
in fib rules core framework that also corrects throw routes
|
||||
handling, it does not solve route reference leakage problem
|
||||
happened when we return -EAGAIN to the fib_rules_lookup()
|
||||
and leave routing table entry referenced in arg->result.
|
||||
|
||||
If rule with matched throw route isn't last matched in the
|
||||
list we overwrite arg->result losing reference on throw
|
||||
route stored previously forever.
|
||||
|
||||
We also partially revert commit ab997ad40839 ("ipv6: fix the
|
||||
incorrect return value of throw route") since we never return
|
||||
routing table entry with dst.error == -EAGAIN when
|
||||
CONFIG_IPV6_MULTIPLE_TABLES is on. Also there is no point
|
||||
to check for RTF_REJECT flag since it is always set throw
|
||||
route.
|
||||
|
||||
Fixes: 73ba57bfae4a ("ipv6: fix backtracking for throw routes")
|
||||
Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/ipv6/fib6_rules.c | 22 ++++++----------------
|
||||
net/ipv6/ip6_fib.c | 3 +--
|
||||
2 files changed, 7 insertions(+), 18 deletions(-)
|
||||
|
||||
--- a/net/ipv6/fib6_rules.c
|
||||
+++ b/net/ipv6/fib6_rules.c
|
||||
@@ -32,7 +32,6 @@ struct fib6_rule {
|
||||
struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
|
||||
int flags, pol_lookup_t lookup)
|
||||
{
|
||||
- struct rt6_info *rt;
|
||||
struct fib_lookup_arg arg = {
|
||||
.lookup_ptr = lookup,
|
||||
.flags = FIB_LOOKUP_NOREF,
|
||||
@@ -44,21 +43,11 @@ struct dst_entry *fib6_rule_lookup(struc
|
||||
fib_rules_lookup(net->ipv6.fib6_rules_ops,
|
||||
flowi6_to_flowi(fl6), flags, &arg);
|
||||
|
||||
- rt = arg.result;
|
||||
+ if (arg.result)
|
||||
+ return arg.result;
|
||||
|
||||
- if (!rt) {
|
||||
- dst_hold(&net->ipv6.ip6_null_entry->dst);
|
||||
- return &net->ipv6.ip6_null_entry->dst;
|
||||
- }
|
||||
-
|
||||
- if (rt->rt6i_flags & RTF_REJECT &&
|
||||
- rt->dst.error == -EAGAIN) {
|
||||
- ip6_rt_put(rt);
|
||||
- rt = net->ipv6.ip6_null_entry;
|
||||
- dst_hold(&rt->dst);
|
||||
- }
|
||||
-
|
||||
- return &rt->dst;
|
||||
+ dst_hold(&net->ipv6.ip6_null_entry->dst);
|
||||
+ return &net->ipv6.ip6_null_entry->dst;
|
||||
}
|
||||
|
||||
static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
|
||||
@@ -121,7 +110,8 @@ static int fib6_rule_action(struct fib_r
|
||||
flp6->saddr = saddr;
|
||||
}
|
||||
err = rt->dst.error;
|
||||
- goto out;
|
||||
+ if (err != -EAGAIN)
|
||||
+ goto out;
|
||||
}
|
||||
again:
|
||||
ip6_rt_put(rt);
|
||||
--- a/net/ipv6/ip6_fib.c
|
||||
+++ b/net/ipv6/ip6_fib.c
|
||||
@@ -289,8 +289,7 @@ struct dst_entry *fib6_rule_lookup(struc
|
||||
struct rt6_info *rt;
|
||||
|
||||
rt = lookup(net, net->ipv6.fib6_main_tbl, fl6, flags);
|
||||
- if (rt->rt6i_flags & RTF_REJECT &&
|
||||
- rt->dst.error == -EAGAIN) {
|
||||
+ if (rt->dst.error == -EAGAIN) {
|
||||
ip6_rt_put(rt);
|
||||
rt = net->ipv6.ip6_null_entry;
|
||||
dst_hold(&rt->dst);
|
||||
-64
@@ -1,64 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Xin Long <lucien.xin@gmail.com>
|
||||
Date: Thu, 15 Jun 2017 16:33:58 +0800
|
||||
Subject: ipv6: fix calling in6_ifa_hold incorrectly for dad work
|
||||
|
||||
From: Xin Long <lucien.xin@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit f8a894b218138888542a5058d0e902378fd0d4ec ]
|
||||
|
||||
Now when starting the dad work in addrconf_mod_dad_work, if the dad work
|
||||
is idle and queued, it needs to hold ifa.
|
||||
|
||||
The problem is there's one gap in [1], during which if the pending dad work
|
||||
is removed elsewhere. It will miss to hold ifa, but the dad word is still
|
||||
idea and queue.
|
||||
|
||||
if (!delayed_work_pending(&ifp->dad_work))
|
||||
in6_ifa_hold(ifp);
|
||||
<--------------[1]
|
||||
mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
|
||||
|
||||
An use-after-free issue can be caused by this.
|
||||
|
||||
Chen Wei found this issue when WARN_ON(!hlist_unhashed(&ifp->addr_lst)) in
|
||||
net6_ifa_finish_destroy was hit because of it.
|
||||
|
||||
As Hannes' suggestion, this patch is to fix it by holding ifa first in
|
||||
addrconf_mod_dad_work, then calling mod_delayed_work and putting ifa if
|
||||
the dad_work is already in queue.
|
||||
|
||||
Note that this patch did not choose to fix it with:
|
||||
|
||||
if (!mod_delayed_work(delay))
|
||||
in6_ifa_hold(ifp);
|
||||
|
||||
As with it, when delay == 0, dad_work would be scheduled immediately, all
|
||||
addrconf_mod_dad_work(0) callings had to be moved under ifp->lock.
|
||||
|
||||
Reported-by: Wei Chen <weichen@redhat.com>
|
||||
Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
|
||||
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
|
||||
Signed-off-by: Xin Long <lucien.xin@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/ipv6/addrconf.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
--- a/net/ipv6/addrconf.c
|
||||
+++ b/net/ipv6/addrconf.c
|
||||
@@ -315,9 +315,9 @@ static void addrconf_mod_rs_timer(struct
|
||||
static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
|
||||
unsigned long delay)
|
||||
{
|
||||
- if (!delayed_work_pending(&ifp->dad_work))
|
||||
- in6_ifa_hold(ifp);
|
||||
- mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
|
||||
+ in6_ifa_hold(ifp);
|
||||
+ if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay))
|
||||
+ in6_ifa_put(ifp);
|
||||
}
|
||||
|
||||
static int snmp6_alloc_dev(struct inet6_dev *idev)
|
||||
-38
@@ -1,38 +0,0 @@
|
||||
From 00ea1ceebe0d9f2dc1cc2b7bd575a00100c27869 Mon Sep 17 00:00:00 2001
|
||||
From: Willem de Bruijn <willemb@google.com>
|
||||
Date: Sat, 18 Feb 2017 19:00:45 -0500
|
||||
Subject: ipv6: release dst on error in ip6_dst_lookup_tail
|
||||
|
||||
From: Willem de Bruijn <willemb@google.com>
|
||||
|
||||
commit 00ea1ceebe0d9f2dc1cc2b7bd575a00100c27869 upstream.
|
||||
|
||||
If ip6_dst_lookup_tail has acquired a dst and fails the IPv4-mapped
|
||||
check, release the dst before returning an error.
|
||||
|
||||
Fixes: ec5e3b0a1d41 ("ipv6: Inhibit IPv4-mapped src address on the wire.")
|
||||
Signed-off-by: Willem de Bruijn <willemb@google.com>
|
||||
Acked-by: Eric Dumazet <edumazet@google.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
|
||||
---
|
||||
net/ipv6/ip6_output.c | 6 ++++--
|
||||
1 file changed, 4 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/net/ipv6/ip6_output.c
|
||||
+++ b/net/ipv6/ip6_output.c
|
||||
@@ -1020,8 +1020,10 @@ static int ip6_dst_lookup_tail(struct ne
|
||||
}
|
||||
#endif
|
||||
if (ipv6_addr_v4mapped(&fl6->saddr) &&
|
||||
- !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr)))
|
||||
- return -EAFNOSUPPORT;
|
||||
+ !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) {
|
||||
+ err = -EAFNOSUPPORT;
|
||||
+ goto out_err_release;
|
||||
+ }
|
||||
|
||||
return 0;
|
||||
|
||||
-73
@@ -1,73 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Gao Feng <gfree.wind@vip.163.com>
|
||||
Date: Fri, 16 Jun 2017 15:00:02 +0800
|
||||
Subject: net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
|
||||
|
||||
From: Gao Feng <gfree.wind@vip.163.com>
|
||||
|
||||
|
||||
[ Upstream commit 9745e362add89432d2c951272a99b0a5fe4348a9 ]
|
||||
|
||||
The register_vlan_device would invoke free_netdev directly, when
|
||||
register_vlan_dev failed. It would trigger the BUG_ON in free_netdev
|
||||
if the dev was already registered. In this case, the netdev would be
|
||||
freed in netdev_run_todo later.
|
||||
|
||||
So add one condition check now. Only when dev is not registered, then
|
||||
free it directly.
|
||||
|
||||
The following is the part coredump when netdev_upper_dev_link failed
|
||||
in register_vlan_dev. I removed the lines which are too long.
|
||||
|
||||
[ 411.237457] ------------[ cut here ]------------
|
||||
[ 411.237458] kernel BUG at net/core/dev.c:7998!
|
||||
[ 411.237484] invalid opcode: 0000 [#1] SMP
|
||||
[ 411.237705] [last unloaded: 8021q]
|
||||
[ 411.237718] CPU: 1 PID: 12845 Comm: vconfig Tainted: G E 4.12.0-rc5+ #6
|
||||
[ 411.237737] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015
|
||||
[ 411.237764] task: ffff9cbeb6685580 task.stack: ffffa7d2807d8000
|
||||
[ 411.237782] RIP: 0010:free_netdev+0x116/0x120
|
||||
[ 411.237794] RSP: 0018:ffffa7d2807dbdb0 EFLAGS: 00010297
|
||||
[ 411.237808] RAX: 0000000000000002 RBX: ffff9cbeb6ba8fd8 RCX: 0000000000001878
|
||||
[ 411.237826] RDX: 0000000000000001 RSI: 0000000000000282 RDI: 0000000000000000
|
||||
[ 411.237844] RBP: ffffa7d2807dbdc8 R08: 0002986100029841 R09: 0002982100029801
|
||||
[ 411.237861] R10: 0004000100029980 R11: 0004000100029980 R12: ffff9cbeb6ba9000
|
||||
[ 411.238761] R13: ffff9cbeb6ba9060 R14: ffff9cbe60f1a000 R15: ffff9cbeb6ba9000
|
||||
[ 411.239518] FS: 00007fb690d81700(0000) GS:ffff9cbebb640000(0000) knlGS:0000000000000000
|
||||
[ 411.239949] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
|
||||
[ 411.240454] CR2: 00007f7115624000 CR3: 0000000077cdf000 CR4: 00000000003406e0
|
||||
[ 411.240936] Call Trace:
|
||||
[ 411.241462] vlan_ioctl_handler+0x3f1/0x400 [8021q]
|
||||
[ 411.241910] sock_ioctl+0x18b/0x2c0
|
||||
[ 411.242394] do_vfs_ioctl+0xa1/0x5d0
|
||||
[ 411.242853] ? sock_alloc_file+0xa6/0x130
|
||||
[ 411.243465] SyS_ioctl+0x79/0x90
|
||||
[ 411.243900] entry_SYSCALL_64_fastpath+0x1e/0xa9
|
||||
[ 411.244425] RIP: 0033:0x7fb69089a357
|
||||
[ 411.244863] RSP: 002b:00007ffcd04e0fc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
|
||||
[ 411.245445] RAX: ffffffffffffffda RBX: 00007ffcd04e2884 RCX: 00007fb69089a357
|
||||
[ 411.245903] RDX: 00007ffcd04e0fd0 RSI: 0000000000008983 RDI: 0000000000000003
|
||||
[ 411.246527] RBP: 00007ffcd04e0fd0 R08: 0000000000000000 R09: 1999999999999999
|
||||
[ 411.246976] R10: 000000000000053f R11: 0000000000000202 R12: 0000000000000004
|
||||
[ 411.247414] R13: 00007ffcd04e1128 R14: 00007ffcd04e2888 R15: 0000000000000001
|
||||
[ 411.249129] RIP: free_netdev+0x116/0x120 RSP: ffffa7d2807dbdb0
|
||||
|
||||
Signed-off-by: Gao Feng <gfree.wind@vip.163.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/8021q/vlan.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/net/8021q/vlan.c
|
||||
+++ b/net/8021q/vlan.c
|
||||
@@ -277,7 +277,8 @@ static int register_vlan_device(struct n
|
||||
return 0;
|
||||
|
||||
out_free_newdev:
|
||||
- free_netdev(new_dev);
|
||||
+ if (new_dev->reg_state == NETREG_UNINITIALIZED)
|
||||
+ free_netdev(new_dev);
|
||||
return err;
|
||||
}
|
||||
|
||||
-50
@@ -1,50 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Jia-Ju Bai <baijiaju1990@163.com>
|
||||
Date: Sat, 10 Jun 2017 16:49:39 +0800
|
||||
Subject: net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
|
||||
|
||||
From: Jia-Ju Bai <baijiaju1990@163.com>
|
||||
|
||||
|
||||
[ Upstream commit f146e872eb12ebbe92d8e583b2637e0741440db3 ]
|
||||
|
||||
The kernel may sleep under a rcu read lock in cfpkt_create_pfx, and the
|
||||
function call path is:
|
||||
cfcnfg_linkup_rsp (acquire the lock by rcu_read_lock)
|
||||
cfctrl_linkdown_req
|
||||
cfpkt_create
|
||||
cfpkt_create_pfx
|
||||
alloc_skb(GFP_KERNEL) --> may sleep
|
||||
cfserl_receive (acquire the lock by rcu_read_lock)
|
||||
cfpkt_split
|
||||
cfpkt_create_pfx
|
||||
alloc_skb(GFP_KERNEL) --> may sleep
|
||||
|
||||
There is "in_interrupt" in cfpkt_create_pfx to decide use "GFP_KERNEL" or
|
||||
"GFP_ATOMIC". In this situation, "GFP_KERNEL" is used because the function
|
||||
is called under a rcu read lock, instead in interrupt.
|
||||
|
||||
To fix it, only "GFP_ATOMIC" is used in cfpkt_create_pfx.
|
||||
|
||||
Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/caif/cfpkt_skbuff.c | 6 +-----
|
||||
1 file changed, 1 insertion(+), 5 deletions(-)
|
||||
|
||||
--- a/net/caif/cfpkt_skbuff.c
|
||||
+++ b/net/caif/cfpkt_skbuff.c
|
||||
@@ -81,11 +81,7 @@ static struct cfpkt *cfpkt_create_pfx(u1
|
||||
{
|
||||
struct sk_buff *skb;
|
||||
|
||||
- if (likely(in_interrupt()))
|
||||
- skb = alloc_skb(len + pfx, GFP_ATOMIC);
|
||||
- else
|
||||
- skb = alloc_skb(len + pfx, GFP_KERNEL);
|
||||
-
|
||||
+ skb = alloc_skb(len + pfx, GFP_ATOMIC);
|
||||
if (unlikely(skb == NULL))
|
||||
return NULL;
|
||||
|
||||
-34
@@ -1,34 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Alexander Potapenko <glider@google.com>
|
||||
Date: Tue, 6 Jun 2017 15:56:54 +0200
|
||||
Subject: net: don't call strlen on non-terminated string in dev_set_alias()
|
||||
|
||||
From: Alexander Potapenko <glider@google.com>
|
||||
|
||||
|
||||
[ Upstream commit c28294b941232931fbd714099798eb7aa7e865d7 ]
|
||||
|
||||
KMSAN reported a use of uninitialized memory in dev_set_alias(),
|
||||
which was caused by calling strlcpy() (which in turn called strlen())
|
||||
on the user-supplied non-terminated string.
|
||||
|
||||
Signed-off-by: Alexander Potapenko <glider@google.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/core/dev.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/net/core/dev.c
|
||||
+++ b/net/core/dev.c
|
||||
@@ -1250,8 +1250,9 @@ int dev_set_alias(struct net_device *dev
|
||||
if (!new_ifalias)
|
||||
return -ENOMEM;
|
||||
dev->ifalias = new_ifalias;
|
||||
+ memcpy(dev->ifalias, alias, len);
|
||||
+ dev->ifalias[len] = 0;
|
||||
|
||||
- strlcpy(dev->ifalias, alias, len+1);
|
||||
return len;
|
||||
}
|
||||
|
||||
-56
@@ -1,56 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Eli Cohen <eli@mellanox.com>
|
||||
Date: Thu, 8 Jun 2017 11:33:16 -0500
|
||||
Subject: net/mlx5: Wait for FW readiness before initializing command interface
|
||||
|
||||
From: Eli Cohen <eli@mellanox.com>
|
||||
|
||||
|
||||
[ Upstream commit 6c780a0267b8a1075f40b39851132eeaefefcff5 ]
|
||||
|
||||
Before attempting to initialize the command interface we must wait till
|
||||
the fw_initializing bit is clear.
|
||||
|
||||
If we fail to meet this condition the hardware will drop our
|
||||
configuration, specifically the descriptors page address. This scenario
|
||||
can happen when the firmware is still executing an FLR flow and did not
|
||||
finish yet so the driver needs to wait for that to finish.
|
||||
|
||||
Fixes: e3297246c2c8 ('net/mlx5_core: Wait for FW readiness on startup')
|
||||
Signed-off-by: Eli Cohen <eli@mellanox.com>
|
||||
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/ethernet/mellanox/mlx5/core/main.c | 14 ++++++++++++--
|
||||
1 file changed, 12 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
|
||||
@@ -155,8 +155,9 @@ static struct mlx5_profile profile[] = {
|
||||
},
|
||||
};
|
||||
|
||||
-#define FW_INIT_TIMEOUT_MILI 2000
|
||||
-#define FW_INIT_WAIT_MS 2
|
||||
+#define FW_INIT_TIMEOUT_MILI 2000
|
||||
+#define FW_INIT_WAIT_MS 2
|
||||
+#define FW_PRE_INIT_TIMEOUT_MILI 10000
|
||||
|
||||
static int wait_fw_init(struct mlx5_core_dev *dev, u32 max_wait_mili)
|
||||
{
|
||||
@@ -956,6 +957,15 @@ static int mlx5_load_one(struct mlx5_cor
|
||||
*/
|
||||
dev->state = MLX5_DEVICE_STATE_UP;
|
||||
|
||||
+ /* wait for firmware to accept initialization segments configurations
|
||||
+ */
|
||||
+ err = wait_fw_init(dev, FW_PRE_INIT_TIMEOUT_MILI);
|
||||
+ if (err) {
|
||||
+ dev_err(&dev->pdev->dev, "Firmware over %d MS in pre-initializing state, aborting\n",
|
||||
+ FW_PRE_INIT_TIMEOUT_MILI);
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
err = mlx5_cmd_init(dev);
|
||||
if (err) {
|
||||
dev_err(&pdev->dev, "Failed initializing command interface, aborting\n");
|
||||
-130
@@ -1,130 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Tal Gilboa <talgi@mellanox.com>
|
||||
Date: Mon, 15 May 2017 14:13:16 +0300
|
||||
Subject: net/mlx5e: Added BW check for DIM decision mechanism
|
||||
|
||||
From: Tal Gilboa <talgi@mellanox.com>
|
||||
|
||||
|
||||
[ Upstream commit c3164d2fc48fd4fa0477ab658b644559c3fe9073 ]
|
||||
|
||||
DIM (Dynamically-tuned Interrupt Moderation) is a mechanism designed for
|
||||
changing the channel interrupt moderation values in order to reduce CPU
|
||||
overhead for all traffic types.
|
||||
Until now only interrupt and packet rate were sampled.
|
||||
We found a scenario on which we get a false indication since a change in
|
||||
DIM caused more aggregation and reduced packet rate while increasing BW.
|
||||
|
||||
We now regard a change as succesfull iff:
|
||||
current_BW > (prev_BW + threshold) or
|
||||
current_BW ~= prev_BW and current_PR > (prev_PR + threshold) or
|
||||
current_BW ~= prev_BW and current_PR ~= prev_PR and
|
||||
current_IR < (prev_IR - threshold)
|
||||
Where BW = Bandwidth, PR = Packet rate and IR = Interrupt rate
|
||||
|
||||
Improvements (ConnectX-4Lx 25GbE, single RX queue, LRO off)
|
||||
--------------------------------------------------
|
||||
packet size | before[Mb/s] | after[Mb/s] | gain |
|
||||
2B | 343.4 | 359.4 | 4.5% |
|
||||
16B | 2739.7 | 2814.8 | 2.7% |
|
||||
64B | 9739 | 10185.3 | 4.5% |
|
||||
|
||||
Fixes: cb3c7fd4f839 ("net/mlx5e: Support adaptive RX coalescing")
|
||||
Signed-off-by: Tal Gilboa <talgi@mellanox.com>
|
||||
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +
|
||||
drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c | 41 +++++++++++----------
|
||||
2 files changed, 24 insertions(+), 19 deletions(-)
|
||||
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
|
||||
@@ -283,12 +283,14 @@ struct mlx5e_dma_info {
|
||||
|
||||
struct mlx5e_rx_am_stats {
|
||||
int ppms; /* packets per msec */
|
||||
+ int bpms; /* bytes per msec */
|
||||
int epms; /* events per msec */
|
||||
};
|
||||
|
||||
struct mlx5e_rx_am_sample {
|
||||
ktime_t time;
|
||||
unsigned int pkt_ctr;
|
||||
+ unsigned int byte_ctr;
|
||||
u16 event_ctr;
|
||||
};
|
||||
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
|
||||
@@ -183,28 +183,27 @@ static void mlx5e_am_exit_parking(struct
|
||||
mlx5e_am_step(am);
|
||||
}
|
||||
|
||||
+#define IS_SIGNIFICANT_DIFF(val, ref) \
|
||||
+ (((100 * abs((val) - (ref))) / (ref)) > 10) /* more than 10% difference */
|
||||
+
|
||||
static int mlx5e_am_stats_compare(struct mlx5e_rx_am_stats *curr,
|
||||
struct mlx5e_rx_am_stats *prev)
|
||||
{
|
||||
- int diff;
|
||||
-
|
||||
- if (!prev->ppms)
|
||||
- return curr->ppms ? MLX5E_AM_STATS_BETTER :
|
||||
- MLX5E_AM_STATS_SAME;
|
||||
-
|
||||
- diff = curr->ppms - prev->ppms;
|
||||
- if (((100 * abs(diff)) / prev->ppms) > 10) /* more than 10% diff */
|
||||
- return (diff > 0) ? MLX5E_AM_STATS_BETTER :
|
||||
- MLX5E_AM_STATS_WORSE;
|
||||
-
|
||||
- if (!prev->epms)
|
||||
- return curr->epms ? MLX5E_AM_STATS_WORSE :
|
||||
+ if (!prev->bpms)
|
||||
+ return curr->bpms ? MLX5E_AM_STATS_BETTER :
|
||||
MLX5E_AM_STATS_SAME;
|
||||
|
||||
- diff = curr->epms - prev->epms;
|
||||
- if (((100 * abs(diff)) / prev->epms) > 10) /* more than 10% diff */
|
||||
- return (diff < 0) ? MLX5E_AM_STATS_BETTER :
|
||||
- MLX5E_AM_STATS_WORSE;
|
||||
+ if (IS_SIGNIFICANT_DIFF(curr->bpms, prev->bpms))
|
||||
+ return (curr->bpms > prev->bpms) ? MLX5E_AM_STATS_BETTER :
|
||||
+ MLX5E_AM_STATS_WORSE;
|
||||
+
|
||||
+ if (IS_SIGNIFICANT_DIFF(curr->ppms, prev->ppms))
|
||||
+ return (curr->ppms > prev->ppms) ? MLX5E_AM_STATS_BETTER :
|
||||
+ MLX5E_AM_STATS_WORSE;
|
||||
+
|
||||
+ if (IS_SIGNIFICANT_DIFF(curr->epms, prev->epms))
|
||||
+ return (curr->epms < prev->epms) ? MLX5E_AM_STATS_BETTER :
|
||||
+ MLX5E_AM_STATS_WORSE;
|
||||
|
||||
return MLX5E_AM_STATS_SAME;
|
||||
}
|
||||
@@ -266,6 +265,7 @@ static void mlx5e_am_sample(struct mlx5e
|
||||
{
|
||||
s->time = ktime_get();
|
||||
s->pkt_ctr = rq->stats.packets;
|
||||
+ s->byte_ctr = rq->stats.bytes;
|
||||
s->event_ctr = rq->cq.event_ctr;
|
||||
}
|
||||
|
||||
@@ -278,12 +278,15 @@ static void mlx5e_am_calc_stats(struct m
|
||||
/* u32 holds up to 71 minutes, should be enough */
|
||||
u32 delta_us = ktime_us_delta(end->time, start->time);
|
||||
unsigned int npkts = end->pkt_ctr - start->pkt_ctr;
|
||||
+ unsigned int nbytes = end->byte_ctr - start->byte_ctr;
|
||||
|
||||
if (!delta_us)
|
||||
return;
|
||||
|
||||
- curr_stats->ppms = (npkts * USEC_PER_MSEC) / delta_us;
|
||||
- curr_stats->epms = (MLX5E_AM_NEVENTS * USEC_PER_MSEC) / delta_us;
|
||||
+ curr_stats->ppms = DIV_ROUND_UP(npkts * USEC_PER_MSEC, delta_us);
|
||||
+ curr_stats->bpms = DIV_ROUND_UP(nbytes * USEC_PER_MSEC, delta_us);
|
||||
+ curr_stats->epms = DIV_ROUND_UP(MLX5E_AM_NEVENTS * USEC_PER_MSEC,
|
||||
+ delta_us);
|
||||
}
|
||||
|
||||
void mlx5e_rx_am_work(struct work_struct *work)
|
||||
-38
@@ -1,38 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Or Gerlitz <ogerlitz@mellanox.com>
|
||||
Date: Thu, 15 Jun 2017 20:08:32 +0300
|
||||
Subject: net/mlx5e: Avoid doing a cleanup call if the profile doesn't have it
|
||||
|
||||
From: Or Gerlitz <ogerlitz@mellanox.com>
|
||||
|
||||
|
||||
[ Upstream commit 31ac93386d135a6c96de9c8bab406f5ccabf5a4d ]
|
||||
|
||||
The error flow of mlx5e_create_netdev calls the cleanup call
|
||||
of the given profile without checking if it exists, fix that.
|
||||
|
||||
Currently the VF reps don't register that callback and we crash
|
||||
if getting into error -- can be reproduced by the user doing ctrl^C
|
||||
while attempting to change the sriov mode from legacy to switchdev.
|
||||
|
||||
Fixes: 26e59d8077a3 '(net/mlx5e: Implement mlx5e interface attach/detach callbacks')
|
||||
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
|
||||
Reported-by: Sabrina Dubroca <sdubroca@redhat.com>
|
||||
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
|
||||
@@ -3846,7 +3846,8 @@ struct net_device *mlx5e_create_netdev(s
|
||||
return netdev;
|
||||
|
||||
err_cleanup_nic:
|
||||
- profile->cleanup(priv);
|
||||
+ if (profile->cleanup)
|
||||
+ profile->cleanup(priv);
|
||||
free_netdev(netdev);
|
||||
|
||||
return NULL;
|
||||
-40
@@ -1,40 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Maor Dickman <maord@mellanox.com>
|
||||
Date: Thu, 18 May 2017 15:15:08 +0300
|
||||
Subject: net/mlx5e: Fix timestamping capabilities reporting
|
||||
|
||||
From: Maor Dickman <maord@mellanox.com>
|
||||
|
||||
|
||||
[ Upstream commit f0b381178b01b831f9907d72f467d6443afdea67 ]
|
||||
|
||||
Misuse of (BIT) macro caused to report wrong flags for
|
||||
"Hardware Transmit Timestamp Modes" and "Hardware Receive
|
||||
Filter Modes"
|
||||
|
||||
Fixes: ef9814deafd0 ('net/mlx5e: Add HW timestamping (TS) support')
|
||||
Signed-off-by: Maor Dickman <maord@mellanox.com>
|
||||
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 8 ++++----
|
||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
|
||||
@@ -1183,11 +1183,11 @@ static int mlx5e_get_ts_info(struct net_
|
||||
SOF_TIMESTAMPING_RX_HARDWARE |
|
||||
SOF_TIMESTAMPING_RAW_HARDWARE;
|
||||
|
||||
- info->tx_types = (BIT(1) << HWTSTAMP_TX_OFF) |
|
||||
- (BIT(1) << HWTSTAMP_TX_ON);
|
||||
+ info->tx_types = BIT(HWTSTAMP_TX_OFF) |
|
||||
+ BIT(HWTSTAMP_TX_ON);
|
||||
|
||||
- info->rx_filters = (BIT(1) << HWTSTAMP_FILTER_NONE) |
|
||||
- (BIT(1) << HWTSTAMP_FILTER_ALL);
|
||||
+ info->rx_filters = BIT(HWTSTAMP_FILTER_NONE) |
|
||||
+ BIT(HWTSTAMP_FILTER_ALL);
|
||||
|
||||
return 0;
|
||||
}
|
||||
-87
@@ -1,87 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Tal Gilboa <talgi@mellanox.com>
|
||||
Date: Mon, 29 May 2017 17:02:55 +0300
|
||||
Subject: net/mlx5e: Fix wrong indications in DIM due to counter wraparound
|
||||
|
||||
From: Tal Gilboa <talgi@mellanox.com>
|
||||
|
||||
|
||||
[ Upstream commit 53acd76ce571e3b71f9205f2d49ab285a9f1aad8 ]
|
||||
|
||||
DIM (Dynamically-tuned Interrupt Moderation) is a mechanism designed for
|
||||
changing the channel interrupt moderation values in order to reduce CPU
|
||||
overhead for all traffic types.
|
||||
Each iteration of the algorithm, DIM calculates the difference in
|
||||
throughput, packet rate and interrupt rate from last iteration in order
|
||||
to make a decision. DIM relies on counters for each metric. When these
|
||||
counters get to their type's max value they wraparound. In this case
|
||||
the delta between 'end' and 'start' samples is negative and when
|
||||
translated to unsigned integers - very high. This results in a false
|
||||
indication to the algorithm and might result in a wrong decision.
|
||||
|
||||
The fix calculates the 'distance' between 'end' and 'start' samples in a
|
||||
cyclic way around the relevant type's max value. It can also be viewed as
|
||||
an absolute value around the type's max value instead of around 0.
|
||||
|
||||
Testing show higher stability in DIM profile selection and no wraparound
|
||||
issues.
|
||||
|
||||
Fixes: cb3c7fd4f839 ("net/mlx5e: Support adaptive RX coalescing")
|
||||
Signed-off-by: Tal Gilboa <talgi@mellanox.com>
|
||||
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/ethernet/mellanox/mlx5/core/en.h | 8 ++++----
|
||||
drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c | 10 +++++++---
|
||||
2 files changed, 11 insertions(+), 7 deletions(-)
|
||||
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
|
||||
@@ -288,10 +288,10 @@ struct mlx5e_rx_am_stats {
|
||||
};
|
||||
|
||||
struct mlx5e_rx_am_sample {
|
||||
- ktime_t time;
|
||||
- unsigned int pkt_ctr;
|
||||
- unsigned int byte_ctr;
|
||||
- u16 event_ctr;
|
||||
+ ktime_t time;
|
||||
+ u32 pkt_ctr;
|
||||
+ u32 byte_ctr;
|
||||
+ u16 event_ctr;
|
||||
};
|
||||
|
||||
struct mlx5e_rx_am { /* Adaptive Moderation */
|
||||
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
|
||||
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
|
||||
@@ -270,6 +270,8 @@ static void mlx5e_am_sample(struct mlx5e
|
||||
}
|
||||
|
||||
#define MLX5E_AM_NEVENTS 64
|
||||
+#define BITS_PER_TYPE(type) (sizeof(type) * BITS_PER_BYTE)
|
||||
+#define BIT_GAP(bits, end, start) ((((end) - (start)) + BIT_ULL(bits)) & (BIT_ULL(bits) - 1))
|
||||
|
||||
static void mlx5e_am_calc_stats(struct mlx5e_rx_am_sample *start,
|
||||
struct mlx5e_rx_am_sample *end,
|
||||
@@ -277,8 +279,9 @@ static void mlx5e_am_calc_stats(struct m
|
||||
{
|
||||
/* u32 holds up to 71 minutes, should be enough */
|
||||
u32 delta_us = ktime_us_delta(end->time, start->time);
|
||||
- unsigned int npkts = end->pkt_ctr - start->pkt_ctr;
|
||||
- unsigned int nbytes = end->byte_ctr - start->byte_ctr;
|
||||
+ u32 npkts = BIT_GAP(BITS_PER_TYPE(u32), end->pkt_ctr, start->pkt_ctr);
|
||||
+ u32 nbytes = BIT_GAP(BITS_PER_TYPE(u32), end->byte_ctr,
|
||||
+ start->byte_ctr);
|
||||
|
||||
if (!delta_us)
|
||||
return;
|
||||
@@ -311,7 +314,8 @@ void mlx5e_rx_am(struct mlx5e_rq *rq)
|
||||
|
||||
switch (am->state) {
|
||||
case MLX5E_AM_MEASURE_IN_PROGRESS:
|
||||
- nevents = rq->cq.event_ctr - am->start_sample.event_ctr;
|
||||
+ nevents = BIT_GAP(BITS_PER_TYPE(u16), rq->cq.event_ctr,
|
||||
+ am->start_sample.event_ctr);
|
||||
if (nevents < MLX5E_AM_NEVENTS)
|
||||
break;
|
||||
mlx5e_am_sample(rq, &end_sample);
|
||||
-44
@@ -1,44 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Jia-Ju Bai <baijiaju1990@163.com>
|
||||
Date: Sat, 10 Jun 2017 17:03:35 +0800
|
||||
Subject: net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse
|
||||
|
||||
From: Jia-Ju Bai <baijiaju1990@163.com>
|
||||
|
||||
|
||||
[ Upstream commit 343eba69c6968190d8654b857aea952fed9a6749 ]
|
||||
|
||||
The kernel may sleep under a rcu read lock in tipc_msg_reverse, and the
|
||||
function call path is:
|
||||
tipc_l2_rcv_msg (acquire the lock by rcu_read_lock)
|
||||
tipc_rcv
|
||||
tipc_sk_rcv
|
||||
tipc_msg_reverse
|
||||
pskb_expand_head(GFP_KERNEL) --> may sleep
|
||||
tipc_node_broadcast
|
||||
tipc_node_xmit_skb
|
||||
tipc_node_xmit
|
||||
tipc_sk_rcv
|
||||
tipc_msg_reverse
|
||||
pskb_expand_head(GFP_KERNEL) --> may sleep
|
||||
|
||||
To fix it, "GFP_KERNEL" is replaced with "GFP_ATOMIC".
|
||||
|
||||
Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/tipc/msg.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
--- a/net/tipc/msg.c
|
||||
+++ b/net/tipc/msg.c
|
||||
@@ -508,7 +508,7 @@ bool tipc_msg_reverse(u32 own_node, str
|
||||
}
|
||||
|
||||
if (skb_cloned(_skb) &&
|
||||
- pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_KERNEL))
|
||||
+ pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))
|
||||
goto exit;
|
||||
|
||||
/* Now reverse the concerned fields */
|
||||
-110
@@ -1,110 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: David Ahern <dsahern@gmail.com>
|
||||
Date: Thu, 8 Jun 2017 11:31:11 -0600
|
||||
Subject: net: vrf: Make add_fib_rules per network namespace flag
|
||||
|
||||
From: David Ahern <dsahern@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit 097d3c9508dc58286344e4a22b300098cf0c1566 ]
|
||||
|
||||
Commit 1aa6c4f6b8cd8 ("net: vrf: Add l3mdev rules on first device create")
|
||||
adds the l3mdev FIB rule the first time a VRF device is created. However,
|
||||
it only creates the rule once and only in the namespace the first device
|
||||
is created - which may not be init_net. Fix by using the net_generic
|
||||
capability to make the add_fib_rules flag per network namespace.
|
||||
|
||||
Fixes: 1aa6c4f6b8cd8 ("net: vrf: Add l3mdev rules on first device create")
|
||||
Reported-by: Petr Machata <petrm@mellanox.com>
|
||||
Signed-off-by: David Ahern <dsahern@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/vrf.c | 36 ++++++++++++++++++++++++++++++++----
|
||||
1 file changed, 32 insertions(+), 4 deletions(-)
|
||||
|
||||
--- a/drivers/net/vrf.c
|
||||
+++ b/drivers/net/vrf.c
|
||||
@@ -36,12 +36,14 @@
|
||||
#include <net/addrconf.h>
|
||||
#include <net/l3mdev.h>
|
||||
#include <net/fib_rules.h>
|
||||
+#include <net/netns/generic.h>
|
||||
|
||||
#define DRV_NAME "vrf"
|
||||
#define DRV_VERSION "1.0"
|
||||
|
||||
#define FIB_RULE_PREF 1000 /* default preference for FIB rules */
|
||||
-static bool add_fib_rules = true;
|
||||
+
|
||||
+static unsigned int vrf_net_id;
|
||||
|
||||
struct net_vrf {
|
||||
struct rtable __rcu *rth;
|
||||
@@ -1237,6 +1239,8 @@ static int vrf_newlink(struct net *src_n
|
||||
struct nlattr *tb[], struct nlattr *data[])
|
||||
{
|
||||
struct net_vrf *vrf = netdev_priv(dev);
|
||||
+ bool *add_fib_rules;
|
||||
+ struct net *net;
|
||||
int err;
|
||||
|
||||
if (!data || !data[IFLA_VRF_TABLE])
|
||||
@@ -1252,13 +1256,15 @@ static int vrf_newlink(struct net *src_n
|
||||
if (err)
|
||||
goto out;
|
||||
|
||||
- if (add_fib_rules) {
|
||||
+ net = dev_net(dev);
|
||||
+ add_fib_rules = net_generic(net, vrf_net_id);
|
||||
+ if (*add_fib_rules) {
|
||||
err = vrf_add_fib_rules(dev);
|
||||
if (err) {
|
||||
unregister_netdevice(dev);
|
||||
goto out;
|
||||
}
|
||||
- add_fib_rules = false;
|
||||
+ *add_fib_rules = false;
|
||||
}
|
||||
|
||||
out:
|
||||
@@ -1341,16 +1347,38 @@ static struct notifier_block vrf_notifie
|
||||
.notifier_call = vrf_device_event,
|
||||
};
|
||||
|
||||
+/* Initialize per network namespace state */
|
||||
+static int __net_init vrf_netns_init(struct net *net)
|
||||
+{
|
||||
+ bool *add_fib_rules = net_generic(net, vrf_net_id);
|
||||
+
|
||||
+ *add_fib_rules = true;
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+static struct pernet_operations vrf_net_ops __net_initdata = {
|
||||
+ .init = vrf_netns_init,
|
||||
+ .id = &vrf_net_id,
|
||||
+ .size = sizeof(bool),
|
||||
+};
|
||||
+
|
||||
static int __init vrf_init_module(void)
|
||||
{
|
||||
int rc;
|
||||
|
||||
register_netdevice_notifier(&vrf_notifier_block);
|
||||
|
||||
- rc = rtnl_link_register(&vrf_link_ops);
|
||||
+ rc = register_pernet_subsys(&vrf_net_ops);
|
||||
if (rc < 0)
|
||||
goto error;
|
||||
|
||||
+ rc = rtnl_link_register(&vrf_link_ops);
|
||||
+ if (rc < 0) {
|
||||
+ unregister_pernet_subsys(&vrf_net_ops);
|
||||
+ goto error;
|
||||
+ }
|
||||
+
|
||||
return 0;
|
||||
|
||||
error:
|
||||
-42
@@ -1,42 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: "Mintz, Yuval" <Yuval.Mintz@cavium.com>
|
||||
Date: Wed, 7 Jun 2017 21:00:33 +0300
|
||||
Subject: net: Zero ifla_vf_info in rtnl_fill_vfinfo()
|
||||
|
||||
From: "Mintz, Yuval" <Yuval.Mintz@cavium.com>
|
||||
|
||||
|
||||
[ Upstream commit 0eed9cf58446b28b233388b7f224cbca268b6986 ]
|
||||
|
||||
Some of the structure's fields are not initialized by the
|
||||
rtnetlink. If driver doesn't set those in ndo_get_vf_config(),
|
||||
they'd leak memory to user.
|
||||
|
||||
Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com>
|
||||
CC: Michal Schmidt <mschmidt@redhat.com>
|
||||
Reviewed-by: Greg Rose <gvrose8192@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/core/rtnetlink.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/net/core/rtnetlink.c
|
||||
+++ b/net/core/rtnetlink.c
|
||||
@@ -1130,6 +1130,8 @@ static noinline_for_stack int rtnl_fill_
|
||||
struct ifla_vf_mac vf_mac;
|
||||
struct ifla_vf_info ivi;
|
||||
|
||||
+ memset(&ivi, 0, sizeof(ivi));
|
||||
+
|
||||
/* Not all SR-IOV capable drivers support the
|
||||
* spoofcheck and "RSS query enable" query. Preset to
|
||||
* -1 so the user space tool can detect that the driver
|
||||
@@ -1138,7 +1140,6 @@ static noinline_for_stack int rtnl_fill_
|
||||
ivi.spoofchk = -1;
|
||||
ivi.rss_query_en = -1;
|
||||
ivi.trusted = -1;
|
||||
- memset(ivi.mac, 0, sizeof(ivi.mac));
|
||||
/* The default value for VF link state is "auto"
|
||||
* IFLA_VF_LINK_STATE_AUTO which equals zero
|
||||
*/
|
||||
-32
@@ -1,32 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Christian Perle <christian.perle@secunet.com>
|
||||
Date: Mon, 12 Jun 2017 10:06:57 +0200
|
||||
Subject: proc: snmp6: Use correct type in memset
|
||||
|
||||
From: Christian Perle <christian.perle@secunet.com>
|
||||
|
||||
|
||||
[ Upstream commit 3500cd73dff48f28f4ba80c171c4c80034d40f76 ]
|
||||
|
||||
Reading /proc/net/snmp6 yields bogus values on 32 bit kernels.
|
||||
Use "u64" instead of "unsigned long" in sizeof().
|
||||
|
||||
Fixes: 4a4857b1c81e ("proc: Reduce cache miss in snmp6_seq_show")
|
||||
Signed-off-by: Christian Perle <christian.perle@secunet.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/ipv6/proc.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
--- a/net/ipv6/proc.c
|
||||
+++ b/net/ipv6/proc.c
|
||||
@@ -219,7 +219,7 @@ static void snmp6_seq_show_item64(struct
|
||||
u64 buff64[SNMP_MIB_MAX];
|
||||
int i;
|
||||
|
||||
- memset(buff64, 0, sizeof(unsigned long) * SNMP_MIB_MAX);
|
||||
+ memset(buff64, 0, sizeof(u64) * SNMP_MIB_MAX);
|
||||
|
||||
snmp_get_cpu_field64_batch(buff64, itemlist, mib, syncpoff);
|
||||
for (i = 0; itemlist[i].name; i++)
|
||||
-42
@@ -1,42 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Serhey Popovych <serhe.popovych@gmail.com>
|
||||
Date: Tue, 20 Jun 2017 14:35:23 +0300
|
||||
Subject: rtnetlink: add IFLA_GROUP to ifla_policy
|
||||
|
||||
From: Serhey Popovych <serhe.popovych@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit db833d40ad3263b2ee3b59a1ba168bb3cfed8137 ]
|
||||
|
||||
Network interface groups support added while ago, however
|
||||
there is no IFLA_GROUP attribute description in policy
|
||||
and netlink message size calculations until now.
|
||||
|
||||
Add IFLA_GROUP attribute to the policy.
|
||||
|
||||
Fixes: cbda10fa97d7 ("net_device: add support for network device groups")
|
||||
Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/core/rtnetlink.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
--- a/net/core/rtnetlink.c
|
||||
+++ b/net/core/rtnetlink.c
|
||||
@@ -937,6 +937,7 @@ static noinline size_t if_nlmsg_size(con
|
||||
+ nla_total_size(1) /* IFLA_LINKMODE */
|
||||
+ nla_total_size(4) /* IFLA_CARRIER_CHANGES */
|
||||
+ nla_total_size(4) /* IFLA_LINK_NETNSID */
|
||||
+ + nla_total_size(4) /* IFLA_GROUP */
|
||||
+ nla_total_size(ext_filter_mask
|
||||
& RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
|
||||
+ rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
|
||||
@@ -1465,6 +1466,7 @@ static const struct nla_policy ifla_poli
|
||||
[IFLA_LINK_NETNSID] = { .type = NLA_S32 },
|
||||
[IFLA_PROTO_DOWN] = { .type = NLA_U8 },
|
||||
[IFLA_XDP] = { .type = NLA_NESTED },
|
||||
+ [IFLA_GROUP] = { .type = NLA_U32 },
|
||||
};
|
||||
|
||||
static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
|
||||
-49
@@ -1,49 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Xin Long <lucien.xin@gmail.com>
|
||||
Date: Sat, 10 Jun 2017 14:48:14 +0800
|
||||
Subject: sctp: disable BH in sctp_for_each_endpoint
|
||||
|
||||
From: Xin Long <lucien.xin@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit 581409dacc9176b0de1f6c4ca8d66e13aa8e1b29 ]
|
||||
|
||||
Now sctp holds read_lock when foreach sctp_ep_hashtable without disabling
|
||||
BH. If CPU schedules to another thread A at this moment, the thread A may
|
||||
be trying to hold the write_lock with disabling BH.
|
||||
|
||||
As BH is disabled and CPU cannot schedule back to the thread holding the
|
||||
read_lock, while the thread A keeps waiting for the read_lock. A dead
|
||||
lock would be triggered by this.
|
||||
|
||||
This patch is to fix this dead lock by calling read_lock_bh instead to
|
||||
disable BH when holding the read_lock in sctp_for_each_endpoint.
|
||||
|
||||
Fixes: 626d16f50f39 ("sctp: export some apis or variables for sctp_diag and reuse some for proc")
|
||||
Reported-by: Xiumei Mu <xmu@redhat.com>
|
||||
Signed-off-by: Xin Long <lucien.xin@gmail.com>
|
||||
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/sctp/socket.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/net/sctp/socket.c
|
||||
+++ b/net/sctp/socket.c
|
||||
@@ -4460,13 +4460,13 @@ int sctp_for_each_endpoint(int (*cb)(str
|
||||
|
||||
for (head = sctp_ep_hashtable; hash < sctp_ep_hashsize;
|
||||
hash++, head++) {
|
||||
- read_lock(&head->lock);
|
||||
+ read_lock_bh(&head->lock);
|
||||
sctp_for_each_hentry(epb, &head->chain) {
|
||||
err = cb(sctp_ep(epb), p);
|
||||
if (err)
|
||||
break;
|
||||
}
|
||||
- read_unlock(&head->lock);
|
||||
+ read_unlock_bh(&head->lock);
|
||||
}
|
||||
|
||||
return err;
|
||||
-46
@@ -1,46 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Xin Long <lucien.xin@gmail.com>
|
||||
Date: Thu, 15 Jun 2017 17:49:08 +0800
|
||||
Subject: sctp: return next obj by passing pos + 1 into sctp_transport_get_idx
|
||||
|
||||
From: Xin Long <lucien.xin@gmail.com>
|
||||
|
||||
|
||||
[ Upstream commit 988c7322116970696211e902b468aefec95b6ec4 ]
|
||||
|
||||
In sctp_for_each_transport, pos is used to save how many objs it has
|
||||
dumped. Now it gets the last obj by sctp_transport_get_idx, then gets
|
||||
the next obj by sctp_transport_get_next.
|
||||
|
||||
The issue is that in the meanwhile if some objs in transport hashtable
|
||||
are removed and the objs nums are less than pos, sctp_transport_get_idx
|
||||
would return NULL and hti.walker.tbl is NULL as well. At this moment
|
||||
it should stop hti, instead of continue getting the next obj. Or it
|
||||
would cause a NULL pointer dereference in sctp_transport_get_next.
|
||||
|
||||
This patch is to pass pos + 1 into sctp_transport_get_idx to get the
|
||||
next obj directly, even if pos > objs nums, it would return NULL and
|
||||
stop hti.
|
||||
|
||||
Fixes: 626d16f50f39 ("sctp: export some apis or variables for sctp_diag and reuse some for proc")
|
||||
Signed-off-by: Xin Long <lucien.xin@gmail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
net/sctp/socket.c | 5 ++---
|
||||
1 file changed, 2 insertions(+), 3 deletions(-)
|
||||
|
||||
--- a/net/sctp/socket.c
|
||||
+++ b/net/sctp/socket.c
|
||||
@@ -4506,9 +4506,8 @@ int sctp_for_each_transport(int (*cb)(st
|
||||
if (err)
|
||||
return err;
|
||||
|
||||
- sctp_transport_get_idx(net, &hti, pos);
|
||||
- obj = sctp_transport_get_next(net, &hti);
|
||||
- for (; obj && !IS_ERR(obj); obj = sctp_transport_get_next(net, &hti)) {
|
||||
+ obj = sctp_transport_get_idx(net, &hti, pos + 1);
|
||||
+ for (; !IS_ERR_OR_NULL(obj); obj = sctp_transport_get_next(net, &hti)) {
|
||||
struct sctp_transport *transport = obj;
|
||||
|
||||
if (!sctp_transport_hold(transport))
|
||||
-50
@@ -1,50 +0,0 @@
|
||||
From foo@baz Thu Jun 29 18:57:46 CEST 2017
|
||||
From: Bert Kenward <bkenward@solarflare.com>
|
||||
Date: Fri, 16 Jun 2017 09:45:08 +0100
|
||||
Subject: sfc: provide dummy definitions of vswitch functions
|
||||
|
||||
From: Bert Kenward <bkenward@solarflare.com>
|
||||
|
||||
|
||||
efx_probe_all() calls efx->type->vswitching_probe during probe. For
|
||||
SFC4000 (Falcon) NICs this function is not defined, leading to a BUG
|
||||
with the top of the call stack similar to:
|
||||
? efx_pci_probe_main+0x29a/0x830
|
||||
efx_pci_probe+0x7d3/0xe70
|
||||
|
||||
vswitching_restore and vswitching_remove also need to be defined.
|
||||
|
||||
Fixed in mainline by:
|
||||
commit 5a6681e22c14 ("sfc: separate out SFC4000 ("Falcon") support into new sfc-falcon driver")
|
||||
|
||||
Fixes: 6d8aaaf6f798 ("sfc: create VEB vswitch and vport above default firmware setup")
|
||||
Signed-off-by: Bert Kenward <bkenward@solarflare.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/net/ethernet/sfc/falcon.c | 10 ++++++++++
|
||||
1 file changed, 10 insertions(+)
|
||||
|
||||
--- a/drivers/net/ethernet/sfc/falcon.c
|
||||
+++ b/drivers/net/ethernet/sfc/falcon.c
|
||||
@@ -2801,6 +2801,11 @@ const struct efx_nic_type falcon_a1_nic_
|
||||
.timer_period_max = 1 << FRF_AB_TC_TIMER_VAL_WIDTH,
|
||||
.offload_features = NETIF_F_IP_CSUM,
|
||||
.mcdi_max_ver = -1,
|
||||
+#ifdef CONFIG_SFC_SRIOV
|
||||
+ .vswitching_probe = efx_port_dummy_op_int,
|
||||
+ .vswitching_restore = efx_port_dummy_op_int,
|
||||
+ .vswitching_remove = efx_port_dummy_op_void,
|
||||
+#endif
|
||||
};
|
||||
|
||||
const struct efx_nic_type falcon_b0_nic_type = {
|
||||
@@ -2902,4 +2907,9 @@ const struct efx_nic_type falcon_b0_nic_
|
||||
.offload_features = NETIF_F_IP_CSUM | NETIF_F_RXHASH | NETIF_F_NTUPLE,
|
||||
.mcdi_max_ver = -1,
|
||||
.max_rx_ip_filters = FR_BZ_RX_FILTER_TBL0_ROWS,
|
||||
+#ifdef CONFIG_SFC_SRIOV
|
||||
+ .vswitching_probe = efx_port_dummy_op_int,
|
||||
+ .vswitching_restore = efx_port_dummy_op_int,
|
||||
+ .vswitching_remove = efx_port_dummy_op_void,
|
||||
+#endif
|
||||
};
|
||||
-84
@@ -1,84 +0,0 @@
|
||||
From dec08194ffeccfa1cf085906b53d301930eae18f Mon Sep 17 00:00:00 2001
|
||||
From: Jiahau Chang <jiahau@gmail.com>
|
||||
Date: Mon, 19 Jun 2017 13:08:30 +0300
|
||||
Subject: xhci: Limit USB2 port wake support for AMD Promontory hosts
|
||||
|
||||
For AMD Promontory xHCI host, although you can disable USB 2.0 ports in
|
||||
BIOS settings, those ports will be enabled anyway after you remove a
|
||||
device on that port and re-plug it in again. It's a known limitation of
|
||||
the chip. As a workaround we can clear the PORT_WAKE_BITS.
|
||||
|
||||
This will disable wake on connect, disconnect and overcurrent on
|
||||
AMD Promontory USB2 ports
|
||||
|
||||
[checkpatch cleanup and commit message reword -Mathias]
|
||||
Cc: <stable@vger.kernel.org>
|
||||
Cc: Tsai Nicholas <nicholas.tsai@amd.com>
|
||||
Signed-off-by: Jiahau Chang <Lars_Chang@asmedia.com.tw>
|
||||
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/usb/host/xhci-hub.c | 3 +++
|
||||
drivers/usb/host/xhci-pci.c | 12 ++++++++++++
|
||||
drivers/usb/host/xhci.h | 1 +
|
||||
3 files changed, 16 insertions(+)
|
||||
|
||||
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
|
||||
index 0dde49c..1adae9e 100644
|
||||
--- a/drivers/usb/host/xhci-hub.c
|
||||
+++ b/drivers/usb/host/xhci-hub.c
|
||||
@@ -1461,6 +1461,9 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
|
||||
t2 |= PORT_WKOC_E | PORT_WKCONN_E;
|
||||
t2 &= ~PORT_WKDISC_E;
|
||||
}
|
||||
+ if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) &&
|
||||
+ (hcd->speed < HCD_USB3))
|
||||
+ t2 &= ~PORT_WAKE_BITS;
|
||||
} else
|
||||
t2 &= ~PORT_WAKE_BITS;
|
||||
|
||||
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
|
||||
index 1bcf971..0965bae 100644
|
||||
--- a/drivers/usb/host/xhci-pci.c
|
||||
+++ b/drivers/usb/host/xhci-pci.c
|
||||
@@ -54,6 +54,11 @@
|
||||
#define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8
|
||||
#define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0
|
||||
|
||||
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9
|
||||
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba
|
||||
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb
|
||||
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc
|
||||
+
|
||||
static const char hcd_name[] = "xhci_hcd";
|
||||
|
||||
static struct hc_driver __read_mostly xhci_pci_hc_driver;
|
||||
@@ -135,6 +140,13 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
|
||||
if (pdev->vendor == PCI_VENDOR_ID_AMD)
|
||||
xhci->quirks |= XHCI_TRUST_TX_LENGTH;
|
||||
|
||||
+ if ((pdev->vendor == PCI_VENDOR_ID_AMD) &&
|
||||
+ ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
|
||||
+ (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) ||
|
||||
+ (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) ||
|
||||
+ (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1)))
|
||||
+ xhci->quirks |= XHCI_U2_DISABLE_WAKE;
|
||||
+
|
||||
if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
|
||||
xhci->quirks |= XHCI_LPM_SUPPORT;
|
||||
xhci->quirks |= XHCI_INTEL_HOST;
|
||||
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
|
||||
index 73a28a9..dcd9649 100644
|
||||
--- a/drivers/usb/host/xhci.h
|
||||
+++ b/drivers/usb/host/xhci.h
|
||||
@@ -1819,6 +1819,7 @@ struct xhci_hcd {
|
||||
/* For controller with a broken Port Disable implementation */
|
||||
#define XHCI_BROKEN_PORT_PED (1 << 25)
|
||||
#define XHCI_LIMIT_ENDPOINT_INTERVAL_7 (1 << 26)
|
||||
+#define XHCI_U2_DISABLE_WAKE (1 << 27)
|
||||
|
||||
unsigned int num_active_eps;
|
||||
unsigned int limit_active_eps;
|
||||
--
|
||||
cgit v1.1
|
||||
|
||||
@@ -18,35 +18,9 @@
|
||||
</BuildDependencies>
|
||||
<Patches>
|
||||
<!-- Linux patches -->
|
||||
<Patch level="1" compressionType="xz">patches/linux/patch-4.9.35.xz</Patch>
|
||||
<!-- Mageia Linux patches // compatible with http://svnweb.mageia.org/packages/cauldron/kernel/releases/4.9.35/1.mga6/PATCHES/patches/series-->
|
||||
<Patch level="1" compressionType="xz">patches/linux/patch-4.9.44.xz</Patch>
|
||||
<!-- Mageia Linux patches // compatible with http://svnweb.mageia.org/packages/cauldron/kernel/releases/4.9.40/1.mga7/PATCHES/patches/series-->
|
||||
<!--stable patches-->
|
||||
<Patch level="1">patches/mageia/stable-ipv6-release-dst-on-error-in-ip6_dst_lookup_tail.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-don-t-call-strlen-on-non-terminated-string-in-dev_set_alias.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-decnet-dn_rtmsg-improve-input-length-sanitization-in-dnrmg_receive_user_skb.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-zero-ifla_vf_info-in-rtnl_fill_vfinfo.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-vrf-make-add_fib_rules-per-network-namespace-flag.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-af_unix-add-sockaddr-length-checks-before-accessing-sa_family-in-bind-and-connect-handlers.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-fix-an-intermittent-pr_emerg-warning-about-lo-becoming-free.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-sctp-disable-bh-in-sctp_for_each_endpoint.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-caif-fix-a-sleep-in-atomic-bug-in-cfpkt_create_pfx.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-tipc-fix-a-sleep-in-atomic-bug-in-tipc_msg_reverse.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-mlx5e-added-bw-check-for-dim-decision-mechanism.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-mlx5e-fix-wrong-indications-in-dim-due-to-counter-wraparound.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-proc-snmp6-use-correct-type-in-memset.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-igmp-acquire-pmc-lock-for-ip_mc_clear_src.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-igmp-add-a-missing-spin_lock_init.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-ipv6-fix-calling-in6_ifa_hold-incorrectly-for-dad-work.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-sctp-return-next-obj-by-passing-pos-1-into-sctp_transport_get_idx.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-mlx5e-avoid-doing-a-cleanup-call-if-the-profile-doesn-t-have-it.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-mlx5-wait-for-fw-readiness-before-initializing-command-interface.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-mlx5e-fix-timestamping-capabilities-reporting.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-decnet-always-not-take-dst-__refcnt-when-inserting-dst-into-hash-table.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-net-8021q-fix-one-possible-panic-caused-by-bug_on-in-free_netdev.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-sfc-provide-dummy-definitions-of-vswitch-functions.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-ipv6-do-not-leak-throw-route-references.patch</Patch>
|
||||
<Patch level="1">patches/mageia/stable-rtnetlink-add-ifla_group-to-ifla_policy.patch</Patch>
|
||||
|
||||
<!--CVE-2016-8405-->
|
||||
<!--other patches-->
|
||||
<Patch level="1">patches/mageia/Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch</Patch>
|
||||
@@ -133,14 +107,17 @@
|
||||
<Patch level="1">patches/mageia/net-wireless-rtlwifi-Use-dev_kfree_skb_irq-instead-of-kfree_skb.patch</Patch>
|
||||
<Patch level="1">patches/mageia/net-wireless-rtlwifi-Fix-kernel-oops-introduced-with-commit-e4965.patch</Patch>
|
||||
<Patch level="1">patches/mageia/net-wireless-realtek-rtl8xxxu-linux-4.11-rc.patch</Patch>
|
||||
<Patch level="1">patches/mageia/net-netfilter-xt_TCPMSS-add-more-sanity-tests-on-tcph-do.patch</Patch>
|
||||
<Patch level="1">patches/mageia/pinctrl_amd-Use-regular-interrupt-instead-of-chained.patch</Patch>
|
||||
<Patch level="1">patches/mageia/platform-x86-add-shuttle-wmi-driver.patch</Patch>
|
||||
<Patch level="1">patches/mageia/platform-x86-shuttle-wmi-drop-devinit-exit.patch</Patch>
|
||||
<Patch level="1">patches/mageia/platform-x86-shuttle-wmi-4.2-buildfix.patch</Patch>
|
||||
<Patch level="1">patches/mageia/platform-x86-asus-nb-wmi-Add-wapf4-quirk-for-the-X30.patch</Patch>
|
||||
<Patch level="1">patches/mageia/include-kbuild-export-pci_ids.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-realtek-Add-new-codec-ID-ALC299.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-realtek-New-codec-support-of-ALC1220.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-realtek-new-id-for-alc1220.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-realtek-Remove-ALC285-device-ID.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-realtek-New-codecs-support-for-ALC215-ALC28.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-A-new-flag-to-enforce-prefix-to-each-pin.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-Allow-to-enable-disable-vmaster-build-expli.patch</Patch>
|
||||
<Patch level="1">patches/mageia/sound-ALSA-hda-Support-Gigabyte-Gaming-board-with-dual-Rea.patch</Patch>
|
||||
@@ -153,7 +130,6 @@
|
||||
<Patch level="1">patches/mageia/hid-usbhid-IBM-BladeCenterHS20-quirk.patch</Patch>
|
||||
<Patch level="1">patches/mageia/usb-storage-unusual_devs-add-id.patch</Patch>
|
||||
<Patch level="1">patches/mageia/usb-storage-unusual_devs-add-id-2.6.37-buildfix.patch</Patch>
|
||||
<Patch level="1">patches/mageia/usb-xhci-Limit-USB2-port-wake-support-for-AMD-Promontory-hosts.patch</Patch>
|
||||
<Patch level="1">patches/mageia/media-usb-pwc-lie-in-proc-usb-devices.patch</Patch>
|
||||
<Patch level="1">patches/mageia/3rd-3rdparty-1.0-tree.patch</Patch>
|
||||
<Patch level="1">patches/mageia/3rd-3rdparty-merge.patch</Patch>
|
||||
@@ -212,6 +188,13 @@
|
||||
</Package>
|
||||
|
||||
<History>
|
||||
<Update release="11">
|
||||
<Date>2017-08-21</Date>
|
||||
<Version>4.9.44</Version>
|
||||
<Comment>Release bump</Comment>
|
||||
<Name>PisiLinux Community</Name>
|
||||
<Email>admin@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="10">
|
||||
<Date>2017-07-04</Date>
|
||||
<Version>4.9.35</Version>
|
||||
|
||||
Reference in New Issue
Block a user