{"push_id":828435521,"size":37,"distinct_size":37,"ref":"refs/heads/4.2-merge","head":"5b38a8d8e4f7f84c471553d22a9d78befe8dcbc8","before":"aa572b51198fc9f404ccb7b298e72b1d773fbe18","commits":[{"sha":"001fc2f5d7ee719cf698eee845bc95d468b16380","author":{"email":"3186038803479a476d7152f26680d7b1b21c12c4@redhat.com","name":"Mark Salter"},"message":"phylib: fix device deletion order in mdiobus_unregister()\n\n[ Upstream commit b6c6aedcbcbacd7b0cb4b64ed5ac835bc1c60a03 ]\n\ncommit 8b63ec1837fa (\"phylib: Make PHYs children of their MDIO bus, not\nthe bus' parent.\") uncovered a problem in mdiobus_unregister() which\nleads to this warning when I reboot an APM Mustang (arm64) platform:\n\n  WARNING: CPU: 7 PID: 4239 at fs/sysfs/group.c:224 sysfs_remove_group+0xa0/0xa4()\n  sysfs group fffffe0000e07a10 not found for kobject 'xgene-mii-eth0:03'\n  ...\n  CPU: 7 PID: 4239 Comm: reboot Tainted: G            E   4.2.0-0.18.el7.test15.aarch64 #1\n  Hardware name: AppliedMicro Mustang/Mustang, BIOS 1.1.0 Aug 26 2015\n  Call Trace:\n  [<fffffe000009739c>] dump_backtrace+0x0/0x170\n  [<fffffe000009752c>] show_stack+0x20/0x2c\n  [<fffffe00007436f0>] dump_stack+0x78/0x9c\n  [<fffffe00000c2cb4>] warn_slowpath_common+0xa0/0xd8\n  [<fffffe00000c2d60>] warn_slowpath_fmt+0x74/0x88\n  [<fffffe0000293d3c>] sysfs_remove_group+0x9c/0xa4\n  [<fffffe00004a8bac>] dpm_sysfs_remove+0x5c/0x70\n  [<fffffe000049b388>] device_del+0x44/0x208\n  [<fffffe000049b578>] device_unregister+0x2c/0x7c\n  [<fffffe000050dc68>] mdiobus_unregister+0x48/0x94\n  [<fffffe000052afd0>] xgene_enet_mdio_remove+0x28/0x44\n  [<fffffe000052d3f0>] xgene_enet_remove+0xd0/0xd8\n  [<fffffe000052d424>] xgene_enet_shutdown+0x2c/0x3c\n  [<fffffe00004a204c>] platform_drv_shutdown+0x24/0x40\n  [<fffffe000049d4f4>] device_shutdown+0xf0/0x1b4\n  [<fffffe00000e31ec>] kernel_restart_prepare+0x40/0x4c\n  [<fffffe00000e32f8>] kernel_restart+0x1c/0x80\n  [<fffffe00000e3670>] SyS_reboot+0x17c/0x250\n\nThe problem is that mdiobus_unregister() deletes the bus device before\nunregistering the phy devices on the bus. This wasn't a problem before\nbecause the phys were not children of the bus:\n\n  /sys/devices/platform/APMC0D05:00/net/eth0/xgene-mii-eth0:03\n  /sys/devices/platform/APMC0D05:00/net/eth0/xgene-mii-eth0\n\nBut now that they are:\n\n  /sys/devices/platform/APMC0D05:00/net/eth0/xgene-mii-eth0/xgene-mii-eth0:03\n\nwhen mdiobus_unregister deletes the bus device, the phy subdirs are\nremoved from sysfs also. So when the phys are unregistered afterward,\nwe get the warning. This patch changes the order so that phys are\nunregistered before the bus device is deleted.\n\nFixes: 8b63ec1837fa (\"phylib: Make PHYs children of their MDIO bus, not the bus' parent.\")\nSigned-off-by: Mark Salter <msalter@redhat.com>\nReviewed-by: Florian Fainelli <f.fainelli@gmail.com>\nTested-by: Mark Langsdorf <mlangsdo@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/001fc2f5d7ee719cf698eee845bc95d468b16380"},{"sha":"4230591d474281936dc03c37d0177f6015aedaea","author":{"email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@iogearbox.net","name":"Daniel Borkmann"},"message":"sock, diag: fix panic in sock_diag_put_filterinfo\n\n[ Upstream commit b382c08656000c12a146723a153b85b13a855b49 ]\n\ndiag socket's sock_diag_put_filterinfo() dumps classic BPF programs\nupon request to user space (ss -0 -b). However, native eBPF programs\nattached to sockets (SO_ATTACH_BPF) cannot be dumped with this method:\n\nTheir orig_prog is always NULL. However, sock_diag_put_filterinfo()\nunconditionally tries to access its filter length resp. wants to copy\nthe filter insns from there. Internal cBPF to eBPF transformations\nattached to sockets don't have this issue, as orig_prog state is kept.\n\nIt's currently only used by packet sockets. If we would want to add\nnative eBPF support in the future, this needs to be done through\na different attribute than PACKET_DIAG_FILTER to not confuse possible\nuser space disassemblers that work on diag data.\n\nFixes: 89aa075832b0 (\"net: sock: allow eBPF programs to be attached to sockets\")\nSigned-off-by: Daniel Borkmann <daniel@iogearbox.net>\nAcked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nAcked-by: Alexei Starovoitov <ast@plumgrid.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/4230591d474281936dc03c37d0177f6015aedaea"},{"sha":"dd35e5b8ad3ddcb3dd13e076ba87e16fd4bd2e99","author":{"email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@iogearbox.net","name":"Daniel Borkmann"},"message":"ipv6: fix exthdrs offload registration in out_rt path\n\n[ Upstream commit e41b0bedba0293b9e1e8d1e8ed553104b9693656 ]\n\nWe previously register IPPROTO_ROUTING offload under inet6_add_offload(),\nbut in error path, we try to unregister it with inet_del_offload(). This\ndoesn't seem correct, it should actually be inet6_del_offload(), also\nipv6_exthdrs_offload_exit() from that commit seems rather incorrect (it\nalso uses rthdr_offload twice), but it got removed entirely later on.\n\nFixes: 3336288a9fea (\"ipv6: Switch to using new offload infrastructure.\")\nSigned-off-by: Daniel Borkmann <daniel@iogearbox.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/dd35e5b8ad3ddcb3dd13e076ba87e16fd4bd2e99"},{"sha":"496e7b36b54f554a314bc218c4f02d51b81a2d81","author":{"email":"f6aa0246ff943bfa8602cdf60d40c481b38ed232@arm.linux.org.uk","name":"Russell King"},"message":"net: fec: clear receive interrupts before processing a packet\n\n[ Upstream commit ed63f1dcd5788d36f942fbcce350742385e3e18c ]\n\nThe patch just to re-submit the patch \"db3421c114cfa6326\" because the\npatch \"4d494cdc92b3b9a0\" remove the change.\n\nClear any pending receive interrupt before we process a pending packet.\nThis helps to avoid any spurious interrupts being raised after we have\nfully cleaned the receive ring, while still allowing an interrupt to be\nraised if we receive another packet.\n\nThe position of this is critical: we must do this prior to reading the\nnext packet status to avoid potentially dropping an interrupt when a\npacket is still pending.\n\nAcked-by: Fugang Duan <B38611@freescale.com>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/496e7b36b54f554a314bc218c4f02d51b81a2d81"},{"sha":"c8bf2008b31f0c522290b32a246e48a551001128","author":{"email":"7f1e149f148542fe38d9e0901a643413f150f183@toshiba-tops.co.jp","name":"Atsushi Nemoto"},"message":"net: eth: altera: fix napi poll_list corruption\n\n[ Upstream commit 4548a697e4969d695047cebd6d9af5e2f6cc728e ]\n\ntse_poll() calls __napi_complete() with irq enabled.  This leads napi\npoll_list corruption and may stop all napi drivers working.\nUse napi_complete() instead of __napi_complete().\n\nSigned-off-by: Atsushi Nemoto <nemoto@toshiba-tops.co.jp>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/c8bf2008b31f0c522290b32a246e48a551001128"},{"sha":"f5f10834321f31c4b08f4f9760e0857cfa90add4","author":{"email":"ae21e0b8c55ca82b564f47d67bb197ebd3d1fcd4@alliedtelesis.co.nz","name":"Richard Laing"},"message":"net/ipv6: Correct PIM6 mrt_lock handling\n\n[ Upstream commit 25b4a44c19c83d98e8c0807a7ede07c1f28eab8b ]\n\nIn the IPv6 multicast routing code the mrt_lock was not being released\ncorrectly in the MFC iterator, as a result adding or deleting a MIF would\ncause a hang because the mrt_lock could not be acquired.\n\nThis fix is a copy of the code for the IPv4 case and ensures that the lock\nis released correctly.\n\nSigned-off-by: Richard Laing <richard.laing@alliedtelesis.co.nz>\nAcked-by: Cong Wang <cwang@twopensource.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/f5f10834321f31c4b08f4f9760e0857cfa90add4"},{"sha":"5548af0c5fc799dd4e165e9755a909e5cb60e4a0","author":{"email":"59190c1867e3222b932a0de3c668eb2d980d69a2@gmail.com","name":"Florian Fainelli"},"message":"net: dsa: bcm_sf2: Fix ageing conditions and operation\n\n[ Upstream commit 39797a279d62972cd914ef580fdfacb13e508bf8 ]\n\nThe comparison check between cur_hw_state and hw_state is currently\ninvalid because cur_hw_state is right shifted by G_MISTP_SHIFT, while\nhw_state is not, so we end-up comparing bits 2:0 with bits 7:5, which is\ngoing to cause an additional aging to occur. Fix this by not shifting\ncur_hw_state while reading it, but instead, mask the value with the\nappropriately shitfted bitmask.\n\nThe other problem with the fast-ageing process is that we did not set\nthe EN_AGE_DYNAMIC bit to request the ageing to occur for dynamically\nlearned MAC addresses. Finally, write back 0 to the FAST_AGE_CTRL\nregister to avoid leaving spurious bits sets from one operation to the\nother.\n\nFixes: 12f460f23423 (\"net: dsa: bcm_sf2: add HW bridging support\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/5548af0c5fc799dd4e165e9755a909e5cb60e4a0"},{"sha":"e60f4a39c2173ad637d5c6541404b7847acac246","author":{"email":"d3f6ba90004ada8c36186a20548ed980b7e493d1@cumulusnetworks.com","name":"Roopa Prabhu"},"message":"ipv6: fix multipath route replace error recovery\n\n[ Upstream commit 6b9ea5a64ed5eeb3f68f2e6fcce0ed1179801d1e ]\n\nProblem:\nThe ecmp route replace support for ipv6 in the kernel, deletes the\nexisting ecmp route too early, ie when it installs the first nexthop.\nIf there is an error in installing the subsequent nexthops, its too late\nto recover the already deleted existing route leaving the fib\nin an inconsistent state.\n\nThis patch reduces the possibility of this by doing the following:\na) Changes the existing multipath route add code to a two stage process:\n  build rt6_infos + insert them\n\tip6_route_add rt6_info creation code is moved into\n\tip6_route_info_create.\nb) This ensures that most errors are caught during building rt6_infos\n  and we fail early\nc) Separates multipath add and del code. Because add needs the special\n  two stage mode in a) and delete essentially does not care.\nd) In any event if the code fails during inserting a route again, a\n  warning is printed (This should be unlikely)\n\nBefore the patch:\n$ip -6 route show\n3000:1000:1000:1000::2 via fe80::202:ff:fe00:b dev swp49s0 metric 1024\n3000:1000:1000:1000::2 via fe80::202:ff:fe00:d dev swp49s1 metric 1024\n3000:1000:1000:1000::2 via fe80::202:ff:fe00:f dev swp49s2 metric 1024\n\n/* Try replacing the route with a duplicate nexthop */\n$ip -6 route change 3000:1000:1000:1000::2/128 nexthop via\nfe80::202:ff:fe00:b dev swp49s0 nexthop via fe80::202:ff:fe00:d dev\nswp49s1 nexthop via fe80::202:ff:fe00:d dev swp49s1\nRTNETLINK answers: File exists\n\n$ip -6 route show\n/* previously added ecmp route 3000:1000:1000:1000::2 dissappears from\n * kernel */\n\nAfter the patch:\n$ip -6 route show\n3000:1000:1000:1000::2 via fe80::202:ff:fe00:b dev swp49s0 metric 1024\n3000:1000:1000:1000::2 via fe80::202:ff:fe00:d dev swp49s1 metric 1024\n3000:1000:1000:1000::2 via fe80::202:ff:fe00:f dev swp49s2 metric 1024\n\n/* Try replacing the route with a duplicate nexthop */\n$ip -6 route change 3000:1000:1000:1000::2/128 nexthop via\nfe80::202:ff:fe00:b dev swp49s0 nexthop via fe80::202:ff:fe00:d dev\nswp49s1 nexthop via fe80::202:ff:fe00:d dev swp49s1\nRTNETLINK answers: File exists\n\n$ip -6 route show\n3000:1000:1000:1000::2 via fe80::202:ff:fe00:b dev swp49s0 metric 1024\n3000:1000:1000:1000::2 via fe80::202:ff:fe00:d dev swp49s1 metric 1024\n3000:1000:1000:1000::2 via fe80::202:ff:fe00:f dev swp49s2 metric 1024\n\nFixes: 27596472473a (\"ipv6: fix ECMP route replacement\")\nSigned-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>\nReviewed-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>\nAcked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/e60f4a39c2173ad637d5c6541404b7847acac246"},{"sha":"12e082bc14a2c95787a79228ab8a1f9300cc8667","author":{"email":"59190c1867e3222b932a0de3c668eb2d980d69a2@gmail.com","name":"Florian Fainelli"},"message":"net: dsa: bcm_sf2: Fix 64-bits register writes\n\n[ Upstream commit 03679a14739a0d4c14b52ba65a69ff553bfba73b ]\n\nThe macro to write 64-bits quantities to the 32-bits register swapped\nthe value and offsets arguments, we want to preserve the ordering of the\narguments with respect to how writel() is implemented for instance:\nvalue first, offset/base second.\n\nFixes: 246d7f773c13 (\"net: dsa: add Broadcom SF2 switch driver\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nReviewed-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/12e082bc14a2c95787a79228ab8a1f9300cc8667"},{"sha":"62f43b58d2b2c4f0200b9ca2b997f4c484f0272f","author":{"email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@iogearbox.net","name":"Daniel Borkmann"},"message":"netlink, mmap: transform mmap skb into full skb on taps\n\n[ Upstream commit 1853c949646005b5959c483becde86608f548f24 ]\n\nKen-ichirou reported that running netlink in mmap mode for receive in\ncombination with nlmon will throw a NULL pointer dereference in\n__kfree_skb() on nlmon_xmit(), in my case I can also trigger an \"unable\nto handle kernel paging request\". The problem is the skb_clone() in\n__netlink_deliver_tap_skb() for skbs that are mmaped.\n\nI.e. the cloned skb doesn't have a destructor, whereas the mmap netlink\nskb has it pointed to netlink_skb_destructor(), set in the handler\nnetlink_ring_setup_skb(). There, skb->head is being set to NULL, so\nthat in such cases, __kfree_skb() doesn't perform a skb_release_data()\nvia skb_release_all(), where skb->head is possibly being freed through\nkfree(head) into slab allocator, although netlink mmap skb->head points\nto the mmap buffer. Similarly, the same has to be done also for large\nnetlink skbs where the data area is vmalloced. Therefore, as discussed,\nmake a copy for these rather rare cases for now. This fixes the issue\non my and Ken-ichirou's test-cases.\n\nReference: http://thread.gmane.org/gmane.linux.network/371129\nFixes: bcbde0d449ed (\"net: netlink: virtual tap device management\")\nReported-by: Ken-ichirou MATSUZAWA <chamaken@gmail.com>\nSigned-off-by: Daniel Borkmann <daniel@iogearbox.net>\nTested-by: Ken-ichirou MATSUZAWA <chamaken@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/62f43b58d2b2c4f0200b9ca2b997f4c484f0272f"},{"sha":"9a04c65c6bcd5fea9e892d338f3d3da8df46c9a1","author":{"email":"7fc7fc98bf391a9b9f95a773bac29e7d60cc65b5@gmail.com","name":"Marcelo Ricardo Leitner"},"message":"sctp: fix race on protocol/netns initialization\n\n[ Upstream commit 8e2d61e0aed2b7c4ecb35844fe07e0b2b762dee4 ]\n\nConsider sctp module is unloaded and is being requested because an user\nis creating a sctp socket.\n\nDuring initialization, sctp will add the new protocol type and then\ninitialize pernet subsys:\n\n        status = sctp_v4_protosw_init();\n        if (status)\n                goto err_protosw_init;\n\n        status = sctp_v6_protosw_init();\n        if (status)\n                goto err_v6_protosw_init;\n\n        status = register_pernet_subsys(&sctp_net_ops);\n\nThe problem is that after those calls to sctp_v{4,6}_protosw_init(), it\nis possible for userspace to create SCTP sockets like if the module is\nalready fully loaded. If that happens, one of the possible effects is\nthat we will have readers for net->sctp.local_addr_list list earlier\nthan expected and sctp_net_init() does not take precautions while\ndealing with that list, leading to a potential panic but not limited to\nthat, as sctp_sock_init() will copy a bunch of blank/partially\ninitialized values from net->sctp.\n\nThe race happens like this:\n\n     CPU 0                           |  CPU 1\n  socket()                           |\n   __sock_create                     | socket()\n    inet_create                      |  __sock_create\n     list_for_each_entry_rcu(        |\n        answer, &inetsw[sock->type], |\n        list) {                      |   inet_create\n      /* no hits */                  |\n     if (unlikely(err)) {            |\n      ...                            |\n      request_module()               |\n      /* socket creation is blocked  |\n       * the module is fully loaded  |\n       */                            |\n       sctp_init                     |\n        sctp_v4_protosw_init         |\n         inet_register_protosw       |\n          list_add_rcu(&p->list,     |\n                       last_perm);   |\n                                     |  list_for_each_entry_rcu(\n                                     |     answer, &inetsw[sock->type],\n        sctp_v6_protosw_init         |     list) {\n                                     |     /* hit, so assumes protocol\n                                     |      * is already loaded\n                                     |      */\n                                     |  /* socket creation continues\n                                     |   * before netns is initialized\n                                     |   */\n        register_pernet_subsys       |\n\nSimply inverting the initialization order between\nregister_pernet_subsys() and sctp_v4_protosw_init() is not possible\nbecause register_pernet_subsys() will create a control sctp socket, so\nthe protocol must be already visible by then. Deferring the socket\ncreation to a work-queue is not good specially because we loose the\nability to handle its errors.\n\nSo, as suggested by Vlad, the fix is to split netns initialization in\ntwo moments: defaults and control socket, so that the defaults are\nalready loaded by when we register the protocol, while control socket\ninitialization is kept at the same moment it is today.\n\nFixes: 4db67e808640 (\"sctp: Make the address lists per network namespace\")\nSigned-off-by: Vlad Yasevich <vyasevich@gmail.com>\nSigned-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/9a04c65c6bcd5fea9e892d338f3d3da8df46c9a1"},{"sha":"c5de8f88c0177f3ac724cd4ad4caa685fee11945","author":{"email":"1dd561f221e05f08425aa0351cbf66864fb4804d@c0d3.blue","name":"Linus Lüssing"},"message":"bridge: fix igmpv3 / mldv2 report parsing\n\n[ Upstream commit c2d4fbd2163e607915cc05798ce7fb7f31117cc1 ]\n\nWith the newly introduced helper functions the skb pulling is hidden in\nthe checksumming function - and undone before returning to the caller.\n\nThe IGMPv3 and MLDv2 report parsing functions in the bridge still\nassumed that the skb is pointing to the beginning of the IGMP/MLD\nmessage while it is now kept at the beginning of the IPv4/6 header,\nbreaking the message parsing and creating packet loss.\n\nFixing this by taking the offset between IP and IGMP/MLD header into\naccount, too.\n\nFixes: 9afd85c9e455 (\"net: Export IGMP/MLD message validation code\")\nReported-by: Tobias Powalowski <tobias.powalowski@googlemail.com>\nTested-by: Tobias Powalowski <tobias.powalowski@googlemail.com>\nSigned-off-by: Linus Lüssing <linus.luessing@c0d3.blue>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/c5de8f88c0177f3ac724cd4ad4caa685fee11945"},{"sha":"abb7a0340081651d037faa2149163f475f2c44ea","author":{"email":"3ab4e30ada880520f74922b979fc5ca34d9375bb@sequanux.org","name":"Simon Guinot"},"message":"net: mvneta: fix DMA buffer unmapping in mvneta_rx()\n\n[ Upstream commit daf158d0d544cec80b7b30deff8cfc59a6e17610 ]\n\nThis patch fixes a regression introduced by the commit a84e32894191\n(\"net: mvneta: fix refilling for Rx DMA buffers\"). Due to this commit\nthe newly allocated Rx buffers are DMA-unmapped in place of those passed\nto the networking stack. Obviously, this causes data corruptions.\n\nThis patch fixes the issue by ensuring that the right Rx buffers are\nDMA-unmapped.\n\nReported-by: Oren Laskin <oren@igneous.io>\nSigned-off-by: Simon Guinot <simon.guinot@sequanux.org>\nFixes: a84e32894191 (\"net: mvneta: fix refilling for Rx DMA buffers\")\nCc: <stable@vger.kernel.org> # v3.8+\nTested-by: Oren Laskin <oren@igneous.io>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/abb7a0340081651d037faa2149163f475f2c44ea"},{"sha":"065b4761929a2315ddcc2f4356a9efbd6d105d0e","author":{"email":"d3f6ba90004ada8c36186a20548ed980b7e493d1@cumulusnetworks.com","name":"Roopa Prabhu"},"message":"rtnetlink: catch -EOPNOTSUPP errors from ndo_bridge_getlink\n\n[ Upstream commit d64f69b0373a7d0bcec8b5da7712977518a8f42b ]\n\nproblem reported:\n\tkernel 4.1.3\n\t------------\n\t# bridge vlan\n\tport\tvlan ids\n\teth0\t 1 PVID Egress Untagged\n\t \t90\n\t \t91\n\t \t92\n\t \t93\n\t \t94\n\t \t95\n\t \t96\n\t \t97\n\t \t98\n\t \t99\n\t \t100\n\n\tvmbr0\t 1 PVID Egress Untagged\n\t \t94\n\n\tkernel 4.2\n\t-----------\n\t# bridge vlan\n\tport\tvlan ids\n\nndo_bridge_getlink can return -EOPNOTSUPP when an interfaces\nndo_bridge_getlink op is set to switchdev_port_bridge_getlink\nand CONFIG_SWITCHDEV is not defined. This today can happen to\nbond, rocker and team devices. This patch adds -EOPNOTSUPP\nchecks after calls to ndo_bridge_getlink.\n\nFixes: 85fdb956726ff2a (\"switchdev: cut over to new switchdev_port_bridge_getlink\")\nReported-by: Alexandre DERUMIER <aderumier@odiso.com>\nSigned-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/065b4761929a2315ddcc2f4356a9efbd6d105d0e"},{"sha":"d192596179a62abe787ed7184fc1cd1d1ec41920","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"net/mlx4_en: really allow to change RSS key\n\n[ Upsteam commit 4671fc6d47e0a0108fe24a4d830347d6a6ef4aa7 ]\n\nWhen changing rss key, we do not want to overwrite user provided key\nby the one provided by netdev_rss_key_fill(), which is the host random\nkey generated at boot time.\n\nFixes: 947cbb0ac242 (\"net/mlx4_en: Support for configurable RSS hash function\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Eyal Perry <eyalpe@mellanox.com>\nCC: Amir Vadai <amirv@mellanox.com>\nAcked-by: Or Gerlitz <ogerlitz@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/d192596179a62abe787ed7184fc1cd1d1ec41920"},{"sha":"3463bb420c2c8ac9ecabc907575ae2297f83f45c","author":{"email":"255103e50249e3d658441816e0597170ebfc16ef@redhat.com","name":"Michael S. Tsirkin"},"message":"macvtap: fix TUNSETSNDBUF values > 64k\n\n[ Upstream commit 3ea79249e81e5ed051f2e6480cbde896d99046e8 ]\n\nUpon TUNSETSNDBUF,  macvtap reads the requested sndbuf size into\na local variable u.\ncommit 39ec7de7092b (\"macvtap: fix uninitialized access on\nTUNSETIFF\") changed its type to u16 (which is the right thing to\ndo for all other macvtap ioctls), breaking all values > 64k.\n\nThe value of TUNSETSNDBUF is actually a signed 32 bit integer, so\nthe right thing to do is to read it into an int.\n\nCc: David S. Miller <davem@davemloft.net>\nFixes: 39ec7de7092b (\"macvtap: fix uninitialized access on TUNSETIFF\")\nReported-by: Mark A. Peloquin\nBisected-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com>\nReported-by: Christian Borntraeger <borntraeger@de.ibm.com>\nSigned-off-by: Michael S. Tsirkin <mst@redhat.com>\nTested-by:  Matthew Rosato <mjrosato@linux.vnet.ibm.com>\nAcked-by: Christian Borntraeger <borntraeger@de.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/3463bb420c2c8ac9ecabc907575ae2297f83f45c"},{"sha":"6e32e731184134db406c428f491a9811cf58252a","author":{"email":"ef65de1c7be0aa837fe7b25ba9a7739905af6a55@gondor.apana.org.au","name":"Herbert Xu"},"message":"netlink: Fix autobind race condition that leads to zero port ID\n\n[ Upstream commit 1f770c0a09da855a2b51af6d19de97fb955eca85 ]\n\nThe commit c0bb07df7d981e4091432754e30c9c720e2c0c78 (\"netlink:\nReset portid after netlink_insert failure\") introduced a race\ncondition where if two threads try to autobind the same socket\none of them may end up with a zero port ID.  This led to kernel\ndeadlocks that were observed by multiple people.\n\nThis patch reverts that commit and instead fixes it by introducing\na separte rhash_portid variable so that the real portid is only set\nafter the socket has been successfully hashed.\n\nFixes: c0bb07df7d98 (\"netlink: Reset portid after netlink_insert failure\")\nReported-by: Tejun Heo <tj@kernel.org>\nReported-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/6e32e731184134db406c428f491a9811cf58252a"},{"sha":"e2a3131de43c6e8072ed618330c49f14d87dba6e","author":{"email":"ef65de1c7be0aa837fe7b25ba9a7739905af6a55@gondor.apana.org.au","name":"Herbert Xu"},"message":"netlink: Replace rhash_portid with bound\n\n[ Upstream commit da314c9923fed553a007785a901fd395b7eb6c19 ]\n\nOn Mon, Sep 21, 2015 at 02:20:22PM -0400, Tejun Heo wrote:\n>\n> store_release and load_acquire are different from the usual memory\n> barriers and can't be paired this way.  You have to pair store_release\n> and load_acquire.  Besides, it isn't a particularly good idea to\n\nOK I've decided to drop the acquire/release helpers as they don't\nhelp us at all and simply pessimises the code by using full memory\nbarriers (on some architectures) where only a write or read barrier\nis needed.\n\n> depend on memory barriers embedded in other data structures like the\n> above.  Here, especially, rhashtable_insert() would have write barrier\n> *before* the entry is hashed not necessarily *after*, which means that\n> in the above case, a socket which appears to have set bound to a\n> reader might not visible when the reader tries to look up the socket\n> on the hashtable.\n\nBut you are right we do need an explicit write barrier here to\nensure that the hashing is visible.\n\n> There's no reason to be overly smart here.  This isn't a crazy hot\n> path, write barriers tend to be very cheap, store_release more so.\n> Please just do smp_store_release() and note what it's paired with.\n\nIt's not about being overly smart.  It's about actually understanding\nwhat's going on with the code.  I've seen too many instances of\npeople simply sprinkling synchronisation primitives around without\nany knowledge of what is happening underneath, which is just a recipe\nfor creating hard-to-debug races.\n\n> > @@ -1539,7 +1546,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,\n> >  \t\t}\n> >  \t}\n> >\n> > -\tif (!nlk->portid) {\n> > +\tif (!nlk->bound) {\n>\n> I don't think you can skip load_acquire here just because this is the\n> second deref of the variable.  That doesn't change anything.  Race\n> condition could still happen between the first and second tests and\n> skipping the second would lead to the same kind of bug.\n\nThe reason this one is OK is because we do not use nlk->portid or\ntry to get nlk from the hash table before we return to user-space.\n\nHowever, there is a real bug here that none of these acquire/release\nhelpers discovered.  The two bound tests here used to be a single\none.  Now that they are separate it is entirely possible for another\nthread to come in the middle and bind the socket.  So we need to\nrepeat the portid check in order to maintain consistency.\n\n> > @@ -1587,7 +1594,7 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,\n> >  \t    !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))\n> >  \t\treturn -EPERM;\n> >\n> > -\tif (!nlk->portid)\n> > +\tif (!nlk->bound)\n>\n> Don't we need load_acquire here too?  Is this path holding a lock\n> which makes that unnecessary?\n\nDitto.\n\n---8<---\nThe commit 1f770c0a09da855a2b51af6d19de97fb955eca85 (\"netlink:\nFix autobind race condition that leads to zero port ID\") created\nsome new races that can occur due to inconcsistencies between the\ntwo port IDs.\n\nTejun is right that a barrier is unavoidable.  Therefore I am\nreverting to the original patch that used a boolean to indicate\nthat a user netlink socket has been bound.\n\nBarriers have been added where necessary to ensure that a valid\nportid and the hashed socket is visible.\n\nI have also changed netlink_insert to only return EBUSY if the\nsocket is bound to a portid different to the requested one.  This\ncombined with only reading nlk->bound once in netlink_bind fixes\na race where two threads that bind the socket at the same time\nwith different port IDs may both succeed.\n\nFixes: 1f770c0a09da (\"netlink: Fix autobind race condition that leads to zero port ID\")\nReported-by: Tejun Heo <tj@kernel.org>\nReported-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nNacked-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/e2a3131de43c6e8072ed618330c49f14d87dba6e"},{"sha":"ccbe6aba49fde168abba5649976da6370453cbf8","author":{"email":"f6aa0246ff943bfa8602cdf60d40c481b38ed232@arm.linux.org.uk","name":"Russell King"},"message":"net: dsa: actually force the speed on the CPU port\n\n[ Upstream commit 53adc9e83028d9e35b6408231ebaf62a94a16e4d ]\n\nCommit 54d792f257c6 (\"net: dsa: Centralise global and port setup\ncode into mv88e6xxx.\") merged in the 4.2 merge window broke the link\nspeed forcing for the CPU port of Marvell DSA switches.  The original\ncode was:\n\n        /* MAC Forcing register: don't force link, speed, duplex\n         * or flow control state to any particular values on physical\n         * ports, but force the CPU port and all DSA ports to 1000 Mb/s\n         * full duplex.\n         */\n        if (dsa_is_cpu_port(ds, p) || ds->dsa_port_mask & (1 << p))\n                REG_WRITE(addr, 0x01, 0x003e);\n        else\n                REG_WRITE(addr, 0x01, 0x0003);\n\nbut the new code does a read-modify-write:\n\n                reg = _mv88e6xxx_reg_read(ds, REG_PORT(port), PORT_PCS_CTRL);\n                if (dsa_is_cpu_port(ds, port) ||\n                    ds->dsa_port_mask & (1 << port)) {\n                        reg |= PORT_PCS_CTRL_FORCE_LINK |\n                                PORT_PCS_CTRL_LINK_UP |\n                                PORT_PCS_CTRL_DUPLEX_FULL |\n                                PORT_PCS_CTRL_FORCE_DUPLEX;\n                        if (mv88e6xxx_6065_family(ds))\n                                reg |= PORT_PCS_CTRL_100;\n                        else\n                                reg |= PORT_PCS_CTRL_1000;\n\nThe link speed in the PCS control register is a two bit field.  Forcing\nthe link speed in this way doesn't ensure that the bit field is set to\nthe correct value - on the hardware I have here, the speed bitfield\nremains set to 0x03, resulting in the speed not being forced to gigabit.\n\nWe must clear both bits before forcing the link speed.\n\nFixes: 54d792f257c6 (\"net: dsa: Centralise global and port setup code into mv88e6xxx.\")\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\nAcked-by: Andrew Lunn <andrew@lunn.ch>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/ccbe6aba49fde168abba5649976da6370453cbf8"},{"sha":"1e0c9d37719e535b948b506638d87125ff266373","author":{"email":"a5c95b3d7cb4d0ae05a15c79c79ab458dc2c8f9e@nicira.com","name":"Jesse Gross"},"message":"openvswitch: Zero flows on allocation.\n\n[ Upstream commit ae5f2fb1d51fa128a460bcfbe3c56d7ab8bf6a43 ]\n\nWhen support for megaflows was introduced, OVS needed to start\ninstalling flows with a mask applied to them. Since masking is an\nexpensive operation, OVS also had an optimization that would only\ntake the parts of the flow keys that were covered by a non-zero\nmask. The values stored in the remaining pieces should not matter\nbecause they are masked out.\n\nWhile this works fine for the purposes of matching (which must always\nlook at the mask), serialization to netlink can be problematic. Since\nthe flow and the mask are serialized separately, the uninitialized\nportions of the flow can be encoded with whatever values happen to be\npresent.\n\nIn terms of functionality, this has little effect since these fields\nwill be masked out by definition. However, it leaks kernel memory to\nuserspace, which is a potential security vulnerability. It is also\npossible that other code paths could look at the masked key and get\nuninitialized data, although this does not currently appear to be an\nissue in practice.\n\nThis removes the mask optimization for flows that are being installed.\nThis was always intended to be the case as the mask optimizations were\nreally targetting per-packet flow operations.\n\nFixes: 03f0d916 (\"openvswitch: Mega flow implementation\")\nSigned-off-by: Jesse Gross <jesse@nicira.com>\nAcked-by: Pravin B Shelar <pshelar@nicira.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/1e0c9d37719e535b948b506638d87125ff266373"}]}