scsi: ufs: don't do anything during error recovery during error

Change-Id: Ie43735be58a7afd20a32e88e73b7a11a29db28a3
Signed-off-by: hgchu <hg.chu@samsung.com>

scsi: ufs: add caps info for platform init

Change-Id: I70fccbd21232c6e41fad7841a4c21c951a3b7546
Signed-off-by: hgchu <hg.chu@samsung.com>

scsi: ufs: Add support hibernation control

Change-Id: I40feacabe23011491cfb24119ba4d861dfbd738d
Signed-off-by: hgchu <hg.chu@samsung.com>

scsi: ufs: adjusted UFS power management for exynos specific

Change-Id: I151e77eb1f5f2703e33cd4e9834204a9fa66f88c
Signed-off-by: hgchu <hg.chu@samsung.com>

scsi: ufs: add error check during link setup

Change-Id: I98eafd045b2e75726e77a9907de3bae571d86093
Signed-off-by: hgchu <hg.chu@samsung.com>

scsi: ufs: identify nexus type

Change-Id: I67e722d443fbf576b7f0a5e1f10bcd84fdae71d8
Signed-off-by: hgchu <hg.chu@samsung.com>

scsi: ufs: get deivce descriptor information

Change-Id: Ifcadfbdbc0e954de726d28a7a33a1c8665123e47
Signed-off-by: hgchu <hg.chu@samsung.com>

scsi: ufs: fix to clear the bit of outstanding_tasks

Change-Id: I5f24c3783eca5102b5b3c098cfcd39d75a0f451a
Signed-off-by: hgchu <hg.chu@samsung.com>

scsi: ufs: Add sysfs node for argos

Change-Id: I89c56c18c57923ab80328ea2f2c987c50e9d12c4
Signed-off-by: hgchu <hg.chu@samsung.com>

scsi: ufs: fix error handling sequence

Change-Id: Id7a538dba09e8efe5ea43b9d0fa329717c6e78ea
Signed-off-by: hgchu <hg.chu@samsung.com>

scsi: ufs: amend ufs host for exynos8890 evt1

Change-Id: Ic77815f6364bf42af7b7c51f410fcf6f51e7c980
Signed-off-by: hgchu <hg.chu@samsung.com>

scsi: ufs: add quirks for specific ufshci

Change-Id: I4f69c3f4a465b90b31472ffe838c185298f840c4
Signed-off-by: hgchu <hg.chu@samsung.com>

scsi: ufs: add exynos host controller

Change-Id: I6009c8a9e759f04844eb2597a6a422caca38271c
Signed-off-by: hgchu <hg.chu@samsung.com>

scsi: ufs: add vendor's specific operation

Change-Id: Id53ebff96cbda110ba1d3d37fde66605edec09f7
Signed-off-by: hgchu <hg.chu@samsung.com>

[9610] firmware: add ACPM TMU plugin binary

Change-Id: I8fe6115b908ba7a0cc273cc69ba29979207c5544
Signed-off-by: yi jaeuk <ju.yi@samsung.com>

[9610] firmware: add ACPM FVP plugin binary

Change-Id: I99fd952d35cd61b49cafe01b246a6adb8024e215
Signed-off-by: yi jaeuk <ju.yi@samsung.com>

[COMMON] firmware: Makefile: convert ihex2fw

Change-Id: I1486470ff0718627fdc938a1220523e8d1cf3f19
Signed-off-by: yi jaeuk <ju.yi@samsung.com>

[COMMON] support exynos in-kernel firmware

Change-Id: I7bc8caa1079d60c40e9ab6643b25be1bab4089d0
Signed-off-by: Eunseok Choi <es10.choi@samsung.com>

[HACK][9610] drivers: acpm: set NULL to acpm_mfd_node

Change-Id: I5cd662400604e46fd2868972634d47f639cc48ec
Signed-off-by: yi jaeuk <ju.yi@samsung.com>

[9610] include: chip_id: add exynos9810 chip_id

Change-Id: I8206d813c467fb65f0bc90b53276ff5a74c49fb1
Signed-off-by: yi jaeuk <ju.yi@samsung.com>

[9610] arm64: configs: Enable ACPM

Change-Id: Ib2504642fe9ec1dbe6f544beb7e2b27a506dc4ad
Signed-off-by: yi jaeuk <ju.yi@samsung.com>

[COMMON] include: soc: modify exynos_ss for acpm

Change-Id: I6acd82ca5963b45e9bc349beb1455f0689616a86
Signed-off-by: Naeun Yoo <ne.yoo@samsung.com>

[9610] arm64: dtsi: add ACPM node

Change-Id: I85207444f120a04a9ceff37a39d866f60227d804
Signed-off-by: yi jaeuk <ju.yi@samsung.com>

[COMMON] drivers: soc: add acpm driver to Kconfig, Makefile

Change-Id: I94895563f73b763c5df84534d00396c7f11c0161
Signed-off-by: yi jaeuk <ju.yi@samsung.com>

[9610] drivers: soc: introduce ACPM driver

Change-Id: I74dca6a17cf3d2b1189371d9c9d8c5a52e9bd70b
Signed-off-by: yi jaeuk <ju.yi@samsung.com>

[9610] arm64: dtsi: Corrected clock node.

Change-Id: Ie71e26cd57ffd25f2d6fe4ac0d4bbcf7da02391d
Signed-off-by: Jang JeongHoon <jnghn.jang@samsung.com>

[9610] arm64: erd9610_defconfig: Enabled CONFIG_ECT.

Change-Id: I4f0115ed16c6d62e927a46444cca950dced3439d
Signed-off-by: Jang JeongHoon <jnghn.jang@samsung.com>

[9610] arm64: erd9610_defconfig: Enabled CAL_IF configs.

Change-Id: I92fcc6dfb7d7e87749935d658b7908709aedaafd
Signed-off-by: Jang JeongHoon <jnghn.jang@samsung.com>

[9610] arm64: dts: Added ECT node.

Change-Id: Idc3cdfe7da0df275466536ae73dd46dabfc81930
Signed-off-by: Jang JeongHoon <jnghn.jang@samsung.com>

[9610] arm64: dtsi: Added exynos_pmu node.

Change-Id: I17044200a14ad413e45bfdf48675b8c749125bb9
Signed-off-by: Jang JeongHoon <jnghn.jang@samsung.com>

soc: samsung: ect: modified the CLASS_ATTR macro in kernel4.14

Change-Id: Ia5edfef564b890b0ed777adf9d8a95fcf4fe1b7a
Signed-off-by: Lee Yongjin <yongjin0.lee@samsung.com>

[COMMON] soc: samsung: ect: fixed prevent defects

CID201507, CID201485, CID201471, CID201258, CID201144, CID200802

Change-Id: I7eea257c11b9b90abcb3d985721a309db42d2c01
Signed-off-by: Lee Yongjin <yongjin0.lee@samsung.com>

[COMMON] trace: ess: fixed the complie error by cmu and pmu

Change-Id: I0f7370a0b15d1d0bf36d17562d8f55dbb89e9f71
Signed-off-by: Lee Yongjin <yongjin0.lee@samsung.com>

[COMMON] soc: samsung: Added initial exynos_pmu codes.

Change-Id: I018b1403724225c5da3b9cd6c46824e452b23aa1
Signed-off-by: Jang JeongHoon <jnghn.jang@samsung.com>

[COMMON] soc: samsung: Added initial ect_parser codes.

Change-Id: Id10fb630aae22f9975ae3cd5f722d597c7b5dbf2
Signed-off-by: Jang JeongHoon <jnghn.jang@samsung.com>

[COMMON] clk: samsung: Added initial clock codes.

Change-Id: If68f3fea942f5eb86d7043208c58a216ccdaf96e
Signed-off-by: Jang JeongHoon <jnghn.jang@samsung.com>

[COMMON] soc: samsung: cal-if: Added initial CAL_IF codes.

Change-Id: Ibe84cbd4af5a2d7462db9ecffa2b85d6d0865441
Signed-off-by: Jang JeongHoon <jnghn.jang@samsung.com>

[HACK] disalbe chip-id driver function

Change-Id: I101b88152dd0c3ee0deb91abc4382e5b97d51953
Signed-off-by: Jaehyoung Choi <jkkkkk.choi@samsung.com>

[HACK] Fix uart driver code

Change-Id: I98f599b91ffd2a55a5b75e234a8d01fc938d24cc
Signed-off-by: Jaehyoung Choi <jkkkkk.choi@samsung.com>

[HACK] remove clock setting code

Change-Id: Ib34be34cd4a23277a8cb29dcf9592ec6abfded27
Signed-off-by: Jaehyoung Choi <jkkkkk.choi@samsung.com>

[COMMON] dt-binding: samsung: Add exynos9610 binding header

Change-Id: I4e929e5f320bd5280cc0d202046ac28373b77864
Signed-off-by: Jaehyoung Choi <jkkkkk.choi@samsung.com>

[9610] arm64: dtsi: Enable MP.

Change-Id: Ic7aa24f6606942432ec7da6ff34ce5daefa42465
Signed-off-by: lakkyung.jung <lakkyung.jung@samsung.com>

[9610] arm64: dts: Change name maestro-erd dts

Change-Id: Ice6f679ab908d646cd524418056a905c040ccb43
Signed-off-by: Jaehyoung Choi <jkkkkk.choi@samsung.com>

[9610] clk: samsung: Added exynos9610 clk driver.

Change-Id: I883a7fb07ad763dc593d15fa605786e06c7feea0
Signed-off-by: Jeonghoon Jang <jnghn.jang@samsung.com>

[9610][ERD] arm64: defconfig: create initial erd9610_defconfig

Change-Id: I9312ff832ae185d933f59b7387c8b15db048f0f4
Signed-off-by: Hyunki Koo <hyunki00.koo@samsung.com>

[9610] arm64: dtsi: create initial pinctrl dtsi of exynos9610

Change-Id: Id625b29839962c7cb1efab1da1dfbd3b19189814
Signed-off-by: Hyunki Koo <hyunki00.koo@samsung.com>

[9610][ERD] arm64: dts: create initial exynos9610 MAESTRO-ERD board dts

Change-Id: I5eaffd942d1b0208414c294cbec7a0e9b4c68faa
Signed-off-by: Jaehyoung Choi <jkkkkk.choi@samsung.com>

[9610] arm64: dtsi: create initial dtsi of exynos9610

Change-Id: I729265cf614990adb37c93a81bea28f085277341
Signed-off-by: Hyunki Koo <hyunki00.koo@samsung.com>

[9610] soc: samsung: Add EXYNOS9610 chip-id information

Change-Id: I39715d220ff9bcd9e62c1bb5667168eee08f8cc4
Signed-off-by: Jaehyoung Choi <jkkkkk.choi@samsung.com>

[9610] arm64: Add SOC_EXYNOS9610 in Kconfig.platforms.

Change-Id: I66eb552449e867d4788aa583da7faa7bbc97bc2f
Signed-off-by: Jaehyoung Choi <jkkkkk.choi@samsung.com>

[COMMON] pinctrl: samsung: support debug show

Each pin is possible to show its register value through DEBUG_FS.
This patch supports it like below:

  cat /sys/kernel/debug/pinctrl/10580000.pinctrl/pinconf-pins
  cat /sys/kernel/debug/pinctrl/10580000.pinctrl/pinconf-groups
  cat /sys/kernel/debug/pinctrl/10580000.pinctrl/pins

Change-Id: I99a05520946d7299ff692a1043b5b5390f33dd0f
Signed-off-by: eunki_kim <eunki_kim@samsung.com>

[COMMON] pinctrl: samsung: add pinctrl_force_sleep for sleep state configuration

Change-Id: I608701d120774998ff771d084a0da13b1675ec9d
Signed-off-by: Youngmin Nam <youngmin.nam@samsung.com>
Signed-off-by: Hyunki Koo <hyunki00.koo@samsung.com>

[COMMON] pinctrl: samsung: change FLTCON register setting routine.

The FLTCON register offset of each GPIO block is not regular.
To support irregular FLTCON offset of all GPIO block,
we should use fltcon_offset value in driver data to set FLTCON properly.

And we need to check whether both FLTCON0 and FLTCON1 should be set or not.
When nr_pins(The number of pins in the signle GPIO bank)
is greater than 4(The max number of pins in the single GPIO bank),
The FILTCON1 register also should be set.
When nr_pins is not greater than 4, we don't need to set FLTCON1.

Only alive block(gpa) has the filter selection bit.
So we need to set filter selction bit in case of alive block.
If some GPIO block is not alive, we should not set filter selection bit.

Change-Id: Icadc5f8df49fbf9b983918150e7016f96c40e57c
Signed-off-by: Youngmin Nam <youngmin.nam@samsung.com>
Signed-off-by: Hyunki Koo <hyunki00.koo@samsung.com>

[9610] pinctrl: samsung: add initial definition of pinctrl for exynos9610

Change-Id: Ie628d29ab948bac4a31aa343087115fb174cc87f
Signed-off-by: Jaehyoung Choi <jkkkkk.choi@samsung.com>

[COMMON] pinctrl: samsung : Add eint filter control register offset filed

To support eint filter control setting, we should describe
enit FLTCON register offset in EXYNOS9_PIN_BANK_EINT macro.
With fltcon_offset, we can set FLTCON regiseter of each GPIO block.

Change-Id: I5754fbfba1f7bd89c8218c5329af1c91081fac77
Signed-off-by: Hyunki Koo <hyunki00.koo@samsung.com>

[COMMON] clocksource: exynos_mct: add flags as IRQF_PERCPU

This flags prevents to migrate timer interrupt to other cpu.

Change-Id: Iabc2e3607b51cc879c2eb3ab02ed897d4ae8506f
Signed-off-by: Hosung Kim <hosung0.kim@samsung.com>

[COMMON] clocksource: exynos_mct: change H/W control sequence

This commit changes H/W control sequence of a majority in
exynos_mct codes. Because changed codes are mass-produced already
but mainline code is not so.

Change-Id: I168e289b06eddf4a53df66c8c11a4df52d11fd4d
Signed-off-by: Hosung Kim <hosung0.kim@samsung.com>

[COMMON] clocksource: exynos_mct: use only as clockevent

This commit set exynos_mct to use clockevent only.

Change-Id: Ie1a103f2a3b5b6283a868f542e1ab0337242d26f
Signed-off-by: Hosung Kim <hosung0.kim@samsung.com>

[COMMON] clocksource: arm_arch_timer: clocksource only flag for exynos

This commit adds the specific flag for using clocksource only in exynos.
It is so specific flag for exynos because exynos uses special power
feature for cpu on/off in the short time we called it c2 mode.

In exynos SoC, clocksource is used as arm_arch_timer and clockevent
is used as exynos_mct.

Change-Id: I411ea46d0f8997e3507adc7e60cb8996507e025b
Signed-off-by: Hosung Kim <hosung0.kim@samsung.com>

[COMMON] arm64: adds map.h to arch/arm64/include/asm

This commit adds map.h into "arch/arm64/include/asm".

Change-Id: I687d590065b9c4c93de62d2948b5aa5d01ed89fd
Signed-off-by: Yulgon Kim <yulgon.kim@samsung.com>

[COMMON] trace: ess: adds exynos-snapshot header for exynos soc

This commit adds exynos-snapshoti header into 'include/linux/".

Change-Id: I1588fdf2b306a34545878bf921fd1cd58f057b4e
Signed-off-by: Yulgon Kim <yulgon.kim@samsung.com>

[COMMON] arm64: Add exynos-smc.s and smc.h files

This patch adds 'exynos-smc.s' to 'arch/arm64/kernel' and 'smc.h'
to 'include/linux'.

Change-Id: Ib9d72f6bd840945e70c20e9478100a9770d8a284
Signed-off-by: Yulgon Kim <yulgon.kim@samsung.com>

[COMMON] soc: chipid: Add unique_id for adb

Change-Id: I144b1d2f806f949bb9a4f2a722296c3fbcbe6b99
Signed-off-by: Changki Kim <changki.kim@samsung.com>

[COMMON] soc: samsung: fix to declare platform driver for exynos-chipid

This commit fixes that exynos-chipid declared the platform driver
structure with __initdata section. The platform driver is used always
seaching by kernel platform driver framework.
If it is declared with __initdata, it's region is released by kernel
after booting.

Change-Id: I5776ff20d877a021c42f01d05d4cb2a1a6a24939
Signed-off-by: Hosung Kim <hosung0.kim@samsung.com>

[COMMON] soc: samsung: add exynos chipid driver support

Exynos SoCs have Chipid, for identification of product IDs
and SoC revisions. This patch intendes to provide initialization
code for all these functionalites.

This driver usese existing binding for exnos-chipid.

CC: Grant Likely <grant.likely@linaro.org>
CC: Rob Herring <robh+dt@kernel.org>
CC: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Pankaj Dubey <pankaj.dubey@samsung.com>
Signed-off-by: Hosung Kim <hosung0.kim@samsung.com>
Conflicts:

drivers/soc/Kconfig
drivers/soc/Makefile
drivers/soc/samsung/Kconfig
drivers/soc/samsung/Makefile

Change-Id: I1271233bcbbc2509e0a0fe69b24de8b3a0044418

Merge 4.14.32 into android-4.14

Changes in 4.14.32
tcp: reset sk_send_head in tcp_write_queue_purge
tcp: purge write queue upon aborting the connection
qed: Fix non TCP packets should be dropped on iWARP ll2 connection
sysfs: symlink: export sysfs_create_link_nowarn()
net: phy: relax error checking when creating sysfs link netdev->phydev
devlink: Remove redundant free on error path
macvlan: filter out unsupported feature flags
net: ipv6: keep sk status consistent after datagram connect failure
ipv6: old_dport should be a __be16 in __ip6_datagram_connect()
ipv6: sr: fix NULL pointer dereference when setting encap source address
ipv6: sr: fix scheduling in RCU when creating seg6 lwtunnel state
mlxsw: spectrum_buffers: Set a minimum quota for CPU port traffic
net: phy: Tell caller result of phy_change()
net sched actions: return explicit error when tunnel_key mode is not specified
ppp: avoid loop in xmit recursion detection code
rhashtable: Fix rhlist duplicates insertion
kcm: lock lower socket in kcm_attach
sch_netem: fix skb leak in netem_enqueue()
ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
net: use skb_to_full_sk() in skb_update_prio()
net: Fix hlist corruptions in inet_evict_bucket()
dccp: check sk for closed state in dccp_sendmsg()
ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option()
l2tp: do not accept arbitrary sockets
net: ethernet: arc: Fix a potential memory leak if an optional regulator is deferred
net: ethernet: ti: cpsw: add check for in-band mode setting with RGMII PHY interface
net: fec: Fix unbalanced PM runtime calls
net/iucv: Free memory obtained by kzalloc
netlink: avoid a double skb free in genlmsg_mcast()
net: Only honor ifindex in IP_PKTINFO if non-0
net: systemport: Rewrite __bcm_sysport_tx_reclaim()
qede: Fix qedr link update
skbuff: Fix not waking applications when errors are enqueued
team: Fix double free in error path
soc/fsl/qbman: fix issue in qman_delete_cgr_safe()
dpaa_eth: fix error in dpaa_remove()
dpaa_eth: remove duplicate initialization
dpaa_eth: increment the RX dropped counter when needed
dpaa_eth: remove duplicate increment of the tx_errors counter
s390/qeth: free netdevice when removing a card
s390/qeth: when thread completes, wake up all waiters
s390/qeth: lock read device while queueing next buffer
s390/qeth: on channel error, reject further cmd requests
Linux 4.14.32

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Linux 4.14.32

s390/qeth: on channel error, reject further cmd requests

[ Upstream commit a6c3d93963e4b333c764fde69802c3ea9eaa9d5c ]

When the IRQ handler determines that one of the cmd IO channels has
failed and schedules recovery, block any further cmd requests from
being submitted. The request would inevitably stall, and prevent the
recovery from making progress until the request times out.

This sort of error was observed after Live Guest Relocation, where
the pending IO on the READ channel intentionally gets terminated to
kick-start recovery. Simultaneously the guest executed SIOCETHTOOL,
triggering qeth to issue a QUERY CARD INFO command. The command
then stalled in the inoperabel WRITE channel.

Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

s390/qeth: lock read device while queueing next buffer

[ Upstream commit 17bf8c9b3d499d5168537c98b61eb7a1fcbca6c2 ]

For calling ccw_device_start(), issue_next_read() needs to hold the
device's ccwlock.
This is satisfied for the IRQ handler path (where qeth_irq() gets called
under the ccwlock), but we need explicit locking for the initial call by
the MPC initialization.

Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

s390/qeth: when thread completes, wake up all waiters

[ Upstream commit 1063e432bb45be209427ed3f1ca3908e4aa3c7d7 ]

qeth_wait_for_threads() is potentially called by multiple users, make
sure to notify all of them after qeth_clear_thread_running_bit()
adjusted the thread_running_mask. With no timeout, callers would
otherwise stall.

Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

s390/qeth: free netdevice when removing a card

[ Upstream commit 6be687395b3124f002a653c1a50b3260222b3cd7 ]

On removal, a qeth card's netdevice is currently not properly freed
because the call chain looks as follows:

qeth_core_remove_device(card)
lx_remove_device(card)
unregister_netdev(card->dev)
card->dev = NULL !!!
qeth_core_free_card(card)
if (card->dev) !!!
free_netdev(card->dev)

Fix it by free'ing the netdev straight after unregistering. This also
fixes the sysfs-driven layer switch case (qeth_dev_layer2_store()),
where the need to free the current netdevice was not considered at all.

Note that free_netdev() takes care of the netif_napi_del() for us too.

Fixes: 4a71df50047f ("qeth: new qeth device driver")
Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Reviewed-by: Ursula Braun <ubraun@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dpaa_eth: remove duplicate increment of the tx_errors counter

[ Upstream commit 82d141cd19d088ee41feafde4a6f86eeb40d93c5 ]

The tx_errors counter is incremented by the dpaa_xmit caller.

Signed-off-by: Camelia Groza <camelia.groza@nxp.com>
Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dpaa_eth: increment the RX dropped counter when needed

[ Upstream commit e4d1b37c17d000a3da9368a3e260fb9ea4927c25 ]

Signed-off-by: Camelia Groza <camelia.groza@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dpaa_eth: remove duplicate initialization

[ Upstream commit 565186362b73226a288830abe595f05f0cec0bbc ]

The fd_format has already been initialized at this point.

Signed-off-by: Camelia Groza <camelia.groza@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dpaa_eth: fix error in dpaa_remove()

[ Upstream commit 88075256ee817041d68c2387f29065b5cb2b342a ]

The recent changes that make the driver probing compatible with DSA
were not propagated in the dpa_remove() function, breaking the
module unload function. Using the proper device to address the issue.

Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

soc/fsl/qbman: fix issue in qman_delete_cgr_safe()

[ Upstream commit 96f413f47677366e0ae03797409bfcc4151dbf9e ]

The wait_for_completion() call in qman_delete_cgr_safe()
was triggering a scheduling while atomic bug, replacing the
kthread with a smp_call_function_single() call to fix it.

Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
Signed-off-by: Roy Pledge <roy.pledge@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

team: Fix double free in error path

[ Upstream commit cbcc607e18422555db569b593608aec26111cb0b ]

The __send_and_alloc_skb() receives a skb ptr as a parameter but in
case it fails the skb is not valid:
- Send failed and released the skb internally.
- Allocation failed.

The current code tries to release the skb in case of failure which
causes redundant freeing.

Fixes: 9b00cf2d1024 ("team: implement multipart netlink messages for options transfers")
Signed-off-by: Arkadi Sharshevsky <arkadis@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

skbuff: Fix not waking applications when errors are enqueued

[ Upstream commit 6e5d58fdc9bedd0255a8781b258f10bbdc63e975 ]

When errors are enqueued to the error queue via sock_queue_err_skb()
function, it is possible that the waiting application is not notified.

Calling 'sk->sk_data_ready()' would not notify applications that
selected only POLLERR events in poll() (for example).

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Randy E. Witt <randy.e.witt@intel.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

qede: Fix qedr link update

[ Upstream commit 4609adc27175839408359822523de7247d56c87f ]

Link updates were not reported to qedr correctly.
Leading to cases where a link could be down, but qedr
would see it as up.
In addition, once qede was loaded, link state would be up,
regardless of the actual link state.

Signed-off-by: Michal Kalderon <michal.kalderon@cavium.com>
Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: systemport: Rewrite __bcm_sysport_tx_reclaim()

[ Upstream commit 484d802d0f2f29c335563fcac2a8facf174a1bbc ]

There is no need for complex checking between the last consumed index
and current consumed index, a simple subtraction will do.

This also eliminates the possibility of a permanent transmit queue stall
under the following conditions:

- one CPU bursts ring->size worth of traffic (up to 256 buffers), to the
  point where we run out of free descriptors, so we stop the transmit
  queue at the end of bcm_sysport_xmit()

- because of our locking, we have the transmit process disable
  interrupts which means we can be blocking the TX reclamation process

- when TX reclamation finally runs, we will be computing the difference
  between ring->c_index (last consumed index by SW) and what the HW
  reports through its register

- this register is masked with (ring->size - 1) = 0xff, which will lead
  to stripping the upper bits of the index (register is 16-bits wide)

- we will be computing last_tx_cn as 0, which means there is no work to
  be done, and we never wake-up the transmit queue, leaving it
  permanently disabled

A practical example is e.g: ring->c_index aka last_c_index = 12, we
pushed 256 entries, HW consumer index = 268, we mask it with 0xff = 12,
so last_tx_cn == 0, nothing happens.

Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: Only honor ifindex in IP_PKTINFO if non-0

[ Upstream commit 2cbb4ea7de167b02ffa63e9cdfdb07a7e7094615 ]

Only allow ifindex from IP_PKTINFO to override SO_BINDTODEVICE settings
if the index is actually set in the message.

Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

netlink: avoid a double skb free in genlmsg_mcast()

[ Upstream commit 02a2385f37a7c6594c9d89b64c4a1451276f08eb ]

nlmsg_multicast() consumes always the skb, thus the original skb must be
freed only when this function is called with a clone.

Fixes: cb9f7a9a5c96 ("netlink: ensure to loop over all netns in genlmsg_multicast_allns()")
Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net/iucv: Free memory obtained by kzalloc

[ Upstream commit fa6a91e9b907231d2e38ea5ed89c537b3525df3d ]

Free memory by calling put_device(), if afiucv_iucv_init is not
successful.

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: fec: Fix unbalanced PM runtime calls

[ Upstream commit a069215cf5985f3aa1bba550264907d6bd05c5f7 ]

When unbinding/removing the driver, we will run into the following warnings:

[  259.655198] fec 400d1000.ethernet: 400d1000.ethernet supply phy not found, using dummy regulator
[  259.665065] fec 400d1000.ethernet: Unbalanced pm_runtime_enable!
[  259.672770] fec 400d1000.ethernet (unnamed net_device) (uninitialized): Invalid MAC address: 00:00:00:00:00:00
[  259.683062] fec 400d1000.ethernet (unnamed net_device) (uninitialized): Using random MAC address: f2:3e:93:b7:29:c1
[  259.696239] libphy: fec_enet_mii_bus: probed

Avoid these warnings by balancing the runtime PM calls during fec_drv_remove().

Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ethernet: ti: cpsw: add check for in-band mode setting with RGMII PHY interface

[ Upstream commit f9db50691db4a7d860fce985f080bb3fc23a7ede ]

According to AM335x TRM[1] 14.3.6.2, AM437x TRM[2] 15.3.6.2 and
DRA7 TRM[3] 24.11.4.8.7.3.3, in-band mode in EXT_EN(bit18) register is only
available when PHY is configured in RGMII mode with 10Mbps speed. It will
cause some networking issues without RGMII mode, such as carrier sense
errors and low throughput. TI also mentioned this issue in their forum[4].

This patch adds the check mechanism for PHY interface with RGMII interface
type, the in-band mode can only be set in RGMII mode with 10Mbps speed.

References:
[1]: https://www.ti.com/lit/ug/spruh73p/spruh73p.pdf
[2]: http://www.ti.com/lit/ug/spruhl7h/spruhl7h.pdf
[3]: http://www.ti.com/lit/ug/spruic2b/spruic2b.pdf
[4]: https://e2e.ti.com/support/arm/sitara_arm/f/791/p/640765/2392155

Suggested-by: Holsety Chen (陳憲輝) <Holsety.Chen@moxa.com>
Signed-off-by: SZ Lin (林上智) <sz.lin@moxa.com>
Signed-off-by: Schuyler Patton <spatton@ti.com>
Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ethernet: arc: Fix a potential memory leak if an optional regulator is deferred

[ Upstream commit 00777fac28ba3e126b9e63e789a613e8bd2cab25 ]

If the optional regulator is deferred, we must release some resources.
They will be re-allocated when the probe function will be called again.

Fixes: 6eacf31139bf ("ethernet: arc: Add support for Rockchip SoC layer device tree bindings")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

l2tp: do not accept arbitrary sockets

[ Upstream commit 17cfe79a65f98abe535261856c5aef14f306dff7 ]

syzkaller found an issue caused by lack of sufficient checks
in l2tp_tunnel_create()

RAW sockets can not be considered as UDP ones for instance.

In another patch, we shall replace all pr_err() by less intrusive
pr_debug() so that syzkaller can find other bugs faster.
Acked-by: Guillaume Nault <g.nault@alphalink.fr>
Acked-by: James Chapman <jchapman@katalix.com>
==================================================================
BUG: KASAN: slab-out-of-bounds in setup_udp_tunnel_sock+0x3ee/0x5f0 net/ipv4/udp_tunnel.c:69
dst_release: dst:00000000d53d0d0f refcnt:-1
Write of size 1 at addr ffff8801d013b798 by task syz-executor3/6242

CPU: 1 PID: 6242 Comm: syz-executor3 Not tainted 4.16.0-rc2+ #253
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x24d lib/dump_stack.c:53
 print_address_description+0x73/0x250 mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report+0x23b/0x360 mm/kasan/report.c:412
 __asan_report_store1_noabort+0x17/0x20 mm/kasan/report.c:435
 setup_udp_tunnel_sock+0x3ee/0x5f0 net/ipv4/udp_tunnel.c:69
 l2tp_tunnel_create+0x1354/0x17f0 net/l2tp/l2tp_core.c:1596
 pppol2tp_connect+0x14b1/0x1dd0 net/l2tp/l2tp_ppp.c:707
 SYSC_connect+0x213/0x4a0 net/socket.c:1640
 SyS_connect+0x24/0x30 net/socket.c:1621
 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option()

[ Upstream commit 9f62c15f28b0d1d746734666d88a79f08ba1e43e ]

Fix the following slab-out-of-bounds kasan report in
ndisc_fill_redirect_hdr_option when the incoming ipv6 packet is not
linear and the accessed data are not in the linear data region of orig_skb.

[ 1503.122508] ==================================================================
[ 1503.122832] BUG: KASAN: slab-out-of-bounds in ndisc_send_redirect+0x94e/0x990
[ 1503.123036] Read of size 1184 at addr ffff8800298ab6b0 by task netperf/1932

[ 1503.123220] CPU: 0 PID: 1932 Comm: netperf Not tainted 4.16.0-rc2+ #124
[ 1503.123347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.10.2-2.fc27 04/01/2014
[ 1503.123527] Call Trace:
[ 1503.123579]  <IRQ>
[ 1503.123638]  print_address_description+0x6e/0x280
[ 1503.123849]  kasan_report+0x233/0x350
[ 1503.123946]  memcpy+0x1f/0x50
[ 1503.124037]  ndisc_send_redirect+0x94e/0x990
[ 1503.125150]  ip6_forward+0x1242/0x13b0
[...]
[ 1503.153890] Allocated by task 1932:
[ 1503.153982]  kasan_kmalloc+0x9f/0xd0
[ 1503.154074]  __kmalloc_track_caller+0xb5/0x160
[ 1503.154198]  __kmalloc_reserve.isra.41+0x24/0x70
[ 1503.154324]  __alloc_skb+0x130/0x3e0
[ 1503.154415]  sctp_packet_transmit+0x21a/0x1810
[ 1503.154533]  sctp_outq_flush+0xc14/0x1db0
[ 1503.154624]  sctp_do_sm+0x34e/0x2740
[ 1503.154715]  sctp_primitive_SEND+0x57/0x70
[ 1503.154807]  sctp_sendmsg+0xaa6/0x1b10
[ 1503.154897]  sock_sendmsg+0x68/0x80
[ 1503.154987]  ___sys_sendmsg+0x431/0x4b0
[ 1503.155078]  __sys_sendmsg+0xa4/0x130
[ 1503.155168]  do_syscall_64+0x171/0x3f0
[ 1503.155259]  entry_SYSCALL_64_after_hwframe+0x42/0xb7

[ 1503.155436] Freed by task 1932:
[ 1503.155527]  __kasan_slab_free+0x134/0x180
[ 1503.155618]  kfree+0xbc/0x180
[ 1503.155709]  skb_release_data+0x27f/0x2c0
[ 1503.155800]  consume_skb+0x94/0xe0
[ 1503.155889]  sctp_chunk_put+0x1aa/0x1f0
[ 1503.155979]  sctp_inq_pop+0x2f8/0x6e0
[ 1503.156070]  sctp_assoc_bh_rcv+0x6a/0x230
[ 1503.156164]  sctp_inq_push+0x117/0x150
[ 1503.156255]  sctp_backlog_rcv+0xdf/0x4a0
[ 1503.156346]  __release_sock+0x142/0x250
[ 1503.156436]  release_sock+0x80/0x180
[ 1503.156526]  sctp_sendmsg+0xbb0/0x1b10
[ 1503.156617]  sock_sendmsg+0x68/0x80
[ 1503.156708]  ___sys_sendmsg+0x431/0x4b0
[ 1503.156799]  __sys_sendmsg+0xa4/0x130
[ 1503.156889]  do_syscall_64+0x171/0x3f0
[ 1503.156980]  entry_SYSCALL_64_after_hwframe+0x42/0xb7

[ 1503.157158] The buggy address belongs to the object at ffff8800298ab600
                which belongs to the cache kmalloc-1024 of size 1024
[ 1503.157444] The buggy address is located 176 bytes inside of
                1024-byte region [ffff8800298ab600, ffff8800298aba00)
[ 1503.157702] The buggy address belongs to the page:
[ 1503.157820] page:ffffea0000a62a00 count:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0
[ 1503.158053] flags: 0x4000000000008100(slab|head)
[ 1503.158171] raw: 4000000000008100 0000000000000000 0000000000000000 00000001800e000e
[ 1503.158350] raw: dead000000000100 dead000000000200 ffff880036002600 0000000000000000
[ 1503.158523] page dumped because: kasan: bad access detected

[ 1503.158698] Memory state around the buggy address:
[ 1503.158816]  ffff8800298ab900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1503.158988]  ffff8800298ab980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1503.159165] >ffff8800298aba00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1503.159338]                    ^
[ 1503.159436]  ffff8800298aba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1503.159610]  ffff8800298abb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1503.159785] ==================================================================
[ 1503.159964] Disabling lock debugging due to kernel taint

The test scenario to trigger the issue consists of 4 devices:
- H0: data sender, connected to LAN0
- H1: data receiver, connected to LAN1
- GW0 and GW1: routers between LAN0 and LAN1. Both of them have an
  ethernet connection on LAN0 and LAN1
On H{0,1} set GW0 as default gateway while on GW0 set GW1 as next hop for
data from LAN0 to LAN1.
Moreover create an ip6ip6 tunnel between H0 and H1 and send 3 concurrent
data streams (TCP/UDP/SCTP) from H0 to H1 through ip6ip6 tunnel (send
buffer size is set to 16K). While data streams are active flush the route
cache on HA multiple times.
I have not been able to identify a given commit that introduced the issue
since, using the reproducer described above, the kasan report has been
triggered from 4.14 and I have not gone back further.

Reported-by: Jianlin Shi <jishi@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dccp: check sk for closed state in dccp_sendmsg()

[ Upstream commit 67f93df79aeefc3add4e4b31a752600f834236e2 ]

dccp_disconnect() sets 'dp->dccps_hc_tx_ccid' tx handler to NULL,
therefore if DCCP socket is disconnected and dccp_sendmsg() is
called after it, it will cause a NULL pointer dereference in
dccp_write_xmit().

This crash and the reproducer was reported by syzbot. Looks like
it is reproduced if commit 69c64866ce07 ("dccp: CVE-2017-8824:
use-after-free in DCCP code") is applied.

Reported-by: syzbot+f99ab3887ab65d70f816@syzkaller.appspotmail.com
Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: Fix hlist corruptions in inet_evict_bucket()

[ Upstream commit a560002437d3646dafccecb1bf32d1685112ddda ]

inet_evict_bucket() iterates global list, and
several tasks may call it in parallel. All of
them hash the same fq->list_evictor to different
lists, which leads to list corruption.

This patch makes fq be hashed to expired list
only if this has not been made yet by another
task. Since inet_frag_alloc() allocates fq
using kmem_cache_zalloc(), we may rely on
list_evictor is initially unhashed.

The problem seems to exist before async
pernet_operations, as there was possible to have
exit method to be executed in parallel with
inet_frags::frags_work, so I add two Fixes tags.
This also may go to stable.

Fixes: d1fe19444d82 "inet: frag: don't re-use chainlist for evictor"
Fixes: f84c6821aa54 "net: Convert pernet_subsys, registered from inet_init()"
Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: use skb_to_full_sk() in skb_update_prio()

[ Upstream commit 4dcb31d4649df36297296b819437709f5407059c ]

Andrei Vagin reported a KASAN: slab-out-of-bounds error in
skb_update_prio()

Since SYNACK might be attached to a request socket, we need to
get back to the listener socket.
Since this listener is manipulated without locks, add const
qualifiers to sock_cgroup_prioidx() so that the const can also
be used in skb_update_prio()

Also add the const qualifier to sock_cgroup_classid() for consistency.

Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead of listener")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrei Vagin <avagin@virtuozzo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()

[ Upstream commit ca0edb131bdf1e6beaeb2b8289fd6b374b74147d ]

A tun device type can trivially be set to arbitrary value using
TUNSETLINK ioctl().

Therefore, lowpan_device_event() must really check that ieee802154_ptr
is not NULL.

Fixes: 2c88b5283f60d ("ieee802154: 6lowpan: remove check on null")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Alexander Aring <alex.aring@gmail.com>
Cc: Stefan Schmidt <stefan@osg.samsung.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Stefan Schmidt <stefan@osg.samsung.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

sch_netem: fix skb leak in netem_enqueue()

[ Upstream commit 35d889d10b649fda66121891ec05eca88150059d ]

When we exceed current packets limit and we have more than one
segment in the list returned by skb_gso_segment(), netem drops
only the first one, skipping the rest, hence kmemleak reports:

unreferenced object 0xffff880b5d23b600 (size 1024):
  comm "softirq", pid 0, jiffies 4384527763 (age 2770.629s)
  hex dump (first 32 bytes):
    00 80 23 5d 0b 88 ff ff 00 00 00 00 00 00 00 00  ..#]............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000d8a19b9d>] __alloc_skb+0xc9/0x520
    [<000000001709b32f>] skb_segment+0x8c8/0x3710
    [<00000000c7b9bb88>] tcp_gso_segment+0x331/0x1830
    [<00000000c921cba1>] inet_gso_segment+0x476/0x1370
    [<000000008b762dd4>] skb_mac_gso_segment+0x1f9/0x510
    [<000000002182660a>] __skb_gso_segment+0x1dd/0x620
    [<00000000412651b9>] netem_enqueue+0x1536/0x2590 [sch_netem]
    [<0000000005d3b2a9>] __dev_queue_xmit+0x1167/0x2120
    [<00000000fc5f7327>] ip_finish_output2+0x998/0xf00
    [<00000000d309e9d3>] ip_output+0x1aa/0x2c0
    [<000000007ecbd3a4>] tcp_transmit_skb+0x18db/0x3670
    [<0000000042d2a45f>] tcp_write_xmit+0x4d4/0x58c0
    [<0000000056a44199>] tcp_tasklet_func+0x3d9/0x540
    [<0000000013d06d02>] tasklet_action+0x1ca/0x250
    [<00000000fcde0b8b>] __do_softirq+0x1b4/0x5a3
    [<00000000e7ed027c>] irq_exit+0x1e2/0x210

Fix it by adding the rest of the segments, if any, to skb 'to_free'
list. Add new __qdisc_drop_all() and qdisc_drop_all() functions
because they can be useful in the future if we need to drop segmented
GSO packets in other places.

Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

kcm: lock lower socket in kcm_attach

[ Upstream commit 2cc683e88c0c993ac3721d9b702cb0630abe2879 ]

Need to lock lower socket in order to provide mutual exclusion
with kcm_unattach.

v2: Add Reported-by for syzbot

Fixes: ab7ac4eb9832e32a09f4e804 ("kcm: Kernel Connection Multiplexor module")
Reported-by: syzbot+ea75c0ffcd353d32515f064aaebefc5279e6161e@syzkaller.appspotmail.com
Signed-off-by: Tom Herbert <tom@quantonium.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

rhashtable: Fix rhlist duplicates insertion

[ Upstream commit d3dcf8eb615537526bd42ff27a081d46d337816e ]

When inserting duplicate objects (those with the same key),
current rhlist implementation messes up the chain pointers by
updating the bucket pointer instead of prev next pointer to the
newly inserted node. This causes missing elements on removal and
travesal.

Fix that by properly updating pprev pointer to point to
the correct rhash_head next pointer.

Issue: 1241076
Change-Id: I86b2c140bcb4aeb10b70a72a267ff590bb2b17e7
Fixes: ca26893f05e8 ('rhashtable: Add rhlist interface')
Signed-off-by: Paul Blakey <paulb@mellanox.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ppp: avoid loop in xmit recursion detection code

[ Upstream commit 6d066734e9f09cdea4a3b9cb76136db3f29cfb02 ]

We already detect situations where a PPP channel sends packets back to
its upper PPP device. While this is enough to avoid deadlocking on xmit
locks, this doesn't prevent packets from looping between the channel
and the unit.

The problem is that ppp_start_xmit() enqueues packets in ppp->file.xq
before checking for xmit recursion. Therefore, __ppp_xmit_process()
might dequeue a packet from ppp->file.xq and send it on the channel
which, in turn, loops it back on the unit. Then ppp_start_xmit()
queues the packet back to ppp->file.xq and __ppp_xmit_process() picks
it up and sends it again through the channel. Therefore, the packet
will loop between __ppp_xmit_process() and ppp_start_xmit() until some
other part of the xmit path drops it.

For L2TP, we rapidly fill the skb's headroom and pppol2tp_xmit() drops
the packet after a few iterations. But PPTP reallocates the headroom
if necessary, letting the loop run and exhaust the machine resources
(as reported in https://bugzilla.kernel.org/show_bug.cgi?id=199109).

Fix this by letting __ppp_xmit_process() enqueue the skb to
ppp->file.xq, so that we can check for recursion before adding it to
the queue. Now ppp_xmit_process() can drop the packet when recursion is
detected.

__ppp_channel_push() is a bit special. It calls __ppp_xmit_process()
without having any actual packet to send. This is used by
ppp_output_wakeup() to re-enable transmission on the parent unit (for
implementations like ppp_async.c, where the .start_xmit() function
might not consume the skb, leaving it in ppp->xmit_pending and
disabling transmission).
Therefore, __ppp_xmit_process() needs to handle the case where skb is
NULL, dequeuing as many packets as possible from ppp->file.xq.

Reported-by: xu heng <xuheng333@zoho.com>
Fixes: 55454a565836 ("ppp: avoid dealock on recursive xmit")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net sched actions: return explicit error when tunnel_key mode is not specified

[ Upstream commit 51d4740f88affd85d49c04e3c9cd129c0e33bcb9 ]

If set/unset mode of the tunnel_key action is not provided, ->init() still
returns 0, and the caller proceeds with bogus 'struct tc_action *' object,
this results in crash:

% tc actions add action tunnel_key src_ip 1.1.1.1 dst_ip 2.2.2.1 id 7 index 1

[   35.805515] general protection fault: 0000 [#1] SMP PTI
[   35.806161] Modules linked in: act_tunnel_key kvm_intel kvm irqbypass
crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64
crypto_simd glue_helper cryptd serio_raw
[   35.808233] CPU: 1 PID: 428 Comm: tc Not tainted 4.16.0-rc4+ #286
[   35.808929] RIP: 0010:tcf_action_init+0x90/0x190
[   35.809457] RSP: 0018:ffffb8edc068b9a0 EFLAGS: 00010206
[   35.810053] RAX: 1320c000000a0003 RBX: 0000000000000001 RCX: 0000000000000000
[   35.810866] RDX: 0000000000000070 RSI: 0000000000007965 RDI: ffffb8edc068b910
[   35.811660] RBP: ffffb8edc068b9d0 R08: 0000000000000000 R09: ffffb8edc068b808
[   35.812463] R10: ffffffffc02bf040 R11: 0000000000000040 R12: ffffb8edc068bb38
[   35.813235] R13: 0000000000000000 R14: 0000000000000000 R15: ffffb8edc068b910
[   35.814006] FS:  00007f3d0d8556c0(0000) GS:ffff91d1dbc40000(0000)
knlGS:0000000000000000
[   35.814881] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   35.815540] CR2: 000000000043f720 CR3: 0000000019248001 CR4: 00000000001606a0
[   35.816457] Call Trace:
[   35.817158]  tc_ctl_action+0x11a/0x220
[   35.817795]  rtnetlink_rcv_msg+0x23d/0x2e0
[   35.818457]  ? __slab_alloc+0x1c/0x30
[   35.819079]  ? __kmalloc_node_track_caller+0xb1/0x2b0
[   35.819544]  ? rtnl_calcit.isra.30+0xe0/0xe0
[   35.820231]  netlink_rcv_skb+0xce/0x100
[   35.820744]  netlink_unicast+0x164/0x220
[   35.821500]  netlink_sendmsg+0x293/0x370
[   35.822040]  sock_sendmsg+0x30/0x40
[   35.822508]  ___sys_sendmsg+0x2c5/0x2e0
[   35.823149]  ? pagecache_get_page+0x27/0x220
[   35.823714]  ? filemap_fault+0xa2/0x640
[   35.824423]  ? page_add_file_rmap+0x108/0x200
[   35.825065]  ? alloc_set_pte+0x2aa/0x530
[   35.825585]  ? finish_fault+0x4e/0x70
[   35.826140]  ? __handle_mm_fault+0xbc1/0x10d0
[   35.826723]  ? __sys_sendmsg+0x41/0x70
[   35.827230]  __sys_sendmsg+0x41/0x70
[   35.827710]  do_syscall_64+0x68/0x120
[   35.828195]  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
[   35.828859] RIP: 0033:0x7f3d0ca4da67
[   35.829331] RSP: 002b:00007ffc9f284338 EFLAGS: 00000246 ORIG_RAX:
000000000000002e
[   35.830304] RAX: ffffffffffffffda RBX: 00007ffc9f284460 RCX: 00007f3d0ca4da67
[   35.831247] RDX: 0000000000000000 RSI: 00007ffc9f2843b0 RDI: 0000000000000003
[   35.832167] RBP: 000000005aa6a7a9 R08: 0000000000000001 R09: 0000000000000000
[   35.833075] R10: 00000000000005f1 R11: 0000000000000246 R12: 0000000000000000
[   35.833997] R13: 00007ffc9f2884c0 R14: 0000000000000001 R15: 0000000000674640
[   35.834923] Code: 24 30 bb 01 00 00 00 45 31 f6 eb 5e 8b 50 08 83 c2 07 83 e2
fc 83 c2 70 49 8b 07 48 8b 40 70 48 85 c0 74 10 48 89 14 24 4c 89 ff <ff> d0 48
8b 14 24 48 01 c2 49 01 d6 45 85 ed 74 05 41 83 47 2c
[   35.837442] RIP: tcf_action_init+0x90/0x190 RSP: ffffb8edc068b9a0
[   35.838291] ---[ end trace a095c06ee4b97a26 ]---

Fixes: d0f6dd8a914f ("net/sched: Introduce act_tunnel_key")
Signed-off-by: Roman Mashak <mrv@mojatatu.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: phy: Tell caller result of phy_change()

[ Upstream commit a2c054a896b8ac794ddcfc7c92e2dc7ec4ed4ed5 ]

In 664fcf123a30e (net: phy: Threaded interrupts allow some simplification)
the phy_interrupt system was changed to use a traditional threaded
interrupt scheme instead of a workqueue approach.

With this change, the phy status check moved into phy_change, which
did not report back to the caller whether or not the interrupt was
handled. This means that, in the case of a shared phy interrupt,
only the first phydev's interrupt registers are checked (since
phy_interrupt() would always return IRQ_HANDLED). This leads to
interrupt storms when it is a secondary device that's actually the
interrupt source.

Signed-off-by: Brad Mouring <brad.mouring@ni.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mlxsw: spectrum_buffers: Set a minimum quota for CPU port traffic

[ Upstream commit bcdd5de80a2275f7879dc278bfc747f1caf94442 ]

In commit 9ffcc3725f09 ("mlxsw: spectrum: Allow packets to be trapped
from any PG") I fixed a problem where packets could not be trapped to
the CPU due to exceeded shared buffer quotas. The mentioned commit
explains the problem in detail.

The problem was fixed by assigning a minimum quota for the CPU port and
the traffic class used for scheduling traffic to the CPU.

However, commit 117b0dad2d54 ("mlxsw: Create a different trap group list
for each device") assigned different traffic classes to different
packet types and rendered the fix useless.

Fix the problem by assigning a minimum quota for the CPU port and all
the traffic classes that are currently in use.

Fixes: 117b0dad2d54 ("mlxsw: Create a different trap group list for each device")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reported-by: Eddie Shklaer <eddies@mellanox.com>
Tested-by: Eddie Shklaer <eddies@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ipv6: sr: fix scheduling in RCU when creating seg6 lwtunnel state

[ Upstream commit 191f86ca8ef27f7a492fd1c03620498c6e94f0ac ]

The seg6_build_state() function is called with RCU read lock held,
so we cannot use GFP_KERNEL. This patch uses GFP_ATOMIC instead.

[   92.770271] =============================
[   92.770628] WARNING: suspicious RCU usage
[   92.770921] 4.16.0-rc4+ #12 Not tainted
[   92.771277] -----------------------------
[   92.771585] ./include/linux/rcupdate.h:302 Illegal context switch in RCU read-side critical section!
[   92.772279]
[   92.772279] other info that might help us debug this:
[   92.772279]
[   92.773067]
[   92.773067] rcu_scheduler_active = 2, debug_locks = 1
[   92.773514] 2 locks held by ip/2413:
[   92.773765]  #0:  (rtnl_mutex){+.+.}, at: [<00000000e5461720>] rtnetlink_rcv_msg+0x441/0x4d0
[   92.774377]  #1:  (rcu_read_lock){....}, at: [<00000000df4f161e>] lwtunnel_build_state+0x59/0x210
[   92.775065]
[   92.775065] stack backtrace:
[   92.775371] CPU: 0 PID: 2413 Comm: ip Not tainted 4.16.0-rc4+ #12
[   92.775791] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc27 04/01/2014
[   92.776608] Call Trace:
[   92.776852]  dump_stack+0x7d/0xbc
[   92.777130]  __schedule+0x133/0xf00
[   92.777393]  ? unwind_get_return_address_ptr+0x50/0x50
[   92.777783]  ? __sched_text_start+0x8/0x8
[   92.778073]  ? rcu_is_watching+0x19/0x30
[   92.778383]  ? kernel_text_address+0x49/0x60
[   92.778800]  ? __kernel_text_address+0x9/0x30
[   92.779241]  ? unwind_get_return_address+0x29/0x40
[   92.779727]  ? pcpu_alloc+0x102/0x8f0
[   92.780101]  _cond_resched+0x23/0x50
[   92.780459]  __mutex_lock+0xbd/0xad0
[   92.780818]  ? pcpu_alloc+0x102/0x8f0
[   92.781194]  ? seg6_build_state+0x11d/0x240
[   92.781611]  ? save_stack+0x9b/0xb0
[   92.781965]  ? __ww_mutex_wakeup_for_backoff+0xf0/0xf0
[   92.782480]  ? seg6_build_state+0x11d/0x240
[   92.782925]  ? lwtunnel_build_state+0x1bd/0x210
[   92.783393]  ? ip6_route_info_create+0x687/0x1640
[   92.783846]  ? ip6_route_add+0x74/0x110
[   92.784236]  ? inet6_rtm_newroute+0x8a/0xd0

Fixes: 6c8702c60b886 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
Signed-off-by: David Lebrun <dlebrun@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>