linux.git/include/linux, branch v4.18.8

r8169: add support for NCube 8168 network card

2018-09-15T07:46:41+00:00

[ Upstream commit 9fd0e09a4e86499639653243edfcb417a05c5c46 ]

This card identifies itself as:
  Ethernet controller [0200]: NCube Device [10ff:8168] (rev 06)
  Subsystem: TP-LINK Technologies Co., Ltd. Device [7470:3468]

Adding a new entry to rtl8169_pci_tbl makes the card work.

Link: http://launchpad.net/bugs/1788730
Signed-off-by: Anthony Wong 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

iommu/vt-d: Fix dev iotlb pfsid use

2018-09-09T08:32:39+00:00

commit 1c48db44924298ad0cb5a6386b88017539be8822 upstream.

PFSID should be used in the invalidation descriptor for flushing
device IOTLBs on SRIOV VFs.

Signed-off-by: Jacob Pan 
Cc: stable@vger.kernel.org
Cc: "Ashok Raj" 
Cc: "Lu Baolu" 
Signed-off-by: Joerg Roedel 
Signed-off-by: Greg Kroah-Hartman

iommu/vt-d: Add definitions for PFSID

2018-09-09T08:32:39+00:00

commit 0f725561e168485eff7277d683405c05b192f537 upstream.

When SRIOV VF device IOTLB is invalidated, we need to provide
the PF source ID such that IOMMU hardware can gauge the depth
of invalidation queue which is shared among VFs. This is needed
when device invalidation throttle (DIT) capability is supported.

This patch adds bit definitions for checking and tracking PFSID.

Signed-off-by: Jacob Pan 
Cc: stable@vger.kernel.org
Cc: "Ashok Raj" 
Cc: "Lu Baolu" 
Signed-off-by: Joerg Roedel 
Signed-off-by: Greg Kroah-Hartman

NFSv4 client live hangs after live data migration recovery

2018-09-09T08:32:38+00:00

commit 0f90be132cbf1537d87a6a8b9e80867adac892f6 upstream.

After a live data migration event at the NFS server, the client may send
I/O requests to the wrong server, causing a live hang due to repeated
recovery events.  On the wire, this will appear as an I/O request failing
with NFS4ERR_BADSESSION, followed by successful CREATE_SESSION, repeatedly.
NFS4ERR_BADSSESSION is returned because the session ID being used was
issued by the other server and is not valid at the old server.

The failure is caused by async worker threads having cached the transport
(xprt) in the rpc_task structure.  After the migration recovery completes,
the task is redispatched and the task resends the request to the wrong
server based on the old value still present in tk_xprt.

The solution is to recompute the tk_xprt field of the rpc_task structure
so that the request goes to the correct server.

Signed-off-by: Bill Baker 
Reviewed-by: Chuck Lever 
Tested-by: Helen Chao 
Fixes: fb43d17210ba ("SUNRPC: Use the multipath iterator to assign a ...")
Cc: stable@vger.kernel.org # v4.9+
Signed-off-by: Anna Schumaker 
Signed-off-by: Greg Kroah-Hartman

nfsd: fix leaked file lock with nfs exported overlayfs

2018-09-09T08:32:38+00:00

commit 64bed6cbe38bc95689fb9399872d9ce250192f90 upstream.

nfsd and lockd call vfs_lock_file() to lock/unlock the inode
returned by locks_inode(file).

Many places in nfsd/lockd code use the inode returned by
file_inode(file) for lock manipulation. With Overlayfs, file_inode()
(the underlying inode) is not the same object as locks_inode() (the
overlay inode). This can result in "Leaked POSIX lock" messages
and eventually to a kernel crash as reported by Eddie Horng:
https://marc.info/?l=linux-unionfs&m=153086643202072&w=2

Fix all the call sites in nfsd/lockd that should use locks_inode().
This is a correctness bug that manifested when overlayfs gained
NFS export support in v4.16.

Reported-by: Eddie Horng 
Tested-by: Eddie Horng 
Cc: Jeff Layton 
Fixes: 8383f1748829 ("ovl: wire up NFS export operations")
Cc: stable@vger.kernel.org
Signed-off-by: Amir Goldstein 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Greg Kroah-Hartman

Drivers: hv: vmbus: Reset the channel callback in vmbus_onoffer_rescind()

2018-09-09T08:32:34+00:00

commit d3b26dd7cb0e3433bfd3c1d4dcf74c6039bb49fb upstream.

Before setting channel->rescind in vmbus_rescind_cleanup(), we should make
sure the channel callback won't run any more, otherwise a high-level
driver like pci_hyperv, which may be infinitely waiting for the host VSP's
response and notices the channel has been rescinded, can't safely give
up: e.g., in hv_pci_protocol_negotiation() -> wait_for_response(), it's
unsafe to exit from wait_for_response() and proceed with the on-stack
variable "comp_pkt" popped. The issue was originally spotted by
Michael Kelley .

In vmbus_close_internal(), the patch also minimizes the range protected by
disabling/enabling channel->callback_event: we don't really need that for
the whole function.

Signed-off-by: Dexuan Cui 
Reviewed-by: Michael Kelley 
Cc: stable@vger.kernel.org
Cc: K. Y. Srinivasan 
Cc: Stephen Hemminger 
Cc: Michael Kelley 
Signed-off-by: K. Y. Srinivasan 
Signed-off-by: Greg Kroah-Hartman

overflow.h: Add arithmetic shift helper

2018-09-09T08:32:32+00:00

commit 0c66847793d1982d1083dc6f7adad60fa265ce9c upstream.

Add shift_overflow() helper to assist driver authors in ensuring that
shift operations don't cause overflows or other odd conditions.

Signed-off-by: Jason Gunthorpe 
Signed-off-by: Leon Romanovsky 
[kees: tweaked comments and commit log, dropped unneeded assignment]
Signed-off-by: Kees Cook 
Signed-off-by: Greg Kroah-Hartman

powerpc/64s: Fix page table fragment refcount race vs speculative references

2018-09-09T08:32:30+00:00

commit 4231aba000f5a4583dd9f67057aadb68c3eca99d upstream.

The page table fragment allocator uses the main page refcount racily
with respect to speculative references. A customer observed a BUG due
to page table page refcount underflow in the fragment allocator. This
can be caused by the fragment allocator set_page_count stomping on a
speculative reference, and then the speculative failure handler
decrements the new reference, and the underflow eventually pops when
the page tables are freed.

Fix this by using a dedicated field in the struct page for the page
table fragment allocator.

Fixes: 5c1f6ee9a31c ("powerpc: Reduce PTE table memory wastage")
Cc: stable@vger.kernel.org # v3.10+
Reviewed-by: Aneesh Kumar K.V 
Signed-off-by: Nicholas Piggin 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman

Replace magic for trusting the secondary keyring with #define

2018-09-09T08:32:30+00:00

commit 817aef260037f33ee0f44c17fe341323d3aebd6d upstream.

Replace the use of a magic number that indicates that verify_*_signature()
should use the secondary keyring with a symbol.

Signed-off-by: Yannik Sembritzki 
Signed-off-by: David Howells 
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

blkcg: Introduce blkg_root_lookup()

2018-09-09T08:32:29+00:00

commit 6bad9b210a228d2fe0e0efe26d9b115348529cee upstream.

This new function will be used in a later patch to verify whether a
queue has been dissociated from the cgroup controller before being
released.

Signed-off-by: Bart Van Assche 
Cc: Tejun Heo 
Cc: Christoph Hellwig 
Cc: Ming Lei 
Cc: Omar Sandoval 
Cc: Johannes Thumshirn 
Cc: Alexandru Moise <00moses.alexander00@gmail.com>
Cc: Joseph Qi 
Cc: 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman