diff --git a/blacklist.conf b/blacklist.conf index f41775f..6bd1cec 100644 --- a/blacklist.conf +++ b/blacklist.conf @@ -19,6 +19,7 @@ # Blacklisted Paths # ----------------- +MAINTAINERS # We don't care about upstream MAINTAINERS file arch/alpha arch/arc arch/arm/boot/dts # we don't ship device tree @@ -929,3 +930,4 @@ f1782c9bc547754f4bd3043fe8cfda53db85f13f # User visible changes and lots of fixu c54c7374ff44de5e609506aca7c0deae4703b6d1 # drm/dp_mst: reverted in the below 9765635b30756eb74e05e260ac812659c296cd28 # drm/dp_mst: reverting 8960de4a5ca7980ed1e19e7ca5a774d3b7a55c38 # client part, likely not needed for SLE +d48051c5b8376038c2b287c3b1bd55b8d391d567 # fixes bug only in 4.18 and later diff --git a/patches.drivers/net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch b/patches.drivers/net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch new file mode 100644 index 0000000..38697eb --- /dev/null +++ b/patches.drivers/net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch @@ -0,0 +1,41 @@ +From 986103e7920cabc0b910749e77ae5589d3934d52 Mon Sep 17 00:00:00 2001 +From: Thomas Falcon +Date: Fri, 30 Nov 2018 10:59:08 -0600 +Subject: [PATCH] net/ibmvnic: Fix RTNL deadlock during device reset + +References: bnc#1115431 +Patch-mainline: queued +Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git +Git-commit: 986103e7920cabc0b910749e77ae5589d3934d52 + +Commit a5681e20b541 ("net/ibmnvic: Fix deadlock problem +in reset") made the change to hold the RTNL lock during +driver reset but still calls netdev_notify_peers, which +results in a deadlock. Instead, use call_netdevice_notifiers, +which is functionally the same except that it does not +take the RTNL lock again. + +Fixes: a5681e20b541 ("net/ibmnvic: Fix deadlock problem in reset") +Signed-off-by: Thomas Falcon +Signed-off-by: David S. Miller +Acked-by: Michal Suchanek +--- + drivers/net/ethernet/ibm/ibmvnic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index c0203a0d5e3b..ed50b8dee44f 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1859,7 +1859,7 @@ static int do_reset(struct ibmvnic_adapter *adapter, + + if (adapter->reset_reason != VNIC_RESET_FAILOVER && + adapter->reset_reason != VNIC_RESET_CHANGE_PARAM) +- netdev_notify_peers(netdev); ++ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev); + + netif_carrier_on(netdev); + +-- +2.19.2 + diff --git a/patches.drivers/net-net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch b/patches.drivers/net-net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch deleted file mode 100644 index 971f28e..0000000 --- a/patches.drivers/net-net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch +++ /dev/null @@ -1,37 +0,0 @@ -From patchwork Fri Nov 30 16:59:08 2018 -Subject: [net] net/ibmvnic: Fix RTNL deadlock during device reset -X-Patchwork-Id: 1006087 -Date: Fri, 30 Nov 2018 10:59:08 -0600 -From: Thomas Falcon - -References: bnc#1115431 -Patch-mainline: submitted, http://patchwork.ozlabs.org/patch/1006087/ - -Commit a5681e20b541 ("net/ibmnvic: Fix deadlock problem -in reset") made the change to hold the RTNL lock during -driver reset but still calls netdev_notify_peers, which -results in a deadlock. Instead, use call_netdevice_notifiers, -which is functionally the same except that it does not -take the RTNL lock again. - -Fixes: a5681e20b541 ("net/ibmnvic: Fix deadlock problem in reset") - -Signed-off-by: Thomas Falcon -Acked-by: Michal Suchanek ---- - drivers/net/ethernet/ibm/ibmvnic.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c -index c0203a0..ed50b8d 100644 ---- a/drivers/net/ethernet/ibm/ibmvnic.c -+++ b/drivers/net/ethernet/ibm/ibmvnic.c -@@ -1859,7 +1859,7 @@ static int do_reset(struct ibmvnic_adapter *adapter, - - if (adapter->reset_reason != VNIC_RESET_FAILOVER && - adapter->reset_reason != VNIC_RESET_CHANGE_PARAM) -- netdev_notify_peers(netdev); -+ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev); - - netif_carrier_on(netdev); - diff --git a/patches.fixes/0001-xen-x86-add-diagnostic-printout-to-xen_mc_flush-in-c.patch b/patches.fixes/0001-xen-x86-add-diagnostic-printout-to-xen_mc_flush-in-c.patch new file mode 100644 index 0000000..2fe900d --- /dev/null +++ b/patches.fixes/0001-xen-x86-add-diagnostic-printout-to-xen_mc_flush-in-c.patch @@ -0,0 +1,102 @@ +From: Juergen Gross +Date: Fri, 23 Nov 2018 17:24:51 +0100 +Patch-mainline: 4.20-rc5 +Git-commit: a7b403104e17209ea71eea59d4a71bf9e0d8cb83 +References: bnc#1116183 +Subject: [PATCH] xen/x86: add diagnostic printout to xen_mc_flush() in case of + error + +Failure of an element of a Xen multicall is signalled via a WARN() +only if the kernel is compiled with MC_DEBUG. It is impossible to +know which element failed and why it did so. + +Change that by printing the related information even without MC_DEBUG, +even if maybe in some limited form (e.g. without information which +caller produced the failing element). + +Move the printing out of the switch statement in order to have the +same information for a single call. + +Signed-off-by: Juergen Gross +Reviewed-by: Boris Ostrovsky +Signed-off-by: Juergen Gross +--- + arch/x86/xen/multicalls.c | 35 ++++++++++++++++++++--------------- + 1 file changed, 20 insertions(+), 15 deletions(-) + +diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c +index 2bce7958ce8b..0766a08bdf45 100644 +--- a/arch/x86/xen/multicalls.c ++++ b/arch/x86/xen/multicalls.c +@@ -69,6 +69,11 @@ void xen_mc_flush(void) + + trace_xen_mc_flush(b->mcidx, b->argidx, b->cbidx); + ++#if MC_DEBUG ++ memcpy(b->debug, b->entries, ++ b->mcidx * sizeof(struct multicall_entry)); ++#endif ++ + switch (b->mcidx) { + case 0: + /* no-op */ +@@ -87,32 +92,34 @@ void xen_mc_flush(void) + break; + + default: +-#if MC_DEBUG +- memcpy(b->debug, b->entries, +- b->mcidx * sizeof(struct multicall_entry)); +-#endif +- + if (HYPERVISOR_multicall(b->entries, b->mcidx) != 0) + BUG(); + for (i = 0; i < b->mcidx; i++) + if (b->entries[i].result < 0) + ret++; ++ } + ++ if (WARN_ON(ret)) { ++ pr_err("%d of %d multicall(s) failed: cpu %d\n", ++ ret, b->mcidx, smp_processor_id()); ++ for (i = 0; i < b->mcidx; i++) { ++ if (b->entries[i].result < 0) { + #if MC_DEBUG +- if (ret) { +- printk(KERN_ERR "%d multicall(s) failed: cpu %d\n", +- ret, smp_processor_id()); +- dump_stack(); +- for (i = 0; i < b->mcidx; i++) { +- printk(KERN_DEBUG " call %2d/%d: op=%lu arg=[%lx] result=%ld\t%pF\n", +- i+1, b->mcidx, ++ pr_err(" call %2d: op=%lu arg=[%lx] result=%ld\t%pF\n", ++ i + 1, + b->debug[i].op, + b->debug[i].args[0], + b->entries[i].result, + b->caller[i]); ++#else ++ pr_err(" call %2d: op=%lu arg=[%lx] result=%ld\n", ++ i + 1, ++ b->entries[i].op, ++ b->entries[i].args[0], ++ b->entries[i].result); ++#endif + } + } +-#endif + } + + b->mcidx = 0; +@@ -126,8 +133,6 @@ void xen_mc_flush(void) + b->cbidx = 0; + + local_irq_restore(flags); +- +- WARN_ON(ret); + } + + struct multicall_space __xen_mc_entry(size_t args) +-- +2.16.4 + diff --git a/patches.fixes/libceph-fall-back-to-sendmsg-for-slab-pages.patch b/patches.fixes/libceph-fall-back-to-sendmsg-for-slab-pages.patch new file mode 100644 index 0000000..91f4887 --- /dev/null +++ b/patches.fixes/libceph-fall-back-to-sendmsg-for-slab-pages.patch @@ -0,0 +1,57 @@ +From: Ilya Dryomov +Date: Thu, 8 Nov 2018 15:55:37 +0100 +Subject: libceph: fall back to sendmsg for slab pages +Git-commit: 7e241f647dc7087a0401418a187f3f5b527cc690 +Patch-mainline: v4.20-rc4 +References: bsc#1118316 + +skb_can_coalesce() allows coalescing neighboring slab objects into +a single frag: + + return page == skb_frag_page(frag) && + off == frag->page_offset + skb_frag_size(frag); + +ceph_tcp_sendpage() can be handed slab pages. One example of this is +XFS: it passes down sector sized slab objects for its metadata I/O. If +the kernel client is co-located on the OSD node, the skb may go through +loopback and pop on the receive side with the exact same set of frags. +When tcp_recvmsg() attempts to copy out such a frag, hardened usercopy +complains because the size exceeds the object's allocated size: + + usercopy: kernel memory exposure attempt detected from ffff9ba917f20a00 (kmalloc-512) (1024 bytes) + +Although skb_can_coalesce() could be taught to return false if the +resulting frag would cross a slab object boundary, we already have +a fallback for non-refcounted pages. Utilize it for slab pages too. + +Cc: stable@vger.kernel.org # 4.8+ +Signed-off-by: Ilya Dryomov +Acked-by: Luis Henriques +--- + net/ceph/messenger.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c +index 57fcc6b4bf6e..2f126eff275d 100644 +--- a/net/ceph/messenger.c ++++ b/net/ceph/messenger.c +@@ -580,9 +580,15 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page, + struct bio_vec bvec; + int ret; + +- /* sendpage cannot properly handle pages with page_count == 0, +- * we need to fallback to sendmsg if that's the case */ +- if (page_count(page) >= 1) ++ /* ++ * sendpage cannot properly handle pages with page_count == 0, ++ * we need to fall back to sendmsg if that's the case. ++ * ++ * Same goes for slab pages: skb_can_coalesce() allows ++ * coalescing neighboring slab objects into a single frag which ++ * triggers one of hardened usercopy checks. ++ */ ++ if (page_count(page) >= 1 && !PageSlab(page)) + return __ceph_tcp_sendpage(sock, page, offset, size, more); + + bvec.bv_page = page; + diff --git a/patches.suse/net-mlx5e-Set-vlan-masks-for-all-offloaded-TC-rules.patch b/patches.suse/net-mlx5e-Set-vlan-masks-for-all-offloaded-TC-rules.patch deleted file mode 100644 index fde1ac0..0000000 --- a/patches.suse/net-mlx5e-Set-vlan-masks-for-all-offloaded-TC-rules.patch +++ /dev/null @@ -1,36 +0,0 @@ -From: Jianbo Liu -Date: Sat, 25 Aug 2018 03:29:58 +0000 -Subject: net/mlx5e: Set vlan masks for all offloaded TC rules -Git-commit: cee26487620bc9bc3c7db21b6984d91f7bae12ae -Patch-mainline: v4.19-rc7 -References: networking-stable-18_10_16 - -In flow steering, if asked to, the hardware matches on the first ethertype -which is not vlan. It's possible to set a rule as follows, which is meant -to match on untagged packet, but will match on a vlan packet: - tc filter add dev eth0 parent ffff: protocol ip flower ... - -To avoid this for packets with single tag, we set vlan masks to tell -hardware to check the tags for every matched packet. - -Fixes: 095b6cfd69ce ('net/mlx5e: Add TC vlan match parsing') -Signed-off-by: Jianbo Liu -Reviewed-by: Or Gerlitz -Signed-off-by: Saeed Mahameed -Signed-off-by: Jiri Slaby ---- - drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -@@ -864,6 +864,9 @@ static int __parse_cls_flower(struct mlx - MLX5_SET(fte_match_set_lyr_2_4, headers_c, first_prio, mask->vlan_priority); - MLX5_SET(fte_match_set_lyr_2_4, headers_v, first_prio, key->vlan_priority); - } -+ } else { -+ MLX5_SET(fte_match_set_lyr_2_4, headers_c, svlan_tag, 1); -+ MLX5_SET(fte_match_set_lyr_2_4, headers_c, cvlan_tag, 1); - } - - if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) { diff --git a/series.conf b/series.conf index 130cb04..3d7e906 100644 --- a/series.conf +++ b/series.conf @@ -18678,7 +18678,6 @@ patches.suse/rtnl-limit-IFLA_NUM_TX_QUEUES-and-IFLA_NUM_RX_QUEUES.patch patches.suse/net-systemport-Fix-wake-up-interrupt-race-during-res.patch patches.suse/net-mlx5-E-Switch-Fix-out-of-bound-access-when-setti.patch - patches.suse/net-mlx5e-Set-vlan-masks-for-all-offloaded-TC-rules.patch patches.suse/ipv4-fix-use-after-free-in-ip_cmsg_recv_dstaddr.patch patches.drm/0001-drm-i915-Handle-incomplete-Z_FINISH-for-compressed-e.patch patches.arch/ARM-8799-1-mm-fix-pci_ioremap_io-offset-check.patch @@ -19195,6 +19194,7 @@ patches.drivers/iommu-ipmmu-vmsa-fix-crash-on-early-domain-free patches.drivers/amd-iommu-fix-guest-virtual-apic-log-tail-address-register patches.drivers/iommu-vt-d-use-memunmap-to-free-memremap + patches.fixes/libceph-fall-back-to-sendmsg-for-slab-pages.patch patches.suse/sctp-not-allow-to-set-asoc-prsctp_enable-by-sockopt.patch patches.suse/sctp-not-increase-stream-s-incnt-before-sending-adds.patch patches.drivers/net-ena-fix-crash-during-failed-resume-from-hibernat.patch @@ -19244,6 +19244,10 @@ patches.fixes/ACPI-IORT-Fix-iort_get_platform_device_domain-uninit.patch patches.drivers/pci-imx6-fix-link-training-status-detection-in-link-up-check patches.fixes/nvme-free-ctrl-device-name-on-init-failure.patch + patches.fixes/0001-xen-x86-add-diagnostic-printout-to-xen_mc_flush-in-c.patch + + # davem/net + patches.drivers/net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch # jejb/scsi for-next patches.drivers/scsi-lpfc-Correct-speeds-on-SFP-swap.patch @@ -19276,7 +19280,6 @@ patches.suse/tty-ldsem-Convert-to-regular-lockdep-annotations.patch patches.suse/tty-ldsem-Add-lockdep-asserts-for-ldisc_sem.patch patches.suse/tty-ldsem-Decrement-wait_readers-on-timeouted-down_r.patch - patches.drivers/net-net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch ######################################################## # end of sorted patches