1. 18 Dec, 2021 8 commits
  2. 17 Dec, 2021 12 commits
    • Brett Creeley's avatar
      iavf: Restrict maximum VLAN filters for VIRTCHNL_VF_OFFLOAD_VLAN_V2 · 92fc5085
      Brett Creeley authored
      For VIRTCHNL_VF_OFFLOAD_VLAN, PF's would limit the number of VLAN
      filters a VF was allowed to add. However, by the time the opcode failed,
      the VLAN netdev had already been added. VIRTCHNL_VF_OFFLOAD_VLAN_V2
      added the ability for a PF to tell the VF how many VLAN filters it's
      allowed to add. Make changes to support that functionality.
      Signed-off-by: default avatarBrett Creeley <brett.creeley@intel.com>
      Tested-by: default avatarKonrad Jankowski <konrad0.jankowski@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      92fc5085
    • Brett Creeley's avatar
      iavf: Add support for VIRTCHNL_VF_OFFLOAD_VLAN_V2 offload enable/disable · 8afadd1c
      Brett Creeley authored
      The new VIRTCHNL_VF_OFFLOAD_VLAN_V2 capability added support that allows
      the VF to support 802.1Q and 802.1ad VLAN insertion and stripping if
      successfully negotiated via VIRTCHNL_OP_GET_OFFLOAD_VLAN_V2_CAPS.
      Multiple changes were needed to support this new functionality.
      
      1. Added new aq_required flags to support any kind of VLAN stripping and
         insertion offload requests via virtchnl.
      
      2. Added the new method iavf_set_vlan_offload_features() that's
         used during VF initialization, VF reset, and iavf_set_features() to
         set the aq_required bits based on the current VLAN offload
         configuration of the VF's netdev.
      
      3. Added virtchnl handling for VIRTCHNL_OP_ENABLE_STRIPPING_V2,
         VIRTCHNL_OP_DISABLE_STRIPPING_V2, VIRTCHNL_OP_ENABLE_INSERTION_V2,
         and VIRTCHNL_OP_ENABLE_INSERTION_V2.
      Signed-off-by: default avatarBrett Creeley <brett.creeley@intel.com>
      Tested-by: default avatarKonrad Jankowski <konrad0.jankowski@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      8afadd1c
    • Brett Creeley's avatar
      iavf: Add support for VIRTCHNL_VF_OFFLOAD_VLAN_V2 hotpath · ccd219d2
      Brett Creeley authored
      The new VIRTCHNL_VF_OFFLOAD_VLAN_V2 capability added support that allows
      the PF to set the location of the Tx and Rx VLAN tag for insertion and
      stripping offloads. In order to support this functionality a few changes
      are needed.
      
      1. Add a new method to cache the VLAN tag location based on negotiated
         capabilities for the Tx and Rx ring flags. This needs to be called in
         the initialization and reset paths.
      
      2. Refactor the transmit hotpath to account for the new Tx ring flags.
         When IAVF_TXR_FLAGS_VLAN_LOC_L2TAG2 is set, then the driver needs to
         insert the VLAN tag in the L2TAG2 field of the transmit descriptor.
         When the IAVF_TXRX_FLAGS_VLAN_LOC_L2TAG1 is set, then the driver needs
         to use the l2tag1 field of the data descriptor (same behavior as
         before).
      
      3. Refactor the iavf_tx_prepare_vlan_flags() function to simplify
         transmit hardware VLAN offload functionality by only depending on the
         skb_vlan_tag_present() function. This can be done because the OS
         won't request transmit offload for a VLAN unless the driver told the
         OS it's supported and enabled.
      
      4. Refactor the receive hotpath to account for the new Rx ring flags and
         VLAN ethertypes. This requires checking the Rx ring flags and
         descriptor status bits to determine the location of the VLAN tag.
         Also, since only a single ethertype can be supported at a time, check
         the enabled netdev features before specifying a VLAN ethertype in
         __vlan_hwaccel_put_tag().
      Signed-off-by: default avatarBrett Creeley <brett.creeley@intel.com>
      Tested-by: default avatarKonrad Jankowski <konrad0.jankowski@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      ccd219d2
    • Brett Creeley's avatar
      iavf: Add support VIRTCHNL_VF_OFFLOAD_VLAN_V2 during netdev config · 48ccc43e
      Brett Creeley authored
      Based on VIRTCHNL_VF_OFFLOAD_VLAN_V2, the VF can now support more VLAN
      capabilities (i.e. 802.1AD offloads and filtering). In order to
      communicate these capabilities to the netdev layer, the VF needs to
      parse its VLAN capabilities based on whether it was able to negotiation
      VIRTCHNL_VF_OFFLOAD_VLAN or VIRTCHNL_VF_OFFLOAD_VLAN_V2 or neither of
      these.
      
      In order to support this, add the following functionality:
      
      iavf_get_netdev_vlan_hw_features() - This is used to determine the VLAN
      features that the underlying hardware supports and that can be toggled
      off/on based on the negotiated capabiltiies. For example, if
      VIRTCHNL_VF_OFFLOAD_VLAN_V2 was negotiated, then any capability marked
      with VIRTCHNL_VLAN_TOGGLE can be toggled on/off by the VF. If
      VIRTCHNL_VF_OFFLOAD_VLAN was negotiated, then only VLAN insertion and/or
      stripping can be toggled on/off.
      
      iavf_get_netdev_vlan_features() - This is used to determine the VLAN
      features that the underlying hardware supports and that should be
      enabled by default. For example, if VIRTHCNL_VF_OFFLOAD_VLAN_V2 was
      negotiated, then any supported capability that has its ethertype_init
      filed set should be enabled by default. If VIRTCHNL_VF_OFFLOAD_VLAN was
      negotiated, then filtering, stripping, and insertion should be enabled
      by default.
      
      Also, refactor iavf_fix_features() to take into account the new
      capabilities. To do this, query all the supported features (enabled by
      default and toggleable) and make sure the requested change is supported.
      If VIRTCHNL_VF_OFFLOAD_VLAN_V2 is successfully negotiated, there is no
      need to check VIRTCHNL_VLAN_TOGGLE here because the driver already told
      the netdev layer which features can be toggled via netdev->hw_features
      during iavf_process_config(), so only those features will be requested
      to change.
      Signed-off-by: default avatarBrett Creeley <brett.creeley@intel.com>
      Tested-by: default avatarKonrad Jankowski <konrad0.jankowski@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      48ccc43e
    • Brett Creeley's avatar
      iavf: Add support for VIRTCHNL_VF_OFFLOAD_VLAN_V2 negotiation · 209f2f9c
      Brett Creeley authored
      In order to support the new VIRTCHNL_VF_OFFLOAD_VLAN_V2 capability the
      VF driver needs to rework it's initialization state machine and reset
      flow. This has to be done because successful negotiation of
      VIRTCHNL_VF_OFFLOAD_VLAN_V2 requires the VF driver to perform a second
      capability request via VIRTCHNL_OP_GET_OFFLOAD_VLAN_V2_CAPS before
      configuring the adapter and its netdev.
      
      Add the VIRTCHNL_VF_OFFLOAD_VLAN_V2 bit when sending the
      VIRTHCNL_OP_GET_VF_RESOURECES message. The underlying PF will either
      support VIRTCHNL_VF_OFFLOAD_VLAN or VIRTCHNL_VF_OFFLOAD_VLAN_V2 or
      neither. Both of these offloads should never be supported together.
      
      Based on this, add 2 new states to the initialization state machine:
      
      __IAVF_INIT_GET_OFFLOAD_VLAN_V2_CAPS
      __IAVF_INIT_CONFIG_ADAPTER
      
      The __IAVF_INIT_GET_OFFLOAD_VLAN_V2_CAPS state is used to request/store
      the new VLAN capabilities if and only if VIRTCHNL_VLAN_OFFLOAD_VLAN_V2
      was successfully negotiated in the __IAVF_INIT_GET_RESOURCES state.
      
      The __IAVF_INIT_CONFIG_ADAPTER state is used to configure the
      adapter/netdev after the resource requests have finished. The VF will
      move into this state regardless of whether it successfully negotiated
      VIRTCHNL_VF_OFFLOAD_VLAN or VIRTCHNL_VF_OFFLOAD_VLAN_V2.
      
      Also, add a the new flag IAVF_FLAG_AQ_GET_OFFLOAD_VLAN_V2_CAPS and set
      it during VF reset. If VIRTCHNL_VF_OFFLOAD_VLAN_V2 was successfully
      negotiated then the VF will request its VLAN capabilities via
      VIRTCHNL_OP_GET_OFFLOAD_VLAN_V2_CAPS during the reset. This is needed
      because the PF may change/modify the VF's configuration during VF reset
      (i.e. modifying the VF's port VLAN configuration).
      
      This also, required the VF to call netdev_update_features() since its
      VLAN features may change during VF reset. Make sure to call this under
      rtnl_lock().
      Signed-off-by: default avatarBrett Creeley <brett.creeley@intel.com>
      Tested-by: default avatarKonrad Jankowski <konrad0.jankowski@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      209f2f9c
    • Brett Creeley's avatar
      virtchnl: Add support for new VLAN capabilities · bd0b536d
      Brett Creeley authored
      Currently VIRTCHNL only allows for VLAN filtering and offloads to happen
      on a single 802.1Q VLAN. Add support to filter and offload on inner,
      outer, and/or inner + outer VLANs.
      
      This is done by introducing the new capability
      VIRTCHNL_VF_OFFLOAD_VLAN_V2. The flow to negotiate this new capability
      is shown below.
      
      1. VF - sets the VIRTCHNL_VF_OFFLOAD_VLAN_V2 bit in the
         virtchnl_vf_resource.vf_caps_flags during the
         VIRTCHNL_OP_GET_VF_RESOURCES request message. The VF should also set
         the VIRTCHNL_VF_OFFLOAD_VLAN bit in case the PF driver doesn't support
         the new capability.
      
      2. PF - sets the VLAN capability bit it supports in the
         VIRTCHNL_OP_GET_VF_RESOURCES response message. This will either be
         VIRTCHNL_VF_OFFLOAD_VLAN_V2, VIRTCHNL_VF_OFFLOAD_VLAN, or none.
      
      3. VF - If the VIRTCHNL_VF_OFFLOAD_VLAN_V2 capability was ACK'd by the
         PF, then the VF needs to request the VLAN capabilities of the
         PF/Device by issuing a VIRTCHNL_OP_GET_OFFLOAD_VLAN_V2_CAPS request.
         If the VIRTCHNL_VF_OFFLOAD_VLAN capability was ACK'd then the VF
         knows only single 802.1Q VLAN filtering/offloads are supported. If no
         VLAN capability is ACK'd then the PF/Device doesn't support hardware
         VLAN filtering/offloads for this VF.
      
      4. PF - Populates the virtchnl_vlan_caps structure based on what it
         allows/supports for that VF and sends that response via
         VIRTCHNL_OP_GET_OFFLOAD_VLAN_V2_CAPS.
      
      After VIRTCHNL_OP_GET_OFFLOAD_VLAN_V2_CAPS is successfully negotiated
      the VF driver needs to interpret the capabilities supported by the
      underlying PF/Device. The VF will be allowed to filter/offload the
      inner 802.1Q, outer (various ethertype), inner 802.1Q + outer
      (various ethertypes), or none based on which fields are set.
      
      The VF will also need to interpret where the VLAN tag should be inserted
      and/or stripped based on the negotiated capabilities.
      Signed-off-by: default avatarBrett Creeley <brett.creeley@intel.com>
      Tested-by: default avatarKonrad Jankowski <konrad0.jankowski@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      bd0b536d
    • Jakub Kicinski's avatar
      Merge tag 'wireless-drivers-next-2021-12-17' of... · f75c1d55
      Jakub Kicinski authored
      Merge tag 'wireless-drivers-next-2021-12-17' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next
      
      Kalle Valo says:
      
      ====================
      wireless-drivers-next patches for v5.17
      
      Second set of patches for v5.17, planning to do at least one more.
      Smaller new features, nothing special this time.
      
      Major changes:
      
      rtw88
       * debugfs file to fix tx rate
      
      iwlwifi
       * support SAR GEO Offset Mapping (SGOM) via BIOS
       * support firmware API version 68
       * add some new device IDs
      
      ath11k
       * support PCI devices with 1 MSI vector
       * WCN6855 hw2.1 support
       * 11d scan offload support
       * full monitor mode, only supported on QCN9074
       * scan MAC address randomization support
       * reserved host DDR addresses from DT for PCI devices support
      
      ath9k
       * switch to rate table based lookup
      
      ath
       * extend South Korea regulatory domain support
      
      wcn36xx
       * beacon filter support
      
      * tag 'wireless-drivers-next-2021-12-17' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next: (129 commits)
        wcn36xx: Implement beacon filtering
        wcn36xx: Fix physical location of beacon filter comment
        wcn36xx: Fix beacon filter structure definitions
        ath11k: Use reserved host DDR addresses from DT for PCI devices
        dt: bindings: add new DT entry for ath11k PCI device support
        wilc1000: Improve WILC TX performance when power_save is off
        wl1251: specify max. IE length
        rsi: fix array out of bound
        wilc1000: Rename workqueue from "WILC_wq" to "NETDEV-wq"
        wilc1000: Rename tx task from "K_TXQ_TASK" to NETDEV-tx
        wilc1000: Rename irq handler from "WILC_IRQ" to netdev name
        wilc1000: Rename SPI driver from "WILC_SPI" to "wilc1000_spi"
        wilc1000: Fix spurious "FW not responding" error
        wilc1000: Remove misleading USE_SPI_DMA macro
        wilc1000: Fix missing newline in error message
        wilc1000: Fix copy-and-paste typo in wilc_set_mac_address
        rtw89: coex: Update COEX to 5.5.8
        rtw89: coex: Cancel PS leaving while C2H comes
        rtw89: coex: Update BT counters while receiving report
        rtw89: coex: Define LPS state for BTC using
        ...
      ====================
      
      Link: https://lore.kernel.org/r/20211217130952.34887C36AE9@smtp.kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      f75c1d55
    • Changcheng Deng's avatar
      net: dsa: microchip: remove unneeded variable · 86df8be6
      Changcheng Deng authored
      Remove unneeded variable used to store return value.
      Reported-by: default avatarZeal Robot <zealci@zte.com.cn>
      Signed-off-by: default avatarChangcheng Deng <deng.changcheng@zte.com.cn>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      86df8be6
    • Dexuan Cui's avatar
      net: mana: Add RX fencing · 6cc74443
      Dexuan Cui authored
      RX fencing allows the driver to know that any prior change to the RQs has
      finished, e.g. when the RQs are disabled/enabled or the hashkey/indirection
      table are changed, RX fencing is required.
      
      Remove the previous workaround "ssleep(1)" and add the real support for
      RX fencing as the PF driver supports the MANA_FENCE_RQ request now (any
      old PF driver not supporting the request won't be used in production).
      Signed-off-by: default avatarDexuan Cui <decui@microsoft.com>
      Reviewed-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
      Link: https://lore.kernel.org/r/20211216001748.8751-1-decui@microsoft.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      6cc74443
    • Yang Li's avatar
      net: vertexcom: remove unneeded semicolon · 431b9b4d
      Yang Li authored
      Eliminate the following coccicheck warning:
      ./drivers/net/ethernet/vertexcom/mse102x.c:414:2-3: Unneeded semicolon
      Reported-by: default avatarAbaci Robot <abaci@linux.alibaba.com>
      Signed-off-by: default avatarYang Li <yang.lee@linux.alibaba.com>
      Link: https://lore.kernel.org/r/20211216015433.83383-1-yang.lee@linux.alibaba.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      431b9b4d
    • Yinjun Zhang's avatar
      nfp: flower: refine the use of circular buffer · 7ffd9041
      Yinjun Zhang authored
      The current use of circular buffer to manage stats_context_id is
      very obscure, and it will cause problem if its element size is
      not power of two. So change the use more straightforward and
      scalable, and also change that for mask_id to keep consistency.
      Signed-off-by: default avatarYinjun Zhang <yinjun.zhang@corigine.com>
      Signed-off-by: default avatarSimon Horman <simon.horman@corigine.com>
      Link: https://lore.kernel.org/r/1639618621-5857-1-git-send-email-yinjun.zhang@corigine.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      7ffd9041
    • Jakub Kicinski's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 7cd2802d
      Jakub Kicinski authored
      No conflicts.
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      7cd2802d
  3. 16 Dec, 2021 20 commits
    • Linus Torvalds's avatar
      Merge tag 'audit-pr-20211216' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit · 6441998e
      Linus Torvalds authored
      Pull audit fix from Paul Moore:
       "A single patch to fix a problem where the audit queue could grow
        unbounded when the audit daemon is forcibly stopped"
      
      * tag 'audit-pr-20211216' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
        audit: improve robustness of the audit queue handling
      6441998e
    • Linus Torvalds's avatar
      Merge tag 'net-5.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 180f3bcf
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Networking fixes, including fixes from mac80211, wifi, bpf.
      
        Relatively large batches of fixes from BPF and the WiFi stack, calm in
        general networking.
      
        Current release - regressions:
      
         - dpaa2-eth: fix buffer overrun when reporting ethtool statistics
      
        Current release - new code bugs:
      
         - bpf: fix incorrect state pruning for <8B spill/fill
      
         - iavf:
             - add missing unlocks in iavf_watchdog_task()
             - do not override the adapter state in the watchdog task (again)
      
         - mlxsw: spectrum_router: consolidate MAC profiles when possible
      
        Previous releases - regressions:
      
         - mac80211 fixes:
             - rate control, avoid driver crash for retransmitted frames
             - regression in SSN handling of addba tx
             - a memory leak where sta_info is not freed
             - marking TX-during-stop for TX in in_reconfig, prevent stall
      
         - cfg80211: acquire wiphy mutex on regulatory work
      
         - wifi drivers: fix build regressions and LED config dependency
      
         - virtio_net: fix rx_drops stat for small pkts
      
         - dsa: mv88e6xxx: unforce speed & duplex in mac_link_down()
      
        Previous releases - always broken:
      
         - bpf fixes:
             - kernel address leakage in atomic fetch
             - kernel address leakage in atomic cmpxchg's r0 aux reg
             - signed bounds propagation after mov32
             - extable fixup offset
             - extable address check
      
         - mac80211:
             - fix the size used for building probe request
             - send ADDBA requests using the tid/queue of the aggregation
               session
             - agg-tx: don't schedule_and_wake_txq() under sta->lock, avoid
               deadlocks
             - validate extended element ID is present
      
         - mptcp:
             - never allow the PM to close a listener subflow (null-defer)
             - clear 'kern' flag from fallback sockets, prevent crash
             - fix deadlock in __mptcp_push_pending()
      
         - inet_diag: fix kernel-infoleak for UDP sockets
      
         - xsk: do not sleep in poll() when need_wakeup set
      
         - smc: avoid very long waits in smc_release()
      
         - sch_ets: don't remove idle classes from the round-robin list
      
         - netdevsim:
             - zero-initialize memory for bpf map's value, prevent info leak
             - don't let user space overwrite read only (max) ethtool parms
      
         - ixgbe: set X550 MDIO speed before talking to PHY
      
         - stmmac:
             - fix null-deref in flower deletion w/ VLAN prio Rx steering
             - dwmac-rk: fix oob read in rk_gmac_setup
      
         - ice: time stamping fixes
      
         - systemport: add global locking for descriptor life cycle"
      
      * tag 'net-5.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (89 commits)
        bpf, selftests: Fix racing issue in btf_skc_cls_ingress test
        selftest/bpf: Add a test that reads various addresses.
        bpf: Fix extable address check.
        bpf: Fix extable fixup offset.
        bpf, selftests: Add test case trying to taint map value pointer
        bpf: Make 32->64 bounds propagation slightly more robust
        bpf: Fix signed bounds propagation after mov32
        sit: do not call ipip6_dev_free() from sit_init_net()
        net: systemport: Add global locking for descriptor lifecycle
        net/smc: Prevent smc_release() from long blocking
        net: Fix double 0x prefix print in SKB dump
        virtio_net: fix rx_drops stat for small pkts
        dsa: mv88e6xxx: fix debug print for SPEED_UNFORCED
        sfc_ef100: potential dereference of null pointer
        net: stmmac: dwmac-rk: fix oob read in rk_gmac_setup
        net: usb: lan78xx: add Allied Telesis AT29M2-AF
        net/packet: rx_owner_map depends on pg_vec
        netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc
        dpaa2-eth: fix ethtool statistics
        ixgbe: set X550 MDIO speed before talking to PHY
        ...
      180f3bcf
    • Linus Torvalds's avatar
      Merge tag 'soc-fixes-5.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · 93db8300
      Linus Torvalds authored
      Pull ARM SoC fixes from Arnd Bergmann:
       "There are a number of DT fixes, mostly for mistakes found through
        static checking of the dts files again, as well as a couple of minor
        changes to address incorrect DT settings.
      
        For i.MX, there is yet another series of devitree changes to update
        RGMII delay settings for ethernet, which is an ongoing problem after
        some driver changes.
      
        For SoC specific device drivers, a number of smaller fixes came up:
      
         - i.MX SoC identification was incorrectly registered non-i.MX
           machines when the driver is built-in
      
         - One fix on imx8m-blk-ctrl driver to get i.MX8MM MIPI reset work
           properly
      
         - a few compile fixes for warnings that get in the way of -Werror
      
         - a string overflow in the scpi firmware driver
      
         - a boot failure with FORTIFY_SOURCE on Rockchips machines
      
         - broken error handling in the AMD TEE driver
      
         - a revert for a tegra reset driver commit that broke HDA"
      
      * tag 'soc-fixes-5.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits)
        soc/tegra: fuse: Fix bitwise vs. logical OR warning
        firmware: arm_scpi: Fix string overflow in SCPI genpd driver
        soc: imx: Register SoC device only on i.MX boards
        soc: imx: imx8m-blk-ctrl: Fix imx8mm mipi reset
        ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name
        arm64: dts: imx8mq: remove interconnect property from lcdif
        ARM: socfpga: dts: fix qspi node compatible
        arm64: dts: apple: add #interrupt-cells property to pinctrl nodes
        dt-bindings: i2c: apple,i2c: allow multiple compatibles
        arm64: meson: remove COMMON_CLK
        arm64: meson: fix dts for JetHub D1
        tee: amdtee: fix an IS_ERR() vs NULL bug
        arm64: dts: apple: change ethernet0 device type to ethernet
        arm64: dts: ten64: remove redundant interrupt declaration for gpio-keys
        arm64: dts: rockchip: fix poweroff on helios64
        arm64: dts: rockchip: fix audio-supply for Rock Pi 4
        arm64: dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply
        arm64: dts: rockchip: fix rk3308-roc-cc vcc-sd supply
        arm64: dts: rockchip: remove mmc-hs400-enhanced-strobe from rk3399-khadas-edge
        ARM: rockchip: Use memcpy_toio instead of memcpy on smp bring-up
        ...
      93db8300
    • Jakub Kicinski's avatar
      Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf · 0c3e2474
      Jakub Kicinski authored
      Daniel Borkmann says:
      
      ====================
      pull-request: bpf 2021-12-16
      
      We've added 15 non-merge commits during the last 7 day(s) which contain
      a total of 12 files changed, 434 insertions(+), 30 deletions(-).
      
      The main changes are:
      
      1) Fix incorrect verifier state pruning behavior for <8B register spill/fill,
         from Paul Chaignon.
      
      2) Fix x86-64 JIT's extable handling for fentry/fexit when return pointer
         is an ERR_PTR(), from Alexei Starovoitov.
      
      3) Fix 3 different possibilities that BPF verifier missed where unprivileged
         could leak kernel addresses, from Daniel Borkmann.
      
      4) Fix xsk's poll behavior under need_wakeup flag, from Magnus Karlsson.
      
      5) Fix an oob-write in test_verifier due to a missed MAX_NR_MAPS bump,
         from Kumar Kartikeya Dwivedi.
      
      6) Fix a race in test_btf_skc_cls_ingress selftest, from Martin KaFai Lau.
      
      * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
        bpf, selftests: Fix racing issue in btf_skc_cls_ingress test
        selftest/bpf: Add a test that reads various addresses.
        bpf: Fix extable address check.
        bpf: Fix extable fixup offset.
        bpf, selftests: Add test case trying to taint map value pointer
        bpf: Make 32->64 bounds propagation slightly more robust
        bpf: Fix signed bounds propagation after mov32
        bpf, selftests: Update test case for atomic cmpxchg on r0 with pointer
        bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg
        bpf, selftests: Add test case for atomic fetch on spilled pointer
        bpf: Fix kernel address leakage in atomic fetch
        selftests/bpf: Fix OOB write in test_verifier
        xsk: Do not sleep in poll() when need_wakeup set
        selftests/bpf: Tests for state pruning with u32 spill/fill
        bpf: Fix incorrect state pruning for <8B spill/fill
      ====================
      
      Link: https://lore.kernel.org/r/20211216210005.13815-1-daniel@iogearbox.netSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      0c3e2474
    • Martin KaFai Lau's avatar
      bpf, selftests: Fix racing issue in btf_skc_cls_ingress test · c2fcbf81
      Martin KaFai Lau authored
      The libbpf CI reported occasional failure in btf_skc_cls_ingress:
      
        test_syncookie:FAIL:Unexpected syncookie states gen_cookie:80326634 recv_cookie:0
        bpf prog error at line 97
      
      "error at line 97" means the bpf prog cannot find the listening socket
      when the final ack is received.  It then skipped processing
      the syncookie in the final ack which then led to "recv_cookie:0".
      
      The problem is the userspace program did not do accept() and went
      ahead to close(listen_fd) before the kernel (and the bpf prog) had
      a chance to process the final ack.
      
      The fix is to add accept() call so that the userspace will wait for
      the kernel to finish processing the final ack first before close()-ing
      everything.
      
      Fixes: 9a856cae ("bpf: selftest: Add test_btf_skc_cls_ingress")
      Reported-by: default avatarAndrii Nakryiko <andrii@kernel.org>
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Link: https://lore.kernel.org/bpf/20211216191630.466151-1-kafai@fb.com
      c2fcbf81
    • Alexei Starovoitov's avatar
      selftest/bpf: Add a test that reads various addresses. · 7edc3fcb
      Alexei Starovoitov authored
      Add a function to bpf_testmod that returns invalid kernel and user addresses.
      Then attach an fexit program to that function that tries to read
      memory through these addresses.
      
      This logic checks that bpf_probe_read_kernel and BPF_PROBE_MEM logic is sane.
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      7edc3fcb
    • Alexei Starovoitov's avatar
      bpf: Fix extable address check. · 588a25e9
      Alexei Starovoitov authored
      The verifier checks that PTR_TO_BTF_ID pointer is either valid or NULL,
      but it cannot distinguish IS_ERR pointer from valid one.
      
      When offset is added to IS_ERR pointer it may become small positive
      value which is a user address that is not handled by extable logic
      and has to be checked for at the runtime.
      
      Tighten BPF_PROBE_MEM pointer check code to prevent this case.
      
      Fixes: 4c5de127 ("bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.")
      Reported-by: default avatarLorenzo Fontana <lorenzo.fontana@elastic.co>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      588a25e9
    • Alexei Starovoitov's avatar
      bpf: Fix extable fixup offset. · 433956e9
      Alexei Starovoitov authored
      The prog - start_of_ldx is the offset before the faulting ldx to the location
      after it, so this will be used to adjust pt_regs->ip for jumping over it and
      continuing, and with old temp it would have been fixed up to the wrong offset,
      causing crash.
      
      Fixes: 4c5de127 ("bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.")
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Reviewed-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      433956e9
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · a52a8e9e
      Linus Torvalds authored
      Pull clk fix from Stephen Boyd:
       "A single fix for the clk framework that needed some more bake time in
        linux-next.
      
        The problem is that two clks being registered at the same time can
        lead to a busted clk tree if the parent isn't fully registered by the
        time the child finds the parent. We rejigger the place where we mark
        the parent as fully registered so that the child can't find the parent
        until things are proper"
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: Don't parent clks until the parent is fully registered
      a52a8e9e
    • Daniel Borkmann's avatar
      bpf, selftests: Add test case trying to taint map value pointer · b1a7288d
      Daniel Borkmann authored
      Add a test case which tries to taint map value pointer arithmetic into a
      unknown scalar with subsequent export through the map.
      
      Before fix:
      
        # ./test_verifier 1186
        #1186/u map access: trying to leak tained dst reg FAIL
        Unexpected success to load!
        verification time 24 usec
        stack depth 8
        processed 15 insns (limit 1000000) max_states_per_insn 0 total_states 1 peak_states 1 mark_read 1
        #1186/p map access: trying to leak tained dst reg FAIL
        Unexpected success to load!
        verification time 8 usec
        stack depth 8
        processed 15 insns (limit 1000000) max_states_per_insn 0 total_states 1 peak_states 1 mark_read 1
        Summary: 0 PASSED, 0 SKIPPED, 2 FAILED
      
      After fix:
      
        # ./test_verifier 1186
        #1186/u map access: trying to leak tained dst reg OK
        #1186/p map access: trying to leak tained dst reg OK
        Summary: 2 PASSED, 0 SKIPPED, 0 FAILED
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Reviewed-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      b1a7288d
    • Daniel Borkmann's avatar
      bpf: Make 32->64 bounds propagation slightly more robust · e572ff80
      Daniel Borkmann authored
      Make the bounds propagation in __reg_assign_32_into_64() slightly more
      robust and readable by aligning it similarly as we did back in the
      __reg_combine_64_into_32() counterpart. Meaning, only propagate or
      pessimize them as a smin/smax pair.
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Reviewed-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      e572ff80
    • Daniel Borkmann's avatar
      bpf: Fix signed bounds propagation after mov32 · 3cf2b61e
      Daniel Borkmann authored
      For the case where both s32_{min,max}_value bounds are positive, the
      __reg_assign_32_into_64() directly propagates them to their 64 bit
      counterparts, otherwise it pessimises them into [0,u32_max] universe and
      tries to refine them later on by learning through the tnum as per comment
      in mentioned function. However, that does not always happen, for example,
      in mov32 operation we call zext_32_to_64(dst_reg) which invokes the
      __reg_assign_32_into_64() as is without subsequent bounds update as
      elsewhere thus no refinement based on tnum takes place.
      
      Thus, not calling into the __update_reg_bounds() / __reg_deduce_bounds() /
      __reg_bound_offset() triplet as we do, for example, in case of ALU ops via
      adjust_scalar_min_max_vals(), will lead to more pessimistic bounds when
      dumping the full register state:
      
      Before fix:
      
        0: (b4) w0 = -1
        1: R0_w=invP4294967295
           (id=0,imm=ffffffff,
            smin_value=4294967295,smax_value=4294967295,
            umin_value=4294967295,umax_value=4294967295,
            var_off=(0xffffffff; 0x0),
            s32_min_value=-1,s32_max_value=-1,
            u32_min_value=-1,u32_max_value=-1)
      
        1: (bc) w0 = w0
        2: R0_w=invP4294967295
           (id=0,imm=ffffffff,
            smin_value=0,smax_value=4294967295,
            umin_value=4294967295,umax_value=4294967295,
            var_off=(0xffffffff; 0x0),
            s32_min_value=-1,s32_max_value=-1,
            u32_min_value=-1,u32_max_value=-1)
      
      Technically, the smin_value=0 and smax_value=4294967295 bounds are not
      incorrect, but given the register is still a constant, they break assumptions
      about const scalars that smin_value == smax_value and umin_value == umax_value.
      
      After fix:
      
        0: (b4) w0 = -1
        1: R0_w=invP4294967295
           (id=0,imm=ffffffff,
            smin_value=4294967295,smax_value=4294967295,
            umin_value=4294967295,umax_value=4294967295,
            var_off=(0xffffffff; 0x0),
            s32_min_value=-1,s32_max_value=-1,
            u32_min_value=-1,u32_max_value=-1)
      
        1: (bc) w0 = w0
        2: R0_w=invP4294967295
           (id=0,imm=ffffffff,
            smin_value=4294967295,smax_value=4294967295,
            umin_value=4294967295,umax_value=4294967295,
            var_off=(0xffffffff; 0x0),
            s32_min_value=-1,s32_max_value=-1,
            u32_min_value=-1,u32_max_value=-1)
      
      Without the smin_value == smax_value and umin_value == umax_value invariant
      being intact for const scalars, it is possible to leak out kernel pointers
      from unprivileged user space if the latter is enabled. For example, when such
      registers are involved in pointer arithmtics, then adjust_ptr_min_max_vals()
      will taint the destination register into an unknown scalar, and the latter
      can be exported and stored e.g. into a BPF map value.
      
      Fixes: 3f50f132 ("bpf: Verifier, do explicit ALU32 bounds tracking")
      Reported-by: default avatarKuee K1r0a <liulin063@gmail.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Reviewed-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      3cf2b61e
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · fa36bbe6
      Linus Torvalds authored
      Pull arm64 fix from Catalin Marinas:
       "Fix missing error code on kexec failure path"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: kexec: Fix missing error code 'ret' warning in load_other_segments()
      fa36bbe6
    • Kalle Valo's avatar
      Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git · fd5e3c4a
      Kalle Valo authored
      ath.git patches for v5.17. Major changes:
      
      ath11k
      
      * support PCI devices with 1 MSI vector
      
      * WCN6855 hw2.1 support
      
      * 11d scan offload support
      
      * full monitor mode, only supported on QCN9074
      
      * scan MAC address randomization support
      
      * reserved host DDR addresses from DT for PCI devices support
      
      ath9k
      
      * switch to rate table based lookup
      
      ath
      
      * extend South Korea regulatory domain support
      
      wcn36xx
      
      * beacon filter support
      fd5e3c4a
    • Linus Torvalds's avatar
      Merge tag 'for-5.16/dm-fixes' of... · 81eebd54
      Linus Torvalds authored
      Merge tag 'for-5.16/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
      
      Pull device mapper fixes from Mike Snitzer:
      
       - Fix use after free in DM btree remove's rebalance_children()
      
       - Fix DM integrity data corruption, introduced during 5.16 merge, due
         to improper use of bvec_kmap_local()
      
      * tag 'for-5.16/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm integrity: fix data corruption due to improper use of bvec_kmap_local
        dm btree remove: fix use after free in rebalance_children()
      81eebd54
    • Lakshmi Ramasubramanian's avatar
      arm64: kexec: Fix missing error code 'ret' warning in load_other_segments() · 9c5d89bc
      Lakshmi Ramasubramanian authored
      Since commit ac10be5c ("arm64: Use common
      of_kexec_alloc_and_setup_fdt()"), smatch reports the following warning:
      
        arch/arm64/kernel/machine_kexec_file.c:152 load_other_segments()
        warn: missing error code 'ret'
      
      Return code is not set to an error code in load_other_segments() when
      of_kexec_alloc_and_setup_fdt() call returns a NULL dtb. This results
      in status success (return code set to 0) being returned from
      load_other_segments().
      
      Set return code to -EINVAL if of_kexec_alloc_and_setup_fdt() returns
      NULL dtb.
      Signed-off-by: default avatarLakshmi Ramasubramanian <nramas@linux.microsoft.com>
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Fixes: ac10be5c ("arm64: Use common of_kexec_alloc_and_setup_fdt()")
      Link: https://lore.kernel.org/r/20211210010121.101823-1-nramas@linux.microsoft.comSigned-off-by: default avatarWill Deacon <will@kernel.org>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      9c5d89bc
    • David Howells's avatar
      afs: Fix mmap · 1744a22a
      David Howells authored
      Fix afs_add_open_map() to check that the vnode isn't already on the list
      when it adds it.  It's possible that afs_drop_open_mmap() decremented
      the cb_nr_mmap counter, but hadn't yet got into the locked section to
      remove it.
      
      Also vnode->cb_mmap_link should be initialised, so fix that too.
      
      Fixes: 6e0e99d5 ("afs: Fix mmap coherency vs 3rd-party changes")
      Reported-by: kafs-testing+fedora34_64checkkafs-build-300@auristor.com
      Suggested-by: default avatarMarc Dionne <marc.dionne@auristor.com>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Tested-by: kafs-testing+fedora34_64checkkafs-build-300@auristor.com
      cc: linux-afs@lists.infradead.org
      Link: https://lore.kernel.org/r/686465.1639435380@warthog.procyon.org.uk/ # v1
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1744a22a
    • Eric Dumazet's avatar
      sit: do not call ipip6_dev_free() from sit_init_net() · e28587cc
      Eric Dumazet authored
      ipip6_dev_free is sit dev->priv_destructor, already called
      by register_netdevice() if something goes wrong.
      
      Alternative would be to make ipip6_dev_free() robust against
      multiple invocations, but other drivers do not implement this
      strategy.
      
      syzbot reported:
      
      dst_release underflow
      WARNING: CPU: 0 PID: 5059 at net/core/dst.c:173 dst_release+0xd8/0xe0 net/core/dst.c:173
      Modules linked in:
      CPU: 1 PID: 5059 Comm: syz-executor.4 Not tainted 5.16.0-rc5-syzkaller #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      RIP: 0010:dst_release+0xd8/0xe0 net/core/dst.c:173
      Code: 4c 89 f2 89 d9 31 c0 5b 41 5e 5d e9 da d5 44 f9 e8 1d 90 5f f9 c6 05 87 48 c6 05 01 48 c7 c7 80 44 99 8b 31 c0 e8 e8 67 29 f9 <0f> 0b eb 85 0f 1f 40 00 53 48 89 fb e8 f7 8f 5f f9 48 83 c3 a8 48
      RSP: 0018:ffffc9000aa5faa0 EFLAGS: 00010246
      RAX: d6894a925dd15a00 RBX: 00000000ffffffff RCX: 0000000000040000
      RDX: ffffc90005e19000 RSI: 000000000003ffff RDI: 0000000000040000
      RBP: 0000000000000000 R08: ffffffff816a1f42 R09: ffffed1017344f2c
      R10: ffffed1017344f2c R11: 0000000000000000 R12: 0000607f462b1358
      R13: 1ffffffff1bfd305 R14: ffffe8ffffcb1358 R15: dffffc0000000000
      FS:  00007f66c71a2700(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007f88aaed5058 CR3: 0000000023e0f000 CR4: 00000000003506f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       <TASK>
       dst_cache_destroy+0x107/0x1e0 net/core/dst_cache.c:160
       ipip6_dev_free net/ipv6/sit.c:1414 [inline]
       sit_init_net+0x229/0x550 net/ipv6/sit.c:1936
       ops_init+0x313/0x430 net/core/net_namespace.c:140
       setup_net+0x35b/0x9d0 net/core/net_namespace.c:326
       copy_net_ns+0x359/0x5c0 net/core/net_namespace.c:470
       create_new_namespaces+0x4ce/0xa00 kernel/nsproxy.c:110
       unshare_nsproxy_namespaces+0x11e/0x180 kernel/nsproxy.c:226
       ksys_unshare+0x57d/0xb50 kernel/fork.c:3075
       __do_sys_unshare kernel/fork.c:3146 [inline]
       __se_sys_unshare kernel/fork.c:3144 [inline]
       __x64_sys_unshare+0x34/0x40 kernel/fork.c:3144
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      RIP: 0033:0x7f66c882ce99
      Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
      RSP: 002b:00007f66c71a2168 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
      RAX: ffffffffffffffda RBX: 00007f66c893ff60 RCX: 00007f66c882ce99
      RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000048040200
      RBP: 00007f66c8886ff1 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
      R13: 00007fff6634832f R14: 00007f66c71a2300 R15: 0000000000022000
       </TASK>
      
      Fixes: cf124db5 ("net: Fix inconsistent teardown and release of private netdev state.")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Link: https://lore.kernel.org/r/20211216111741.1387540-1-eric.dumazet@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      e28587cc
    • Florian Fainelli's avatar
      net: systemport: Add global locking for descriptor lifecycle · 8b8e6e78
      Florian Fainelli authored
      The descriptor list is a shared resource across all of the transmit queues, and
      the locking mechanism used today only protects concurrency across a given
      transmit queue between the transmit and reclaiming. This creates an opportunity
      for the SYSTEMPORT hardware to work on corrupted descriptors if we have
      multiple producers at once which is the case when using multiple transmit
      queues.
      
      This was particularly noticeable when using multiple flows/transmit queues and
      it showed up in interesting ways in that UDP packets would get a correct UDP
      header checksum being calculated over an incorrect packet length. Similarly TCP
      packets would get an equally correct checksum computed by the hardware over an
      incorrect packet length.
      
      The SYSTEMPORT hardware maintains an internal descriptor list that it re-arranges
      when the driver produces a new descriptor anytime it writes to the
      WRITE_PORT_{HI,LO} registers, there is however some delay in the hardware to
      re-organize its descriptors and it is possible that concurrent TX queues
      eventually break this internal allocation scheme to the point where the
      length/status part of the descriptor gets used for an incorrect data buffer.
      
      The fix is to impose a global serialization for all TX queues in the short
      section where we are writing to the WRITE_PORT_{HI,LO} registers which solves
      the corruption even with multiple concurrent TX queues being used.
      
      Fixes: 80105bef ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Link: https://lore.kernel.org/r/20211215202450.4086240-1-f.fainelli@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      8b8e6e78
    • D. Wythe's avatar
      net/smc: Prevent smc_release() from long blocking · 5c15b312
      D. Wythe authored
      In nginx/wrk benchmark, there's a hung problem with high probability
      on case likes that: (client will last several minutes to exit)
      
      server: smc_run nginx
      
      client: smc_run wrk -c 10000 -t 1 http://server
      
      Client hangs with the following backtrace:
      
      0 [ffffa7ce8Of3bbf8] __schedule at ffffffff9f9eOd5f
      1 [ffffa7ce8Of3bc88] schedule at ffffffff9f9eløe6
      2 [ffffa7ce8Of3bcaO] schedule_timeout at ffffffff9f9e3f3c
      3 [ffffa7ce8Of3bd2O] wait_for_common at ffffffff9f9el9de
      4 [ffffa7ce8Of3bd8O] __flush_work at ffffffff9fOfeOl3
      5 [ffffa7ce8øf3bdfO] smc_release at ffffffffcO697d24 [smc]
      6 [ffffa7ce8Of3be2O] __sock_release at ffffffff9f8O2e2d
      7 [ffffa7ce8Of3be4ø] sock_close at ffffffff9f8ø2ebl
      8 [ffffa7ce8øf3be48] __fput at ffffffff9f334f93
      9 [ffffa7ce8Of3be78] task_work_run at ffffffff9flOlff5
      10 [ffffa7ce8Of3beaO] do_exit at ffffffff9fOe5Ol2
      11 [ffffa7ce8Of3bflO] do_group_exit at ffffffff9fOe592a
      12 [ffffa7ce8Of3bf38] __x64_sys_exit_group at ffffffff9fOe5994
      13 [ffffa7ce8Of3bf4O] do_syscall_64 at ffffffff9f9d4373
      14 [ffffa7ce8Of3bfsO] entry_SYSCALL_64_after_hwframe at ffffffff9fa0007c
      
      This issue dues to flush_work(), which is used to wait for
      smc_connect_work() to finish in smc_release(). Once lots of
      smc_connect_work() was pending or all executing work dangling,
      smc_release() has to block until one worker comes to free, which
      is equivalent to wait another smc_connnect_work() to finish.
      
      In order to fix this, There are two changes:
      
      1. For those idle smc_connect_work(), cancel it from the workqueue; for
         executing smc_connect_work(), waiting for it to finish. For that
         purpose, replace flush_work() with cancel_work_sync().
      
      2. Since smc_connect() hold a reference for passive closing, if
         smc_connect_work() has been cancelled, release the reference.
      
      Fixes: 24ac3a08 ("net/smc: rebuild nonblocking connect")
      Reported-by: default avatarTony Lu <tonylu@linux.alibaba.com>
      Tested-by: default avatarDust Li <dust.li@linux.alibaba.com>
      Reviewed-by: default avatarDust Li <dust.li@linux.alibaba.com>
      Reviewed-by: default avatarTony Lu <tonylu@linux.alibaba.com>
      Signed-off-by: default avatarD. Wythe <alibuda@linux.alibaba.com>
      Acked-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
      Link: https://lore.kernel.org/r/1639571361-101128-1-git-send-email-alibuda@linux.alibaba.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      5c15b312