1. 07 Dec, 2021 15 commits
  2. 04 Dec, 2021 2 commits
    • Lee Jones's avatar
      net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero · 2be6d4d1
      Lee Jones authored
      Currently, due to the sequential use of min_t() and clamp_t() macros,
      in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is not set, the logic
      sets tx_max to 0.  This is then used to allocate the data area of the
      SKB requested later in cdc_ncm_fill_tx_frame().
      
      This does not cause an issue presently because when memory is
      allocated during initialisation phase of SKB creation, more memory
      (512b) is allocated than is required for the SKB headers alone (320b),
      leaving some space (512b - 320b = 192b) for CDC data (172b).
      
      However, if more elements (for example 3 x u64 = [24b]) were added to
      one of the SKB header structs, say 'struct skb_shared_info',
      increasing its original size (320b [320b aligned]) to something larger
      (344b [384b aligned]), then suddenly the CDC data (172b) no longer
      fits in the spare SKB data area (512b - 384b = 128b).
      
      Consequently the SKB bounds checking semantics fails and panics:
      
        skbuff: skb_over_panic: text:ffffffff830a5b5f len:184 put:172   \
           head:ffff888119227c00 data:ffff888119227c00 tail:0xb8 end:0x80 dev:<NULL>
      
        ------------[ cut here ]------------
        kernel BUG at net/core/skbuff.c:110!
        RIP: 0010:skb_panic+0x14f/0x160 net/core/skbuff.c:106
        <snip>
        Call Trace:
         <IRQ>
         skb_over_panic+0x2c/0x30 net/core/skbuff.c:115
         skb_put+0x205/0x210 net/core/skbuff.c:1877
         skb_put_zero include/linux/skbuff.h:2270 [inline]
         cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1116 [inline]
         cdc_ncm_fill_tx_frame+0x127f/0x3d50 drivers/net/usb/cdc_ncm.c:1293
         cdc_ncm_tx_fixup+0x98/0xf0 drivers/net/usb/cdc_ncm.c:1514
      
      By overriding the max value with the default CDC_NCM_NTB_MAX_SIZE_TX
      when not offered through the system provided params, we ensure enough
      data space is allocated to handle the CDC data, meaning no crash will
      occur.
      
      Cc: Oliver Neukum <oliver@neukum.org>
      Fixes: 289507d3 ("net: cdc_ncm: use sysfs for rx/tx aggregation tuning")
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Reviewed-by: default avatarBjørn Mork <bjorn@mork.no>
      Link: https://lore.kernel.org/r/20211202143437.1411410-1-lee.jones@linaro.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      2be6d4d1
    • Manish Chopra's avatar
      qede: validate non LSO skb length · 8e227b19
      Manish Chopra authored
      Although it is unlikely that stack could transmit a non LSO
      skb with length > MTU, however in some cases or environment such
      occurrences actually resulted into firmware asserts due to packet
      length being greater than the max supported by the device (~9700B).
      
      This patch adds the safeguard for such odd cases to avoid firmware
      asserts.
      
      v2: Added "Fixes" tag with one of the initial driver commit
          which enabled the TX traffic actually (as this was probably
          day1 issue which was discovered recently by some customer
          environment)
      
      Fixes: a2ec6172 ("qede: Add support for link")
      Signed-off-by: default avatarManish Chopra <manishc@marvell.com>
      Signed-off-by: default avatarAlok Prasad <palok@marvell.com>
      Signed-off-by: default avatarPrabhakar Kushwaha <pkushwaha@marvell.com>
      Signed-off-by: default avatarAriel Elior <aelior@marvell.com>
      Link: https://lore.kernel.org/r/20211203174413.13090-1-manishc@marvell.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      8e227b19
  3. 03 Dec, 2021 10 commits
    • Dan Carpenter's avatar
      net: altera: set a couple error code in probe() · badd7857
      Dan Carpenter authored
      There are two error paths which accidentally return success instead of
      a negative error code.
      
      Fixes: bbd2190c ("Altera TSE: Add main and header file for Altera Ethernet Driver")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      badd7857
    • Jiasheng Jiang's avatar
      net: bcm4908: Handle dma_set_coherent_mask error codes · 128f6ec9
      Jiasheng Jiang authored
      The return value of dma_set_coherent_mask() is not always 0.
      To catch the exception in case that dma is not support the mask.
      
      Fixes: 9d61d138 ("net: broadcom: rename BCM4908 driver & update DT binding")
      Signed-off-by: default avatarJiasheng Jiang <jiasheng@iscas.ac.cn>
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      128f6ec9
    • Li Zhijian's avatar
      selftests: net/fcnal-test.sh: add exit code · 0f8a3b48
      Li Zhijian authored
      Previously, the selftest framework always treats it as *ok* even though
      some of them are failed actually. That's because the script always
      returns 0.
      
      It supports PASS/FAIL/SKIP exit code now.
      
      CC: Philip Li <philip.li@intel.com>
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Signed-off-by: default avatarLi Zhijian <zhijianx.li@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0f8a3b48
    • Eric Dumazet's avatar
      bonding: make tx_rebalance_counter an atomic · dac8e00f
      Eric Dumazet authored
      KCSAN reported a data-race [1] around tx_rebalance_counter
      which can be accessed from different contexts, without
      the protection of a lock/mutex.
      
      [1]
      BUG: KCSAN: data-race in bond_alb_init_slave / bond_alb_monitor
      
      write to 0xffff888157e8ca24 of 4 bytes by task 7075 on cpu 0:
       bond_alb_init_slave+0x713/0x860 drivers/net/bonding/bond_alb.c:1613
       bond_enslave+0xd94/0x3010 drivers/net/bonding/bond_main.c:1949
       do_set_master net/core/rtnetlink.c:2521 [inline]
       __rtnl_newlink net/core/rtnetlink.c:3475 [inline]
       rtnl_newlink+0x1298/0x13b0 net/core/rtnetlink.c:3506
       rtnetlink_rcv_msg+0x745/0x7e0 net/core/rtnetlink.c:5571
       netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2491
       rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5589
       netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
       netlink_unicast+0x5fc/0x6c0 net/netlink/af_netlink.c:1345
       netlink_sendmsg+0x6e1/0x7d0 net/netlink/af_netlink.c:1916
       sock_sendmsg_nosec net/socket.c:704 [inline]
       sock_sendmsg net/socket.c:724 [inline]
       ____sys_sendmsg+0x39a/0x510 net/socket.c:2409
       ___sys_sendmsg net/socket.c:2463 [inline]
       __sys_sendmsg+0x195/0x230 net/socket.c:2492
       __do_sys_sendmsg net/socket.c:2501 [inline]
       __se_sys_sendmsg net/socket.c:2499 [inline]
       __x64_sys_sendmsg+0x42/0x50 net/socket.c:2499
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      read to 0xffff888157e8ca24 of 4 bytes by task 1082 on cpu 1:
       bond_alb_monitor+0x8f/0xc00 drivers/net/bonding/bond_alb.c:1511
       process_one_work+0x3fc/0x980 kernel/workqueue.c:2298
       worker_thread+0x616/0xa70 kernel/workqueue.c:2445
       kthread+0x2c7/0x2e0 kernel/kthread.c:327
       ret_from_fork+0x1f/0x30
      
      value changed: 0x00000001 -> 0x00000064
      
      Reported by Kernel Concurrency Sanitizer on:
      CPU: 1 PID: 1082 Comm: kworker/u4:3 Not tainted 5.16.0-rc3-syzkaller #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Workqueue: bond1 bond_alb_monitor
      
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dac8e00f
    • Eric Dumazet's avatar
      tcp: fix another uninit-value (sk_rx_queue_mapping) · 03cfda4f
      Eric Dumazet authored
      KMSAN is still not happy [1].
      
      I missed that passive connections do not inherit their
      sk_rx_queue_mapping values from the request socket,
      but instead tcp_child_process() is calling
      sk_mark_napi_id(child, skb)
      
      We have many sk_mark_napi_id() callers, so I am providing
      a new helper, forcing the setting sk_rx_queue_mapping
      and sk_napi_id.
      
      Note that we had no KMSAN report for sk_napi_id because
      passive connections got a copy of this field from the listener.
      sk_rx_queue_mapping in the other hand is inside the
      sk_dontcopy_begin/sk_dontcopy_end so sk_clone_lock()
      leaves this field uninitialized.
      
      We might remove dead code populating req->sk_rx_queue_mapping
      in the future.
      
      [1]
      
      BUG: KMSAN: uninit-value in __sk_rx_queue_set include/net/sock.h:1924 [inline]
      BUG: KMSAN: uninit-value in sk_rx_queue_update include/net/sock.h:1938 [inline]
      BUG: KMSAN: uninit-value in sk_mark_napi_id include/net/busy_poll.h:136 [inline]
      BUG: KMSAN: uninit-value in tcp_child_process+0xb42/0x1050 net/ipv4/tcp_minisocks.c:833
       __sk_rx_queue_set include/net/sock.h:1924 [inline]
       sk_rx_queue_update include/net/sock.h:1938 [inline]
       sk_mark_napi_id include/net/busy_poll.h:136 [inline]
       tcp_child_process+0xb42/0x1050 net/ipv4/tcp_minisocks.c:833
       tcp_v4_rcv+0x3d83/0x4ed0 net/ipv4/tcp_ipv4.c:2066
       ip_protocol_deliver_rcu+0x760/0x10b0 net/ipv4/ip_input.c:204
       ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
       NF_HOOK include/linux/netfilter.h:307 [inline]
       ip_local_deliver+0x584/0x8c0 net/ipv4/ip_input.c:252
       dst_input include/net/dst.h:460 [inline]
       ip_sublist_rcv_finish net/ipv4/ip_input.c:551 [inline]
       ip_list_rcv_finish net/ipv4/ip_input.c:601 [inline]
       ip_sublist_rcv+0x11fd/0x1520 net/ipv4/ip_input.c:609
       ip_list_rcv+0x95f/0x9a0 net/ipv4/ip_input.c:644
       __netif_receive_skb_list_ptype net/core/dev.c:5505 [inline]
       __netif_receive_skb_list_core+0xe34/0x1240 net/core/dev.c:5553
       __netif_receive_skb_list+0x7fc/0x960 net/core/dev.c:5605
       netif_receive_skb_list_internal+0x868/0xde0 net/core/dev.c:5696
       gro_normal_list net/core/dev.c:5850 [inline]
       napi_complete_done+0x579/0xdd0 net/core/dev.c:6587
       virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline]
       virtnet_poll+0x17b6/0x2350 drivers/net/virtio_net.c:1557
       __napi_poll+0x14e/0xbc0 net/core/dev.c:7020
       napi_poll net/core/dev.c:7087 [inline]
       net_rx_action+0x824/0x1880 net/core/dev.c:7174
       __do_softirq+0x1fe/0x7eb kernel/softirq.c:558
       run_ksoftirqd+0x33/0x50 kernel/softirq.c:920
       smpboot_thread_fn+0x616/0xbf0 kernel/smpboot.c:164
       kthread+0x721/0x850 kernel/kthread.c:327
       ret_from_fork+0x1f/0x30
      
      Uninit was created at:
       __alloc_pages+0xbc7/0x10a0 mm/page_alloc.c:5409
       alloc_pages+0x8a5/0xb80
       alloc_slab_page mm/slub.c:1810 [inline]
       allocate_slab+0x287/0x1c20 mm/slub.c:1947
       new_slab mm/slub.c:2010 [inline]
       ___slab_alloc+0xbdf/0x1e90 mm/slub.c:3039
       __slab_alloc mm/slub.c:3126 [inline]
       slab_alloc_node mm/slub.c:3217 [inline]
       slab_alloc mm/slub.c:3259 [inline]
       kmem_cache_alloc+0xbb3/0x11c0 mm/slub.c:3264
       sk_prot_alloc+0xeb/0x570 net/core/sock.c:1914
       sk_clone_lock+0xd6/0x1940 net/core/sock.c:2118
       inet_csk_clone_lock+0x8d/0x6a0 net/ipv4/inet_connection_sock.c:956
       tcp_create_openreq_child+0xb1/0x1ef0 net/ipv4/tcp_minisocks.c:453
       tcp_v4_syn_recv_sock+0x268/0x2710 net/ipv4/tcp_ipv4.c:1563
       tcp_check_req+0x207c/0x2a30 net/ipv4/tcp_minisocks.c:765
       tcp_v4_rcv+0x36f5/0x4ed0 net/ipv4/tcp_ipv4.c:2047
       ip_protocol_deliver_rcu+0x760/0x10b0 net/ipv4/ip_input.c:204
       ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
       NF_HOOK include/linux/netfilter.h:307 [inline]
       ip_local_deliver+0x584/0x8c0 net/ipv4/ip_input.c:252
       dst_input include/net/dst.h:460 [inline]
       ip_sublist_rcv_finish net/ipv4/ip_input.c:551 [inline]
       ip_list_rcv_finish net/ipv4/ip_input.c:601 [inline]
       ip_sublist_rcv+0x11fd/0x1520 net/ipv4/ip_input.c:609
       ip_list_rcv+0x95f/0x9a0 net/ipv4/ip_input.c:644
       __netif_receive_skb_list_ptype net/core/dev.c:5505 [inline]
       __netif_receive_skb_list_core+0xe34/0x1240 net/core/dev.c:5553
       __netif_receive_skb_list+0x7fc/0x960 net/core/dev.c:5605
       netif_receive_skb_list_internal+0x868/0xde0 net/core/dev.c:5696
       gro_normal_list net/core/dev.c:5850 [inline]
       napi_complete_done+0x579/0xdd0 net/core/dev.c:6587
       virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline]
       virtnet_poll+0x17b6/0x2350 drivers/net/virtio_net.c:1557
       __napi_poll+0x14e/0xbc0 net/core/dev.c:7020
       napi_poll net/core/dev.c:7087 [inline]
       net_rx_action+0x824/0x1880 net/core/dev.c:7174
       __do_softirq+0x1fe/0x7eb kernel/softirq.c:558
      
      Fixes: 342159ee ("net: avoid dirtying sk->sk_rx_queue_mapping")
      Fixes: a37a0ee4 ("net: avoid uninit-value from tcp_conn_request")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Tested-by: default avatarAlexander Potapenko <glider@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      03cfda4f
    • Eric Dumazet's avatar
      inet: use #ifdef CONFIG_SOCK_RX_QUEUE_MAPPING consistently · a9418924
      Eric Dumazet authored
      Since commit 4e1beecc ("net/sock: Add kernel config
      SOCK_RX_QUEUE_MAPPING"),
      sk_rx_queue_mapping access is guarded by CONFIG_SOCK_RX_QUEUE_MAPPING.
      
      Fixes: 54b92e84 ("tcp: Migrate TCP_ESTABLISHED/TCP_SYN_RECV sockets in accept queues.")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Kuniyuki Iwashima <kuniyu@amazon.co.jp>
      Cc: Daniel Borkmann <daniel@iogearbox.net>
      Cc: Martin KaFai Lau <kafai@fb.com>
      Cc: Tariq Toukan <tariqt@nvidia.com>
      Acked-by: default avatarKuniyuki Iwashima <kuniyu@amazon.co.jp>
      Reviewed-by: default avatarTariq Toukan <tariqt@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a9418924
    • Li Zhijian's avatar
      selftests/tc-testing: Fix cannot create /sys/bus/netdevsim/new_device: Directory nonexistent · db925bca
      Li Zhijian authored
      Install netdevsim to provide /sys/bus/netdevsim/new_device interface.
      
      It helps to fix:
       # ok 97 9a7d - Change ETS strict band without quantum # skipped - skipped - previous setup failed 11 ce7d
       #
       #
       # -----> prepare stage *** Could not execute: "echo "1 1 4" > /sys/bus/netdevsim/new_device"
       #
       # -----> prepare stage *** Error message: "/bin/sh: 1: cannot create /sys/bus/netdevsim/new_device: Directory nonexistent
       # "
       #
       # -----> prepare stage *** Aborting test run.
       #
       #
       # <_io.BufferedReader name=5> *** stdout ***
       #
      Signed-off-by: default avatarLi Zhijian <zhijianx.li@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      db925bca
    • Li Zhijian's avatar
      selftests/tc-testing: add missing config · a8c9505c
      Li Zhijian authored
      qdiscs/fq_pie requires CONFIG_NET_SCH_FQ_PIE, otherwise tc will fail
      to create a fq_pie qdisc.
      
      It fixes following issue:
       # not ok 57 83be - Create FQ-PIE with invalid number of flows
       #       Command exited with 2, expected 0
       # Error: Specified qdisc not found.
      Signed-off-by: default avatarLi Zhijian <zhijianx.li@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a8c9505c
    • Li Zhijian's avatar
      selftests/tc-testing: add exit code · 96f38967
      Li Zhijian authored
      Mark the summary result as FAIL to prevent from confusing the selftest
      framework if some of them are failed.
      
      Previously, the selftest framework always treats it as *ok* even though
      some of them are failed actually. That's because the script tdc.sh always
      return 0.
      
       # All test results:
       #
       # 1..97
       # ok 1 83be - Create FQ-PIE with invalid number of flows
       # ok 2 8b6e - Create RED with no flags
      [...snip]
       # ok 6 5f15 - Create RED with flags ECN, harddrop
       # ok 7 53e8 - Create RED with flags ECN, nodrop
       # ok 8 d091 - Fail to create RED with only nodrop flag
       # ok 9 af8e - Create RED with flags ECN, nodrop, harddrop
       # not ok 10 ce7d - Add mq Qdisc to multi-queue device (4 queues)
       #       Could not match regex pattern. Verify command output:
       # qdisc mq 1: root
       # qdisc fq_codel 0: parent 1:4 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
       # qdisc fq_codel 0: parent 1:3 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
      [...snip]
       # ok 96 6979 - Change quantum of a strict ETS band
       # ok 97 9a7d - Change ETS strict band without quantum
       #
       #
       #
       #
       ok 1 selftests: tc-testing: tdc.sh <<< summary result
      
      CC: Philip Li <philip.li@intel.com>
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Signed-off-by: default avatarLi Zhijian <zhijianx.li@intel.com>
      Acked-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      96f38967
    • Peilin Ye's avatar
      selftests/fib_tests: Rework fib_rp_filter_test() · f6071e5e
      Peilin Ye authored
      Currently rp_filter tests in fib_tests.sh:fib_rp_filter_test() are
      failing.  ping sockets are bound to dummy1 using the "-I" option
      (SO_BINDTODEVICE), but socket lookup is failing when receiving ping
      replies, since the routing table thinks they belong to dummy0.
      
      For example, suppose ping is using a SOCK_RAW socket for ICMP messages.
      When receiving ping replies, in __raw_v4_lookup(), sk->sk_bound_dev_if
      is 3 (dummy1), but dif (skb_rtable(skb)->rt_iif) says 2 (dummy0), so the
      raw_sk_bound_dev_eq() check fails.  Similar things happen in
      ping_lookup() for SOCK_DGRAM sockets.
      
      These tests used to pass due to a bug [1] in iputils, where "ping -I"
      actually did not bind ICMP message sockets to device.  The bug has been
      fixed by iputils commit f455fee41c07 ("ping: also bind the ICMP socket
      to the specific device") in 2016, which is why our rp_filter tests
      started to fail.  See [2] .
      
      Fixing the tests while keeping everything in one netns turns out to be
      nontrivial.  Rework the tests and build the following topology:
      
       ┌─────────────────────────────┐    ┌─────────────────────────────┐
       │  network namespace 1 (ns1)  │    │  network namespace 2 (ns2)  │
       │                             │    │                             │
       │  ┌────┐     ┌─────┐         │    │  ┌─────┐            ┌────┐  │
       │  │ lo │<───>│veth1│<────────┼────┼─>│veth2│<──────────>│ lo │  │
       │  └────┘     ├─────┴──────┐  │    │  ├─────┴──────┐     └────┘  │
       │             │192.0.2.1/24│  │    │  │192.0.2.1/24│             │
       │             └────────────┘  │    │  └────────────┘             │
       └─────────────────────────────┘    └─────────────────────────────┘
      
      Consider sending an ICMP_ECHO packet A in ns2.  Both source and
      destination IP addresses are 192.0.2.1, and we use strict mode rp_filter
      in both ns1 and ns2:
      
        1. A is routed to lo since its destination IP address is one of ns2's
           local addresses (veth2);
        2. A is redirected from lo's egress to veth2's egress using mirred;
        3. A arrives at veth1's ingress in ns1;
        4. A is redirected from veth1's ingress to lo's ingress, again, using
           mirred;
        5. In __fib_validate_source(), fib_info_nh_uses_dev() returns false,
           since A was received on lo, but reverse path lookup says veth1;
        6. However A is not dropped since we have relaxed this check for lo in
           commit 66f82095 ("fib: relax source validation check for loopback
           packets");
      
      Making sure A is not dropped here in this corner case is the whole point
      of having this test.
      
        7. As A reaches the ICMP layer, an ICMP_ECHOREPLY packet, B, is
           generated;
        8. Similarly, B is redirected from lo's egress to veth1's egress (in
           ns1), then redirected once again from veth2's ingress to lo's
           ingress (in ns2), using mirred.
      
      Also test "ping 127.0.0.1" from ns2.  It does not trigger the relaxed
      check in __fib_validate_source(), but just to make sure the topology
      works with loopback addresses.
      
      Tested with ping from iputils 20210722-41-gf9fb573:
      
      $ ./fib_tests.sh -t rp_filter
      
      IPv4 rp_filter tests
          TEST: rp_filter passes local packets		[ OK ]
          TEST: rp_filter passes loopback packets		[ OK ]
      
      [1] https://github.com/iputils/iputils/issues/55
      [2] https://github.com/iputils/iputils/commit/f455fee41c077d4b700a473b2f5b3487b8febc1dReported-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Fixes: adb701d6 ("selftests: add a test case for rp_filter")
      Reviewed-by: default avatarCong Wang <cong.wang@bytedance.com>
      Signed-off-by: default avatarPeilin Ye <peilin.ye@bytedance.com>
      Acked-by: default avatarDavid Ahern <dsahern@kernel.org>
      Link: https://lore.kernel.org/r/20211201004720.6357-1-yepeilin.cs@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      f6071e5e
  4. 02 Dec, 2021 13 commits
    • Linus Torvalds's avatar
      Merge tag 'net-5.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · a51e3ac4
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Including fixes from wireless, and wireguard.
      
        Mostly scattered driver changes this week, with one big clump in
        mv88e6xxx. Nothing of note, really.
      
        Current release - regressions:
      
         - smc: keep smc_close_final()'s error code during active close
      
        Current release - new code bugs:
      
         - iwlwifi: various static checker fixes (int overflow, leaks, missing
           error codes)
      
         - rtw89: fix size of firmware header before transfer, avoid crash
      
         - mt76: fix timestamp check in tx_status; fix pktid leak;
      
         - mscc: ocelot: fix missing unlock on error in ocelot_hwstamp_set()
      
        Previous releases - regressions:
      
         - smc: fix list corruption in smc_lgr_cleanup_early
      
         - ipv4: convert fib_num_tclassid_users to atomic_t
      
        Previous releases - always broken:
      
         - tls: fix authentication failure in CCM mode
      
         - vrf: reset IPCB/IP6CB when processing outbound pkts, prevent
           incorrect processing
      
         - dsa: mv88e6xxx: fixes for various device errata
      
         - rds: correct socket tunable error in rds_tcp_tune()
      
         - ipv6: fix memory leak in fib6_rule_suppress
      
         - wireguard: reset peer src endpoint when netns exits
      
         - wireguard: improve resilience to DoS around incoming handshakes
      
         - tcp: fix page frag corruption on page fault which involves TCP
      
         - mpls: fix missing attributes in delete notifications
      
         - mt7915: fix NULL pointer dereference with ad-hoc mode
      
        Misc:
      
         - rt2x00: be more lenient about EPROTO errors during start
      
         - mlx4_en: update reported link modes for 1/10G"
      
      * tag 'net-5.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (85 commits)
        net: dsa: b53: Add SPI ID table
        gro: Fix inconsistent indenting
        selftests: net: Correct case name
        net/rds: correct socket tunable error in rds_tcp_tune()
        mctp: Don't let RTM_DELROUTE delete local routes
        net/smc: Keep smc_close_final rc during active close
        ibmvnic: drop bad optimization in reuse_tx_pools()
        ibmvnic: drop bad optimization in reuse_rx_pools()
        net/smc: fix wrong list_del in smc_lgr_cleanup_early
        Fix Comment of ETH_P_802_3_MIN
        ethernet: aquantia: Try MAC address from device tree
        ipv4: convert fib_num_tclassid_users to atomic_t
        net: avoid uninit-value from tcp_conn_request
        net: annotate data-races on txq->xmit_lock_owner
        octeontx2-af: Fix a memleak bug in rvu_mbox_init()
        net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
        vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
        net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
        net: dsa: mv88e6xxx: Link in pcs_get_state() if AN is bypassed
        net: dsa: mv88e6xxx: Fix inband AN for 2500base-x on 88E6393X family
        ...
      a51e3ac4
    • Linus Torvalds's avatar
      Merge tag 'trace-v5.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 2b2c0f24
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
       "Three tracing fixes:
      
         - Allow compares of strings when using signed and unsigned characters
      
         - Fix kmemleak false positive for histogram entries
      
         - Handle negative numbers for user defined kretprobe data sizes"
      
      * tag 'trace-v5.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        kprobes: Limit max data_size of the kretprobe instances
        tracing: Fix a kmemleak false positive in tracing_map
        tracing/histograms: String compares should not care about signed values
      2b2c0f24
    • Linus Torvalds's avatar
      Merge tag 'for-linus-5.16-2' of git://github.com/cminyard/linux-ipmi · df365887
      Linus Torvalds authored
      Pull IPMI fixes from Corey Minyard:
       "Some changes that went in 5.16 had issues. When working on the design
        a piece was redesigned and things got missed. And the message type was
        not being initialized when it was allocated, resulting in crashes.
      
        In addition, the IPMI driver has had a shutdown issue where it could
        still have an item in a system workqueue after it had been shutdown.
        Move to a private workqueue to avoid that problem"
      
      * tag 'for-linus-5.16-2' of git://github.com/cminyard/linux-ipmi:
        ipmi:ipmb: Fix unknown command response
        ipmi: fix IPMI_SMI_MSG_TYPE_IPMB_DIRECT response length checking
        ipmi: fix oob access due to uninit smi_msg type
        ipmi: msghandler: Make symbol 'remove_work_wq' static
        ipmi: Move remove_work to dedicated workqueue
      df365887
    • Florian Fainelli's avatar
      net: dsa: b53: Add SPI ID table · 88362ebf
      Florian Fainelli authored
      Currently autoloading for SPI devices does not use the DT ID table, it
      uses SPI modalises. Supporting OF modalises is going to be difficult if
      not impractical, an attempt was made but has been reverted, so ensure
      that module autoloading works for this driver by adding an id_table
      listing the SPI IDs for everything.
      
      Fixes: 96c8395e ("spi: Revert modalias changes")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      88362ebf
    • Jiapeng Chong's avatar
      gro: Fix inconsistent indenting · 1ebb87cc
      Jiapeng Chong authored
      Eliminate the follow smatch warning:
      
      net/ipv6/ip6_offload.c:249 ipv6_gro_receive() warn: inconsistent
      indenting.
      Reported-by: default avatarAbaci Robot <abaci@linux.alibaba.com>
      Signed-off-by: default avatarJiapeng Chong <jiapeng.chong@linux.alibaba.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1ebb87cc
    • Li Zhijian's avatar
      selftests: net: Correct case name · a05431b2
      Li Zhijian authored
      ipv6_addr_bind/ipv4_addr_bind are function names. Previously, bind test
      would not be run by default due to the wrong case names
      
      Fixes: 34d0302a ("selftests: Add ipv6 address bind tests to fcnal-test")
      Fixes: 75b2b2b3 ("selftests: Add ipv4 address bind tests to fcnal-test")
      Signed-off-by: default avatarLi Zhijian <lizhijian@cn.fujitsu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a05431b2
    • William Kucharski's avatar
      net/rds: correct socket tunable error in rds_tcp_tune() · 19f36edf
      William Kucharski authored
      Correct an error where setting /proc/sys/net/rds/tcp/rds_tcp_rcvbuf would
      instead modify the socket's sk_sndbuf and would leave sk_rcvbuf untouched.
      
      Fixes: c6a58ffe ("RDS: TCP: Add sysctl tunables for sndbuf/rcvbuf on rds-tcp socket")
      Signed-off-by: default avatarWilliam Kucharski <william.kucharski@oracle.com>
      Acked-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      19f36edf
    • Matt Johnston's avatar
      mctp: Don't let RTM_DELROUTE delete local routes · 76d00160
      Matt Johnston authored
      We need to test against the existing route type, not
      the rtm_type in the netlink request.
      
      Fixes: 83f0a0b7 ("mctp: Specify route types, require rtm_type in RTM_*ROUTE messages")
      Signed-off-by: default avatarMatt Johnston <matt@codeconstruct.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      76d00160
    • Tony Lu's avatar
      net/smc: Keep smc_close_final rc during active close · 00e158fb
      Tony Lu authored
      When smc_close_final() returns error, the return code overwrites by
      kernel_sock_shutdown() in smc_close_active(). The return code of
      smc_close_final() is more important than kernel_sock_shutdown(), and it
      will pass to userspace directly.
      
      Fix it by keeping both return codes, if smc_close_final() raises an
      error, return it or kernel_sock_shutdown()'s.
      
      Link: https://lore.kernel.org/linux-s390/1f67548e-cbf6-0dce-82b5-10288a4583bd@linux.ibm.com/
      Fixes: 606a63c9 ("net/smc: Ensure the active closing peer first closes clcsock")
      Suggested-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
      Signed-off-by: default avatarTony Lu <tonylu@linux.alibaba.com>
      Reviewed-by: default avatarWen Gu <guwen@linux.alibaba.com>
      Acked-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      00e158fb
    • Sukadev Bhattiprolu's avatar
      ibmvnic: drop bad optimization in reuse_tx_pools() · 5b085601
      Sukadev Bhattiprolu authored
      When trying to decide whether or not reuse existing rx/tx pools
      we tried to allow a range of values for the pool parameters rather
      than exact matches. This was intended to reuse the resources for
      instance when switching between two VIO servers with different
      default parameters.
      
      But this optimization is incomplete and breaks when we try to
      change the number of queues for instance. The optimization needs
      to be updated, so drop it for now and simplify the code.
      
      Fixes: bbd80930 ("ibmvnic: Reuse tx pools when possible")
      Reported-by: default avatarDany Madden <drt@linux.ibm.com>
      Signed-off-by: default avatarSukadev Bhattiprolu <sukadev@linux.ibm.com>
      Reviewed-by: default avatarDany Madden <drt@linux.ibm.com>
      Reviewed-by: default avatarRick Lindsley <ricklind@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5b085601
    • Sukadev Bhattiprolu's avatar
      ibmvnic: drop bad optimization in reuse_rx_pools() · 0584f494
      Sukadev Bhattiprolu authored
      When trying to decide whether or not reuse existing rx/tx pools
      we tried to allow a range of values for the pool parameters rather
      than exact matches. This was intended to reuse the resources for
      instance when switching between two VIO servers with different
      default parameters.
      
      But this optimization is incomplete and breaks when we try to
      change the number of queues for instance. The optimization needs
      to be updated, so drop it for now and simplify the code.
      
      Fixes: 489de956 ("ibmvnic: Reuse rx pools when possible")
      Reported-by: default avatarDany Madden <drt@linux.ibm.com>
      Signed-off-by: default avatarSukadev Bhattiprolu <sukadev@linux.ibm.com>
      Reviewed-by: default avatarDany Madden <drt@linux.ibm.com>
      Reviewed-by: default avatarRick Lindsley <ricklind@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0584f494
    • Dust Li's avatar
      net/smc: fix wrong list_del in smc_lgr_cleanup_early · 789b6cc2
      Dust Li authored
      smc_lgr_cleanup_early() meant to delete the link
      group from the link group list, but it deleted
      the list head by mistake.
      
      This may cause memory corruption since we didn't
      remove the real link group from the list and later
      memseted the link group structure.
      We got a list corruption panic when testing:
      
      [  231.277259] list_del corruption. prev->next should be ffff8881398a8000, but was 0000000000000000
      [  231.278222] ------------[ cut here ]------------
      [  231.278726] kernel BUG at lib/list_debug.c:53!
      [  231.279326] invalid opcode: 0000 [#1] SMP NOPTI
      [  231.279803] CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.10.46+ #435
      [  231.280466] Hardware name: Alibaba Cloud ECS, BIOS 8c24b4c 04/01/2014
      [  231.281248] Workqueue: events smc_link_down_work
      [  231.281732] RIP: 0010:__list_del_entry_valid+0x70/0x90
      [  231.282258] Code: 4c 60 82 e8 7d cc 6a 00 0f 0b 48 89 fe 48 c7 c7 88 4c
      60 82 e8 6c cc 6a 00 0f 0b 48 89 fe 48 c7 c7 c0 4c 60 82 e8 5b cc 6a 00 <0f>
      0b 48 89 fe 48 c7 c7 00 4d 60 82 e8 4a cc 6a 00 0f 0b cc cc cc
      [  231.284146] RSP: 0018:ffffc90000033d58 EFLAGS: 00010292
      [  231.284685] RAX: 0000000000000054 RBX: ffff8881398a8000 RCX: 0000000000000000
      [  231.285415] RDX: 0000000000000001 RSI: ffff88813bc18040 RDI: ffff88813bc18040
      [  231.286141] RBP: ffffffff8305ad40 R08: 0000000000000003 R09: 0000000000000001
      [  231.286873] R10: ffffffff82803da0 R11: ffffc90000033b90 R12: 0000000000000001
      [  231.287606] R13: 0000000000000000 R14: ffff8881398a8000 R15: 0000000000000003
      [  231.288337] FS:  0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
      [  231.289160] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  231.289754] CR2: 0000000000e72058 CR3: 000000010fa96006 CR4: 00000000003706f0
      [  231.290485] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  231.291211] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [  231.291940] Call Trace:
      [  231.292211]  smc_lgr_terminate_sched+0x53/0xa0
      [  231.292677]  smc_switch_conns+0x75/0x6b0
      [  231.293085]  ? update_load_avg+0x1a6/0x590
      [  231.293517]  ? ttwu_do_wakeup+0x17/0x150
      [  231.293907]  ? update_load_avg+0x1a6/0x590
      [  231.294317]  ? newidle_balance+0xca/0x3d0
      [  231.294716]  smcr_link_down+0x50/0x1a0
      [  231.295090]  ? __wake_up_common_lock+0x77/0x90
      [  231.295534]  smc_link_down_work+0x46/0x60
      [  231.295933]  process_one_work+0x18b/0x350
      
      Fixes: a0a62ee1 ("net/smc: separate locks for SMCD and SMCR link group lists")
      Signed-off-by: default avatarDust Li <dust.li@linux.alibaba.com>
      Acked-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
      Reviewed-by: default avatarTony Lu <tonylu@linux.alibaba.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      789b6cc2
    • Xiayu Zhang's avatar
      Fix Comment of ETH_P_802_3_MIN · 72f6a452
      Xiayu Zhang authored
      The description of ETH_P_802_3_MIN is misleading.
      The value of EthernetType in Ethernet II frame is more than 0x0600,
      the value of Length in 802.3 frame is less than 0x0600.
      Signed-off-by: default avatarXiayu Zhang <Xiayu.Zhang@mediatek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      72f6a452