1. 14 Aug, 2018 29 commits
    • Gustavo A. R. Silva's avatar
      net: filter: mark expected switch fall-through · 4597b62f
      Gustavo A. R. Silva authored
      In preparation to enabling -Wimplicit-fallthrough, mark switch cases
      where we are expecting to fall through.
      
      Addresses-Coverity-ID: 1472592 ("Missing break in switch")
      Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4597b62f
    • Xiao Liang's avatar
      xen-netfront: fix warn message as irq device name has '/' · 21f2706b
      Xiao Liang authored
      There is a call trace generated after commit 2d408c0d(
      xen-netfront: fix queue name setting). There is no 'device/vif/xx-q0-tx' file found
      under /proc/irq/xx/.
      
      This patch only picks up device type and id as its name.
      
      With the patch, now /proc/interrupts looks like below and the warning message gone:
       70:         21          0          0          0   xen-dyn    -event     vif0-q0-tx
       71:         15          0          0          0   xen-dyn    -event     vif0-q0-rx
       72:         14          0          0          0   xen-dyn    -event     vif0-q1-tx
       73:         33          0          0          0   xen-dyn    -event     vif0-q1-rx
       74:         12          0          0          0   xen-dyn    -event     vif0-q2-tx
       75:         24          0          0          0   xen-dyn    -event     vif0-q2-rx
       76:         19          0          0          0   xen-dyn    -event     vif0-q3-tx
       77:         21          0          0          0   xen-dyn    -event     vif0-q3-rx
      
      Below is call trace information without this patch:
      
      name 'device/vif/0-q0-tx'
      WARNING: CPU: 2 PID: 37 at fs/proc/generic.c:174 __xlate_proc_name+0x85/0xa0
      RIP: 0010:__xlate_proc_name+0x85/0xa0
      RSP: 0018:ffffb85c40473c18 EFLAGS: 00010286
      RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000000006
      RDX: 0000000000000007 RSI: 0000000000000096 RDI: ffff984c7f516930
      RBP: ffffb85c40473cb8 R08: 000000000000002c R09: 0000000000000229
      R10: 0000000000000000 R11: 0000000000000001 R12: ffffb85c40473c98
      R13: ffffb85c40473cb8 R14: ffffb85c40473c50 R15: 0000000000000000
      FS:  0000000000000000(0000) GS:ffff984c7f500000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007f69b6899038 CR3: 000000001c20a006 CR4: 00000000001606e0
      Call Trace:
      __proc_create+0x45/0x230
      ? snprintf+0x49/0x60
      proc_mkdir_data+0x35/0x90
      register_handler_proc+0xef/0x110
      ? proc_register+0xfc/0x110
      ? proc_create_data+0x70/0xb0
      __setup_irq+0x39b/0x660
      ? request_threaded_irq+0xad/0x160
      request_threaded_irq+0xf5/0x160
      ? xennet_tx_buf_gc+0x1d0/0x1d0 [xen_netfront]
      bind_evtchn_to_irqhandler+0x3d/0x70
      ? xenbus_alloc_evtchn+0x41/0xa0
      netback_changed+0xa46/0xcda [xen_netfront]
      ? find_watch+0x40/0x40
      xenwatch_thread+0xc5/0x160
      ? finish_wait+0x80/0x80
      kthread+0x112/0x130
      ? kthread_create_worker_on_cpu+0x70/0x70
      ret_from_fork+0x35/0x40
      Code: 81 5c 00 48 85 c0 75 cc 5b 49 89 2e 31 c0 5d 4d 89 3c 24 41 5c 41 5d 41 5e 41 5f c3 4c 89 ee 48 c7 c7 40 4f 0e b4 e8 65 ea d8 ff <0f> 0b b8 fe ff ff ff 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 0f 1f
      ---[ end trace 650e5561b0caab3a ]---
      Signed-off-by: default avatarXiao Liang <xiliang@redhat.com>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      21f2706b
    • Ganesh Goudar's avatar
    • Dan Carpenter's avatar
      net: dsa: mv88e6xxx: missing unlock on error path · e29129fc
      Dan Carpenter authored
      We added a new error path, but we need to drop the lock before we return.
      
      Fixes: 2d2e1dd2 ("net: dsa: mv88e6xxx: Cache the port cmode")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e29129fc
    • Arnd Bergmann's avatar
      rds: fix building with IPV6=m · f6f7a26a
      Arnd Bergmann authored
      When CONFIG_RDS_TCP is built-in and CONFIG_IPV6 is a loadable
      module, we get a link error agains the modular ipv6_chk_addr()
      function:
      
      net/rds/tcp.o: In function `rds_tcp_laddr_check':
      tcp.c:(.text+0x3b2): undefined reference to `ipv6_chk_addr'
      
      This adds back a dependency that forces RDS_TCP to also be
      a loadable module when IPV6 is one.
      
      Fixes: e65d4d96 ("rds: Remove IPv6 dependency")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f6f7a26a
    • Nick Desaulniers's avatar
      inet/connection_sock: prefer _THIS_IP_ to current_text_addr · 96d18d82
      Nick Desaulniers authored
      As part of the effort to reduce the code duplication between _THIS_IP_
      and current_text_addr(), let's consolidate callers of
      current_text_addr() to use _THIS_IP_.
      Signed-off-by: default avatarNick Desaulniers <ndesaulniers@google.com>
      Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      96d18d82
    • Dan Carpenter's avatar
      net: dsa: mv88e6xxx: bitwise vs logical bug · 6feddb49
      Dan Carpenter authored
      We are trying to test if these flags are set but there are some && vs &
      typos.
      
      Fixes: efd1ba6a ("net: dsa: mv88e6xxx: Add SERDES phydev_mac_change up for 6390")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6feddb49
    • Jeremy Cline's avatar
      net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd() · 66b51b0a
      Jeremy Cline authored
      req->sdiag_family is a user-controlled value that's used as an array
      index. Sanitize it after the bounds check to avoid speculative
      out-of-bounds array access.
      
      This also protects the sock_is_registered() call, so this removes the
      sanitize call there.
      
      Fixes: e978de7a ("net: socket: Fix potential spectre v1 gadget in sock_is_registered")
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: konrad.wilk@oracle.com
      Cc: jamie.iles@oracle.com
      Cc: liran.alon@oracle.com
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJeremy Cline <jcline@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      66b51b0a
    • Alexander Aring's avatar
      ieee802154: hwsim: using right kind of iteration · 1c89a8e3
      Alexander Aring authored
      This patch fixes the error path to unsubscribe all other phy's from
      current phy. The actually code using a wrong kind of list iteration may
      copied from the case to unsubscribe the current phy from all other
      phy's.
      
      Cc: Stefan Schmidt <stefan@datenfreihafen.org>
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Fixes: f25da51f ("ieee802154: hwsim: add replacement for fakelb")
      Signed-off-by: default avatarAlexander Aring <aring@mojatatu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1c89a8e3
    • David S. Miller's avatar
      Merge branch 'hns3-next' · ac272a3e
      David S. Miller authored
      Salil Mehta says:
      
      ====================
      Misc bug fixes & small enhancements for HNS3 Driver
      
      This patch-set presents some bug fixes and minor enhancements to
      HNS3 Ethernet driver.
      
      Rework Summary:
      (*) Patch V1->V2
          1. Fixed David S Miller's comments
          2. Dropped patch 0005 "net: hns3: Fix for vf vlan delete failed problem" for now.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ac272a3e
    • Peng Li's avatar
      net: hns3: Add vlan filter setting by ethtool command -K · 3e85af6a
      Peng Li authored
      Revision(0x20) HW does not support enabling or disabling individual
      netdev's HW_VLAN_CTAG_FILTER feature, and Revision(0x21) supports
      enabling or disabling individual netdev's HW_VLAN_CTAG_FILTER
      feature.
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarSalil Mehta <salil.mehta@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3e85af6a
    • Yunsheng Lin's avatar
      net: hns3: Set tx ring' tc info when netdev is up · 1c772154
      Yunsheng Lin authored
      The HNS3_RING_TX_RING_TC_REG register is used to map tx ring to
      specific tc, the tx queue to tc mapping is needed by the hardware
      to do the correct tx schedule.
      Signed-off-by: default avatarYunsheng Lin <linyunsheng@huawei.com>
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarSalil Mehta <salil.mehta@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1c772154
    • Yunsheng Lin's avatar
      net: hns3: Remove tx ring BD len register in hns3_enet · 26a07ccc
      Yunsheng Lin authored
      There is no HNS3_RING_TX_RING_BD_LEN_REG register according
      to UM, so this patch removes it.
      Signed-off-by: default avatarYunsheng Lin <linyunsheng@huawei.com>
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarSalil Mehta <salil.mehta@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      26a07ccc
    • Yunsheng Lin's avatar
      net: hns3: Fix desc num set to default when setting channel · 128b900d
      Yunsheng Lin authored
      When user set the channel num using "ethtool -L ethX", the desc num
      of BD will set to default value, which will cause desc num set by
      user lost problem.
      
      This patch fixes it by restoring the desc num set by user when setting
      channel num.
      
      Fixes: 09f2af64 ("net: hns3: add support to modify tqps number")
      Signed-off-by: default avatarYunsheng Lin <linyunsheng@huawei.com>
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarSalil Mehta <salil.mehta@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      128b900d
    • Jian Shen's avatar
      net: hns3: Fix for phy link issue when using marvell phy driver · 60081dcc
      Jian Shen authored
      For marvell phy m88e1510, bit SUPPORTED_FIBRE of phydev->supported
      is default on. Both phy_resume() and phy_suspend() will check the
      SUPPORTED_FIBRE bit and write register of fibre page.
      
      Currently in hns3 driver, the SUPPORTED_FIBRE bit will be cleared
      after phy_connect_direct() finished. Because phy_resume() is called
      in phy_connect_direct(), and phy_suspend() is called when disconnect
      phy device, so the operation for fibre page register is not symmetrical.
      It will cause phy link issue when reload hns3 driver.
      
      This patch fixes it by disable the SUPPORTED_FIBRE before connecting
      phy.
      
      Fixes: 256727da ("net: hns3: Add MDIO support to HNS3 Ethernet driver for hip08 SoC")
      Signed-off-by: default avatarJian Shen <shenjian15@huawei.com>
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarSalil Mehta <salil.mehta@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      60081dcc
    • Fuyun Liang's avatar
      net: hns3: Fix for information of phydev lost problem when down/up · b01b7cf1
      Fuyun Liang authored
      Function call of phy_connect_direct will reinitialize phydev. Some
      information like advertising will be lost. Phy_connect_direct only
      needs to be called once. And driver can run well. This patch adds
      some functions to ensure that phy_connect_direct is called only once
      to solve the information of phydev lost problem occurring when we stop
      the net and open it again.
      
      Fixes: 46a3df9f ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support
      Signed-off-by: default avatarFuyun Liang <liangfuyun1@huawei.com>
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarSalil Mehta <salil.mehta@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b01b7cf1
    • Xi Wang's avatar
      net: hns3: Fix for command format parsing error in hclge_is_all_function_id_zero · 6c39d527
      Xi Wang authored
      According to the functional specification of hardware, the first
      descriptor of response from command 'lookup vlan talbe' is not valid.
      Currently, the first descriptor is parsed as normal value, which will
      cause an expected error.
      
      This patch fixes this problem by skipping the first descriptor.
      
      Fixes: 46a3df9f ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
      Signed-off-by: default avatarXi Wang <wangxi11@huawei.com>
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarSalil Mehta <salil.mehta@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6c39d527
    • Peng Li's avatar
      net: hns3: Add support for serdes loopback selftest · 5fd50ac3
      Peng Li authored
      This patch adds support for serdes loopback selftest in hns3
      driver.
      Signed-off-by: default avatarYunsheng Lin <linyunsheng@huawei.com>
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarSalil Mehta <salil.mehta@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5fd50ac3
    • Arnd Bergmann's avatar
      bnxt_en: take coredump_record structure off stack · 1bbf3aed
      Arnd Bergmann authored
      The bnxt_coredump_record structure is very long, causing a warning
      about possible stack overflow on 32-bit architectures:
      
      drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c: In function 'bnxt_get_coredump':
      drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2989:1: error: the frame size of 1188 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
      
      I could not see any reason to operate on an on-stack copy of the
      structure before copying it back into the caller-provided buffer, which
      also simplifies the code here.
      
      Fixes: 6c5657d0 ("bnxt_en: Add support for ethtool get dump.")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1bbf3aed
    • Arnd Bergmann's avatar
      net: systemport: fix unused function warning · cf87615d
      Arnd Bergmann authored
      The only remaining caller of this function is inside of an #ifdef
      after another caller got removed. This causes a harmless warning
      in some configurations:
      
      drivers/net/ethernet/broadcom/bcmsysport.c:1068:13: error: 'bcm_sysport_resume_from_wol' defined but not used [-Werror=unused-function]
      
      Removing the #ifdef around the PM functions simplifies the code
      and avoids the problem but letting the compiler drop the unused
      functions silently.
      
      Fixes: 9e85e227 ("net: systemport: Do not re-configure upon WoL interrupt")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cf87615d
    • Arnd Bergmann's avatar
      net: stmmac: mark PM functions as __maybe_unused · 81a8b079
      Arnd Bergmann authored
      The newly added suspend/resume functions cause a build warning
      when CONFIG_PM is disabled:
      
      drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c:324:12: error: 'stmmac_pci_resume' defined but not used [-Werror=unused-function]
      drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c:306:12: error: 'stmmac_pci_suspend' defined but not used [-Werror=unused-function]
      
      Mark them as __maybe_unused so gcc can drop them silently.
      
      Fixes: b7d0f08e ("net: stmmac: Fix WoL for PCI-based setups")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      81a8b079
    • Arnd Bergmann's avatar
      l2tp: fix unused function warning · c2ebc256
      Arnd Bergmann authored
      Removing one of the callers of pppol2tp_session_get_sock caused a harmless
      warning in some configurations:
      
      net/l2tp/l2tp_ppp.c:142:21: 'pppol2tp_session_get_sock' defined but not used [-Wunused-function]
      
      Rather than adding another #ifdef here, using a proper IS_ENABLED()
      check makes the code more readable and avoids those warnings while
      letting the compiler figure out for itself which code is needed.
      
      This adds one pointer for the unused show() callback in struct
      l2tp_session, but that seems harmless.
      
      Fixes: b0e29063 ("l2tp: remove pppol2tp_session_ioctl()")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c2ebc256
    • Arnd Bergmann's avatar
      bnxt_en: avoid string overflow for record->system_name · 3d46eee5
      Arnd Bergmann authored
      The utsname()->nodename string may be 64 bytes long, and it gets
      copied without the trailing nul byte into the shorter record->system_name,
      as gcc now warns:
      
      In file included from include/linux/bitmap.h:9,
                       from include/linux/ethtool.h:16,
                       from drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:13:
      In function 'strncpy',
          inlined from 'bnxt_fill_coredump_record' at drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2863:2:
      include/linux/string.h:254:9: error: '__builtin_strncpy' output truncated before terminating nul copying as many bytes from a string as its length [-Werror=stringop-truncation]
      
      Using strlcpy() at least avoids overflowing the destination buffer
      and adds proper nul-termination. It may still truncate long names
      though, which probably can't be solved here.
      
      Fixes: 6c5657d0 ("bnxt_en: Add support for ethtool get dump.")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3d46eee5
    • Arnd Bergmann's avatar
      net: lan743x: fix building without CONFIG_PTP_1588_CLOCK · 9dc502d7
      Arnd Bergmann authored
      Building without CONFIG_PTP_1588_CLOCK results in multiple failures,
      this was obviously not well tested:
      
      drivers/net/ethernet/microchip/lan743x_ptp.c: In function 'lan743x_ptp_isr':
      drivers/net/ethernet/microchip/lan743x_ptp.c:781:28: error: 'struct lan743x_ptp' has no member named 'ptp_clock'; did you mean 'tx_ts_lock'?
         ptp_schedule_worker(ptp->ptp_clock, 0);
                                  ^~~~~~~~~
                                  tx_ts_lock
      drivers/net/ethernet/microchip/lan743x_ptp.c: In function 'lan743x_ptp_open':
      drivers/net/ethernet/microchip/lan743x_ptp.c:879:6: error: unused variable 'ret' [-Werror=unused-variable]
        int ret = -ENODEV;
            ^~~
      At top level:
      drivers/net/ethernet/microchip/lan743x_ptp.c:63:13: error: 'lan743x_ptp_tx_ts_enqueue_ts' defined but not used [-Werror=unused-function]
       static void lan743x_ptp_tx_ts_enqueue_ts(struct lan743x_adapter *adapter,
                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
      cc1: all warnings being treated as errors
      drivers/net/ethernet/microchip/lan743x_ethtool.c: In function 'lan743x_ethtool_get_ts_info':
      drivers/net/ethernet/microchip/lan743x_ethtool.c:558:19: error: 'struct lan743x_ptp' has no member named 'ptp_clock'; did you mean 'tx_ts_lock'?
      
      Those #ifdef checks are hard to get right, replace them all with
      IS_ENABLED() checks that leave the same code visible to the compiler
      but let it optimize out the unused bits based on the configuration.
      
      Fixes: 07624df1 ("lan743x: lan743x: Add PTP support")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9dc502d7
    • Arnd Bergmann's avatar
      net: lan743x: select CRC16 · 3aad9240
      Arnd Bergmann authored
      lan743x now fails to build when CONFIG_CRC16 is disabled:
      
      drivers/net/ethernet/microchip/lan743x_main.o: In function crc16'
      
      Force it on like all other users do.
      
      Fixes: 4d94282a ("lan743x: Add power management support")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3aad9240
    • David S. Miller's avatar
      Merge branch 'net_sched-Fix-two-tc_index-filter-init-issues' · e8ae5e92
      David S. Miller authored
      Hangbin Liu says:
      
      ====================
      net_sched: Fix two tc_index filter init issues
      
      These two patches fix two tc_index filter init issues. The first one fixes
      missing exts info in new filter, which will cause NULL pointer dereference
      when delete tcindex filter. The second one fixes missing res info when create
      new filter, which will make filter unbind failed.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e8ae5e92
    • Hangbin Liu's avatar
      net_sched: Fix missing res info when create new tc_index filter · 008369dc
      Hangbin Liu authored
      Li Shuang reported the following warn:
      
      [  733.484610] WARNING: CPU: 6 PID: 21123 at net/sched/sch_cbq.c:1418 cbq_destroy_class+0x5d/0x70 [sch_cbq]
      [  733.495190] Modules linked in: sch_cbq cls_tcindex sch_dsmark rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat l
      [  733.574155]  syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm igb ixgbe ahci libahci i2c_algo_bit libata i40e i2c_core dca mdio megaraid_sas dm_mirror dm_region_hash dm_log dm_mod
      [  733.592500] CPU: 6 PID: 21123 Comm: tc Not tainted 4.18.0-rc8.latest+ #131
      [  733.600169] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.1.5 04/11/2016
      [  733.608518] RIP: 0010:cbq_destroy_class+0x5d/0x70 [sch_cbq]
      [  733.614734] Code: e7 d9 d2 48 8b 7b 48 e8 61 05 da d2 48 8d bb f8 00 00 00 e8 75 ae d5 d2 48 39 eb 74 0a 48 89 df 5b 5d e9 16 6c 94 d2 5b 5d c3 <0f> 0b eb b6 0f 1f 44 00 00 66 2e 0f 1f 84
      [  733.635798] RSP: 0018:ffffbfbb066bb9d8 EFLAGS: 00010202
      [  733.641627] RAX: 0000000000000001 RBX: ffff9cdd17392800 RCX: 000000008010000f
      [  733.649588] RDX: ffff9cdd1df547e0 RSI: ffff9cdd17392800 RDI: ffff9cdd0f84c800
      [  733.657547] RBP: ffff9cdd0f84c800 R08: 0000000000000001 R09: 0000000000000000
      [  733.665508] R10: ffff9cdd0f84d000 R11: 0000000000000001 R12: 0000000000000001
      [  733.673469] R13: 0000000000000000 R14: 0000000000000001 R15: ffff9cdd17392200
      [  733.681430] FS:  00007f911890a740(0000) GS:ffff9cdd1f8c0000(0000) knlGS:0000000000000000
      [  733.690456] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  733.696864] CR2: 0000000000b5544c CR3: 0000000859374002 CR4: 00000000001606e0
      [  733.704826] Call Trace:
      [  733.707554]  cbq_destroy+0xa1/0xd0 [sch_cbq]
      [  733.712318]  qdisc_destroy+0x62/0x130
      [  733.716401]  dsmark_destroy+0x2a/0x70 [sch_dsmark]
      [  733.721745]  qdisc_destroy+0x62/0x130
      [  733.725829]  qdisc_graft+0x3ba/0x470
      [  733.729817]  tc_get_qdisc+0x2a6/0x2c0
      [  733.733901]  ? cred_has_capability+0x7d/0x130
      [  733.738761]  rtnetlink_rcv_msg+0x263/0x2d0
      [  733.743330]  ? rtnl_calcit.isra.30+0x110/0x110
      [  733.748287]  netlink_rcv_skb+0x4d/0x130
      [  733.752576]  netlink_unicast+0x1a3/0x250
      [  733.756949]  netlink_sendmsg+0x2ae/0x3a0
      [  733.761324]  sock_sendmsg+0x36/0x40
      [  733.765213]  ___sys_sendmsg+0x26f/0x2d0
      [  733.769493]  ? handle_pte_fault+0x586/0xdf0
      [  733.774158]  ? __handle_mm_fault+0x389/0x500
      [  733.778919]  ? __sys_sendmsg+0x5e/0xa0
      [  733.783099]  __sys_sendmsg+0x5e/0xa0
      [  733.787087]  do_syscall_64+0x5b/0x180
      [  733.791171]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [  733.796805] RIP: 0033:0x7f9117f23f10
      [  733.800791] Code: c3 48 8b 05 82 6f 2c 00 f7 db 64 89 18 48 83 cb ff eb dd 0f 1f 80 00 00 00 00 83 3d 8d d0 2c 00 00 75 10 b8 2e 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8
      [  733.821873] RSP: 002b:00007ffe96818398 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
      [  733.830319] RAX: ffffffffffffffda RBX: 000000005b71244c RCX: 00007f9117f23f10
      [  733.838280] RDX: 0000000000000000 RSI: 00007ffe968183e0 RDI: 0000000000000003
      [  733.846241] RBP: 00007ffe968183e0 R08: 000000000000ffff R09: 0000000000000003
      [  733.854202] R10: 00007ffe96817e20 R11: 0000000000000246 R12: 0000000000000000
      [  733.862161] R13: 0000000000662ee0 R14: 0000000000000000 R15: 0000000000000000
      [  733.870121] ---[ end trace 28edd4aad712ddca ]---
      
      This is because we didn't update f->result.res when create new filter. Then in
      tcindex_delete() -> tcf_unbind_filter(), we will failed to find out the res
      and unbind filter, which will trigger the WARN_ON() in cbq_destroy_class().
      
      Fix it by updating f->result.res when create new filter.
      
      Fixes: 6e056569 ("net_sched: fix another crash in cls_tcindex")
      Reported-by: default avatarLi Shuang <shuali@redhat.com>
      Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      008369dc
    • Hangbin Liu's avatar
      net_sched: fix NULL pointer dereference when delete tcindex filter · 2df8bee5
      Hangbin Liu authored
      Li Shuang reported the following crash:
      
      [   71.267724] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
      [   71.276456] PGD 800000085d9bd067 P4D 800000085d9bd067 PUD 859a0b067 PMD 0
      [   71.284127] Oops: 0000 [#1] SMP PTI
      [   71.288015] CPU: 12 PID: 2386 Comm: tc Not tainted 4.18.0-rc8.latest+ #131
      [   71.295686] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.1.5 04/11/2016
      [   71.304037] RIP: 0010:tcindex_delete+0x72/0x280 [cls_tcindex]
      [   71.310446] Code: 00 31 f6 48 87 75 20 48 85 f6 74 11 48 8b 47 18 48 8b 40 08 48 8b 40 50 e8 fb a6 f8 fc 48 85 db 0f 84 dc 00 00 00 48 8b 73 18 <8b> 56 04 48 8d 7e 04 85 d2 0f 84 7b 01 00
      [   71.331517] RSP: 0018:ffffb45207b3f898 EFLAGS: 00010282
      [   71.337345] RAX: ffff8ad3d72d6360 RBX: ffff8acc84393680 RCX: 000000000000002e
      [   71.345306] RDX: ffff8ad3d72c8570 RSI: 0000000000000000 RDI: ffff8ad847a45800
      [   71.353277] RBP: ffff8acc84393688 R08: ffff8ad3d72c8400 R09: 0000000000000000
      [   71.361238] R10: ffff8ad3de786e00 R11: 0000000000000000 R12: ffffb45207b3f8c7
      [   71.369199] R13: ffff8ad3d93bd2a0 R14: 000000000000002e R15: ffff8ad3d72c9600
      [   71.377161] FS:  00007f9d3ec3e740(0000) GS:ffff8ad3df980000(0000) knlGS:0000000000000000
      [   71.386188] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [   71.392597] CR2: 0000000000000004 CR3: 0000000852f06003 CR4: 00000000001606e0
      [   71.400558] Call Trace:
      [   71.403299]  tcindex_destroy_element+0x25/0x40 [cls_tcindex]
      [   71.409611]  tcindex_walk+0xbb/0x110 [cls_tcindex]
      [   71.414953]  tcindex_destroy+0x44/0x90 [cls_tcindex]
      [   71.420492]  ? tcindex_delete+0x280/0x280 [cls_tcindex]
      [   71.426323]  tcf_proto_destroy+0x16/0x40
      [   71.430696]  tcf_chain_flush+0x51/0x70
      [   71.434876]  tcf_block_put_ext.part.30+0x8f/0x1b0
      [   71.440122]  tcf_block_put+0x4d/0x70
      [   71.444108]  cbq_destroy+0x4d/0xd0 [sch_cbq]
      [   71.448869]  qdisc_destroy+0x62/0x130
      [   71.452951]  dsmark_destroy+0x2a/0x70 [sch_dsmark]
      [   71.458300]  qdisc_destroy+0x62/0x130
      [   71.462373]  qdisc_graft+0x3ba/0x470
      [   71.466359]  tc_get_qdisc+0x2a6/0x2c0
      [   71.470443]  ? cred_has_capability+0x7d/0x130
      [   71.475307]  rtnetlink_rcv_msg+0x263/0x2d0
      [   71.479875]  ? rtnl_calcit.isra.30+0x110/0x110
      [   71.484832]  netlink_rcv_skb+0x4d/0x130
      [   71.489109]  netlink_unicast+0x1a3/0x250
      [   71.493482]  netlink_sendmsg+0x2ae/0x3a0
      [   71.497859]  sock_sendmsg+0x36/0x40
      [   71.501748]  ___sys_sendmsg+0x26f/0x2d0
      [   71.506029]  ? handle_pte_fault+0x586/0xdf0
      [   71.510694]  ? __handle_mm_fault+0x389/0x500
      [   71.515457]  ? __sys_sendmsg+0x5e/0xa0
      [   71.519636]  __sys_sendmsg+0x5e/0xa0
      [   71.523626]  do_syscall_64+0x5b/0x180
      [   71.527711]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [   71.533345] RIP: 0033:0x7f9d3e257f10
      [   71.537331] Code: c3 48 8b 05 82 6f 2c 00 f7 db 64 89 18 48 83 cb ff eb dd 0f 1f 80 00 00 00 00 83 3d 8d d0 2c 00 00 75 10 b8 2e 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8
      [   71.558401] RSP: 002b:00007fff6f893398 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
      [   71.566848] RAX: ffffffffffffffda RBX: 000000005b71274d RCX: 00007f9d3e257f10
      [   71.574810] RDX: 0000000000000000 RSI: 00007fff6f8933e0 RDI: 0000000000000003
      [   71.582770] RBP: 00007fff6f8933e0 R08: 000000000000ffff R09: 0000000000000003
      [   71.590729] R10: 00007fff6f892e20 R11: 0000000000000246 R12: 0000000000000000
      [   71.598689] R13: 0000000000662ee0 R14: 0000000000000000 R15: 0000000000000000
      [   71.606651] Modules linked in: sch_cbq cls_tcindex sch_dsmark xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_coni
      [   71.685425]  libahci i2c_algo_bit i2c_core i40e libata dca mdio megaraid_sas dm_mirror dm_region_hash dm_log dm_mod
      [   71.697075] CR2: 0000000000000004
      [   71.700792] ---[ end trace f604eb1acacd978b ]---
      
      Reproducer:
      tc qdisc add dev lo handle 1:0 root dsmark indices 64 set_tc_index
      tc filter add dev lo parent 1:0 protocol ip prio 1 tcindex mask 0xfc shift 2
      tc qdisc add dev lo parent 1:0 handle 2:0 cbq bandwidth 10Mbit cell 8 avpkt 1000 mpu 64
      tc class add dev lo parent 2:0 classid 2:1 cbq bandwidth 10Mbit rate 1500Kbit avpkt 1000 prio 1 bounded isolated allot 1514 weight 1 maxburst 10
      tc filter add dev lo parent 2:0 protocol ip prio 1 handle 0x2e tcindex classid 2:1 pass_on
      tc qdisc add dev lo parent 2:1 pfifo limit 5
      tc qdisc del dev lo root
      
      This is because in tcindex_set_parms, when there is no old_r, we set new
      exts to cr.exts. And we didn't set it to filter when r == &new_filter_result.
      
      Then in tcindex_delete() -> tcf_exts_get_net(), we will get NULL pointer
      dereference as we didn't init exts.
      
      Fix it by moving tcf_exts_change() after "if (old_r && old_r != r)" check.
      Then we don't need "cr" as there is no errout after that.
      
      Fixes: bf63ac73 ("net_sched: fix an oops in tcindex filter")
      Reported-by: default avatarLi Shuang <shuali@redhat.com>
      Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2df8bee5
    • Jakub Kicinski's avatar
      nfp: clean up return types in kdoc comments · 19997ba7
      Jakub Kicinski authored
      Remove 'Return:' information from functions which no longer
      return a value.  Also update name and return types of nfp_nffw_info
      access functions.
      Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      Reviewed-by: default avatarDirk van der Merwe <dirk.vandermerwe@netronome.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      19997ba7
  2. 13 Aug, 2018 11 commits