1. 26 Apr, 2024 8 commits
  2. 25 Apr, 2024 32 commits
    • Eric Dumazet's avatar
      net: add two more call_rcu_hurry() · c4e86b43
      Eric Dumazet authored
      I had failures with pmtu.sh selftests lately,
      with netns dismantles firing ref_tracking alerts [1].
      
      After much debugging, I found that some queued
      rcu callbacks were delayed by minutes, because
      of CONFIG_RCU_LAZY=y option.
      
      Joel Fernandes had a similar issue in the past,
      fixed with commit 483c26ff ("net: Use call_rcu_hurry()
      for dst_release()")
      
      In this commit, I make sure nexthop_free_rcu()
      and free_fib_info_rcu() are not delayed too much
      because they both can release device references.
      
      tools/testing/selftests/net/pmtu.sh no longer fails.
      
      Traces were:
      
      [  968.179860] ref_tracker: veth_A-R1@00000000d0ff3fe2 has 3/5 users at
                          dst_alloc+0x76/0x160
                          ip6_dst_alloc+0x25/0x80
                          ip6_pol_route+0x2a8/0x450
                          ip6_pol_route_output+0x1f/0x30
                          fib6_rule_lookup+0x163/0x270
                          ip6_route_output_flags+0xda/0x190
                          ip6_dst_lookup_tail.constprop.0+0x1d0/0x260
                          ip6_dst_lookup_flow+0x47/0xa0
                          udp_tunnel6_dst_lookup+0x158/0x210
                          vxlan_xmit_one+0x4c2/0x1550 [vxlan]
                          vxlan_xmit+0x52d/0x14f0 [vxlan]
                          dev_hard_start_xmit+0x7b/0x1e0
                          __dev_queue_xmit+0x20b/0xe40
                          ip6_finish_output2+0x2ea/0x6e0
                          ip6_finish_output+0x143/0x320
                          ip6_output+0x74/0x140
      
      [  968.179860] ref_tracker: veth_A-R1@00000000d0ff3fe2 has 1/5 users at
                          netdev_get_by_index+0xc0/0xe0
                          fib6_nh_init+0x1a9/0xa90
                          rtm_new_nexthop+0x6fa/0x1580
                          rtnetlink_rcv_msg+0x155/0x3e0
                          netlink_rcv_skb+0x61/0x110
                          rtnetlink_rcv+0x19/0x20
                          netlink_unicast+0x23f/0x380
                          netlink_sendmsg+0x1fc/0x430
                          ____sys_sendmsg+0x2ef/0x320
                          ___sys_sendmsg+0x86/0xd0
                          __sys_sendmsg+0x67/0xc0
                          __x64_sys_sendmsg+0x21/0x30
                          x64_sys_call+0x252/0x2030
                          do_syscall_64+0x6c/0x190
                          entry_SYSCALL_64_after_hwframe+0x76/0x7e
      
      [  968.179860] ref_tracker: veth_A-R1@00000000d0ff3fe2 has 1/5 users at
                          ipv6_add_dev+0x136/0x530
                          addrconf_notify+0x19d/0x770
                          notifier_call_chain+0x65/0xd0
                          raw_notifier_call_chain+0x1a/0x20
                          call_netdevice_notifiers_info+0x54/0x90
                          register_netdevice+0x61e/0x790
                          veth_newlink+0x230/0x440
                          __rtnl_newlink+0x7d2/0xaa0
                          rtnl_newlink+0x4c/0x70
                          rtnetlink_rcv_msg+0x155/0x3e0
                          netlink_rcv_skb+0x61/0x110
                          rtnetlink_rcv+0x19/0x20
                          netlink_unicast+0x23f/0x380
                          netlink_sendmsg+0x1fc/0x430
                          ____sys_sendmsg+0x2ef/0x320
                          ___sys_sendmsg+0x86/0xd0
      ....
      [ 1079.316024]  ? show_regs+0x68/0x80
      [ 1079.316087]  ? __warn+0x8c/0x140
      [ 1079.316103]  ? ref_tracker_free+0x1a0/0x270
      [ 1079.316117]  ? report_bug+0x196/0x1c0
      [ 1079.316135]  ? handle_bug+0x42/0x80
      [ 1079.316149]  ? exc_invalid_op+0x1c/0x70
      [ 1079.316162]  ? asm_exc_invalid_op+0x1f/0x30
      [ 1079.316193]  ? ref_tracker_free+0x1a0/0x270
      [ 1079.316208]  ? _raw_spin_unlock+0x1a/0x40
      [ 1079.316222]  ? free_unref_page+0x126/0x1a0
      [ 1079.316239]  ? destroy_large_folio+0x69/0x90
      [ 1079.316251]  ? __folio_put+0x99/0xd0
      [ 1079.316276]  dst_dev_put+0x69/0xd0
      [ 1079.316308]  fib6_nh_release_dsts.part.0+0x3d/0x80
      [ 1079.316327]  fib6_nh_release+0x45/0x70
      [ 1079.316340]  nexthop_free_rcu+0x131/0x170
      [ 1079.316356]  rcu_do_batch+0x1ee/0x820
      [ 1079.316370]  ? rcu_do_batch+0x179/0x820
      [ 1079.316388]  rcu_core+0x1aa/0x4d0
      [ 1079.316405]  rcu_core_si+0x12/0x20
      [ 1079.316417]  __do_softirq+0x13a/0x3dc
      [ 1079.316435]  __irq_exit_rcu+0xa3/0x110
      [ 1079.316449]  irq_exit_rcu+0x12/0x30
      [ 1079.316462]  sysvec_apic_timer_interrupt+0x5b/0xe0
      [ 1079.316474]  asm_sysvec_apic_timer_interrupt+0x1f/0x30
      [ 1079.316569] RIP: 0033:0x7f06b65c63f0
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
      Cc: Paul E. McKenney <paulmck@kernel.org>
      Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
      Link: https://lore.kernel.org/r/20240423205408.39632-1-edumazet@google.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      c4e86b43
    • Jakub Kicinski's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 2bd87951
      Jakub Kicinski authored
      Cross-merge networking fixes after downstream PR.
      
      Conflicts:
      
      drivers/net/ethernet/ti/icssg/icssg_prueth.c
      
      net/mac80211/chan.c
        89884459 ("wifi: mac80211: fix idle calculation with multi-link")
        87f55002 ("wifi: mac80211: simplify ieee80211_assign_link_chanctx()")
      https://lore.kernel.org/all/20240422105623.7b1fbda2@canb.auug.org.au/
      
      net/unix/garbage.c
        1971d13f ("af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().")
        4090fa37 ("af_unix: Replace garbage collection algorithm.")
      
      drivers/net/ethernet/ti/icssg/icssg_prueth.c
      drivers/net/ethernet/ti/icssg/icssg_common.c
        4dcd0e83 ("net: ti: icssg-prueth: Fix signedness bug in prueth_init_rx_chns()")
        e2dc7bfd ("net: ti: icssg-prueth: Move common functions into a separate file")
      
      No adjacent changes.
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      2bd87951
    • Eric Dumazet's avatar
      tcp: avoid premature drops in tcp_add_backlog() · ec00ed47
      Eric Dumazet authored
      While testing TCP performance with latest trees,
      I saw suspect SOCKET_BACKLOG drops.
      
      tcp_add_backlog() computes its limit with :
      
          limit = (u32)READ_ONCE(sk->sk_rcvbuf) +
                  (u32)(READ_ONCE(sk->sk_sndbuf) >> 1);
          limit += 64 * 1024;
      
      This does not take into account that sk->sk_backlog.len
      is reset only at the very end of __release_sock().
      
      Both sk->sk_backlog.len and sk->sk_rmem_alloc could reach
      sk_rcvbuf in normal conditions.
      
      We should double sk->sk_rcvbuf contribution in the formula
      to absorb bubbles in the backlog, which happen more often
      for very fast flows.
      
      This change maintains decent protection against abuses.
      
      Fixes: c377411f ("net: sk_add_backlog() take rmem_alloc into account")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Link: https://lore.kernel.org/r/20240423125620.3309458-1-edumazet@google.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      ec00ed47
    • Jakub Kicinski's avatar
      Merge tag 'wireless-next-2024-04-24' of... · e6be197f
      Jakub Kicinski authored
      Merge tag 'wireless-next-2024-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next
      
      Kalle Valo says:
      
      ====================
      wireless-next patches for v6.10
      
      The second "new features" pull request for v6.10 with changes both in
      stack and in drivers. This time the pull request is rather small and
      nothing special standing out except maybe that we have several
      kernel-doc fixes. Great to see that we are getting warning free
      wireless code (until new warnings are added).
      
      Major changes:
      
      rtl8xxxu:
       * enable Management Frame Protection (MFP) support
      
      rtw88:
       * disable unsupported interface type of mesh point for all chips, and only
         support station mode for SDIO chips.
      
      * tag 'wireless-next-2024-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (63 commits)
        wifi: mac80211: handle link ID during management Tx
        wifi: mac80211: handle sdata->u.ap.active flag with MLO
        wifi: cfg80211: add return docs for regulatory functions
        wifi: cfg80211: make some regulatory functions void
        wifi: mac80211: add return docs for sta_info_flush()
        wifi: mac80211: keep mac80211 consistent on link activation failure
        wifi: mac80211: simplify ieee80211_assign_link_chanctx()
        wifi: mac80211: reserve chanctx during find
        wifi: cfg80211: fix cfg80211 function kernel-doc
        wifi: mac80211_hwsim: Use wider regulatory for custom for 6GHz tests
        wifi: iwlwifi: mvm: Don't allow EMLSR when the RSSI is low
        wifi: iwlwifi: mvm: disable EMLSR when we suspend with wowlan
        wifi: iwlwifi: mvm: get periodic statistics in EMLSR
        wifi: iwlwifi: mvm: don't recompute EMLSR mode in can_activate_links
        wifi: iwlwifi: mvm: implement EMLSR prevention mechanism.
        wifi: iwlwifi: mvm: exit EMLSR upon missed beacon
        wifi: iwlwifi: mvm: init vif works only once
        wifi: iwlwifi: mvm: Add helper functions to update EMLSR status
        wifi: iwlwifi: mvm: Implement new link selection algorithm
        wifi: iwlwifi: mvm: move EMLSR/links code
        ...
      ====================
      
      Link: https://lore.kernel.org/r/20240424100122.217AEC113CE@smtp.kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      e6be197f
    • Jakub Kicinski's avatar
      Merge branch 'net-dsa-b53-remove-adjust_link' · ed93293b
      Jakub Kicinski authored
      Florian Fainelli says:
      
      ====================
      net: dsa: b53: Remove adjust_link
      
      b53 is now the only remaining driver that uses both PHYLIB's adjust_link
      and PHYLINK's mac_ops callbacks, convert entirely to PHYLINK.
      ====================
      
      Link: https://lore.kernel.org/r/20240423183339.1368511-1-florian.fainelli@broadcom.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      ed93293b
    • Florian Fainelli's avatar
      net: dsa: b53: provide own phylink MAC operations · d0a35d29
      Florian Fainelli authored
      Convert b53 to provide its own phylink MAC operations, thus avoiding the
      shim layer in DSA's port.c
      Signed-off-by: default avatarFlorian Fainelli <florian.fainelli@broadcom.com>
      Reviewed-by: default avatarRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
      Link: https://lore.kernel.org/r/20240423183339.1368511-9-florian.fainelli@broadcom.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      d0a35d29
    • Florian Fainelli's avatar
      net: dsa: b53: Remove b53_adjust_link() · 60035435
      Florian Fainelli authored
      Only use the PHYLINK implementation from there on now that an equivalent
      configuration is applied to all of the switch ports.
      Signed-off-by: default avatarFlorian Fainelli <florian.fainelli@broadcom.com>
      Reviewed-by: default avatarRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
      Link: https://lore.kernel.org/r/20240423183339.1368511-8-florian.fainelli@broadcom.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      60035435
    • Florian Fainelli's avatar
      net: dsa: b53: Call b53_eee_init() from b53_mac_link_up() · 888128f3
      Florian Fainelli authored
      And make sure this is done for the MLO_AN_PHY case, where it actually
      makes sense, contrary to b53_adjust_link() which only did it for
      fixed-PHY configurations where it does not make sense.
      Signed-off-by: default avatarFlorian Fainelli <florian.fainelli@broadcom.com>
      Reviewed-by: default avatarRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
      Link: https://lore.kernel.org/r/20240423183339.1368511-7-florian.fainelli@broadcom.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      888128f3
    • Florian Fainelli's avatar
      net: dsa: b53: Configure RGMII for 531x5 and MII for 5325 · 536e5b2e
      Florian Fainelli authored
      Call b53_adjust_531x5_rgmii() and b53_adjust_5325_mii() from
      b53_phylink_mac_config() when we have a fixed PHY in preparation for removing
      b53_adjust_link(). Also move b53_adjust_63xx_rgmii() to
      b53_phylink_mac_config() where it logically belongs.
      Signed-off-by: default avatarFlorian Fainelli <florian.fainelli@broadcom.com>
      Reviewed-by: default avatarRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
      Link: https://lore.kernel.org/r/20240423183339.1368511-6-florian.fainelli@broadcom.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      536e5b2e
    • Florian Fainelli's avatar
      net: dsa: b53: Force flow control for BCM5301X CPU port(s) · 93a2579e
      Florian Fainelli authored
      Just like what b53_adjust_link() does, force flow control for the
      BCM5301X CPU port(s) by forcing rx_pause and tx_pause in
      b53_phylink_mac_link_up(). Preparatory step for getting rid of
      b53_adjust_link().
      Signed-off-by: default avatarFlorian Fainelli <florian.fainelli@broadcom.com>
      Reviewed-by: default avatarRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
      Link: https://lore.kernel.org/r/20240423183339.1368511-5-florian.fainelli@broadcom.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      93a2579e
    • Florian Fainelli's avatar
      net: dsa: b53: Introduce b53_adjust_5325_mii() · 0d18dea4
      Florian Fainelli authored
      Takes care of doing the 5325 switch series specific MII programming and
      is called from b53_adjust_link() to allow the future removal of
      b53_adjust_link().
      Signed-off-by: default avatarFlorian Fainelli <florian.fainelli@broadcom.com>
      Reviewed-by: default avatarRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
      Link: https://lore.kernel.org/r/20240423183339.1368511-4-florian.fainelli@broadcom.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      0d18dea4
    • Florian Fainelli's avatar
      net: dsa: b53: Introduce b53_adjust_531x5_rgmii() · b3d06dc3
      Florian Fainelli authored
      Takes care of doing the 531x5 switch series specific RGMII programming
      and is called from b53_adjust_link() to allow the future removal of
      b53_adjust_link().
      Signed-off-by: default avatarFlorian Fainelli <florian.fainelli@broadcom.com>
      Reviewed-by: default avatarRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
      Link: https://lore.kernel.org/r/20240423183339.1368511-3-florian.fainelli@broadcom.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      b3d06dc3
    • Florian Fainelli's avatar
      65245197
    • Linus Torvalds's avatar
      Merge tag 'net-6.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 52afb15e
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Including fixes from netfilter, wireless and bluetooth.
      
        Nothing major, regression fixes are mostly in drivers, two more of
        those are flowing towards us thru various trees. I wish some of the
        changes went into -rc5, we'll try to keep an eye on frequency of PRs
        from sub-trees.
      
        Also disproportional number of fixes for bugs added in v6.4, strange
        coincidence.
      
        Current release - regressions:
      
         - igc: fix LED-related deadlock on driver unbind
      
         - wifi: mac80211: small fixes to recent clean up of the connection
           process
      
         - Revert "wifi: iwlwifi: bump FW API to 90 for BZ/SC devices", kernel
           doesn't have all the code to deal with that version, yet
      
         - Bluetooth:
             - set power_ctrl_enabled on NULL returned by gpiod_get_optional()
             - qca: fix invalid device address check, again
      
         - eth: ravb: fix registered interrupt names
      
        Current release - new code bugs:
      
         - wifi: mac80211: check EHT/TTLM action frame length
      
        Previous releases - regressions:
      
         - fix sk_memory_allocated_{add|sub} for architectures where
           __this_cpu_{add|sub}* are not IRQ-safe
      
         - dsa: mv88e6xx: fix link setup for 88E6250
      
        Previous releases - always broken:
      
         - ip: validate dev returned from __in_dev_get_rcu(), prevent possible
           null-derefs in a few places
      
         - switch number of for_each_rcu() loops using call_rcu() on the
           iterator to for_each_safe()
      
         - macsec: fix isolation of broadcast traffic in presence of offload
      
         - vxlan: drop packets from invalid source address
      
         - eth: mlxsw: trap and ACL programming fixes
      
         - eth: bnxt: PCIe error recovery fixes, fix counting dropped packets
      
         - Bluetooth:
             - lots of fixes for the command submission rework from v6.4
             - qca: fix NULL-deref on non-serdev suspend
      
        Misc:
      
         - tools: ynl: don't ignore errors in NLMSG_DONE messages"
      
      * tag 'net-6.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (88 commits)
        af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
        net: b44: set pause params only when interface is up
        tls: fix lockless read of strp->msg_ready in ->poll
        dpll: fix dpll_pin_on_pin_register() for multiple parent pins
        net: ravb: Fix registered interrupt names
        octeontx2-af: fix the double free in rvu_npc_freemem()
        net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets
        ice: fix LAG and VF lock dependency in ice_reset_vf()
        iavf: Fix TC config comparison with existing adapter TC config
        i40e: Report MFS in decimal base instead of hex
        i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
        net: ti: icssg-prueth: Fix signedness bug in prueth_init_rx_chns()
        net/mlx5e: Advertise mlx5 ethernet driver updates sk_buff md_dst for MACsec
        macsec: Detect if Rx skb is macsec-related for offloading devices that update md_dst
        ethernet: Add helper for assigning packet type when dest address does not match device address
        macsec: Enable devices to advertise whether they update sk_buff md_dst during offloads
        net: phy: dp83869: Fix MII mode failure
        netfilter: nf_tables: honor table dormant flag from netdev release event path
        eth: bnxt: fix counting packets discarded due to OOM and netpoll
        igc: Fix LED-related deadlock on driver unbind
        ...
      52afb15e
    • Linus Torvalds's avatar
      Merge tag 'nfsd-6.9-5' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux · e33c4963
      Linus Torvalds authored
      Pull nfsd fixes from Chuck Lever:
      
       - Revert some backchannel fixes that went into v6.9-rc
      
      * tag 'nfsd-6.9-5' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
        Revert "NFSD: Convert the callback workqueue to use delayed_work"
        Revert "NFSD: Reschedule CB operations when backchannel rpc_clnt is shut down"
      e33c4963
    • Linus Torvalds's avatar
      Merge tag 'for-linus-2024042501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid · f9e02329
      Linus Torvalds authored
      Pull HID fixes from Benjamin Tissoires:
      
       - A couple of i2c-hid fixes (Kenny Levinsen & Nam Cao)
      
       - A config issue with mcp-2221 when CONFIG_IIO is not enabled
         (Abdelrahman Morsy)
      
       - A dev_err fix in intel-ish-hid (Zhang Lixu)
      
       - A couple of mouse fixes for both nintendo and Logitech-dj (Nuno
         Pereira and Yaraslau Furman)
      
       - I'm changing my main kernel email address as it's way simpler for me
         than the Red Hat one (Benjamin Tissoires)
      
      * tag 'for-linus-2024042501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
        HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is enabled
        HID: logitech-dj: allow mice to use all types of reports
        HID: i2c-hid: Revert to await reset ACK before reading report descriptor
        HID: nintendo: Fix N64 controller being identified as mouse
        MAINTAINERS: update Benjamin's email address
        HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc
        HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
      f9e02329
    • Jakub Kicinski's avatar
      Merge tag 'nf-24-04-25' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf · e8baa63f
      Jakub Kicinski authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter/IPVS fixes for net
      
      The following patchset contains two Netfilter/IPVS fixes for net:
      
      Patch #1 fixes SCTP checksumming for IPVS with gso packets,
      	 from Ismael Luceno.
      
      Patch #2 honor dormant flag from netdev event path to fix a possible
      	 double hook unregistration.
      
      * tag 'nf-24-04-25' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
        netfilter: nf_tables: honor table dormant flag from netdev release event path
        ipvs: Fix checksumming on GSO of SCTP packets
      ====================
      
      Link: https://lore.kernel.org/r/20240425090149.1359547-1-pablo@netfilter.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      e8baa63f
    • Kuniyuki Iwashima's avatar
      af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc(). · 1971d13f
      Kuniyuki Iwashima authored
      syzbot reported a lockdep splat regarding unix_gc_lock and
      unix_state_lock().
      
      One is called from recvmsg() for a connected socket, and another
      is called from GC for TCP_LISTEN socket.
      
      So, the splat is false-positive.
      
      Let's add a dedicated lock class for the latter to suppress the splat.
      
      Note that this change is not necessary for net-next.git as the issue
      is only applied to the old GC impl.
      
      [0]:
      WARNING: possible circular locking dependency detected
      6.9.0-rc5-syzkaller-00007-g4d200843 #0 Not tainted
       -----------------------------------------------------
      kworker/u8:1/11 is trying to acquire lock:
      ffff88807cea4e70 (&u->lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
      ffff88807cea4e70 (&u->lock){+.+.}-{2:2}, at: __unix_gc+0x40e/0xf70 net/unix/garbage.c:302
      
      but task is already holding lock:
      ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
      ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: __unix_gc+0x117/0xf70 net/unix/garbage.c:261
      
      which lock already depends on the new lock.
      
      the existing dependency chain (in reverse order) is:
      
       -> #1 (unix_gc_lock){+.+.}-{2:2}:
             lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
             __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
             _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
             spin_lock include/linux/spinlock.h:351 [inline]
             unix_notinflight+0x13d/0x390 net/unix/garbage.c:140
             unix_detach_fds net/unix/af_unix.c:1819 [inline]
             unix_destruct_scm+0x221/0x350 net/unix/af_unix.c:1876
             skb_release_head_state+0x100/0x250 net/core/skbuff.c:1188
             skb_release_all net/core/skbuff.c:1200 [inline]
             __kfree_skb net/core/skbuff.c:1216 [inline]
             kfree_skb_reason+0x16d/0x3b0 net/core/skbuff.c:1252
             kfree_skb include/linux/skbuff.h:1262 [inline]
             manage_oob net/unix/af_unix.c:2672 [inline]
             unix_stream_read_generic+0x1125/0x2700 net/unix/af_unix.c:2749
             unix_stream_splice_read+0x239/0x320 net/unix/af_unix.c:2981
             do_splice_read fs/splice.c:985 [inline]
             splice_file_to_pipe+0x299/0x500 fs/splice.c:1295
             do_splice+0xf2d/0x1880 fs/splice.c:1379
             __do_splice fs/splice.c:1436 [inline]
             __do_sys_splice fs/splice.c:1652 [inline]
             __se_sys_splice+0x331/0x4a0 fs/splice.c:1634
             do_syscall_x64 arch/x86/entry/common.c:52 [inline]
             do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
             entry_SYSCALL_64_after_hwframe+0x77/0x7f
      
       -> #0 (&u->lock){+.+.}-{2:2}:
             check_prev_add kernel/locking/lockdep.c:3134 [inline]
             check_prevs_add kernel/locking/lockdep.c:3253 [inline]
             validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869
             __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
             lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
             __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
             _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
             spin_lock include/linux/spinlock.h:351 [inline]
             __unix_gc+0x40e/0xf70 net/unix/garbage.c:302
             process_one_work kernel/workqueue.c:3254 [inline]
             process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335
             worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
             kthread+0x2f0/0x390 kernel/kthread.c:388
             ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
             ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
      
      other info that might help us debug this:
      
       Possible unsafe locking scenario:
      
             CPU0                    CPU1
             ----                    ----
        lock(unix_gc_lock);
                                     lock(&u->lock);
                                     lock(unix_gc_lock);
        lock(&u->lock);
      
       *** DEADLOCK ***
      
      3 locks held by kworker/u8:1/11:
       #0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline]
       #0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x17c0 kernel/workqueue.c:3335
       #1: ffffc90000107d00 (unix_gc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline]
       #1: ffffc90000107d00 (unix_gc_work){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x17c0 kernel/workqueue.c:3335
       #2: ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
       #2: ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: __unix_gc+0x117/0xf70 net/unix/garbage.c:261
      
      stack backtrace:
      CPU: 0 PID: 11 Comm: kworker/u8:1 Not tainted 6.9.0-rc5-syzkaller-00007-g4d200843 #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
      Workqueue: events_unbound __unix_gc
      Call Trace:
       <TASK>
       __dump_stack lib/dump_stack.c:88 [inline]
       dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
       check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2187
       check_prev_add kernel/locking/lockdep.c:3134 [inline]
       check_prevs_add kernel/locking/lockdep.c:3253 [inline]
       validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869
       __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
       __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
       _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
       spin_lock include/linux/spinlock.h:351 [inline]
       __unix_gc+0x40e/0xf70 net/unix/garbage.c:302
       process_one_work kernel/workqueue.c:3254 [inline]
       process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335
       worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
       kthread+0x2f0/0x390 kernel/kthread.c:388
       ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
       </TASK>
      
      Fixes: 47d8ac01 ("af_unix: Fix garbage collector racing against connect()")
      Reported-and-tested-by: syzbot+fa379358c28cc87cc307@syzkaller.appspotmail.com
      Closes: https://syzkaller.appspot.com/bug?extid=fa379358c28cc87cc307Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
      Link: https://lore.kernel.org/r/20240424170443.9832-1-kuniyu@amazon.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      1971d13f
    • Peter Münster's avatar
      net: b44: set pause params only when interface is up · e3eb7dd4
      Peter Münster authored
      b44_free_rings() accesses b44::rx_buffers (and ::tx_buffers)
      unconditionally, but b44::rx_buffers is only valid when the
      device is up (they get allocated in b44_open(), and deallocated
      again in b44_close()), any other time these are just a NULL pointers.
      
      So if you try to change the pause params while the network interface
      is disabled/administratively down, everything explodes (which likely
      netifd tries to do).
      
      Link: https://github.com/openwrt/openwrt/issues/13789
      Fixes: 1da177e4 (Linux-2.6.12-rc2)
      Cc: stable@vger.kernel.org
      Reported-by: default avatarPeter Münster <pm@a16n.net>
      Suggested-by: default avatarJonas Gorski <jonas.gorski@gmail.com>
      Signed-off-by: default avatarVaclav Svoboda <svoboda@neng.cz>
      Tested-by: default avatarPeter Münster <pm@a16n.net>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarPeter Münster <pm@a16n.net>
      Reviewed-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Link: https://lore.kernel.org/r/87y192oolj.fsf@a16n.netSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      e3eb7dd4
    • Sabrina Dubroca's avatar
      tls: fix lockless read of strp->msg_ready in ->poll · 0844370f
      Sabrina Dubroca authored
      tls_sk_poll is called without locking the socket, and needs to read
      strp->msg_ready (via tls_strp_msg_ready). Convert msg_ready to a bool
      and use READ_ONCE/WRITE_ONCE where needed. The remaining reads are
      only performed when the socket is locked.
      
      Fixes: 121dca78 ("tls: suppress wakeups unless we have a full record")
      Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
      Link: https://lore.kernel.org/r/0b7ee062319037cf86af6b317b3d72f7bfcd2e97.1713797701.git.sd@queasysnail.netSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      0844370f
    • Arkadiusz Kubalewski's avatar
      dpll: fix dpll_pin_on_pin_register() for multiple parent pins · 38d7b94e
      Arkadiusz Kubalewski authored
      In scenario where pin is registered with multiple parent pins via
      dpll_pin_on_pin_register(..), all belonging to the same dpll device.
      A second call to dpll_pin_on_pin_unregister(..) would cause a call trace,
      as it tries to use already released registration resources (due to fix
      introduced in b446631f). In this scenario pin was registered twice,
      so resources are not yet expected to be release until each registered
      pin/pin pair is unregistered.
      
      Currently, the following crash/call trace is produced when ice driver is
      removed on the system with installed E810T NIC which includes dpll device:
      
      WARNING: CPU: 51 PID: 9155 at drivers/dpll/dpll_core.c:809 dpll_pin_ops+0x20/0x30
      RIP: 0010:dpll_pin_ops+0x20/0x30
      Call Trace:
       ? __warn+0x7f/0x130
       ? dpll_pin_ops+0x20/0x30
       dpll_msg_add_pin_freq+0x37/0x1d0
       dpll_cmd_pin_get_one+0x1c0/0x400
       ? __nlmsg_put+0x63/0x80
       dpll_pin_event_send+0x93/0x140
       dpll_pin_on_pin_unregister+0x3f/0x100
       ice_dpll_deinit_pins+0xa1/0x230 [ice]
       ice_remove+0xf1/0x210 [ice]
      
      Fix by adding a parent pointer as a cookie when creating a registration,
      also when searching for it. For the regular pins pass NULL, this allows to
      create separated registration for each parent the pin is registered with.
      
      Fixes: b446631f ("dpll: fix dpll_xa_ref_*_del() for multiple registrations")
      Signed-off-by: default avatarArkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
      Reviewed-by: default avatarJiri Pirko <jiri@nvidia.com>
      Link: https://lore.kernel.org/r/20240424101636.1491424-1-arkadiusz.kubalewski@intel.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      38d7b94e
    • Geert Uytterhoeven's avatar
      net: ravb: Fix registered interrupt names · 0c81ea5a
      Geert Uytterhoeven authored
      As interrupts are now requested from ravb_probe(), before calling
      register_netdev(), ndev->name still contains the template "eth%d",
      leading to funny names in /proc/interrupts.  E.g. on R-Car E3:
      
      	89:  0      0  GICv2  93 Level  eth%d:ch22:multi
      	90:  0      3  GICv2  95 Level  eth%d:ch24:emac
      	91:  0  23484  GICv2  71 Level  eth%d:ch0:rx_be
      	92:  0      0  GICv2  72 Level  eth%d:ch1:rx_nc
      	93:  0  13735  GICv2  89 Level  eth%d:ch18:tx_be
      	94:  0      0  GICv2  90 Level  eth%d:ch19:tx_nc
      
      Worse, on platforms with multiple RAVB instances (e.g. R-Car V4H), all
      interrupts have similar names.
      
      Fix this by using the device name instead, like is done in several other
      drivers:
      
      	89:  0      0  GICv2  93 Level  e6800000.ethernet:ch22:multi
      	90:  0      1  GICv2  95 Level  e6800000.ethernet:ch24:emac
      	91:  0  28578  GICv2  71 Level  e6800000.ethernet:ch0:rx_be
      	92:  0      0  GICv2  72 Level  e6800000.ethernet:ch1:rx_nc
      	93:  0  14044  GICv2  89 Level  e6800000.ethernet:ch18:tx_be
      	94:  0      0  GICv2  90 Level  e6800000.ethernet:ch19:tx_nc
      
      Rename the local variable dev_name, as it shadows the dev_name()
      function, and pre-initialize it, to simplify the code.
      
      Fixes: 32f012b8 ("net: ravb: Move getting/requesting IRQs in the probe() method")
      Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Reviewed-by: default avatarNiklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
      Reviewed-by: default avatarSergey Shtylyov <s.shtylyov@omp.ru>
      Reviewed-by: default avatarClaudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
      Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> # on RZ/G3S
      Link: https://lore.kernel.org/r/cde67b68adf115b3cf0b44c32334ae00b2fbb321.1713944647.git.geert+renesas@glider.beSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      0c81ea5a
    • Su Hui's avatar
      octeontx2-af: fix the double free in rvu_npc_freemem() · 6e965eba
      Su Hui authored
      Clang static checker(scan-build) warning:
      drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c:line 2184, column 2
      Attempt to free released memory.
      
      npc_mcam_rsrcs_deinit() has released 'mcam->counters.bmap'. Deleted this
      redundant kfree() to fix this double free problem.
      
      Fixes: dd784287 ("octeontx2-af: Add new devlink param to configure maximum usable NIX block LFs")
      Signed-off-by: default avatarSu Hui <suhui@nfschina.com>
      Reviewed-by: default avatarGeetha sowjanya <gakula@marvell.com>
      Reviewed-by: default avatarKalesh AP <kalesh-anakkur.purayil@broadcom.com>
      Reviewed-by: default avatarHariprasad Kelam <hkelam@marvell.com>
      Link: https://lore.kernel.org/r/20240424022724.144587-1-suhui@nfschina.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      6e965eba
    • Jason Reeder's avatar
      net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets · 1b9e743e
      Jason Reeder authored
      The CPTS, by design, captures the messageType (Sync, Delay_Req, etc.)
      field from the second nibble of the PTP header which is defined in the
      PTPv2 (1588-2008) specification. In the PTPv1 (1588-2002) specification
      the first two bytes of the PTP header are defined as the versionType
      which is always 0x0001. This means that any PTPv1 packets that are
      tagged for TX timestamping by the CPTS will have their messageType set
      to 0x0 which corresponds to a Sync message type. This causes issues
      when a PTPv1 stack is expecting a Delay_Req (messageType: 0x1)
      timestamp that never appears.
      
      Fix this by checking if the ptp_class of the timestamped TX packet is
      PTP_CLASS_V1 and then matching the PTP sequence ID to the stored
      sequence ID in the skb->cb data structure. If the sequence IDs match
      and the packet is of type PTPv1 then there is a chance that the
      messageType has been incorrectly stored by the CPTS so overwrite the
      messageType stored by the CPTS with the messageType from the skb->cb
      data structure. This allows the PTPv1 stack to receive TX timestamps
      for Delay_Req packets which are necessary to lock onto a PTP Leader.
      Signed-off-by: default avatarJason Reeder <jreeder@ti.com>
      Signed-off-by: default avatarRavi Gunasekaran <r-gunasekaran@ti.com>
      Tested-by: default avatarEd Trexel <ed.trexel@hp.com>
      Fixes: f6bd5952 ("net: ethernet: ti: introduce am654 common platform time sync driver")
      Link: https://lore.kernel.org/r/20240424071626.32558-1-r-gunasekaran@ti.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      1b9e743e
    • Jakub Kicinski's avatar
      Merge branch 'intel-wired-lan-driver-updates-2024-04-23-i40e-iavf-ice' · 179d5166
      Jakub Kicinski authored
      Tony Nguyen says:
      
      ====================
      Intel Wired LAN Driver Updates 2024-04-23 (i40e, iavf, ice)
      
      This series contains updates to i40e, iavf, and ice drivers.
      
      Sindhu removes WQ_MEM_RECLAIM flag from workqueue for i40e.
      
      Erwan Velu adjusts message to avoid confusion on base being reported on
      i40e.
      
      Sudheer corrects insufficient check for TC equality on iavf.
      
      Jake corrects ordering of locks to avoid possible deadlock on ice.
      ====================
      
      Link: https://lore.kernel.org/r/20240423182723.740401-1-anthony.l.nguyen@intel.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      179d5166
    • Jakub Kicinski's avatar
      Merge branch 'fix-isolation-of-broadcast-traffic-and-unmatched-unicast-traffic-with-macsec-offload' · 4334496e
      Jakub Kicinski authored
      Rahul Rameshbabu says:
      
      ====================
      Fix isolation of broadcast traffic and unmatched unicast traffic with MACsec offload
      
      Some device drivers support devices that enable them to annotate whether a
      Rx skb refers to a packet that was processed by the MACsec offloading
      functionality of the device. Logic in the Rx handling for MACsec offload
      does not utilize this information to preemptively avoid forwarding to the
      macsec netdev currently. Because of this, things like multicast messages or
      unicast messages with an unmatched destination address such as ARP requests
      are forwarded to the macsec netdev whether the message received was MACsec
      encrypted or not. The goal of this patch series is to improve the Rx
      handling for MACsec offload for devices capable of annotating skbs received
      that were decrypted by the NIC offload for MACsec.
      
      Here is a summary of the issue that occurs with the existing logic today.
      
          * The current design of the MACsec offload handling path tries to use
            "best guess" mechanisms for determining whether a packet associated
            with the currently handled skb in the datapath was processed via HW
            offload
          * The best guess mechanism uses the following heuristic logic (in order of
            precedence)
            - Check if header destination MAC address matches MACsec netdev MAC
              address -> forward to MACsec port
            - Check if packet is multicast traffic -> forward to MACsec port
            - MACsec security channel was able to be looked up from skb offload
              context (mlx5 only) -> forward to MACsec port
          * Problem: plaintext traffic can potentially solicit a MACsec encrypted
            response from the offload device
            - Core aspect of MACsec is that it identifies unauthorized LAN connections
              and excludes them from communication
              + This behavior can be seen when not enabling offload for MACsec
            - The offload behavior violates this principle in MACsec
      
      I believe this behavior is a security bug since applications utilizing
      MACsec could be exploited using this behavior, and the correct way to
      resolve this is by having the hardware correctly indicate whether MACsec
      offload occurred for the packet or not. In the patches in this series, I
      leave a warning for when the problematic path occurs because I cannot
      figure out a secure way to fix the security issue that applies to the core
      MACsec offload handling in the Rx path without breaking MACsec offload for
      other vendors.
      
      Shown at the bottom is an example use case where plaintext traffic sent to
      a physical port of a NIC configured for MACsec offload is unable to be
      handled correctly by the software stack when the NIC provides awareness to
      the kernel about whether the received packet is MACsec traffic or not. In
      this specific example, plaintext ARP requests are being responded with
      MACsec encrypted ARP replies (which leads to routing information being
      unable to be built for the requester).
      
          Side 1
      
            ip link del macsec0
            ip address flush mlx5_1
            ip address add 1.1.1.1/24 dev mlx5_1
            ip link set dev mlx5_1 up
            ip link add link mlx5_1 macsec0 type macsec sci 1 encrypt on
            ip link set dev macsec0 address 00:11:22:33:44:66
            ip macsec offload macsec0 mac
            ip macsec add macsec0 tx sa 0 pn 1 on key 00 dffafc8d7b9a43d5b9a3dfbbf6a30c16
            ip macsec add macsec0 rx sci 2 on
            ip macsec add macsec0 rx sci 2 sa 0 pn 1 on key 00 ead3664f508eb06c40ac7104cdae4ce5
            ip address flush macsec0
            ip address add 2.2.2.1/24 dev macsec0
            ip link set dev macsec0 up
      
            # macsec0 enters promiscuous mode.
            # This enables all traffic received on macsec_vlan to be processed by
            # the macsec offload rx datapath. This however means that traffic
            # meant to be received by mlx5_1 will be incorrectly steered to
            # macsec0 as well.
      
            ip link add link macsec0 name macsec_vlan type vlan id 1
            ip link set dev macsec_vlan address 00:11:22:33:44:88
            ip address flush macsec_vlan
            ip address add 3.3.3.1/24 dev macsec_vlan
            ip link set dev macsec_vlan up
      
          Side 2
      
            ip link del macsec0
            ip address flush mlx5_1
            ip address add 1.1.1.2/24 dev mlx5_1
            ip link set dev mlx5_1 up
            ip link add link mlx5_1 macsec0 type macsec sci 2 encrypt on
            ip link set dev macsec0 address 00:11:22:33:44:77
            ip macsec offload macsec0 mac
            ip macsec add macsec0 tx sa 0 pn 1 on key 00 ead3664f508eb06c40ac7104cdae4ce5
            ip macsec add macsec0 rx sci 1 on
            ip macsec add macsec0 rx sci 1 sa 0 pn 1 on key 00 dffafc8d7b9a43d5b9a3dfbbf6a30c16
            ip address flush macsec0
            ip address add 2.2.2.2/24 dev macsec0
            ip link set dev macsec0 up
      
            # macsec0 enters promiscuous mode.
            # This enables all traffic received on macsec_vlan to be processed by
            # the macsec offload rx datapath. This however means that traffic
            # meant to be received by mlx5_1 will be incorrectly steered to
            # macsec0 as well.
      
            ip link add link macsec0 name macsec_vlan type vlan id 1
            ip link set dev macsec_vlan address 00:11:22:33:44:99
            ip address flush macsec_vlan
            ip address add 3.3.3.2/24 dev macsec_vlan
            ip link set dev macsec_vlan up
      
          Side 1
      
            ping -I mlx5_1 1.1.1.2
            PING 1.1.1.2 (1.1.1.2) from 1.1.1.1 mlx5_1: 56(84) bytes of data.
            From 1.1.1.1 icmp_seq=1 Destination Host Unreachable
            ping: sendmsg: No route to host
            From 1.1.1.1 icmp_seq=2 Destination Host Unreachable
            From 1.1.1.1 icmp_seq=3 Destination Host Unreachable
      
      Changes:
      
        v2->v3:
          * Made dev paramater const for eth_skb_pkt_type helper as suggested by Sabrina
            Dubroca <sd@queasysnail.net>
        v1->v2:
          * Fixed series subject to detail the issue being fixed
          * Removed strange characters from cover letter
          * Added comment in example that illustrates the impact involving
            promiscuous mode
          * Added patch for generalizing packet type detection
          * Added Fixes: tags and targeting net
          * Removed pointless warning in the heuristic Rx path for macsec offload
          * Applied small refactor in Rx path offload to minimize scope of rx_sc
            local variable
      
      Link: https://github.com/Binary-Eater/macsec-rx-offload/blob/trunk/MACsec_violation_in_core_stack_offload_rx_handling.pdf
      Link: https://lore.kernel.org/netdev/20240419213033.400467-5-rrameshbabu@nvidia.com/
      Link: https://lore.kernel.org/netdev/20240419011740.333714-1-rrameshbabu@nvidia.com/
      Link: https://lore.kernel.org/netdev/87r0l25y1c.fsf@nvidia.com/
      Link: https://lore.kernel.org/netdev/20231116182900.46052-1-rrameshbabu@nvidia.com/
      ====================
      
      Link: https://lore.kernel.org/r/20240423181319.115860-1-rrameshbabu@nvidia.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      4334496e
    • Jacob Keller's avatar
      ice: fix LAG and VF lock dependency in ice_reset_vf() · 96fdd1f6
      Jacob Keller authored
      9f74a3df ("ice: Fix VF Reset paths when interface in a failed over
      aggregate"), the ice driver has acquired the LAG mutex in ice_reset_vf().
      The commit placed this lock acquisition just prior to the acquisition of
      the VF configuration lock.
      
      If ice_reset_vf() acquires the configuration lock via the ICE_VF_RESET_LOCK
      flag, this could deadlock with ice_vc_cfg_qs_msg() because it always
      acquires the locks in the order of the VF configuration lock and then the
      LAG mutex.
      
      Lockdep reports this violation almost immediately on creating and then
      removing 2 VF:
      
      ======================================================
      WARNING: possible circular locking dependency detected
      6.8.0-rc6 #54 Tainted: G        W  O
      ------------------------------------------------------
      kworker/60:3/6771 is trying to acquire lock:
      ff40d43e099380a0 (&vf->cfg_lock){+.+.}-{3:3}, at: ice_reset_vf+0x22f/0x4d0 [ice]
      
      but task is already holding lock:
      ff40d43ea1961210 (&pf->lag_mutex){+.+.}-{3:3}, at: ice_reset_vf+0xb7/0x4d0 [ice]
      
      which lock already depends on the new lock.
      
      the existing dependency chain (in reverse order) is:
      
      -> #1 (&pf->lag_mutex){+.+.}-{3:3}:
             __lock_acquire+0x4f8/0xb40
             lock_acquire+0xd4/0x2d0
             __mutex_lock+0x9b/0xbf0
             ice_vc_cfg_qs_msg+0x45/0x690 [ice]
             ice_vc_process_vf_msg+0x4f5/0x870 [ice]
             __ice_clean_ctrlq+0x2b5/0x600 [ice]
             ice_service_task+0x2c9/0x480 [ice]
             process_one_work+0x1e9/0x4d0
             worker_thread+0x1e1/0x3d0
             kthread+0x104/0x140
             ret_from_fork+0x31/0x50
             ret_from_fork_asm+0x1b/0x30
      
      -> #0 (&vf->cfg_lock){+.+.}-{3:3}:
             check_prev_add+0xe2/0xc50
             validate_chain+0x558/0x800
             __lock_acquire+0x4f8/0xb40
             lock_acquire+0xd4/0x2d0
             __mutex_lock+0x9b/0xbf0
             ice_reset_vf+0x22f/0x4d0 [ice]
             ice_process_vflr_event+0x98/0xd0 [ice]
             ice_service_task+0x1cc/0x480 [ice]
             process_one_work+0x1e9/0x4d0
             worker_thread+0x1e1/0x3d0
             kthread+0x104/0x140
             ret_from_fork+0x31/0x50
             ret_from_fork_asm+0x1b/0x30
      
      other info that might help us debug this:
       Possible unsafe locking scenario:
             CPU0                    CPU1
             ----                    ----
        lock(&pf->lag_mutex);
                                     lock(&vf->cfg_lock);
                                     lock(&pf->lag_mutex);
        lock(&vf->cfg_lock);
      
       *** DEADLOCK ***
      4 locks held by kworker/60:3/6771:
       #0: ff40d43e05428b38 ((wq_completion)ice){+.+.}-{0:0}, at: process_one_work+0x176/0x4d0
       #1: ff50d06e05197e58 ((work_completion)(&pf->serv_task)){+.+.}-{0:0}, at: process_one_work+0x176/0x4d0
       #2: ff40d43ea1960e50 (&pf->vfs.table_lock){+.+.}-{3:3}, at: ice_process_vflr_event+0x48/0xd0 [ice]
       #3: ff40d43ea1961210 (&pf->lag_mutex){+.+.}-{3:3}, at: ice_reset_vf+0xb7/0x4d0 [ice]
      
      stack backtrace:
      CPU: 60 PID: 6771 Comm: kworker/60:3 Tainted: G        W  O       6.8.0-rc6 #54
      Hardware name:
      Workqueue: ice ice_service_task [ice]
      Call Trace:
       <TASK>
       dump_stack_lvl+0x4a/0x80
       check_noncircular+0x12d/0x150
       check_prev_add+0xe2/0xc50
       ? save_trace+0x59/0x230
       ? add_chain_cache+0x109/0x450
       validate_chain+0x558/0x800
       __lock_acquire+0x4f8/0xb40
       ? lockdep_hardirqs_on+0x7d/0x100
       lock_acquire+0xd4/0x2d0
       ? ice_reset_vf+0x22f/0x4d0 [ice]
       ? lock_is_held_type+0xc7/0x120
       __mutex_lock+0x9b/0xbf0
       ? ice_reset_vf+0x22f/0x4d0 [ice]
       ? ice_reset_vf+0x22f/0x4d0 [ice]
       ? rcu_is_watching+0x11/0x50
       ? ice_reset_vf+0x22f/0x4d0 [ice]
       ice_reset_vf+0x22f/0x4d0 [ice]
       ? process_one_work+0x176/0x4d0
       ice_process_vflr_event+0x98/0xd0 [ice]
       ice_service_task+0x1cc/0x480 [ice]
       process_one_work+0x1e9/0x4d0
       worker_thread+0x1e1/0x3d0
       ? __pfx_worker_thread+0x10/0x10
       kthread+0x104/0x140
       ? __pfx_kthread+0x10/0x10
       ret_from_fork+0x31/0x50
       ? __pfx_kthread+0x10/0x10
       ret_from_fork_asm+0x1b/0x30
       </TASK>
      
      To avoid deadlock, we must acquire the LAG mutex only after acquiring the
      VF configuration lock. Fix the ice_reset_vf() to acquire the LAG mutex only
      after we either acquire or check that the VF configuration lock is held.
      
      Fixes: 9f74a3df ("ice: Fix VF Reset paths when interface in a failed over aggregate")
      Signed-off-by: default avatarJacob Keller <jacob.e.keller@intel.com>
      Reviewed-by: default avatarDave Ertman <david.m.ertman@intel.com>
      Reviewed-by: default avatarMateusz Polchlopek <mateusz.polchlopek@intel.com>
      Tested-by: default avatarPrzemek Kitszel <przemyslaw.kitszel@intel.com>
      Tested-by: default avatarRafal Romanowski <rafal.romanowski@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      Link: https://lore.kernel.org/r/20240423182723.740401-5-anthony.l.nguyen@intel.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      96fdd1f6
    • Sudheer Mogilappagari's avatar
      iavf: Fix TC config comparison with existing adapter TC config · 54976cf5
      Sudheer Mogilappagari authored
      Same number of TCs doesn't imply that underlying TC configs are
      same. The config could be different due to difference in number
      of queues in each TC. Add utility function to determine if TC
      configs are same.
      
      Fixes: d5b33d02 ("i40evf: add ndo_setup_tc callback to i40evf")
      Signed-off-by: default avatarSudheer Mogilappagari <sudheer.mogilappagari@intel.com>
      Tested-by: Mineri Bhange <minerix.bhange@intel.com> (A Contingent Worker at Intel)
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      Link: https://lore.kernel.org/r/20240423182723.740401-4-anthony.l.nguyen@intel.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      54976cf5
    • Erwan Velu's avatar
      i40e: Report MFS in decimal base instead of hex · ef3c3131
      Erwan Velu authored
      If the MFS is set below the default (0x2600), a warning message is
      reported like the following :
      
      	MFS for port 1 has been set below the default: 600
      
      This message is a bit confusing as the number shown here (600) is in
      fact an hexa number: 0x600 = 1536
      
      Without any explicit "0x" prefix, this message is read like the MFS is
      set to 600 bytes.
      
      MFS, as per MTUs, are usually expressed in decimal base.
      
      This commit reports both current and default MFS values in decimal
      so it's less confusing for end-users.
      
      A typical warning message looks like the following :
      
      	MFS for port 1 (1536) has been set below the default (9728)
      Signed-off-by: default avatarErwan Velu <e.velu@criteo.com>
      Reviewed-by: default avatarSimon Horman <horms@kernel.org>
      Tested-by: default avatarTony Brelinski <tony.brelinski@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      Fixes: 3a2c6ced ("i40e: Add a check to see if MFS is set")
      Link: https://lore.kernel.org/r/20240423182723.740401-3-anthony.l.nguyen@intel.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      ef3c3131
    • Sindhu Devale's avatar
      i40e: Do not use WQ_MEM_RECLAIM flag for workqueue · 2cc7d150
      Sindhu Devale authored
      Issue reported by customer during SRIOV testing, call trace:
      When both i40e and the i40iw driver are loaded, a warning
      in check_flush_dependency is being triggered. This seems
      to be because of the i40e driver workqueue is allocated with
      the WQ_MEM_RECLAIM flag, and the i40iw one is not.
      
      Similar error was encountered on ice too and it was fixed by
      removing the flag. Do the same for i40e too.
      
      [Feb 9 09:08] ------------[ cut here ]------------
      [  +0.000004] workqueue: WQ_MEM_RECLAIM i40e:i40e_service_task [i40e] is
      flushing !WQ_MEM_RECLAIM infiniband:0x0
      [  +0.000060] WARNING: CPU: 0 PID: 937 at kernel/workqueue.c:2966
      check_flush_dependency+0x10b/0x120
      [  +0.000007] Modules linked in: snd_seq_dummy snd_hrtimer snd_seq
      snd_timer snd_seq_device snd soundcore nls_utf8 cifs cifs_arc4
      nls_ucs2_utils rdma_cm iw_cm ib_cm cifs_md4 dns_resolver netfs qrtr
      rfkill sunrpc vfat fat intel_rapl_msr intel_rapl_common irdma
      intel_uncore_frequency intel_uncore_frequency_common ice ipmi_ssif
      isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal
      intel_powerclamp gnss coretemp ib_uverbs rapl intel_cstate ib_core
      iTCO_wdt iTCO_vendor_support acpi_ipmi mei_me ipmi_si intel_uncore
      ioatdma i2c_i801 joydev pcspkr mei ipmi_devintf lpc_ich
      intel_pch_thermal i2c_smbus ipmi_msghandler acpi_power_meter acpi_pad
      xfs libcrc32c ast sd_mod drm_shmem_helper t10_pi drm_kms_helper sg ixgbe
      drm i40e ahci crct10dif_pclmul libahci crc32_pclmul igb crc32c_intel
      libata ghash_clmulni_intel i2c_algo_bit mdio dca wmi dm_mirror
      dm_region_hash dm_log dm_mod fuse
      [  +0.000050] CPU: 0 PID: 937 Comm: kworker/0:3 Kdump: loaded Not
      tainted 6.8.0-rc2-Feb-net_dev-Qiueue-00279-gbd43c5687e05 #1
      [  +0.000003] Hardware name: Intel Corporation S2600BPB/S2600BPB, BIOS
      SE5C620.86B.02.01.0013.121520200651 12/15/2020
      [  +0.000001] Workqueue: i40e i40e_service_task [i40e]
      [  +0.000024] RIP: 0010:check_flush_dependency+0x10b/0x120
      [  +0.000003] Code: ff 49 8b 54 24 18 48 8d 8b b0 00 00 00 49 89 e8 48
      81 c6 b0 00 00 00 48 c7 c7 b0 97 fa 9f c6 05 8a cc 1f 02 01 e8 35 b3 fd
      ff <0f> 0b e9 10 ff ff ff 80 3d 78 cc 1f 02 00 75 94 e9 46 ff ff ff 90
      [  +0.000002] RSP: 0018:ffffbd294976bcf8 EFLAGS: 00010282
      [  +0.000002] RAX: 0000000000000000 RBX: ffff94d4c483c000 RCX:
      0000000000000027
      [  +0.000001] RDX: ffff94d47f620bc8 RSI: 0000000000000001 RDI:
      ffff94d47f620bc0
      [  +0.000001] RBP: 0000000000000000 R08: 0000000000000000 R09:
      00000000ffff7fff
      [  +0.000001] R10: ffffbd294976bb98 R11: ffffffffa0be65e8 R12:
      ffff94c5451ea180
      [  +0.000001] R13: ffff94c5ab5e8000 R14: ffff94c5c20b6e05 R15:
      ffff94c5f1330ab0
      [  +0.000001] FS:  0000000000000000(0000) GS:ffff94d47f600000(0000)
      knlGS:0000000000000000
      [  +0.000002] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  +0.000001] CR2: 00007f9e6f1fca70 CR3: 0000000038e20004 CR4:
      00000000007706f0
      [  +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
      0000000000000000
      [  +0.000001] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
      0000000000000400
      [  +0.000001] PKRU: 55555554
      [  +0.000001] Call Trace:
      [  +0.000001]  <TASK>
      [  +0.000002]  ? __warn+0x80/0x130
      [  +0.000003]  ? check_flush_dependency+0x10b/0x120
      [  +0.000002]  ? report_bug+0x195/0x1a0
      [  +0.000005]  ? handle_bug+0x3c/0x70
      [  +0.000003]  ? exc_invalid_op+0x14/0x70
      [  +0.000002]  ? asm_exc_invalid_op+0x16/0x20
      [  +0.000006]  ? check_flush_dependency+0x10b/0x120
      [  +0.000002]  ? check_flush_dependency+0x10b/0x120
      [  +0.000002]  __flush_workqueue+0x126/0x3f0
      [  +0.000015]  ib_cache_cleanup_one+0x1c/0xe0 [ib_core]
      [  +0.000056]  __ib_unregister_device+0x6a/0xb0 [ib_core]
      [  +0.000023]  ib_unregister_device_and_put+0x34/0x50 [ib_core]
      [  +0.000020]  i40iw_close+0x4b/0x90 [irdma]
      [  +0.000022]  i40e_notify_client_of_netdev_close+0x54/0xc0 [i40e]
      [  +0.000035]  i40e_service_task+0x126/0x190 [i40e]
      [  +0.000024]  process_one_work+0x174/0x340
      [  +0.000003]  worker_thread+0x27e/0x390
      [  +0.000001]  ? __pfx_worker_thread+0x10/0x10
      [  +0.000002]  kthread+0xdf/0x110
      [  +0.000002]  ? __pfx_kthread+0x10/0x10
      [  +0.000002]  ret_from_fork+0x2d/0x50
      [  +0.000003]  ? __pfx_kthread+0x10/0x10
      [  +0.000001]  ret_from_fork_asm+0x1b/0x30
      [  +0.000004]  </TASK>
      [  +0.000001] ---[ end trace 0000000000000000 ]---
      
      Fixes: 4d5957cb ("i40e: remove WQ_UNBOUND and the task limit of our workqueue")
      Signed-off-by: default avatarSindhu Devale <sindhu.devale@intel.com>
      Reviewed-by: default avatarArkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
      Reviewed-by: default avatarMateusz Polchlopek <mateusz.polchlopek@intel.com>
      Signed-off-by: default avatarAleksandr Loktionov <aleksandr.loktionov@intel.com>
      Tested-by: default avatarRobert Ganzynkowicz <robert.ganzynkowicz@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      Link: https://lore.kernel.org/r/20240423182723.740401-2-anthony.l.nguyen@intel.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      2cc7d150
    • Dan Carpenter's avatar
      net: ti: icssg-prueth: Fix signedness bug in prueth_init_rx_chns() · 4dcd0e83
      Dan Carpenter authored
      The rx_chn->irq[] array is unsigned int but it should be signed for the
      error handling to work.  Also if k3_udma_glue_rx_get_irq() returns zero
      then we should return -ENXIO instead of success.
      
      Fixes: 128d5874 ("net: ti: icssg-prueth: Add ICSSG ethernet driver")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
      Reviewed-by: default avatarRoger Quadros <rogerq@kernel.org>
      Reviewed-by: default avatarMD Danish Anwar <danishanwar@ti.com>
      Link: https://lore.kernel.org/r/05282415-e7f4-42f3-99f8-32fde8f30936@moroto.mountainSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      4dcd0e83
    • Rahul Rameshbabu's avatar
      net/mlx5e: Advertise mlx5 ethernet driver updates sk_buff md_dst for MACsec · 39d26a8f
      Rahul Rameshbabu authored
      mlx5 Rx flow steering and CQE handling enable the driver to be able to
      update an skb's md_dst attribute as MACsec when MACsec traffic arrives when
      a device is configured for offloading. Advertise this to the core stack to
      take advantage of this capability.
      
      Cc: stable@vger.kernel.org
      Fixes: b7c9400c ("net/mlx5e: Implement MACsec Rx data path using MACsec skb_metadata_dst")
      Signed-off-by: default avatarRahul Rameshbabu <rrameshbabu@nvidia.com>
      Reviewed-by: default avatarBenjamin Poirier <bpoirier@nvidia.com>
      Reviewed-by: default avatarCosmin Ratiu <cratiu@nvidia.com>
      Reviewed-by: default avatarSabrina Dubroca <sd@queasysnail.net>
      Link: https://lore.kernel.org/r/20240423181319.115860-5-rrameshbabu@nvidia.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      39d26a8f