1. 03 Jun, 2021 5 commits
  2. 02 Jun, 2021 12 commits
    • Wong Vee Khee's avatar
      net: stmmac: fix issue where clk is being unprepared twice · ab00f3e0
      Wong Vee Khee authored
      In the case of MDIO bus registration failure due to no external PHY
      devices is connected to the MAC, clk_disable_unprepare() is called in
      stmmac_bus_clk_config() and intel_eth_pci_probe() respectively.
      
      The second call in intel_eth_pci_probe() will caused the following:-
      
      [   16.578605] intel-eth-pci 0000:00:1e.5: No PHY found
      [   16.583778] intel-eth-pci 0000:00:1e.5: stmmac_dvr_probe: MDIO bus (id: 2) registration failed
      [   16.680181] ------------[ cut here ]------------
      [   16.684861] stmmac-0000:00:1e.5 already disabled
      [   16.689547] WARNING: CPU: 13 PID: 2053 at drivers/clk/clk.c:952 clk_core_disable+0x96/0x1b0
      [   16.697963] Modules linked in: dwc3 iTCO_wdt mei_hdcp iTCO_vendor_support udc_core x86_pkg_temp_thermal kvm_intel marvell10g kvm sch_fq_codel nfsd irqbypass dwmac_intel(+) stmmac uio ax88179_178a pcs_xpcs phylink uhid spi_pxa2xx_platform usbnet mei_me pcspkr tpm_crb mii i2c_i801 dw_dmac dwc3_pci thermal dw_dmac_core intel_rapl_msr libphy i2c_smbus mei tpm_tis intel_th_gth tpm_tis_core tpm intel_th_acpi intel_pmc_core intel_th i915 fuse configfs snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core snd_pcm snd_timer snd soundcore
      [   16.746785] CPU: 13 PID: 2053 Comm: systemd-udevd Tainted: G     U            5.13.0-rc3-intel-lts #76
      [   16.756134] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-S ADP-S DRR4 CRB, BIOS ADLIFSI1.R00.1494.B00.2012031421 12/03/2020
      [   16.769465] RIP: 0010:clk_core_disable+0x96/0x1b0
      [   16.774222] Code: 00 8b 05 45 96 17 01 85 c0 7f 24 48 8b 5b 30 48 85 db 74 a5 8b 43 7c 85 c0 75 93 48 8b 33 48 c7 c7 6e 32 cc b7 e8 b2 5d 52 00 <0f> 0b 5b 5d c3 65 8b 05 76 31 18 49 89 c0 48 0f a3 05 bc 92 1a 01
      [   16.793016] RSP: 0018:ffffa44580523aa0 EFLAGS: 00010086
      [   16.798287] RAX: 0000000000000000 RBX: ffff8d7d0eb70a00 RCX: 0000000000000000
      [   16.805435] RDX: 0000000000000002 RSI: ffffffffb7c62d5f RDI: 00000000ffffffff
      [   16.812610] RBP: 0000000000000287 R08: 0000000000000000 R09: ffffa445805238d0
      [   16.819759] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8d7d0eb70a00
      [   16.826904] R13: ffff8d7d027370c8 R14: 0000000000000006 R15: ffffa44580523ad0
      [   16.834047] FS:  00007f9882fa2600(0000) GS:ffff8d80a0940000(0000) knlGS:0000000000000000
      [   16.842177] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [   16.847966] CR2: 00007f9882bea3d8 CR3: 000000010b126001 CR4: 0000000000370ee0
      [   16.855144] Call Trace:
      [   16.857614]  clk_core_disable_lock+0x1b/0x30
      [   16.861941]  intel_eth_pci_probe.cold+0x11d/0x136 [dwmac_intel]
      [   16.867913]  pci_device_probe+0xcf/0x150
      [   16.871890]  really_probe+0xf5/0x3e0
      [   16.875526]  driver_probe_device+0x64/0x150
      [   16.879763]  device_driver_attach+0x53/0x60
      [   16.883998]  __driver_attach+0x9f/0x150
      [   16.887883]  ? device_driver_attach+0x60/0x60
      [   16.892288]  ? device_driver_attach+0x60/0x60
      [   16.896698]  bus_for_each_dev+0x77/0xc0
      [   16.900583]  bus_add_driver+0x184/0x1f0
      [   16.904469]  driver_register+0x6c/0xc0
      [   16.908268]  ? 0xffffffffc07ae000
      [   16.911598]  do_one_initcall+0x4a/0x210
      [   16.915489]  ? kmem_cache_alloc_trace+0x305/0x4e0
      [   16.920247]  do_init_module+0x5c/0x230
      [   16.924057]  load_module+0x2894/0x2b70
      [   16.927857]  ? __do_sys_finit_module+0xb5/0x120
      [   16.932441]  __do_sys_finit_module+0xb5/0x120
      [   16.936845]  do_syscall_64+0x42/0x80
      [   16.940476]  entry_SYSCALL_64_after_hwframe+0x44/0xae
      [   16.945586] RIP: 0033:0x7f98830e5ccd
      [   16.949177] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 93 31 0c 00 f7 d8 64 89 01 48
      [   16.967970] RSP: 002b:00007ffc66b60168 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
      [   16.975583] RAX: ffffffffffffffda RBX: 000055885de35ef0 RCX: 00007f98830e5ccd
      [   16.982725] RDX: 0000000000000000 RSI: 00007f98832541e3 RDI: 0000000000000012
      [   16.989868] RBP: 0000000000020000 R08: 0000000000000000 R09: 0000000000000000
      [   16.997042] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f98832541e3
      [   17.004222] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffc66b60328
      [   17.011369] ---[ end trace df06a3dab26b988c ]---
      [   17.016062] ------------[ cut here ]------------
      [   17.020701] stmmac-0000:00:1e.5 already unprepared
      
      Removing the stmmac_bus_clks_config() call in stmmac_dvr_probe and let
      dwmac-intel to handle the unprepare and disable of the clk device.
      
      Fixes: 5ec55823 ("net: stmmac: add clocks management for gmac driver")
      Cc: Joakim Zhang <qiangqing.zhang@nxp.com>
      Signed-off-by: default avatarWong Vee Khee <vee.khee.wong@linux.intel.com>
      Reviewed-by: default avatarJoakim Zhang <qiangqing.zhang@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ab00f3e0
    • Josh Triplett's avatar
      net: ipconfig: Don't override command-line hostnames or domains · b508d5fb
      Josh Triplett authored
      If the user specifies a hostname or domain name as part of the ip=
      command-line option, preserve it and don't overwrite it with one
      supplied by DHCP/BOOTP.
      
      For instance, ip=::::myhostname::dhcp will use "myhostname" rather than
      ignoring and overwriting it.
      
      Fix the comment on ic_bootp_string that suggests it only copies a string
      "if not already set"; it doesn't have any such logic.
      Signed-off-by: default avatarJosh Triplett <josh@joshtriplett.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b508d5fb
    • David S. Miller's avatar
      Merge tag 'mlx5-fixes-2021-06-01' of git://git.kernel.org/pub/scm/linu · dd627662
      David S. Miller authored
      x/kernel/git/saeed/linux
      
      Saeed Mahameed says:
      
      ====================
      mlx5 fixes 2021-06-01
      
      This series introduces some fixes to mlx5 driver.
      Please pull and let me know if there is any problem.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dd627662
    • Yevgeny Kliteynik's avatar
      net/mlx5: DR, Create multi-destination flow table with level less than 64 · 216214c6
      Yevgeny Kliteynik authored
      Flow table that contains flow pointing to multiple flow tables or multiple
      TIRs must have a level lower than 64. In our case it applies to muli-
      destination flow table.
      Fix the level of the created table to comply with HW Spec definitions, and
      still make sure that its level lower than SW-owned tables, so that it
      would be possible to point from the multi-destination FW table to SW
      tables.
      
      Fixes: 34583bee ("net/mlx5: DR, Create multi-destination table for SW-steering use")
      Signed-off-by: default avatarYevgeny Kliteynik <kliteyn@nvidia.com>
      Reviewed-by: default avatarAlex Vesker <valex@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      216214c6
    • Aya Levin's avatar
      net/mlx5e: Fix conflict with HW TS and CQE compression · 5349cbba
      Aya Levin authored
      When a driver's profile doesn't support a dedicated PTP-RQ,
      configuration of CQE compression while HW TS is configured should fail.
      
      Fixes: 885b8cfb ("net/mlx5e: Update ethtool setting of CQE compression")
      Signed-off-by: default avatarAya Levin <ayal@nvidia.com>
      Reviewed-by: default avatarMoshe Shemesh <moshe@nvidia.com>
      Reviewed-by: default avatarTariq Toukan <tariqt@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      5349cbba
    • Aya Levin's avatar
      net/mlx5e: Fix HW TS with CQE compression according to profile · 256f79d1
      Aya Levin authored
      When the driver's profile doesn't support a dedicated PTP-RQ, the PTP
      accuracy of HW TS is affected by the CQE compression. In this case,
      turn off CQE compression. Otherwise, the driver crashes:
      
      BUG: kernel NULL pointer dereference, address:0000000000000018
      ...
      ...
      RIP: 0010:mlx5e_ptp_rx_set_fs+0x25/0x1a0 [mlx5_core]
      ...
      ...
      Call Trace:
       mlx5e_ptp_activate_channel+0xb2/0xf0 [mlx5_core]
       mlx5e_activate_priv_channels+0x3b9/0x8c0 [mlx5_core]
       ? __mutex_unlock_slowpath+0x45/0x2a0
       ? mlx5e_refresh_tirs+0x151/0x1e0 [mlx5_core]
       mlx5e_switch_priv_channels+0x1cd/0x2d0 [mlx5_core]
       ? mlx5e_xdp_allowed+0x150/0x150 [mlx5_core]
       mlx5e_safe_switch_params+0x118/0x3c0 [mlx5_core]
       ? __mutex_lock+0x6e/0x8e0
       ? mlx5e_hwstamp_set+0xa9/0x300 [mlx5_core]
       mlx5e_hwstamp_set+0x194/0x300 [mlx5_core]
       ? dev_ioctl+0x9b/0x3d0
       mlx5i_ioctl+0x37/0x60 [mlx5_core]
       mlx5i_pkey_ioctl+0x12/0x20 [mlx5_core]
       dev_ioctl+0xa9/0x3d0
       sock_ioctl+0x268/0x420
       __x64_sys_ioctl+0x3d8/0x790
       ? lockdep_hardirqs_on_prepare+0xe4/0x190
       do_syscall_64+0x2d/0x40
      entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Fixes: 960fbfe2 ("net/mlx5e: Allow coexistence of CQE compression and HW TS PTP")
      Signed-off-by: default avatarAya Levin <ayal@nvidia.com>
      Reviewed-by: default avatarMoshe Shemesh <moshe@nvidia.com>
      Reviewed-by: default avatarTariq Toukan <tariqt@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      256f79d1
    • Roi Dayan's avatar
      net/mlx5e: Fix adding encap rules to slow path · 2a2c84fa
      Roi Dayan authored
      On some devices the ignore flow level cap is not supported and we
      shouldn't use it. Setting the dest ft with mlx5_chains_get_tc_end_ft()
      already gives the correct end ft if ignore flow level cap is supported
      or not.
      
      Fixes: 39ac237c ("net/mlx5: E-Switch, Refactor chains and priorities")
      Signed-off-by: default avatarRoi Dayan <roid@nvidia.com>
      Reviewed-by: default avatarPaul Blakey <paulb@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      2a2c84fa
    • Roi Dayan's avatar
      net/mlx5e: Check for needed capability for cvlan matching · afe93f71
      Roi Dayan authored
      If not supported show an error and return instead of trying to offload
      to the hardware and fail.
      
      Fixes: 699e96dd ("net/mlx5e: Support offloading tc double vlan headers match")
      Reported-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: default avatarRoi Dayan <roid@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      afe93f71
    • Moshe Shemesh's avatar
      net/mlx5: Check firmware sync reset requested is set before trying to abort it · 5940e642
      Moshe Shemesh authored
      In case driver sent NACK to firmware on sync reset request, it will get
      sync reset abort event while it didn't set sync reset requested mode.
      Thus, on abort sync reset event handler, driver should check reset
      requested is set before trying to stop sync reset poll.
      
      Fixes: 7dd6df32 ("net/mlx5: Handle sync reset abort event")
      Signed-off-by: default avatarMoshe Shemesh <moshe@nvidia.com>
      Reviewed-by: default avatarTariq Toukan <tariqt@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      5940e642
    • Roi Dayan's avatar
      net/mlx5e: Disable TLS offload for uplink representor · b38742e4
      Roi Dayan authored
      TLS offload is not supported in switchdev mode.
      
      Fixes: 7a9fb35e ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode")
      Signed-off-by: default avatarRoi Dayan <roid@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      b38742e4
    • Aya Levin's avatar
      net/mlx5e: Fix incompatible casting · d8ec9200
      Aya Levin authored
      Device supports setting of a single fec mode at a time, enforce this
      by bitmap_weight == 1. Input from fec command is in u32, avoid cast to
      unsigned long and use bitmap_from_arr32 to populate bitmap safely.
      
      Fixes: 4bd9d507 ("net/mlx5e: Enforce setting of a single FEC mode")
      Signed-off-by: default avatarAya Levin <ayal@nvidia.com>
      Reviewed-by: default avatarTariq Toukan <tariqt@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      d8ec9200
    • Joe Perches's avatar
      MAINTAINERS: nfc mailing lists are subscribers-only · b0003726
      Joe Perches authored
      It looks as if the MAINTAINERS entries for the nfc mailing list
      should be updated as I just got a "rejected" bounce from the nfc list.
      
      -------
      Your message to the Linux-nfc mailing-list was rejected for the following
      reasons:
      
      The message is not from a list member
      -------
      Signed-off-by: default avatarJoe Perches <joe@perches.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b0003726
  3. 01 Jun, 2021 10 commits
    • David S. Miller's avatar
      Merge branch 'ktls-use-after-free' · 7c0aee30
      David S. Miller authored
      Maxim Mikityanskiy says:
      
      ====================
      Fix use-after-free after the TLS device goes down and up
      
      This small series fixes a use-after-free bug in the TLS offload code.
      The first patch is a preparation for the second one, and the second is
      the fix itself.
      
      v2 changes:
      
      Remove unneeded EXPORT_SYMBOL_GPL.
      ====================
      Acked-by: default avatarJakub Kicinski <kuba@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7c0aee30
    • Maxim Mikityanskiy's avatar
      net/tls: Fix use-after-free after the TLS device goes down and up · c55dcdd4
      Maxim Mikityanskiy authored
      When a netdev with active TLS offload goes down, tls_device_down is
      called to stop the offload and tear down the TLS context. However, the
      socket stays alive, and it still points to the TLS context, which is now
      deallocated. If a netdev goes up, while the connection is still active,
      and the data flow resumes after a number of TCP retransmissions, it will
      lead to a use-after-free of the TLS context.
      
      This commit addresses this bug by keeping the context alive until its
      normal destruction, and implements the necessary fallbacks, so that the
      connection can resume in software (non-offloaded) kTLS mode.
      
      On the TX side tls_sw_fallback is used to encrypt all packets. The RX
      side already has all the necessary fallbacks, because receiving
      non-decrypted packets is supported. The thing needed on the RX side is
      to block resync requests, which are normally produced after receiving
      non-decrypted packets.
      
      The necessary synchronization is implemented for a graceful teardown:
      first the fallbacks are deployed, then the driver resources are released
      (it used to be possible to have a tls_dev_resync after tls_dev_del).
      
      A new flag called TLS_RX_DEV_DEGRADED is added to indicate the fallback
      mode. It's used to skip the RX resync logic completely, as it becomes
      useless, and some objects may be released (for example, resync_async,
      which is allocated and freed by the driver).
      
      Fixes: e8f69799 ("net/tls: Add generic NIC offload infrastructure")
      Signed-off-by: default avatarMaxim Mikityanskiy <maximmi@nvidia.com>
      Reviewed-by: default avatarTariq Toukan <tariqt@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c55dcdd4
    • Maxim Mikityanskiy's avatar
      net/tls: Replace TLS_RX_SYNC_RUNNING with RCU · 05fc8b6c
      Maxim Mikityanskiy authored
      RCU synchronization is guaranteed to finish in finite time, unlike a
      busy loop that polls a flag. This patch is a preparation for the bugfix
      in the next patch, where the same synchronize_net() call will also be
      used to sync with the TX datapath.
      Signed-off-by: default avatarMaxim Mikityanskiy <maximmi@nvidia.com>
      Reviewed-by: default avatarTariq Toukan <tariqt@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      05fc8b6c
    • Jiapeng Chong's avatar
      ethernet: myri10ge: Fix missing error code in myri10ge_probe() · f336d0b9
      Jiapeng Chong authored
      The error code is missing in this code scenario, add the error code
      '-EINVAL' to the return value 'status'.
      
      Eliminate the follow smatch warning:
      
      drivers/net/ethernet/myricom/myri10ge/myri10ge.c:3818 myri10ge_probe()
      warn: missing error code 'status'.
      Reported-by: default avatarAbaci Robot <abaci@linux.alibaba.com>
      Signed-off-by: default avatarJiapeng Chong <jiapeng.chong@linux.alibaba.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f336d0b9
    • David S. Miller's avatar
      Merge branch 'virtio_net-build_skb-fixes' · 53d5fa9b
      David S. Miller authored
      Xuan Zhuo says:
      
      ====================
      virtio-net: fix for build_skb()
      
      The logic of this piece is really messy. Fortunately, my refactored patch can be
      completed with a small amount of testing.
      ====================
      Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      53d5fa9b
    • Xuan Zhuo's avatar
      virtio_net: get build_skb() buf by data ptr · 8fb7da9e
      Xuan Zhuo authored
      In the case of merge, the page passed into page_to_skb() may be a head
      page, not the page where the current data is located. So when trying to
      get the buf where the data is located, we should get buf based on
      headroom instead of offset.
      
      This patch solves this problem. But if you don't use this patch, the
      original code can also run, because if the page is not the page of the
      current data, the calculated tailroom will be less than 0, and will not
      enter the logic of build_skb() . The significance of this patch is to
      modify this logical problem, allowing more situations to use
      build_skb().
      Signed-off-by: default avatarXuan Zhuo <xuanzhuo@linux.alibaba.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8fb7da9e
    • Xuan Zhuo's avatar
      virtio-net: fix for unable to handle page fault for address · 5c37711d
      Xuan Zhuo authored
      In merge mode, when xdp is enabled, if the headroom of buf is smaller
      than virtnet_get_headroom(), xdp_linearize_page() will be called but the
      variable of "headroom" is still 0, which leads to wrong logic after
      entering page_to_skb().
      
      [   16.600944] BUG: unable to handle page fault for address: ffffecbfff7b43c8[   16.602175] #PF: supervisor read access in kernel mode
      [   16.603350] #PF: error_code(0x0000) - not-present page
      [   16.604200] PGD 0 P4D 0
      [   16.604686] Oops: 0000 [#1] SMP PTI
      [   16.605306] CPU: 4 PID: 715 Comm: sh Tainted: G    B             5.12.0+ #312
      [   16.606429] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/04
      [   16.608217] RIP: 0010:unmap_page_range+0x947/0xde0
      [   16.609014] Code: 00 00 08 00 48 83 f8 01 45 19 e4 41 f7 d4 41 83 e4 03 e9 a4 fd ff ff e8 b7 63 ed ff 4c 89 e0 48 c1 e0 065
      [   16.611863] RSP: 0018:ffffc90002503c58 EFLAGS: 00010286
      [   16.612720] RAX: ffffecbfff7b43c0 RBX: 00007f19f7203000 RCX: ffffffff812ff359
      [   16.613853] RDX: ffff888107778000 RSI: 0000000000000000 RDI: 0000000000000005
      [   16.614976] RBP: ffffea000425e000 R08: 0000000000000000 R09: 3030303030303030
      [   16.616124] R10: ffffffff82ed7d94 R11: 6637303030302052 R12: 7c00000afffded0f
      [   16.617276] R13: 0000000000000001 R14: ffff888119ee7010 R15: 00007f19f7202000
      [   16.618423] FS:  0000000000000000(0000) GS:ffff88842fd00000(0000) knlGS:0000000000000000
      [   16.619738] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [   16.620670] CR2: ffffecbfff7b43c8 CR3: 0000000103220005 CR4: 0000000000370ee0
      [   16.621792] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [   16.622920] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [   16.624047] Call Trace:
      [   16.624525]  ? release_pages+0x24d/0x730
      [   16.625209]  unmap_single_vma+0xa9/0x130
      [   16.625885]  unmap_vmas+0x76/0xf0
      [   16.626480]  exit_mmap+0xa0/0x210
      [   16.627129]  mmput+0x67/0x180
      [   16.627673]  do_exit+0x3d1/0xf10
      [   16.628259]  ? do_user_addr_fault+0x231/0x840
      [   16.629000]  do_group_exit+0x53/0xd0
      [   16.629631]  __x64_sys_exit_group+0x1d/0x20
      [   16.630354]  do_syscall_64+0x3c/0x80
      [   16.630988]  entry_SYSCALL_64_after_hwframe+0x44/0xae
      [   16.631828] RIP: 0033:0x7f1a043d0191
      [   16.632464] Code: Unable to access opcode bytes at RIP 0x7f1a043d0167.
      [   16.633502] RSP: 002b:00007ffe3d993308 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
      [   16.634737] RAX: ffffffffffffffda RBX: 00007f1a044c9490 RCX: 00007f1a043d0191
      [   16.635857] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
      [   16.636986] RBP: 0000000000000000 R08: ffffffffffffff88 R09: 0000000000000001
      [   16.638120] R10: 0000000000000008 R11: 0000000000000246 R12: 00007f1a044c9490
      [   16.639245] R13: 0000000000000001 R14: 00007f1a044c9968 R15: 0000000000000000
      [   16.640408] Modules linked in:
      [   16.640958] CR2: ffffecbfff7b43c8
      [   16.641557] ---[ end trace bc4891c6ce46354c ]---
      [   16.642335] RIP: 0010:unmap_page_range+0x947/0xde0
      [   16.643135] Code: 00 00 08 00 48 83 f8 01 45 19 e4 41 f7 d4 41 83 e4 03 e9 a4 fd ff ff e8 b7 63 ed ff 4c 89 e0 48 c1 e0 065
      [   16.645983] RSP: 0018:ffffc90002503c58 EFLAGS: 00010286
      [   16.646845] RAX: ffffecbfff7b43c0 RBX: 00007f19f7203000 RCX: ffffffff812ff359
      [   16.647970] RDX: ffff888107778000 RSI: 0000000000000000 RDI: 0000000000000005
      [   16.649091] RBP: ffffea000425e000 R08: 0000000000000000 R09: 3030303030303030
      [   16.650250] R10: ffffffff82ed7d94 R11: 6637303030302052 R12: 7c00000afffded0f
      [   16.651394] R13: 0000000000000001 R14: ffff888119ee7010 R15: 00007f19f7202000
      [   16.652529] FS:  0000000000000000(0000) GS:ffff88842fd00000(0000) knlGS:0000000000000000
      [   16.653887] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [   16.654841] CR2: ffffecbfff7b43c8 CR3: 0000000103220005 CR4: 0000000000370ee0
      [   16.655992] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [   16.657150] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [   16.658290] Kernel panic - not syncing: Fatal exception
      [   16.659613] Kernel Offset: disabled
      [   16.660234] ---[ end Kernel panic - not syncing: Fatal exception ]---
      
      Fixes: fb32856b ("virtio-net: page_to_skb() use build_skb when there's sufficient tailroom")
      Signed-off-by: default avatarXuan Zhuo <xuanzhuo@linux.alibaba.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5c37711d
    • Alexander Aring's avatar
      net: sock: fix in-kernel mark setting · dd9082f4
      Alexander Aring authored
      This patch fixes the in-kernel mark setting by doing an additional
      sk_dst_reset() which was introduced by commit 50254256 ("sock: Reset
      dst when changing sk_mark via setsockopt"). The code is now shared to
      avoid any further suprises when changing the socket mark value.
      
      Fixes: 84d1c617 ("net: sock: add sock_set_mark")
      Reported-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarAlexander Aring <aahringo@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dd9082f4
    • Vladimir Oltean's avatar
      net: dsa: tag_8021q: fix the VLAN IDs used for encoding sub-VLANs · 4ef8d857
      Vladimir Oltean authored
      When using sub-VLANs in the range of 1-7, the resulting value from:
      
      	rx_vid = dsa_8021q_rx_vid_subvlan(ds, port, subvlan);
      
      is wrong according to the description from tag_8021q.c:
      
       | 11  | 10  |  9  |  8  |  7  |  6  |  5  |  4  |  3  |  2  |  1  |  0  |
       +-----------+-----+-----------------+-----------+-----------------------+
       |    DIR    | SVL |    SWITCH_ID    |  SUBVLAN  |          PORT         |
       +-----------+-----+-----------------+-----------+-----------------------+
      
      For example, when ds->index == 0, port == 3 and subvlan == 1,
      dsa_8021q_rx_vid_subvlan() returns 1027, same as it returns for
      subvlan == 0, but it should have returned 1043.
      
      This is because the low portion of the subvlan bits are not masked
      properly when writing into the 12-bit VLAN value. They are masked into
      bits 4:3, but they should be masked into bits 5:4.
      
      Fixes: 3eaae1d0 ("net: dsa: tag_8021q: support up to 8 VLANs per port using sub-VLANs")
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4ef8d857
    • Krzysztof Kozlowski's avatar
      nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect · 4ac06a1e
      Krzysztof Kozlowski authored
      It's possible to trigger NULL pointer dereference by local unprivileged
      user, when calling getsockname() after failed bind() (e.g. the bind
      fails because LLCP_SAP_MAX used as SAP):
      
        BUG: kernel NULL pointer dereference, address: 0000000000000000
        CPU: 1 PID: 426 Comm: llcp_sock_getna Not tainted 5.13.0-rc2-next-20210521+ #9
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1 04/01/2014
        Call Trace:
         llcp_sock_getname+0xb1/0xe0
         __sys_getpeername+0x95/0xc0
         ? lockdep_hardirqs_on_prepare+0xd5/0x180
         ? syscall_enter_from_user_mode+0x1c/0x40
         __x64_sys_getpeername+0x11/0x20
         do_syscall_64+0x36/0x70
         entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      This can be reproduced with Syzkaller C repro (bind followed by
      getpeername):
      https://syzkaller.appspot.com/x/repro.c?x=14def446e00000
      
      Cc: <stable@vger.kernel.org>
      Fixes: d646960f ("NFC: Initial LLCP support")
      Reported-by: syzbot+80fb126e7f7d8b1a5914@syzkaller.appspotmail.com
      Reported-by: default avatarbutt3rflyh4ck <butterflyhuangxx@gmail.com>
      Signed-off-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
      Link: https://lore.kernel.org/r/20210531072138.5219-1-krzysztof.kozlowski@canonical.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      4ac06a1e
  4. 30 May, 2021 1 commit
    • Sriranjani P's avatar
      net: stmmac: fix kernel panic due to NULL pointer dereference of mdio_bus_data · 593f555f
      Sriranjani P authored
      Fixed link does not need mdio bus and in that case mdio_bus_data will
      not be allocated. Before using mdio_bus_data we should check for NULL.
      
      This patch fix the kernel panic due to NULL pointer dereference of
      mdio_bus_data when it is not allocated.
      
      Without this patch we do see following kernel crash caused due to kernel
      NULL pointer dereference.
      
      Call trace:
      stmmac_dvr_probe+0x3c/0x10b0
      dwc_eth_dwmac_probe+0x224/0x378
      platform_probe+0x68/0xe0
      really_probe+0x130/0x3d8
      driver_probe_device+0x68/0xd0
      device_driver_attach+0x74/0x80
      __driver_attach+0x58/0xf8
      bus_for_each_dev+0x7c/0xd8
      driver_attach+0x24/0x30
      bus_add_driver+0x148/0x1f0
      driver_register+0x64/0x120
      __platform_driver_register+0x28/0x38
      dwc_eth_dwmac_driver_init+0x1c/0x28
      do_one_initcall+0x78/0x158
      kernel_init_freeable+0x1f0/0x244
      kernel_init+0x14/0x118
      ret_from_fork+0x10/0x30
      Code: f9002bfb 9113e2d9 910e6273 aa0003f7 (f9405c78)
      ---[ end trace 32d9d41562ddc081 ]---
      
      Fixes: e5e5b771 ("net: stmmac: make in-band AN mode parsing is supported for non-DT")
      Signed-off-by: default avatarSriranjani P <sriranjani.p@samsung.com>
      Signed-off-by: default avatarPankaj Dubey <pankaj.dubey@samsung.com>
      Link: https://lore.kernel.org/r/20210528071056.35252-1-sriranjani.p@samsung.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      593f555f
  5. 28 May, 2021 5 commits
  6. 27 May, 2021 6 commits
    • Jakub Kicinski's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · 44991d61
      Jakub Kicinski authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter/IPVS fixes for net
      
      The following patchset contains Netfilter/IPVS fixes for net:
      
      1) Fix incorrect sockopts unregistration from error path,
         from Florian Westphal.
      
      2) A few patches to provide better error reporting when missing kernel
         netfilter options are missing in .config.
      
      3) Fix dormant table flag updates.
      
      4) Memleak in IPVS  when adding service with IP_VS_SVC_F_HASHED flag.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf:
        ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service
        netfilter: nf_tables: fix table flag updates
        netfilter: nf_tables: extended netlink error reporting for chain type
        netfilter: nf_tables: missing error reporting for not selected expressions
        netfilter: conntrack: unregister ipv4 sockopts on error unwind
      ====================
      
      Link: https://lore.kernel.org/r/20210527190115.98503-1-pablo@netfilter.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      44991d61
    • Ariel Levkovich's avatar
      net/sched: act_ct: Fix ct template allocation for zone 0 · fb91702b
      Ariel Levkovich authored
      Fix current behavior of skipping template allocation in case the
      ct action is in zone 0.
      
      Skipping the allocation may cause the datapath ct code to ignore the
      entire ct action with all its attributes (commit, nat) in case the ct
      action in zone 0 was preceded by a ct clear action.
      
      The ct clear action sets the ct_state to untracked and resets the
      skb->_nfct pointer. Under these conditions and without an allocated
      ct template, the skb->_nfct pointer will remain NULL which will
      cause the tc ct action handler to exit without handling commit and nat
      actions, if such exist.
      
      For example, the following rule in OVS dp:
      recirc_id(0x2),ct_state(+new-est-rel-rpl+trk),ct_label(0/0x1), \
      in_port(eth0),actions:ct_clear,ct(commit,nat(src=10.11.0.12)), \
      recirc(0x37a)
      
      Will result in act_ct skipping the commit and nat actions in zone 0.
      
      The change removes the skipping of template allocation for zone 0 and
      treats it the same as any other zone.
      
      Fixes: b57dc7c1 ("net/sched: Introduce action ct")
      Signed-off-by: default avatarAriel Levkovich <lariel@nvidia.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Link: https://lore.kernel.org/r/20210526170110.54864-1-lariel@nvidia.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      fb91702b
    • Paul Blakey's avatar
      net/sched: act_ct: Offload connections with commit action · 0cc254e5
      Paul Blakey authored
      Currently established connections are not offloaded if the filter has a
      "ct commit" action. This behavior will not offload connections of the
      following scenario:
      
      $ tc_filter add dev $DEV ingress protocol ip prio 1 flower \
        ct_state -trk \
        action ct commit action goto chain 1
      
      $ tc_filter add dev $DEV ingress protocol ip chain 1 prio 1 flower \
        action mirred egress redirect dev $DEV2
      
      $ tc_filter add dev $DEV2 ingress protocol ip prio 1 flower \
        action ct commit action goto chain 1
      
      $ tc_filter add dev $DEV2 ingress protocol ip prio 1 chain 1 flower \
        ct_state +trk+est \
        action mirred egress redirect dev $DEV
      
      Offload established connections, regardless of the commit flag.
      
      Fixes: 46475bb2 ("net/sched: act_ct: Software offload of established flows")
      Reviewed-by: default avatarOz Shlomo <ozsh@nvidia.com>
      Reviewed-by: default avatarJiri Pirko <jiri@nvidia.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarPaul Blakey <paulb@nvidia.com>
      Link: https://lore.kernel.org/r/1622029449-27060-1-git-send-email-paulb@nvidia.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      0cc254e5
    • Parav Pandit's avatar
      devlink: Correct VIRTUAL port to not have phys_port attributes · b28d8f0c
      Parav Pandit authored
      Physical port name, port number attributes do not belong to virtual port
      flavour. When VF or SF virtual ports are registered they incorrectly
      append "np0" string in the netdevice name of the VF/SF.
      
      Before this fix, VF netdevice name were ens2f0np0v0, ens2f0np0v1 for VF
      0 and 1 respectively.
      
      After the fix, they are ens2f0v0, ens2f0v1.
      
      With this fix, reading /sys/class/net/ens2f0v0/phys_port_name returns
      -EOPNOTSUPP.
      
      Also devlink port show example for 2 VFs on one PF to ensure that any
      physical port attributes are not exposed.
      
      $ devlink port show
      pci/0000:06:00.0/65535: type eth netdev ens2f0np0 flavour physical port 0 splittable false
      pci/0000:06:00.3/196608: type eth netdev ens2f0v0 flavour virtual splittable false
      pci/0000:06:00.4/262144: type eth netdev ens2f0v1 flavour virtual splittable false
      
      This change introduces a netdevice name change on systemd/udev
      version 245 and higher which honors phys_port_name sysfs file for
      generation of netdevice name.
      
      This also aligns to phys_port_name usage which is limited to switchdev
      ports as described in [1].
      
      [1] https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/tree/Documentation/networking/switchdev.rst
      
      Fixes: acf1ee44 ("devlink: Introduce devlink port flavour virtual")
      Signed-off-by: default avatarParav Pandit <parav@nvidia.com>
      Reviewed-by: default avatarJiri Pirko <jiri@nvidia.com>
      Link: https://lore.kernel.org/r/20210526200027.14008-1-parav@nvidia.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      b28d8f0c
    • Julian Anastasov's avatar
      ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service · 56e4ee82
      Julian Anastasov authored
      syzbot reported memory leak [1] when adding service with
      HASHED flag. We should ignore this flag both from sockopt
      and netlink provided data, otherwise the service is not
      hashed and not visible while releasing resources.
      
      [1]
      BUG: memory leak
      unreferenced object 0xffff888115227800 (size 512):
        comm "syz-executor263", pid 8658, jiffies 4294951882 (age 12.560s)
        hex dump (first 32 bytes):
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        backtrace:
          [<ffffffff83977188>] kmalloc include/linux/slab.h:556 [inline]
          [<ffffffff83977188>] kzalloc include/linux/slab.h:686 [inline]
          [<ffffffff83977188>] ip_vs_add_service+0x598/0x7c0 net/netfilter/ipvs/ip_vs_ctl.c:1343
          [<ffffffff8397d770>] do_ip_vs_set_ctl+0x810/0xa40 net/netfilter/ipvs/ip_vs_ctl.c:2570
          [<ffffffff838449a8>] nf_setsockopt+0x68/0xa0 net/netfilter/nf_sockopt.c:101
          [<ffffffff839ae4e9>] ip_setsockopt+0x259/0x1ff0 net/ipv4/ip_sockglue.c:1435
          [<ffffffff839fa03c>] raw_setsockopt+0x18c/0x1b0 net/ipv4/raw.c:857
          [<ffffffff83691f20>] __sys_setsockopt+0x1b0/0x360 net/socket.c:2117
          [<ffffffff836920f2>] __do_sys_setsockopt net/socket.c:2128 [inline]
          [<ffffffff836920f2>] __se_sys_setsockopt net/socket.c:2125 [inline]
          [<ffffffff836920f2>] __x64_sys_setsockopt+0x22/0x30 net/socket.c:2125
          [<ffffffff84350efa>] do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
          [<ffffffff84400068>] entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Reported-and-tested-by: syzbot+e562383183e4b1766930@syzkaller.appspotmail.com
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Signed-off-by: default avatarJulian Anastasov <ja@ssi.bg>
      Reviewed-by: default avatarSimon Horman <horms@verge.net.au>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      56e4ee82
    • Linus Torvalds's avatar
      Merge tag 'net-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · d7c5303f
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Networking fixes for 5.13-rc4, including fixes from bpf, netfilter,
        can and wireless trees. Notably including fixes for the recently
        announced "FragAttacks" WiFi vulnerabilities. Rather large batch,
        touching some core parts of the stack, too, but nothing hair-raising.
      
        Current release - regressions:
      
         - tipc: make node link identity publish thread safe
      
         - dsa: felix: re-enable TAS guard band mode
      
         - stmmac: correct clocks enabled in stmmac_vlan_rx_kill_vid()
      
         - stmmac: fix system hang if change mac address after interface
           ifdown
      
        Current release - new code bugs:
      
         - mptcp: avoid OOB access in setsockopt()
      
         - bpf: Fix nested bpf_bprintf_prepare with more per-cpu buffers
      
         - ethtool: stats: fix a copy-paste error - init correct array size
      
        Previous releases - regressions:
      
         - sched: fix packet stuck problem for lockless qdisc
      
         - net: really orphan skbs tied to closing sk
      
         - mlx4: fix EEPROM dump support
      
         - bpf: fix alu32 const subreg bound tracking on bitwise operations
      
         - bpf: fix mask direction swap upon off reg sign change
      
         - bpf, offload: reorder offload callback 'prepare' in verifier
      
         - stmmac: Fix MAC WoL not working if PHY does not support WoL
      
         - packetmmap: fix only tx timestamp on request
      
         - tipc: skb_linearize the head skb when reassembling msgs
      
        Previous releases - always broken:
      
         - mac80211: address recent "FragAttacks" vulnerabilities
      
         - mac80211: do not accept/forward invalid EAPOL frames
      
         - mptcp: avoid potential error message floods
      
         - bpf, ringbuf: deny reserve of buffers larger than ringbuf to
           prevent out of buffer writes
      
         - bpf: forbid trampoline attach for functions with variable arguments
      
         - bpf: add deny list of functions to prevent inf recursion of tracing
           programs
      
         - tls splice: check SPLICE_F_NONBLOCK instead of MSG_DONTWAIT
      
         - can: isotp: prevent race between isotp_bind() and
           isotp_setsockopt()
      
         - netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check,
           fallback to non-AVX2 version
      
        Misc:
      
         - bpf: add kconfig knob for disabling unpriv bpf by default"
      
      * tag 'net-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (172 commits)
        net: phy: Document phydev::dev_flags bits allocation
        mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer
        mptcp: avoid error message on infinite mapping
        mptcp: drop unconditional pr_warn on bad opt
        mptcp: avoid OOB access in setsockopt()
        nfp: update maintainer and mailing list addresses
        net: mvpp2: add buffer header handling in RX
        bnx2x: Fix missing error code in bnx2x_iov_init_one()
        net: zero-initialize tc skb extension on allocation
        net: hns: Fix kernel-doc
        sctp: fix the proc_handler for sysctl encap_port
        sctp: add the missing setting for asoc encap_port
        bpf, selftests: Adjust few selftest result_unpriv outcomes
        bpf: No need to simulate speculative domain for immediates
        bpf: Fix mask direction swap upon off reg sign change
        bpf: Wrap aux data inside bpf_sanitize_info container
        bpf: Fix BPF_LSM kconfig symbol dependency
        selftests/bpf: Add test for l3 use of bpf_redirect_peer
        bpftool: Add sock_release help info for cgroup attach/prog load command
        net: dsa: microchip: enable phy errata workaround on 9567
        ...
      d7c5303f
  7. 26 May, 2021 1 commit