1. 23 Feb, 2018 3 commits
    • Andy Spencer's avatar
      gianfar: simplify FCS handling and fix memory leak · d903ec77
      Andy Spencer authored
      Previously, buffer descriptors containing only the frame check sequence
      (FCS) were skipped and not added to the skb. However, the page reference
      count was still incremented, leading to a memory leak.
      
      Fixing this inside gfar_add_rx_frag() is difficult due to reserved
      memory handling and page reuse. Instead, move the FCS handling to
      gfar_process_frame() and trim off the FCS before passing the skb up the
      networking stack.
      Signed-off-by: default avatarAndy Spencer <aspencer@spacex.com>
      Signed-off-by: default avatarJim Gruen <jgruen@spacex.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d903ec77
    • Arnd Bergmann's avatar
      ipv6 sit: work around bogus gcc-8 -Wrestrict warning · ca79bec2
      Arnd Bergmann authored
      gcc-8 has a new warning that detects overlapping input and output arguments
      in memcpy(). It triggers for sit_init_net() calling ipip6_tunnel_clone_6rd(),
      which is actually correct:
      
      net/ipv6/sit.c: In function 'sit_init_net':
      net/ipv6/sit.c:192:3: error: 'memcpy' source argument is the same as destination [-Werror=restrict]
      
      The problem here is that the logic detecting the memcpy() arguments finds them
      to be the same, but the conditional that tests for the input and output of
      ipip6_tunnel_clone_6rd() to be identical is not a compile-time constant.
      
      We know that netdev_priv(t->dev) is the same as t for a tunnel device,
      and comparing "dev" directly here lets the compiler figure out as well
      that 'dev == sitn->fb_tunnel_dev' when called from sit_init_net(), so
      it no longer warns.
      
      This code is old, so Cc stable to make sure that we don't get the warning
      for older kernels built with new gcc.
      
      Cc: Martin Sebor <msebor@gmail.com>
      Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83456Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ca79bec2
    • Alexey Kodanev's avatar
      macvlan: fix use-after-free in macvlan_common_newlink() · 4e14bf42
      Alexey Kodanev authored
      The following use-after-free was reported by KASan when running
      LTP macvtap01 test on 4.16-rc2:
      
      [10642.528443] BUG: KASAN: use-after-free in
                     macvlan_common_newlink+0x12ef/0x14a0 [macvlan]
      [10642.626607] Read of size 8 at addr ffff880ba49f2100 by task ip/18450
      ...
      [10642.963873] Call Trace:
      [10642.994352]  dump_stack+0x5c/0x7c
      [10643.035325]  print_address_description+0x75/0x290
      [10643.092938]  kasan_report+0x28d/0x390
      [10643.137971]  ? macvlan_common_newlink+0x12ef/0x14a0 [macvlan]
      [10643.207963]  macvlan_common_newlink+0x12ef/0x14a0 [macvlan]
      [10643.275978]  macvtap_newlink+0x171/0x260 [macvtap]
      [10643.334532]  rtnl_newlink+0xd4f/0x1300
      ...
      [10646.256176] Allocated by task 18450:
      [10646.299964]  kasan_kmalloc+0xa6/0xd0
      [10646.343746]  kmem_cache_alloc_trace+0xf1/0x210
      [10646.397826]  macvlan_common_newlink+0x6de/0x14a0 [macvlan]
      [10646.464386]  macvtap_newlink+0x171/0x260 [macvtap]
      [10646.522728]  rtnl_newlink+0xd4f/0x1300
      ...
      [10647.022028] Freed by task 18450:
      [10647.061549]  __kasan_slab_free+0x138/0x180
      [10647.111468]  kfree+0x9e/0x1c0
      [10647.147869]  macvlan_port_destroy+0x3db/0x650 [macvlan]
      [10647.211411]  rollback_registered_many+0x5b9/0xb10
      [10647.268715]  rollback_registered+0xd9/0x190
      [10647.319675]  register_netdevice+0x8eb/0xc70
      [10647.370635]  macvlan_common_newlink+0xe58/0x14a0 [macvlan]
      [10647.437195]  macvtap_newlink+0x171/0x260 [macvtap]
      
      Commit d02fd6e7 ("macvlan: Fix one possible double free") handles
      the case when register_netdevice() invokes ndo_uninit() on error and
      as a result free the port. But 'macvlan_port_get_rtnl(dev))' check
      (returns dev->rx_handler_data), which was added by this commit in order
      to prevent double free, is not quite correct:
      
      * for macvlan it always returns NULL because 'lowerdev' is the one that
        was used to register rx handler (port) in macvlan_port_create() as
        well as to unregister it in macvlan_port_destroy().
      * for macvtap it always returns a valid pointer because macvtap registers
        its own rx handler before macvlan_common_newlink().
      
      Fixes: d02fd6e7 ("macvlan: Fix one possible double free")
      Signed-off-by: default avatarAlexey Kodanev <alexey.kodanev@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4e14bf42
  2. 22 Feb, 2018 10 commits
  3. 21 Feb, 2018 10 commits
    • Tom Lendacky's avatar
      amd-xgbe: Restore PCI interrupt enablement setting on resume · cfd092f2
      Tom Lendacky authored
      After resuming from suspend, the PCI device support must re-enable the
      interrupt setting so that interrupts are actually delivered.
      Signed-off-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cfd092f2
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf · bf006d18
      David S. Miller authored
      Daniel Borkmann says:
      
      ====================
      pull-request: bpf 2018-02-20
      
      The following pull-request contains BPF updates for your *net* tree.
      
      The main changes are:
      
      1) Fix a memory leak in LPM trie's map_free() callback function, where
         the trie structure itself was not freed since initial implementation.
         Also a synchronize_rcu() was needed in order to wait for outstanding
         programs accessing the trie to complete, from Yonghong.
      
      2) Fix sock_map_alloc()'s error path in order to correctly propagate
         the -EINVAL error in case of too large allocation requests. This
         was just recently introduced when fixing close hooks via ULP layer,
         fix from Eric.
      
      3) Do not use GFP_ATOMIC in __cpu_map_entry_alloc(). Reason is that this
         will not work with the recent __ptr_ring_init_queue_alloc() conversion
         to kvmalloc_array(), where in case of fallback to vmalloc() that GFP
         flag is invalid, from Jason.
      
      4) Fix two recent syzkaller warnings: i) fix bpf_prog_array_copy_to_user()
         when a prog query with a big number of ids was performed where we'd
         otherwise trigger a warning from allocator side, ii) fix a missing
         mlock precharge on arraymaps, from Daniel.
      
      5) Two fixes for bpftool in order to avoid breaking JSON output when used
         in batch mode, from Quentin.
      
      6) Move a pr_debug() in libbpf in order to avoid having an otherwise
         uninitialized variable in bpf_program__reloc_text(), from Jeremy.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bf006d18
    • David S. Miller's avatar
      Merge branch 'virtio_net-XDP-fixes' · 6c4df17c
      David S. Miller authored
      Jesper Dangaard Brouer says:
      
      ====================
      virtio_net: several bugs in XDP code for driver virtio_net
      
      The virtio_net driver actually violates the original memory model of
      XDP causing hard to debug crashes.  Per request of John Fastabend,
      instead of removing the XDP feature I'm fixing as much as possible.
      While testing virtio_net with XDP_REDIRECT I found 4 different bugs.
      
      Patch-1: not enough tail-room for build_skb in receive_mergeable()
       only option is to disable XDP_REDIRECT in receive_mergeable()
      
      Patch-2: XDP in receive_small() basically never worked (check wrong flag)
      
      Patch-3: fix memory leak for XDP_REDIRECT in error cases
      
      Patch-4: avoid crash when ndo_xdp_xmit is called on dev not ready for XDP
      
      In the longer run, we should consider introducing a separate receive
      function when attaching an XDP program, and also change the memory
      model to be compatible with XDP when attaching an XDP prog.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6c4df17c
    • Jesper Dangaard Brouer's avatar
      virtio_net: fix ndo_xdp_xmit crash towards dev not ready for XDP · 8dcc5b0a
      Jesper Dangaard Brouer authored
      When a driver implements the ndo_xdp_xmit() function, there is
      (currently) no generic way to determine whether it is safe to call.
      
      It is e.g. unsafe to call the drivers ndo_xdp_xmit, if it have not
      allocated the needed XDP TX queues yet.  This is the case for
      virtio_net, which first allocates the XDP TX queues once an XDP/bpf
      prog is attached (in virtnet_xdp_set()).
      
      Thus, a crash will occur for virtio_net when redirecting to another
      virtio_net device's ndo_xdp_xmit, which have not attached a XDP prog.
      The sample xdp_redirect_map tries to attach a dummy XDP prog to take
      this into account, but it can also easily fail if the virtio_net (or
      actually underlying vhost driver) have not allocated enough extra
      queues for the device.
      
      Allocating more queue this is currently a manual config.
      Hint for libvirt XML add:
      
        <driver name='vhost' queues='16'>
          <host mrg_rxbuf='off'/>
          <guest tso4='off' tso6='off' ecn='off' ufo='off'/>
        </driver>
      
      The solution in this patch is to check that the device have loaded an
      XDP/bpf prog before proceeding.  This is similar to the check
      performed in driver ixgbe.
      Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8dcc5b0a
    • Jesper Dangaard Brouer's avatar
      virtio_net: fix memory leak in XDP_REDIRECT · 11b7d897
      Jesper Dangaard Brouer authored
      XDP_REDIRECT calling xdp_do_redirect() can fail for multiple reasons
      (which can be inspected by tracepoints). The current semantics is that
      on failure the driver calling xdp_do_redirect() must handle freeing or
      recycling the page associated with this frame.  This can be seen as an
      optimization, as drivers usually have an optimized XDP_DROP code path
      for frame recycling in place already.
      
      The virtio_net driver didn't handle when xdp_do_redirect() failed.
      This caused a memory leak as the page refcnt wasn't decremented on
      failures.
      
      The function __virtnet_xdp_xmit() did handle one type of failure,
      when the xmit queue virtqueue_add_outbuf() is full, which "hides"
      releasing a refcnt on the page.  Instead the function __virtnet_xdp_xmit()
      must follow API of xdp_do_redirect(), which on errors leave it up to
      the caller to free the page, of the failed send operation.
      
      Fixes: 186b3c99 ("virtio-net: support XDP_REDIRECT")
      Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      11b7d897
    • Jesper Dangaard Brouer's avatar
      virtio_net: fix XDP code path in receive_small() · 95dbe9e7
      Jesper Dangaard Brouer authored
      When configuring virtio_net to use the code path 'receive_small()',
      in-order to get correct XDP_REDIRECT support, I discovered TCP packets
      would get silently dropped when loading an XDP program action XDP_PASS.
      
      The bug seems to be that receive_small() when XDP is loaded check that
      hdr->hdr.flags is zero, which seems wrong as hdr.flags contains the
      flags VIRTIO_NET_HDR_F_* :
       #define VIRTIO_NET_HDR_F_NEEDS_CSUM 1 /* Use csum_start, csum_offset */
       #define VIRTIO_NET_HDR_F_DATA_VALID 2 /* Csum is valid */
      
      TCP got dropped as it had the VIRTIO_NET_HDR_F_DATA_VALID flag set.
      
      The flags that are relevant here are the VIRTIO_NET_HDR_GSO_* flags
      stored in hdr->hdr.gso_type. Thus, the fix is just check that none of
      the gso_type flags have been set.
      
      Fixes: bb91accf ("virtio-net: XDP support for small buffers")
      Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      95dbe9e7
    • Jesper Dangaard Brouer's avatar
      virtio_net: disable XDP_REDIRECT in receive_mergeable() case · 7324f539
      Jesper Dangaard Brouer authored
      The virtio_net code have three different RX code-paths in receive_buf().
      Two of these code paths can handle XDP, but one of them is broken for
      at least XDP_REDIRECT.
      
      Function(1): receive_big() does not support XDP.
      Function(2): receive_small() support XDP fully and uses build_skb().
      Function(3): receive_mergeable() broken XDP_REDIRECT uses napi_alloc_skb().
      
      The simple explanation is that receive_mergeable() is broken because
      it uses napi_alloc_skb(), which violates XDP given XDP assumes packet
      header+data in single page and enough tail room for skb_shared_info.
      
      The longer explaination is that receive_mergeable() tries to
      work-around and satisfy these XDP requiresments e.g. by having a
      function xdp_linearize_page() that allocates and memcpy RX buffers
      around (in case packet is scattered across multiple rx buffers).  This
      does currently satisfy XDP_PASS, XDP_DROP and XDP_TX (but only because
      we have not implemented bpf_xdp_adjust_tail yet).
      
      The XDP_REDIRECT action combined with cpumap is broken, and cause hard
      to debug crashes.  The main issue is that the RX packet does not have
      the needed tail-room (SKB_DATA_ALIGN(skb_shared_info)), causing
      skb_shared_info to overlap the next packets head-room (in which cpumap
      stores info).
      
      Reproducing depend on the packet payload length and if RX-buffer size
      happened to have tail-room for skb_shared_info or not.  But to make
      this even harder to troubleshoot, the RX-buffer size is runtime
      dynamically change based on an Exponentially Weighted Moving Average
      (EWMA) over the packet length, when refilling RX rings.
      
      This patch only disable XDP_REDIRECT support in receive_mergeable()
      case, because it can cause a real crash.
      
      IMHO we should consider NOT supporting XDP in receive_mergeable() at
      all, because the principles behind XDP are to gain speed by (1) code
      simplicity, (2) sacrificing memory and (3) where possible moving
      runtime checks to setup time.  These principles are clearly being
      violated in receive_mergeable(), that e.g. runtime track average
      buffer size to save memory consumption.
      
      In the longer run, we should consider introducing a separate receive
      function when attaching an XDP program, and also change the memory
      model to be compatible with XDP when attaching an XDP prog.
      
      Fixes: 186b3c99 ("virtio-net: support XDP_REDIRECT")
      Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7324f539
    • David S. Miller's avatar
      Merge tag 'mlx5-fixes-2018-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux · 9c4ff2a9
      David S. Miller authored
      Saeed Mahameed says:
      
      ====================
      Mellanox, mlx5 fixes 2018-02-20
      
      The following pull request includes some fixes for the mlx5 core and
      netdevice driver.
      
      Please pull and let me know if there's any issue.
      
      -stable 4.10.y:
      ('net/mlx5e: Fix loopback self test when GRO is off')
      
      -stable 4.12.y:
      ('net/mlx5e: Specify numa node when allocating drop rq')
      
      -stable 4.13.y:
      ('net/mlx5e: Verify inline header size do not exceed SKB linear size')
      
      -stable 4.15.y:
      ('net/mlx5e: Fix TCP checksum in LRO buffers')
      ('net/mlx5: Fix error handling when adding flow rules')
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9c4ff2a9
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · 943a0d4a
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains large batch with Netfilter fixes for
      your net tree, mostly due to syzbot report fixups and pr_err()
      ratelimiting, more specifically, they are:
      
      1) Get rid of superfluous unnecessary check in x_tables before vmalloc(),
         we don't hit BUG there anymore, patch from Michal Hock, suggested by
         Andrew Morton.
      
      2) Race condition in proc file creation in ipt_CLUSTERIP, from Cong Wang.
      
      3) Drop socket lock that results in circular locking dependency, patch
         from Paolo Abeni.
      
      4) Drop packet if case of malformed blob that makes backpointer jump
         in x_tables, from Florian Westphal.
      
      5) Fix refcount leak due to race in ipt_CLUSTERIP in
         clusterip_config_find_get(), from Cong Wang.
      
      6) Several patches to ratelimit pr_err() for x_tables since this can be
         a problem where CAP_NET_ADMIN semantics can protect us in untrusted
         namespace, from Florian Westphal.
      
      7) Missing .gitignore update for new autogenerated asn1 state machine
         for the SNMP NAT helper, from Zhu Lingshan.
      
      8) Missing timer initialization in xt_LED, from Paolo Abeni.
      
      9) Do not allow negative port range in NAT, also from Paolo.
      
      10) Lock imbalance in the xt_hashlimit rate match mode, patch from
          Eric Dumazet.
      
      11) Initialize workqueue before timer in the idletimer match,
          from Eric Dumazet.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      943a0d4a
    • Roman Kapl's avatar
      net: sched: report if filter is too large to dump · 5ae437ad
      Roman Kapl authored
      So far, if the filter was too large to fit in the allocated skb, the
      kernel did not return any error and stopped dumping. Modify the dumper
      so that it returns -EMSGSIZE when a filter fails to dump and it is the
      first filter in the skb. If we are not first, we will get a next chance
      with more room.
      
      I understand this is pretty near to being an API change, but the
      original design (silent truncation) can be considered a bug.
      
      Note: The error case can happen pretty easily if you create a filter
      with 32 actions and have 4kb pages. Also recent versions of iproute try
      to be clever with their buffer allocation size, which in turn leads to
      Signed-off-by: default avatarRoman Kapl <code@rkapl.cz>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5ae437ad
  4. 20 Feb, 2018 13 commits
  5. 19 Feb, 2018 4 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 79c0ef3e
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Prevent index integer overflow in ptr_ring, from Jason Wang.
      
       2) Program mvpp2 multicast filter properly, from Mikulas Patocka.
      
       3) The bridge brport attribute file is write only and doesn't have a
          ->show() method, don't blindly invoke it. From Xin Long.
      
       4) Inverted mask used in genphy_setup_forced(), from Ingo van Lil.
      
       5) Fix multiple definition issue with if_ether.h UAPI header, from
          Hauke Mehrtens.
      
       6) Fix GFP_KERNEL usage in atomic in RDS protocol code, from Sowmini
          Varadhan.
      
       7) Revert XDP redirect support from thunderx driver, it is not
          implemented properly. From Jesper Dangaard Brouer.
      
       8) Fix missing RTNL protection across some tipc operations, from Ying
          Xue.
      
       9) Return the correct IV bytes in the TLS getsockopt code, from Boris
          Pismenny.
      
      10) Take tclassid into consideration properly when doing FIB rule
          matching. From Stefano Brivio.
      
      11) cxgb4 device needs more PCI VPD quirks, from Casey Leedom.
      
      12) TUN driver doesn't align frags properly, and we can end up doing
          unaligned atomics on misaligned metadata. From Eric Dumazet.
      
      13) Fix various crashes found using DEBUG_PREEMPT in rmnet driver, from
          Subash Abhinov Kasiviswanathan.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (56 commits)
        tg3: APE heartbeat changes
        mlxsw: spectrum_router: Do not unconditionally clear route offload indication
        net: qualcomm: rmnet: Fix possible null dereference in command processing
        net: qualcomm: rmnet: Fix warning seen with 64 bit stats
        net: qualcomm: rmnet: Fix crash on real dev unregistration
        sctp: remove the left unnecessary check for chunk in sctp_renege_events
        rxrpc: Work around usercopy check
        tun: fix tun_napi_alloc_frags() frag allocator
        udplite: fix partial checksum initialization
        skbuff: Fix comment mis-spelling.
        dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
        PCI/cxgb4: Extend T3 PCI quirk to T4+ devices
        cxgb4: fix trailing zero in CIM LA dump
        cxgb4: free up resources of pf 0-3
        fib_semantics: Don't match route with mismatching tclassid
        NFC: llcp: Limit size of SDP URI
        tls: getsockopt return record sequence number
        tls: reset the crypto info if copy_from_user fails
        tls: retrun the correct IV in getsockopt
        docs: segmentation-offloads.txt: add SCTP info
        ...
      79c0ef3e
    • Prashant Sreedharan's avatar
      tg3: APE heartbeat changes · 506b0a39
      Prashant Sreedharan authored
      In ungraceful host shutdown or driver crash case BMC connectivity is
      lost. APE firmware is missing the driver state in this
      case to keep the BMC connectivity alive.
      This patch has below change to address this issue.
      
      Heartbeat mechanism with APE firmware. This heartbeat mechanism
      is needed to notify the APE firmware about driver state.
      
      This patch also has the change in wait time for APE event from
      1ms to 20ms as there can be some delay in getting response.
      
      v2: Drop inline keyword as per David suggestion.
      Signed-off-by: default avatarPrashant Sreedharan <prashant.sreedharan@broadcom.com>
      Signed-off-by: default avatarSatish Baddipadige <satish.baddipadige@broadcom.com>
      Signed-off-by: default avatarSiva Reddy Kallam <siva.kallam@broadcom.com>
      Acked-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      506b0a39
    • Eric Dumazet's avatar
      netfilter: IDLETIMER: be syzkaller friendly · cfc2c740
      Eric Dumazet authored
      We had one report from syzkaller [1]
      
      First issue is that INIT_WORK() should be done before mod_timer()
      or we risk timer being fired too soon, even with a 1 second timer.
      
      Second issue is that we need to reject too big info->timeout
      to avoid overflows in msecs_to_jiffies(info->timeout * 1000), or
      risk looping, if result after overflow is 0.
      
      [1]
      WARNING: CPU: 1 PID: 5129 at kernel/workqueue.c:1444 __queue_work+0xdf4/0x1230 kernel/workqueue.c:1444
      Kernel panic - not syncing: panic_on_warn set ...
      
      CPU: 1 PID: 5129 Comm: syzkaller159866 Not tainted 4.16.0-rc1+ #230
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       <IRQ>
       __dump_stack lib/dump_stack.c:17 [inline]
       dump_stack+0x194/0x257 lib/dump_stack.c:53
       panic+0x1e4/0x41c kernel/panic.c:183
       __warn+0x1dc/0x200 kernel/panic.c:547
       report_bug+0x211/0x2d0 lib/bug.c:184
       fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
       fixup_bug arch/x86/kernel/traps.c:247 [inline]
       do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
       do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
       invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:988
      RIP: 0010:__queue_work+0xdf4/0x1230 kernel/workqueue.c:1444
      RSP: 0018:ffff8801db507538 EFLAGS: 00010006
      RAX: ffff8801aeb46080 RBX: ffff8801db530200 RCX: ffffffff81481404
      RDX: 0000000000000100 RSI: ffffffff86b42640 RDI: 0000000000000082
      RBP: ffff8801db507758 R08: 1ffff1003b6a0de5 R09: 000000000000000c
      R10: ffff8801db5073f0 R11: 0000000000000020 R12: 1ffff1003b6a0eb6
      R13: ffff8801b1067ae0 R14: 00000000000001f8 R15: dffffc0000000000
       queue_work_on+0x16a/0x1c0 kernel/workqueue.c:1488
       queue_work include/linux/workqueue.h:488 [inline]
       schedule_work include/linux/workqueue.h:546 [inline]
       idletimer_tg_expired+0x44/0x60 net/netfilter/xt_IDLETIMER.c:116
       call_timer_fn+0x228/0x820 kernel/time/timer.c:1326
       expire_timers kernel/time/timer.c:1363 [inline]
       __run_timers+0x7ee/0xb70 kernel/time/timer.c:1666
       run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
       __do_softirq+0x2d7/0xb85 kernel/softirq.c:285
       invoke_softirq kernel/softirq.c:365 [inline]
       irq_exit+0x1cc/0x200 kernel/softirq.c:405
       exiting_irq arch/x86/include/asm/apic.h:541 [inline]
       smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052
       apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:829
       </IRQ>
      RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:777 [inline]
      RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
      RIP: 0010:_raw_spin_unlock_irqrestore+0x5e/0xba kernel/locking/spinlock.c:184
      RSP: 0018:ffff8801c20173c8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff12
      RAX: dffffc0000000000 RBX: 0000000000000282 RCX: 0000000000000006
      RDX: 1ffffffff0d592cd RSI: 1ffff10035d68d23 RDI: 0000000000000282
      RBP: ffff8801c20173d8 R08: 1ffff10038402e47 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8820e5c8
      R13: ffff8801b1067ad8 R14: ffff8801aea7c268 R15: ffff8801aea7c278
       __debug_object_init+0x235/0x1040 lib/debugobjects.c:378
       debug_object_init+0x17/0x20 lib/debugobjects.c:391
       __init_work+0x2b/0x60 kernel/workqueue.c:506
       idletimer_tg_create net/netfilter/xt_IDLETIMER.c:152 [inline]
       idletimer_tg_checkentry+0x691/0xb00 net/netfilter/xt_IDLETIMER.c:213
       xt_check_target+0x22c/0x7d0 net/netfilter/x_tables.c:850
       check_target net/ipv6/netfilter/ip6_tables.c:533 [inline]
       find_check_entry.isra.7+0x935/0xcf0 net/ipv6/netfilter/ip6_tables.c:575
       translate_table+0xf52/0x1690 net/ipv6/netfilter/ip6_tables.c:744
       do_replace net/ipv6/netfilter/ip6_tables.c:1160 [inline]
       do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1686
       nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]
       nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115
       ipv6_setsockopt+0x10b/0x130 net/ipv6/ipv6_sockglue.c:927
       udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1422
       sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2976
       SYSC_setsockopt net/socket.c:1850 [inline]
       SyS_setsockopt+0x189/0x360 net/socket.c:1829
       do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287
      
      Fixes: 0902b469 ("netfilter: xtables: idletimer target implementation")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzkaller <syzkaller@googlegroups.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      cfc2c740
    • Ido Schimmel's avatar
      mlxsw: spectrum_router: Do not unconditionally clear route offload indication · d1c95af3
      Ido Schimmel authored
      When mlxsw replaces (or deletes) a route it removes the offload
      indication from the replaced route. This is problematic for IPv4 routes,
      as the offload indication is stored in the fib_info which is usually
      shared between multiple routes.
      
      Instead of unconditionally clearing the offload indication, only clear
      it if no other route is using the fib_info.
      
      Fixes: 3984d1a8 ("mlxsw: spectrum_router: Provide offload indication using nexthop flags")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Reported-by: default avatarAlexander Petrovskiy <alexpe@mellanox.com>
      Tested-by: default avatarAlexander Petrovskiy <alexpe@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d1c95af3