1. 19 May, 2022 11 commits
    • Linus Torvalds's avatar
      Merge tag 'net-5.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · d904c8cc
      Linus Torvalds authored
      Pull networking fixes from Paolo Abeni:
       "Including fixes from can, xfrm and netfilter subtrees.
      
        Notably this reverts a recent TCP/DCCP netns-related change to address
        a possible UaF.
      
        Current release - regressions:
      
         - tcp: revert "tcp/dccp: get rid of inet_twsk_purge()"
      
         - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in
           ifdown
      
        Previous releases - regressions:
      
         - netfilter: flowtable: fix TCP flow teardown
      
         - can: revert "can: m_can: pci: use custom bit timings for Elkhart
           Lake"
      
         - xfrm: check encryption module availability consistency
      
         - eth: vmxnet3: fix possible use-after-free bugs in
           vmxnet3_rq_alloc_rx_buf()
      
         - eth: mlx5: initialize flow steering during driver probe
      
         - eth: ice: fix crash when writing timestamp on RX rings
      
        Previous releases - always broken:
      
         - mptcp: fix checksum byte order
      
         - eth: lan966x: fix assignment of the MAC address
      
         - eth: mlx5: remove HW-GRO from reported features
      
         - eth: ftgmac100: disable hardware checksum on AST2600"
      
      * tag 'net-5.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (50 commits)
        net: bridge: Clear offload_fwd_mark when passing frame up bridge interface.
        ptp: ocp: change sysfs attr group handling
        selftests: forwarding: fix missing backslash
        netfilter: nf_tables: disable expression reduction infra
        netfilter: flowtable: move dst_check to packet path
        netfilter: flowtable: fix TCP flow teardown
        net: ftgmac100: Disable hardware checksum on AST2600
        igb: skip phy status check where unavailable
        nfc: pn533: Fix buggy cleanup order
        mptcp: Do TCP fallback on early DSS checksum failure
        mptcp: fix checksum byte order
        net: af_key: check encryption module availability consistency
        net: af_key: add check for pfkey_broadcast in function pfkey_process
        net/mlx5: Drain fw_reset when removing device
        net/mlx5e: CT: Fix setting flow_source for smfs ct tuples
        net/mlx5e: CT: Fix support for GRE tuples
        net/mlx5e: Remove HW-GRO from reported features
        net/mlx5e: Properly block HW GRO when XDP is enabled
        net/mlx5e: Properly block LRO when XDP is enabled
        net/mlx5e: Block rx-gro-hw feature in switchdev mode
        ...
      d904c8cc
    • Andrew Lunn's avatar
      net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. · fbb3abdf
      Andrew Lunn authored
      It is possible to stack bridges on top of each other. Consider the
      following which makes use of an Ethernet switch:
      
             br1
           /    \
          /      \
         /        \
       br0.11    wlan0
         |
         br0
       /  |  \
      p1  p2  p3
      
      br0 is offloaded to the switch. Above br0 is a vlan interface, for
      vlan 11. This vlan interface is then a slave of br1. br1 also has a
      wireless interface as a slave. This setup trunks wireless lan traffic
      over the copper network inside a VLAN.
      
      A frame received on p1 which is passed up to the bridge has the
      skb->offload_fwd_mark flag set to true, indicating that the switch has
      dealt with forwarding the frame out ports p2 and p3 as needed. This
      flag instructs the software bridge it does not need to pass the frame
      back down again. However, the flag is not getting reset when the frame
      is passed upwards. As a result br1 sees the flag, wrongly interprets
      it, and fails to forward the frame to wlan0.
      
      When passing a frame upwards, clear the flag. This is the Rx
      equivalent of br_switchdev_frame_unmark() in br_dev_xmit().
      
      Fixes: f1c2eddf ("bridge: switchdev: Use an helper to clear forward mark")
      Signed-off-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Reviewed-by: default avatarIdo Schimmel <idosch@nvidia.com>
      Tested-by: default avatarIdo Schimmel <idosch@nvidia.com>
      Acked-by: default avatarNikolay Aleksandrov <razor@blackwall.org>
      Link: https://lore.kernel.org/r/20220518005840.771575-1-andrew@lunn.chSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      fbb3abdf
    • Jonathan Lemon's avatar
      ptp: ocp: change sysfs attr group handling · c2239294
      Jonathan Lemon authored
      In the detach path, the driver calls sysfs_remove_group() for the
      groups it believes has been registered.  However, if the group was
      never previously registered, then this causes a splat.
      
      Instead, compute the groups that should be registered in advance,
      and then call sysfs_create_groups(), which registers them all at once.
      
      Update the error handling appropriately.
      
      Fixes: c205d53c ("ptp: ocp: Add firmware capability bits for feature gating")
      Reported-by: default avatarZheyu Ma <zheyuma97@gmail.com>
      Signed-off-by: default avatarJonathan Lemon <jonathan.lemon@gmail.com>
      Link: https://lore.kernel.org/r/20220517214600.10606-1-jonathan.lemon@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      c2239294
    • Joachim Wiberg's avatar
      selftests: forwarding: fix missing backslash · 090f9dd0
      Joachim Wiberg authored
      Fix missing backslash, introduced in f62c5acc.  Causes all tests to
      not be installed.
      
      Fixes: f62c5acc ("selftests/net/forwarding: add missing tests to Makefile")
      Signed-off-by: default avatarJoachim Wiberg <troglobit@gmail.com>
      Acked-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Link: https://lore.kernel.org/r/20220518151630.2747773-1-troglobit@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      090f9dd0
    • Jakub Kicinski's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf · 7dc02d7f
      Jakub Kicinski authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      1) Reduce number of hardware offload retries from flowtable datapath
         which might hog system with retries, from Felix Fietkau.
      
      2) Skip neighbour lookup for PPPoE device, fill_forward_path() already
         provides this and set on destination address from fill_forward_path for
         PPPoE device, also from Felix.
      
      4) When combining PPPoE on top of a VLAN device, set info->outdev to the
         PPPoE device so software offload works, from Felix.
      
      5) Fix TCP teardown flowtable state, races with conntrack gc might result
         in resetting the state to ESTABLISHED and the time to one day. Joint
         work with Oz Shlomo and Sven Auhagen.
      
      6) Call dst_check() from flowtable datapath to check if dst is stale
         instead of doing it from garbage collector path.
      
      7) Disable register tracking infrastructure, either user-space or
         kernel need to pre-fetch keys inconditionally, otherwise register
         tracking assumes data is already available in register that might
         not well be there, leading to incorrect reductions.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
        netfilter: nf_tables: disable expression reduction infra
        netfilter: flowtable: move dst_check to packet path
        netfilter: flowtable: fix TCP flow teardown
        netfilter: nft_flow_offload: fix offload with pppoe + vlan
        net: fix dev_fill_forward_path with pppoe + bridge
        netfilter: nft_flow_offload: skip dst neigh lookup for ppp devices
        netfilter: flowtable: fix excessive hw offload attempts after failure
      ====================
      
      Link: https://lore.kernel.org/r/20220518213841.359653-1-pablo@netfilter.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      7dc02d7f
    • Linus Torvalds's avatar
      Merge tag 'block-5.18-2022-05-18' of git://git.kernel.dk/linux-block · f993aed4
      Linus Torvalds authored
      Pull block fix from Jens Axboe:
       "Just a small fix for a missing fifo time assigment for the head
        insertion case in mq-deadline"
      
      * tag 'block-5.18-2022-05-18' of git://git.kernel.dk/linux-block:
        block/mq-deadline: Set the fifo_time member also if inserting at head
      f993aed4
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.18-2022-05-18' of git://git.kernel.dk/linux-block · 01464a73
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
       "Two small changes fixing issues from the 5.18 merge window:
      
         - Fix wrong ordering of a tracepoint (Dylan)
      
         - Fix MSG_RING on IOPOLL rings (me)"
      
      * tag 'io_uring-5.18-2022-05-18' of git://git.kernel.dk/linux-block:
        io_uring: don't attempt to IOPOLL for MSG_RING requests
        io_uring: fix ordering of args in io_uring_queue_async_work
      01464a73
    • Linus Torvalds's avatar
      Merge tag 'audit-pr-20220518' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit · 8194a008
      Linus Torvalds authored
      Pull audit fix from Paul Moore:
       "A single audit patch to fix a problem where a task's audit_context was
        not being properly reset with io_uring"
      
      * tag 'audit-pr-20220518' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
        audit,io_uring,io-wq: call __audit_uring_exit for dummy contexts
      8194a008
    • Linus Torvalds's avatar
      Merge tag 'selinux-pr-20220518' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux · 6899c161
      Linus Torvalds authored
      Pull selinux fix from Paul Moore:
       "A single SELinux patch to fix an error path that was doing the wrong
        thing with respect to freeing memory"
      
      * tag 'selinux-pr-20220518' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
        selinux: fix bad cleanup on error in hashtab_duplicate()
      6899c161
    • Linus Torvalds's avatar
      Merge branch 'arm/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · 5494d0eb
      Linus Torvalds authored
      Pull ARM SoC fixes from Arnd Bergmann:
       "The SoC bug fixes have calmed down sufficiently, there is one minor
        update for the MAINTAINERS file, and few bug fixes for dts
        descriptions:
      
         - Updates to the BananaPi R2-Pro (rk3568) dts to match production
           hardware rather than the prototype version.
      
         - Qualcomm sm8250 soundwire gets disabled on some machines to avoid
           crashes
      
         - A number of aspeed SoC specific fixes, addressing incorrect pin
           cotrol settings, some values in the romed8hm board, and a revert
           for an accidental removal of a DT node"
      
      * 'arm/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
        MAINTAINERS: omap: remove me as a maintainer
        ARM: dts: aspeed: Add video engine to g6
        ARM: dts: aspeed: romed8hm3: Fix GPIOB0 name
        ARM: dts: aspeed: romed8hm3: Add lm25066 sense resistor values
        ARM: dts: aspeed-g6: fix SPI1/SPI2 quad pin group
        ARM: dts: aspeed-g6: add FWQSPI group in pinctrl dtsi
        dt-bindings: pinctrl: aspeed-g6: add FWQSPI function/group
        pinctrl: pinctrl-aspeed-g6: add FWQSPI function-group
        dt-bindings: pinctrl: aspeed-g6: remove FWQSPID group
        pinctrl: pinctrl-aspeed-g6: remove FWQSPID group in pinctrl
        ARM: dts: aspeed-g6: remove FWQSPID group in pinctrl dtsi
        arm64: dts: qcom: sm8250: don't enable rx/tx macro by default
        arm64: dts: rockchip: Add gmac1 and change network settings of bpi-r2-pro
        arm64: dts: rockchip: Change io-domains of bpi-r2-pro
      5494d0eb
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · dbd380bb
      Linus Torvalds authored
      Pull misc fixes from Al Viro:
       "vhost race fix and a percpu_ref_init-caused cgroup double-free fix.
      
        The latter had manifested as buggered struct mount refcounting - those
        are also using percpu data structures, but anything that does percpu
        allocations could be hit"
      
      * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        Fix double fget() in vhost_net_set_backend()
        percpu_ref_init(): clean ->percpu_count_ref on failure
      dbd380bb
  2. 18 May, 2022 29 commits
    • Linus Torvalds's avatar
      Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost · db1fd3fc
      Linus Torvalds authored
      Pull mlx5 fix from Michael Tsirkin:
       "One last minute fixup
      
        The patch has been on list for a while but as it was posted as part of
        a thread it was missed"
      
      * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
        vdpa/mlx5: Use consistent RQT size
      db1fd3fc
    • Al Viro's avatar
      Fix double fget() in vhost_net_set_backend() · fb4554c2
      Al Viro authored
      Descriptor table is a shared resource; two fget() on the same descriptor
      may return different struct file references.  get_tap_ptr_ring() is
      called after we'd found (and pinned) the socket we'll be using and it
      tries to find the private tun/tap data structures associated with it.
      Redoing the lookup by the same file descriptor we'd used to get the
      socket is racy - we need to same struct file.
      
      Thanks to Jason for spotting a braino in the original variant of patch -
      I'd missed the use of fd == -1 for disabling backend, and in that case
      we can end up with sock == NULL and sock != oldsock.
      
      Cc: stable@kernel.org
      Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      fb4554c2
    • Eli Cohen's avatar
      vdpa/mlx5: Use consistent RQT size · acde3929
      Eli Cohen authored
      The current code evaluates RQT size based on the configured number of
      virtqueues. This can raise an issue in the following scenario:
      
      Assume MQ was negotiated.
      1. mlx5_vdpa_set_map() gets called.
      2. handle_ctrl_mq() is called setting cur_num_vqs to some value, lower
         than the configured max VQs.
      3. A second set_map gets called, but now a smaller number of VQs is used
         to evaluate the size of the RQT.
      4. handle_ctrl_mq() is called with a value larger than what the RQT can
         hold. This will emit errors and the driver state is compromised.
      
      To fix this, we use a new field in struct mlx5_vdpa_net to hold the
      required number of entries in the RQT. This value is evaluated in
      mlx5_vdpa_set_driver_features() where we have the negotiated features
      all set up.
      
      In addition to that, we take into consideration the max capability of RQT
      entries early when the device is added so we don't need to take consider
      it when creating the RQT.
      
      Last, we remove the use of mlx5_vdpa_max_qps() which just returns the
      max_vas / 2 and make the code clearer.
      
      Fixes: 52893733 ("vdpa/mlx5: Add multiqueue support")
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarEli Cohen <elic@nvidia.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      acde3929
    • Linus Torvalds's avatar
      Merge tag 'sound-5.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · ef130216
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "A collection of last-minute HD- an USB-audio quirks in addition to a
        fix for the legacy ISA wavefront driver.
      
        All look small and easy"
      
      * tag 'sound-5.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: usb-audio: Restore Rane SL-1 quirk
        ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine
        ALSA: hda/realtek: Add quirk for TongFang devices with pop noise
        ALSA: hda/realtek: Add quirk for the Framework Laptop
        ALSA: wavefront: Proper check of get_user() error
        ALSA: hda/realtek: Add quirk for Dell Latitude 7520
        ALSA: hda - fix unused Realtek function when PM is not enabled
        ALSA: usb-audio: Don't get sample rate for MCT Trigger 5 USB-to-HDMI
      ef130216
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: disable expression reduction infra · 9e539c5b
      Pablo Neira Ayuso authored
      Either userspace or kernelspace need to pre-fetch keys inconditionally
      before comparisons for this to work. Otherwise, register tracking data
      is misleading and it might result in reducing expressions which are not
      yet registers.
      
      First expression is also guaranteed to be evaluated always, however,
      certain expressions break before writing data to registers, before
      comparing the data, leaving the register in undetermined state.
      
      This patch disables this infrastructure by now.
      
      Fixes: b2d30654 ("netfilter: nf_tables: do not reduce read-only expressions")
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      9e539c5b
    • Ritaro Takenaka's avatar
      netfilter: flowtable: move dst_check to packet path · 2738d9d9
      Ritaro Takenaka authored
      Fixes sporadic IPv6 packet loss when flow offloading is enabled.
      
      IPv6 route GC and flowtable GC are not synchronized.
      When dst_cache becomes stale and a packet passes through the flow before
      the flowtable GC teardowns it, the packet can be dropped.
      So, it is necessary to check dst every time in packet path.
      
      Fixes: 227e1e4d ("netfilter: nf_flowtable: skip device lookup from interface index")
      Signed-off-by: default avatarRitaro Takenaka <ritarot634@gmail.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      2738d9d9
    • Pablo Neira Ayuso's avatar
      netfilter: flowtable: fix TCP flow teardown · e5eaac2b
      Pablo Neira Ayuso authored
      This patch addresses three possible problems:
      
      1. ct gc may race to undo the timeout adjustment of the packet path, leaving
         the conntrack entry in place with the internal offload timeout (one day).
      
      2. ct gc removes the ct because the IPS_OFFLOAD_BIT is not set and the CLOSE
         timeout is reached before the flow offload del.
      
      3. tcp ct is always set to ESTABLISHED with a very long timeout
         in flow offload teardown/delete even though the state might be already
         CLOSED. Also as a remark we cannot assume that the FIN or RST packet
         is hitting flow table teardown as the packet might get bumped to the
         slow path in nftables.
      
      This patch resets IPS_OFFLOAD_BIT from flow_offload_teardown(), so
      conntrack handles the tcp rst/fin packet which triggers the CLOSE/FIN
      state transition.
      
      Moreover, teturn the connection's ownership to conntrack upon teardown
      by clearing the offload flag and fixing the established timeout value.
      The flow table GC thread will asynchonrnously free the flow table and
      hardware offload entries.
      
      Before this patch, the IPS_OFFLOAD_BIT remained set for expired flows on
      which is also misleading since the flow is back to classic conntrack
      path.
      
      If nf_ct_delete() removes the entry from the conntrack table, then it
      calls nf_ct_put() which decrements the refcnt. This is not a problem
      because the flowtable holds a reference to the conntrack object from
      flow_offload_alloc() path which is released via flow_offload_free().
      
      This patch also updates nft_flow_offload to skip packets in SYN_RECV
      state. Since we might miss or bump packets to slow path, we do not know
      what will happen there while we are still in SYN_RECV, this patch
      postpones offload up to the next packet which also aligns to the
      existing behaviour in tc-ct.
      
      flow_offload_teardown() does not reset the existing tcp state from
      flow_offload_fixup_tcp() to ESTABLISHED anymore, packets bump to slow
      path might have already update the state to CLOSE/FIN.
      
      Joint work with Oz and Sven.
      
      Fixes: 1e5b2471 ("netfilter: nf_flow_table: teardown flow timeout race")
      Signed-off-by: default avatarOz Shlomo <ozsh@nvidia.com>
      Signed-off-by: default avatarSven Auhagen <sven.auhagen@voleatech.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      e5eaac2b
    • Joel Stanley's avatar
      net: ftgmac100: Disable hardware checksum on AST2600 · 6fd45e79
      Joel Stanley authored
      The AST2600 when using the i210 NIC over NC-SI has been observed to
      produce incorrect checksum results with specific MTU values. This was
      first observed when sending data across a long distance set of networks.
      
      On a local network, the following test was performed using a 1MB file of
      random data.
      
      On the receiver run this script:
      
       #!/bin/bash
       while [ 1 ]; do
              # Zero the stats
              nstat -r  > /dev/null
              nc -l 9899 > test-file
              # Check for checksum errors
              TcpInCsumErrors=$(nstat | grep TcpInCsumErrors)
              if [ -z "$TcpInCsumErrors" ]; then
                      echo No TcpInCsumErrors
              else
                      echo TcpInCsumErrors = $TcpInCsumErrors
              fi
       done
      
      On an AST2600 system:
      
       # nc <IP of  receiver host> 9899 < test-file
      
      The test was repeated with various MTU values:
      
       # ip link set mtu 1410 dev eth0
      
      The observed results:
      
       1500 - good
       1434 - bad
       1400 - good
       1410 - bad
       1420 - good
      
      The test was repeated after disabling tx checksumming:
      
       # ethtool -K eth0 tx-checksumming off
      
      And all MTU values tested resulted in transfers without error.
      
      An issue with the driver cannot be ruled out, however there has been no
      bug discovered so far.
      
      David has done the work to take the original bug report of slow data
      transfer between long distance connections and triaged it down to this
      test case.
      
      The vendor suspects this this is a hardware issue when using NC-SI. The
      fixes line refers to the patch that introduced AST2600 support.
      Reported-by: default avatarDavid Wilder <wilder@us.ibm.com>
      Reviewed-by: default avatarDylan Hung <dylan_hung@aspeedtech.com>
      Signed-off-by: default avatarJoel Stanley <joel@jms.id.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6fd45e79
    • Kevin Mitchell's avatar
      igb: skip phy status check where unavailable · 942d2ad5
      Kevin Mitchell authored
      igb_read_phy_reg() will silently return, leaving phy_data untouched, if
      hw->ops.read_reg isn't set. Depending on the uninitialized value of
      phy_data, this led to the phy status check either succeeding immediately
      or looping continuously for 2 seconds before emitting a noisy err-level
      timeout. This message went out to the console even though there was no
      actual problem.
      
      Instead, first check if there is read_reg function pointer. If not,
      proceed without trying to check the phy status register.
      
      Fixes: b72f3f72 ("igb: When GbE link up, wait for Remote receiver status condition")
      Signed-off-by: default avatarKevin Mitchell <kevmitch@arista.com>
      Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      942d2ad5
    • Lin Ma's avatar
      nfc: pn533: Fix buggy cleanup order · b8cedb70
      Lin Ma authored
      When removing the pn533 device (i2c or USB), there is a logic error. The
      original code first cancels the worker (flush_delayed_work) and then
      destroys the workqueue (destroy_workqueue), leaving the timer the last
      one to be deleted (del_timer). This result in a possible race condition
      in a multi-core preempt-able kernel. That is, if the cleanup
      (pn53x_common_clean) is concurrently run with the timer handler
      (pn533_listen_mode_timer), the timer can queue the poll_work to the
      already destroyed workqueue, causing use-after-free.
      
      This patch reorder the cleanup: it uses the del_timer_sync to make sure
      the handler is finished before the routine will destroy the workqueue.
      Note that the timer cannot be activated by the worker again.
      
      static void pn533_wq_poll(struct work_struct *work)
      ...
       rc = pn533_send_poll_frame(dev);
       if (rc)
         return;
      
       if (cur_mod->len == 0 && dev->poll_mod_count > 1)
         mod_timer(&dev->listen_timer, ...);
      
      That is, the mod_timer can be called only when pn533_send_poll_frame()
      returns no error, which is impossible because the device is detaching
      and the lower driver should return ENODEV code.
      Signed-off-by: default avatarLin Ma <linma@zju.edu.cn>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b8cedb70
    • David S. Miller's avatar
      Merge branch 'mptcp-checksums' · 575fb4fb
      David S. Miller authored
      Mat Martineau says:
      
      ====================
      mptcp: Fix checksum byte order on little-endian
      
      These patches address a bug in the byte ordering of MPTCP checksums on
      little-endian architectures. The __sum16 type is always big endian, but
      was being cast to u16 and then byte-swapped (on little-endian archs)
      when reading/writing the checksum field in MPTCP option headers.
      
      MPTCP checksums are off by default, but are enabled if one or both peers
      request it in the SYN/SYNACK handshake.
      
      The corrected code is verified to interoperate between big-endian and
      little-endian machines.
      
      Patch 1 fixes the checksum byte order, patch 2 partially mitigates
      interoperation with peers sending bad checksums by falling back to TCP
      instead of resetting the connection.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      575fb4fb
    • Mat Martineau's avatar
      mptcp: Do TCP fallback on early DSS checksum failure · ae66fb2b
      Mat Martineau authored
      RFC 8684 section 3.7 describes several opportunities for a MPTCP
      connection to "fall back" to regular TCP early in the connection
      process, before it has been confirmed that MPTCP options can be
      successfully propagated on all SYN, SYN/ACK, and data packets. If a peer
      acknowledges the first received data packet with a regular TCP header
      (no MPTCP options), fallback is allowed.
      
      If the recipient of that first data packet finds a MPTCP DSS checksum
      error, this provides an opportunity to fail gracefully with a TCP
      fallback rather than resetting the connection (as might happen if a
      checksum failure were detected later).
      
      This commit modifies the checksum failure code to attempt fallback on
      the initial subflow of a MPTCP connection, only if it's a failure in the
      first data mapping. In cases where the peer initiates the connection,
      requests checksums, is the first to send data, and the peer is sending
      incorrect checksums (see
      https://github.com/multipath-tcp/mptcp_net-next/issues/275), this allows
      the connection to proceed as TCP rather than reset.
      
      Fixes: dd8bcd17 ("mptcp: validate the data checksum")
      Acked-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ae66fb2b
    • Paolo Abeni's avatar
      mptcp: fix checksum byte order · ba2c89e0
      Paolo Abeni authored
      The MPTCP code typecasts the checksum value to u16 and
      then converts it to big endian while storing the value into
      the MPTCP option.
      
      As a result, the wire encoding for little endian host is
      wrong, and that causes interoperabilty interoperability
      issues with other implementation or host with different endianness.
      
      Address the issue writing in the packet the unmodified __sum16 value.
      
      MPTCP checksum is disabled by default, interoperating with systems
      with bad mptcp-level csum encoding should cause fallback to TCP.
      
      Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/275
      Fixes: c5b39e26 ("mptcp: send out checksum for DSS")
      Fixes: 390b95a5 ("mptcp: receive checksum for DSS")
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ba2c89e0
    • David S. Miller's avatar
      Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue · 680b8926
      David S. Miller authored
      Tony Nguyen says:
      
      ====================
      Intel Wired LAN Driver Updates 2022-05-17
      
      This series contains updates to ice driver only.
      
      Arkadiusz prevents writing of timestamps when rings are being
      configured to resolve null pointer dereference.
      
      Paul changes a delayed call to baseline statistics to occur immediately
      which was causing misreporting of statistics due to the delay.
      
      Michal fixes incorrect restoration of interrupt moderation settings.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      680b8926
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec · 089403a3
      David S. Miller authored
      Steffen Klassert says:
      
      ====================
      pull request (net): ipsec 2022-05-18
      
      1) Fix "disable_policy" flag use when arriving from different devices.
         From Eyal Birger.
      
      2) Fix error handling of pfkey_broadcast in function pfkey_process.
         From Jiasheng Jiang.
      
      3) Check the encryption module availability consistency in pfkey.
         From Thomas Bartschies.
      
      Please pull or let me know if there are problems.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      089403a3
    • David S. Miller's avatar
      Merge tag 'mlx5-fixes-2022-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux · 765d1216
      David S. Miller authored
      Saeed Mahameed says:
      
      ====================
      mlx5 fixes 2022-05-17
      
      This series provides bug fixes to mlx5 driver.
      Please pull and let me know if there is any problem.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      765d1216
    • Thomas Bartschies's avatar
      net: af_key: check encryption module availability consistency · 015c44d7
      Thomas Bartschies authored
      Since the recent introduction supporting the SM3 and SM4 hash algos for IPsec, the kernel
      produces invalid pfkey acquire messages, when these encryption modules are disabled. This
      happens because the availability of the algos wasn't checked in all necessary functions.
      This patch adds these checks.
      Signed-off-by: default avatarThomas Bartschies <thomas.bartschies@cvk.de>
      Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      015c44d7
    • Jiasheng Jiang's avatar
      net: af_key: add check for pfkey_broadcast in function pfkey_process · 4dc2a5a8
      Jiasheng Jiang authored
      If skb_clone() returns null pointer, pfkey_broadcast() will
      return error.
      Therefore, it should be better to check the return value of
      pfkey_broadcast() and return error if fails.
      
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Signed-off-by: default avatarJiasheng Jiang <jiasheng@iscas.ac.cn>
      Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      4dc2a5a8
    • Al Viro's avatar
      percpu_ref_init(): clean ->percpu_count_ref on failure · a9171431
      Al Viro authored
      That way percpu_ref_exit() is safe after failing percpu_ref_init().
      At least one user (cgroup_create()) had a double-free that way;
      there might be other similar bugs.  Easier to fix in percpu_ref_init(),
      rather than playing whack-a-mole in sloppy users...
      
      Usual symptoms look like a messed refcounting in one of subsystems
      that use percpu allocations (might be percpu-refcount, might be
      something else).  Having refcounts for two different objects share
      memory is Not Nice(tm)...
      
      Reported-by: syzbot+5b1e53987f858500ec00@syzkaller.appspotmail.com
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      a9171431
    • Shay Drory's avatar
      net/mlx5: Drain fw_reset when removing device · 16d42d31
      Shay Drory authored
      In case fw sync reset is called in parallel to device removal, device
      might stuck in the following deadlock:
               CPU 0                        CPU 1
               -----                        -----
                                        remove_one
                                         uninit_one (locks intf_state_mutex)
      mlx5_sync_reset_now_event()
      work in fw_reset->wq.
       mlx5_enter_error_state()
        mutex_lock (intf_state_mutex)
                                         cleanup_once
                                          fw_reset_cleanup()
                                           destroy_workqueue(fw_reset->wq)
      
      Drain the fw_reset WQ, and make sure no new work is being queued, before
      entering uninit_one().
      The Drain is done before devlink_unregister() since fw_reset, in some
      flows, is using devlink API devlink_remote_reload_actions_performed().
      
      Fixes: 38b9f903 ("net/mlx5: Handle sync reset request event")
      Signed-off-by: default avatarShay Drory <shayd@nvidia.com>
      Reviewed-by: default avatarMoshe Shemesh <moshe@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      16d42d31
    • Paul Blakey's avatar
      net/mlx5e: CT: Fix setting flow_source for smfs ct tuples · 04c551ba
      Paul Blakey authored
      Cited patch sets flow_source to ANY overriding the provided spec
      flow_source, avoiding the optimization done by commit c9c079b4
      ("net/mlx5: CT: Set flow source hint from provided tuple device").
      
      To fix the above, set the dr_rule flow_source from provided flow spec.
      
      Fixes: 3ee61ebb ("net/mlx5: CT: Add software steering ct flow steering provider")
      Signed-off-by: default avatarPaul Blakey <paulb@nvidia.com>
      Reviewed-by: default avatarOz Shlomo <ozsh@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      04c551ba
    • Paul Blakey's avatar
      net/mlx5e: CT: Fix support for GRE tuples · 8e1dcf49
      Paul Blakey authored
      cited commit removed support for GRE tuples when software steering was enabled.
      
      To bring back support for GRE tuples, add GRE ipv4/ipv6 matchers.
      
      Fixes: 3ee61ebb ("net/mlx5: CT: Add software steering ct flow steering provider")
      Signed-off-by: default avatarPaul Blakey <paulb@nvidia.com>
      Reviewed-by: default avatarOz Shlomo <ozsh@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      8e1dcf49
    • Gal Pressman's avatar
      net/mlx5e: Remove HW-GRO from reported features · 6bbd7230
      Gal Pressman authored
      We got reports of certain HW-GRO flows causing kernel call traces, which
      might be related to firmware. To be on the safe side, disable the
      feature for now and re-enable it once a driver/firmware fix is found.
      
      Fixes: 83439f3c ("net/mlx5e: Add HW-GRO offload")
      Signed-off-by: default avatarGal Pressman <gal@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      6bbd7230
    • Maxim Mikityanskiy's avatar
      net/mlx5e: Properly block HW GRO when XDP is enabled · b0617e7b
      Maxim Mikityanskiy authored
      HW GRO is incompatible and mutually exclusive with XDP and XSK. However,
      the needed checks are only made when enabling XDP. If HW GRO is enabled
      when XDP is already active, the command will succeed, and XDP will be
      skipped in the data path, although still enabled.
      
      This commit fixes the bug by checking the XDP and XSK status in
      mlx5e_fix_features and disabling HW GRO if XDP is enabled.
      
      Fixes: 83439f3c ("net/mlx5e: Add HW-GRO offload")
      Signed-off-by: default avatarMaxim Mikityanskiy <maximmi@nvidia.com>
      Reviewed-by: default avatarTariq Toukan <tariqt@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      b0617e7b
    • Maxim Mikityanskiy's avatar
      net/mlx5e: Properly block LRO when XDP is enabled · cf6e34c8
      Maxim Mikityanskiy authored
      LRO is incompatible and mutually exclusive with XDP. However, the needed
      checks are only made when enabling XDP. If LRO is enabled when XDP is
      already active, the command will succeed, and XDP will be skipped in the
      data path, although still enabled.
      
      This commit fixes the bug by checking the XDP status in
      mlx5e_fix_features and disabling LRO if XDP is enabled.
      
      Fixes: 86994156 ("net/mlx5e: XDP fast RX drop bpf programs support")
      Signed-off-by: default avatarMaxim Mikityanskiy <maximmi@nvidia.com>
      Reviewed-by: default avatarTariq Toukan <tariqt@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      cf6e34c8
    • Aya Levin's avatar
      net/mlx5e: Block rx-gro-hw feature in switchdev mode · 15a5078c
      Aya Levin authored
      When the driver is in switchdev mode and rx-gro-hw is set, the RQ needs
      special CQE handling. Till then, block setting of rx-gro-hw feature in
      switchdev mode, to avoid failure while setting the feature due to
      failure while opening the RQ.
      
      Fixes: f97d5c2a ("net/mlx5e: Add handle SHAMPO cqe support")
      Signed-off-by: default avatarAya Levin <ayal@nvidia.com>
      Reviewed-by: default avatarTariq Toukan <tariqt@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      15a5078c
    • Maxim Mikityanskiy's avatar
      net/mlx5e: Wrap mlx5e_trap_napi_poll into rcu_read_lock · 37916974
      Maxim Mikityanskiy authored
      The body of mlx5e_napi_poll is wrapped into rcu_read_lock to be able to
      read the XDP program pointer using rcu_dereference. However, the trap RQ
      NAPI doesn't use rcu_read_lock, because the trap RQ works only in the
      non-linear mode, and mlx5e_skb_from_cqe_nonlinear, until recently,
      didn't support XDP and didn't call rcu_dereference.
      
      Starting from the cited commit, mlx5e_skb_from_cqe_nonlinear supports
      XDP and calls rcu_dereference, but mlx5e_trap_napi_poll doesn't wrap it
      into rcu_read_lock. It leads to RCU-lockdep warnings like this:
      
          WARNING: suspicious RCU usage
      
      This commit fixes the issue by adding an rcu_read_lock to
      mlx5e_trap_napi_poll, similarly to mlx5e_napi_poll.
      
      Fixes: ea5d49bd ("net/mlx5e: Add XDP multi buffer support to the non-linear legacy RQ")
      Signed-off-by: default avatarMaxim Mikityanskiy <maximmi@nvidia.com>
      Reviewed-by: default avatarTariq Toukan <tariqt@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      37916974
    • Yevgeny Kliteynik's avatar
      net/mlx5: DR, Ignore modify TTL on RX if device doesn't support it · 785d7ed2
      Yevgeny Kliteynik authored
      When modifying TTL, packet's csum has to be recalculated.
      Due to HW issue in ConnectX-5, csum recalculation for modify
      TTL on RX is supported through a work-around that is specifically
      enabled by configuration.
      If the work-around isn't enabled, rather than adding an unsupported
      action the modify TTL action on RX should be ignored.
      Ignoring modify TTL action might result in zero actions, so in such
      cases we will not convert the match STE to modify STE, as it is done
      by FW in DMFS.
      
      This patch fixes an issue where modify TTL action was ignored both
      on RX and TX instead of only on RX.
      
      Fixes: 4ff725e1 ("net/mlx5: DR, Ignore modify TTL if device doesn't support it")
      Signed-off-by: default avatarYevgeny Kliteynik <kliteyn@nvidia.com>
      Reviewed-by: default avatarAlex Vesker <valex@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      785d7ed2
    • Shay Drory's avatar
      net/mlx5: Initialize flow steering during driver probe · b3388697
      Shay Drory authored
      Currently, software objects of flow steering are created and destroyed
      during reload flow. In case a device is unloaded, the following error
      is printed during grace period:
      
       mlx5_core 0000:00:0b.0: mlx5_fw_fatal_reporter_err_work:690:(pid 95):
          Driver is in error state. Unloading
      
      As a solution to fix use-after-free bugs, where we try to access
      these objects, when reading the value of flow_steering_mode devlink
      param[1], let's split flow steering creation and destruction into two
      routines:
          * init and cleanup: memory, cache, and pools allocation/free.
          * create and destroy: namespaces initialization and cleanup.
      
      While at it, re-order the cleanup function to mirror the init function.
      
      [1]
      Kasan trace:
      
      [  385.119849 ] BUG: KASAN: use-after-free in mlx5_devlink_fs_mode_get+0x3b/0xa0
      [  385.119849 ] Read of size 4 at addr ffff888104b79308 by task bash/291
      [  385.119849 ]
      [  385.119849 ] CPU: 1 PID: 291 Comm: bash Not tainted 5.17.0-rc1+ #2
      [  385.119849 ] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-2.fc32 04/01/2014
      [  385.119849 ] Call Trace:
      [  385.119849 ]  <TASK>
      [  385.119849 ]  dump_stack_lvl+0x6e/0x91
      [  385.119849 ]  print_address_description.constprop.0+0x1f/0x160
      [  385.119849 ]  ? mlx5_devlink_fs_mode_get+0x3b/0xa0
      [  385.119849 ]  ? mlx5_devlink_fs_mode_get+0x3b/0xa0
      [  385.119849 ]  kasan_report.cold+0x83/0xdf
      [  385.119849 ]  ? devlink_param_notify+0x20/0x190
      [  385.119849 ]  ? mlx5_devlink_fs_mode_get+0x3b/0xa0
      [  385.119849 ]  mlx5_devlink_fs_mode_get+0x3b/0xa0
      [  385.119849 ]  devlink_nl_param_fill+0x18a/0xa50
      [  385.119849 ]  ? _raw_spin_lock_irqsave+0x8d/0xe0
      [  385.119849 ]  ? devlink_flash_update_timeout_notify+0xf0/0xf0
      [  385.119849 ]  ? __wake_up_common+0x4b/0x1e0
      [  385.119849 ]  ? preempt_count_sub+0x14/0xc0
      [  385.119849 ]  ? _raw_spin_unlock_irqrestore+0x28/0x40
      [  385.119849 ]  ? __wake_up_common_lock+0xe3/0x140
      [  385.119849 ]  ? __wake_up_common+0x1e0/0x1e0
      [  385.119849 ]  ? __sanitizer_cov_trace_const_cmp8+0x27/0x80
      [  385.119849 ]  ? __rcu_read_unlock+0x48/0x70
      [  385.119849 ]  ? kasan_unpoison+0x23/0x50
      [  385.119849 ]  ? __kasan_slab_alloc+0x2c/0x80
      [  385.119849 ]  ? memset+0x20/0x40
      [  385.119849 ]  ? __sanitizer_cov_trace_const_cmp4+0x25/0x80
      [  385.119849 ]  devlink_param_notify+0xce/0x190
      [  385.119849 ]  devlink_unregister+0x92/0x2b0
      [  385.119849 ]  remove_one+0x41/0x140
      [  385.119849 ]  pci_device_remove+0x68/0x140
      [  385.119849 ]  ? pcibios_free_irq+0x10/0x10
      [  385.119849 ]  __device_release_driver+0x294/0x3f0
      [  385.119849 ]  device_driver_detach+0x82/0x130
      [  385.119849 ]  unbind_store+0x193/0x1b0
      [  385.119849 ]  ? subsys_interface_unregister+0x270/0x270
      [  385.119849 ]  drv_attr_store+0x4e/0x70
      [  385.119849 ]  ? drv_attr_show+0x60/0x60
      [  385.119849 ]  sysfs_kf_write+0xa7/0xc0
      [  385.119849 ]  kernfs_fop_write_iter+0x23a/0x2f0
      [  385.119849 ]  ? sysfs_kf_bin_read+0x160/0x160
      [  385.119849 ]  new_sync_write+0x311/0x430
      [  385.119849 ]  ? new_sync_read+0x480/0x480
      [  385.119849 ]  ? _raw_spin_lock+0x87/0xe0
      [  385.119849 ]  ? __sanitizer_cov_trace_cmp4+0x25/0x80
      [  385.119849 ]  ? security_file_permission+0x94/0xa0
      [  385.119849 ]  vfs_write+0x4c7/0x590
      [  385.119849 ]  ksys_write+0xf6/0x1e0
      [  385.119849 ]  ? __x64_sys_read+0x50/0x50
      [  385.119849 ]  ? fpregs_assert_state_consistent+0x99/0xa0
      [  385.119849 ]  do_syscall_64+0x3d/0x90
      [  385.119849 ]  entry_SYSCALL_64_after_hwframe+0x44/0xae
      [  385.119849 ] RIP: 0033:0x7fc36ef38504
      [  385.119849 ] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f
      80 00 00 00 00 48 8d 05 f9 61 0d 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f
      05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 49 89 d4 55 48 89 f5 53
      [  385.119849 ] RSP: 002b:00007ffde0ff3d08 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      [  385.119849 ] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007fc36ef38504
      [  385.119849 ] RDX: 000000000000000c RSI: 00007fc370521040 RDI: 0000000000000001
      [  385.119849 ] RBP: 00007fc370521040 R08: 00007fc36f00b8c0 R09: 00007fc36ee4b740
      [  385.119849 ] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc36f00a760
      [  385.119849 ] R13: 000000000000000c R14: 00007fc36f005760 R15: 000000000000000c
      [  385.119849 ]  </TASK>
      [  385.119849 ]
      [  385.119849 ] Allocated by task 65:
      [  385.119849 ]  kasan_save_stack+0x1e/0x40
      [  385.119849 ]  __kasan_kmalloc+0x81/0xa0
      [  385.119849 ]  mlx5_init_fs+0x11b/0x1160
      [  385.119849 ]  mlx5_load+0x13c/0x220
      [  385.119849 ]  mlx5_load_one+0xda/0x160
      [  385.119849 ]  mlx5_recover_device+0xb8/0x100
      [  385.119849 ]  mlx5_health_try_recover+0x2f9/0x3a1
      [  385.119849 ]  devlink_health_reporter_recover+0x75/0x100
      [  385.119849 ]  devlink_health_report+0x26c/0x4b0
      [  385.275909 ]  mlx5_fw_fatal_reporter_err_work+0x11e/0x1b0
      [  385.275909 ]  process_one_work+0x520/0x970
      [  385.275909 ]  worker_thread+0x378/0x950
      [  385.275909 ]  kthread+0x1bb/0x200
      [  385.275909 ]  ret_from_fork+0x1f/0x30
      [  385.275909 ]
      [  385.275909 ] Freed by task 65:
      [  385.275909 ]  kasan_save_stack+0x1e/0x40
      [  385.275909 ]  kasan_set_track+0x21/0x30
      [  385.275909 ]  kasan_set_free_info+0x20/0x30
      [  385.275909 ]  __kasan_slab_free+0xfc/0x140
      [  385.275909 ]  kfree+0xa5/0x3b0
      [  385.275909 ]  mlx5_unload+0x2e/0xb0
      [  385.275909 ]  mlx5_unload_one+0x86/0xb0
      [  385.275909 ]  mlx5_fw_fatal_reporter_err_work.cold+0xca/0xcf
      [  385.275909 ]  process_one_work+0x520/0x970
      [  385.275909 ]  worker_thread+0x378/0x950
      [  385.275909 ]  kthread+0x1bb/0x200
      [  385.275909 ]  ret_from_fork+0x1f/0x30
      [  385.275909 ]
      [  385.275909 ] The buggy address belongs to the object at ffff888104b79300
      [  385.275909 ]  which belongs to the cache kmalloc-128 of size 128
      [  385.275909 ] The buggy address is located 8 bytes inside of
      [  385.275909 ]  128-byte region [ffff888104b79300, ffff888104b79380)
      [  385.275909 ] The buggy address belongs to the page:
      [  385.275909 ] page:00000000de44dd39 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104b78
      [  385.275909 ] head:00000000de44dd39 order:1 compound_mapcount:0
      [  385.275909 ] flags: 0x8000000000010200(slab|head|zone=2)
      [  385.275909 ] raw: 8000000000010200 0000000000000000 dead000000000122 ffff8881000428c0
      [  385.275909 ] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
      [  385.275909 ] page dumped because: kasan: bad access detected
      [  385.275909 ]
      [  385.275909 ] Memory state around the buggy address:
      [  385.275909 ]  ffff888104b79200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc
      [  385.275909 ]  ffff888104b79280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [  385.275909 ] >ffff888104b79300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  385.275909 ]                       ^
      [  385.275909 ]  ffff888104b79380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [  385.275909 ]  ffff888104b79400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  385.275909 ]]
      
      Fixes: e890acd5 ("net/mlx5: Add devlink flow_steering_mode parameter")
      Signed-off-by: default avatarShay Drory <shayd@nvidia.com>
      Reviewed-by: default avatarMark Bloch <mbloch@nvidia.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      b3388697