1. 12 Apr, 2021 2 commits
  2. 11 Apr, 2021 3 commits
  3. 09 Apr, 2021 26 commits
  4. 08 Apr, 2021 9 commits
    • Muhammad Usama Anjum's avatar
      net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh · 864db232
      Muhammad Usama Anjum authored
      nlh is being checked for validtity two times when it is dereferenced in
      this function. Check for validity again when updating the flags through
      nlh pointer to make the dereferencing safe.
      
      CC: <stable@vger.kernel.org>
      Addresses-Coverity: ("NULL pointer dereference")
      Signed-off-by: default avatarMuhammad Usama Anjum <musamaanjum@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      864db232
    • David S. Miller's avatar
      Merge branch 'lantiq-GSWIP-fixes' · 2d1b50ab
      David S. Miller authored
      Martin Blumenstingl says:
      
      ====================
      lantiq: GSWIP: two more fixes
      
      after my last patch got accepted and is now in net as commit
      3e6fdeb2 ("net: dsa: lantiq_gswip: Let GSWIP automatically set
      the xMII clock") [0] some more people from the OpenWrt community
      (many thanks to everyone involved) helped test the GSWIP driver: [1]
      
      It turns out that the previous fix does not work for all boards.
      There's no regression, but it doesn't fix as many problems as I
      thought. This is why two more fixes are needed:
      - the first one solves many (four known but probably there are
        a few extra hidden ones) reported bugs with the GSWIP where no
        traffic would flow. Not all circumstances are fully understood
        but testing shows that switching away from PHY auto polling
        solves all of them
      - while investigating the different problems which are addressed
        by the first patch some small issues with the existing code were
        found. These are addressed by the second patch
      
      Changes since v1 at [0]:
      - Don't configure the link parameters in gswip_phylink_mac_config
        (as we're using the "modern" way in gswip_phylink_mac_link_up).
        Thanks to Andrew for the hint with the phylink documentation.
      - Clarify that GSWIP_MII_CFG_RMII_CLK is ignored by the hardware in
        the description of the second patch as suggested by Hauke
      - Don't set GSWIP_MII_CFG_RGMII_IBS in the second patch as we don't
        have any hardware available for testing this. The patch
        description now also reflects this.
      - Added Andrew's Reviewed-by to the first patch (thank you!)
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2d1b50ab
    • Martin Blumenstingl's avatar
      net: dsa: lantiq_gswip: Configure all remaining GSWIP_MII_CFG bits · 4b592324
      Martin Blumenstingl authored
      There are a few more bits in the GSWIP_MII_CFG register for which we
      did rely on the boot-loader (or the hardware defaults) to set them up
      properly.
      
      For some external RMII PHYs we need to select the GSWIP_MII_CFG_RMII_CLK
      bit and also we should un-set it for non-RMII PHYs. The
      GSWIP_MII_CFG_RMII_CLK bit is ignored for other PHY connection modes.
      
      The GSWIP IP also supports in-band auto-negotiation for RGMII PHYs when
      the GSWIP_MII_CFG_RGMII_IBS bit is set. Clear this bit always as there's
      no known hardware which uses this (so it is not tested yet).
      
      Clear the xMII isolation bit when set at initialization time if it was
      previously set by the bootloader. Not doing so could lead to no traffic
      (neither RX nor TX) on a port with this bit set.
      
      While here, also add the GSWIP_MII_CFG_RESET bit. We don't need to
      manage it because this bit is self-clearning when set. We still add it
      here to get a better overview of the GSWIP_MII_CFG register.
      
      Fixes: 14fceff4 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200")
      Cc: stable@vger.kernel.org
      Suggested-by: default avatarHauke Mehrtens <hauke@hauke-m.de>
      Acked-by: default avatarHauke Mehrtens <hauke@hauke-m.de>
      Signed-off-by: default avatarMartin Blumenstingl <martin.blumenstingl@googlemail.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4b592324
    • Martin Blumenstingl's avatar
      net: dsa: lantiq_gswip: Don't use PHY auto polling · 3e9005be
      Martin Blumenstingl authored
      PHY auto polling on the GSWIP hardware can be used so link changes
      (speed, link up/down, etc.) can be detected automatically. Internally
      GSWIP reads the PHY's registers for this functionality. Based on this
      automatic detection GSWIP can also automatically re-configure it's port
      settings. Unfortunately this auto polling (and configuration) mechanism
      seems to cause various issues observed by different people on different
      devices:
      - FritzBox 7360v2: the two Gbit/s ports (connected to the two internal
        PHY11G instances) are working fine but the two Fast Ethernet ports
        (using an AR8030 RMII PHY) are completely dead (neither RX nor TX are
        received). It turns out that the AR8030 PHY sets the BMSR_ESTATEN bit
        as well as the ESTATUS_1000_TFULL and ESTATUS_1000_XFULL bits. This
        makes the PHY auto polling state machine (rightfully?) think that the
        established link speed (when the other side is Gbit/s capable) is
        1Gbit/s.
      - None of the Ethernet ports on the Zyxel P-2812HNU-F1 (two are
        connected to the internal PHY11G GPHYs while the other three are
        external RGMII PHYs) are working. Neither RX nor TX traffic was
        observed. It is not clear which part of the PHY auto polling state-
        machine caused this.
      - FritzBox 7412 (only one LAN port which is connected to one of the
        internal GPHYs running in PHY22F / Fast Ethernet mode) was seeing
        random disconnects (link down events could be seen). Sometimes all
        traffic would stop after such disconnect. It is not clear which part
        of the PHY auto polling state-machine cauased this.
      - TP-Link TD-W9980 (two ports are connected to the internal GPHYs
        running in PHY11G / Gbit/s mode, the other two are external RGMII
        PHYs) was affected by similar issues as the FritzBox 7412 just without
        the "link down" events
      
      Switch to software based configuration instead of PHY auto polling (and
      letting the GSWIP hardware configure the ports automatically) for the
      following link parameters:
      - link up/down
      - link speed
      - full/half duplex
      - flow control (RX / TX pause)
      
      After a big round of manual testing by various people (who helped test
      this on OpenWrt) it turns out that this fixes all reported issues.
      
      Additionally it can be considered more future proof because any
      "quirk" which is implemented for a PHY on the driver side can now be
      used with the GSWIP hardware as well because Linux is in control of the
      link parameters.
      
      As a nice side-effect this also solves a problem where fixed-links were
      not supported previously because we were relying on the PHY auto polling
      mechanism, which cannot work for fixed-links as there's no PHY from
      where it can read the registers. Configuring the link settings on the
      GSWIP ports means that we now use the settings from device-tree also for
      ports with fixed-links.
      
      Fixes: 14fceff4 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200")
      Fixes: 3e6fdeb2 ("net: dsa: lantiq_gswip: Let GSWIP automatically set the xMII clock")
      Cc: stable@vger.kernel.org
      Acked-by: default avatarHauke Mehrtens <hauke@hauke-m.de>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarMartin Blumenstingl <martin.blumenstingl@googlemail.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3e9005be
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · 4fa56ad0
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
       "Nothing very exciting here, just a few small bug fixes. No red flags
        for this release have shown up.
      
         - Regression from the last pull request in cxgb4 related to the ipv6
           fixes
      
         - KASAN crasher in rtrs
      
         - oops in hfi1 related to a buggy BIOS
      
         - Userspace could oops qedr's XRC support
      
         - Uninitialized memory when parsing a LS_NLA_TYPE_DGID netlink
           message"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        RDMA/addr: Be strict with gid size
        RDMA/qedr: Fix kernel panic when trying to access recv_cq
        IB/hfi1: Fix probe time panic when AIP is enabled with a buggy BIOS
        RDMA/cxgb4: check for ipv6 address properly while destroying listener
        RDMA/rtrs-clt: Close rtrs client conn before destroying rtrs clt session files
      4fa56ad0
    • Frank Rowand's avatar
      of: unittest: overlay: ensure proper alignment of copied FDT · 48d499bd
      Frank Rowand authored
      The Devicetree standard specifies an 8 byte alignment of the FDT.
      Code in libfdt expects this alignment for an FDT image in memory.
      kmemdup() returns 4 byte alignment on openrisc.  Replace kmemdup()
      with kmalloc(), align pointer, memcpy() to get proper alignment.
      
      The 4 byte alignment exposed a related bug which triggered a crash
      on openrisc with:
      commit 79edff12 ("scripts/dtc: Update to upstream version v1.6.0-51-g183df9e9c2b9")
      as reported in:
      https://lore.kernel.org/lkml/20210327224116.69309-1-linux@roeck-us.net/Reported-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarFrank Rowand <frank.rowand@sony.com>
      Link: https://lore.kernel.org/r/20210408204508.2276230-1-frowand.list@gmail.comSigned-off-by: default avatarRob Herring <robh@kernel.org>
      48d499bd
    • David S. Miller's avatar
      Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue · 6494d15f
      David S. Miller authored
      Tony Nguyen says:
      
      ====================
      Intel Wired LAN Driver Updates 2021-04-08
      
      This series contains updates to i40e and ice drivers.
      
      Grzegorz fixes the ordering of parameters to i40e_aq_get_phy_register()
      which is causing incorrect information to be reported.
      
      Arkadiusz fixes various sparse issues reported on the i40e driver.
      
      Yongxin Liu fixes a memory leak with aRFS following resume from suspend
      for ice driver.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6494d15f
    • Pavel Tikhomirov's avatar
      net: sched: sch_teql: fix null-pointer dereference · 1ffbc7ea
      Pavel Tikhomirov authored
      Reproduce:
      
        modprobe sch_teql
        tc qdisc add dev teql0 root teql0
      
      This leads to (for instance in Centos 7 VM) OOPS:
      
      [  532.366633] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8
      [  532.366733] IP: [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
      [  532.366825] PGD 80000001376d5067 PUD 137e37067 PMD 0
      [  532.366906] Oops: 0000 [#1] SMP
      [  532.366987] Modules linked in: sch_teql ...
      [  532.367945] CPU: 1 PID: 3026 Comm: tc Kdump: loaded Tainted: G               ------------ T 3.10.0-1062.7.1.el7.x86_64 #1
      [  532.368041] Hardware name: Virtuozzo KVM, BIOS 1.11.0-2.vz7.2 04/01/2014
      [  532.368125] task: ffff8b7d37d31070 ti: ffff8b7c9fdbc000 task.ti: ffff8b7c9fdbc000
      [  532.368224] RIP: 0010:[<ffffffffc06124a8>]  [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
      [  532.368320] RSP: 0018:ffff8b7c9fdbf8e0  EFLAGS: 00010286
      [  532.368394] RAX: ffffffffc0612490 RBX: ffff8b7cb1565e00 RCX: ffff8b7d35ba2000
      [  532.368476] RDX: ffff8b7d35ba2000 RSI: 0000000000000000 RDI: ffff8b7cb1565e00
      [  532.368557] RBP: ffff8b7c9fdbf8f8 R08: ffff8b7d3fd1f140 R09: ffff8b7d3b001600
      [  532.368638] R10: ffff8b7d3b001600 R11: ffffffff84c7d65b R12: 00000000ffffffd8
      [  532.368719] R13: 0000000000008000 R14: ffff8b7d35ba2000 R15: ffff8b7c9fdbf9a8
      [  532.368800] FS:  00007f6a4e872740(0000) GS:ffff8b7d3fd00000(0000) knlGS:0000000000000000
      [  532.368885] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  532.368961] CR2: 00000000000000a8 CR3: 00000001396ee000 CR4: 00000000000206e0
      [  532.369046] Call Trace:
      [  532.369159]  [<ffffffff84c8192e>] qdisc_create+0x36e/0x450
      [  532.369268]  [<ffffffff846a9b49>] ? ns_capable+0x29/0x50
      [  532.369366]  [<ffffffff849afde2>] ? nla_parse+0x32/0x120
      [  532.369442]  [<ffffffff84c81b4c>] tc_modify_qdisc+0x13c/0x610
      [  532.371508]  [<ffffffff84c693e7>] rtnetlink_rcv_msg+0xa7/0x260
      [  532.372668]  [<ffffffff84907b65>] ? sock_has_perm+0x75/0x90
      [  532.373790]  [<ffffffff84c69340>] ? rtnl_newlink+0x890/0x890
      [  532.374914]  [<ffffffff84c8da7b>] netlink_rcv_skb+0xab/0xc0
      [  532.376055]  [<ffffffff84c63708>] rtnetlink_rcv+0x28/0x30
      [  532.377204]  [<ffffffff84c8d400>] netlink_unicast+0x170/0x210
      [  532.378333]  [<ffffffff84c8d7a8>] netlink_sendmsg+0x308/0x420
      [  532.379465]  [<ffffffff84c2f3a6>] sock_sendmsg+0xb6/0xf0
      [  532.380710]  [<ffffffffc034a56e>] ? __xfs_filemap_fault+0x8e/0x1d0 [xfs]
      [  532.381868]  [<ffffffffc034a75c>] ? xfs_filemap_fault+0x2c/0x30 [xfs]
      [  532.383037]  [<ffffffff847ec23a>] ? __do_fault.isra.61+0x8a/0x100
      [  532.384144]  [<ffffffff84c30269>] ___sys_sendmsg+0x3e9/0x400
      [  532.385268]  [<ffffffff847f3fad>] ? handle_mm_fault+0x39d/0x9b0
      [  532.386387]  [<ffffffff84d88678>] ? __do_page_fault+0x238/0x500
      [  532.387472]  [<ffffffff84c31921>] __sys_sendmsg+0x51/0x90
      [  532.388560]  [<ffffffff84c31972>] SyS_sendmsg+0x12/0x20
      [  532.389636]  [<ffffffff84d8dede>] system_call_fastpath+0x25/0x2a
      [  532.390704]  [<ffffffff84d8de21>] ? system_call_after_swapgs+0xae/0x146
      [  532.391753] Code: 00 00 00 00 00 00 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 55 41 54 53 48 8b b7 48 01 00 00 48 89 fb <48> 8b 8e a8 00 00 00 48 85 c9 74 43 48 89 ca eb 0f 0f 1f 80 00
      [  532.394036] RIP  [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
      [  532.395127]  RSP <ffff8b7c9fdbf8e0>
      [  532.396179] CR2: 00000000000000a8
      
      Null pointer dereference happens on master->slaves dereference in
      teql_destroy() as master is null-pointer.
      
      When qdisc_create() calls teql_qdisc_init() it imediately fails after
      check "if (m->dev == dev)" because both devices are teql0, and it does
      not set qdisc_priv(sch)->m leaving it zero on error path, then
      qdisc_create() imediately calls teql_destroy() which does not expect
      zero master pointer and we get OOPS.
      
      Fixes: 87b60cfa ("net_sched: fix error recovery at qdisc creation")
      Signed-off-by: default avatarPavel Tikhomirov <ptikhomirov@virtuozzo.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1ffbc7ea
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf · 971e3057
      David S. Miller authored
      Daniel Borkmann says:
      
      ====================
      pull-request: bpf 2021-04-08
      
      The following pull-request contains BPF updates for your *net* tree.
      
      We've added 4 non-merge commits during the last 2 day(s) which contain
      a total of 4 files changed, 31 insertions(+), 10 deletions(-).
      
      The main changes are:
      
      1) Validate and reject invalid JIT branch displacements, from Piotr Krysiuk.
      
      2) Fix incorrect unhash restore as well as fwd_alloc memory accounting in
         sock map, from John Fastabend.
      
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      971e3057