1. 21 Jul, 2020 6 commits
    • David S. Miller's avatar
      Merge branch 'smc-fixes' · d49e2c9e
      David S. Miller authored
      Karsten Graul says:
      
      ====================
      net/smc: fixes 2020-07-20
      
      Please apply the following patch series for smc to netdev's net tree.
      
      Patch 1 fixes a problem with a buffer that is not put back when the
      connection was killed in the meantime.
      Patch 2 fixes a wrong behaviour when the maximum dmb buffer count
      exceeded.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d49e2c9e
    • Karsten Graul's avatar
      net/smc: fix dmb buffer shortage · a9e44502
      Karsten Graul authored
      There is a current limit of 1920 registered dmb buffers per ISM device
      for smc-d. One link group can contain 255 connections, each connection
      is using one dmb buffer. When the connection is closed then the
      registered buffer is held in a queue and is reused by the next
      connection. When a link group is 'full' then another link group is
      created and uses an own buffer pool. The link groups are added to a
      list using list_add() which puts a new link group to the first position
      in the list.
      In the situation that many connections are opened (>1920) and a few of
      them stay open while others are closed quickly we end up with at least 8
      link groups. For a new connection a matching link group is looked up,
      iterating over the list of link groups. The trailing 7 link groups
      all have registered dmb buffers which could be reused, while the first
      link group has only a few dmb buffers and then hit the 1920 limit.
      Because the first link group is not full (255 connection limit not
      reached) it is chosen and finally the connection falls back to TCP
      because there is no dmb buffer available in this link group.
      There are multiple ways to fix that: using list_add_tail() allows
      to scan older link groups first for free buffers which ensures that
      buffers are reused first. This fixes the problem for smc-r link groups
      as well. For smc-d there is an even better way to address this problem
      because smc-d does not have the 255 connections per link group limit.
      So fix the problem for smc-d by allowing large link groups.
      
      Fixes: c6ba7c9b ("net/smc: add base infrastructure for SMC-D and ISM")
      Reviewed-by: default avatarUrsula Braun <ubraun@linux.ibm.com>
      Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a9e44502
    • Karsten Graul's avatar
      net/smc: put slot when connection is killed · 2bced6ae
      Karsten Graul authored
      To get a send slot smc_wr_tx_get_free_slot() is called, which might
      wait for a free slot. When smc_wr_tx_get_free_slot() returns there is a
      check if the connection was killed in the meantime. In that case don't
      only return an error, but also put back the free slot.
      
      Fixes: b2900980 ("net/smc: cancel send and receive for terminated socket")
      Reviewed-by: default avatarUrsula Braun <ubraun@linux.ibm.com>
      Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2bced6ae
    • David Howells's avatar
      rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA · 639f181f
      David Howells authored
      rxrpc_sendmsg() returns EPIPE if there's an outstanding error, such as if
      rxrpc_recvmsg() indicating ENODATA if there's nothing for it to read.
      
      Change rxrpc_recvmsg() to return EAGAIN instead if there's nothing to read
      as this particular error doesn't get stored in ->sk_err by the networking
      core.
      
      Also change rxrpc_sendmsg() so that it doesn't fail with delayed receive
      errors (there's no way for it to report which call, if any, the error was
      caused by).
      
      Fixes: 17926a79 ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      639f181f
    • David S. Miller's avatar
      Merge tag 'ieee802154-for-davem-2020-07-20' of... · 7d85396c
      David S. Miller authored
      Merge tag 'ieee802154-for-davem-2020-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan
      
      Stefan Schmidt says:
      
      ====================
      pull-request: ieee802154 for net 2020-07-20
      
      An update from ieee802154 for your *net* tree.
      
      A potential memory leak fix for adf7242 from Liu Jian,
      and one more HTTPS link change from Alexander A. Klimov.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7d85396c
    • Zhang Changzhong's avatar
      net: bcmgenet: add missed clk_disable_unprepare in bcmgenet_probe · 53a92889
      Zhang Changzhong authored
      The driver forgets to call clk_disable_unprepare() in error path after
      a success calling for clk_prepare_enable().
      
      Fix to goto err_clk_disable if clk_prepare_enable() is successful.
      
      Fixes: c80d36ff ("net: bcmgenet: Use devm_clk_get_optional() to get the clocks")
      Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
      Acked-by: default avatarDoug Berger <opendmb@gmail.com>
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      53a92889
  2. 20 Jul, 2020 5 commits
    • Zhang Changzhong's avatar
      net: bcmgenet: fix error returns in bcmgenet_probe() · 24a63fe6
      Zhang Changzhong authored
      The driver forgets to call clk_disable_unprepare() in error path after
      a success calling for clk_prepare_enable().
      
      Fix to goto err_clk_disable if clk_prepare_enable() is successful.
      
      Fixes: 99d55638 ("net: bcmgenet: enable NETIF_F_HIGHDMA flag")
      Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
      Acked-by: default avatarDoug Berger <opendmb@gmail.com>
      Acked-by: default avatarFlorian fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      24a63fe6
    • Alexander A. Klimov's avatar
      net: ieee802154: adf7242: Replace HTTP links with HTTPS ones · 19dc3654
      Alexander A. Klimov authored
      Rationale:
      Reduces attack surface on kernel devs opening the links for MITM
      as HTTPS traffic is much harder to manipulate.
      
      Deterministic algorithm:
      For each file:
        If not .svg:
          For each line:
            If doesn't contain `\bxmlns\b`:
              For each link, `\bhttp://[^# \t\r\n]*(?:\w|/)`:
      	  If neither `\bgnu\.org/license`, nor `\bmozilla\.org/MPL\b`:
                  If both the HTTP and HTTPS versions
                  return 200 OK and serve the same content:
                    Replace HTTP with HTTPS.
      Signed-off-by: default avatarAlexander A. Klimov <grandmaster@al2klimov.de>
      Link: https://lore.kernel.org/r/20200719113142.58304-1-grandmaster@al2klimov.deSigned-off-by: default avatarStefan Schmidt <stefan@datenfreihafen.org>
      19dc3654
    • Taehee Yoo's avatar
      bonding: check error value of register_netdevice() immediately · 544f287b
      Taehee Yoo authored
      If register_netdevice() is failed, net_device should not be used
      because variables are uninitialized or freed.
      So, the routine should be stopped immediately.
      But, bond_create() doesn't check return value of register_netdevice()
      immediately. That will result in a panic because of using uninitialized
      or freed memory.
      
      Test commands:
          modprobe netdev-notifier-error-inject
          echo -22 > /sys/kernel/debug/notifier-error-inject/netdev/\
      actions/NETDEV_REGISTER/error
          modprobe bonding max_bonds=3
      
      Splat looks like:
      [  375.028492][  T193] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
      [  375.033207][  T193] CPU: 2 PID: 193 Comm: kworker/2:2 Not tainted 5.8.0-rc4+ #645
      [  375.036068][  T193] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
      [  375.039673][  T193] Workqueue: events linkwatch_event
      [  375.041557][  T193] RIP: 0010:dev_activate+0x4a/0x340
      [  375.043381][  T193] Code: 40 a8 04 0f 85 db 00 00 00 8b 83 08 04 00 00 85 c0 0f 84 0d 01 00 00 31 d2 89 d0 48 8d 04 40 48 c1 e0 07 48 03 83 00 04 00 00 <48> 8b 48 10 f6 41 10 01 75 08 f0 80 a1 a0 01 00 00 fd 48 89 48 08
      [  375.050267][  T193] RSP: 0018:ffff9f8facfcfdd8 EFLAGS: 00010202
      [  375.052410][  T193] RAX: 6b6b6b6b6b6b6b6b RBX: ffff9f8fae6ea000 RCX: 0000000000000006
      [  375.055178][  T193] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f8fae6ea000
      [  375.057762][  T193] RBP: ffff9f8fae6ea000 R08: 0000000000000000 R09: 0000000000000000
      [  375.059810][  T193] R10: 0000000000000001 R11: 0000000000000000 R12: ffff9f8facfcfe08
      [  375.061892][  T193] R13: ffffffff883587e0 R14: 0000000000000000 R15: ffff9f8fae6ea580
      [  375.063931][  T193] FS:  0000000000000000(0000) GS:ffff9f8fbae00000(0000) knlGS:0000000000000000
      [  375.066239][  T193] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  375.067841][  T193] CR2: 00007f2f542167a0 CR3: 000000012cee6002 CR4: 00000000003606e0
      [  375.069657][  T193] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  375.071471][  T193] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [  375.073269][  T193] Call Trace:
      [  375.074005][  T193]  linkwatch_do_dev+0x4d/0x50
      [  375.075052][  T193]  __linkwatch_run_queue+0x10b/0x200
      [  375.076244][  T193]  linkwatch_event+0x21/0x30
      [  375.077274][  T193]  process_one_work+0x252/0x600
      [  375.078379][  T193]  ? process_one_work+0x600/0x600
      [  375.079518][  T193]  worker_thread+0x3c/0x380
      [  375.080534][  T193]  ? process_one_work+0x600/0x600
      [  375.081668][  T193]  kthread+0x139/0x150
      [  375.082567][  T193]  ? kthread_park+0x90/0x90
      [  375.083567][  T193]  ret_from_fork+0x22/0x30
      
      Fixes: e826eafa ("bonding: Call netif_carrier_off after register_netdevice")
      Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      544f287b
    • Russell King's avatar
      arm64: dts: clearfog-gt-8k: fix switch link configuration · 7c6719a1
      Russell King authored
      The commit below caused a regression for clearfog-gt-8k, where the link
      between the switch and the host does not come up.
      
      Investigation revealed two issues:
      - MV88E6xxx DSA no longer allows an in-band link to come up as the link
        is programmed to be forced down. Commit "net: dsa: mv88e6xxx: fix
        in-band AN link establishment" addresses this.
      
      - The dts configured dissimilar link modes at each end of the host to
        switch link; the host was configured using a fixed link (so has no
        in-band status) and the switch was configured to expect in-band
        status.
      
      With both issues fixed, the regression is resolved.
      
      Fixes: 34b5e6a3 ("net: dsa: mv88e6xxx: Configure MAC when using fixed link")
      Reported-by: default avatarMartin Rowe <martin.p.rowe@gmail.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7c6719a1
    • Russell King's avatar
      net: dsa: mv88e6xxx: fix in-band AN link establishment · fad58190
      Russell King authored
      If in-band negotiation or fixed-link modes are specified for a DSA
      port, the DSA code will force the link down during initialisation. For
      fixed-link mode, this is fine, as phylink will manage the link state.
      However, for in-band mode, phylink expects the PCS to detect link,
      which will not happen if the link is forced down.
      
      There is a related issue that in in-band mode, the link could come up
      while we are making configuration changes, so we should force the link
      down prior to reconfiguring the interface mode.
      
      This patch addresses both issues.
      
      Fixes: 3be98b2d ("net: dsa: Down cpu/dsa ports phylink will control")
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fad58190
  3. 19 Jul, 2020 11 commits
  4. 18 Jul, 2020 6 commits
  5. 17 Jul, 2020 10 commits
    • Wang Hai's avatar
      nfc: nci: add missed destroy_workqueue in nci_register_device · 0b4a66a3
      Wang Hai authored
      When nfc_register_device fails in nci_register_device,
      destroy_workqueue() shouled be called to destroy ndev->tx_wq.
      
      Fixes: 3c1c0f5d ("NFC: NCI: Fix nci_register_device init sequence")
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0b4a66a3
    • David S. Miller's avatar
      Merge branch 'bcmgenet-WAKE_FILTER' · 12915174
      David S. Miller authored
      Doug Berger says:
      
      ====================
      net: bcmgenet: fix WAKE_FILTER resume from deep sleep
      
      The WAKE_FILTER logic can only wake the system from the standby
      power state. However, some systems that include the GENET IP
      support deeper power saving states and the driver should suspend
      and resume correctly from those states as well.
      
      This commit set squashes a few issues uncovered while testing
      suspend and resume from these deep sleep states.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      12915174
    • Doug Berger's avatar
      net: bcmgenet: restore HFB filters on resume · a8c64542
      Doug Berger authored
      The Hardware Filter Block RAM may not be preserved when the GENET
      block is reset during a deep sleep, so it is not sufficient to
      only backup and restore the enables.
      
      This commit clears out the HFB block and reprograms the rxnfc
      rules when the system resumes from a suspended state. To support
      this the bcmgenet_hfb_create_rxnfc_filter() function is modified
      to access the register space directly so that it can't fail due
      to memory allocation issues.
      
      Fixes: f50932cc ("net: bcmgenet: add WAKE_FILTER support")
      Signed-off-by: default avatarDoug Berger <opendmb@gmail.com>
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a8c64542
    • Doug Berger's avatar
      net: bcmgenet: test RBUF_ACPI_EN when resuming · 3d653adb
      Doug Berger authored
      When the GENET driver resumes from deep sleep the UMAC_CMD
      register may not be accessible and therefore should not be
      accessed from bcmgenet_wol_power_up_cfg() if the GENET has
      been reset.
      
      This commit adds a check of the RBUF_ACPI_EN flag when Wake
      on Filter is enabled. A clear flag indicates that the GENET
      hardware must have been reset so the remainder of the
      hardware programming is bypassed.
      
      Fixes: f50932cc ("net: bcmgenet: add WAKE_FILTER support")
      Signed-off-by: default avatarDoug Berger <opendmb@gmail.com>
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3d653adb
    • Doug Berger's avatar
      net: bcmgenet: test MPD_EN when resuming · 2f11f0df
      Doug Berger authored
      When the GENET driver resumes from deep sleep the UMAC_CMD
      register may not be accessible and therefore should not be
      accessed from bcmgenet_wol_power_up_cfg() if the GENET has
      been reset.
      
      This commit adds a check of the MPD_EN flag when Wake on
      Magic Packet is enabled. A clear flag indicates that the
      GENET hardware must have been reset so the remainder of the
      hardware programming is bypassed.
      
      Fixes: 1a1d5106 ("net: bcmgenet: move clk_wol management to bcmgenet_wol")
      Signed-off-by: default avatarDoug Berger <opendmb@gmail.com>
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2f11f0df
    • Paolo Pisati's avatar
      selftests: net: ip_defrag: modprobe missing nf_defrag_ipv6 support · aba69d49
      Paolo Pisati authored
      Fix ip_defrag.sh when CONFIG_NF_DEFRAG_IPV6=m:
      
      $ sudo ./ip_defrag.sh
      + set -e
      + mktemp -u XXXXXX
      + readonly NETNS=ns-rGlXcw
      + trap cleanup EXIT
      + setup
      + ip netns add ns-rGlXcw
      + ip -netns ns-rGlXcw link set lo up
      + ip netns exec ns-rGlXcw sysctl -w net.ipv4.ipfrag_high_thresh=9000000
      + ip netns exec ns-rGlXcw sysctl -w net.ipv4.ipfrag_low_thresh=7000000
      + ip netns exec ns-rGlXcw sysctl -w net.ipv4.ipfrag_time=1
      + ip netns exec ns-rGlXcw sysctl -w net.ipv6.ip6frag_high_thresh=9000000
      + ip netns exec ns-rGlXcw sysctl -w net.ipv6.ip6frag_low_thresh=7000000
      + ip netns exec ns-rGlXcw sysctl -w net.ipv6.ip6frag_time=1
      + ip netns exec ns-rGlXcw sysctl -w net.netfilter.nf_conntrack_frag6_high_thresh=9000000
      + cleanup
      + ip netns del ns-rGlXcw
      
      $ ls -la /proc/sys/net/netfilter/nf_conntrack_frag6_high_thresh
      ls: cannot access '/proc/sys/net/netfilter/nf_conntrack_frag6_high_thresh': No such file or directory
      
      $ sudo modprobe nf_defrag_ipv6
      $ ls -la /proc/sys/net/netfilter/nf_conntrack_frag6_high_thresh
      -rw-r--r-- 1 root root 0 Jul 14 12:34 /proc/sys/net/netfilter/nf_conntrack_frag6_high_thresh
      Signed-off-by: default avatarPaolo Pisati <paolo.pisati@canonical.com>
      Reviewed-by: default avatarJakub Kicinski <kuba@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      aba69d49
    • Wang Hai's avatar
      net: smc91x: Fix possible memory leak in smc_drv_probe() · bca9749b
      Wang Hai authored
      If try_toggle_control_gpio() failed in smc_drv_probe(), free_netdev(ndev)
      should be called to free the ndev created earlier. Otherwise, a memleak
      will occur.
      
      Fixes: 7d2911c4 ("net: smc91x: Fix gpios for device tree based booting")
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bca9749b
    • Weilong Chen's avatar
      rtnetlink: Fix memory(net_device) leak when ->newlink fails · cebb6975
      Weilong Chen authored
      When vlan_newlink call register_vlan_dev fails, it might return error
      with dev->reg_state = NETREG_UNREGISTERED. The rtnl_newlink should
      free the memory. But currently rtnl_newlink only free the memory which
      state is NETREG_UNINITIALIZED.
      
      BUG: memory leak
      unreferenced object 0xffff8881051de000 (size 4096):
        comm "syz-executor139", pid 560, jiffies 4294745346 (age 32.445s)
        hex dump (first 32 bytes):
          76 6c 61 6e 32 00 00 00 00 00 00 00 00 00 00 00  vlan2...........
          00 45 28 03 81 88 ff ff 00 00 00 00 00 00 00 00  .E(.............
        backtrace:
          [<0000000047527e31>] kmalloc_node include/linux/slab.h:578 [inline]
          [<0000000047527e31>] kvmalloc_node+0x33/0xd0 mm/util.c:574
          [<000000002b59e3bc>] kvmalloc include/linux/mm.h:753 [inline]
          [<000000002b59e3bc>] kvzalloc include/linux/mm.h:761 [inline]
          [<000000002b59e3bc>] alloc_netdev_mqs+0x83/0xd90 net/core/dev.c:9929
          [<000000006076752a>] rtnl_create_link+0x2c0/0xa20 net/core/rtnetlink.c:3067
          [<00000000572b3be5>] __rtnl_newlink+0xc9c/0x1330 net/core/rtnetlink.c:3329
          [<00000000e84ea553>] rtnl_newlink+0x66/0x90 net/core/rtnetlink.c:3397
          [<0000000052c7c0a9>] rtnetlink_rcv_msg+0x540/0x990 net/core/rtnetlink.c:5460
          [<000000004b5cb379>] netlink_rcv_skb+0x12b/0x3a0 net/netlink/af_netlink.c:2469
          [<00000000c71c20d3>] netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
          [<00000000c71c20d3>] netlink_unicast+0x4c6/0x690 net/netlink/af_netlink.c:1329
          [<00000000cca72fa9>] netlink_sendmsg+0x735/0xcc0 net/netlink/af_netlink.c:1918
          [<000000009221ebf7>] sock_sendmsg_nosec net/socket.c:652 [inline]
          [<000000009221ebf7>] sock_sendmsg+0x109/0x140 net/socket.c:672
          [<000000001c30ffe4>] ____sys_sendmsg+0x5f5/0x780 net/socket.c:2352
          [<00000000b71ca6f3>] ___sys_sendmsg+0x11d/0x1a0 net/socket.c:2406
          [<0000000007297384>] __sys_sendmsg+0xeb/0x1b0 net/socket.c:2439
          [<000000000eb29b11>] do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:359
          [<000000006839b4d0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      Fixes: cb626bf5 ("net-sysfs: Fix reference count leak")
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarWeilong Chen <chenweilong@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cebb6975
    • Min Li's avatar
      docs: ptp.rst: add support for Renesas (IDT) ClockMatrix · 56a1c778
      Min Li authored
      Add below to “Ancillary clock features” section
        - Low Pass Filter (LPF) access from user space
      
      Add below to list of “Supported hardware” section
        + Renesas (IDT) ClockMatrixSigned-off-by: default avatarMin Li <min.li.xe@renesas.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      56a1c778
    • Liu Jian's avatar
      ieee802154: fix one possible memleak in adf7242_probe · 66673f96
      Liu Jian authored
      When probe fail, we should destroy the workqueue.
      
      Fixes: 2795e8c2 ("net: ieee802154: fix a potential NULL pointer dereference")
      Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
      Acked-by: default avatarMichael Hennerich <michael.hennerich@analog.com>
      Link: https://lore.kernel.org/r/20200717090121.2143-1-liujian56@huawei.comSigned-off-by: default avatarStefan Schmidt <stefan@datenfreihafen.org>
      66673f96
  6. 16 Jul, 2020 2 commits