1. 26 Sep, 2020 3 commits
    • David S. Miller's avatar
      Merge branch 'bonding-team-basic-dev-needed_headroom-support' · dc171dcf
      David S. Miller authored
      Eric Dumazet says:
      
      ====================
      bonding/team: basic dev->needed_headroom support
      
      Both bonding and team drivers support non-ethernet devices,
      but missed proper dev->needed_headroom initializations.
      
      syzbot found a crash caused by bonding, I mirrored the fix in team as well.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dc171dcf
    • Eric Dumazet's avatar
      team: set dev->needed_headroom in team_setup_by_port() · 89d01748
      Eric Dumazet authored
      Some devices set needed_headroom. If we ignore it, we might
      end up crashing in various skb_push() for example in ipgre_header()
      since some layers assume enough headroom has been reserved.
      
      Fixes: 1d76efe1 ("team: add support for non-ethernet devices")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      89d01748
    • Eric Dumazet's avatar
      bonding: set dev->needed_headroom in bond_setup_by_slave() · f32f1933
      Eric Dumazet authored
      syzbot managed to crash a host by creating a bond
      with a GRE device.
      
      For non Ethernet device, bonding calls bond_setup_by_slave()
      instead of ether_setup(), and unfortunately dev->needed_headroom
      was not copied from the new added member.
      
      [  171.243095] skbuff: skb_under_panic: text:ffffffffa184b9ea len:116 put:20 head:ffff883f84012dc0 data:ffff883f84012dbc tail:0x70 end:0xd00 dev:bond0
      [  171.243111] ------------[ cut here ]------------
      [  171.243112] kernel BUG at net/core/skbuff.c:112!
      [  171.243117] invalid opcode: 0000 [#1] SMP KASAN PTI
      [  171.243469] gsmi: Log Shutdown Reason 0x03
      [  171.243505] Call Trace:
      [  171.243506]  <IRQ>
      [  171.243512]  [<ffffffffa171be59>] skb_push+0x49/0x50
      [  171.243516]  [<ffffffffa184b9ea>] ipgre_header+0x2a/0xf0
      [  171.243520]  [<ffffffffa17452d7>] neigh_connected_output+0xb7/0x100
      [  171.243524]  [<ffffffffa186f1d3>] ip6_finish_output2+0x383/0x490
      [  171.243528]  [<ffffffffa186ede2>] __ip6_finish_output+0xa2/0x110
      [  171.243531]  [<ffffffffa186acbc>] ip6_finish_output+0x2c/0xa0
      [  171.243534]  [<ffffffffa186abe9>] ip6_output+0x69/0x110
      [  171.243537]  [<ffffffffa186ac90>] ? ip6_output+0x110/0x110
      [  171.243541]  [<ffffffffa189d952>] mld_sendpack+0x1b2/0x2d0
      [  171.243544]  [<ffffffffa189d290>] ? mld_send_report+0xf0/0xf0
      [  171.243548]  [<ffffffffa189c797>] mld_ifc_timer_expire+0x2d7/0x3b0
      [  171.243551]  [<ffffffffa189c4c0>] ? mld_gq_timer_expire+0x50/0x50
      [  171.243556]  [<ffffffffa0fea270>] call_timer_fn+0x30/0x130
      [  171.243559]  [<ffffffffa0fea17c>] expire_timers+0x4c/0x110
      [  171.243563]  [<ffffffffa0fea0e3>] __run_timers+0x213/0x260
      [  171.243566]  [<ffffffffa0fecb7d>] ? ktime_get+0x3d/0xa0
      [  171.243570]  [<ffffffffa0ff9c4e>] ? clockevents_program_event+0x7e/0xe0
      [  171.243574]  [<ffffffffa0f7e5d5>] ? sched_clock_cpu+0x15/0x190
      [  171.243577]  [<ffffffffa0fe973d>] run_timer_softirq+0x1d/0x40
      [  171.243581]  [<ffffffffa1c00152>] __do_softirq+0x152/0x2f0
      [  171.243585]  [<ffffffffa0f44e1f>] irq_exit+0x9f/0xb0
      [  171.243588]  [<ffffffffa1a02e1d>] smp_apic_timer_interrupt+0xfd/0x1a0
      [  171.243591]  [<ffffffffa1a01ea6>] apic_timer_interrupt+0x86/0x90
      
      Fixes: f5184d26 ("net: Allow netdevices to specify needed head/tailroom")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f32f1933
  2. 25 Sep, 2020 22 commits
  3. 24 Sep, 2020 6 commits
    • Felix Fietkau's avatar
      mt76: mt7615: reduce maximum VHT MPDU length to 7991 · efb16763
      Felix Fietkau authored
      After fixing mac80211 to allow larger A-MSDUs in some cases, there have been
      reports of performance regressions and packet loss with some clients.
      It appears that the issue occurs when the hardware is transmitting A-MSDUs
      bigger than 8k. Limit the local VHT MPDU size capability to 7991, matching
      the value used for MT7915 as well.
      Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      Link: https://lore.kernel.org/r/20200923052442.24141-1-nbd@nbd.name
      efb16763
    • Voon Weifeng's avatar
      net: stmmac: removed enabling eee in EEE set callback · 7241c5a6
      Voon Weifeng authored
      EEE should be only be enabled during stmmac_mac_link_up() when the
      link are up and being set up properly. set_eee should only do settings
      configuration and disabling the eee.
      
      Without this fix, turning on EEE using ethtool will return
      "Operation not supported". This is due to the driver is in a dead loop
      waiting for eee to be advertised in the for eee to be activated but the
      driver will only configure the EEE advertisement after the eee is
      activated.
      
      Ethtool should only return "Operation not supported" if there is no EEE
      capbility in the MAC controller.
      
      Fixes: 8a7493e5 ("net: stmmac: Fix a race in EEE enable callback")
      Signed-off-by: default avatarVoon Weifeng <weifeng.voon@intel.com>
      Acked-by: default avatarMark Gross <mgross@linux.intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7241c5a6
    • Hauke Mehrtens's avatar
      net: lantiq: Add locking for TX DMA channel · f9317ae5
      Hauke Mehrtens authored
      The TX DMA channel data is accessed by the xrx200_start_xmit() and the
      xrx200_tx_housekeeping() function from different threads. Make sure the
      accesses are synchronized by acquiring the netif_tx_lock() in the
      xrx200_tx_housekeeping() function too. This lock is acquired by the
      kernel before calling xrx200_start_xmit().
      Signed-off-by: default avatarHauke Mehrtens <hauke@hauke-m.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f9317ae5
    • Tian Tao's avatar
      net: switchdev: Fixed kerneldoc warning · ea6754ae
      Tian Tao authored
      Update kernel-doc line comments to fix warnings reported by make W=1.
      net/switchdev/switchdev.c:413: warning: Function parameter or
      member 'extack' not described in 'call_switchdev_notifiers'
      Signed-off-by: default avatarTian Tao <tiantao6@hisilicon.com>
      Acked-by: default avatarIvan Vecera <ivecera@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ea6754ae
    • Geert Uytterhoeven's avatar
      Revert "ravb: Fixed to be able to unload modules" · 77972b55
      Geert Uytterhoeven authored
      This reverts commit 1838d6c6.
      
      This commit moved the ravb_mdio_init() call (and thus the
      of_mdiobus_register() call) from the ravb_probe() to the ravb_open()
      call.  This causes a regression during system resume (s2idle/s2ram), as
      new PHY devices cannot be bound while suspended.
      
      During boot, the Micrel PHY is detected like this:
      
          Micrel KSZ9031 Gigabit PHY e6800000.ethernet-ffffffff:00: attached PHY driver [Micrel KSZ9031 Gigabit PHY] (mii_bus:phy_addr=e6800000.ethernet-ffffffff:00, irq=228)
          ravb e6800000.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
      
      During system suspend, (A) defer_all_probes is set to true, and (B)
      usermodehelper_disabled is set to UMH_DISABLED, to avoid drivers being
      probed while suspended.
      
        A. If CONFIG_MODULES=n, phy_device_register() calling device_add()
           merely adds the device, but does not probe it yet, as
           really_probe() returns early due to defer_all_probes being set:
      
             dpm_resume+0x128/0x4f8
      	 device_resume+0xcc/0x1b0
      	   dpm_run_callback+0x74/0x340
      	     ravb_resume+0x190/0x1b8
      	       ravb_open+0x84/0x770
      		 of_mdiobus_register+0x1e0/0x468
      		   of_mdiobus_register_phy+0x1b8/0x250
      		     of_mdiobus_phy_device_register+0x178/0x1e8
      		       phy_device_register+0x114/0x1b8
      			 device_add+0x3d4/0x798
      			   bus_probe_device+0x98/0xa0
      			     device_initial_probe+0x10/0x18
      			       __device_attach+0xe4/0x140
      				 bus_for_each_drv+0x64/0xc8
      				   __device_attach_driver+0xb8/0xe0
      				     driver_probe_device.part.11+0xc4/0xd8
      				       really_probe+0x32c/0x3b8
      
           Later, phy_attach_direct() notices no PHY driver has been bound,
           and falls back to the Generic PHY, leading to degraded operation:
      
             Generic PHY e6800000.ethernet-ffffffff:00: attached PHY driver [Generic PHY] (mii_bus:phy_addr=e6800000.ethernet-ffffffff:00, irq=POLL)
             ravb e6800000.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
      
        B. If CONFIG_MODULES=y, request_module() returns early with -EBUSY due
           to UMH_DISABLED, and MDIO initialization fails completely:
      
             mdio_bus e6800000.ethernet-ffffffff:00: error -16 loading PHY driver module for ID 0x00221622
             ravb e6800000.ethernet eth0: failed to initialize MDIO
             PM: dpm_run_callback(): ravb_resume+0x0/0x1b8 returns -16
             PM: Device e6800000.ethernet failed to resume: error -16
      
           Ignoring -EBUSY in phy_request_driver_module(), like was done for
           -ENOENT in commit 21e19442 ("net: phy: fix issue with loading
           PHY driver w/o initramfs"), would makes it fall back to the Generic
           PHY, like in the CONFIG_MODULES=n case.
      Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarSergei Shtylyov <sergei.shtylyov@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      77972b55
    • Mat Martineau's avatar
      mptcp: Wake up MPTCP worker when DATA_FIN found on a TCP FIN packet · ef59b195
      Mat Martineau authored
      When receiving a DATA_FIN MPTCP option on a TCP FIN packet, the DATA_FIN
      information would be stored but the MPTCP worker did not get
      scheduled. In turn, the MPTCP socket state would remain in
      TCP_ESTABLISHED and no blocked operations would be awakened.
      
      TCP FIN packets are seen by the MPTCP socket when moving skbs out of the
      subflow receive queues, so schedule the MPTCP worker when a skb with
      DATA_FIN but no data payload is moved from a subflow queue. Other cases
      (DATA_FIN on a bare TCP ACK or on a packet with data payload) are
      already handled.
      
      Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/84
      Fixes: 43b54c6e ("mptcp: Use full MPTCP-level disconnect state machine")
      Acked-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
      Signed-off-by: default avatarMatthieu Baerts <matthieu.baerts@tessares.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ef59b195
  4. 22 Sep, 2020 9 commits
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 805c6d3c
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "No common topic, just assorted fixes"
      
      * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        fuse: fix the ->direct_IO() treatment of iov_iter
        fs: fix cast in fsparam_u32hex() macro
        vboxsf: Fix the check for the old binary mount-arguments struct
      805c6d3c
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · d3017135
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
      
       - fix failure to add bond interfaces to a bridge, the offload-handling
         code was too defensive there and recent refactoring unearthed that.
         Users complained (Ido)
      
       - fix unnecessarily reflecting ECN bits within TOS values / QoS marking
         in TCP ACK and reset packets (Wei)
      
       - fix a deadlock with bpf iterator. Hopefully we're in the clear on
         this front now... (Yonghong)
      
       - BPF fix for clobbering r2 in bpf_gen_ld_abs (Daniel)
      
       - fix AQL on mt76 devices with FW rate control and add a couple of AQL
         issues in mac80211 code (Felix)
      
       - fix authentication issue with mwifiex (Maximilian)
      
       - WiFi connectivity fix: revert IGTK support in ti/wlcore (Mauro)
      
       - fix exception handling for multipath routes via same device (David
         Ahern)
      
       - revert back to a BH spin lock flavor for nsid_lock: there are paths
         which do require the BH context protection (Taehee)
      
       - fix interrupt / queue / NAPI handling in the lantiq driver (Hauke)
      
       - fix ife module load deadlock (Cong)
      
       - make an adjustment to netlink reply message type for code added in
         this release (the sole change touching uAPI here) (Michal)
      
       - a number of fixes for small NXP and Microchip switches (Vladimir)
      
      [ Pull request acked by David: "you can expect more of this in the
        future as I try to delegate more things to Jakub" ]
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (167 commits)
        net: mscc: ocelot: fix some key offsets for IP4_TCP_UDP VCAP IS2 entries
        net: dsa: seville: fix some key offsets for IP4_TCP_UDP VCAP IS2 entries
        net: dsa: felix: fix some key offsets for IP4_TCP_UDP VCAP IS2 entries
        inet_diag: validate INET_DIAG_REQ_PROTOCOL attribute
        net: bridge: br_vlan_get_pvid_rcu() should dereference the VLAN group under RCU
        net: Update MAINTAINERS for MediaTek switch driver
        net/mlx5e: mlx5e_fec_in_caps() returns a boolean
        net/mlx5e: kTLS, Avoid kzalloc(GFP_KERNEL) under spinlock
        net/mlx5e: kTLS, Fix leak on resync error flow
        net/mlx5e: kTLS, Add missing dma_unmap in RX resync
        net/mlx5e: kTLS, Fix napi sync and possible use-after-free
        net/mlx5e: TLS, Do not expose FPGA TLS counter if not supported
        net/mlx5e: Fix using wrong stats_grps in mlx5e_update_ndo_stats()
        net/mlx5e: Fix multicast counter not up-to-date in "ip -s"
        net/mlx5e: Fix endianness when calculating pedit mask first bit
        net/mlx5e: Enable adding peer miss rules only if merged eswitch is supported
        net/mlx5e: CT: Fix freeing ct_label mapping
        net/mlx5e: Fix memory leak of tunnel info when rule under multipath not ready
        net/mlx5e: Use synchronize_rcu to sync with NAPI
        net/mlx5e: Use RCU to protect rq->xdp_prog
        ...
      d3017135
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.9-2020-09-22' of git://git.kernel.dk/linux-block · 0baca070
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
       "A few fixes - most of them regression fixes from this cycle, but also
        a few stable heading fixes, and a build fix for the included demo tool
        since some systems now actually have gettid() available"
      
      * tag 'io_uring-5.9-2020-09-22' of git://git.kernel.dk/linux-block:
        io_uring: fix openat/openat2 unified prep handling
        io_uring: mark statx/files_update/epoll_ctl as non-SQPOLL
        tools/io_uring: fix compile breakage
        io_uring: don't use retry based buffered reads for non-async bdev
        io_uring: don't re-setup vecs/iter in io_resumit_prep() is already there
        io_uring: don't run task work on an exiting task
        io_uring: drop 'ctx' ref on task work cancelation
        io_uring: grab any needed state during defer prep
      0baca070
    • Linus Torvalds's avatar
      Merge tag 'block-5.9-2020-09-22' of git://git.kernel.dk/linux-block · c37b7189
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A few NVMe fixes, and a dasd write zero fix"
      
      * tag 'block-5.9-2020-09-22' of git://git.kernel.dk/linux-block:
        nvmet: get transport reference for passthru ctrl
        nvme-core: get/put ctrl and transport module in nvme_dev_open/release()
        nvme-tcp: fix kconfig dependency warning when !CRYPTO
        nvme-pci: disable the write zeros command for Intel 600P/P3100
        s390/dasd: Fix zero write for FBA devices
      c37b7189
    • Linus Torvalds's avatar
      Merge tag 'trace-v5.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · eff48dde
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
      
       - Check kprobe is enabled before unregistering from ftrace as it isn't
         registered when disabled.
      
       - Remove kprobes enabled via command-line that is on init text when
         freed.
      
       - Add missing RCU synchronization for ftrace trampoline symbols removed
         from kallsyms.
      
       - Free trampoline on error path if ftrace_startup() fails.
      
       - Give more space for the longer PID numbers in trace output.
      
       - Fix a possible double free in the histogram code.
      
       - A couple of fixes that were discovered by sparse.
      
      * tag 'trace-v5.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        bootconfig: init: make xbc_namebuf static
        kprobes: tracing/kprobes: Fix to kill kprobes on initmem after boot
        tracing: fix double free
        ftrace: Let ftrace_enable_sysctl take a kernel pointer buffer
        tracing: Make the space reserved for the pid wider
        ftrace: Fix missing synchronize_rcu() removing trampoline from kallsyms
        ftrace: Free the trampoline when ftrace_startup() fails
        kprobes: Fix to check probe enabled before disarm_kprobe_ftrace()
      eff48dde
    • David S. Miller's avatar
      Merge branch 'Fix-broken-tc-flower-rules-for-mscc_ocelot-switches' · b334ec66
      David S. Miller authored
      Vladimir Oltean says:
      
      ====================
      Fix broken tc-flower rules for mscc_ocelot switches
      
      All 3 switch drivers from the Ocelot family have the same bug in the
      VCAP IS2 key offsets, which is that some keys are in the incorrect
      order.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b334ec66
    • Vladimir Oltean's avatar
      net: mscc: ocelot: fix some key offsets for IP4_TCP_UDP VCAP IS2 entries · 8194d8fa
      Vladimir Oltean authored
      The IS2 IP4_TCP_UDP key offsets do not correspond to the VSC7514
      datasheet. Whether they work or not is unknown to me. On VSC9959 and
      VSC9953, with the same mistake and same discrepancy from the
      documentation, tc-flower src_port and dst_port rules did not work, so I
      am assuming the same is true here.
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8194d8fa
    • Vladimir Oltean's avatar
      net: dsa: seville: fix some key offsets for IP4_TCP_UDP VCAP IS2 entries · 7a023075
      Vladimir Oltean authored
      Since these were copied from the Felix VCAP IS2 code, and only the
      offsets were adjusted, the order of the bit fields is still wrong.
      Fix it.
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7a023075
    • Xiaoliang Yang's avatar
      net: dsa: felix: fix some key offsets for IP4_TCP_UDP VCAP IS2 entries · 8b9e03cd
      Xiaoliang Yang authored
      Some of the IS2 IP4_TCP_UDP keys are not correct, like L4_DPORT,
      L4_SPORT and other L4 keys. This prevents offloaded tc-flower rules from
      matching on src_port and dst_port for TCP and UDP packets.
      Signed-off-by: default avatarXiaoliang Yang <xiaoliang.yang_1@nxp.com>
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8b9e03cd