5.15.127-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 5.15.127-rc1 review
This is the start of the stable review cycle for the 5.15.127 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.127-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.127-rc1
Frederic Weisbecker <[email protected]>
timers/nohz: Last resort update jiffies on nohz_full IRQ entry
Nicholas Piggin <[email protected]>
timers/nohz: Switch to ONESHOT_STOPPED in the low-res handler when the tick is stopped
Frederic Weisbecker <[email protected]>
tick: Detect and fix jiffies update stall
Eric Dumazet <[email protected]>
sch_netem: fix issues in netem_change() vs get_dist_table()
Masahiro Yamada <[email protected]>
alpha: remove __init annotation from exported page_is_ram()
Nilesh Javali <[email protected]>
scsi: qedf: Fix firmware halt over suspend and resume
Nilesh Javali <[email protected]>
scsi: qedi: Fix firmware halt over suspend and resume
Karan Tilak Kumar <[email protected]>
scsi: fnic: Replace return codes in fnic_clean_pending_aborts()
Zhu Wang <[email protected]>
scsi: core: Fix possible memory leak if device_add() fails
Zhu Wang <[email protected]>
scsi: snic: Fix possible memory leak if device_add() fails
Alexandra Diupina <[email protected]>
scsi: 53c700: Check that command slot is not NULL
Michael Kelley <[email protected]>
scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
Tony Battersby <[email protected]>
scsi: core: Fix legacy /proc parsing buffer overflow
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: report use refcount overflow
Ming Lei <[email protected]>
nvme-rdma: fix potential unbalanced freeze & unfreeze
Ming Lei <[email protected]>
nvme-tcp: fix potential unbalanced freeze & unfreeze
Josef Bacik <[email protected]>
btrfs: set cache_block_group_error if we find an error
Qu Wenruo <[email protected]>
btrfs: reject invalid reloc tree root keys with stack dump
Qu Wenruo <[email protected]>
btrfs: exit gracefully if reloc roots don't match
Christoph Hellwig <[email protected]>
btrfs: don't stop integrity writeback too early
Nick Child <[email protected]>
ibmvnic: Handle DMA unmapping of login buffs in release functions
Nick Child <[email protected]>
ibmvnic: Unmap DMA login rsp buffer on send login fail
Nick Child <[email protected]>
ibmvnic: Enforce stronger sanity checks on login response
Moshe Shemesh <[email protected]>
net/mlx5: Skip clock update work when device is in error state
Daniel Jurgens <[email protected]>
net/mlx5: Allow 0 for total host VFs
Christophe JAILLET <[email protected]>
dmaengine: mcf-edma: Fix a potential un-allocated memory access
Ido Schimmel <[email protected]>
nexthop: Fix infinite nexthop bucket dump when using maximum nexthop ID
Ido Schimmel <[email protected]>
nexthop: Make nexthop bucket dump more efficient
Ido Schimmel <[email protected]>
nexthop: Fix infinite nexthop dump when using maximum nexthop ID
Jie Wang <[email protected]>
net: hns3: add wait until mac link down
Jie Wang <[email protected]>
net: hns3: refactor hclge_mac_link_status_wait for interface reuse
Li Yang <[email protected]>
net: phy: at803x: remove set/get wol callbacks for AR8032
Michael Guralnik <[email protected]>
RDMA/umem: Set iova in ODP flow
Felix Fietkau <[email protected]>
wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
Daniel Stone <[email protected]>
drm/rockchip: Don't spam logs in atomic check
Douglas Miller <[email protected]>
IB/hfi1: Fix possible panic during hotplug remove
Piotr Gardocki <[email protected]>
iavf: fix potential races for FDIR filters
Andrew Kanner <[email protected]>
drivers: net: prevent tun_build_skb() to exceed the packet size limit
Eric Dumazet <[email protected]>
dccp: fix data-race around dp->dccps_mss_cache
Ziyang Xuan <[email protected]>
bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
Magnus Karlsson <[email protected]>
xsk: fix refcount underflow in error path
Florian Westphal <[email protected]>
tunnels: fix kasan splat when generating ipv4 pmtu error
Eric Dumazet <[email protected]>
net/packet: annotate data-races around tp->status
Nathan Chancellor <[email protected]>
mISDN: Update parameter type of dsp_cmx_send()
Xu Kuohai <[email protected]>
bpf, sockmap: Fix bug that strp_done cannot be called
Xu Kuohai <[email protected]>
bpf, sockmap: Fix map type error in sock_map_del_link
Andrew Kanner <[email protected]>
net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail()
Ido Schimmel <[email protected]>
selftests: forwarding: tc_flower: Relax success criterion
Ido Schimmel <[email protected]>
selftests: forwarding: Switch off timeout
Ido Schimmel <[email protected]>
selftests: forwarding: Skip test when no interfaces are specified
Ido Schimmel <[email protected]>
selftests: forwarding: ethtool_extended_state: Skip when using veth pairs
Ido Schimmel <[email protected]>
selftests: forwarding: ethtool: Skip when using veth pairs
Ido Schimmel <[email protected]>
selftests: forwarding: Add a helper to skip test when using veth pairs
Mark Brown <[email protected]>
selftests/rseq: Fix build with undefined __weak
Florian Westphal <[email protected]>
netfilter: nf_tables: don't skip expired elements during walk
Karol Herbst <[email protected]>
drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
Arnd Bergmann <[email protected]>
x86: Move gds_ucode_mitigated() declaration to header
Arnd Bergmann <[email protected]>
x86/speculation: Add cpu_show_gds() prototype
Kirill A. Shutemov <[email protected]>
x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
Cristian Ciocaltea <[email protected]>
x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
Nick Desaulniers <[email protected]>
x86/srso: Fix build breakage with the LLVM linker
Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Fix response to vsafe0V event
Prashanth K <[email protected]>
usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
Elson Roy Serrao <[email protected]>
usb: dwc3: Properly handle processing of pending events
Alan Stern <[email protected]>
usb-storage: alauda: Fix uninit-value in alauda_check_media()
Ricky WU <[email protected]>
misc: rtsx: judge ASPM Mode to set PETXCFG Reg
Qi Zheng <[email protected]>
binder: fix memory leak in binder_init()
Alvin Šipraga <[email protected]>
iio: adc: ina2xx: avoid NULL pointer dereference on OF device match
Yiyuan Guo <[email protected]>
iio: cros_ec: Fix the allocation size for cros_ec_command
Aleksa Sarai <[email protected]>
io_uring: correct check for O_TMPFILE
Ilya Leoshkevich <[email protected]>
selftests/bpf: Fix sk_assign on s390x
Yonghong Song <[email protected]>
selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code
Andrii Nakryiko <[email protected]>
selftests/bpf: make test_align selftest more robust
Andrii Nakryiko <[email protected]>
bpf: aggressively forget precise markings during state checkpointing
Andrii Nakryiko <[email protected]>
bpf: stop setting precise in current state
Andrii Nakryiko <[email protected]>
bpf: allow precision tracking for programs with subprogs
Ryusuke Konishi <[email protected]>
nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
Colin Ian King <[email protected]>
radix tree test suite: fix incorrect allocation size for pthreads
Tao Ren <[email protected]>
hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100
Melissa Wen <[email protected]>
drm/amd/display: check attr flag before set cursor degamma on DCN3+
Boris Brezillon <[email protected]>
drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()
Karol Herbst <[email protected]>
drm/nouveau/gr: enable memory loads on helper invocation on all channels
Andrea Parri <[email protected]>
riscv,mmio: Fix readX()-to-delay() ordering
Ilpo Järvinen <[email protected]>
dmaengine: pl330: Return DMA_PAUSED when transaction is paused
Maciej Żenczykowski <[email protected]>
ipv6: adjust ndisc_is_useropt() to also return true for PIO
Sergei Antonov <[email protected]>
mmc: moxart: read scr register without changing byte order
Jason A. Donenfeld <[email protected]>
wireguard: allowedips: expand maximum node depth
Namjae Jeon <[email protected]>
ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()
Long Li <[email protected]>
ksmbd: validate command request size
-------------
Diffstat:
Makefile | 4 +- arch/alpha/kernel/setup.c | 3 +- arch/riscv/include/asm/mmio.h | 16 +- arch/x86/entry/vdso/vma.c | 4 +- arch/x86/include/asm/processor.h | 2 + arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kernel/vmlinux.lds.S | 12 +- arch/x86/kvm/x86.c | 2 - drivers/android/binder.c | 1 + drivers/android/binder_alloc.c | 6 + drivers/android/binder_alloc.h | 1 + drivers/dma/mcf-edma.c | 13 +- drivers/dma/pl330.c | 18 +- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c | 7 +- drivers/gpu/drm/drm_gem_shmem_helper.c | 6 + drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c | 10 ++ drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c | 1 + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 17 +- drivers/hwmon/pmbus/bel-pfe.c | 16 +- drivers/iio/adc/ina2xx-adc.c | 9 +- .../common/cros_ec_sensors/cros_ec_sensors_core.c | 2 +- drivers/infiniband/core/umem.c | 3 +- drivers/infiniband/hw/hfi1/chip.c | 1 + drivers/isdn/mISDN/dsp.h | 2 +- drivers/isdn/mISDN/dsp_cmx.c | 2 +- drivers/isdn/mISDN/dsp_core.c | 2 +- drivers/misc/cardreader/rts5227.c | 2 +- drivers/misc/cardreader/rts5228.c | 18 -- drivers/misc/cardreader/rts5249.c | 3 +- drivers/misc/cardreader/rts5260.c | 18 -- drivers/misc/cardreader/rts5261.c | 18 -- drivers/misc/cardreader/rtsx_pcr.c | 5 +- drivers/mmc/host/moxart-mmc.c | 8 +- drivers/net/bonding/bond_main.c | 4 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 24 ++- drivers/net/ethernet/ibm/ibmvnic.c | 38 +++- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 5 +- drivers/net/ethernet/intel/iavf/iavf_fdir.c | 11 +- .../net/ethernet/mellanox/mlx5/core/lib/clock.c | 5 + drivers/net/ethernet/mellanox/mlx5/core/sriov.c | 3 +- drivers/net/phy/at803x.c | 2 - drivers/net/tun.c | 2 +- drivers/net/wireguard/allowedips.c | 8 +- drivers/net/wireguard/selftest/allowedips.c | 16 +- drivers/nvme/host/rdma.c | 3 +- drivers/nvme/host/tcp.c | 3 +- drivers/scsi/53c700.c | 2 +- drivers/scsi/fnic/fnic_scsi.c | 6 +- drivers/scsi/qedf/qedf_main.c | 18 ++ drivers/scsi/qedi/qedi_main.c | 18 ++ drivers/scsi/raid_class.c | 1 + drivers/scsi/scsi_proc.c | 30 ++-- drivers/scsi/snic/snic_disc.c | 1 + drivers/scsi/storvsc_drv.c | 4 - drivers/usb/common/usb-conn-gpio.c | 6 +- drivers/usb/dwc3/gadget.c | 9 +- drivers/usb/storage/alauda.c | 12 +- drivers/usb/typec/tcpm/tcpm.c | 7 + fs/btrfs/disk-io.c | 3 +- fs/btrfs/extent-tree.c | 5 +- fs/btrfs/extent_io.c | 7 +- fs/btrfs/relocation.c | 45 ++++- fs/btrfs/tree-checker.c | 14 ++ fs/ksmbd/smb2misc.c | 10 +- fs/ksmbd/smb2pdu.c | 9 +- fs/nilfs2/inode.c | 8 + fs/nilfs2/segment.c | 2 + fs/nilfs2/the_nilfs.h | 2 + include/linux/cpu.h | 2 + include/linux/skmsg.h | 1 + include/net/cfg80211.h | 3 + include/net/netfilter/nf_tables.h | 31 +++- io_uring/io_uring.c | 6 +- kernel/bpf/verifier.c | 199 +++++++++++++++++++-- kernel/softirq.c | 3 +- kernel/time/tick-sched.c | 36 +++- kernel/time/tick-sched.h | 4 + net/core/filter.c | 6 - net/core/skmsg.c | 10 +- net/core/sock_map.c | 10 +- net/dccp/output.c | 2 +- net/dccp/proto.c | 10 +- net/ipv4/ip_tunnel_core.c | 2 +- net/ipv4/nexthop.c | 28 +-- net/ipv6/ndisc.c | 3 +- net/netfilter/nf_tables_api.c | 168 ++++++++++------- net/netfilter/nft_flow_offload.c | 6 +- net/netfilter/nft_immediate.c | 8 +- net/netfilter/nft_objref.c | 8 +- net/netfilter/nft_set_hash.c | 2 - net/netfilter/nft_set_pipapo.c | 18 +- net/netfilter/nft_set_rbtree.c | 2 - net/packet/af_packet.c | 16 +- net/sched/sch_netem.c | 59 +++--- net/xdp/xsk.c | 1 + tools/testing/radix-tree/regression1.c | 2 +- tools/testing/selftests/bpf/prog_tests/align.c | 36 ++-- tools/testing/selftests/bpf/prog_tests/sk_assign.c | 25 ++- tools/testing/selftests/bpf/progs/connect4_prog.c | 2 +- tools/testing/selftests/bpf/progs/test_sk_assign.c | 11 ++ .../selftests/bpf/progs/test_sk_assign_libbpf.c | 3 + tools/testing/selftests/net/fib_nexthops.sh | 10 ++ tools/testing/selftests/net/forwarding/ethtool.sh | 2 + .../net/forwarding/ethtool_extended_state.sh | 2 + tools/testing/selftests/net/forwarding/lib.sh | 16 ++ tools/testing/selftests/net/forwarding/settings | 1 + .../testing/selftests/net/forwarding/tc_flower.sh | 8 +- tools/testing/selftests/rseq/Makefile | 4 +- tools/testing/selftests/rseq/rseq.c | 2 + 114 files changed, 946 insertions(+), 407 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/89 ksmbd: validate command request size
From: Long Li <[email protected]>
commit 5aa4fda5aa9c2a5a7bac67b4a12b089ab81fee3c upstream.
In commit 2b9b8f3b68ed ("ksmbd: validate command payload size"), except for SMB2_OPLOCK_BREAK_HE command, the request size of other commands is not checked, it's not expected. Fix it by add check for request size of other commands.
--- fs/ksmbd/smb2misc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
fs/ksmbd/smb2misc.c +5 -5
@@ -381,13 +381,13 @@ int ksmbd_smb2_check_message(struct ksmb }if (smb2_req_struct_sizes[command] != pdu->StructureSize2) { -if (command ==SMB2_OPLOCK_BREAK_HE && -le16_to_cpu (pdu->StructureSize2) !=OP_BREAK_STRUCT_SIZE_20 && -le16_to_cpu (pdu->StructureSize2) !=OP_BREAK_STRUCT_SIZE_21 ) { +if (!(command ==SMB2_OPLOCK_BREAK_HE && + (le16_to_cpu (pdu->StructureSize2) ==OP_BREAK_STRUCT_SIZE_20 || +le16_to_cpu (pdu->StructureSize2) ==OP_BREAK_STRUCT_SIZE_21 ))) {/* special case for SMB2.1 lease break message */ ksmbd_debug (SMB , -"Illegal request size %d for oplock break\n" , -le16_to_cpu (pdu->StructureSize2)); +"Illegal request size %u for command %d\n" , +le16_to_cpu (pdu->StructureSize2), command);return 1 ; } }
Greg Kroah-Hartman
maintainerPATCH 2/89 ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
commit 79ed288cef201f1f212dfb934bcaac75572fb8f6 upstream.
There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of current smb2_ea_info. ksmbd need to validate buffer length Before accessing the next ea. ksmbd should check buffer length using buf_len, not next variable. next is the start offset of current ea that got from previous ea.
--- fs/ksmbd/smb2pdu.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/ksmbd/smb2pdu.c +8 -1
@@ -2309,9 +2309,16 @@ next:break ; buf_len -= next; eabuf = (struct smb2_ea_info *)((char *)eabuf + next); -if (next < (u32 )eabuf->EaNameLength +le16_to_cpu (eabuf->EaValueLength)) +if (buf_len <sizeof (struct smb2_ea_info )) { + rc = -EINVAL ;break ; + } +if (buf_len <sizeof (struct smb2_ea_info ) + eabuf->EaNameLength + +le16_to_cpu (eabuf->EaValueLength)) { + rc = -EINVAL ; +break ; + } }while (next !=0 );kfree (attr_name);
Greg Kroah-Hartman
maintainerPATCH 3/89 wireguard: allowedips: expand maximum node depth
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit 46622219aae2b67813fe31a7b8cb7da5baff5c8a upstream.
In the allowedips self-test, nodes are inserted into the tree, but it generated an even amount of nodes, but for checking maximum node depth, there is of course the root node, which makes the total number necessarily odd. With two few nodes added, it never triggered the maximum depth check like it should have. So, add 129 nodes instead of 128 nodes, and do so with a more straightforward scheme, starting with all the bits set, and shifting over one each time. Then increase the maximum depth to 129, and choose a better name for that variable to make it clear that it represents depth as opposed to bits.
--- drivers/net/wireguard/allowedips.c | 8 ++++---- drivers/net/wireguard/selftest/allowedips.c | 16 ++++++++++------ 2 files changed, 14 insertions(+), 10 deletions(-)
drivers/net/wireguard/allowedips.c +4 -4
@@ -6,7 +6,7 @@#include "allowedips.h" #include "peer.h" -enum {MAX_ALLOWEDIPS_BITS =128 }; +enum {MAX_ALLOWEDIPS_DEPTH =129 };static struct kmem_cache *node_cache;
@@ -42,7 +42,7 @@ static void push_rcu(struct allowedips_n struct allowedips_node __rcu *p, unsigned int *len) { if (rcu_access_pointer(p)) { - if (WARN_ON(IS_ENABLED(DEBUG) && *len >= MAX_ALLOWEDIPS_BITS)) + if (WARN_ON(IS_ENABLED(DEBUG) && *len >= MAX_ALLOWEDIPS_DEPTH)) return; stack[(*len)++] =rcu_dereference_raw (p); }
@@ -55,7 +55,7 @@ static void node_free_rcu(struct rcu_heastatic void root_free_rcu (struct rcu_head *rcu) { -struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_BITS ] = { +struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_DEPTH ] = { container_of(rcu, struct allowedips_node, rcu) };unsigned int len =1 ;
@@ -68,7 +68,7 @@ static void root_free_rcu(struct rcu_heastatic void root_remove_peer_lists (struct allowedips_node *root) { -struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_BITS ] = { root }; +struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_DEPTH ] = { root };unsigned int len =1 ;while (len >0 && (node = stack[--len])) {
drivers/net/wireguard/selftest/allowedips.c +10 -6
@@ -593,16 +593,20 @@ bool __init wg_allowedips_selftest(void)wg_allowedips_remove_by_peer (&t, a, &mutex);test_negative (4 , a,192 ,168 ,0 ,1 ); -/* These will hit the WARN_ON(len >= MAX_ALLOWEDIPS_BITS) in free_node +/* These will hit the WARN_ON(len >= MAX_ALLOWEDIPS_DEPTH) in free_node * if something goes wrong. */ -for (i =0 ; i <MAX_ALLOWEDIPS_BITS ; ++i) { - part =cpu_to_be64 (~(1LLU << (i %64 ))); -memset (&ip,0xff ,16 ); -memcpy ((u8 *)&ip + (i <64 ) *8 , &part,8 ); +for (i =0 ; i <64 ; ++i) { + part =cpu_to_be64 (~0LLU << i); +memset (&ip,0xff ,8 ); +memcpy ((u8 *)&ip +8 , &part,8 ); +wg_allowedips_insert_v6 (&t, &ip,128 , a, &mutex); +memcpy (&ip, &part,8 ); +memset ((u8 *)&ip +8 ,0 ,8 );wg_allowedips_insert_v6 (&t, &ip,128 , a, &mutex); } - +memset (&ip,0 ,16 ); +wg_allowedips_insert_v6 (&t, &ip,128 , a, &mutex);wg_allowedips_free (&t, &mutex);wg_allowedips_init (&t);
Greg Kroah-Hartman
maintainerPATCH 4/89 mmc: moxart: read scr register without changing byte order
In reply to Greg Kroah-HartmanFrom: Sergei Antonov <[email protected]>
commit d44263222134b5635932974c6177a5cba65a07e8 upstream.
Conversion from big-endian to native is done in a common function mmc_app_send_scr(). Converting in moxart_transfer_pio() is extra. Double conversion on a LE system returns an incorrect SCR value, leads to errors:
mmc0: unrecognised SCR structure version 8
--- drivers/mmc/host/moxart-mmc.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/mmc/host/moxart-mmc.c +1 -7
@@ -338,13 +338,7 @@ static void moxart_transfer_pio(struct mreturn ; }for (len =0 ; len < remain && len < host->fifo_width;) { -/* SCR data must be read in big endian. */ -if (data->mrq->cmd->opcode ==SD_APP_SEND_SCR ) - *sgp =ioread32be (host->base + -REG_DATA_WINDOW ); -else - *sgp =ioread32 (host->base + -REG_DATA_WINDOW ); + *sgp =ioread32 (host->base +REG_DATA_WINDOW ); sgp++; len +=4 ; }
Greg Kroah-Hartman
maintainerPATCH 5/89 ipv6: adjust ndisc_is_useropt() to also return true for PIO
In reply to Greg Kroah-HartmanFrom: Maciej Żenczykowski <[email protected]>
commit 048c796beb6eb4fa3a5a647ee1c81f5c6f0f6a2a upstream.
The upcoming (and nearly finalized):
https://datatracker.ietf.org/doc/draft-collink-6man-pio-pflag/
will update the IPv6 RA to include a new flag in the PIO field, which will serve as a hint to perform DHCPv6-PD.
As we don't want DHCPv6 related logic inside the kernel, this piece of information needs to be exposed to userspace. The simplest option is to simply expose the entire PIO through the already existing mechanism.
Even without this new flag, the already existing PIO R (router address) flag (from RFC6275) cannot AFAICT be handled entirely in kernel, and provides useful information that should be exposed to userspace (the router's global address, for use by Mobile IPv6).
Also cc'ing stable@ for inclusion in LTS, as while technically this is not quite a bugfix, and instead more of a feature, it is absolutely trivial and the alternative is manually cherrypicking into all Android Common Kernel trees - and I know Greg will ask for it to be sent in via LTS instead...
--- net/ipv6/ndisc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/ndisc.c +2 -1
@@ -196,7 +196,8 @@ static struct nd_opt_hdr *ndisc_next_optstatic inline int ndisc_is_useropt (const struct net_device *dev,struct nd_opt_hdr *opt) { -return opt->nd_opt_type ==ND_OPT_RDNSS || +return opt->nd_opt_type ==ND_OPT_PREFIX_INFO || + opt->nd_opt_type ==ND_OPT_RDNSS || opt->nd_opt_type ==ND_OPT_DNSSL || opt->nd_opt_type ==ND_OPT_CAPTIVE_PORTAL || opt->nd_opt_type == ND_OPT_PREF64 ||
Greg Kroah-Hartman
maintainerPATCH 6/89 dmaengine: pl330: Return DMA_PAUSED when transaction is paused
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
commit 8cda3ececf07d374774f6a13e5a94bc2dc04c26c upstream.
pl330_pause() does not set anything to indicate paused condition which causes pl330_tx_status() to return DMA_IN_PROGRESS. This breaks 8250 DMA flush after the fix in commit 57e9af7831dc ("serial: 8250_dma: Fix DMA Rx rearm race"). The function comment for pl330_pause() claims pause is supported but resume is not which is enough for 8250 DMA flush to work as long as DMA status reports DMA_PAUSED when appropriate.
Add PAUSED state for descriptor and mark BUSY descriptors with PAUSED in pl330_pause(). Return DMA_PAUSED from pl330_tx_status() when the descriptor is PAUSED.
--- drivers/dma/pl330.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/dma/pl330.c +16 -2
@@ -404,6 +404,12 @@ enum desc_status {*/ BUSY ,/* +* Pause was called while descriptor was BUSY. Due to hardware +* limitations, only termination is possible for descriptors +* that have been paused. +*/ + PAUSED, +/* * Sitting on the channel work_list but xfer done * by PL330 core */
@@ -2041,7 +2047,7 @@ static inline void fill_queue(struct dmalist_for_each_entry (desc, &pch->work_list, node) {/* If already submitted */ -if (desc->status ==BUSY ) +if (desc->status ==BUSY || desc->status ==PAUSED )continue ; ret =pl330_submit_req (pch->thread, desc);
@@ -2326,6 +2332,7 @@ static int pl330_pause(struct dma_chan * {struct dma_pl330_chan *pch =to_pchan (chan);struct pl330_dmac *pl330 = pch->dmac; +struct dma_pl330_desc *desc;unsigned long flags;pm_runtime_get_sync (pl330->ddma.dev);
@@ -2335,6 +2342,10 @@ static int pl330_pause(struct dma_chan *_stop (pch->thread);spin_unlock (&pl330->lock); +list_for_each_entry (desc, &pch->work_list, node) { +if (desc->status ==BUSY ) + desc->status =PAUSED ; + }spin_unlock_irqrestore (&pch->lock, flags);pm_runtime_mark_last_busy (pl330->ddma.dev);pm_runtime_put_autosuspend (pl330->ddma.dev);
@@ -2425,7 +2436,7 @@ pl330_tx_status(struct dma_chan *chan, delse if (running && desc == running) transferred =pl330_get_current_xferred_count (pch, desc); -else if (desc->status ==BUSY ) +else if (desc->status ==BUSY || desc->status ==PAUSED )/* * Busy but not running means either just enqueued, * or finished and not yet marked done
@@ -2442,6 +2453,9 @@ pl330_tx_status(struct dma_chan *chan, dcase DONE : ret =DMA_COMPLETE ;break ; +case PAUSED : + ret =DMA_PAUSED ; +break ;case PREP :case BUSY : ret =DMA_IN_PROGRESS ;
Greg Kroah-Hartman
maintainerPATCH 7/89 riscv,mmio: Fix readX()-to-delay() ordering
In reply to Greg Kroah-HartmanFrom: Andrea Parri <[email protected]>
commit 4eb2eb1b4c0eb07793c240744843498564a67b83 upstream.
Section 2.1 of the Platform Specification [1] states:
Unless otherwise specified by a given I/O device, I/O devices are on ordering channel 0 (i.e., they are point-to-point strongly ordered).
which is not sufficient to guarantee that a readX() by a hart completes before a subsequent delay() on the same hart (cf. memory-barriers.txt, "Kernel I/O barrier effects").
Set the I(nput) bit in __io_ar() to restore the ordering, align inline comments.
[1] https://github.com/riscv/riscv-platform-specs
--- arch/riscv/include/asm/mmio.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/riscv/include/asm/mmio.h +8 -8
@@ -101,9 +101,9 @@ static inline u64 __raw_readq(const vola* Relaxed I/O memory access primitives. These follow the Device memory * ordering rules but do not guarantee any ordering relative to Normal memory * accesses. These are defined to order the indicated access (either a read or -* write) with all other I/O memory accesses. Since the platform specification -* defines that all I/O regions are strongly ordered on channel 2, no explicit -* fences are required to enforce this ordering. +* write) with all other I/O memory accesses to the same peripheral. Since the +* platform specification defines that all I/O regions are strongly ordered on +* channel 0, no explicit fences are required to enforce this ordering. */ /* FIXME: These are now the same as asm-generic */ #define __io_rbr () do {} while (0)
@@ -125,14 +125,14 @@ static inline u64 __raw_readq(const vola#endif /* -* I/O memory access primitives. Reads are ordered relative to any -* following Normal memory access. Writes are ordered relative to any prior -* Normal memory access. The memory barriers here are necessary as RISC-V +* I/O memory access primitives. Reads are ordered relative to any following +* Normal memory read and delay() loop. Writes are ordered relative to any +* prior Normal memory write. The memory barriers here are necessary as RISC-V * doesn't define any ordering between the memory space and the I/O space. */ #define __io_br () do {} while (0) -#define __io_ar (v) __asm__ __volatile__ ("fence i,r" : : : "memory") -#define __io_bw () __asm__ __volatile__ ("fence w,o" : : : "memory") +#define __io_ar (v) ({ __asm__ __volatile__ ("fence i,ir" : : : "memory"); }) +#define __io_bw () ({ __asm__ __volatile__ ("fence w,o" : : : "memory"); })#define __io_aw () mmiowb_set_pending()#define readb (c) ({ u8 __v; __io_br(); __v = readb_cpu(c); __io_ar(__v); __v; })
Greg Kroah-Hartman
maintainerPATCH 8/89 drm/nouveau/gr: enable memory loads on helper invocation on all channels
In reply to Greg Kroah-HartmanFrom: Karol Herbst <[email protected]>
commit 1cb9e2ef66d53b020842b18762e30d0eb4384de8 upstream.
We have a lurking bug where Fragment Shader Helper Invocations can't load from memory. But this is actually required in OpenGL and is causing random hangs or failures in random shaders.
It is unknown how widespread this issue is, but shaders hitting this can end up with infinite loops.
We enable those only on all Kepler and newer GPUs where we use our own Firmware.
Nvidia's firmware provides a way to set a kernelspace controlled list of mmio registers in the gr space from push buffers via MME macros.
v2: drop code for gm200 and newer.
--- drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c | 4 +++- drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c | 10 ++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c | 1 + 6 files changed, 17 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h +1 -0
@@ -123,6 +123,7 @@ void gk104_grctx_generate_r418800(structextern const struct gf100_grctx_func gk110_grctx;void gk110_grctx_generate_r419eb0 (struct gf100_gr *); +void gk110_grctx_generate_r419f78 (struct gf100_gr *);extern const struct gf100_grctx_func gk110b_grctx;extern const struct gf100_grctx_func gk208_grctx;
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c +3 -1
@@ -916,7 +916,9 @@ static void gk104_grctx_generate_r419f78(struct gf100_gr *gr) {struct nvkm_device *device = gr->base.engine.subdev.device; -nvkm_mask (device,0x419f78 ,0x00000001 ,0x00000000 ); + +/* bit 3 set disables loads in fp helper invocations, we need it enabled */ +nvkm_mask (device,0x419f78 ,0x00000009 ,0x00000000 ); }void
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c +10 -0
@@ -820,6 +820,15 @@ gk110_grctx_generate_r419eb0(struct gf10nvkm_mask (device,0x419eb0 ,0x00001000 ,0x00001000 ); } +void +gk110_grctx_generate_r419f78 (struct gf100_gr *gr) +{ +struct nvkm_device *device = gr->base.engine.subdev.device; + +/* bit 3 set disables loads in fp helper invocations, we need it enabled */ +nvkm_mask (device,0x419f78 ,0x00000008 ,0x00000000 ); +} +const struct gf100_grctx_func gk110_grctx = { .main = gf100_grctx_generate_main,
@@ -852,4 +861,5 @@ gk110_grctx = { .gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr, .r418800 = gk104_grctx_generate_r418800, .r419eb0 = gk110_grctx_generate_r419eb0, + .r419f78 = gk110_grctx_generate_r419f78, };
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c +1 -0
@@ -101,4 +101,5 @@ gk110b_grctx = { .gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr, .r418800 = gk104_grctx_generate_r418800, .r419eb0 = gk110_grctx_generate_r419eb0, + .r419f78 = gk110_grctx_generate_r419f78, };
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c +1 -0
@@ -566,4 +566,5 @@ gk208_grctx = { .dist_skip_table = gf117_grctx_generate_dist_skip_table, .gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr, .r418800 = gk104_grctx_generate_r418800, + .r419f78 = gk110_grctx_generate_r419f78, };
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c +1 -0
@@ -991,4 +991,5 @@ gm107_grctx = { .r406500 = gm107_grctx_generate_r406500, .gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr, .r419e00 = gm107_grctx_generate_r419e00, + .r419f78 = gk110_grctx_generate_r419f78, };
Greg Kroah-Hartman
maintainerPATCH 9/89 drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()
In reply to Greg Kroah-HartmanFrom: Boris Brezillon <[email protected]>
commit 07dd476f6116966cb2006e25fdcf48f0715115ff upstream.
The dma-buf backend is supposed to provide its own vm_ops, but some implementation just have nothing special to do and leave vm_ops untouched, probably expecting this field to be zero initialized (this is the case with the system_heap implementation for instance). Let's reset vma->vm_ops to NULL to keep things working with these implementations.
--- drivers/gpu/drm/drm_gem_shmem_helper.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_gem_shmem_helper.c +6 -0
@@ -591,7 +591,13 @@ int drm_gem_shmem_mmap(struct drm_gem_shint ret;if (obj->import_attach) { +/* Reset both vm_ops and vm_private_data, so we don't end up with +* vm_ops pointing to our implementation if the dma-buf backend +* doesn't set those fields. +*/ vma->vm_private_data =NULL ; + vma->vm_ops =NULL ; + ret =dma_buf_mmap (obj->dma_buf, vma,0 );/* Drop the reference drm_gem_mmap_obj() acquired.*/
Greg Kroah-Hartman
maintainerPATCH 10/89 drm/amd/display: check attr flag before set cursor degamma on DCN3+
In reply to Greg Kroah-HartmanFrom: Melissa Wen <[email protected]>
commit 96b020e2163fb2197266b2f71b1007495206e6bb upstream.
Don't set predefined degamma curve to cursor plane if the cursor attribute flag is not set. Applying a degamma curve to the cursor by default breaks userspace expectation. Checking the flag before performing any color transformation prevents too dark cursor gamma in DCN3+ on many Linux desktop environment (KDE Plasma, GNOME, wlroots-based, etc.) as reported at:
- https://gitlab.freedesktop.org/drm/amd/-/issues/1513
This is the same approach followed by DCN2 drivers where the issue is not present.
--- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c +5 -2
@@ -355,8 +355,11 @@ void dpp3_set_cursor_attributes(int cur_rom_en =0 ;if (color_format ==CURSOR_MODE_COLOR_PRE_MULTIPLIED_ALPHA || - color_format ==CURSOR_MODE_COLOR_UN_PRE_MULTIPLIED_ALPHA ) - cur_rom_en =1 ; + color_format ==CURSOR_MODE_COLOR_UN_PRE_MULTIPLIED_ALPHA ) { +if (cursor_attributes->attribute_flags.bits.ENABLE_CURSOR_DEGAMMA) { + cur_rom_en =1 ; + } + } REG_UPDATE_3(CURSOR0_CONTROL, CUR0_MODE, color_format,
Greg Kroah-Hartman
maintainerPATCH 11/89 hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100
In reply to Greg Kroah-HartmanFrom: Tao Ren <[email protected]>
commit f38963b9cd0645a336cf30c5da2e89e34e34fec3 upstream.
Skip status check for both pfe1100 and pfe3000 because the communication error is also observed on pfe1100 devices.
--- drivers/hwmon/pmbus/bel-pfe.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/hwmon/pmbus/bel-pfe.c +8 -8
@@ -17,12 +17,13 @@enum chips {pfe1100, pfe3000};/* -* Disable status check for pfe3000 devices, because some devices report -* communication error (invalid command) for VOUT_MODE command (0x20) -* although correct VOUT_MODE (0x16) is returned: it leads to incorrect -* exponent in linear mode. +* Disable status check because some devices report communication error +* (invalid command) for VOUT_MODE command (0x20) although the correct +* VOUT_MODE (0x16) is returned: it leads to incorrect exponent in linear +* mode. +* This affects both pfe3000 and pfe1100. */ -static struct pmbus_platform_data pfe3000_plat_data = { +static struct pmbus_platform_data pfe_plat_data = { .flags =PMBUS_SKIP_STATUS_CHECK , };
@@ -94,16 +95,15 @@ static int pfe_pmbus_probe(struct i2c_clint model; model = (int )i2c_match_id (pfe_device_id, client)->driver_data; + client->dev.platform_data = &pfe_plat_data;/* * PFE3000-12-069RA devices may not stay in page 0 during device * probe which leads to probe failure (read status word failed). * So let's set the device to page 0 at the beginning. */ -if (model == pfe3000) { - client->dev.platform_data = &pfe3000_plat_data; +if (model == pfe3000)i2c_smbus_write_byte_data (client,PMBUS_PAGE ,0 ); - }return pmbus_do_probe (client, &pfe_driver_info[model]); }
Greg Kroah-Hartman
maintainerPATCH 12/89 radix tree test suite: fix incorrect allocation size for pthreads
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit cac7ea57a06016e4914848b707477fb07ee4ae1c upstream.
Currently the pthread allocation for each array item is based on the size of a pthread_t pointer and should be the size of the pthread_t structure, so the allocation is under-allocating the correct size. Fix this by using the size of each element in the pthreads array.
Static analysis cppcheck reported:tools/testing/radix-tree/regression1.c:180:2: warning: Size of pointer 'threads' used instead of size of its data. [pointerSize]
--- tools/testing/radix-tree/regression1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/radix-tree/regression1.c +1 -1
@@ -177,7 +177,7 @@ void regression1_test(void) nr_threads =2 ;pthread_barrier_init (&worker_barrier,NULL , nr_threads); - threads =malloc (nr_threads *sizeof (pthread_t *)); + threads =malloc (nr_threads *sizeof (*threads));for (i =0 ; i < nr_threads; i++) { arg = i;
Greg Kroah-Hartman
maintainerPATCH 13/89 nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit f8654743a0e6909dc634cbfad6db6816f10f3399 upstream.
During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). Previously, nilfs_evict_inode() could cause use-after-free read for nilfs_root if inodes are left in "garbage_list" and released by nilfs_dispose_list at the end of nilfs_detach_log_writer(), and this bug was fixed by commit 9b5a04ac3ad9 ("nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()").
However, it turned out that there is another possibility of UAF in the call path where mark_inode_dirty_sync() is called from iput():
nilfs_detach_log_writer()
nilfs_dispose_list()
iput()
mark_inode_dirty_sync()
__mark_inode_dirty()
nilfs_dirty_inode()
__nilfs_mark_inode_dirty()
nilfs_load_inode_block() --> causes UAF of nilfs_root structThis can happen after commit 0ae45f63d4ef ("vfs: add support for a lazytime mount option"), which changed iput() to call mark_inode_dirty_sync() on its final reference if i_state has I_DIRTY_TIME flag and i_nlink is non-zero.
This issue appears after commit 28a65b49eb53 ("nilfs2: do not write dirty data after degenerating to read-only") when using the syzbot reproducer, but the issue has potentially existed before.
Fix this issue by adding a "purging flag" to the nilfs structure, setting that flag while disposing the "garbage_list" and checking it in __nilfs_mark_inode_dirty().
Unlike commit 9b5a04ac3ad9 ("nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()"), this patch does not rely on ns_writer to determine whether to skip operations, so as not to break recovery on mount. The nilfs_salvage_orphan_logs routine dirties the buffer of salvaged data before attaching the log writer, so changing __nilfs_mark_inode_dirty() to skip the operation when ns_writer is NULL will cause recovery write to fail. The purpose of using the cleanup-only flag is to allow for narrowing of such conditions.
--- fs/nilfs2/inode.c | 8 ++++++++ fs/nilfs2/segment.c | 2 ++ fs/nilfs2/the_nilfs.h | 2 ++ 3 files changed, 12 insertions(+)
fs/nilfs2/inode.c +8 -0
@@ -1105,9 +1105,17 @@ int nilfs_set_file_dirty(struct inode *iint __nilfs_mark_inode_dirty (struct inode *inode,int flags) { +struct the_nilfs *nilfs = inode->i_sb->s_fs_info;struct buffer_head *ibh;int err; +/* +* Do not dirty inodes after the log writer has been detached +* and its nilfs_root struct has been freed. +*/ +if (unlikely (nilfs_purging (nilfs))) +return 0 ; + err =nilfs_load_inode_block (inode, &ibh);if (unlikely (err)) { nilfs_warn(inode->i_sb,
fs/nilfs2/segment.c +2 -0
@@ -2845,6 +2845,7 @@ void nilfs_detach_log_writer(struct supenilfs_segctor_destroy (nilfs->ns_writer); nilfs->ns_writer =NULL ; } +set_nilfs_purging (nilfs);/* Force to free the list of dirty files */ spin_lock (&nilfs->ns_inode_lock);
@@ -2857,4 +2858,5 @@ void nilfs_detach_log_writer(struct supeup_write (&nilfs->ns_segctor_sem);nilfs_dispose_list (nilfs, &garbage_list,1 ); +clear_nilfs_purging (nilfs); }
fs/nilfs2/the_nilfs.h +2 -0
@@ -29,6 +29,7 @@ enum {THE_NILFS_DISCONTINUED ,/* 'next' pointer chain has broken */ THE_NILFS_GC_RUNNING ,/* gc process is running */ THE_NILFS_SB_DIRTY ,/* super block is dirty */ + THE_NILFS_PURGING, /* disposing dirty files for cleanup */ };/**
@@ -208,6 +209,7 @@ THE_NILFS_FNS(INIT, init) THE_NILFS_FNS(DISCONTINUED, discontinued) THE_NILFS_FNS(GC_RUNNING, gc_running) THE_NILFS_FNS(SB_DIRTY, sb_dirty) +THE_NILFS_FNS (PURGING , purging)/* * Mount option operations
Greg Kroah-Hartman
maintainerPATCH 14/89 bpf: allow precision tracking for programs with subprogs
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit be2ef8161572ec1973124ebc50f56dafc2925e07 ]
Stop forcing precise=true for SCALAR registers when BPF program has any subprograms. Current restriction means that any BPF program, as soon as it uses subprograms, will end up not getting any of the precision tracking benefits in reduction of number of verified states.
This patch keeps the fallback mark_all_scalars_precise() behavior if precise marking has to cross function frames. E.g., if subprogram requires R1 (first input arg) to be marked precise, ideally we'd need to backtrack to the parent function and keep marking R1 and its dependencies as precise. But right now we give up and force all the SCALARs in any of the current and parent states to be forced to precise=true. We can lift that restriction in the future.
But this patch fixes two issues identified when trying to enable precision tracking for subprogs.
First, prevent "escaping" from top-most state in a global subprog. While with entry-level BPF program we never end up requesting precision for R1-R5 registers, because R2-R5 are not initialized (and so not readable in correct BPF program), and R1 is PTR_TO_CTX, not SCALAR, and so is implicitly precise. With global subprogs, though, it's different, as global subprog a) can have up to 5 SCALAR input arguments, which might get marked as precise=true and b) it is validated in isolation from its main entry BPF program. b) means that we can end up exhausting parent state chain and still not mark all registers in reg_mask as precise, which would lead to verifier bug warning.
To handle that, we need to consider two cases. First, if the very first state is not immediately "checkpointed" (i.e., stored in state lookup hashtable), it will get correct first_insn_idx and last_insn_idx instruction set during state checkpointing. As such, this case is already handled and __mark_chain_precision() already handles that by just doing nothing when we reach to the very first parent state. st->parent will be NULL and we'll just stop. Perhaps some extra check for reg_mask and stack_mask is due here, but this patch doesn't address that issue.
More problematic second case is when global function's initial state is immediately checkpointed before we manage to process the very first instruction. This is happening because when there is a call to global subprog from the main program the very first subprog's instruction is marked as pruning point, so before we manage to process first instruction we have to check and checkpoint state. This patch adds a special handling for such "empty" state, which is identified by having st->last_insn_idx set to -1. In such case, we check that we are indeed validating global subprog, and with some sanity checking we mark input args as precise if requested.
Note that we also initialize state->first_insn_idx with correct start insn_idx offset. For main program zero is correct value, but for any subprog it's quite confusing to not have first_insn_idx set. This doesn't have any functional impact, but helps with debugging and state printing. We also explicitly initialize state->last_insns_idx instead of relying on is_state_visited() to do this with env->prev_insns_idx, which will be -1 on the very first instruction. This concludes necessary changes to handle specifically global subprog's precision tracking.
Second identified problem was missed handling of BPF helper functions that call into subprogs (e.g., bpf_loop and few others). From precision tracking and backtracking logic's standpoint those are effectively calls into subprogs and should be called as BPF_PSEUDO_CALL calls.
This patch takes the least intrusive way and just checks against a short list of current BPF helpers that do call subprogs, encapsulated in is_callback_calling_function() function. But to prevent accidentally forgetting to add new BPF helpers to this "list", we also do a sanity check in __check_func_call, which has to be called for each such special BPF helper, to validate that BPF helper is indeed recognized as callback-calling one. This should catch any missed checks in the future. Adding some special flags to be added in function proto definitions seemed like an overkill in this case.
With the above changes, it's possible to remove forceful setting of reg->precise to true in __mark_reg_unknown, which turns on precision tracking both inside subprogs and entry progs that have subprogs. No warnings or errors were detected across all the selftests, but also when validating with veristat against internal Meta BPF objects and Cilium objects. Further, in some BPF programs there are noticeable reduction in number of states and instructions validated due to more effective precision tracking, especially benefiting syncookie test.
$ ./veristat -C -e file,prog,insns,states ~/baseline-results.csv ~/subprog-precise-results.csv | grep -v '+0' File Program Total insns (A) Total insns (B) Total insns (DIFF) Total states (A) Total states (B) Total states (DIFF) ---------------------------------------- -------------------------- --------------- --------------- ------------------ ---------------- ---------------- ------------------- pyperf600_bpf_loop.bpf.linked1.o on_event 3966 3678 -288 (-7.26%) 306 276 -30 (-9.80%) pyperf_global.bpf.linked1.o on_event 7563 7530 -33 (-0.44%) 520 517 -3 (-0.58%) pyperf_subprogs.bpf.linked1.o on_event 36358 36934 +576 (+1.58%) 2499 2531 +32 (+1.28%) setget_sockopt.bpf.linked1.o skops_sockopt 3965 4038 +73 (+1.84%) 343 347 +4 (+1.17%) test_cls_redirect_subprogs.bpf.linked1.o cls_redirect 64965 64901 -64 (-0.10%) 4619 4612 -7 (-0.15%) test_misc_tcp_hdr_options.bpf.linked1.o misc_estab 1491 1307 -184 (-12.34%) 110 100 -10 (-9.09%) test_pkt_access.bpf.linked1.o test_pkt_access 354 349 -5 (-1.41%) 25 24 -1 (-4.00%) test_sock_fields.bpf.linked1.o egress_read_sock_fields 435 375 -60 (-13.79%) 22 20 -2 (-9.09%) test_sysctl_loop2.bpf.linked1.o sysctl_tcp_mem 1508 1501 -7 (-0.46%) 29 28 -1 (-3.45%) test_tc_dtime.bpf.linked1.o egress_fwdns_prio100 468 435 -33 (-7.05%) 45 41 -4 (-8.89%) test_tc_dtime.bpf.linked1.o ingress_fwdns_prio100 398 408 +10 (+2.51%) 42 39 -3 (-7.14%) test_tc_dtime.bpf.linked1.o ingress_fwdns_prio101 1096 842 -254 (-23.18%) 97 73 -24 (-24.74%) test_tcp_hdr_options.bpf.linked1.o estab 2758 2408 -350 (-12.69%) 208 181 -27 (-12.98%) test_urandom_usdt.bpf.linked1.o urand_read_with_sema 466 448 -18 (-3.86%) 31 28 -3 (-9.68%) test_urandom_usdt.bpf.linked1.o urand_read_without_sema 466 448 -18 (-3.86%) 31 28 -3 (-9.68%) test_urandom_usdt.bpf.linked1.o urandlib_read_with_sema 466 448 -18 (-3.86%) 31 28 -3 (-9.68%) test_urandom_usdt.bpf.linked1.o urandlib_read_without_sema 466 448 -18 (-3.86%) 31 28 -3 (-9.68%) test_xdp_noinline.bpf.linked1.o balancer_ingress_v6 4302 4294 -8 (-0.19%) 257 256 -1 (-0.39%) xdp_synproxy_kern.bpf.linked1.o syncookie_tc 583722 405757 -177965 (-30.49%) 35846 25735 -10111 (-28.21%) xdp_synproxy_kern.bpf.linked1.o syncookie_xdp 609123 479055 -130068 (-21.35%) 35452 29145 -6307 (-17.79%) ---------------------------------------- -------------------------- --------------- --------------- ------------------ ---------------- ---------------- -------------------
Stable-dep-of: ecdf985d7615 ("bpf: track immediate values written to stack by BPF_ST instruction")
--- kernel/bpf/verifier.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 58 insertions(+), 1 deletion(-)
kernel/bpf/verifier.c +58 -1
@@ -517,6 +517,12 @@ static bool is_ptr_cast_function(enum bp func_id == BPF_FUNC_skc_to_tcp_request_sock; } +static bool is_callback_calling_function (enum bpf_func_id func_id) +{ +return func_id == BPF_FUNC_for_each_map_elem || + func_id == BPF_FUNC_timer_set_callback; +} +static bool is_cmpxchg_insn (const struct bpf_insn *insn) { return BPF_CLASS(insn->code) == BPF_STX &&
@@ -1446,7 +1452,7 @@ static void __mark_reg_unknown(const str reg->type =SCALAR_VALUE ; reg->var_off = tnum_unknown; reg->frameno =0 ; - reg->precise = env->subprog_cnt >1 || !env->bpf_capable; + reg->precise = !env->bpf_capable;__mark_reg_unbounded (reg); }
@@ -2267,6 +2273,11 @@ static int backtrack_insn(struct bpf_ver*/ if (insn->src_reg ==BPF_PSEUDO_KFUNC_CALL && insn->imm ==0 )return -ENOTSUPP ; +/* BPF helpers that invoke callback subprogs are +* equivalent to BPF_PSEUDO_CALL above +*/ +if (insn->src_reg ==0 &&is_callback_calling_function (insn->imm)) +return -ENOTSUPP ;/* regular helper call sets R0 */ *reg_mask &= ~1 ;if (*reg_mask &0x3f ) {
@@ -2445,12 +2456,42 @@ static int __mark_chain_precision(structreturn 0 ;if (!reg_mask && !stack_mask)return 0 ; +for (;;) {DECLARE_BITMAP (mask,64 );u32 history = st->jmp_history_cnt;if (env->log.level &BPF_LOG_LEVEL )verbose (env,"last_idx %d first_idx %d\n" , last_idx, first_idx); + +if (last_idx <0 ) { +/* we are at the entry into subprog, which +* is expected for global funcs, but only if +* requested precise registers are R1-R5 +* (which are global func's input arguments) +*/ +if (st->curframe ==0 && + st->frame[0 ]->subprogno >0 && + st->frame[0 ]->callsite ==BPF_MAIN_FUNC && + stack_mask ==0 && (reg_mask & ~0x3e ) ==0 ) { +bitmap_from_u64 (mask, reg_mask); +for_each_set_bit (i, mask,32 ) { + reg = &st->frame[0 ]->regs[i]; +if (reg->type !=SCALAR_VALUE ) { + reg_mask &= ~(1u << i); +continue ; + } + reg->precise = true; + } +return 0 ; + } + +verbose (env,"BUG backtracing func entry subprog %d reg_mask %x stack_mask %llx\n" , + st->frame[0 ]->subprogno, reg_mask, stack_mask); +WARN_ONCE (1 ,"verifier backtracking bug" ); +return -EFAULT ; + } +for (i = last_idx;;) {if (skip_first) { err =0 ;
@@ -5806,6 +5847,10 @@ typedef int (*set_callee_state_fn)(strucstruct bpf_func_state *callee, int insn_idx); +static int set_callee_state (struct bpf_verifier_env *env, +struct bpf_func_state *caller, +struct bpf_func_state *callee,int insn_idx); +static int __check_func_call (struct bpf_verifier_env *env,struct bpf_insn *insn,int *insn_idx,int subprog,set_callee_state_fn set_callee_state_cb)
@@ -5856,6 +5901,16 @@ static int __check_func_call(struct bpf_ } } +/* set_callee_state is used for direct subprog calls, but we are +* interested in validating only BPF helpers that can call subprogs as +* callbacks +*/ +if (set_callee_state_cb != set_callee_state && !is_callback_calling_function (insn->imm)) { +verbose (env,"verifier bug: helper %s#%d is not marked as callback-calling\n" , +func_id_name (insn->imm), insn->imm); +return -EFAULT ; + } +if (insn->code == (BPF_JMP |BPF_CALL ) && insn->src_reg ==0 && insn->imm == BPF_FUNC_timer_set_callback) {
@@ -13209,6 +13264,8 @@ static int do_check_common(struct bpf_veBPF_MAIN_FUNC /* callsite */ ,0 /* frameno */ , subprog); + state->first_insn_idx = env->subprog_info[subprog].start; + state->last_insn_idx =-1 ; regs = state->frame[state->curframe]->regs;if (subprog || env->prog->type ==BPF_PROG_TYPE_EXT ) {
Greg Kroah-Hartman
maintainerPATCH 15/89 bpf: stop setting precise in current state
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit f63181b6ae79fd3b034cde641db774268c2c3acf ]
Setting reg->precise to true in current state is not necessary from correctness standpoint, but it does pessimise the whole precision (or rather "imprecision", because that's what we want to keep as much as possible) tracking. Why is somewhat subtle and my best attempt to explain this is recorded in an extensive comment for __mark_chain_precise() function. Some more careful thinking and code reading is probably required still to grok this completely, unfortunately. Whiteboarding and a bunch of extra handwaiving in person would be even more helpful, but is deemed impractical in Git commit.
Next patch pushes this imprecision property even further, building on top of the insights described in this patch.
End results are pretty nice, we get reduction in number of total instructions and states verified due to a better states reuse, as some of the states are now more generic and permissive due to less unnecessary precise=true requirements.
SELFTESTS RESULTS
=================
$ ./veristat -C -e file,prog,insns,states ~/subprog-precise-results.csv ~/imprecise-early-results.csv | grep -v '+0' File Program Total insns (A) Total insns (B) Total insns (DIFF) Total states (A) Total states (B) Total states (DIFF) --------------------------------------- ---------------------- --------------- --------------- ------------------ ---------------- ---------------- ------------------- bpf_iter_ksym.bpf.linked1.o dump_ksym 347 285 -62 (-17.87%) 20 19 -1 (-5.00%) pyperf600_bpf_loop.bpf.linked1.o on_event 3678 3736 +58 (+1.58%) 276 285 +9 (+3.26%) setget_sockopt.bpf.linked1.o skops_sockopt 4038 3947 -91 (-2.25%) 347 343 -4 (-1.15%) test_l4lb.bpf.linked1.o balancer_ingress 4559 2611 -1948 (-42.73%) 118 105 -13 (-11.02%) test_l4lb_noinline.bpf.linked1.o balancer_ingress 6279 6268 -11 (-0.18%) 237 236 -1 (-0.42%) test_misc_tcp_hdr_options.bpf.linked1.o misc_estab 1307 1303 -4 (-0.31%) 100 99 -1 (-1.00%) test_sk_lookup.bpf.linked1.o ctx_narrow_access 456 447 -9 (-1.97%) 39 38 -1 (-2.56%) test_sysctl_loop1.bpf.linked1.o sysctl_tcp_mem 1389 1384 -5 (-0.36%) 26 25 -1 (-3.85%) test_tc_dtime.bpf.linked1.o egress_fwdns_prio101 518 485 -33 (-6.37%) 51 46 -5 (-9.80%) test_tc_dtime.bpf.linked1.o egress_host 519 468 -51 (-9.83%) 50 44 -6 (-12.00%) test_tc_dtime.bpf.linked1.o ingress_fwdns_prio101 842 1000 +158 (+18.76%) 73 88 +15 (+20.55%) xdp_synproxy_kern.bpf.linked1.o syncookie_tc 405757 373173 -32584 (-8.03%) 25735 22882 -2853 (-11.09%) xdp_synproxy_kern.bpf.linked1.o syncookie_xdp 479055 371590 -107465 (-22.43%) 29145 22207 -6938 (-23.81%) --------------------------------------- ---------------------- --------------- --------------- ------------------ ---------------- ---------------- -------------------
Slight regression in test_tc_dtime.bpf.linked1.o/ingress_fwdns_prio101 is left for a follow up, there might be some more precision-related bugs in existing BPF verifier logic.
CILIUM RESULTS
==============
$ ./veristat -C -e file,prog,insns,states ~/subprog-precise-results-cilium.csv ~/imprecise-early-results-cilium.csv | grep -v '+0' File Program Total insns (A) Total insns (B) Total insns (DIFF) Total states (A) Total states (B) Total states (DIFF) ------------- ------------------------------ --------------- --------------- ------------------ ---------------- ---------------- ------------------- bpf_host.o cil_from_host 762 556 -206 (-27.03%) 43 37 -6 (-13.95%) bpf_host.o tail_handle_nat_fwd_ipv4 23541 23426 -115 (-0.49%) 1538 1537 -1 (-0.07%) bpf_host.o tail_nodeport_nat_egress_ipv4 33592 33566 -26 (-0.08%) 2163 2161 -2 (-0.09%) bpf_lxc.o tail_handle_nat_fwd_ipv4 23541 23426 -115 (-0.49%) 1538 1537 -1 (-0.07%) bpf_overlay.o tail_nodeport_nat_egress_ipv4 33581 33543 -38 (-0.11%) 2160 2157 -3 (-0.14%) bpf_xdp.o tail_handle_nat_fwd_ipv4 21659 20920 -739 (-3.41%) 1440 1376 -64 (-4.44%) bpf_xdp.o tail_handle_nat_fwd_ipv6 17084 17039 -45 (-0.26%) 907 905 -2 (-0.22%) bpf_xdp.o tail_lb_ipv4 73442 73430 -12 (-0.02%) 4370 4369 -1 (-0.02%) bpf_xdp.o tail_lb_ipv6 152114 151895 -219 (-0.14%) 6493 6479 -14 (-0.22%) bpf_xdp.o tail_nodeport_nat_egress_ipv4 17377 17200 -177 (-1.02%) 1125 1111 -14 (-1.24%) bpf_xdp.o tail_nodeport_nat_ingress_ipv6 6405 6397 -8 (-0.12%) 309 308 -1 (-0.32%) bpf_xdp.o tail_rev_nodeport_lb4 7126 6934 -192 (-2.69%) 414 402 -12 (-2.90%) bpf_xdp.o tail_rev_nodeport_lb6 18059 17905 -154 (-0.85%) 1105 1096 -9 (-0.81%) ------------- ------------------------------ --------------- --------------- ------------------ ---------------- ---------------- -------------------
Stable-dep-of: ecdf985d7615 ("bpf: track immediate values written to stack by BPF_ST instruction")
--- kernel/bpf/verifier.c | 103 ++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 91 insertions(+), 12 deletions(-)
kernel/bpf/verifier.c +91 -12
@@ -2382,8 +2382,11 @@ static void mark_all_scalars_precise(str/* big hammer: mark all scalars precise in this path. * pop_stack may still get !precise scalars. +* We also skip current state and go straight to first parent state, +* because precision markings in current non-checkpointed state are +* not needed. See why in the comment in __mark_chain_precision below. */ -for (; st; st = st->parent) +for (st = st->parent; st; st = st->parent) {for (i =0 ; i <= st->curframe; i++) { func = st->frame[i];for (j =0 ; j <BPF_REG_FP ; j++) {
@@ -2401,8 +2404,88 @@ static void mark_all_scalars_precise(str reg->precise = true; } } + } } +/* +* __mark_chain_precision() backtracks BPF program instruction sequence and +* chain of verifier states making sure that register *regno* (if regno >= 0) +* and/or stack slot *spi* (if spi >= 0) are marked as precisely tracked +* SCALARS, as well as any other registers and slots that contribute to +* a tracked state of given registers/stack slots, depending on specific BPF +* assembly instructions (see backtrack_insns() for exact instruction handling +* logic). This backtracking relies on recorded jmp_history and is able to +* traverse entire chain of parent states. This process ends only when all the +* necessary registers/slots and their transitive dependencies are marked as +* precise. +* +* One important and subtle aspect is that precise marks *do not matter* in +* the currently verified state (current state). It is important to understand +* why this is the case. +* +* First, note that current state is the state that is not yet "checkpointed", +* i.e., it is not yet put into env->explored_states, and it has no children +* states as well. It's ephemeral, and can end up either a) being discarded if +* compatible explored state is found at some point or BPF_EXIT instruction is +* reached or b) checkpointed and put into env->explored_states, branching out +* into one or more children states. +* +* In the former case, precise markings in current state are completely +* ignored by state comparison code (see regsafe() for details). Only +* checkpointed ("old") state precise markings are important, and if old +* state's register/slot is precise, regsafe() assumes current state's +* register/slot as precise and checks value ranges exactly and precisely. If +* states turn out to be compatible, current state's necessary precise +* markings and any required parent states' precise markings are enforced +* after the fact with propagate_precision() logic, after the fact. But it's +* important to realize that in this case, even after marking current state +* registers/slots as precise, we immediately discard current state. So what +* actually matters is any of the precise markings propagated into current +* state's parent states, which are always checkpointed (due to b) case above). +* As such, for scenario a) it doesn't matter if current state has precise +* markings set or not. +* +* Now, for the scenario b), checkpointing and forking into child(ren) +* state(s). Note that before current state gets to checkpointing step, any +* processed instruction always assumes precise SCALAR register/slot +* knowledge: if precise value or range is useful to prune jump branch, BPF +* verifier takes this opportunity enthusiastically. Similarly, when +* register's value is used to calculate offset or memory address, exact +* knowledge of SCALAR range is assumed, checked, and enforced. So, similar to +* what we mentioned above about state comparison ignoring precise markings +* during state comparison, BPF verifier ignores and also assumes precise +* markings *at will* during instruction verification process. But as verifier +* assumes precision, it also propagates any precision dependencies across +* parent states, which are not yet finalized, so can be further restricted +* based on new knowledge gained from restrictions enforced by their children +* states. This is so that once those parent states are finalized, i.e., when +* they have no more active children state, state comparison logic in +* is_state_visited() would enforce strict and precise SCALAR ranges, if +* required for correctness. +* +* To build a bit more intuition, note also that once a state is checkpointed, +* the path we took to get to that state is not important. This is crucial +* property for state pruning. When state is checkpointed and finalized at +* some instruction index, it can be correctly and safely used to "short +* circuit" any *compatible* state that reaches exactly the same instruction +* index. I.e., if we jumped to that instruction from a completely different +* code path than original finalized state was derived from, it doesn't +* matter, current state can be discarded because from that instruction +* forward having a compatible state will ensure we will safely reach the +* exit. States describe preconditions for further exploration, but completely +* forget the history of how we got here. +* +* This also means that even if we needed precise SCALAR range to get to +* finalized state, but from that point forward *that same* SCALAR register is +* never used in a precise context (i.e., it's precise value is not needed for +* correctness), it's correct and safe to mark such register as "imprecise" +* (i.e., precise marking set to false). This is what we rely on when we do +* not set precise marking in current state. If no child state requires +* precision for any given SCALAR register, it's safe to dictate that it can +* be imprecise. If any child state does require this register to be precise, +* we'll mark it precise later retroactively during precise markings +* propagation from child state to parent states. +*/ static int __mark_chain_precision (struct bpf_verifier_env *env,int frame,int regno,int spi) {
@@ -2420,6 +2503,10 @@ static int __mark_chain_precision(structif (!env->bpf_capable)return 0 ; +/* Do sanity checks against current state of register and/or stack +* slot, but don't set precise flag in current state, as precision +* tracking in the current state is unnecessary. +*/ func = st->frame[frame];if (regno >=0 ) { reg = &func->regs[regno];
@@ -2427,11 +2514,7 @@ static int __mark_chain_precision(structWARN_ONCE (1 ,"backtracing misuse" );return -EFAULT ; } -if (!reg->precise) - new_marks = true; -else - reg_mask =0 ; - reg->precise = true; + new_marks = true; }while (spi >=0 ) {
@@ -2444,11 +2527,7 @@ static int __mark_chain_precision(struct stack_mask =0 ;break ; } -if (!reg->precise) - new_marks = true; -else - stack_mask =0 ; - reg->precise = true; + new_marks = true;break ; }
@@ -10356,7 +10435,7 @@ static bool regsafe(struct bpf_verifier_if (env->explore_alu_limits)return false;if (rcur->type ==SCALAR_VALUE ) { -if (!rold->precise && !rcur->precise) +if (!rold->precise)return true;/* new val must satisfy old val knowledge */ return range_within(rold, rcur) &&
Greg Kroah-Hartman
maintainerPATCH 16/89 bpf: aggressively forget precise markings during state checkpointing
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 7a830b53c17bbadcf99f778f28aaaa4e6c41df5f ]
Exploit the property of about-to-be-checkpointed state to be able to forget all precise markings up to that point even more aggressively. We now clear all potentially inherited precise markings right before checkpointing and branching off into child state. If any of children states require precise knowledge of any SCALAR register, those will be propagated backwards later on before this state is finalized, preserving correctness.
There is a single selftests BPF program change, but tremendous one: 25x reduction in number of verified instructions and states in trace_virtqueue_add_sgs.
Cilium results are more modest, but happen across wider range of programs.
SELFTESTS RESULTS
=================
$ ./veristat -C -e file,prog,insns,states ~/imprecise-early-results.csv ~/imprecise-aggressive-results.csv | grep -v '+0' File Program Total insns (A) Total insns (B) Total insns (DIFF) Total states (A) Total states (B) Total states (DIFF) ------------------- ----------------------- --------------- --------------- ------------------ ---------------- ---------------- ------------------- loop6.bpf.linked1.o trace_virtqueue_add_sgs 398057 15114 -382943 (-96.20%) 8717 336 -8381 (-96.15%) ------------------- ----------------------- --------------- --------------- ------------------ ---------------- ---------------- -------------------
CILIUM RESULTS
==============
$ ./veristat -C -e file,prog,insns,states ~/imprecise-early-results-cilium.csv ~/imprecise-aggressive-results-cilium.csv | grep -v '+0' File Program Total insns (A) Total insns (B) Total insns (DIFF) Total states (A) Total states (B) Total states (DIFF) ------------- -------------------------------- --------------- --------------- ------------------ ---------------- ---------------- ------------------- bpf_host.o tail_handle_nat_fwd_ipv4 23426 23221 -205 (-0.88%) 1537 1515 -22 (-1.43%) bpf_host.o tail_handle_nat_fwd_ipv6 13009 12904 -105 (-0.81%) 719 708 -11 (-1.53%) bpf_host.o tail_nodeport_nat_ingress_ipv6 5261 5196 -65 (-1.24%) 247 243 -4 (-1.62%) bpf_host.o tail_nodeport_nat_ipv6_egress 3446 3406 -40 (-1.16%) 203 198 -5 (-2.46%) bpf_lxc.o tail_handle_nat_fwd_ipv4 23426 23221 -205 (-0.88%) 1537 1515 -22 (-1.43%) bpf_lxc.o tail_handle_nat_fwd_ipv6 13009 12904 -105 (-0.81%) 719 708 -11 (-1.53%) bpf_lxc.o tail_ipv4_ct_egress 5074 4897 -177 (-3.49%) 255 248 -7 (-2.75%) bpf_lxc.o tail_ipv4_ct_ingress 5100 4923 -177 (-3.47%) 255 248 -7 (-2.75%) bpf_lxc.o tail_ipv4_ct_ingress_policy_only 5100 4923 -177 (-3.47%) 255 248 -7 (-2.75%) bpf_lxc.o tail_ipv6_ct_egress 4558 4536 -22 (-0.48%) 188 187 -1 (-0.53%) bpf_lxc.o tail_ipv6_ct_ingress 4578 4556 -22 (-0.48%) 188 187 -1 (-0.53%) bpf_lxc.o tail_ipv6_ct_ingress_policy_only 4578 4556 -22 (-0.48%) 188 187 -1 (-0.53%) bpf_lxc.o tail_nodeport_nat_ingress_ipv6 5261 5196 -65 (-1.24%) 247 243 -4 (-1.62%) bpf_overlay.o tail_nodeport_nat_ingress_ipv6 5261 5196 -65 (-1.24%) 247 243 -4 (-1.62%) bpf_overlay.o tail_nodeport_nat_ipv6_egress 3482 3442 -40 (-1.15%) 204 201 -3 (-1.47%) bpf_xdp.o tail_nodeport_nat_egress_ipv4 17200 15619 -1581 (-9.19%) 1111 1010 -101 (-9.09%) ------------- -------------------------------- --------------- --------------- ------------------ ---------------- ---------------- -------------------
Stable-dep-of: ecdf985d7615 ("bpf: track immediate values written to stack by BPF_ST instruction")
--- kernel/bpf/verifier.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+)
kernel/bpf/verifier.c +37 -0
@@ -2407,6 +2407,31 @@ static void mark_all_scalars_precise(str } } +static void mark_all_scalars_imprecise (struct bpf_verifier_env *env,struct bpf_verifier_state *st) +{ +struct bpf_func_state *func; +struct bpf_reg_state *reg; +int i, j; + +for (i =0 ; i <= st->curframe; i++) { + func = st->frame[i]; +for (j =0 ; j <BPF_REG_FP ; j++) { + reg = &func->regs[j]; +if (reg->type !=SCALAR_VALUE ) +continue ; + reg->precise = false; + } +for (j =0 ; j < func->allocated_stack /BPF_REG_SIZE ; j++) { +if (!is_spilled_reg (&func->stack[j])) +continue ; + reg = &func->stack[j].spilled_ptr; +if (reg->type !=SCALAR_VALUE ) +continue ; + reg->precise = false; + } + } +} +/* * __mark_chain_precision() backtracks BPF program instruction sequence and * chain of verifier states making sure that register *regno* (if regno >= 0)
@@ -2485,6 +2510,14 @@ static void mark_all_scalars_precise(str* be imprecise. If any child state does require this register to be precise, * we'll mark it precise later retroactively during precise markings * propagation from child state to parent states. +* +* Skipping precise marking setting in current state is a mild version of +* relying on the above observation. But we can utilize this property even +* more aggressively by proactively forgetting any precise marking in the +* current state (which we inherited from the parent state), right before we +* checkpoint it and branch off into new child state. This is done by +* mark_all_scalars_imprecise() to hopefully get more permissive and generic +* finalized states which help in short circuiting more future states. */ static int __mark_chain_precision (struct bpf_verifier_env *env,int frame,int regno,int spi)
@@ -10984,6 +11017,10 @@ next: env->prev_jmps_processed = env->jmps_processed; env->prev_insn_processed = env->insn_processed; +/* forget precise markings we inherited, see __mark_chain_precision */ +if (env->bpf_capable) +mark_all_scalars_imprecise (env, cur); +/* add new state to the head of linked list */ new = &new_sl->state; err =copy_verifier_state (new, cur);
Greg Kroah-Hartman
maintainerPATCH 17/89 selftests/bpf: make test_align selftest more robust
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 4f999b767769b76378c3616c624afd6f4bb0d99f ]
test_align selftest relies on BPF verifier log emitting register states for specific instructions in expected format. Unfortunately, BPF verifier precision backtracking log interferes with such expectations. And instruction on which precision propagation happens sometimes don't output full expected register states. This does indeed look like something to be improved in BPF verifier, but is beyond the scope of this patch set.
So to make test_align a bit more robust, inject few dummy R4 = R5 instructions which capture desired state of R5 and won't have precision tracking logs on them. This fixes tests until we can improve BPF verifier output in the presence of precision tracking.
Stable-dep-of: ecdf985d7615 ("bpf: track immediate values written to stack by BPF_ST instruction")
--- tools/testing/selftests/bpf/prog_tests/align.c | 36 +++++++++++++++---------- 1 file changed, 23 insertions(+), 13 deletions(-)
tools/testing/selftests/bpf/prog_tests/align.c +23 -13
@@ -2,7 +2,7 @@#include <test_progs.h> #define MAX_INSNS 512 -#define MAX_MATCHES 16 +#define MAX_MATCHES 24struct bpf_reg_match {unsigned int line;
@@ -267,6 +267,7 @@ static struct bpf_align_test tests[] = {*/ BPF_MOV64_REG (BPF_REG_5 ,BPF_REG_2 ),BPF_ALU64_REG (BPF_ADD ,BPF_REG_5 ,BPF_REG_6 ), +BPF_MOV64_REG (BPF_REG_4 ,BPF_REG_5 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_5 ,14 ),BPF_MOV64_REG (BPF_REG_4 ,BPF_REG_5 ), BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
@@ -280,6 +281,7 @@ static struct bpf_align_test tests[] = {BPF_MOV64_REG (BPF_REG_5 ,BPF_REG_2 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_5 ,14 ),BPF_ALU64_REG (BPF_ADD ,BPF_REG_5 ,BPF_REG_6 ), +BPF_MOV64_REG (BPF_REG_4 ,BPF_REG_5 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_5 ,4 ),BPF_ALU64_REG (BPF_ADD ,BPF_REG_5 ,BPF_REG_6 ), BPF_MOV64_REG(BPF_REG_4, BPF_REG_5),
@@ -311,44 +313,52 @@ static struct bpf_align_test tests[] = { {15, "R4=pkt(id=1,off=18,r=18,umax_value=1020,var_off=(0x0; 0x3fc))"}, {15, "R5=pkt(id=1,off=14,r=18,umax_value=1020,var_off=(0x0; 0x3fc))"},/* Variable offset is added to R5 packet pointer, -* resulting in auxiliary alignment of 4. +* resulting in auxiliary alignment of 4. To avoid BPF +* verifier's precision backtracking logging +* interfering we also have a no-op R4 = R5 +* instruction to validate R5 state. We also check +* that R4 is what it should be in such case. */ - {18, "R5_w=pkt(id=2,off=0,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {19, "R4_w=pkt(id=2,off=0,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {19, "R5_w=pkt(id=2,off=0,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* Constant offset is added to R5, resulting in * reg->off of 14. */ - {19, "R5_w=pkt(id=2,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {20, "R5_w=pkt(id=2,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* At the time the word size load is performed from R5, * its total fixed offset is NET_IP_ALIGN + reg->off * (14) which is 16. Then the variable offset is 4-byte * aligned, so the total offset is 4-byte aligned and * meets the load's requirements. */ - {23, "R4=pkt(id=2,off=18,r=18,umax_value=1020,var_off=(0x0; 0x3fc))"}, - {23, "R5=pkt(id=2,off=14,r=18,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {24, "R4=pkt(id=2,off=18,r=18,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {24, "R5=pkt(id=2,off=14,r=18,umax_value=1020,var_off=(0x0; 0x3fc))"},/* Constant offset is added to R5 packet pointer, * resulting in reg->off value of 14. */ - {26, "R5_w=pkt(id=0,off=14,r=8"}, + {27, "R5_w=pkt(id=0,off=14,r=8"},/* Variable offset is added to R5, resulting in a -* variable offset of (4n). +* variable offset of (4n). See comment for insn #19 +* for R4 = R5 trick. */ - {27, "R5_w=pkt(id=3,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {29, "R4_w=pkt(id=3,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {29, "R5_w=pkt(id=3,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* Constant is added to R5 again, setting reg->off to 18. */ - {28, "R5_w=pkt(id=3,off=18,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {30, "R5_w=pkt(id=3,off=18,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* And once more we add a variable; resulting var_off * is still (4n), fixed offset is not changed. * Also, we create a new reg->id. */ - {29, "R5_w=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc)"}, + {32, "R4_w=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc)"}, + {32, "R5_w=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc)"},/* At the time the word size load is performed from R5, * its total fixed offset is NET_IP_ALIGN + reg->off (18) * which is 20. Then the variable offset is (4n), so * the total offset is 4-byte aligned and meets the * load's requirements. */ - {33, "R4=pkt(id=4,off=22,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"}, - {33, "R5=pkt(id=4,off=18,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"}, + {35, "R4=pkt(id=4,off=22,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"}, + {35, "R5=pkt(id=4,off=18,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"}, }, }, {
Greg Kroah-Hartman
maintainerPATCH 18/89 selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code
In reply to Greg Kroah-HartmanFrom: Yonghong Song <[email protected]>
[ Upstream commit 63d78b7e8ca2d0eb8c687a355fa19d01b6fcc723 ]
With latest llvm17, selftest fexit_bpf2bpf/func_replace_return_code has the following verification failure:
0: R1=ctx(off=0,imm=0) R10=fp0
; int connect_v4_prog(struct bpf_sock_addr *ctx)
0: (bf) r7 = r1 ; R1=ctx(off=0,imm=0) R7_w=ctx(off=0,imm=0)
1: (b4) w6 = 0 ; R6_w=0
; memset(&tuple.ipv4.saddr, 0, sizeof(tuple.ipv4.saddr));
...
; return do_bind(ctx) ? 1 : 0;
179: (bf) r1 = r7 ; R1=ctx(off=0,imm=0) R7=ctx(off=0,imm=0)
180: (85) call pc+147
Func#3 is global and valid. Skipping.
181: R0_w=scalar()
181: (bc) w6 = w0 ; R0_w=scalar() R6_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff))
182: (05) goto pc-129
; }
54: (bc) w0 = w6 ; R0_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) R6_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff))
55: (95) exit
At program exit the register R0 has value (0x0; 0xffffffff) should have been in (0x0; 0x1) processed 281 insns (limit 1000000) max_states_per_insn 1 total_states 26 peak_states 26 mark_read 13 -- END PROG LOAD LOG --
libbpf: prog 'connect_v4_prog': failed to load: -22
The corresponding source code:
__attribute__ ((noinline))
int do_bind(struct bpf_sock_addr *ctx)
{
struct sockaddr_in sa = {}; sa.sin_family = AF_INET;
sa.sin_port = bpf_htons(0);
sa.sin_addr.s_addr = bpf_htonl(SRC_REWRITE_IP4);
if (bpf_bind(ctx, (struct sockaddr *)&sa, sizeof(sa)) != 0)
return 0;
return 1;
}
...
SEC("cgroup/connect4")
int connect_v4_prog(struct bpf_sock_addr *ctx)
{
...
return do_bind(ctx) ? 1 : 0;}
Insn 180 is a call to 'do_bind'. The call's return value is also the return value for the program. Since do_bind() returns 0/1, so it is legitimate for compiler to optimize 'return do_bind(ctx) ? 1 : 0' to 'return do_bind(ctx)'. However, such optimization breaks verifier as the return value of 'do_bind()' is marked as any scalar which violates the requirement of prog return value 0/1.
There are two ways to fix this problem, (1) changing 'return 1' in do_bind() to e.g. 'return 10' so the compiler has to do 'do_bind(ctx) ? 1 :0', or (2) suggested by Andrii, marking do_bind() with __weak attribute so the compiler cannot make any assumption on do_bind() return value.
This patch adopted adding __weak approach which is simpler and more resistant to potential compiler optimizations.
--- tools/testing/selftests/bpf/progs/connect4_prog.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/progs/connect4_prog.c +1 -1
@@ -33,7 +33,7 @@ int _version SEC("version") = 1; -__attribute__ ((noinline)) +__attribute__ ((noinline))__weak int do_bind (struct bpf_sock_addr *ctx) {struct sockaddr_in sa = {};
Greg Kroah-Hartman
maintainerPATCH 19/89 selftests/bpf: Fix sk_assign on s390x
In reply to Greg Kroah-HartmanFrom: Ilya Leoshkevich <[email protected]>
[ Upstream commit 7ce878ca81bca7811e669db4c394b86780e0dbe4 ]
sk_assign is failing on an s390x machine running Debian "bookworm" for 2 reasons: legacy server_map definition and uninitialized addrlen in recvfrom() call.
Fix by adding a new-style server_map definition and dropping addrlen (recvfrom() allows NULL values for src_addr and addrlen).
Since the test should support tc built without libbpf, build the prog
twice: with the old-style definition and with the new-style definition, then select the right one at runtime. This could be done at compile time too, but this would not be cross-compilation friendly.
--- tools/testing/selftests/bpf/prog_tests/sk_assign.c | 25 ++++++++++---- tools/testing/selftests/bpf/progs/test_sk_assign.c | 11 ++++++ tools/testing/selftests/bpf/progs/test_sk_assign_libbpf.c | 3 + 3 files changed, 33 insertions(+), 6 deletions(-) create mode 100644 tools/testing/selftests/bpf/progs/test_sk_assign_libbpf.c
tools/testing/selftests/bpf/prog_tests/sk_assign.c +19 -6
@@ -29,7 +29,23 @@ static int stop, duration;static bool configure_stack (void ) { +char tc_version[128 ];char tc_cmd[BUFSIZ ]; +char *prog; +FILE *tc; + +/* Check whether tc is built with libbpf. */ + tc =popen ("tc -V" ,"r" ); +if (CHECK_FAIL (!tc)) +return false; +if (CHECK_FAIL (!fgets (tc_version,sizeof (tc_version), tc))) +return false; +if (strstr (tc_version,", libbpf " )) + prog ="test_sk_assign_libbpf.o" ; +else + prog ="test_sk_assign.o" ; +if (CHECK_FAIL (pclose (tc))) +return false;/* Move to a new networking namespace */ if (CHECK_FAIL (unshare (CLONE_NEWNET )))
@@ -46,8 +62,8 @@ configure_stack(void)/* Load qdisc, BPF program */ if (CHECK_FAIL (system ("tc qdisc add dev lo clsact" )))return false; -sprintf (tc_cmd,"%s %s %s %s" ,"tc filter add dev lo ingress bpf" , -"direct-action object-file ./test_sk_assign.o" , +sprintf (tc_cmd,"%s %s %s %s %s" ,"tc filter add dev lo ingress bpf" , +"direct-action object-file" , prog,"section classifier/sk_assign_test" , (env.verbosity <VERBOSE_VERY ) ?" 2>/dev/null" :"verbose" ); if (CHECK(system(tc_cmd), "BPF load failed;",
@@ -129,15 +145,12 @@ get_port(int fd)static ssize_t rcv_msg (int srv_client,int type) { -struct sockaddr_storage ss;char buf[BUFSIZ ]; -socklen_t slen;if (type ==SOCK_STREAM )return read (srv_client, &buf,sizeof (buf));else -return recvfrom (srv_client, &buf,sizeof (buf),0 , - (struct sockaddr *)&ss, &slen); +return recvfrom (srv_client, &buf,sizeof (buf),0 ,NULL ,NULL ); } static int
tools/testing/selftests/bpf/progs/test_sk_assign.c +11 -0
@@ -16,6 +16,16 @@#include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h> +#if defined(IPROUTE2_HAVE_LIBBPF ) +/* Use a new-style map definition. */ +struct { + __uint(type, BPF_MAP_TYPE_SOCKMAP); + __type(key, int); + __type(value, __u64); + __uint(pinning, LIBBPF_PIN_BY_NAME); + __uint(max_entries, 1); +} server_map SEC(".maps"); +#else /* Pin map under /sys/fs/bpf/tc/globals/<map name> */ #define PIN_GLOBAL_NS 2
@@ -35,6 +45,7 @@ struct { .max_elem = 1, .pinning = PIN_GLOBAL_NS, }; +#endif int _version SEC("version") = 1; char _license[] SEC("license") = "GPL";
tools/testing/selftests/bpf/progs/test_sk_assign_libbpf.c new file +3 -0
@@ -0,0 +1,3 @@ +// SPDX-License-Identifier: GPL-2.0 +#define IPROUTE2_HAVE_LIBBPF +#include "test_sk_assign.c"
Greg Kroah-Hartman
maintainerPATCH 20/89 io_uring: correct check for O_TMPFILE
In reply to Greg Kroah-HartmanFrom: Aleksa Sarai <[email protected]>
Commit 72dbde0f2afbe4af8e8595a89c650ae6b9d9c36f upstream.
O_TMPFILE is actually __O_TMPFILE|O_DIRECTORY. This means that the old check for whether RESOLVE_CACHED can be used would incorrectly think that O_DIRECTORY could not be used with RESOLVE_CACHED.
--- io_uring/io_uring.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
io_uring/io_uring.c +4 -2
@@ -4375,9 +4375,11 @@ static int io_openat2(struct io_kiocb *rif (issue_flags &IO_URING_F_NONBLOCK ) {/* * Don't bother trying for O_TRUNC, O_CREAT, or O_TMPFILE open, -* it'll always -EAGAIN +* it'll always -EAGAIN. Note that we test for __O_TMPFILE +* because O_TMPFILE includes O_DIRECTORY, which isn't a flag +* we need to force async for. */ -if (req->open.how.flags & (O_TRUNC |O_CREAT |O_TMPFILE )) +if (req->open.how.flags & (O_TRUNC |O_CREAT | __O_TMPFILE))return -EAGAIN ; op.lookup_flags |=LOOKUP_CACHED ; op.open_flag |=O_NONBLOCK ;
Greg Kroah-Hartman
maintainerPATCH 21/89 iio: cros_ec: Fix the allocation size for cros_ec_command
In reply to Greg Kroah-HartmanFrom: Yiyuan Guo <[email protected]>
commit 8a4629055ef55177b5b63dab1ecce676bd8cccdd upstream.
The struct cros_ec_command contains several integer fields and a trailing array. An allocation size neglecting the integer fields can lead to buffer overrun.
--- drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c +1 -1
@@ -259,7 +259,7 @@ int cros_ec_sensors_core_init(struct plaplatform_set_drvdata (pdev, indio_dev); state->ec = ec->ec_dev; - state->msg =devm_kzalloc (&pdev->dev, + state->msg =devm_kzalloc (&pdev->dev,sizeof (*state->msg) +max ((u16 )sizeof (struct ec_params_motion_sense ), state->ec->max_response),GFP_KERNEL );if (!state->msg)
Greg Kroah-Hartman
maintainerPATCH 22/89 iio: adc: ina2xx: avoid NULL pointer dereference on OF device match
In reply to Greg Kroah-HartmanFrom: Alvin Šipraga <[email protected]>
commit a41e19cc0d6b6a445a4133170b90271e4a2553dc upstream.
The affected lines were resulting in a NULL pointer dereference on our platform because the device tree contained the following list of compatible strings:
power-sensor@40 {
compatible = "ti,ina232", "ti,ina231";
...
};Since the driver doesn't declare a compatible string "ti,ina232", the OF matching succeeds on "ti,ina231". But the I2C device ID info is populated via the first compatible string, cf. modalias population in of_i2c_get_board_info(). Since there is no "ina232" entry in the legacy I2C device ID table either, the struct i2c_device_id *id pointer in the probe function is NULL.
Fix this by using the already populated type variable instead, which points to the proper driver data. Since the name is also wanted, add a generic one to the ina2xx_config table.
--- drivers/iio/adc/ina2xx-adc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/iio/adc/ina2xx-adc.c +6 -3
@@ -124,6 +124,7 @@ static const struct regmap_config ina2xxenum ina2xx_ids { ina219, ina226 };struct ina2xx_config { +const char *name;u16 config_default;int calibration_value;int shunt_voltage_lsb;/* nV */
@@ -155,6 +156,7 @@ struct ina2xx_chip_info {static const struct ina2xx_config ina2xx_config[] = { [ina219] = { + .name ="ina219" , .config_default =INA219_CONFIG_DEFAULT , .calibration_value =4096 , .shunt_voltage_lsb =10000 ,
@@ -164,6 +166,7 @@ static const struct ina2xx_config ina2xx .chip_id = ina219, }, [ina226] = { + .name = "ina226", .config_default = INA226_CONFIG_DEFAULT, .calibration_value = 2048, .shunt_voltage_lsb = 2500,
@@ -999,7 +1002,7 @@ static int ina2xx_probe(struct i2c_clien/* Patch the current config register with default. */ val = chip->config->config_default; -if (id->driver_data == ina226) { +if (type == ina226) {ina226_set_average (chip,INA226_DEFAULT_AVG , &val);ina226_set_int_time_vbus (chip,INA226_DEFAULT_IT , &val);ina226_set_int_time_vshunt (chip,INA226_DEFAULT_IT , &val);
@@ -1018,7 +1021,7 @@ static int ina2xx_probe(struct i2c_clien } indio_dev->modes =INDIO_DIRECT_MODE ; -if (id->driver_data == ina226) { +if (type == ina226) { indio_dev->channels = ina226_channels; indio_dev->num_channels =ARRAY_SIZE (ina226_channels); indio_dev->info = &ina226_info;
@@ -1027,7 +1030,7 @@ static int ina2xx_probe(struct i2c_clien indio_dev->num_channels =ARRAY_SIZE (ina219_channels); indio_dev->info = &ina219_info; } - indio_dev->name = id->name; + indio_dev->name = id ? id->name : chip->config->name; ret = devm_iio_kfifo_buffer_setup(&client->dev, indio_dev, INDIO_BUFFER_SOFTWARE,
Greg Kroah-Hartman
maintainerPATCH 23/89 binder: fix memory leak in binder_init()
In reply to Greg Kroah-HartmanFrom: Qi Zheng <[email protected]>
commit adb9743d6a08778b78d62d16b4230346d3508986 upstream.
In binder_init(), the destruction of binder_alloc_shrinker_init() is not performed in the wrong path, which will cause memory leaks. So this commit introduces binder_alloc_shrinker_exit() and calls it in the wrong path to fix that.
--- drivers/android/binder.c | 1 + drivers/android/binder_alloc.c | 6 ++++++ drivers/android/binder_alloc.h | 1 + 3 files changed, 8 insertions(+)
drivers/android/binder.c +1 -0
@@ -6412,6 +6412,7 @@ err_init_binder_device_failed: err_alloc_device_names_failed:debugfs_remove_recursive (binder_debugfs_dir_entry_root); +binder_alloc_shrinker_exit ();return ret; }
drivers/android/binder_alloc.c +6 -0
@@ -1091,6 +1091,12 @@ int binder_alloc_shrinker_init(void)return ret; } +void binder_alloc_shrinker_exit (void ) +{ +unregister_shrinker (&binder_shrinker); +list_lru_destroy (&binder_alloc_lru); +} +/** * check_buffer() - verify that buffer/offset is safe to access * @alloc: binder_alloc for this proc
drivers/android/binder_alloc.h +1 -0
@@ -131,6 +131,7 @@ extern struct binder_buffer *binder_allo int pid);extern void binder_alloc_init (struct binder_alloc *alloc);extern int binder_alloc_shrinker_init (void ); +extern void binder_alloc_shrinker_exit (void );extern void binder_alloc_vma_close (struct binder_alloc *alloc);extern struct binder_buffer * binder_alloc_prepare_to_free(struct binder_alloc *alloc,
Greg Kroah-Hartman
maintainerPATCH 24/89 misc: rtsx: judge ASPM Mode to set PETXCFG Reg
In reply to Greg Kroah-HartmanFrom: Ricky WU <[email protected]>
commit 101bd907b4244a726980ee67f95ed9cafab6ff7a upstream.
ASPM Mode is ASPM_MODE_CFG need to judge the value of clkreq_0 to set HIGH or LOW, if the ASPM Mode is ASPM_MODE_REG always set to HIGH during the initialization.
--- drivers/misc/cardreader/rts5227.c | 2 +- drivers/misc/cardreader/rts5228.c | 18 ------------------ drivers/misc/cardreader/rts5249.c | 3 +-- drivers/misc/cardreader/rts5260.c | 18 ------------------ drivers/misc/cardreader/rts5261.c | 18 ------------------ drivers/misc/cardreader/rtsx_pcr.c | 5 ++++- 6 files changed, 6 insertions(+), 58 deletions(-)
drivers/misc/cardreader/rts5227.c +1 -1
@@ -171,7 +171,7 @@ static int rts5227_extra_init_hw(structelse rtsx_pci_add_cmd (pcr,WRITE_REG_CMD ,PETXCFG ,0x30 ,0x00 ); -if (option->force_clkreq_0) +if (option->force_clkreq_0 && pcr->aspm_mode ==ASPM_MODE_CFG )rtsx_pci_add_cmd (pcr,WRITE_REG_CMD ,PETXCFG ,FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_LOW );else
drivers/misc/cardreader/rts5228.c +0 -18
@@ -427,17 +427,10 @@ static void rts5228_init_from_cfg(struct option->ltr_enabled = false; } } - -if (rtsx_check_dev_flag (pcr,ASPM_L1_1_EN |ASPM_L1_2_EN - |PM_L1_1_EN |PM_L1_2_EN )) - option->force_clkreq_0 = false; -else - option->force_clkreq_0 = true; }static int rts5228_extra_init_hw (struct rtsx_pcr *pcr) { -struct rtsx_cr_option *option = &pcr->option;rtsx_pci_write_register (pcr,RTS5228_AUTOLOAD_CFG1 ,CD_RESUME_EN_MASK ,CD_RESUME_EN_MASK );
@@ -468,17 +461,6 @@ static int rts5228_extra_init_hw(structelse rtsx_pci_write_register (pcr,PETXCFG ,0x30 ,0x00 ); -/* -* If u_force_clkreq_0 is enabled, CLKREQ# PIN will be forced -* to drive low, and we forcibly request clock. -*/ -if (option->force_clkreq_0) -rtsx_pci_write_register (pcr,PETXCFG , -FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_LOW ); -else -rtsx_pci_write_register (pcr,PETXCFG , -FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_HIGH ); -rtsx_pci_write_register (pcr,PWD_SUSPEND_EN ,0xFF ,0xFB );rtsx_pci_write_register (pcr, pcr->reg_pm_ctrl3,0x10 ,0x00 ); rtsx_pci_write_register(pcr, RTS5228_REG_PME_FORCE_CTL,
drivers/misc/cardreader/rts5249.c +1 -2
@@ -302,12 +302,11 @@ static int rts5249_extra_init_hw(struct } } -/* * If u_force_clkreq_0 is enabled, CLKREQ# PIN will be forced * to drive low, and we forcibly request clock. */ -if (option->force_clkreq_0) +if (option->force_clkreq_0 && pcr->aspm_mode ==ASPM_MODE_CFG )rtsx_pci_write_register (pcr,PETXCFG ,FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_LOW );else
drivers/misc/cardreader/rts5260.c +0 -18
@@ -517,17 +517,10 @@ static void rts5260_init_from_cfg(struct option->ltr_enabled = false; } } - -if (rtsx_check_dev_flag (pcr,ASPM_L1_1_EN |ASPM_L1_2_EN - |PM_L1_1_EN |PM_L1_2_EN )) - option->force_clkreq_0 = false; -else - option->force_clkreq_0 = true; }static int rts5260_extra_init_hw (struct rtsx_pcr *pcr) { -struct rtsx_cr_option *option = &pcr->option;/* Set mcu_cnt to 7 to ensure data can be sampled properly */ rtsx_pci_write_register (pcr,0xFC03 ,0x7F ,0x07 );
@@ -546,17 +539,6 @@ static int rts5260_extra_init_hw(structrts5260_init_hw (pcr); -/* -* If u_force_clkreq_0 is enabled, CLKREQ# PIN will be forced -* to drive low, and we forcibly request clock. -*/ -if (option->force_clkreq_0) -rtsx_pci_write_register (pcr,PETXCFG , -FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_LOW ); -else -rtsx_pci_write_register (pcr,PETXCFG , -FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_HIGH ); -rtsx_pci_write_register (pcr, pcr->reg_pm_ctrl3,0x10 ,0x00 );return 0 ;
drivers/misc/cardreader/rts5261.c +0 -18
@@ -468,17 +468,10 @@ static void rts5261_init_from_cfg(struct option->ltr_enabled = false; } } - -if (rtsx_check_dev_flag (pcr,ASPM_L1_1_EN |ASPM_L1_2_EN - |PM_L1_1_EN |PM_L1_2_EN )) - option->force_clkreq_0 = false; -else - option->force_clkreq_0 = true; }static int rts5261_extra_init_hw (struct rtsx_pcr *pcr) { -struct rtsx_cr_option *option = &pcr->option;u32 val; rtsx_pci_write_register(pcr, RTS5261_AUTOLOAD_CFG1,
@@ -524,17 +517,6 @@ static int rts5261_extra_init_hw(structelse rtsx_pci_write_register (pcr,PETXCFG ,0x30 ,0x00 ); -/* -* If u_force_clkreq_0 is enabled, CLKREQ# PIN will be forced -* to drive low, and we forcibly request clock. -*/ -if (option->force_clkreq_0) -rtsx_pci_write_register (pcr,PETXCFG , -FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_LOW ); -else -rtsx_pci_write_register (pcr,PETXCFG , -FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_HIGH ); -rtsx_pci_write_register (pcr,PWD_SUSPEND_EN ,0xFF ,0xFB );rtsx_pci_write_register (pcr, pcr->reg_pm_ctrl3,0x10 ,0x00 ); rtsx_pci_write_register(pcr, RTS5261_REG_PME_FORCE_CTL,
drivers/misc/cardreader/rtsx_pcr.c +4 -1
@@ -1400,8 +1400,11 @@ static int rtsx_pci_init_hw(struct rtsx_return err; } -if (pcr->aspm_mode ==ASPM_MODE_REG ) +if (pcr->aspm_mode ==ASPM_MODE_REG ) {rtsx_pci_write_register (pcr,ASPM_FORCE_CTL ,0x30 ,0x30 ); +rtsx_pci_write_register (pcr,PETXCFG , +FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_HIGH ); + }/* No CD interrupt if probing driver with card inserted. * So we need to initialize pcr->card_exist here.
Greg Kroah-Hartman
maintainerPATCH 25/89 usb-storage: alauda: Fix uninit-value in alauda_check_media()
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit a6ff6e7a9dd69364547751db0f626a10a6d628d2 upstream.
Syzbot got KMSAN to complain about access to an uninitialized value in the alauda subdriver of usb-storage:
BUG: KMSAN: uninit-value in alauda_transport+0x462/0x57f0 drivers/usb/storage/alauda.c:1137 CPU: 0 PID: 12279 Comm: usb-storage Not tainted 5.3.0-rc7+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x13a/0x2b0 mm/kmsan/kmsan_report.c:108 __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:250 alauda_check_media+0x344/0x3310 drivers/usb/storage/alauda.c:460
The problem is that alauda_check_media() doesn't verify that its USB transfer succeeded before trying to use the received data. What should happen if the transfer fails isn't entirely clear, but a reasonably conservative approach is to pretend that no media is present.
A similar problem exists in a usb_stor_dbg() call in alauda_get_media_status(). In this case, when an error occurs the call is redundant, because usb_stor_ctrl_transfer() already will print a debugging message.
Finally, unrelated to the uninitialized memory access, is the fact that alauda_check_media() performs DMA to a buffer on the stack. Fortunately usb-storage provides a general purpose DMA-able buffer for uses like this. We'll use it instead.
--- drivers/usb/storage/alauda.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/usb/storage/alauda.c +9 -3
@@ -318,7 +318,8 @@ static int alauda_get_media_status(struc rc =usb_stor_ctrl_transfer (us, us->recv_ctrl_pipe, command,0xc0 ,0 ,1 , data,2 ); -usb_stor_dbg (us,"Media status %02X %02X\n" , data[0 ], data[1 ]); +if (rc ==USB_STOR_XFER_GOOD ) +usb_stor_dbg (us,"Media status %02X %02X\n" , data[0 ], data[1 ]);return rc; }
@@ -454,9 +455,14 @@ static int alauda_init_media(struct us_dstatic int alauda_check_media (struct us_data *us) {struct alauda_info *info = (struct alauda_info *) us->extra; -unsigned char status[2 ]; +unsigned char *status = us->iobuf; +int rc; -alauda_get_media_status (us, status); + rc =alauda_get_media_status (us, status); +if (rc !=USB_STOR_XFER_GOOD ) { + status[0 ] =0xF0 ;/* Pretend there's no media */ + status[1 ] =0 ; + }/* Check for no media or door open */ if ((status[0] & 0x80) || ((status[0] & 0x1F) == 0x10)
Greg Kroah-Hartman
maintainerPATCH 26/89 usb: dwc3: Properly handle processing of pending events
In reply to Greg Kroah-HartmanFrom: Elson Roy Serrao <[email protected]>
commit 3ddaa6a274578e23745b7466346fc2650df8f959 upstream.
If dwc3 is runtime suspended we defer processing the event buffer until resume, by setting the pending_events flag. Set this flag before triggering resume to avoid race with the runtime resume callback.
While handling the pending events, in addition to checking the event buffer we also need to process it. Handle this by explicitly calling dwc3_thread_interrupt(). Also balance the runtime pm get() operation that triggered this processing.
--- drivers/usb/dwc3/gadget.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/usb/dwc3/gadget.c +8 -1
@@ -4204,9 +4204,14 @@ static irqreturn_t dwc3_check_event_buf(u32 reg;if (pm_runtime_suspended (dwc->dev)) { + dwc->pending_events = true; +/* +* Trigger runtime resume. The get() function will be balanced +* after processing the pending events in dwc3_process_pending +* events(). +*/ pm_runtime_get (dwc->dev);disable_irq_nosync (dwc->irq_gadget); - dwc->pending_events = true;return IRQ_HANDLED ; }
@@ -4470,6 +4475,8 @@ void dwc3_gadget_process_pending_events( {if (dwc->pending_events) {dwc3_interrupt (dwc->irq_gadget, dwc->ev_buf); +dwc3_thread_interrupt (dwc->irq_gadget, dwc->ev_buf); +pm_runtime_put (dwc->dev); dwc->pending_events = false;enable_irq (dwc->irq_gadget); }
Greg Kroah-Hartman
maintainerPATCH 27/89 usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
In reply to Greg Kroah-HartmanFrom: Prashanth K <[email protected]>
commit 8e21a620c7e6e00347ade1a6ed4967b359eada5a upstream.
Currently if we bootup a device without cable connected, then usb-conn-gpio won't call set_role() because last_role is same as current role. This happens since last_role gets initialised to zero during the probe.
To avoid this, add a new flag initial_detection into struct usb_conn_info, which prevents bailing out during initial detection.
--- drivers/usb/common/usb-conn-gpio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/usb/common/usb-conn-gpio.c +5 -1
@@ -42,6 +42,7 @@ struct usb_conn_info {struct power_supply_desc desc;struct power_supply *charger; +bool initial_detection; };/*
@@ -86,11 +87,13 @@ static void usb_conn_detect_cable(structdev_dbg (info->dev,"role %s -> %s, gpios: id %d, vbus %d\n" ,usb_role_string (info->last_role),usb_role_string (role), id, vbus); -if (info->last_role == role) { +if (!info->initial_detection && info->last_role == role) {dev_warn (info->dev,"repeated role: %s\n" ,usb_role_string (role));return ; } + info->initial_detection = false; +if (info->last_role ==USB_ROLE_HOST && info->vbus)regulator_disable (info->vbus);
@@ -273,6 +276,7 @@ static int usb_conn_probe(struct platforplatform_set_drvdata (pdev, info);/* Perform initial detection */ + info->initial_detection = true;usb_conn_queue_dwork (info,0 );return 0 ;
Greg Kroah-Hartman
maintainerPATCH 28/89 usb: typec: tcpm: Fix response to vsafe0V event
In reply to Greg Kroah-HartmanFrom: Badhri Jagan Sridharan <[email protected]>
commit 4270d2b4845e820b274702bfc2a7140f69e4d19d upstream.
Do not transition to SNK_UNATTACHED state when receiving vsafe0v event while in SNK_HARD_RESET_WAIT_VBUS. Ignore VBUS off events as well as in some platforms VBUS off can be signalled more than once.
[143515.364753] Requesting mux state 1, usb-role 2, orientation 2 [143515.365520] pending state change SNK_HARD_RESET_SINK_OFF -> SNK_HARD_RESET_SINK_ON @ 650 ms [rev3 HARD_RESET] [143515.632281] CC1: 0 -> 0, CC2: 3 -> 0 [state SNK_HARD_RESET_SINK_OFF, polarity 1, disconnected] [143515.637214] VBUS on [143515.664985] VBUS off [143515.664992] state change SNK_HARD_RESET_SINK_OFF -> SNK_HARD_RESET_WAIT_VBUS [rev3 HARD_RESET] [143515.665564] VBUS VSAFE0V [143515.665566] state change SNK_HARD_RESET_WAIT_VBUS -> SNK_UNATTACHED [rev3 HARD_RESET]
--- drivers/usb/typec/tcpm/tcpm.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/typec/tcpm/tcpm.c +7 -0
@@ -5246,6 +5246,10 @@ static void _tcpm_pd_vbus_off(struct tcp/* Do nothing, vbus drop expected */ break ; +case SNK_HARD_RESET_WAIT_VBUS : +/* Do nothing, its OK to receive vbus off events */ +break ; +default :if (port->pwr_role ==TYPEC_SINK && port->attached)tcpm_set_state (port,SNK_UNATTACHED ,tcpm_wait_for_discharge (port));
@@ -5292,6 +5296,9 @@ static void _tcpm_pd_vbus_vsafe0v(structcase SNK_DEBOUNCED :/*Do nothing, still waiting for VSAFE5V for connect */ break ; +case SNK_HARD_RESET_WAIT_VBUS : +/* Do nothing, its OK to receive vbus off events */ +break ;default :if (port->pwr_role ==TYPEC_SINK && port->auto_vbus_discharge_enabled)tcpm_set_state (port,SNK_UNATTACHED ,0 );
Greg Kroah-Hartman
maintainerPATCH 29/89 x86/srso: Fix build breakage with the LLVM linker
In reply to Greg Kroah-HartmanFrom: Nick Desaulniers <[email protected]>
commit cbe8ded48b939b9d55d2c5589ab56caa7b530709 upstream.
The assertion added to verify the difference in bits set of the addresses of srso_untrain_ret_alias() and srso_safe_ret_alias() would fail to link in LLVM's ld.lld linker with the following error:
ld.lld: error: ./arch/x86/kernel/vmlinux.lds:210: at least one side of the expression must be absolute
ld.lld: error: ./arch/x86/kernel/vmlinux.lds:211: at least one side of the expression must be absolute
Use ABSOLUTE to evaluate the expression referring to at least one of the symbols so that LLD can evaluate the linker script.
Also, add linker version info to the comment about XOR being unsupported in either ld.bfd or ld.lld until somewhat recently.
--- arch/x86/kernel/vmlinux.lds.S | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
arch/x86/kernel/vmlinux.lds.S +9 -3
@@ -518,11 +518,17 @@ INIT_PER_CPU(irq_stack_backing_store); #ifdef CONFIG_CPU_SRSO /* - * GNU ld cannot do XOR so do: (A | B) - (A & B) in order to compute the XOR + * GNU ld cannot do XOR until 2.41. + * https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=f6f78318fca803c4907fb8d7f6ded8295f1947b1 + * + * LLVM lld cannot do XOR until lld-17. + * https://github.com/llvm/llvm-project/commit/fae96104d4378166cbe5c875ef8ed808a356f3fb + * + * Instead do: (A | B) - (A & B) in order to compute the XOR * of the two function addresses: */ -. = ASSERT(((srso_untrain_ret_alias | srso_safe_ret_alias) - - (srso_untrain_ret_alias & srso_safe_ret_alias)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)), +. = ASSERT(((ABSOLUTE(srso_untrain_ret_alias) | srso_safe_ret_alias) - + (ABSOLUTE(srso_untrain_ret_alias) & srso_safe_ret_alias)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)), "SRSO function pair won't alias"); #endif
Greg Kroah-Hartman
maintainerPATCH 30/89 x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
In reply to Greg Kroah-HartmanFrom: Cristian Ciocaltea <[email protected]>
commit 6dbef74aeb090d6bee7d64ef3fa82ae6fa53f271 upstream.
Commit
522b1d69219d ("x86/cpu/amd: Add a Zenbleed fix")
provided a fix for the Zen2 VZEROUPPER data corruption bug affecting a range of CPU models, but the AMD Custom APU 0405 found on SteamDeck was not listed, although it is clearly affected by the vulnerability.
Add this CPU variant to the Zenbleed erratum list, in order to unconditionally enable the fallback fix until a proper microcode update is available.
--- arch/x86/kernel/cpu/amd.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kernel/cpu/amd.c +1 -0
@@ -73,6 +73,7 @@ static const int amd_erratum_1054[] =static const int amd_zenbleed[] =AMD_LEGACY_ERRATUM (AMD_MODEL_RANGE (0x17 ,0x30 ,0x0 ,0x4f ,0xf ),AMD_MODEL_RANGE (0x17 ,0x60 ,0x0 ,0x7f ,0xf ), +AMD_MODEL_RANGE (0x17 ,0x90 ,0x0 ,0x91 ,0xf ),AMD_MODEL_RANGE (0x17 ,0xa0 ,0x0 ,0xaf ,0xf )); static const int amd_div0[] =
Greg Kroah-Hartman
maintainerPATCH 31/89 x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
In reply to Greg Kroah-HartmanFrom: Kirill A. Shutemov <[email protected]>
commit 1b8b1aa90c9c0e825b181b98b8d9e249dc395470 upstream.
Yingcong has noticed that on the 5-level paging machine, VDSO and VVAR VMAs are placed above the 47-bit border:
8000001a9000-8000001ad000 r--p 00000000 00:00 0 [vvar]
8000001ad000-8000001af000 r-xp 00000000 00:00 0 [vdso]
This might confuse users who are not aware of 5-level paging and expect all userspace addresses to be under the 47-bit border.
So far problem has only been triggered with ASLR disabled, although it may also occur with ASLR enabled if the layout is randomized in a just right way.
The problem happens due to custom placement for the VMAs in the VDSO
code: vdso_addr() tries to place them above the stack and checks the result against TASK_SIZE_MAX, which is wrong. TASK_SIZE_MAX is set to the 56-bit border on 5-level paging machines. Use DEFAULT_MAP_WINDOW instead.
--- arch/x86/entry/vdso/vma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/entry/vdso/vma.c +2 -2
@@ -322,8 +322,8 @@ static unsigned long vdso_addr(unsigned/* Round the lowest possible end address up to a PMD boundary. */ end = (start + len +PMD_SIZE -1 ) &PMD_MASK ; -if (end >=TASK_SIZE_MAX ) - end =TASK_SIZE_MAX ; +if (end >=DEFAULT_MAP_WINDOW ) + end =DEFAULT_MAP_WINDOW ; end -= len;if (end > start) {
Greg Kroah-Hartman
maintainerPATCH 32/89 x86/speculation: Add cpu_show_gds() prototype
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit a57c27c7ad85c420b7de44c6ee56692d51709dda upstream.
The newly added function has two definitions but no prototypes:
drivers/base/cpu.c:605:16: error: no previous prototype for 'cpu_show_gds' [-Werror=missing-prototypes]
Add a declaration next to the other ones for this file to avoid the warning.
--- include/linux/cpu.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/cpu.h +2 -0
@@ -72,6 +72,8 @@ extern ssize_t cpu_show_retbleed(struct struct device_attribute *attr, char *buf);extern ssize_t cpu_show_spec_rstack_overflow (struct device *dev,struct device_attribute *attr,char *buf); +extern ssize_t cpu_show_gds (struct device *dev, +struct device_attribute *attr,char *buf); extern __printf(4, 5) struct device *cpu_device_create(struct device *parent, void *drvdata,
Greg Kroah-Hartman
maintainerPATCH 33/89 x86: Move gds_ucode_mitigated() declaration to header
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit eb3515dc99c7c85f4170b50838136b2a193f8012 upstream.
The declaration got placed in the .c file of the caller, but that causes a warning for the definition:
arch/x86/kernel/cpu/bugs.c:682:6: error: no previous prototype for 'gds_ucode_mitigated' [-Werror=missing-prototypes]
Move it to a header where both sides can observe it instead.
--- arch/x86/include/asm/processor.h | 2 ++ arch/x86/kvm/x86.c | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/x86/include/asm/processor.h +2 -0
@@ -859,4 +859,6 @@ enum mds_mitigations { MDS_MITIGATION_VMWERV, }; +extern bool gds_ucode_mitigated (void ); +#endif /* _ASM_X86_PROCESSOR_H */
arch/x86/kvm/x86.c +0 -2
@@ -303,8 +303,6 @@ static struct kmem_cache *x86_fpu_cache;static struct kmem_cache *x86_emulator_cache; -extern bool gds_ucode_mitigated (void ); -/* * When called, it means the previous get/set msr reached an invalid msr. * Return true if we want to ignore/silent this failed msr access.
Greg Kroah-Hartman
maintainerPATCH 34/89 drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
In reply to Greg Kroah-HartmanFrom: Karol Herbst <[email protected]>
commit d5712cd22b9cf109fded1b7f178f4c1888c8b84b upstream.
The original commit adding that check tried to protect the kenrel against a potential invalid NULL pointer access.
However we call nouveau_connector_detect_depth once without a native_mode set on purpose for non LVDS connectors and this broke DP support in a few cases.
--- drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_connector.c +1 -1
@@ -966,7 +966,7 @@ nouveau_connector_get_modes(struct drm_c/* Determine display colour depth for everything except LVDS now, * DP requires this before mode_valid() is called. */ -if (connector->connector_type !=DRM_MODE_CONNECTOR_LVDS && nv_connector->native_mode) +if (connector->connector_type !=DRM_MODE_CONNECTOR_LVDS )nouveau_connector_detect_depth (connector);/* Find the native mode if this is a digital panel, if we didn't
Greg Kroah-Hartman
maintainerPATCH 35/89 netfilter: nf_tables: dont skip expired elements during walk
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
commit 24138933b97b055d486e8064b4a1721702442a9b upstream.
There is an asymmetry between commit/abort and preparation phase if the following conditions are met:
1. set is a verdict map ("1.2.3.4 : jump foo")
2. timeouts are enabled
In this case, following sequence is problematic:
1. element E in set S refers to chain C
2. userspace requests removal of set S
3. kernel does a set walk to decrement chain->use count for all elements from preparation phase
4. kernel does another set walk to remove elements from the commit phase (or another walk to do a chain->use increment for all elements from abort phase)
If E has already expired in 1), it will be ignored during list walk, so its use count won't have been changed.
Then, when set is culled, ->destroy callback will zap the element via nf_tables_set_elem_destroy(), but this function is only safe for elements that have been deactivated earlier from the preparation phase:
lack of earlier deactivate removes the element but leaks the chain use count, which results in a WARN splat when the chain gets removed later, plus a leak of the nft_chain structure.
Update pipapo_get() not to skip expired elements, otherwise flush command reports bogus ENOENT errors.
--- net/netfilter/nf_tables_api.c | 4 ++++ net/netfilter/nft_set_hash.c | 2 -- net/netfilter/nft_set_pipapo.c | 18 ++++++++++++------ net/netfilter/nft_set_rbtree.c | 2 -- 4 files changed, 16 insertions(+), 10 deletions(-)
net/netfilter/nf_tables_api.c +4 -0
@@ -5274,8 +5274,12 @@ static int nf_tables_dump_setelem(constconst struct nft_set_iter *iter, struct nft_set_elem *elem) { + const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);struct nft_set_dump_args *args; +if (nft_set_elem_expired (ext)) +return 0 ; + args = container_of(iter, struct nft_set_dump_args, iter);return nf_tables_fill_setelem (args->skb, set, elem); }
net/netfilter/nft_set_hash.c +0 -2
@@ -278,8 +278,6 @@ static void nft_rhash_walk(const structif (iter->count < iter->skip) goto cont; -if (nft_set_elem_expired (&he->ext)) - goto cont;if (!nft_set_elem_active (&he->ext, iter->genmask)) goto cont;
net/netfilter/nft_set_pipapo.c +12 -6
@@ -566,8 +566,7 @@ next_match: goto out;if (last) { -if (nft_set_elem_expired (&f->mt[b].e->ext) || - (genmask && +if ((genmask && !nft_set_elem_active (&f->mt[b].e->ext, genmask))) goto next_match;
@@ -601,8 +600,17 @@ out:static void *nft_pipapo_get (const struct net *net,const struct nft_set *set,const struct nft_set_elem *elem,unsigned int flags) { -return pipapo_get (net, set, (const u8 *)elem->key.val.data, -nft_genmask_cur (net)); +struct nft_pipapo_elem *ret; + + ret =pipapo_get (net, set, (const u8 *)elem->key.val.data, +nft_genmask_cur (net)); +if (IS_ERR (ret)) +return ret; + +if (nft_set_elem_expired (&ret->ext)) +return ERR_PTR (-ENOENT ); + +return ret; }/**
@@ -2006,8 +2014,6 @@ static void nft_pipapo_walk(const struct goto cont; e = f->mt[r].e; -if (nft_set_elem_expired (&e->ext)) - goto cont; elem.priv = e;
net/netfilter/nft_set_rbtree.c +0 -2
@@ -552,8 +552,6 @@ static void nft_rbtree_walk(const structif (iter->count < iter->skip) goto cont; -if (nft_set_elem_expired (&rbe->ext)) - goto cont;if (!nft_set_elem_active (&rbe->ext, iter->genmask)) goto cont;
Greg Kroah-Hartman
maintainerPATCH 36/89 selftests/rseq: Fix build with undefined __weak
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
commit d5ad9aae13dcced333c1a7816ff0a4fbbb052466 upstream.
Commit 3bcbc20942db ("selftests/rseq: Play nice with binaries statically linked against glibc 2.35+") which is now in Linus' tree introduced uses of __weak but did nothing to ensure that a definition is provided for it resulting in build failures for the rseq tests:
rseq.c:41:1: error: unknown type name '__weak' __weak ptrdiff_t __rseq_offset;
^
rseq.c:41:17: error: expected ';' after top level declarator
__weak ptrdiff_t __rseq_offset;
^
;rseq.c:42:1: error: unknown type name '__weak'__weak unsigned int __rseq_size;
^
rseq.c:43:1: error: unknown type name '__weak'__weak unsigned int __rseq_flags;
Fix this by using the definition from tools/include compiler.h.
Message-Id: <[email protected]>
--- tools/testing/selftests/rseq/Makefile | 4 +++- tools/testing/selftests/rseq/rseq.c | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-)
tools/testing/selftests/rseq/Makefile +3 -1
@@ -4,8 +4,10 @@ ifneq ($(shell $(CC) --version 2>&1 | he CLANG_FLAGS += -no-integrated-as endif +top_srcdir = ../../../.. + CFLAGS += -O2 -Wall -g -I./ -I../../../../usr/include/ -L$(OUTPUT) -Wl,-rpath=./ \ - $(CLANG_FLAGS) + $(CLANG_FLAGS) -I$(top_srcdir)/tools/include LDLIBS += -lpthread -ldl # Own dependencies because we only want to build against 1st prerequisite, but
tools/testing/selftests/rseq/rseq.c +2 -0
@@ -29,6 +29,8 @@#include <dlfcn.h> #include <stddef.h> +#include <linux/compiler.h> +#include "../kselftest.h" #include "rseq.h"
Greg Kroah-Hartman
maintainerPATCH 37/89 selftests: forwarding: Add a helper to skip test when using veth pairs
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 66e131861ab7bf754b50813216f5c6885cd32d63 upstream.
A handful of tests require physical loopbacks to be used instead of veth pairs. Add a helper that these tests will invoke in order to be skipped when executed with veth pairs.
--- tools/testing/selftests/net/forwarding/lib.sh | 11 +++++++++++ 1 file changed, 11 insertions(+)
tools/testing/selftests/net/forwarding/lib.sh +11 -0
@@ -122,6 +122,17 @@ check_ethtool_lanes_support() fi } +skip_on_veth() +{ + local kind=$(ip -j -d link show dev ${NETIFS[p1]} | + jq -r '.[].linkinfo.info_kind') + + if [[ $kind == veth ]]; then + echo "SKIP: Test cannot be run with veth pairs" + exit $ksft_skip + fi +} + if [[ "$(id -u)" -ne 0 ]]; then echo "SKIP: need root privileges" exit $ksft_skip
Greg Kroah-Hartman
maintainerPATCH 38/89 selftests: forwarding: ethtool: Skip when using veth pairs
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 60a36e21915c31c0375d9427be9406aa8ce2ec34 upstream.
Auto-negotiation cannot be tested with veth pairs, resulting in failures:
# ./ethtool.sh
TEST: force of same speed autoneg off [FAIL]
error in configuration. swp1 speed Not autoneg off
[...]Fix by skipping the test when used with veth pairs.
--- tools/testing/selftests/net/forwarding/ethtool.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/forwarding/ethtool.sh +2 -0
@@ -286,6 +286,8 @@ different_speeds_autoneg_on() ethtool -s $h1 autoneg on } +skip_on_veth + trap cleanup EXIT setup_prepare
Greg Kroah-Hartman
maintainerPATCH 39/89 selftests: forwarding: ethtool_extended_state: Skip when using veth pairs
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit b3d9305e60d121dac20a77b6847c4cf14a4c0001 upstream.
Ethtool extended state cannot be tested with veth pairs, resulting in failures:
# ./ethtool_extended_state.sh
TEST: Autoneg, No partner detected [FAIL]
Expected "Autoneg", got "Link detected: no"
[...]Fix by skipping the test when used with veth pairs.
--- tools/testing/selftests/net/forwarding/ethtool_extended_state.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/forwarding/ethtool_extended_state.sh +2 -0
@@ -95,6 +95,8 @@ no_cable() ip link set dev $swp3 down } +skip_on_veth + setup_prepare tests_run
Greg Kroah-Hartman
maintainerPATCH 40/89 selftests: forwarding: Skip test when no interfaces are specified
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit d72c83b1e4b4a36a38269c77a85ff52f95eb0d08 upstream.
As explained in [1], the forwarding selftests are meant to be run with either physical loopbacks or veth pairs. The interfaces are expected to be specified in a user-provided forwarding.config file or as command line arguments. By default, this file is not present and the tests fail:
# make -C tools/testing/selftests TARGETS=net/forwarding run_tests [...] TAP version 13 1..102 # timeout set to 45 # selftests: net/forwarding: bridge_igmp.sh # Command line is not complete. Try option "help" # Failed to create netif not ok 1 selftests: net/forwarding: bridge_igmp.sh # exit=1 [...]
Fix by skipping a test if interfaces are not provided either via the configuration file or command line arguments.
# make -C tools/testing/selftests TARGETS=net/forwarding run_tests [...] TAP version 13 1..102 # timeout set to 45 # selftests: net/forwarding: bridge_igmp.sh # SKIP: Cannot create interface. Name not specified ok 1 selftests: net/forwarding: bridge_igmp.sh # SKIP
[1] tools/testing/selftests/net/forwarding/README
--- tools/testing/selftests/net/forwarding/lib.sh | 5 +++++ 1 file changed, 5 insertions(+)
tools/testing/selftests/net/forwarding/lib.sh +5 -0
@@ -185,6 +185,11 @@ create_netif_veth() for ((i = 1; i <= NUM_NETIFS; ++i)); do local j=$((i+1)) + if [ -z ${NETIFS[p$i]} ]; then + echo "SKIP: Cannot create interface. Name not specified" + exit $ksft_skip + fi + ip link show dev ${NETIFS[p$i]} &> /dev/null if [[ $? -ne 0 ]]; then ip link add ${NETIFS[p$i]} type veth \
Greg Kroah-Hartman
maintainerPATCH 41/89 selftests: forwarding: Switch off timeout
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 0529883ad102f6c04e19fb7018f31e1bda575bbe upstream.
The default timeout for selftests is 45 seconds, but it is not enough for forwarding selftests which can takes minutes to finish depending on the number of tests cases:
# make -C tools/testing/selftests TARGETS=net/forwarding run_tests TAP version 13 1..102 # timeout set to 45 # selftests: net/forwarding: bridge_igmp.sh # TEST: IGMPv2 report 239.10.10.10 [ OK ] # TEST: IGMPv2 leave 239.10.10.10 [ OK ] # TEST: IGMPv3 report 239.10.10.10 is_include [ OK ] # TEST: IGMPv3 report 239.10.10.10 include -> allow [ OK ] # not ok 1 selftests: net/forwarding: bridge_igmp.sh # TIMEOUT 45 seconds
Fix by switching off the timeout and setting it to 0. A similar change was done for BPF selftests in commit 6fc5916cc256 ("selftests: bpf:
Switch off timeout").
--- tools/testing/selftests/net/forwarding/settings | 1 + 1 file changed, 1 insertion(+) create mode 100644 tools/testing/selftests/net/forwarding/settings
tools/testing/selftests/net/forwarding/settings new file +1 -0
@@ -0,0 +1 @@ +timeout=0
Greg Kroah-Hartman
maintainerPATCH 42/89 selftests: forwarding: tc_flower: Relax success criterion
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 9ee37e53e7687654b487fc94e82569377272a7a8 upstream.
The test checks that filters that match on source or destination MAC were only hit once. A host can send more than one packet with a given source or destination MAC, resulting in failures.
Fix by relaxing the success criterion and instead check that the filters were not hit zero times. Using tc_check_at_least_x_packets() is also an option, but it is not available in older kernels.
--- tools/testing/selftests/net/forwarding/tc_flower.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/net/forwarding/tc_flower.sh +4 -4
@@ -52,8 +52,8 @@ match_dst_mac_test() tc_check_packets "dev $h2 ingress" 101 1 check_fail $? "Matched on a wrong filter" - tc_check_packets "dev $h2 ingress" 102 1 - check_err $? "Did not match on correct filter" + tc_check_packets "dev $h2 ingress" 102 0 + check_fail $? "Did not match on correct filter" tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
@@ -78,8 +78,8 @@ match_src_mac_test() tc_check_packets "dev $h2 ingress" 101 1 check_fail $? "Matched on a wrong filter" - tc_check_packets "dev $h2 ingress" 102 1 - check_err $? "Did not match on correct filter" + tc_check_packets "dev $h2 ingress" 102 0 + check_fail $? "Did not match on correct filter" tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
Greg Kroah-Hartman
maintainerPATCH 43/89 net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail()
In reply to Greg Kroah-HartmanFrom: Andrew Kanner <[email protected]>
commit d14eea09edf427fa36bd446f4a3271f99164202f upstream.
Syzkaller reported the following issue:
=======================================
Too BIG xdp->frame_sz = 131072
WARNING: CPU: 0 PID: 5020 at net/core/filter.c:4121 ____bpf_xdp_adjust_tail net/core/filter.c:4121 [inline] WARNING: CPU: 0 PID: 5020 at net/core/filter.c:4121 bpf_xdp_adjust_tail+0x466/0xa10 net/core/filter.c:4103 ... Call Trace: <TASK> bpf_prog_4add87e5301a4105+0x1a/0x1c __bpf_prog_run include/linux/filter.h:600 [inline] bpf_prog_run_xdp include/linux/filter.h:775 [inline] bpf_prog_run_generic_xdp+0x57e/0x11e0 net/core/dev.c:4721 netif_receive_generic_xdp net/core/dev.c:4807 [inline] do_xdp_generic+0x35c/0x770 net/core/dev.c:4866 tun_get_user+0x2340/0x3ca0 drivers/net/tun.c:1919 tun_chr_write_iter+0xe8/0x210 drivers/net/tun.c:2043 call_write_iter include/linux/fs.h:1871 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x650/0xe40 fs/read_write.c:584 ksys_write+0x12f/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
xdp->frame_sz > PAGE_SIZE check was introduced in commit c8741e2bfe87 ("xdp: Allow bpf_xdp_adjust_tail() to grow packet size"). But Jesper Dangaard Brouer <[email protected]> noted that after introducing the xdp_init_buff() which all XDP driver use - it's safe to remove this check. The original intend was to catch cases where XDP drivers have not been updated to use xdp.frame_sz, but that is not longer a concern (since xdp_init_buff).
Running the initial syzkaller repro it was discovered that the contiguous physical memory allocation is used for both xdp paths in tun_get_user(), e.g. tun_build_skb() and tun_alloc_skb(). It was also stated by Jesper Dangaard Brouer <[email protected]> that XDP can work on higher order pages, as long as this is contiguous physical memory (e.g. a page).
--- net/core/filter.c | 6 ------ 1 file changed, 6 deletions(-)
net/core/filter.c +0 -6
@@ -3843,12 +3843,6 @@ BPF_CALL_2(bpf_xdp_adjust_tail, struct xif (unlikely (data_end > data_hard_end))return -EINVAL ; -/* ALL drivers MUST init xdp->frame_sz, chicken check below */ -if (unlikely (xdp->frame_sz >PAGE_SIZE )) { -WARN_ONCE (1 ,"Too BIG xdp->frame_sz = %d\n" , xdp->frame_sz); -return -EINVAL ; - } -if (unlikely (data_end < xdp->data +ETH_HLEN ))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 44/89 bpf, sockmap: Fix map type error in sock_map_del_link
In reply to Greg Kroah-HartmanFrom: Xu Kuohai <[email protected]>
commit 7e96ec0e6605b69bb21bbf6c0ff9051e656ec2b1 upstream.
sock_map_del_link() operates on both SOCKMAP and SOCKHASH, although both types have member named "progs", the offset of "progs" member in these two types is different, so "progs" should be accessed with the real map type.
--- net/core/sock_map.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/core/sock_map.c +5 -5
@@ -148,13 +148,13 @@ static void sock_map_del_link(struct soclist_for_each_entry_safe (link, tmp, &psock->link, list) {if (link->link_raw == link_raw) {struct bpf_map *map = link->map; - struct bpf_stab *stab = container_of(map, struct bpf_stab, - map); -if (psock->saved_data_ready && stab->progs.stream_parser) +struct sk_psock_progs *progs =sock_map_progs (map); + +if (psock->saved_data_ready && progs->stream_parser) strp_stop = true; -if (psock->saved_data_ready && stab->progs.stream_verdict) +if (psock->saved_data_ready && progs->stream_verdict) verdict_stop = true; -if (psock->saved_data_ready && stab->progs.skb_verdict) +if (psock->saved_data_ready && progs->skb_verdict) verdict_stop = true;list_del (&link->list);sk_psock_free_link (link);
Greg Kroah-Hartman
maintainerPATCH 45/89 bpf, sockmap: Fix bug that strp_done cannot be called
In reply to Greg Kroah-HartmanFrom: Xu Kuohai <[email protected]>
commit 809e4dc71a0f2b8d2836035d98603694fff11d5d upstream.
strp_done is only called when psock->progs.stream_parser is not NULL, but stream_parser was set to NULL by sk_psock_stop_strp(), called by sk_psock_drop() earlier. So, strp_done can never be called.
Introduce SK_PSOCK_RX_ENABLED to mark whether there is strp on psock. Change the condition for calling strp_done from judging whether stream_parser is set to judging whether this flag is set. This flag is only set once when strp_init() succeeds, and will never be cleared later.
--- include/linux/skmsg.h | 1 + net/core/skmsg.c | 10 ++++++++-- 2 files changed, 9 insertions(+), 2 deletions(-)
include/linux/skmsg.h +1 -0
@@ -63,6 +63,7 @@ struct sk_psock_progs {enum sk_psock_state_bits {SK_PSOCK_TX_ENABLED , +SK_PSOCK_RX_STRP_ENABLED , };struct sk_psock_link {
net/core/skmsg.c +8 -2
@@ -1124,13 +1124,19 @@ static void sk_psock_strp_data_ready(strint sk_psock_init_strp (struct sock *sk,struct sk_psock *psock) { +int ret; +static const struct strp_callbacks cb = { .rcv_msg = sk_psock_strp_read, .read_sock_done = sk_psock_strp_read_done, .parse_msg = sk_psock_strp_parse, }; -return strp_init (&psock->strp, sk, &cb); + ret =strp_init (&psock->strp, sk, &cb); +if (!ret) +sk_psock_set_state (psock,SK_PSOCK_RX_STRP_ENABLED ); + +return ret; }void sk_psock_start_strp (struct sock *sk,struct sk_psock *psock)
@@ -1158,7 +1164,7 @@ void sk_psock_stop_strp(struct sock *sk,static void sk_psock_done_strp (struct sk_psock *psock) {/* Parser has been stopped */ -if (psock->progs.stream_parser) +if (sk_psock_test_state (psock,SK_PSOCK_RX_STRP_ENABLED ))strp_done (&psock->strp); }#else
Greg Kroah-Hartman
maintainerPATCH 46/89 mISDN: Update parameter type of dsp_cmx_send()
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 1696ec8654016dad3b1baf6c024303e584400453 upstream.
When booting a kernel with CONFIG_MISDN_DSP=y and CONFIG_CFI_CLANG=y, there is a failure when dsp_cmx_send() is called indirectly from call_timer_fn():
[ 0.371412] CFI failure at call_timer_fn+0x2f/0x150 (target: dsp_cmx_send+0x0/0x530; expected type: 0x92ada1e9)
The function pointer prototype that call_timer_fn() expects is
void (*fn)(struct timer_list *)
whereas dsp_cmx_send() has a parameter type of 'void *', which causes the control flow integrity checks to fail because the parameter types do not match.
Change dsp_cmx_send()'s parameter type to be 'struct timer_list' to match the expected prototype. The argument is unused anyways, so this has no functional change, aside from avoiding the CFI failure.
--- drivers/isdn/mISDN/dsp.h | 2 +- drivers/isdn/mISDN/dsp_cmx.c | 2 +- drivers/isdn/mISDN/dsp_core.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
drivers/isdn/mISDN/dsp.h +1 -1
@@ -247,7 +247,7 @@ extern void dsp_cmx_hardware(struct dsp_extern int dsp_cmx_conf (struct dsp *dsp,u32 conf_id);extern void dsp_cmx_receive (struct dsp *dsp,struct sk_buff *skb);extern void dsp_cmx_hdlc (struct dsp *dsp,struct sk_buff *skb); -extern void dsp_cmx_send (void *arg); +extern void dsp_cmx_send (struct timer_list *arg);extern void dsp_cmx_transmit (struct dsp *dsp,struct sk_buff *skb);extern int dsp_cmx_del_conf_member (struct dsp *dsp);extern int dsp_cmx_del_conf (struct dsp_conf *conf);
drivers/isdn/mISDN/dsp_cmx.c +1 -1
@@ -1625,7 +1625,7 @@ static u16 dsp_count; /* last sample coustatic int dsp_count_valid;/* if we have last sample count */ void -dsp_cmx_send (void *arg) +dsp_cmx_send (struct timer_list *arg) {struct dsp_conf *conf;struct dsp_conf_member *member;
drivers/isdn/mISDN/dsp_core.c +1 -1
@@ -1195,7 +1195,7 @@ static int __init dsp_init(void) }/* set sample timer */ -timer_setup (&dsp_spl_tl, (void *)dsp_cmx_send,0 ); +timer_setup (&dsp_spl_tl, dsp_cmx_send,0 ); dsp_spl_tl.expires = jiffies + dsp_tics; dsp_spl_jiffies = dsp_spl_tl.expires;add_timer (&dsp_spl_tl);
Greg Kroah-Hartman
maintainerPATCH 47/89 net/packet: annotate data-races around tp->status
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 8a9896177784063d01068293caea3f74f6830ff6 upstream.
Another syzbot report [1] is about tp->status lockless reads from __packet_get_status()
[1]
BUG: KCSAN: data-race in __packet_rcv_has_room / __packet_set_status
write to 0xffff888117d7c080 of 8 bytes by interrupt on cpu 0:
__packet_set_status+0x78/0xa0 net/packet/af_packet.c:407 tpacket_rcv+0x18bb/0x1a60 net/packet/af_packet.c:2483 deliver_skb net/core/dev.c:2173 [inline] __netif_receive_skb_core+0x408/0x1e80 net/core/dev.c:5337 __netif_receive_skb_one_core net/core/dev.c:5491 [inline] __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5607 process_backlog+0x21f/0x380 net/core/dev.c:5935 __napi_poll+0x60/0x3b0 net/core/dev.c:6498 napi_poll net/core/dev.c:6565 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6698 __do_softirq+0xc1/0x265 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x57/0xa0 kernel/softirq.c:650 sysvec_apic_timer_interrupt+0x6d/0x80 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 smpboot_thread_fn+0x33c/0x4a0 kernel/smpboot.c:112 kthread+0x1d7/0x210 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
read to 0xffff888117d7c080 of 8 bytes by interrupt on cpu 1:
__packet_get_status net/packet/af_packet.c:436 [inline] packet_lookup_frame net/packet/af_packet.c:524 [inline] __tpacket_has_room net/packet/af_packet.c:1255 [inline] __packet_rcv_has_room+0x3f9/0x450 net/packet/af_packet.c:1298 tpacket_rcv+0x275/0x1a60 net/packet/af_packet.c:2285 deliver_skb net/core/dev.c:2173 [inline] dev_queue_xmit_nit+0x38a/0x5e0 net/core/dev.c:2243 xmit_one net/core/dev.c:3574 [inline] dev_hard_start_xmit+0xcf/0x3f0 net/core/dev.c:3594 __dev_queue_xmit+0xefb/0x1d10 net/core/dev.c:4244 dev_queue_xmit include/linux/netdevice.h:3088 [inline] can_send+0x4eb/0x5d0 net/can/af_can.c:276 bcm_can_tx+0x314/0x410 net/can/bcm.c:302 bcm_tx_timeout_handler+0xdb/0x260 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x217/0x700 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0xd6/0x120 kernel/time/hrtimer.c:1766 __do_softirq+0xc1/0x265 kernel/softirq.c:571 run_ksoftirqd+0x17/0x20 kernel/softirq.c:939 smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164 kthread+0x1d7/0x210 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
value changed: 0x0000000000000000 -> 0x0000000020000081
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 6.4.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
--- net/packet/af_packet.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
net/packet/af_packet.c +10 -6
@@ -368,18 +368,20 @@ static void __packet_set_status(struct p {union tpacket_uhdr h; +/* WRITE_ONCE() are paired with READ_ONCE() in __packet_get_status */ + h.raw = frame;switch (po->tp_version) {case TPACKET_V1 : - h.h1->tp_status = status; +WRITE_ONCE (h.h1->tp_status, status);flush_dcache_page (pgv_to_page (&h.h1->tp_status));break ;case TPACKET_V2 : - h.h2->tp_status = status; +WRITE_ONCE (h.h2->tp_status, status);flush_dcache_page (pgv_to_page (&h.h2->tp_status));break ;case TPACKET_V3 : - h.h3->tp_status = status; +WRITE_ONCE (h.h3->tp_status, status);flush_dcache_page (pgv_to_page (&h.h3->tp_status));break ;default :
@@ -396,17 +398,19 @@ static int __packet_get_status(const strsmp_rmb (); +/* READ_ONCE() are paired with WRITE_ONCE() in __packet_set_status */ + h.raw = frame;switch (po->tp_version) {case TPACKET_V1 :flush_dcache_page (pgv_to_page (&h.h1->tp_status)); -return h.h1->tp_status; +return READ_ONCE (h.h1->tp_status);case TPACKET_V2 :flush_dcache_page (pgv_to_page (&h.h2->tp_status)); -return h.h2->tp_status; +return READ_ONCE (h.h2->tp_status);case TPACKET_V3 :flush_dcache_page (pgv_to_page (&h.h3->tp_status)); -return h.h3->tp_status; +return READ_ONCE (h.h3->tp_status);default :WARN (1 ,"TPACKET version not supported.\n" );BUG ();
Greg Kroah-Hartman
maintainerPATCH 48/89 tunnels: fix kasan splat when generating ipv4 pmtu error
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
commit 6a7ac3d20593865209dceb554d8b3f094c6bd940 upstream.
If we try to emit an icmp error in response to a nonliner skb, we get
BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309 [..] kasan_report+0x105/0x140 ip_compute_csum+0x134/0x220 iptunnel_pmtud_build_icmp+0x554/0x1020 skb_tunnel_check_pmtu+0x513/0xb80 vxlan_xmit_one+0x139e/0x2ef0 vxlan_xmit+0x1867/0x2760 dev_hard_start_xmit+0x1ee/0x4f0 br_dev_queue_push_xmit+0x4d1/0x660 [..]
ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck.
--- net/ipv4/ip_tunnel_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/ip_tunnel_core.c +1 -1
@@ -224,7 +224,7 @@ static int iptunnel_pmtud_build_icmp(str .un.frag.__unused = 0, .un.frag.mtu = htons(mtu), }; - icmph->checksum =ip_compute_csum (icmph, len); + icmph->checksum =csum_fold (skb_checksum (skb,0 , len,0 ));skb_reset_transport_header (skb); niph =skb_push (skb,sizeof (*niph));
Greg Kroah-Hartman
maintainerPATCH 49/89 xsk: fix refcount underflow in error path
In reply to Greg Kroah-HartmanFrom: Magnus Karlsson <[email protected]>
commit 85c2c79a07302fe68a1ad5cc449458cc559e314d upstream.
Fix a refcount underflow problem reported by syzbot that can happen when a system is running out of memory. If xp_alloc_tx_descs() fails, and it can only fail due to not having enough memory, then the error path is triggered. In this error path, the refcount of the pool is decremented as it has incremented before. However, the reference to the pool in the socket was not nulled. This means that when the socket is closed later, the socket teardown logic will think that there is a pool attached to the socket and try to decrease the refcount again, leading to a refcount underflow.
I chose this fix as it involved adding just a single line. Another option would have been to move xp_get_pool() and the assignment of xs->pool to after the if-statement and using xs_umem->pool instead of xs->pool in the whole if-statement resulting in somewhat simpler code, but this would have led to much more churn in the code base perhaps making it harder to backport.
--- net/xdp/xsk.c | 1 + 1 file changed, 1 insertion(+)
net/xdp/xsk.c +1 -0
@@ -1001,6 +1001,7 @@ static int xsk_bind(struct socket *sock, err =xp_alloc_tx_descs (xs->pool, xs);if (err) {xp_put_pool (xs->pool); + xs->pool =NULL ;sockfd_put (sock); goto out_unlock; }
Greg Kroah-Hartman
maintainerPATCH 50/89 bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
In reply to Greg Kroah-HartmanFrom: Ziyang Xuan <[email protected]>
commit 01f4fd27087078c90a0e22860d1dfa2cd0510791 upstream.
BUG_ON(!vlan_info) is triggered in unregister_vlan_dev() with following testcase:
# ip netns add ns1 # ip netns exec ns1 ip link add bond0 type bond mode 0 # ip netns exec ns1 ip link add bond_slave_1 type veth peer veth2 # ip netns exec ns1 ip link set bond_slave_1 master bond0 # ip netns exec ns1 ip link add link bond_slave_1 name vlan10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link add link bond0 name bond0_vlan10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link set bond_slave_1 nomaster # ip netns del ns1
The logical analysis of the problem is as follows:
1. create ETH_P_8021AD protocol vlan10 for bond_slave_1:register_vlan_dev()
vlan_vid_add()
vlan_info_alloc()
__vlan_vid_add() // add [ETH_P_8021AD, 10] vid to bond_slave_12. create ETH_P_8021AD protocol bond0_vlan10 for bond0:register_vlan_dev()
vlan_vid_add()
__vlan_vid_add()
vlan_add_rx_filter_info()
if (!vlan_hw_filter_capable(dev, proto)) // condition established because bond0 without NETIF_F_HW_VLAN_STAG_FILTER
return 0;
if (netif_device_present(dev))
return dev->netdev_ops->ndo_vlan_rx_add_vid(dev, proto, vid); // will be never called
// The slaves of bond0 will not refer to the [ETH_P_8021AD, 10] vid.3. detach bond_slave_1 from bond0:__bond_release_one()
vlan_vids_del_by_dev()
list_for_each_entry(vid_info, &vlan_info->vid_list, list)
vlan_vid_del(dev, vid_info->proto, vid_info->vid);
// bond_slave_1 [ETH_P_8021AD, 10] vid will be deleted.
// bond_slave_1->vlan_info will be assigned NULL.4. delete vlan10 during delete ns1:default_device_exit_batch()
dev->rtnl_link_ops->dellink() // unregister_vlan_dev() for vlan10
vlan_info = rtnl_dereference(real_dev->vlan_info); // real_dev of vlan10 is bond_slave_1 BUG_ON(!vlan_info); // bond_slave_1->vlan_info is NULL now, bug is triggered!!!
Add S-VLAN tag related features support to bond driver. So the bond driver will always propagate the VLAN info to its slaves.
--- drivers/net/bonding/bond_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +3 -1
@@ -5491,7 +5491,9 @@ void bond_setup(struct net_device *bond_ bond_dev->hw_features =BOND_VLAN_FEATURES |NETIF_F_HW_VLAN_CTAG_RX | -NETIF_F_HW_VLAN_CTAG_FILTER ; +NETIF_F_HW_VLAN_CTAG_FILTER | +NETIF_F_HW_VLAN_STAG_RX | +NETIF_F_HW_VLAN_STAG_FILTER ; bond_dev->hw_features |=NETIF_F_GSO_ENCAP_ALL ; bond_dev->features |= bond_dev->hw_features;
Greg Kroah-Hartman
maintainerPATCH 51/89 dccp: fix data-race around dp->dccps_mss_cache
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit a47e598fbd8617967e49d85c49c22f9fc642704c upstream.
dccp_sendmsg() reads dp->dccps_mss_cache before locking the socket. Same thing in do_dccp_getsockopt().
Add READ_ONCE()/WRITE_ONCE() annotations,
and change dccp_sendmsg() to check again dccps_mss_cache after socket is locked.
--- net/dccp/output.c | 2 +- net/dccp/proto.c | 10 ++++++++-- 2 files changed, 9 insertions(+), 3 deletions(-)
net/dccp/output.c +1 -1
@@ -187,7 +187,7 @@ unsigned int dccp_sync_mss(struct sock */* And store cached results */ icsk->icsk_pmtu_cookie = pmtu; - dp->dccps_mss_cache = cur_mps; +WRITE_ONCE (dp->dccps_mss_cache, cur_mps);return cur_mps; }
net/dccp/proto.c +8 -2
@@ -639,7 +639,7 @@ static int do_dccp_getsockopt(struct socreturn dccp_getsockopt_service (sk, len, (__be32 __user *)optval, optlen);case DCCP_SOCKOPT_GET_CUR_MPS : - val = dp->dccps_mss_cache; + val =READ_ONCE (dp->dccps_mss_cache);break ;case DCCP_SOCKOPT_AVAILABLE_CCIDS :return ccid_getsockopt_builtin_ccids (sk, len, optval, optlen);
@@ -748,7 +748,7 @@ int dccp_sendmsg(struct sock *sk, structtrace_dccp_probe (sk, len); -if (len > dp->dccps_mss_cache) +if (len >READ_ONCE (dp->dccps_mss_cache))return -EMSGSIZE ;lock_sock (sk);
@@ -781,6 +781,12 @@ int dccp_sendmsg(struct sock *sk, struct goto out_discard; } +/* We need to check dccps_mss_cache after socket is locked. */ +if (len > dp->dccps_mss_cache) { + rc = -EMSGSIZE ; + goto out_discard; + } +skb_reserve (skb, sk->sk_prot->max_header); rc =memcpy_from_msg (skb_put (skb, len), msg, len);if (rc !=0 )
Greg Kroah-Hartman
maintainerPATCH 52/89 drivers: net: prevent tun_build_skb() to exceed the packet size limit
In reply to Greg Kroah-HartmanFrom: Andrew Kanner <[email protected]>
commit 59eeb232940515590de513b997539ef495faca9a upstream.
Using the syzkaller repro with reduced packet size it was discovered that XDP_PACKET_HEADROOM is not checked in tun_can_build_skb(), although pad may be incremented in tun_build_skb(). This may end up with exceeding the PAGE_SIZE limit in tun_build_skb().
Jason Wang <[email protected]> proposed to count XDP_PACKET_HEADROOM always (e.g. without rcu_access_pointer(tun->xdp_prog)) in tun_can_build_skb() since there's a window during which XDP program might be attached between tun_can_build_skb() and tun_build_skb().
--- drivers/net/tun.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/tun.c +1 -1
@@ -1574,7 +1574,7 @@ static bool tun_can_build_skb(struct tunif (zerocopy)return false; -if (SKB_DATA_ALIGN (len +TUN_RX_PAD ) + +if (SKB_DATA_ALIGN (len +TUN_RX_PAD +XDP_PACKET_HEADROOM ) +SKB_DATA_ALIGN (sizeof (struct skb_shared_info )) >PAGE_SIZE )return false;
Greg Kroah-Hartman
maintainerPATCH 53/89 iavf: fix potential races for FDIR filters
In reply to Greg Kroah-HartmanFrom: Piotr Gardocki <[email protected]>
commit 0fb1d8eb234b6979d4981d2d385780dd7d8d9771 upstream.
Add fdir_fltr_lock locking in unprotected places.
The change in iavf_fdir_is_dup_fltr adds a spinlock around a loop which iterates over all filters and looks for a duplicate. The filter can be removed from list and freed from memory at the same time it's being compared. All other places where filters are deleted are already protected with spinlock.
The remaining changes protect adapter->fdir_active_fltr variable so now all its uses are under a spinlock.
--- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 5 ++++- drivers/net/ethernet/intel/iavf/iavf_fdir.c | 11 ++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/iavf/iavf_ethtool.c +4 -1
@@ -1387,14 +1387,15 @@ static int iavf_add_fdir_ethtool(structif (fsp->flow_type &FLOW_MAC_EXT )return -EINVAL ; +spin_lock_bh (&adapter->fdir_fltr_lock);if (adapter->fdir_active_fltr >=IAVF_MAX_FDIR_FILTERS ) { +spin_unlock_bh (&adapter->fdir_fltr_lock);dev_err (&adapter->pdev->dev,"Unable to add Flow Director filter because VF reached the limit of max allowed filters (%u)\n" ,IAVF_MAX_FDIR_FILTERS );return -ENOSPC ; } -spin_lock_bh (&adapter->fdir_fltr_lock);if (iavf_find_fdir_fltr_by_loc (adapter, fsp->location)) {dev_err (&adapter->pdev->dev,"Failed to add Flow Director filter, it already exists\n" );spin_unlock_bh (&adapter->fdir_fltr_lock);
@@ -1767,7 +1768,9 @@ static int iavf_get_rxnfc(struct net_devcase ETHTOOL_GRXCLSRLCNT :if (!FDIR_FLTR_SUPPORT (adapter))break ; +spin_lock_bh (&adapter->fdir_fltr_lock); cmd->rule_cnt = adapter->fdir_active_fltr; +spin_unlock_bh (&adapter->fdir_fltr_lock); cmd->data =IAVF_MAX_FDIR_FILTERS ; ret =0 ;break ;
drivers/net/ethernet/intel/iavf/iavf_fdir.c +8 -3
@@ -722,7 +722,9 @@ void iavf_print_fdir_fltr(struct iavf_adbool iavf_fdir_is_dup_fltr (struct iavf_adapter *adapter,struct iavf_fdir_fltr *fltr) {struct iavf_fdir_fltr *tmp; +bool ret = false; +spin_lock_bh (&adapter->fdir_fltr_lock);list_for_each_entry (tmp, &adapter->fdir_list_head, list) {if (tmp->flow_type != fltr->flow_type)continue ;
@@ -732,11 +734,14 @@ bool iavf_fdir_is_dup_fltr(struct iavf_a !memcmp(&tmp->ip_data, &fltr->ip_data, sizeof(fltr->ip_data)) && !memcmp(&tmp->ext_data, &fltr->ext_data, - sizeof(fltr->ext_data))) - return true; + sizeof(fltr->ext_data))) { + ret = true; +break ; + } } +spin_unlock_bh (&adapter->fdir_fltr_lock); -return false; +return ret; }/**
Greg Kroah-Hartman
maintainerPATCH 54/89 IB/hfi1: Fix possible panic during hotplug remove
In reply to Greg Kroah-HartmanFrom: Douglas Miller <[email protected]>
commit 4fdfaef71fced490835145631a795497646f4555 upstream.
During hotplug remove it is possible that the update counters work might be pending, and may run after memory has been freed. Cancel the update counters work before freeing memory.
--- drivers/infiniband/hw/hfi1/chip.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/hfi1/chip.c +1 -0
@@ -12306,6 +12306,7 @@ static void free_cntrs(struct hfi1_devdaif (dd->synth_stats_timer.function)del_timer_sync (&dd->synth_stats_timer); +cancel_work_sync (&dd->update_cntr_work); ppd = (struct hfi1_pportdata *)(dd +1 );for (i =0 ; i < dd->num_pports; i++, ppd++) {kfree (ppd->cntrs);
Greg Kroah-Hartman
maintainerPATCH 55/89 drm/rockchip: Dont spam logs in atomic check
In reply to Greg Kroah-HartmanFrom: Daniel Stone <[email protected]>
commit 43dae319b50fac075ad864f84501c703ef20eb2b upstream.
Userspace should not be able to trigger DRM_ERROR messages to spam the logs; especially not through atomic commit parameters which are completely legitimate for userspace to attempt.
--- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/gpu/drm/rockchip/rockchip_drm_vop.c +9 -8
@@ -820,12 +820,12 @@ static int vop_plane_atomic_check(struct* need align with 2 pixel. */ if (fb->format->is_yuv && ((new_plane_state->src.x1 >>16 ) %2 )) { -DRM_ERROR ("Invalid Source: Yuv format not support odd xpos\n" ); +DRM_DEBUG_KMS ("Invalid Source: Yuv format not support odd xpos\n" );return -EINVAL ; }if (fb->format->is_yuv && new_plane_state->rotation &DRM_MODE_REFLECT_Y ) { -DRM_ERROR ("Invalid Source: Yuv format does not support this rotation\n" ); +DRM_DEBUG_KMS ("Invalid Source: Yuv format does not support this rotation\n" );return -EINVAL ; }
@@ -833,7 +833,7 @@ static int vop_plane_atomic_check(structstruct vop *vop =to_vop (crtc);if (!vop->data->afbc) { -DRM_ERROR ("vop does not support AFBC\n" ); +DRM_DEBUG_KMS ("vop does not support AFBC\n" );return -EINVAL ; }
@@ -842,15 +842,16 @@ static int vop_plane_atomic_check(structreturn ret;if (new_plane_state->src.x1 || new_plane_state->src.y1) { -DRM_ERROR ("AFBC does not support offset display, xpos=%d, ypos=%d, offset=%d\n" , - new_plane_state->src.x1, - new_plane_state->src.y1, fb->offsets[0 ]); +DRM_DEBUG_KMS ("AFBC does not support offset display, " \ +"xpos=%d, ypos=%d, offset=%d\n" , + new_plane_state->src.x1, new_plane_state->src.y1, + fb->offsets[0 ]);return -EINVAL ; }if (new_plane_state->rotation && new_plane_state->rotation !=DRM_MODE_ROTATE_0 ) { -DRM_ERROR ("No rotation support in AFBC, rotation=%d\n" , - new_plane_state->rotation); +DRM_DEBUG_KMS ("No rotation support in AFBC, rotation=%d\n" , + new_plane_state->rotation);return -EINVAL ; } }
Greg Kroah-Hartman
maintainerPATCH 56/89 wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
commit 5fb9a9fb71a33be61d7d8e8ba4597bfb18d604d0 upstream.
AP_VLAN interfaces are virtual, so doesn't really exist as a type for capabilities. When passed in as a type, AP is the one that's really intended.
--- include/net/cfg80211.h | 3 +++ 1 file changed, 3 insertions(+)
include/net/cfg80211.h +3 -0
@@ -510,6 +510,9 @@ ieee80211_get_sband_iftype_data(const stif (WARN_ON (iftype >=NL80211_IFTYPE_MAX ))return NULL ; +if (iftype ==NL80211_IFTYPE_AP_VLAN ) + iftype =NL80211_IFTYPE_AP ; +for (i =0 ; i < sband->n_iftype_data; i++) {const struct ieee80211_sband_iftype_data *data = &sband->iftype_data[i];
Greg Kroah-Hartman
maintainerPATCH 57/89 RDMA/umem: Set iova in ODP flow
In reply to Greg Kroah-HartmanFrom: Michael Guralnik <[email protected]>
commit 186b169cf1e4be85aa212a893ea783a543400979 upstream.
Fixing the ODP registration flow to set the iova correctly. The calculation in ib_umem_num_dma_blocks() function assumes the iova of the umem is set correctly.
When iova is not set, the calculation in ib_umem_num_dma_blocks() is equivalent to length/page_size, which is true only when memory is aligned. For unaligned memory, iova must be set for the ALIGN() in the ib_umem_num_dma_blocks() to take effect and return a correct value.
mlx5_ib uses ib_umem_num_dma_blocks() to decide the mkey size to use for the MR. Without this fix, when registering unaligned ODP MR, a wrong size mkey might be chosen and this might cause the UMR to fail.
UMR would fail over insufficient size to update the mkey translation:
infiniband mlx5_0: dump_cqe:273:(pid 0): dump error cqe 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000030: 00 00 00 00 0f 00 78 06 25 00 00 58 00 da ac d2 infiniband mlx5_0: mlx5_ib_post_send_wait:806:(pid 20311): reg umr failed (6)
infiniband mlx5_0: pagefault_real_mr:661:(pid 20311): Failed to update mkey page tables
--- drivers/infiniband/core/umem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/core/umem.c +2 -1
@@ -85,6 +85,8 @@ unsigned long ib_umem_find_best_pgsz(strdma_addr_t mask;int i; + umem->iova = va = virt; +if (umem->is_odp) {unsigned int page_size =BIT (to_ib_umem_odp (umem)->page_shift);
@@ -100,7 +102,6 @@ unsigned long ib_umem_find_best_pgsz(str*/ pgsz_bitmap &=GENMASK (BITS_PER_LONG -1 ,PAGE_SHIFT ); - umem->iova = va = virt;/* The best result is the smallest page size that results in the minimum * number of required pages. Compute the largest page size that could * work based on VA address bits that don't change.
Greg Kroah-Hartman
maintainerPATCH 58/89 net: phy: at803x: remove set/get wol callbacks for AR8032
In reply to Greg Kroah-HartmanFrom: Li Yang <[email protected]>
commit d7791cec2304aea22eb2ada944e4d467302f5bfe upstream.
Since the AR8032 part does not support wol, remove related callbacks from it.
--- drivers/net/phy/at803x.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/phy/at803x.c +0 -2
@@ -1375,8 +1375,6 @@ static struct phy_driver at803x_driver[] .flags = PHY_POLL_CABLE_TEST, .config_init = at803x_config_init, .link_change_notify = at803x_link_change_notify, - .set_wol = at803x_set_wol, - .get_wol = at803x_get_wol, .suspend = at803x_suspend, .resume = at803x_resume,/* PHY_BASIC_FEATURES */
Greg Kroah-Hartman
maintainerPATCH 59/89 net: hns3: refactor hclge_mac_link_status_wait for interface reuse
In reply to Greg Kroah-HartmanFrom: Jie Wang <[email protected]>
commit 08469dacfad25428b66549716811807203744f4f upstream.
Some nic configurations could only be performed after link is down. So this patch refactor this API for reuse.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +9 -5
@@ -70,6 +70,8 @@ static void hclge_sync_mac_table(structstatic void hclge_restore_hw_table (struct hclge_dev *hdev);static void hclge_sync_promisc_mode (struct hclge_dev *hdev);static void hclge_sync_fd_table (struct hclge_dev *hdev); +static int hclge_mac_link_status_wait (struct hclge_dev *hdev,int link_ret, +int wait_cnt);static struct hnae3_ae_algo ae_algo;
@@ -7745,10 +7747,9 @@ static void hclge_phy_link_status_wait(s }while (++i <HCLGE_PHY_LINK_STATUS_NUM ); } -static int hclge_mac_link_status_wait (struct hclge_dev *hdev,int link_ret) +static int hclge_mac_link_status_wait (struct hclge_dev *hdev,int link_ret, +int wait_cnt) { -#define HCLGE_MAC_LINK_STATUS_NUM 100 -int link_status;int i =0 ;int ret;
@@ -7761,13 +7762,15 @@ static int hclge_mac_link_status_wait(streturn 0 ;msleep (HCLGE_LINK_STATUS_MS ); - }while (++i <HCLGE_MAC_LINK_STATUS_NUM ); + }while (++i < wait_cnt);return -EBUSY ; }static int hclge_mac_phy_link_status_wait (struct hclge_dev *hdev,bool en,bool is_phy) { +#define HCLGE_MAC_LINK_STATUS_NUM 100 +int link_ret; link_ret = en ?HCLGE_LINK_STATUS_UP :HCLGE_LINK_STATUS_DOWN ;
@@ -7775,7 +7778,8 @@ static int hclge_mac_phy_link_status_waiif (is_phy)hclge_phy_link_status_wait (hdev, link_ret); -return hclge_mac_link_status_wait (hdev, link_ret); +return hclge_mac_link_status_wait (hdev, link_ret, +HCLGE_MAC_LINK_STATUS_NUM ); }static int hclge_set_app_loopback (struct hclge_dev *hdev,bool en)
Greg Kroah-Hartman
maintainerPATCH 60/89 net: hns3: add wait until mac link down
In reply to Greg Kroah-HartmanFrom: Jie Wang <[email protected]>
commit 6265e242f7b95f2c1195b42ec912b84ad161470e upstream.
In some configure flow of hns3 driver, for example, change mtu, it will disable MAC through firmware before configuration. But firmware disables MAC asynchronously. The rx traffic may be not stopped in this case.
So fixes it by waiting until mac link is down.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +9 -1
@@ -7658,6 +7658,8 @@ static void hclge_enable_fd(struct hnae3static void hclge_cfg_mac_mode (struct hclge_dev *hdev,bool enable) { +#define HCLGE_LINK_STATUS_WAIT_CNT 3 +struct hclge_desc desc;struct hclge_config_mac_mode_cmd *req = (struct hclge_config_mac_mode_cmd *)desc.data;
@@ -7682,9 +7684,15 @@ static void hclge_cfg_mac_mode(struct hc req->txrx_pad_fcs_loop_en =cpu_to_le32 (loop_en); ret =hclge_cmd_send (&hdev->hw, &desc,1 ); -if (ret) +if (ret) {dev_err (&hdev->pdev->dev,"mac enable fail, ret =%d.\n" , ret); +return ; + } + +if (!enable) +hclge_mac_link_status_wait (hdev,HCLGE_LINK_STATUS_DOWN , +HCLGE_LINK_STATUS_WAIT_CNT ); } static int hclge_config_switch_param(struct hclge_dev *hdev, int vfid,
Greg Kroah-Hartman
maintainerPATCH 61/89 nexthop: Fix infinite nexthop dump when using maximum nexthop ID
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 913f60cacda73ccac8eead94983e5884c03e04cd upstream.
A netlink dump callback can return a positive number to signal that more information needs to be dumped or zero to signal that the dump is complete. In the second case, the core netlink code will append the NLMSG_DONE message to the skb in order to indicate to user space that the dump is complete.
The nexthop dump callback always returns a positive number if nexthops were filled in the provided skb, even if the dump is complete. This means that a dump will span at least two recvmsg() calls as long as nexthops are present. In the last recvmsg() call the dump callback will not fill in any nexthops because the previous call indicated that the dump should restart from the last dumped nexthop ID plus one.
# ip nexthop add id 1 blackhole
# strace -e sendto,recvmsg -s 5 ip nexthop
sendto(3, [[{nlmsg_len=24, nlmsg_type=RTM_GETNEXTHOP, nlmsg_flags=NLM_F_REQUEST|NLM_F_DUMP, nlmsg_seq=1691394315, nlmsg_pid=0}, {nh_family=AF_UNSPEC, nh_scope=RT_SCOPE_UNIVERSE, nh_protocol=RTPROT_UNSPEC, nh_flags=0}], {nlmsg_len=0, nlmsg_type=0 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=0}], 152, 0, NULL, 0) = 152
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=NULL, iov_len=0}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_TRUNC}, MSG_PEEK|MSG_TRUNC) = 36
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{nlmsg_len=36, nlmsg_type=RTM_NEWNEXTHOP, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691394315, nlmsg_pid=343}, {nh_family=AF_INET, nh_scope=RT_SCOPE_UNIVERSE, nh_protocol=RTPROT_UNSPEC, nh_flags=0}, [[{nla_len=8, nla_type=NHA_ID}, 1], {nla_len=4, nla_type=NHA_BLACKHOLE}]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 36
id 1 blackhole
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=NULL, iov_len=0}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_TRUNC}, MSG_PEEK|MSG_TRUNC) = 20
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NLMSG_DONE, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691394315, nlmsg_pid=343}, 0], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20
+++ exited with 0 +++This behavior is both inefficient and buggy. If the last nexthop to be dumped had the maximum ID of 0xffffffff, then the dump will restart from 0 (0xffffffff + 1) and never end:
# ip nexthop add id $((2**32-1)) blackhole # ip nexthop id 4294967295 blackhole id 4294967295 blackhole [...]
Fix by adjusting the dump callback to return zero when the dump is complete. After the fix only one recvmsg() call is made and the NLMSG_DONE message is appended to the RTM_NEWNEXTHOP response:
# ip nexthop add id $((2**32-1)) blackhole
# strace -e sendto,recvmsg -s 5 ip nexthop
sendto(3, [[{nlmsg_len=24, nlmsg_type=RTM_GETNEXTHOP, nlmsg_flags=NLM_F_REQUEST|NLM_F_DUMP, nlmsg_seq=1691394080, nlmsg_pid=0}, {nh_family=AF_UNSPEC, nh_scope=RT_SCOPE_UNIVERSE, nh_protocol=RTPROT_UNSPEC, nh_flags=0}], {nlmsg_len=0, nlmsg_type=0 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=0}], 152, 0, NULL, 0) = 152
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=NULL, iov_len=0}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_TRUNC}, MSG_PEEK|MSG_TRUNC) = 56
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[[{nlmsg_len=36, nlmsg_type=RTM_NEWNEXTHOP, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691394080, nlmsg_pid=342}, {nh_family=AF_INET, nh_scope=RT_SCOPE_UNIVERSE, nh_protocol=RTPROT_UNSPEC, nh_flags=0}, [[{nla_len=8, nla_type=NHA_ID}, 4294967295], {nla_len=4, nla_type=NHA_BLACKHOLE}]], [{nlmsg_len=20, nlmsg_type=NLMSG_DONE, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691394080, nlmsg_pid=342}, 0]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 56
id 4294967295 blackhole
+++ exited with 0 +++Note that if the NLMSG_DONE message cannot be appended because of size limitations, then another recvmsg() will be needed, but the core netlink code will not invoke the dump callback and simply reply with a NLMSG_DONE message since it knows that the callback previously returned zero.
Add a test that fails before the fix:
# ./fib_nexthops.sh -t basic [...] TEST: Maximum nexthop ID dump [FAIL] [...]
And passes after it:
# ./fib_nexthops.sh -t basic [...] TEST: Maximum nexthop ID dump [ OK ] [...]
--- net/ipv4/nexthop.c | 6 +----- tools/testing/selftests/net/fib_nexthops.sh | 5 +++++ 2 files changed, 6 insertions(+), 5 deletions(-)
net/ipv4/nexthop.c +1 -5
@@ -3222,13 +3222,9 @@ static int rtm_dump_nexthop(struct sk_bu &rtm_dump_nexthop_cb, &filter);if (err <0 ) {if (likely (skb->len)) - goto out; - goto out_err; + err = skb->len; } -out: - err = skb->len; -out_err: cb->seq = net->nexthop.seq;nl_dump_check_consistent (cb,nlmsg_hdr (skb));return err;
tools/testing/selftests/net/fib_nexthops.sh +5 -0
@@ -1917,6 +1917,11 @@ basic() run_cmd "$IP link set dev lo up" + # Dump should not loop endlessly when maximum nexthop ID is configured. + run_cmd "$IP nexthop add id $((2**32-1)) blackhole" + run_cmd "timeout 5 $IP nexthop" + log_test $? 0 "Maximum nexthop ID dump" + # # groups #
Greg Kroah-Hartman
maintainerPATCH 62/89 nexthop: Make nexthop bucket dump more efficient
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit f10d3d9df49d9e6ee244fda6ca264f901a9c5d85 upstream.
rtm_dump_nexthop_bucket_nh() is used to dump nexthop buckets belonging to a specific resilient nexthop group. The function returns a positive return code (the skb length) upon both success and failure.
The above behavior is problematic. When a complete nexthop bucket dump is requested, the function that walks the different nexthops treats the non-zero return code as an error. This causes buckets belonging to different resilient nexthop groups to be dumped using different buffers even if they can all fit in the same buffer:
# ip link add name dummy1 up type dummy
# ip nexthop add id 1 dev dummy1
# ip nexthop add id 10 group 1 type resilient buckets 1
# ip nexthop add id 20 group 1 type resilient buckets 1
# strace -e recvmsg -s 0 ip nexthop bucket
[...]
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[...], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 64
id 10 index 0 idle_time 10.27 nhid 1
[...]
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[...], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 64
id 20 index 0 idle_time 6.44 nhid 1
[...]Fix by only returning a non-zero return code when an error occurred and restarting the dump from the bucket index we failed to fill in. This allows buckets belonging to different resilient nexthop groups to be dumped using the same buffer:
# ip link add name dummy1 up type dummy
# ip nexthop add id 1 dev dummy1
# ip nexthop add id 10 group 1 type resilient buckets 1
# ip nexthop add id 20 group 1 type resilient buckets 1
# strace -e recvmsg -s 0 ip nexthop bucket
[...]
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[...], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 128
id 10 index 0 idle_time 30.21 nhid 1
id 20 index 0 idle_time 26.7 nhid 1
[...]While this change is more of a performance improvement change than an actual bug fix, it is a prerequisite for a subsequent patch that does fix a bug.
--- net/ipv4/nexthop.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
net/ipv4/nexthop.c +5 -11
@@ -3364,25 +3364,19 @@ static int rtm_dump_nexthop_bucket_nh(st dd->filter.res_bucket_nh_id != nhge->nh->id) continue; + dd->ctx->bucket_index = bucket_index; err =nh_fill_res_bucket (skb, nh, bucket, bucket_index,RTM_NEWNEXTHOPBUCKET , portid, cb->nlh->nlmsg_seq,NLM_F_MULTI , cb->extack); -if (err <0 ) { -if (likely (skb->len)) - goto out; - goto out_err; - } +if (err) +return err; } dd->ctx->done_nh_idx = dd->ctx->nh.idx +1 ; - bucket_index =0 ; + dd->ctx->bucket_index =0 ; -out: - err = skb->len; -out_err: - dd->ctx->bucket_index = bucket_index; -return err; +return 0 ; } static int rtm_dump_nexthop_bucket_cb(struct sk_buff *skb,
Greg Kroah-Hartman
maintainerPATCH 63/89 nexthop: Fix infinite nexthop bucket dump when using maximum nexthop ID
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 8743aeff5bc4dcb5b87b43765f48d5ac3ad7dd9f upstream.
A netlink dump callback can return a positive number to signal that more information needs to be dumped or zero to signal that the dump is complete. In the second case, the core netlink code will append the NLMSG_DONE message to the skb in order to indicate to user space that the dump is complete.
The nexthop bucket dump callback always returns a positive number if nexthop buckets were filled in the provided skb, even if the dump is complete. This means that a dump will span at least two recvmsg() calls as long as nexthop buckets are present. In the last recvmsg() call the dump callback will not fill in any nexthop buckets because the previous call indicated that the dump should restart from the last dumped nexthop ID plus one.
# ip link add name dummy1 up type dummy
# ip nexthop add id 1 dev dummy1
# ip nexthop add id 10 group 1 type resilient buckets 2
# strace -e sendto,recvmsg -s 5 ip nexthop bucket
sendto(3, [[{nlmsg_len=24, nlmsg_type=RTM_GETNEXTHOPBUCKET, nlmsg_flags=NLM_F_REQUEST|NLM_F_DUMP, nlmsg_seq=1691396980, nlmsg_pid=0}, {family=AF_UNSPEC, data="\x00\x00\x00\x00\x00"...}], {nlmsg_len=0, nlmsg_type=0 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=0}], 152, 0, NULL, 0) = 152
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=NULL, iov_len=0}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_TRUNC}, MSG_PEEK|MSG_TRUNC) = 128
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[[{nlmsg_len=64, nlmsg_type=RTM_NEWNEXTHOPBUCKET, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691396980, nlmsg_pid=347}, {family=AF_UNSPEC, data="\x00\x00\x00\x00\x00"...}], [{nlmsg_len=64, nlmsg_type=RTM_NEWNEXTHOPBUCKET, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691396980, nlmsg_pid=347}, {family=AF_UNSPEC, data="\x00\x00\x00\x00\x00"...}]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 128
id 10 index 0 idle_time 6.66 nhid 1
id 10 index 1 idle_time 6.66 nhid 1
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=NULL, iov_len=0}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_TRUNC}, MSG_PEEK|MSG_TRUNC) = 20
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NLMSG_DONE, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691396980, nlmsg_pid=347}, 0], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20
+++ exited with 0 +++This behavior is both inefficient and buggy. If the last nexthop to be dumped had the maximum ID of 0xffffffff, then the dump will restart from 0 (0xffffffff + 1) and never end:
# ip link add name dummy1 up type dummy # ip nexthop add id 1 dev dummy1 # ip nexthop add id $((2**32-1)) group 1 type resilient buckets 2 # ip nexthop bucket id 4294967295 index 0 idle_time 5.55 nhid 1 id 4294967295 index 1 idle_time 5.55 nhid 1 id 4294967295 index 0 idle_time 5.55 nhid 1 id 4294967295 index 1 idle_time 5.55 nhid 1 [...]
Fix by adjusting the dump callback to return zero when the dump is complete. After the fix only one recvmsg() call is made and the NLMSG_DONE message is appended to the RTM_NEWNEXTHOPBUCKET responses:
# ip link add name dummy1 up type dummy
# ip nexthop add id 1 dev dummy1
# ip nexthop add id $((2**32-1)) group 1 type resilient buckets 2
# strace -e sendto,recvmsg -s 5 ip nexthop bucket
sendto(3, [[{nlmsg_len=24, nlmsg_type=RTM_GETNEXTHOPBUCKET, nlmsg_flags=NLM_F_REQUEST|NLM_F_DUMP, nlmsg_seq=1691396737, nlmsg_pid=0}, {family=AF_UNSPEC, data="\x00\x00\x00\x00\x00"...}], {nlmsg_len=0, nlmsg_type=0 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=0}], 152, 0, NULL, 0) = 152
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=NULL, iov_len=0}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_TRUNC}, MSG_PEEK|MSG_TRUNC) = 148
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[[{nlmsg_len=64, nlmsg_type=RTM_NEWNEXTHOPBUCKET, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691396737, nlmsg_pid=350}, {family=AF_UNSPEC, data="\x00\x00\x00\x00\x00"...}], [{nlmsg_len=64, nlmsg_type=RTM_NEWNEXTHOPBUCKET, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691396737, nlmsg_pid=350}, {family=AF_UNSPEC, data="\x00\x00\x00\x00\x00"...}], [{nlmsg_len=20, nlmsg_type=NLMSG_DONE, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691396737, nlmsg_pid=350}, 0]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 148
id 4294967295 index 0 idle_time 6.61 nhid 1
id 4294967295 index 1 idle_time 6.61 nhid 1
+++ exited with 0 +++Note that if the NLMSG_DONE message cannot be appended because of size limitations, then another recvmsg() will be needed, but the core netlink code will not invoke the dump callback and simply reply with a NLMSG_DONE message since it knows that the callback previously returned zero.
Add a test that fails before the fix:
# ./fib_nexthops.sh -t basic_res [...] TEST: Maximum nexthop ID dump [FAIL] [...]
And passes after it:
# ./fib_nexthops.sh -t basic_res [...] TEST: Maximum nexthop ID dump [ OK ] [...]
--- net/ipv4/nexthop.c | 6 +----- tools/testing/selftests/net/fib_nexthops.sh | 5 +++++ 2 files changed, 6 insertions(+), 5 deletions(-)
net/ipv4/nexthop.c +1 -5
@@ -3425,13 +3425,9 @@ static int rtm_dump_nexthop_bucket(strucif (err <0 ) {if (likely (skb->len)) - goto out; - goto out_err; + err = skb->len; } -out: - err = skb->len; -out_err: cb->seq = net->nexthop.seq;nl_dump_check_consistent (cb,nlmsg_hdr (skb));return err;
tools/testing/selftests/net/fib_nexthops.sh +5 -0
@@ -2142,6 +2142,11 @@ basic_res() run_cmd "$IP nexthop bucket list fdb" log_test $? 255 "Dump all nexthop buckets with invalid 'fdb' keyword" + # Dump should not loop endlessly when maximum nexthop ID is configured. + run_cmd "$IP nexthop add id $((2**32-1)) group 1/2 type resilient buckets 4" + run_cmd "timeout 5 $IP nexthop bucket" + log_test $? 0 "Maximum nexthop ID dump" + # # resilient nexthop buckets get requests #
Greg Kroah-Hartman
maintainerPATCH 64/89 dmaengine: mcf-edma: Fix a potential un-allocated memory access
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit 0a46781c89dece85386885a407244ca26e5c1c44 upstream.
When 'mcf_edma' is allocated, some space is allocated for a flexible array at the end of the struct. 'chans' item are allocated, that is to say 'pdata->dma_channels'.
Then, this number of item is stored in 'mcf_edma->n_chans'.
A few lines later, if 'mcf_edma->n_chans' is 0, then a default value of 64 is set.
This ends to no space allocated by devm_kzalloc() because chans was 0, but 64 items are read and/or written in some not allocated memory.
Change the logic to define a default value before allocating the memory.
--- drivers/dma/mcf-edma.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/dma/mcf-edma.c +7 -6
@@ -191,7 +191,13 @@ static int mcf_edma_probe(struct platforreturn -EINVAL ; } - chans = pdata->dma_channels; +if (!pdata->dma_channels) { +dev_info (&pdev->dev,"setting default channel number to 64" ); + chans =64 ; + }else { + chans = pdata->dma_channels; + } + len =sizeof (*mcf_edma) +sizeof (*mcf_chan) * chans; mcf_edma =devm_kzalloc (&pdev->dev, len,GFP_KERNEL );if (!mcf_edma)
@@ -203,11 +209,6 @@ static int mcf_edma_probe(struct platfor mcf_edma->drvdata = &mcf_data; mcf_edma->big_endian =1 ; -if (!mcf_edma->n_chans) { -dev_info (&pdev->dev,"setting default channel number to 64" ); - mcf_edma->n_chans =64 ; - } -mutex_init (&mcf_edma->fsl_edma_mutex); res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );
Greg Kroah-Hartman
maintainerPATCH 65/89 net/mlx5: Allow 0 for total host VFs
In reply to Greg Kroah-HartmanFrom: Daniel Jurgens <[email protected]>
commit 2dc2b3922d3c0f52d3a792d15dcacfbc4cc76b8f upstream.
When querying eswitch functions 0 is a valid number of host VFs. After introducing ARM SRIOV falling through to getting the max value from PCI results in using the total VFs allowed on the ARM for the host.
--- drivers/net/ethernet/mellanox/mlx5/core/sriov.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/sriov.c +1 -2
@@ -256,8 +256,7 @@ static u16 mlx5_get_max_vfs(struct mlx5_ host_total_vfs =MLX5_GET (query_esw_functions_out, out, host_params_context.host_total_vfs);kvfree (out); -if (host_total_vfs) -return host_total_vfs; +return host_total_vfs; } done:
Greg Kroah-Hartman
maintainerPATCH 66/89 net/mlx5: Skip clock update work when device is in error state
In reply to Greg Kroah-HartmanFrom: Moshe Shemesh <[email protected]>
commit d006207625657322ba8251b6e7e829f9659755dc upstream.
When device is in error state, marked by the flag MLX5_DEVICE_STATE_INTERNAL_ERROR, the HW and PCI may not be accessible and so clock update work should be skipped. Furthermore, such access through PCI in error state, after calling mlx5_pci_disable_device() can result in failing to recover from pci errors.
--- drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +5 -0
@@ -189,10 +189,15 @@ static void mlx5_timestamp_overflow(stru clock = container_of(timer, struct mlx5_clock, timer); mdev = container_of(clock, struct mlx5_core_dev, clock); +if (mdev->state ==MLX5_DEVICE_STATE_INTERNAL_ERROR ) + goto out; +write_seqlock_irqsave (&clock->lock, flags);timecounter_read (&timer->tc);mlx5_update_clock_info_page (mdev);write_sequnlock_irqrestore (&clock->lock, flags); + +out:schedule_delayed_work (&timer->overflow_work, timer->overflow_period); }
Greg Kroah-Hartman
maintainerPATCH 67/89 ibmvnic: Enforce stronger sanity checks on login response
In reply to Greg Kroah-HartmanFrom: Nick Child <[email protected]>
commit db17ba719bceb52f0ae4ebca0e4c17d9a3bebf05 upstream.
Ensure that all offsets in a login response buffer are within the size of the allocated response buffer. Any offsets or lengths that surpass the allocation are likely the result of an incomplete response buffer. In these cases, a full reset is necessary.
When attempting to login, the ibmvnic device will allocate a response buffer and pass a reference to the VIOS. The VIOS will then send the ibmvnic device a LOGIN_RSP CRQ to signal that the buffer has been filled with data. If the ibmvnic device does not get a response in 20 seconds, the old buffer is freed and a new login request is sent. With 2 outstanding requests, any LOGIN_RSP CRQ's could be for the older login request. If this is the case then the login response buffer (which is for the newer login request) could be incomplete and contain invalid data. Therefore, we must enforce strict sanity checks on the response buffer values.
Testing has shown that the off_rxadd_buff_size value is filled in last by the VIOS and will be the smoking gun for these circumstances.
Until VIOS can implement a mechanism for tracking outstanding response buffers and a method for mapping a LOGIN_RSP CRQ to a particular login response buffer, the best ibmvnic can do in this situation is perform a full reset.
--- drivers/net/ethernet/ibm/ibmvnic.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/net/ethernet/ibm/ibmvnic.c +18 -0
@@ -4788,6 +4788,7 @@ static int handle_login_rsp(union ibmvniint num_tx_pools;int num_rx_pools;u64 *size_array; +u32 rsp_len;int i;/* CHECK: Test/set of login_pending does not need to be atomic
@@ -4839,6 +4840,23 @@ static int handle_login_rsp(union ibmvniibmvnic_reset (adapter,VNIC_RESET_FATAL );return -EIO ; } + + rsp_len =be32_to_cpu (login_rsp->len); +if (be32_to_cpu (login->login_rsp_len) < rsp_len || + rsp_len <=be32_to_cpu (login_rsp->off_txsubm_subcrqs) || + rsp_len <=be32_to_cpu (login_rsp->off_rxadd_subcrqs) || + rsp_len <=be32_to_cpu (login_rsp->off_rxadd_buff_size) || + rsp_len <=be32_to_cpu (login_rsp->off_supp_tx_desc)) { +/* This can happen if a login request times out and there are +* 2 outstanding login requests sent, the LOGIN_RSP crq +* could have been for the older login request. So we are +* parsing the newer response buffer which may be incomplete +*/ +dev_err (dev,"FATAL: Login rsp offsets/lengths invalid\n" ); +ibmvnic_reset (adapter,VNIC_RESET_FATAL ); +return -EIO ; + } + size_array = (u64 *)((u8 *)(adapter->login_rsp_buf) +be32_to_cpu (adapter->login_rsp_buf->off_rxadd_buff_size));/* variable buffer sizes are not supported, so just read the
Greg Kroah-Hartman
maintainerPATCH 68/89 ibmvnic: Unmap DMA login rsp buffer on send login fail
In reply to Greg Kroah-HartmanFrom: Nick Child <[email protected]>
commit 411c565b4bc63e9584a8493882bd566e35a90588 upstream.
If the LOGIN CRQ fails to send then we must DMA unmap the response buffer. Previously, if the CRQ failed then the memory was freed without DMA unmapping.
--- drivers/net/ethernet/ibm/ibmvnic.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/ibm/ibmvnic.c +4 -1
@@ -4220,11 +4220,14 @@ static int send_login(struct ibmvnic_adaif (rc) { adapter->login_pending = false;netdev_err (adapter->netdev,"Failed to send login, rc=%d\n" , rc); - goto buf_rsp_map_failed; + goto buf_send_failed; }return 0 ; +buf_send_failed: +dma_unmap_single (dev, rsp_buffer_token, rsp_buffer_size, +DMA_FROM_DEVICE ); buf_rsp_map_failed:kfree (login_rsp_buffer); adapter->login_rsp_buf =NULL ;
Greg Kroah-Hartman
maintainerPATCH 69/89 ibmvnic: Handle DMA unmapping of login buffs in release functions
In reply to Greg Kroah-HartmanFrom: Nick Child <[email protected]>
commit d78a671eb8996af19d6311ecdee9790d2fa479f0 upstream.
Rather than leaving the DMA unmapping of the login buffers to the login response handler, move this work into the login release functions. Previously, these functions were only used for freeing the allocated buffers. This could lead to issues if there are more than one outstanding login buffer requests, which is possible if a login request times out.
If a login request times out, then there is another call to send login. The send login function makes a call to the login buffer release function. In the past, this freed the buffers but did not DMA unmap. Therefore, the VIOS could still write to the old login (now freed) buffer. It is for this reason that it is a good idea to leave the DMA unmap call to the login buffers release function.
Since the login buffer release functions now handle DMA unmapping, remove the duplicate DMA unmapping in handle_login_rsp().
--- drivers/net/ethernet/ibm/ibmvnic.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/net/ethernet/ibm/ibmvnic.c +10 -5
@@ -1007,12 +1007,22 @@ static int ibmvnic_login(struct net_devistatic void release_login_buffer (struct ibmvnic_adapter *adapter) { +if (!adapter->login_buf) +return ; + +dma_unmap_single (&adapter->vdev->dev, adapter->login_buf_token, + adapter->login_buf_sz,DMA_TO_DEVICE );kfree (adapter->login_buf); adapter->login_buf =NULL ; }static void release_login_rsp_buffer (struct ibmvnic_adapter *adapter) { +if (!adapter->login_rsp_buf) +return ; + +dma_unmap_single (&adapter->vdev->dev, adapter->login_rsp_buf_token, + adapter->login_rsp_buf_sz,DMA_FROM_DEVICE );kfree (adapter->login_rsp_buf); adapter->login_rsp_buf =NULL ; }
@@ -4803,11 +4813,6 @@ static int handle_login_rsp(union ibmvni } adapter->login_pending = false; -dma_unmap_single (dev, adapter->login_buf_token, adapter->login_buf_sz, -DMA_TO_DEVICE ); -dma_unmap_single (dev, adapter->login_rsp_buf_token, - adapter->login_rsp_buf_sz,DMA_FROM_DEVICE ); -/* If the number of queues requested can't be allocated by the * server, the login response will return with code 1. We will need * to resend the login buffer with fewer queues requested.
Greg Kroah-Hartman
maintainerPATCH 70/89 btrfs: dont stop integrity writeback too early
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit effa24f689ce0948f68c754991a445a8d697d3a8 upstream.
extent_write_cache_pages stops writing pages as soon as nr_to_write hits zero. That is the right thing for opportunistic writeback, but incorrect for data integrity writeback, which needs to ensure that no dirty pages are left in the range. Thus only stop the writeback for WB_SYNC_NONE if nr_to_write hits 0.
This is a port of write_cache_pages changes in commit 05fe478dd04e ("mm: write_cache_pages integrity fix").
Note that I've only trigger the problem with other changes to the btrfs writeback code, but this condition seems worthwhile fixing anyway.
--- fs/btrfs/extent_io.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/btrfs/extent_io.c +4 -3
@@ -4844,11 +4844,12 @@ retry: }/* -* the filesystem may choose to bump up nr_to_write. +* The filesystem may choose to bump up nr_to_write. * We have to make sure to honor the new nr_to_write -* at any time +* at any time. */ - nr_to_write_done = wbc->nr_to_write <=0 ; + nr_to_write_done = (wbc->sync_mode ==WB_SYNC_NONE && + wbc->nr_to_write <=0 ); }pagevec_release (&pvec);cond_resched ();
Greg Kroah-Hartman
maintainerPATCH 71/89 btrfs: exit gracefully if reloc roots dont match
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 05d7ce504545f7874529701664c90814ca645c5d upstream.
[BUG]
Syzbot reported a crash that an ASSERT() got triggered inside prepare_to_merge().
[CAUSE]
The root cause of the triggered ASSERT() is we can have a race between quota tree creation and relocation.
This leads us to create a duplicated quota tree in the btrfs_read_fs_root() path, and since it's treated as fs tree, it would have ROOT_SHAREABLE flag, causing us to create a reloc tree for it.
The bug itself is fixed by a dedicated patch for it, but this already taught us the ASSERT() is not something straightforward for developers.
[ENHANCEMENT]
Instead of using an ASSERT(), let's handle it gracefully and output extra info about the mismatch reloc roots to help debug.
Also with the above ASSERT() removed, we can trigger ASSERT(0)s inside merge_reloc_roots() later.
Also replace those ASSERT(0)s with WARN_ON()s.
--- fs/btrfs/relocation.c | 45 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 37 insertions(+), 8 deletions(-)
fs/btrfs/relocation.c +37 -8
@@ -1905,7 +1905,39 @@ again: err =PTR_ERR (root);break ; } -ASSERT (root->reloc_root == reloc_root); + +if (unlikely (root->reloc_root != reloc_root)) { +if (root->reloc_root) { +btrfs_err (fs_info, +"reloc tree mismatch, root %lld has reloc root key (%lld %u %llu) gen %llu, expect reloc root key (%lld %u %llu) gen %llu" , + root->root_key.objectid, + root->reloc_root->root_key.objectid, + root->reloc_root->root_key.type, + root->reloc_root->root_key.offset, +btrfs_root_generation ( + &root->reloc_root->root_item), + reloc_root->root_key.objectid, + reloc_root->root_key.type, + reloc_root->root_key.offset, +btrfs_root_generation ( + &reloc_root->root_item)); + }else { +btrfs_err (fs_info, +"reloc tree mismatch, root %lld has no reloc root, expect reloc root key (%lld %u %llu) gen %llu" , + root->root_key.objectid, + reloc_root->root_key.objectid, + reloc_root->root_key.type, + reloc_root->root_key.offset, +btrfs_root_generation ( + &reloc_root->root_item)); + } +list_add (&reloc_root->root_list, &reloc_roots); +btrfs_put_root (root); +btrfs_abort_transaction (trans, -EUCLEAN ); +if (!err) + err = -EUCLEAN ; +break ; + }/* * set reference count to 1, so btrfs_recover_relocation
@@ -1978,7 +2010,7 @@ again: root =btrfs_get_fs_root (fs_info, reloc_root->root_key.offset, false);if (btrfs_root_refs (&reloc_root->root_item) >0 ) { -if (IS_ERR (root)) { +if (WARN_ON (IS_ERR (root))) {/* * For recovery we read the fs roots on mount, * and if we didn't find the root then we marked
@@ -1987,17 +2019,14 @@ again:* memory. However there's no reason we can't * handle the error properly here just in case. */ -ASSERT (0 ); ret =PTR_ERR (root); goto out; } -if (root->reloc_root != reloc_root) { +if (WARN_ON (root->reloc_root != reloc_root)) {/* -* This is actually impossible without something -* going really wrong (like weird race condition -* or cosmic rays). +* This can happen if on-disk metadata has some +* corruption, e.g. bad reloc tree key offset. */ -ASSERT (0 ); ret = -EINVAL ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 72/89 btrfs: reject invalid reloc tree root keys with stack dump
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 6ebcd021c92b8e4b904552e4d87283032100796d upstream.
[BUG]
Syzbot reported a crash that an ASSERT() got triggered inside prepare_to_merge().
That ASSERT() makes sure the reloc tree is properly pointed back by its subvolume tree.
[CAUSE]
After more debugging output, it turns out we had an invalid reloc tree:
BTRFS error (device loop1): reloc tree mismatch, root 8 has no reloc root, expect reloc root key (-8, 132, 8) gen 17
Note the above root key is (TREE_RELOC_OBJECTID, ROOT_ITEM, QUOTA_TREE_OBJECTID), meaning it's a reloc tree for quota tree.
But reloc trees can only exist for subvolumes, as for non-subvolume trees, we just COW the involved tree block, no need to create a reloc tree since those tree blocks won't be shared with other trees.
Only subvolumes tree can share tree blocks with other trees (thus they have BTRFS_ROOT_SHAREABLE flag).
Thus this new debug output proves my previous assumption that corrupted on-disk data can trigger that ASSERT().
[FIX]
Besides the dedicated fix and the graceful exit, also let tree-checker to check such root keys, to make sure reloc trees can only exist for subvolumes.
--- fs/btrfs/disk-io.c | 3 ++- fs/btrfs/tree-checker.c | 14 ++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-)
fs/btrfs/disk-io.c +2 -1
@@ -1437,7 +1437,8 @@ static int btrfs_init_fs_root(struct btr goto fail;if (root->root_key.objectid !=BTRFS_TREE_LOG_OBJECTID && - !btrfs_is_data_reloc_root (root)) { + !btrfs_is_data_reloc_root (root) && +is_fstree (root->root_key.objectid)) {set_bit (BTRFS_ROOT_SHAREABLE , &root->state);btrfs_check_and_init_root_item (&root->root_item); }
fs/btrfs/tree-checker.c +14 -0
@@ -442,6 +442,20 @@ static int check_root_key(struct extent_btrfs_item_key_to_cpu (leaf, &item_key, slot); is_root_item = (item_key.type ==BTRFS_ROOT_ITEM_KEY ); +/* +* Bad rootid for reloc trees. +* +* Reloc trees are only for subvolume trees, other trees only need +* to be COWed to be relocated. +*/ +if (unlikely (is_root_item && key->objectid ==BTRFS_TREE_RELOC_OBJECTID && + !is_fstree (key->offset))) { +generic_err (leaf, slot, +"invalid reloc tree for root %lld, root id is not a subvolume tree" , + key->offset); +return -EUCLEAN ; + } +/* No such tree id */ if (unlikely (key->objectid ==0 )) {if (is_root_item)
Greg Kroah-Hartman
maintainerPATCH 73/89 btrfs: set cache_block_group_error if we find an error
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 92fb94b69c6accf1e49fff699640fa0ce03dc910 upstream.
We set cache_block_group_error if btrfs_cache_block_group() returns an error, this is because we could end up not finding space to allocate and mistakenly return -ENOSPC, and which could then abort the transaction with the incorrect errno, and in the case of ENOSPC result in a WARN_ON() that will trip up tests like generic/475.
However there's the case where multiple threads can be racing, one thread gets the proper error, and the other thread doesn't actually call btrfs_cache_block_group(), it instead sees ->cached == BTRFS_CACHE_ERROR. Again the result is the same, we fail to allocate our space and return -ENOSPC. Instead we need to set cache_block_group_error to -EIO in this case to make sure that if we do not make our allocation we get the appropriate error returned back to the caller.
--- fs/btrfs/extent-tree.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/btrfs/extent-tree.c +4 -1
@@ -4334,8 +4334,11 @@ have_block_group: ret =0 ; } -if (unlikely (block_group->cached ==BTRFS_CACHE_ERROR )) +if (unlikely (block_group->cached ==BTRFS_CACHE_ERROR )) { +if (!cache_block_group_error) + cache_block_group_error = -EIO ; goto loop; + } bg_ret =NULL ; ret =do_allocation (block_group, &ffe_ctl, &bg_ret);
Greg Kroah-Hartman
maintainerPATCH 74/89 nvme-tcp: fix potential unbalanced freeze & unfreeze
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
commit 99dc264014d5aed66ee37ddf136a38b5a2b1b529 upstream.
Move start_freeze into nvme_tcp_configure_io_queues(), and there is at least two benefits:
1) fix unbalanced freeze and unfreeze, since re-connection work may fail or be broken by removal
2) IO during error recovery can be failfast quickly because nvme fabrics unquiesces queues after teardown.
One side-effect is that !mpath request may timeout during connecting because of queue topo change, but that looks not one big deal:
1) same problem exists with current code base
2) compared with !mpath, mpath use case is dominant
--- drivers/nvme/host/tcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/tcp.c +2 -1
@@ -1888,6 +1888,7 @@ static int nvme_tcp_configure_io_queues( goto out_cleanup_connect_q;if (!new) { +nvme_start_freeze (ctrl);nvme_start_queues (ctrl);if (!nvme_wait_freeze_timeout (ctrl,NVME_IO_TIMEOUT )) {/*
@@ -1896,6 +1897,7 @@ static int nvme_tcp_configure_io_queues(* to be safe. */ ret = -ENODEV ; +nvme_unfreeze (ctrl); goto out_wait_freeze_timed_out; } blk_mq_update_nr_hw_queues(ctrl->tagset,
@@ -2014,7 +2016,6 @@ static void nvme_tcp_teardown_io_queues(if (ctrl->queue_count <=1 )return ;blk_mq_quiesce_queue (ctrl->admin_q); -nvme_start_freeze (ctrl);nvme_stop_queues (ctrl);nvme_sync_io_queues (ctrl);nvme_tcp_stop_io_queues (ctrl);
Greg Kroah-Hartman
maintainerPATCH 75/89 nvme-rdma: fix potential unbalanced freeze & unfreeze
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
commit 29b434d1e49252b3ad56ad3197e47fafff5356a1 upstream.
Move start_freeze into nvme_rdma_configure_io_queues(), and there is at least two benefits:
1) fix unbalanced freeze and unfreeze, since re-connection work may fail or be broken by removal
2) IO during error recovery can be failfast quickly because nvme fabrics unquiesces queues after teardown.
One side-effect is that !mpath request may timeout during connecting because of queue topo change, but that looks not one big deal:
1) same problem exists with current code base
2) compared with !mpath, mpath use case is dominant
--- drivers/nvme/host/rdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/rdma.c +2 -1
@@ -989,6 +989,7 @@ static int nvme_rdma_configure_io_queues goto out_cleanup_connect_q;if (!new) { +nvme_start_freeze (&ctrl->ctrl);nvme_start_queues (&ctrl->ctrl);if (!nvme_wait_freeze_timeout (&ctrl->ctrl,NVME_IO_TIMEOUT )) {/*
@@ -997,6 +998,7 @@ static int nvme_rdma_configure_io_queues* to be safe. */ ret = -ENODEV ; +nvme_unfreeze (&ctrl->ctrl); goto out_wait_freeze_timed_out; } blk_mq_update_nr_hw_queues(ctrl->ctrl.tagset,
@@ -1038,7 +1040,6 @@ static void nvme_rdma_teardown_io_queues bool remove) {if (ctrl->ctrl.queue_count >1 ) { -nvme_start_freeze (&ctrl->ctrl);nvme_stop_queues (&ctrl->ctrl);nvme_sync_io_queues (&ctrl->ctrl);nvme_rdma_stop_io_queues (ctrl);
Greg Kroah-Hartman
maintainerPATCH 76/89 netfilter: nf_tables: report use refcount overflow
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
commit 1689f25924ada8fe14a4a82c38925d04994c7142 upstream.
Overflow use refcount checks are not complete.
Add helper function to deal with object reference counter tracking. Report -EMFILE in case UINT_MAX is reached.
nft_use_dec() splats in case that reference counter underflows, which should not ever happen.
Add nft_use_inc_restore() and nft_use_dec_restore() which are used to restore reference counter from error and abort paths.
Use u32 in nft_flowtable and nft_object since helper functions cannot work on bitfields.
Remove the few early incomplete checks now that the helper functions are in place and used to check for refcount overflow.
--- include/net/netfilter/nf_tables.h | 31 ++++++- net/netfilter/nf_tables_api.c | 164 +++++++++++++++++++++++--------------- net/netfilter/nft_flow_offload.c | 6 - net/netfilter/nft_immediate.c | 8 - net/netfilter/nft_objref.c | 8 + 5 files changed, 141 insertions(+), 76 deletions(-)
include/net/netfilter/nf_tables.h +27 -4
@@ -1144,6 +1144,29 @@ int __nft_release_basechain(struct nft_cunsigned int nft_do_chain (struct nft_pktinfo *pkt,void *priv); +static inline bool nft_use_inc (u32 *use) +{ +if (*use ==UINT_MAX ) +return false; + + (*use)++; + +return true; +} + +static inline void nft_use_dec (u32 *use) +{ +WARN_ON_ONCE ((*use)-- ==0 ); +} + +/* For error and abort path: restore use counter to previous state. */ +static inline void nft_use_inc_restore (u32 *use) +{ +WARN_ON_ONCE (!nft_use_inc (use)); +} + +#define nft_use_dec_restore nft_use_dec +/** * struct nft_table - nf_tables table *
@@ -1227,8 +1250,8 @@ struct nft_object {struct list_head list;struct rhlist_head rhlhead;struct nft_object_hash_key key; - u32 genmask:2, - use:30; + u32 genmask:2; +u32 use;u64 handle;u16 udlen;u8 *udata;
@@ -1330,8 +1353,8 @@ struct nft_flowtable {char *name;int hooknum;int ops_len; - u32 genmask:2, - use:30; + u32 genmask:2; +u32 use;u64 handle;/* runtime data below here */ struct list_head hook_list____cacheline_aligned ;
net/netfilter/nf_tables_api.c +101 -63
509 lines not on this page · raw message
net/netfilter/nft_flow_offload.c +4 -2
@@ -381,8 +381,10 @@ static int nft_flow_offload_init(const sif (IS_ERR (flowtable))return PTR_ERR (flowtable); +if (!nft_use_inc (&flowtable->use)) +return -EMFILE ; + priv->flowtable = flowtable; - flowtable->use++;return nf_ct_netns_get (ctx->net, ctx->family); }
@@ -401,7 +403,7 @@ static void nft_flow_offload_activate(co {struct nft_flow_offload *priv =nft_expr_priv (expr); - priv->flowtable->use++; +nft_use_inc_restore (&priv->flowtable->use); } static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
net/netfilter/nft_immediate.c +4 -4
@@ -168,7 +168,7 @@ static void nft_immediate_deactivate(connft_immediate_chain_deactivate (ctx, chain, phase);nft_chain_del (chain); chain->bound = false; - chain->table->use--; +nft_use_dec (&chain->table->use);break ; }break ;
@@ -207,7 +207,7 @@ static void nft_immediate_destroy(const* let the transaction records release this chain and its rules. */ if (chain->bound) { - chain->use--; +nft_use_dec (&chain->use);break ; }
@@ -215,9 +215,9 @@ static void nft_immediate_destroy(const chain_ctx = *ctx; chain_ctx.chain = chain; - chain->use--; +nft_use_dec (&chain->use);list_for_each_entry_safe (rule, n, &chain->rules, list) { - chain->use--; +nft_use_dec (&chain->use);list_del (&rule->list);nf_tables_rule_destroy (&chain_ctx, rule); }
net/netfilter/nft_objref.c +5 -3
@@ -41,8 +41,10 @@ static int nft_objref_init(const structif (IS_ERR (obj))return -ENOENT ; +if (!nft_use_inc (&obj->use)) +return -EMFILE ; +nft_objref_priv (expr) = obj; - obj->use++;return 0 ; }
@@ -71,7 +73,7 @@ static void nft_objref_deactivate(constif (phase ==NFT_TRANS_COMMIT )return ; - obj->use--; +nft_use_dec (&obj->use); } static void nft_objref_activate(const struct nft_ctx *ctx,
@@ -79,7 +81,7 @@ static void nft_objref_activate(const st {struct nft_object *obj =nft_objref_priv (expr); - obj->use++; +nft_use_inc_restore (&obj->use); }static struct nft_expr_type nft_objref_type;
Greg Kroah-Hartman
maintainerPATCH 77/89 scsi: core: Fix legacy /proc parsing buffer overflow
In reply to Greg Kroah-HartmanFrom: Tony Battersby <[email protected]>
commit 9426d3cef5000824e5f24f80ed5f42fb935f2488 upstream.
(lightly modified commit message mostly by Linus Torvalds)
The parsing code for /proc/scsi/scsi is disgusting and broken. We should have just used 'sscanf()' or something simple like that, but the logic may actually predate our kernel sscanf library routine for all I know. It certainly predates both git and BK histories.
And we can't change it to be something sane like that now, because the string matching at the start is done case-insensitively, and the separator parsing between numbers isn't done at all, so *any* separator will work, including a possible terminating NUL character.
This interface is root-only, and entirely for legacy use, so there is absolutely no point in trying to tighten up the parsing. Because any separator has traditionally worked, it's entirely possible that people have used random characters rather than the suggested space.
So don't bother to try to pretty it up, and let's just make a minimal patch that can be back-ported and we can forget about this whole sorry thing for another two decades.
Just make it at least not read past the end of the supplied data.
--- drivers/scsi/scsi_proc.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-)
drivers/scsi/scsi_proc.c +17 -13
@@ -311,7 +311,7 @@ static ssize_t proc_scsi_write(struct fi size_t length, loff_t *ppos) { int host, channel, id, lun; -char *buffer, *p; +char *buffer, *end, *p;int err;if (!buf || length >PAGE_SIZE )
@@ -326,10 +326,14 @@ static ssize_t proc_scsi_write(struct fi goto out; err = -EINVAL ; -if (length <PAGE_SIZE ) - buffer[length] ='\0' ; -else if (buffer[PAGE_SIZE -1 ]) - goto out; +if (length <PAGE_SIZE ) { + end = buffer + length; + *end ='\0' ; + }else { + end = buffer +PAGE_SIZE -1 ; +if (*end) + goto out; + }/* * Usage: echo "scsi add-single-device 0 1 2 3" >/proc/scsi/scsi
@@ -338,10 +342,10 @@ static ssize_t proc_scsi_write(struct fiif (!strncmp ("scsi add-single-device" , buffer,22 )) { p = buffer +23 ; - host =simple_strtoul (p, &p,0 ); - channel =simple_strtoul (p +1 , &p,0 ); - id =simple_strtoul (p +1 , &p,0 ); - lun =simple_strtoul (p +1 , &p,0 ); + host = (p < end) ?simple_strtoul (p, &p,0 ) :0 ; + channel = (p +1 < end) ?simple_strtoul (p +1 , &p,0 ) :0 ; + id = (p +1 < end) ?simple_strtoul (p +1 , &p,0 ) :0 ; + lun = (p +1 < end) ?simple_strtoul (p +1 , &p,0 ) :0 ; err =scsi_add_single_device (host, channel, id, lun);
@@ -352,10 +356,10 @@ static ssize_t proc_scsi_write(struct fi }else if (!strncmp ("scsi remove-single-device" , buffer,25 )) { p = buffer +26 ; - host =simple_strtoul (p, &p,0 ); - channel =simple_strtoul (p +1 , &p,0 ); - id =simple_strtoul (p +1 , &p,0 ); - lun =simple_strtoul (p +1 , &p,0 ); + host = (p < end) ?simple_strtoul (p, &p,0 ) :0 ; + channel = (p +1 < end) ?simple_strtoul (p +1 , &p,0 ) :0 ; + id = (p +1 < end) ?simple_strtoul (p +1 , &p,0 ) :0 ; + lun = (p +1 < end) ?simple_strtoul (p +1 , &p,0 ) :0 ; err =scsi_remove_single_device (host, channel, id, lun); }
Greg Kroah-Hartman
maintainerPATCH 78/89 scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
In reply to Greg Kroah-HartmanFrom: Michael Kelley <[email protected]>
commit 175544ad48cbf56affeef2a679c6a4d4fb1e2881 upstream.
Hyper-V provides the ability to connect Fibre Channel LUNs to the host system and present them in a guest VM as a SCSI device. I/O to the vFC device is handled by the storvsc driver. The storvsc driver includes a partial integration with the FC transport implemented in the generic portion of the Linux SCSI subsystem so that FC attributes can be displayed in /sys. However, the partial integration means that some aspects of vFC don't work properly. Unfortunately, a full and correct integration isn't practical because of limitations in what Hyper-V provides to the guest.
In particular, in the context of Hyper-V storvsc, the FC transport timeout function fc_eh_timed_out() causes a kernel panic because it can't find the rport and dereferences a NULL pointer. The original patch that added the call from storvsc_eh_timed_out() to fc_eh_timed_out() is faulty in this regard.
In many cases a timeout is due to a transient condition, so the situation can be improved by just continuing to wait like with other I/O requests issued by storvsc, and avoiding the guaranteed panic. For a permanent failure, continuing to wait may result in a hung thread instead of a panic, which again may be better.
So fix the panic by removing the storvsc call to fc_eh_timed_out(). This allows storvsc to keep waiting for a response. The change has been tested by users who experienced a panic in fc_eh_timed_out() due to transient timeouts, and it solves their problem.
In the future we may want to deprecate the vFC functionality in storvsc since it can't be fully fixed. But it has current users for whom it is working well enough, so it should probably stay for a while longer.
--- drivers/scsi/storvsc_drv.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/scsi/storvsc_drv.c +0 -4
@@ -1730,10 +1730,6 @@ static int storvsc_host_reset_handler(st*/ static enum blk_eh_timer_return storvsc_eh_timed_out (struct scsi_cmnd *scmnd) { -#if IS_ENABLED (CONFIG_SCSI_FC_ATTRS ) -if (scmnd->device->host->transportt == fc_transport_template) -return fc_eh_timed_out (scmnd); -#endif return BLK_EH_RESET_TIMER ; }
Greg Kroah-Hartman
maintainerPATCH 79/89 scsi: 53c700: Check that command slot is not NULL
In reply to Greg Kroah-HartmanFrom: Alexandra Diupina <[email protected]>
commit 8366d1f1249a0d0bba41d0bd1298d63e5d34c7f7 upstream.
Add a check for the command slot value to avoid dereferencing a NULL pointer.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/scsi/53c700.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/53c700.c +1 -1
@@ -1599,7 +1599,7 @@ NCR_700_intr(int irq, void *dev_id)printk ("scsi%d (%d:%d) PHASE MISMATCH IN SEND MESSAGE %d remain, return %p[%04x], phase %s\n" , host->host_no, pun, lun, count, (void *)temp, temp - hostdata->pScript,sbcl_to_string (NCR_700_readb (host,SBCL_REG )));#endif resume_offset = hostdata->pScript + Ent_SendMessagePhaseMismatch; - }else if (dsp >=to32bit (&slot->pSG[0 ].ins) && + }else if (slot && dsp >=to32bit (&slot->pSG[0 ].ins) && dsp <=to32bit (&slot->pSG[NCR_700_SG_SEGMENTS ].ins)) {int data_transfer =NCR_700_readl (host,DBC_REG ) &0xffffff ;int SGcount = (dsp -to32bit (&slot->pSG[0 ].ins))/sizeof (struct NCR_700_SG_List );
Greg Kroah-Hartman
maintainerPATCH 80/89 scsi: snic: Fix possible memory leak if device_add() fails
In reply to Greg Kroah-HartmanFrom: Zhu Wang <[email protected]>
commit 41320b18a0e0dfb236dba4edb9be12dba1878156 upstream.
If device_add() returns error, the name allocated by dev_set_name() needs be freed. As the comment of device_add() says, put_device() should be used to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanp().
--- drivers/scsi/snic/snic_disc.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/snic/snic_disc.c +1 -0
@@ -317,6 +317,7 @@ snic_tgt_create(struct snic *snic, struc"Snic Tgt: device_add, with err = %d\n" , ret); +put_device (&tgt->dev);put_device (&snic->shost->shost_gendev);spin_lock_irqsave (snic->shost->host_lock, flags);list_del (&tgt->list);
Greg Kroah-Hartman
maintainerPATCH 81/89 scsi: core: Fix possible memory leak if device_add() fails
In reply to Greg Kroah-HartmanFrom: Zhu Wang <[email protected]>
commit 04b5b5cb0136ce970333a9c6cec7e46adba1ea3a upstream.
If device_add() returns error, the name allocated by dev_set_name() needs be freed. As the comment of device_add() says, put_device() should be used to decrease the reference count in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanp().
--- drivers/scsi/raid_class.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/raid_class.c +1 -0
@@ -248,6 +248,7 @@ int raid_component_add(struct raid_templreturn 0 ; err_out: +put_device (&rc->dev);list_del (&rc->node); rd->component_count--;put_device (component_dev);
Greg Kroah-Hartman
maintainerPATCH 82/89 scsi: fnic: Replace return codes in fnic_clean_pending_aborts()
In reply to Greg Kroah-HartmanFrom: Karan Tilak Kumar <[email protected]>
commit 5a43b07a87835660f91d88a4db11abfea8c523b7 upstream.
fnic_clean_pending_aborts() was returning a non-zero value irrespective of failure or success. This caused the caller of this function to assume that the device reset had failed, even though it would succeed in most cases. As a consequence, a successful device reset would escalate to host reset.
--- drivers/scsi/fnic/fnic_scsi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/scsi/fnic/fnic_scsi.c +4 -2
@@ -2172,7 +2172,7 @@ static int fnic_clean_pending_aborts(str bool new_sc) { -int ret =SUCCESS ; +int ret =0 ;struct fnic_pending_aborts_iter_data iter_data = { .fnic = fnic, .lun_dev = lr_sc->device,
@@ -2192,9 +2192,11 @@ static int fnic_clean_pending_aborts(str/* walk again to check, if IOs are still pending in fw */ if (fnic_is_abts_pending (fnic, lr_sc)) - ret =FAILED ; + ret =1 ; clean_pending_aborts_end: +FNIC_SCSI_DBG (KERN_INFO , fnic->lport->host, +"%s: exit status: %d\n" , __func__, ret);return ret; }
Greg Kroah-Hartman
maintainerPATCH 83/89 scsi: qedi: Fix firmware halt over suspend and resume
In reply to Greg Kroah-HartmanFrom: Nilesh Javali <[email protected]>
commit 1516ee035df32115197cd93ae3619dba7b020986 upstream.
While performing certain power-off sequences, PCI drivers are called to suspend and resume their underlying devices through PCI PM (power management) interface. However the hardware does not support PCI PM suspend/resume operations so system wide suspend/resume leads to bad MFW (management firmware) state which causes various follow-up errors in driver when communicating with the device/firmware.
To fix this driver implements PCI PM suspend handler to indicate unsupported operation to the PCI subsystem explicitly, thus avoiding system to go into suspended/standby mode.
--- drivers/scsi/qedi/qedi_main.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/scsi/qedi/qedi_main.c +18 -0
@@ -69,6 +69,7 @@ static struct nvm_iscsi_block *qedi_get_static void qedi_recovery_handler (struct work_struct *work);static void qedi_schedule_hw_err_handler (void *dev,enum qed_hw_err_type err_type); +static int qedi_suspend (struct pci_dev *pdev,pm_message_t state);static int qedi_iscsi_event_cb (void *context,u8 fw_event_code,void *fw_handle) {
@@ -2515,6 +2516,22 @@ static void qedi_shutdown(struct pci_dev__qedi_remove (pdev,QEDI_MODE_SHUTDOWN ); } +static int qedi_suspend (struct pci_dev *pdev,pm_message_t state) +{ +struct qedi_ctx *qedi; + +if (!pdev) { +QEDI_ERR (NULL ,"pdev is NULL.\n" ); +return -ENODEV ; + } + + qedi =pci_get_drvdata (pdev); + +QEDI_ERR (&qedi->dbg_ctx,"%s: Device does not support suspend operation\n" , __func__); + +return -EPERM ; +} +static int __qedi_probe (struct pci_dev *pdev,int mode) {struct qedi_ctx *qedi;
@@ -2873,6 +2890,7 @@ static struct pci_driver qedi_pci_driver .remove = qedi_remove, .shutdown = qedi_shutdown, .err_handler = &qedi_err_handler, + .suspend = qedi_suspend, };static int __init qedi_init (void )
Greg Kroah-Hartman
maintainerPATCH 84/89 scsi: qedf: Fix firmware halt over suspend and resume
In reply to Greg Kroah-HartmanFrom: Nilesh Javali <[email protected]>
commit ef222f551e7c4e2008fc442ffc9edcd1a7fd8f63 upstream.
While performing certain power-off sequences, PCI drivers are called to suspend and resume their underlying devices through PCI PM (power management) interface. However the hardware does not support PCI PM suspend/resume operations so system wide suspend/resume leads to bad MFW (management firmware) state which causes various follow-up errors in driver when communicating with the device/firmware.
To fix this driver implements PCI PM suspend handler to indicate unsupported operation to the PCI subsystem explicitly, thus avoiding system to go into suspended/standby mode.
--- drivers/scsi/qedf/qedf_main.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/scsi/qedf/qedf_main.c +18 -0
@@ -31,6 +31,7 @@ static void qedf_remove(struct pci_dev *static void qedf_shutdown (struct pci_dev *pdev);static void qedf_schedule_recovery_handler (void *dev);static void qedf_recovery_handler (struct work_struct *work); +static int qedf_suspend (struct pci_dev *pdev,pm_message_t state);/* * Driver module parameters.
@@ -3276,6 +3277,7 @@ static struct pci_driver qedf_pci_driver .probe = qedf_probe, .remove = qedf_remove, .shutdown = qedf_shutdown, + .suspend = qedf_suspend, };static int __qedf_probe (struct pci_dev *pdev,int mode)
@@ -4005,6 +4007,22 @@ static void qedf_shutdown(struct pci_dev__qedf_remove (pdev,QEDF_MODE_NORMAL ); } +static int qedf_suspend (struct pci_dev *pdev,pm_message_t state) +{ +struct qedf_ctx *qedf; + +if (!pdev) { +QEDF_ERR (NULL ,"pdev is NULL.\n" ); +return -ENODEV ; + } + + qedf =pci_get_drvdata (pdev); + +QEDF_ERR (&qedf->dbg_ctx,"%s: Device does not support suspend operation\n" , __func__); + +return -EPERM ; +} +/* * Recovery handler code */
Greg Kroah-Hartman
maintainerPATCH 85/89 alpha: remove __init annotation from exported page_is_ram()
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
commit 6ccbd7fd474674654019a20177c943359469103a upstream.
EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization.
Commit c5a130325f13 ("ACPI/APEI: Add parameter check before error injection") exported page_is_ram(), hence the __init annotation should be removed.
This fixes the modpost warning in ARCH=alpha builds:
WARNING: modpost: vmlinux: page_is_ram: EXPORT_SYMBOL used for init symbol. Remove __init or EXPORT_SYMBOL.
--- arch/alpha/kernel/setup.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/alpha/kernel/setup.c +1 -2
@@ -385,8 +385,7 @@ setup_memory(void *kernel_end)#endif /* CONFIG_BLK_DEV_INITRD */ } -int __init -page_is_ram (unsigned long pfn) +int page_is_ram (unsigned long pfn) {struct memclust_struct * cluster;struct memdesc_struct * memdesc;
Greg Kroah-Hartman
maintainerPATCH 86/89 sch_netem: fix issues in netem_change() vs get_dist_table()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 11b73313c12403f617b47752db0ab3deef201af7 upstream.
In blamed commit, I missed that get_dist_table() was allocating memory using GFP_KERNEL, and acquiring qdisc lock to perform the swap of newly allocated table with current one.
In this patch, get_dist_table() is allocating memory and copy user data before we acquire the qdisc lock.
Then we perform swap operations while being protected by the lock.
Note that after this patch netem_change() no longer can do partial changes. If an error is returned, qdisc conf is left unchanged.
--- net/sched/sch_netem.c | 59 +++++++++++++++++++++----------------------------- 1 file changed, 25 insertions(+), 34 deletions(-)
net/sched/sch_netem.c +25 -34
@@ -773,12 +773,10 @@ static void dist_free(struct disttable ** signed 16 bit values. */ -static int get_dist_table (struct Qdisc *sch,struct disttable **tbl, -const struct nlattr *attr) +static int get_dist_table (struct disttable **tbl,const struct nlattr *attr) {size_t n =nla_len (attr)/sizeof (__s16);const __s16 *data =nla_data (attr); -spinlock_t *root_lock;struct disttable *d;int i;
@@ -793,13 +791,7 @@ static int get_dist_table(struct Qdisc *for (i =0 ; i < n; i++) d->table[i] = data[i]; - root_lock =qdisc_root_sleeping_lock (sch); - -spin_lock_bh (root_lock); -swap (*tbl, d); -spin_unlock_bh (root_lock); - -dist_free (d); + *tbl = d;return 0 ; }
@@ -956,6 +948,8 @@ static int netem_change(struct Qdisc *sc {struct netem_sched_data *q =qdisc_priv (sch);struct nlattr *tb[TCA_NETEM_MAX +1 ]; +struct disttable *delay_dist =NULL ; +struct disttable *slot_dist =NULL ;struct tc_netem_qopt *qopt;struct clgstate old_clg;int old_loss_model =CLG_RANDOM ;
@@ -969,6 +963,18 @@ static int netem_change(struct Qdisc *scif (ret <0 )return ret; +if (tb[TCA_NETEM_DELAY_DIST ]) { + ret =get_dist_table (&delay_dist, tb[TCA_NETEM_DELAY_DIST ]); +if (ret) + goto table_free; + } + +if (tb[TCA_NETEM_SLOT_DIST ]) { + ret =get_dist_table (&slot_dist, tb[TCA_NETEM_SLOT_DIST ]); +if (ret) + goto table_free; + } +sch_tree_lock (sch);/* backup q->clg and q->loss_model */ old_clg = q->clg;
@@ -978,26 +984,17 @@ static int netem_change(struct Qdisc *sc ret =get_loss_clg (q, tb[TCA_NETEM_LOSS ]);if (ret) { q->loss_model = old_loss_model; + q->clg = old_clg; goto unlock; } }else { q->loss_model =CLG_RANDOM ; } -if (tb[TCA_NETEM_DELAY_DIST ]) { - ret =get_dist_table (sch, &q->delay_dist, - tb[TCA_NETEM_DELAY_DIST ]); -if (ret) - goto get_table_failure; - } - -if (tb[TCA_NETEM_SLOT_DIST ]) { - ret =get_dist_table (sch, &q->slot_dist, - tb[TCA_NETEM_SLOT_DIST ]); -if (ret) - goto get_table_failure; - } - +if (delay_dist) +swap (q->delay_dist, delay_dist); +if (slot_dist) +swap (q->slot_dist, slot_dist); sch->limit = qopt->limit; q->latency =PSCHED_TICKS2NS (qopt->latency);
@@ -1047,17 +1044,11 @@ static int netem_change(struct Qdisc *sc unlock:sch_tree_unlock (sch); -return ret; -get_table_failure: -/* recover clg and loss_model, in case of -* q->clg and q->loss_model were modified -* in get_loss_clg() -*/ - q->clg = old_clg; - q->loss_model = old_loss_model; - - goto unlock; +table_free: +dist_free (delay_dist); +dist_free (slot_dist); +return ret; } static int netem_init(struct Qdisc *sch, struct nlattr *opt,
Greg Kroah-Hartman
maintainerPATCH 87/89 tick: Detect and fix jiffies update stall
In reply to Greg Kroah-HartmanFrom: Frederic Weisbecker <[email protected]>
[ Upstream commit a1ff03cd6fb9c501fff63a4a2bface9adcfa81cd ]
tick: Detect and fix jiffies update stall
On some rare cases, the timekeeper CPU may be delaying its jiffies update duty for a while. Known causes include:
* The timekeeper is waiting on stop_machine in a MULTI_STOP_DISABLE_IRQ or MULTI_STOP_RUN state. Disabled interrupts prevent from timekeeping updates while waiting for the target CPU to complete its stop_machine() callback.
* The timekeeper vcpu has VMEXIT'ed for a long while due to some overload on the host.
Detect and fix these situations with emergency timekeeping catchups.
--- kernel/time/tick-sched.c | 17 +++++++++++++++++ kernel/time/tick-sched.h | 4 ++++ 2 files changed, 21 insertions(+)
kernel/time/tick-sched.c +17 -0
@@ -180,6 +180,8 @@ static ktime_t tick_init_jiffy_update(voreturn period; } +#define MAX_STALLED_JIFFIES 5 +static void tick_sched_do_timer (struct tick_sched *ts,ktime_t now) {int cpu =smp_processor_id ();
@@ -207,6 +209,21 @@ static void tick_sched_do_timer(struct tif (tick_do_timer_cpu == cpu)tick_do_update_jiffies64 (now); +/* +* If jiffies update stalled for too long (timekeeper in stop_machine() +* or VMEXIT'ed for several msecs), force an update. +*/ +if (ts->last_tick_jiffies != jiffies) { + ts->stalled_jiffies =0 ; + ts->last_tick_jiffies =READ_ONCE (jiffies); + }else { +if (++ts->stalled_jiffies ==MAX_STALLED_JIFFIES ) { +tick_do_update_jiffies64 (now); + ts->stalled_jiffies =0 ; + ts->last_tick_jiffies =READ_ONCE (jiffies); + } + } +if (ts->inidle) ts->got_idle_tick =1 ; }
kernel/time/tick-sched.h +4 -0
@@ -49,6 +49,8 @@ enum tick_nohz_mode {* @timer_expires_base: Base time clock monotonic for @timer_expires * @next_timer: Expiry time of next expiring timer for debugging purpose only * @tick_dep_mask: Tick dependency mask - is set, if someone needs the tick +* @last_tick_jiffies: Value of jiffies seen on last tick +* @stalled_jiffies: Number of stalled jiffies detected across ticks */ struct tick_sched {struct hrtimer sched_timer;
@@ -77,6 +79,8 @@ struct tick_sched {u64 next_timer;ktime_t idle_expires;atomic_t tick_dep_mask; +unsigned long last_tick_jiffies; +unsigned int stalled_jiffies; };extern struct tick_sched *tick_get_tick_sched (int cpu);
Greg Kroah-Hartman
maintainerPATCH 88/89 timers/nohz: Switch to ONESHOT_STOPPED in the low-res handler when the tick is stopped
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
[ Upstream commit 62c1256d544747b38e77ca9b5bfe3a26f9592576 ]
When tick_nohz_stop_tick() stops the tick and high resolution timers are disabled, then the clock event device is not put into ONESHOT_STOPPED mode. This can lead to spurious timer interrupts with some clock event device drivers that don't shut down entirely after firing.
Eliminate these by putting the device into ONESHOT_STOPPED mode at points where it is not being reprogrammed. When there are no timers active, then tick_program_event() with KTIME_MAX can be used to stop the device. When there is a timer active, the device can be stopped at the next tick (any new timer added by timers will reprogram the tick).
--- kernel/time/tick-sched.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
kernel/time/tick-sched.c +10 -2
@@ -950,6 +950,8 @@ static void tick_nohz_stop_tick(struct tif (unlikely (expires ==KTIME_MAX )) {if (ts->nohz_mode ==NOHZ_MODE_HIGHRES )hrtimer_cancel (&ts->sched_timer); +else +tick_program_event (KTIME_MAX ,1 );return ; }
@@ -1356,9 +1358,15 @@ static void tick_nohz_handler(struct clotick_sched_do_timer (ts, now);tick_sched_handle (ts, regs); -/* No need to reprogram if we are running tickless */ -if (unlikely (ts->tick_stopped)) +if (unlikely (ts->tick_stopped)) { +/* +* The clockevent device is not reprogrammed, so change the +* clock event device to ONESHOT_STOPPED to avoid spurious +* interrupts on devices which might not be truly one shot. +*/ +tick_program_event (KTIME_MAX ,1 );return ; + }hrtimer_forward (&ts->sched_timer, now,TICK_NSEC );tick_program_event (hrtimer_get_expires (&ts->sched_timer),1 );
Greg Kroah-Hartman
maintainerPATCH 89/89 timers/nohz: Last resort update jiffies on nohz_full IRQ entry
In reply to Greg Kroah-HartmanFrom: Frederic Weisbecker <[email protected]>
[ Upstream commit 53e87e3cdc155f20c3417b689df8d2ac88d79576 ]
When at least one CPU runs in nohz_full mode, a dedicated timekeeper CPU is guaranteed to stay online and to never stop its tick.
Meanwhile on some rare case, the dedicated timekeeper may be running with interrupts disabled for a while, such as in stop_machine.
If jiffies stop being updated, a nohz_full CPU may end up endlessly programming the next tick in the past, taking the last jiffies update monotonic timestamp as a stale base, resulting in an tick storm.
Here is a scenario where it matters:
0) CPU 0 is the timekeeper and CPU 1 a nohz_full CPU.
1) A stop machine callback is queued to execute somewhere.
2) CPU 0 reaches MULTI_STOP_DISABLE_IRQ while CPU 1 is still in MULTI_STOP_PREPARE. Hence CPU 0 can't do its timekeeping duty. CPU 1 can still take IRQs.
3) CPU 1 receives an IRQ which queues a timer callback one jiffy forward.
4) On IRQ exit, CPU 1 schedules the tick one jiffy forward, taking last_jiffies_update as a base. But last_jiffies_update hasn't been updated for 2 jiffies since the timekeeper has interrupts disabled.
5) clockevents_program_event(), which relies on ktime_get(), observes that the expiration is in the past and therefore programs the min delta event on the clock.
6) The tick fires immediately, goto 3)
7) Tick storm, the nohz_full CPU is drown and takes ages to reach MULTI_STOP_DISABLE_IRQ, which is the only way out of this situation.
Solve this with unconditionally updating jiffies if the value is stale on nohz_full IRQ entry. IRQs and other disturbances are expected to be rare enough on nohz_full for the unconditional call to ktime_get() to actually matter.
--- kernel/softirq.c | 3 ++- kernel/time/tick-sched.c | 7 +++++++ 2 files changed, 9 insertions(+), 1 deletion(-)
kernel/softirq.c +2 -1
@@ -595,7 +595,8 @@ void irq_enter_rcu(void) {__irq_enter_raw (); -if (is_idle_task (current) && (irq_count () ==HARDIRQ_OFFSET )) +if (tick_nohz_full_cpu (smp_processor_id ()) || + (is_idle_task (current) && (irq_count () ==HARDIRQ_OFFSET )))tick_irq_enter ();account_hardirq_enter (current);
kernel/time/tick-sched.c +7 -0
@@ -1420,6 +1420,13 @@ static inline void tick_nohz_irq_enter(v now =ktime_get ();if (ts->idle_active)tick_nohz_stop_idle (ts, now); +/* +* If all CPUs are idle. We may need to update a stale jiffies value. +* Note nohz_full is a special case: a timekeeper is guaranteed to stay +* alive but it might be busy looping with interrupts disabled in some +* rare case (typically stop machine). So we must make sure we have a +* last resort. +*/ if (ts->tick_stopped)tick_nohz_update_jiffies (now); }
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.127 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.127-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.15:
11 builds: 11 pass, 0 fail
28 boots: 28 pass, 0 fail
94 tests: 94 pass, 0 failLinux version: 5.15.127-rc1-gc79c1253de29
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Hello,
Quoted 5 lines · On Sun, 13 Aug 2023 23:18:51 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 5.15.127 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.127-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.
This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].
[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] c79c1253de29 ("Linux 5.15.127-rc1")
Thanks,
SJ
[...]
---
ok 13 selftests: damon-tests: build_i386_idle_flag.sh # selftests: damon-tests: build_i386_highpte.sh
# .config:1341:warning: override: reassigning to symbol DAMON ok 14 selftests: damon-tests: build_i386_highpte.sh
# selftests: damon-tests: build_nomemcg.sh
# .config:1342:warning: override: reassigning to symbol DAMON # .config:1352:warning: override: reassigning to symbol CGROUPS ok 15 selftests: damon-tests: build_nomemcg.sh
# kselftest dir '/home/sjpark/damon-tests-cont/linux/tools/testing/selftests/damon-tests' is in dirty state. # the log is at '/home/sjpark/log'. [32m ok 1 selftests: damon: debugfs_attrs.sh ok 1 selftests: damon-tests: kunit.sh ok 2 selftests: damon-tests: huge_count_read_write.sh ok 3 selftests: damon-tests: buffer_overflow.sh ok 4 selftests: damon-tests: rm_contexts.sh ok 5 selftests: damon-tests: record_null_deref.sh ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh ok 8 selftests: damon-tests: damo_tests.sh ok 9 selftests: damon-tests: masim-record.sh ok 10 selftests: damon-tests: build_i386.sh ok 11 selftests: damon-tests: build_m68k.sh ok 12 selftests: damon-tests: build_arm64.sh ok 13 selftests: damon-tests: build_i386_idle_flag.sh ok 14 selftests: damon-tests: build_i386_highpte.sh ok 15 selftests: damon-tests: build_nomemcg.sh [33m [92mPASS [39m _remote_run_corr.sh SUCCESS
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.127 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000. Anything received after that time might be too late.
Build results:
total: 160 pass: 160 fail: 0 Qemu test results: total: 501 pass: 501 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.127 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.127-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.127 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.127-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.127 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000. Anything received after that time might be too late.
No problems seen on x86_64 and aarch64.
Thanks,
Harshit
Ve
Quoted 10 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.127-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Hello!
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.127 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.127-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
This branch exhibits the same problem with regards to x86 and Clang as reported on 6.4 [1] and 6.1 [2].
We found a one-off warning on i386 (physical machine):
-----8<-----
[ 1346.674005] NETDEV WATCHDOG: eth0 (igb): transmit queue 0 timed out [ 1346.680282] WARNING: CPU: 1 PID: 0 at net/sched/sch_generic.c:477 dev_watchdog+0x21c/0x230 [ 1346.688549] Modules linked in: tun x86_pkg_temp_thermal [ 1346.693773] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.127-rc1 #1 [ 1346.700211] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.2 05/23/2018 [ 1346.707595] EIP: dev_watchdog+0x21c/0x230 [ 1346.711609] Code: 0a 1b 2e 00 eb b2 c6 43 ac 00 eb 89 8b 7d e8 c6 05 ac c0 76 c9 01 89 f8 e8 d1 19 fb ff 56 50 57 68 64 4a 4d c9 e8 06 f1 26 00 <0f> 0b 83 c4 10 eb 90 8d b4 26 00 00 00 00 8d b6 00 00 00 00 3e 8d [ 1346.730352] EAX: 00000037 EBX: c1b482a8 ECX: f5bb2690 EDX: f5bacbac [ 1346.736611] ESI: 00000000 EDI: c1b48000 EBP: c118ff4c ESP: c118ff20 [ 1346.742869] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00210296 [ 1346.749653] CR0: 80050033 CR2: b7f4122c CR3: 030fe000 CR4: 003506d0 [ 1346.755910] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [ 1346.762167] DR6: fffe0ff0 DR7: 00000400 [ 1346.766000] Call Trace: [ 1346.768442] <SOFTIRQ> [ 1346.770801] ? show_regs.cold+0x14/0x1a [ 1346.774640] ? __warn+0x71/0x100 [ 1346.777873] ? dev_watchdog+0x21c/0x230 [ 1346.781713] ? report_bug+0x7e/0xa0 [ 1346.785203] ? exc_overflow+0x40/0x40 [ 1346.788871] ? handle_bug+0x2a/0x50 [ 1346.792363] ? exc_invalid_op+0x1b/0x60 [ 1346.796200] ? handle_exception+0x133/0x133 [ 1346.800379] ? sugov_start+0x4b/0x160 [ 1346.804046] ? mptcp_token_join_cookie_init_state+0xa8/0xe0 [ 1346.809616] ? exc_overflow+0x40/0x40 [ 1346.813274] ? dev_watchdog+0x21c/0x230 [ 1346.817104] ? mptcp_token_join_cookie_init_state+0xa8/0xe0 [ 1346.822668] ? exc_overflow+0x40/0x40 [ 1346.826335] ? dev_watchdog+0x21c/0x230 [ 1346.830176] ? pfifo_fast_reset+0x150/0x150 [ 1346.834361] call_timer_fn+0x28/0xe0 [ 1346.837939] __run_timers+0x1e8/0x260 [ 1346.841596] ? pfifo_fast_reset+0x150/0x150 [ 1346.845773] run_timer_softirq+0x19/0x30 [ 1346.849692] __do_softirq+0xfc/0x2e9 [ 1346.853272] ? __softirqentry_text_start+0x8/0x8 [ 1346.857888] call_on_stack+0x45/0x50 [ 1346.861459] </SOFTIRQ> [ 1346.863905] ? __irq_exit_rcu+0x90/0xc0 [ 1346.867745] ? irq_exit_rcu+0xd/0x20 [ 1346.871324] ? sysvec_apic_timer_interrupt+0x27/0x40 [ 1346.876288] ? handle_exception+0x133/0x133 [ 1346.880467] ? cpuidle_enter+0x27/0x40 [ 1346.884217] ? cpuidle_enter_state+0xc5/0x3c0 [ 1346.888577] ? trace_array_put+0x8/0x50 [ 1346.892417] ? sysvec_call_function_single+0x40/0x40 [ 1346.897382] ? cpuidle_enter_state+0xc8/0x3c0 [ 1346.901742] ? show_energy_performance_preference+0xd8/0xf0 [ 1346.907315] ? trace_array_put+0x8/0x50 [ 1346.911153] ? sysvec_call_function_single+0x40/0x40 [ 1346.916111] ? cpuidle_enter_state+0xc8/0x3c0 [ 1346.920471] ? cpuidle_enter+0x27/0x40 [ 1346.924221] ? do_idle+0x1e9/0x290 [ 1346.927621] ? cpu_startup_entry+0x25/0x30 [ 1346.931720] ? start_secondary+0x105/0x140 [ 1346.935818] ? startup_32_smp+0x161/0x164 [ 1346.939822] ---[ end trace 8a197f71c975528f ]---
----->8-----
This is possibly related to bug 216884 [3]. Full test log is available [4]. This did not happen again on handful of reruns of the same test.
Here's the rest of report:
## Build
* kernel: 5.15.127-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.15.y
* git commit: 952b0de2b49f760b2e3b49d93faae7a6beb96dee
* git describe: v5.15.126-90-g952b0de2b49f
* test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.15.y/build/v5.15.126-90-g952b0de2b49f
## Test regressions (compared to v5.15.126)
* i386, log-parser-test
- check-kernel-exception
- check-kernel-warning
* x86, log-parser-boot
- check-kernel-warning
## No metric regressions (compared to v5.15.126)
## No test fixes (compared to v5.15.126)
## No metric fixes (compared to v5.15.126)
## Test result summary
total: 123935, pass: 100041, fail: 3496, skip: 20284, xfail: 114
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 117 total, 116 passed, 1 failed
* arm64: 45 total, 45 passed, 0 failed
* i386: 35 total, 34 passed, 1 failed
* mips: 27 total, 26 passed, 1 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 27 total, 26 passed, 1 failed
* riscv: 11 total, 11 passed, 0 failed
* s390: 12 total, 11 passed, 1 failed
* sh: 14 total, 12 passed, 2 failed
* sparc: 8 total, 8 passed, 0 failed
* x86_64: 38 total, 38 passed, 0 failed
## Test suites summary
* boot
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-watchdog
* kselftest-x86
* kunit
* kvm-unit-tests
* libgpiod
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* perf
* rcutorture
* v4l2-compliance
Greetings!
Daniel Díaz
[email protected]
[1] https://lore.kernel.org/stable/[email protected]/
[2] https://lore.kernel.org/stable/[email protected]/
[3] https://bugzilla.kernel.org/show_bug.cgi?id=216884
[4] https://lkft.validation.linaro.org/scheduler/job/6664165#L2145
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.127 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.127-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:
Signature · 1 line
Florian
Quoted 9 lines
This is the start of the stable review cycle for the 5.15.127 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.127-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my x86_64 and ARM64 test systems. No errors or regressions.
Thanks.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.127 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.127-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.15:
11 builds: 11 pass, 0 fail
28 boots: 28 pass, 0 fail
102 tests: 102 pass, 0 failLinux version: 5.15.127-rc1-g952b0de2b49f
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.127 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000. Anything received after that time might be too late.
Too late here.
Anyway for RCU it passed,
thanks,
- Joel
Quoted 406 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.127-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 5.15.127-rc1Frederic Weisbecker <[email protected]>
timers/nohz: Last resort update jiffies onnohz_fullIRQ entryNicholas Piggin <[email protected]>
timers/nohz: Switch toONESHOT_STOPPEDin the low-res handler when the tick is stoppedFrederic Weisbecker <[email protected]>
tick: Detect and fix jiffies update stallEric Dumazet <[email protected]>
sch_netem: fix issues innetem_change()vsget_dist_table()Masahiro Yamada <[email protected]>
alpha: remove__initannotation from exportedpage_is_ram()Nilesh Javali <[email protected]>
scsi: qedf: Fix firmware halt over suspend and resumeNilesh Javali <[email protected]>
scsi: qedi: Fix firmware halt over suspend and resumeKaran Tilak Kumar <[email protected]>
scsi: fnic: Replace return codes infnic_clean_pending_aborts()Zhu Wang <[email protected]>
scsi: core: Fix possible memory leak ifdevice_add()failsZhu Wang <[email protected]>
scsi: snic: Fix possible memory leak ifdevice_add()failsAlexandra Diupina <[email protected]>
scsi: 53c700: Check that command slot is not NULLMichael Kelley <[email protected]>
scsi: storvsc: Fix handling of virtual Fibre Channel timeoutsTony Battersby <[email protected]>
scsi: core: Fix legacy /proc parsing buffer overflowPablo Neira Ayuso <[email protected]>
netfilter:nf_tables: report use refcount overflowMing Lei <[email protected]>
nvme-rdma: fix potential unbalanced freeze & unfreezeMing Lei <[email protected]>
nvme-tcp: fix potential unbalanced freeze & unfreezeJosef Bacik <[email protected]>
btrfs: setcache_block_group_errorif we find an errorQu Wenruo <[email protected]>
btrfs: reject invalid reloc tree root keys with stack dumpQu Wenruo <[email protected]>
btrfs: exit gracefully if reloc roots don't matchChristoph Hellwig <[email protected]>
btrfs: don't stop integrity writeback too earlyNick Child <[email protected]>
ibmvnic: Handle DMA unmapping of login buffs in release functionsNick Child <[email protected]>
ibmvnic: Unmap DMA login rsp buffer on send login failNick Child <[email protected]>
ibmvnic: Enforce stronger sanity checks on login responseMoshe Shemesh <[email protected]>
net/mlx5: Skip clock update work when device is in error stateDaniel Jurgens <[email protected]>
net/mlx5: Allow 0 for total host VFsChristophe JAILLET <[email protected]>
dmaengine: mcf-edma: Fix a potential un-allocated memory accessIdo Schimmel <[email protected]>
nexthop: Fix infinite nexthop bucket dump when using maximum nexthop IDIdo Schimmel <[email protected]>
nexthop: Make nexthop bucket dump more efficientIdo Schimmel <[email protected]>
nexthop: Fix infinite nexthop dump when using maximum nexthop IDJie Wang <[email protected]>
net: hns3: add wait until mac link downJie Wang <[email protected]>
net: hns3: refactorhclge_mac_link_status_waitfor interface reuseLi Yang <[email protected]>
net: phy: at803x: remove set/get wol callbacks for AR8032Michael Guralnik <[email protected]>
RDMA/umem: Set iova in ODP flowFelix Fietkau <[email protected]>
wifi: cfg80211: fix sband iftype data lookup forAP_VLANDaniel Stone <[email protected]>
drm/rockchip: Don't spam logs in atomic checkDouglas Miller <[email protected]>
IB/hfi1: Fix possible panic during hotplug removePiotr Gardocki <[email protected]>
iavf: fix potential races for FDIR filtersAndrew Kanner <[email protected]>
drivers: net: preventtun_build_skb()to exceed the packet size limitEric Dumazet <[email protected]>
dccp: fix data-race around dp->dccps_mss_cacheZiyang Xuan <[email protected]>
bonding: Fix incorrect deletion ofETH_P_8021ADprotocol vid from slavesMagnus Karlsson <[email protected]>
xsk: fix refcount underflow in error pathFlorian Westphal <[email protected]>
tunnels: fix kasan splat when generating ipv4 pmtu errorEric Dumazet <[email protected]>
net/packet: annotate data-races around tp->statusNathan Chancellor <[email protected]>
mISDN: Update parameter type ofdsp_cmx_send()Xu Kuohai <[email protected]>
bpf, sockmap: Fix bug thatstrp_donecannot be calledXu Kuohai <[email protected]>
bpf, sockmap: Fix map type error insock_map_del_linkAndrew Kanner <[email protected]>
net: core: remove unnecessaryframe_szcheck inbpf_xdp_adjust_tail()Ido Schimmel <[email protected]>
selftests: forwarding:tc_flower: Relax success criterionIdo Schimmel <[email protected]>
selftests: forwarding: Switch off timeoutIdo Schimmel <[email protected]>
selftests: forwarding: Skip test when no interfaces are specifiedIdo Schimmel <[email protected]>
selftests: forwarding:ethtool_extended_state: Skip when using veth pairsIdo Schimmel <[email protected]>
selftests: forwarding: ethtool: Skip when using veth pairsIdo Schimmel <[email protected]>
selftests: forwarding: Add a helper to skip test when using veth pairsMark Brown <[email protected]>
selftests/rseq: Fix build with undefined__weakFlorian Westphal <[email protected]>
netfilter:nf_tables: don't skip expired elements during walkKarol Herbst <[email protected]>
drm/nouveau/disp: Revert a NULL check insidenouveau_connector_get_modesArnd Bergmann <[email protected]>
x86: Movegds_ucode_mitigated()declaration to headerArnd Bergmann <[email protected]>
x86/speculation: Addcpu_show_gds()prototypeKirill A. Shutemov <[email protected]>
x86/mm: Fix VDSO and VVAR placement on 5-level paging machinesCristian Ciocaltea <[email protected]>
x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405Nick Desaulniers <[email protected]>
x86/srso: Fix build breakage with the LLVM linkerBadhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Fix response to vsafe0V eventPrashanth K <[email protected]>
usb: common: usb-conn-gpio: Prevent bailing out if initial role is noneElson Roy Serrao <[email protected]>
usb: dwc3: Properly handle processing of pending eventsAlan Stern <[email protected]>
usb-storage: alauda: Fix uninit-value inalauda_check_media()Ricky WU <[email protected]>
misc: rtsx: judge ASPM Mode to set PETXCFG RegQi Zheng <[email protected]>
binder: fix memory leak inbinder_init()Alvin Šipraga <[email protected]>
iio: adc: ina2xx: avoid NULL pointer dereference on OF device matchYiyuan Guo <[email protected]>
iio:cros_ec: Fix the allocation size forcros_ec_commandAleksa Sarai <[email protected]>
io_uring: correct check forO_TMPFILEIlya Leoshkevich <[email protected]>
selftests/bpf: Fix sk_assign on s390xYonghong Song <[email protected]>
selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_codeAndrii Nakryiko <[email protected]>
selftests/bpf: maketest_alignselftest more robustAndrii Nakryiko <[email protected]>
bpf: aggressively forget precise markings during state checkpointingAndrii Nakryiko <[email protected]>
bpf: stop setting precise in current stateAndrii Nakryiko <[email protected]>
bpf: allow precision tracking for programs with subprogsRyusuke Konishi <[email protected]>
nilfs2: fix use-after-free ofnilfs_rootin dirtying inodes via iputColin Ian King <[email protected]>
radix tree test suite: fix incorrect allocation size for pthreadsTao Ren <[email protected]>
hwmon: (pmbus/bel-pfe) EnablePMBUS_SKIP_STATUS_CHECKfor pfe1100Melissa Wen <[email protected]>
drm/amd/display: check attr flag before set cursor degamma on DCN3+Boris Brezillon <[email protected]>
drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()Karol Herbst <[email protected]>
drm/nouveau/gr: enable memory loads on helper invocation on all channelsAndrea Parri <[email protected]>
riscv,mmio: Fix readX()-to-delay() orderingIlpo Järvinen <[email protected]>
dmaengine: pl330: ReturnDMA_PAUSEDwhen transaction is pausedMaciej Żenczykowski <[email protected]>
ipv6: adjustndisc_is_useropt()to also return true for PIOSergei Antonov <[email protected]>
mmc: moxart: read scr register without changing byte orderJason A. Donenfeld <[email protected]>
wireguard: allowedips: expand maximum node depthNamjae Jeon <[email protected]>
ksmbd: fix wrong next length validation of ea buffer insmb2_set_ea()Long Li <[email protected]>
ksmbd: validate command request size-------------
Diffstat:
Makefile | 4 +- arch/alpha/kernel/setup.c | 3 +- arch/riscv/include/asm/mmio.h | 16 +- arch/x86/entry/vdso/vma.c | 4 +- arch/x86/include/asm/processor.h | 2 + arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kernel/vmlinux.lds.S | 12 +- arch/x86/kvm/x86.c | 2 - drivers/android/binder.c | 1 + drivers/android/binder_alloc.c | 6 + drivers/android/binder_alloc.h | 1 + drivers/dma/mcf-edma.c | 13 +- drivers/dma/pl330.c | 18 +- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c | 7 +- drivers/gpu/drm/drm_gem_shmem_helper.c | 6 + drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c | 10 ++ drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c | 1 + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 17 +- drivers/hwmon/pmbus/bel-pfe.c | 16 +- drivers/iio/adc/ina2xx-adc.c | 9 +- .../common/cros_ec_sensors/cros_ec_sensors_core.c | 2 +- drivers/infiniband/core/umem.c | 3 +- drivers/infiniband/hw/hfi1/chip.c | 1 + drivers/isdn/mISDN/dsp.h | 2 +- drivers/isdn/mISDN/dsp_cmx.c | 2 +- drivers/isdn/mISDN/dsp_core.c | 2 +- drivers/misc/cardreader/rts5227.c | 2 +- drivers/misc/cardreader/rts5228.c | 18 -- drivers/misc/cardreader/rts5249.c | 3 +- drivers/misc/cardreader/rts5260.c | 18 -- drivers/misc/cardreader/rts5261.c | 18 -- drivers/misc/cardreader/rtsx_pcr.c | 5 +- drivers/mmc/host/moxart-mmc.c | 8 +- drivers/net/bonding/bond_main.c | 4 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 24 ++- drivers/net/ethernet/ibm/ibmvnic.c | 38 +++- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 5 +- drivers/net/ethernet/intel/iavf/iavf_fdir.c | 11 +- .../net/ethernet/mellanox/mlx5/core/lib/clock.c | 5 + drivers/net/ethernet/mellanox/mlx5/core/sriov.c | 3 +- drivers/net/phy/at803x.c | 2 - drivers/net/tun.c | 2 +- drivers/net/wireguard/allowedips.c | 8 +- drivers/net/wireguard/selftest/allowedips.c | 16 +- drivers/nvme/host/rdma.c | 3 +- drivers/nvme/host/tcp.c | 3 +- drivers/scsi/53c700.c | 2 +- drivers/scsi/fnic/fnic_scsi.c | 6 +- drivers/scsi/qedf/qedf_main.c | 18 ++ drivers/scsi/qedi/qedi_main.c | 18 ++ drivers/scsi/raid_class.c | 1 + drivers/scsi/scsi_proc.c | 30 ++-- drivers/scsi/snic/snic_disc.c | 1 + drivers/scsi/storvsc_drv.c | 4 - drivers/usb/common/usb-conn-gpio.c | 6 +- drivers/usb/dwc3/gadget.c | 9 +- drivers/usb/storage/alauda.c | 12 +- drivers/usb/typec/tcpm/tcpm.c | 7 + fs/btrfs/disk-io.c | 3 +- fs/btrfs/extent-tree.c | 5 +- fs/btrfs/extent_io.c | 7 +- fs/btrfs/relocation.c | 45 ++++- fs/btrfs/tree-checker.c | 14 ++ fs/ksmbd/smb2misc.c | 10 +- fs/ksmbd/smb2pdu.c | 9 +- fs/nilfs2/inode.c | 8 + fs/nilfs2/segment.c | 2 + fs/nilfs2/the_nilfs.h | 2 + include/linux/cpu.h | 2 + include/linux/skmsg.h | 1 + include/net/cfg80211.h | 3 + include/net/netfilter/nf_tables.h | 31 +++- io_uring/io_uring.c | 6 +- kernel/bpf/verifier.c | 199 +++++++++++++++++++-- kernel/softirq.c | 3 +- kernel/time/tick-sched.c | 36 +++- kernel/time/tick-sched.h | 4 + net/core/filter.c | 6 - net/core/skmsg.c | 10 +- net/core/sock_map.c | 10 +- net/dccp/output.c | 2 +- net/dccp/proto.c | 10 +- net/ipv4/ip_tunnel_core.c | 2 +- net/ipv4/nexthop.c | 28 +-- net/ipv6/ndisc.c | 3 +- net/netfilter/nf_tables_api.c | 168 ++++++++++------- net/netfilter/nft_flow_offload.c | 6 +- net/netfilter/nft_immediate.c | 8 +- net/netfilter/nft_objref.c | 8 +- net/netfilter/nft_set_hash.c | 2 - net/netfilter/nft_set_pipapo.c | 18 +- net/netfilter/nft_set_rbtree.c | 2 - net/packet/af_packet.c | 16 +- net/sched/sch_netem.c | 59 +++--- net/xdp/xsk.c | 1 + tools/testing/radix-tree/regression1.c | 2 +- tools/testing/selftests/bpf/prog_tests/align.c | 36 ++-- tools/testing/selftests/bpf/prog_tests/sk_assign.c | 25 ++- tools/testing/selftests/bpf/progs/connect4_prog.c | 2 +- tools/testing/selftests/bpf/progs/test_sk_assign.c | 11 ++ .../selftests/bpf/progs/test_sk_assign_libbpf.c | 3 + tools/testing/selftests/net/fib_nexthops.sh | 10 ++ tools/testing/selftests/net/forwarding/ethtool.sh | 2 + .../net/forwarding/ethtool_extended_state.sh | 2 + tools/testing/selftests/net/forwarding/lib.sh | 16 ++ tools/testing/selftests/net/forwarding/settings | 1 + .../testing/selftests/net/forwarding/tc_flower.sh | 8 +- tools/testing/selftests/rseq/Makefile | 4 +- tools/testing/selftests/rseq/rseq.c | 2 + 114 files changed, 946 insertions(+), 407 deletions(-)