6.8.5-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 6.8.5-rc1 review
This is the start of the stable review cycle for the 6.8.5 release. There are 273 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 10 Apr 2024 12:52:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.8.5-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.8.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.8.5-rc1
Ard Biesheuvel <[email protected]>
x86/efistub: Remap kernel text read-only before dropping NX attribute
Ard Biesheuvel <[email protected]>
x86/sev: Move early startup code into .head.text section
Ard Biesheuvel <[email protected]>
x86/sme: Move early SME kernel encryption handling into .head.text
Ard Biesheuvel <[email protected]>
x86/boot: Move mem_encrypt= parsing to the decompressor
Ard Biesheuvel <[email protected]>
efi/libstub: Add generic support for parsing mem_encrypt=
Andrii Nakryiko <[email protected]>
bpf: support deferring bpf_link dealloc to after RCU grace period
Andrii Nakryiko <[email protected]>
bpf: put uprobe link's path and task in release callback
Greg Kroah-Hartman <[email protected]>
Revert "x86/mpparse: Register APIC address only once"
Thomas Hellström <[email protected]>
drm/xe: Rework rebinding
Thomas Hellström <[email protected]>
drm/xe: Use ring ops TLB invalidation for rebinds
Andi Shyti <[email protected]>
drm/i915/gt: Enable only one CCS for compute workload
Andi Shyti <[email protected]>
drm/i915/gt: Do not generate the command streamer for all the CCS
Andi Shyti <[email protected]>
drm/i915/gt: Disable HW load balancing for CCS
Ankit Nautiyal <[email protected]>
drm/i915/dp: Fix the computation for compressed_bpp for DISPLAY < 13
Ville Syrjälä <[email protected]>
drm/i915/mst: Reject FEC+MST on ICL
Ville Syrjälä <[email protected]>
drm/i915/mst: Limit MST+DSC to TGL+
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in smb2_is_network_name_deleted()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in is_valid_oplock_break()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in smb2_is_valid_lease_break()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in smb2_is_valid_oplock_break()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in cifs_dump_full_key()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in cifs_stats_proc_show()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in cifs_stats_proc_write()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in cifs_debug_files_proc_show()
Ritvik Budhiraja <[email protected]>
smb3: retrying on failed server close
Paulo Alcantara <[email protected]>
smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex
Paulo Alcantara <[email protected]>
smb: client: handle DFS tcons in cifs_construct_tcon()
Paulo Alcantara <[email protected]>
smb: client: refresh referral without acquiring refpath_lock
Paulo Alcantara <[email protected]>
smb: client: guarantee refcounted children from parent session
Paulo Alcantara <[email protected]>
smb: client: fix UAF in smb2_reconnect_server()
Stefan O'Rear <[email protected]>
riscv: process: Fix kernel gp leakage
Samuel Holland <[email protected]>
riscv: Fix spurious errors from __get/put_kernel_nofault
Sumanth Korikkar <[email protected]>
s390/entry: align system call table on 8 bytes
Edward Liaw <[email protected]>
selftests/mm: include strings.h for ffsl
David Hildenbrand <[email protected]>
mm/secretmem: fix GUP-fast succeeding on secretmem folios
Mark Brown <[email protected]>
arm64/ptrace: Use saved floating point state type to determine SVE layout
Björn Töpel <[email protected]>
riscv: Fix vector state restore in rt_sigreturn()
Kent Overstreet <[email protected]>
aio: Fix null ptr deref in aio_complete() wakeup
Kan Liang <[email protected]>
perf/x86/intel/ds: Don't clear ->pebs_data_cfg for the last PEBS event
Jason A. Donenfeld <[email protected]>
x86/coco: Require seeding RNG with RDRAND on CoCo systems
Borislav Petkov (AMD) <[email protected]>
x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
David Hildenbrand <[email protected]>
x86/mm/pat: fix VM_PAT handling in COW mappings
Sergey Shtylyov <[email protected]>
of: module: prevent NULL pointer dereference in vsnprintf()
Herve Codina <[email protected]>
of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
Herve Codina <[email protected]>
driver core: Introduce device_link_wait_removal()
Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: hda: Compensate LLP in case it is not reset
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-pcm: Correct the delay calculation
Peter Ujfalusi <[email protected]>
ASoC: SOF: sof-pcm: Add pointer callback to sof_ipc_pcm_ops
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-pcm: Invalidate the stream_start_offset in PAUSED state
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-pcm: Combine the SOF_IPC4_PIPE_PAUSED cases in pcm_trigger
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-pcm: Move struct sof_ipc4_timestamp_info definition locally
Peter Ujfalusi <[email protected]>
ASoC: SOF: Remove the get_stream_position callback
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-pcm: Use the snd_sof_pcm_get_dai_frame_counter() for pcm_delay
Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: hda-common-ops: Do not set the get_stream_position callback
Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: Set the dai/host get frame/byte counter callbacks
Peter Ujfalusi <[email protected]>
ASoC: SOF: Introduce a new callback pair to be used for PCM delay reporting
Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: mtl/lnl: Use the generic get_stream_position callback
Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: hda: Implement get_stream_position (Linear Link Position)
Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: hda-pcm: Use dsp_max_burst_size_in_ms to place constraint
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-topology: Save the DMA maximum burst size for PCMs
Peter Ujfalusi <[email protected]>
ASoC: SOF: Add dsp_max_burst_size_in_ms member to snd_sof_pcm_stream
Jens Axboe <[email protected]>
io_uring/kbuf: hold io_buffer_list reference over mmap
Jens Axboe <[email protected]>
io_uring: use private workqueue for exit work
Jens Axboe <[email protected]>
io_uring/rw: don't allow multishot reads without NOWAIT support
Jens Axboe <[email protected]>
io_uring/kbuf: protect io_buffer_list teardown with a reference
Jens Axboe <[email protected]>
io_uring/kbuf: get rid of bl->is_ready
Jens Axboe <[email protected]>
io_uring/kbuf: get rid of lower BGID lists
I Gede Agastya Darma Laksana <[email protected]>
ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone
Luke D. Jones <[email protected]>
ALSA: hda/realtek: cs35l41: Support ASUS ROG G634JYR
Christian Bendiksen <[email protected]>
ALSA: hda/realtek: Add sound quirks for Lenovo Legion slim 7 16ARHA7 models
Christoffer Sandberg <[email protected]>
ALSA: hda/realtek - Fix inactive headset mic jack
Peter Ujfalusi <[email protected]>
ALSA: hda: Add pplcllpl/u members to hdac_ext_stream
Namjae Jeon <[email protected]>
ksmbd: do not set SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1
Namjae Jeon <[email protected]>
ksmbd: validate payload size in ipc response
Namjae Jeon <[email protected]>
ksmbd: don't send oplock break if rename fails
Kent Gibson <[email protected]>
gpio: cdev: fix missed label sanitizing in debounce_setup()
Bartosz Golaszewski <[email protected]>
gpio: cdev: check for NULL labels when sanitizing them for irqs
Gabe Teeger <[email protected]>
Revert "drm/amd/display: Send DTBCLK disable message on first commit"
Borislav Petkov (AMD) <[email protected]>
x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk
Peter Collingbourne <[email protected]>
stackdepot: rename pool_index to pool_index_plus_1
Oscar Salvador <[email protected]>
lib/stackdepot: move stack_record struct definition into the header
Jeff Layton <[email protected]>
nfsd: hold a lighter-weight client reference over CB_RECALL_ANY
Alexandre Ghiti <[email protected]>
riscv: Disable preemption when using patch_map()
Alexandre Ghiti <[email protected]>
riscv: Fix warning by declaring arch_cpu_idle() as noinstr
Andreas Schwab <[email protected]>
riscv: use KERN_INFO in do_trap
Chuck Lever <[email protected]>
SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
Vijendar Mukunda <[email protected]>
ASoC: SOF: amd: fix for false dsp interrupts
Arnd Bergmann <[email protected]>
ata: sata_mv: Fix PCI device ID table declaration compilation warning
Andi Shyti <[email protected]>
drm/i915/gt: Limit the reserved VM space to only the platforms that need it
Nikita Travkin <[email protected]>
thermal: gov_power_allocator: Allow binding without trip points
Nikita Travkin <[email protected]>
thermal: gov_power_allocator: Allow binding without cooling devices
Thomas Richter <[email protected]>
s390/pai: fix sampling event removal for PMU device driver
Huai-Yuan Liu <[email protected]>
spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe
David Howells <[email protected]>
cifs: Fix caching to try to do open O_WRONLY as rdwr on server
Imre Deak <[email protected]>
drm/i915/dp: Fix DSC state HW readout for SST connectors
Oswald Buddenhagen <[email protected]>
Revert "ALSA: emu10k1: fix synthesizer sample playback position and caching"
Li Nan <[email protected]>
scsi: sd: Unregister device if device_add_disk() failed in sd_probe()
Arnd Bergmann <[email protected]>
scsi: mylex: Fix sysfs buffer lengths
Arnd Bergmann <[email protected]>
ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
Richard Fitzgerald <[email protected]>
regmap: maple: Fix uninitialized symbol 'ret' warnings
Vijendar Mukunda <[email protected]>
ASoC: amd: acp: fix for acp_init function error handling
Jaewon Kim <[email protected]>
spi: s3c64xx: Use DMA mode from fifo size
Tudor Ambarus <[email protected]>
spi: s3c64xx: determine the fifo depth only once
Tudor Ambarus <[email protected]>
spi: s3c64xx: allow full FIFO masks
Tudor Ambarus <[email protected]>
spi: s3c64xx: define a magic value
Tudor Ambarus <[email protected]>
spi: s3c64xx: remove else after return
Tudor Ambarus <[email protected]>
spi: s3c64xx: explicitly include <linux/bits.h>
Tudor Ambarus <[email protected]>
spi: s3c64xx: sort headers alphabetically
Sam Protsenko <[email protected]>
spi: s3c64xx: Extract FIFO depth calculation to a dedicated macro
Stephen Lee <[email protected]>
ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
Pierre-Louis Bossart <[email protected]>
ASoC: rt722-sdca-sdw: fix locking sequence
Pierre-Louis Bossart <[email protected]>
ASoC: rt712-sdca-sdw: fix locking sequence
Pierre-Louis Bossart <[email protected]>
ASoC: rt711-sdw: fix locking sequence
Pierre-Louis Bossart <[email protected]>
ASoC: rt711-sdca: fix locking sequence
Pierre-Louis Bossart <[email protected]>
ASoC: rt5682-sdw: fix locking sequence
Rob Clark <[email protected]>
drm/prime: Unbreak virtgpu dma-buf export
Dave Airlie <[email protected]>
nouveau/uvmm: fix addr/range calcs for remap operations
Christian Hewitt <[email protected]>
drm/panfrost: fix power transition timeout warnings
Simon Trimmer <[email protected]>
ALSA: hda: cs35l56: Add ACPI device match tables
Richard Fitzgerald <[email protected]>
regmap: maple: Fix cache corruption in regcache_maple_drop()
Vijendar Mukunda <[email protected]>
ASoC: amd: acp: fix for acp pdm configuration check
Victor Isaev <[email protected]>
RISC-V: Update AT_VECTOR_SIZE_ARCH for new AT_MINSIGSTKSZ
Christian Brauner <[email protected]>
block: count BLK_OPEN_RESTRICT_WRITES openers
Pu Lehui <[email protected]>
drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported
Vladimir Isaev <[email protected]>
riscv: hwprobe: do not produce frtace relocation
Samuel Holland <[email protected]>
riscv: mm: Fix prototype to avoid discarding const
Charles Keepax <[email protected]>
ASoC: cs42l43: Correct extraction of data pointer in suspend/resume
Richard Fitzgerald <[email protected]>
ASoC: wm_adsp: Fix missing mutex_lock in wm_adsp_write_ctl()
Dominique Martinet <[email protected]>
9p: Fix read/write debug statements to report server reply
Davide Caratti <[email protected]>
mptcp: don't account accept() of non-MPC client as fallback to TCP
Geliang Tang <[email protected]>
selftests: mptcp: use += operator to append strings
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: connect: fix shellcheck warnings
Ashish Kalra <[email protected]>
KVM: SVM: Add support for allowing zero SEV ASIDs
Sean Christopherson <[email protected]>
KVM: SVM: Use unsigned integers when dealing with ASIDs
Paul Barker <[email protected]>
net: ravb: Always update error counters
Paul Barker <[email protected]>
net: ravb: Always process TX descriptor ring
Claudiu Beznea <[email protected]>
net: ravb: Let IP-specific receive function to interrogate descriptors
Guenter Roeck <[email protected]>
mean_and_variance: Drop always failing tests
Vitaly Lifshits <[email protected]>
e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue
Vitaly Lifshits <[email protected]>
e1000e: Minor flow correction in e1000_shutdown function
Mario Limonciello <[email protected]>
drm/amd: Flush GFXOFF requests in prepare stage
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Check for notifications after init
Alexander Wetzel <[email protected]>
scsi: sg: Avoid sg device teardown race
Ivan Vecera <[email protected]>
i40e: Enforce software interrupt during busy-poll exit
Aleksandr Loktionov <[email protected]>
i40e: fix vf may be used uninitialized in this function warning
Aleksandr Loktionov <[email protected]>
i40e: fix i40e_count_filters() to count only active/new filters
Aleksandr Mishin <[email protected]>
octeontx2-af: Add array index check
Su Hui <[email protected]>
octeontx2-pf: check negative error code in otx2_open()
Hariprasad Kelam <[email protected]>
octeontx2-af: Fix issue with loading coalesced KPU profiles
Antoine Tenart <[email protected]>
udp: prevent local UDP tunnel packets from being GROed
Antoine Tenart <[email protected]>
udp: do not transition UDP GRO fraglist partial checksums to unnecessary
Antoine Tenart <[email protected]>
udp: do not accept non-tunnel GSO skbs landing in a tunnel
Atlas Yu <[email protected]>
r8169: skip DASH fw status checks when DASH is disabled
David Thompson <[email protected]>
mlxbf_gige: stop interface during shutdown
Kuniyuki Iwashima <[email protected]>
ipv6: Fix infinite recursion in fib6_dump_done().
Vitaly Lifshits <[email protected]>
e1000e: Workaround for sporadic MDI error on Meteor Lake systems
Duoming Zhou <[email protected]>
ax25: fix use-after-free bugs caused by ax25_ds_del_timer
Kuniyuki Iwashima <[email protected]>
tcp: Fix bind() regression for v6-only wildcard and v4(-mapped-v6) non-wildcard addresses.
Jakub Kicinski <[email protected]>
selftests: reuseaddr_conflict: add missing new line at the end of the output
Eric Dumazet <[email protected]>
erspan: make sure erspan_base_hdr is present in skb->head
Kuniyuki Iwashima <[email protected]>
tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses.
Ivan Vecera <[email protected]>
i40e: Fix VF MAC filter removal
Petr Oros <[email protected]>
ice: fix enabling RX VLAN filtering
Joshua Hay <[email protected]>
idpf: fix kernel panic on unknown packet types
Antoine Tenart <[email protected]>
gro: fix ownership transfer
Antoine Tenart <[email protected]>
selftests: net: gro fwd: update vxlan GRO test expectations
Michael Krummsdorf <[email protected]>
net: dsa: mv88e6xxx: fix usable ports on 88e6020
Aleksandr Mishin <[email protected]>
net: phy: micrel: Fix potential null pointer dereference
Wei Fang <[email protected]>
net: fec: Set mac_managed_pm during probe
Duanqiang Wen <[email protected]>
net: txgbe: fix i2c dev name cannot match clkdev
Horatiu Vultur <[email protected]>
net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping
Piotr Wejman <[email protected]>
net: stmmac: fix rx queue priority assignment
Eric Dumazet <[email protected]>
net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()
Christophe JAILLET <[email protected]>
net: dsa: sja1105: Fix parameters order in sja1110_pcs_mdio_write_c45()
Eric Dumazet <[email protected]>
net/sched: act_skbmod: prevent kernel-infoleak
Will Deacon <[email protected]>
KVM: arm64: Ensure target address is granule-aligned for range TLBI
Will Deacon <[email protected]>
KVM: arm64: Use TLBI_TTL_UNKNOWN in __kvm_tlb_flush_vmid_range()
Borislav Petkov (AMD) <[email protected]>
x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO
Paolo Abeni <[email protected]>
mptcp: prevent BPF accessing lowat from a subflow socket.
Jakub Sitnicki <[email protected]>
bpf, sockmap: Prevent lock inversion deadlock in map delete elem
Christophe JAILLET <[email protected]>
vboxsf: Avoid an spurious warning if load_nls_xxx() fails
Eric Dumazet <[email protected]>
netfilter: validate user input for expected length
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: discard table flag update with pending basechain deletion
Ziyang Xuan <[email protected]>
netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: flush pending destroy work before exit_net release
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject new basechain after table flag update
Marco Pinna <[email protected]>
vsock/virtio: fix packet delivery to tap device
Haiyang Zhang <[email protected]>
net: mana: Fix Rx DMA datasize and skb_over_panic
Jose Ignacio Tornos Martinez <[email protected]>
net: usb: ax88179_178a: avoid the interface always configured as random address
Mahmoud Adam <[email protected]>
net/rds: fix possible cp null dereference
Jesper Dangaard Brouer <[email protected]>
xen-netfront: Add missing skb_mark_for_recycle
Geliang Tang <[email protected]>
selftests: mptcp: join: fix dev in check_endpoint
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: release batch on table validation from abort path
Bastien Nocera <[email protected]>
Bluetooth: Fix TOCTOU in HCI debugfs implementation
Hui Wang <[email protected]>
Bluetooth: hci_event: set the conn encrypted before conn establishes
Johan Hovold <[email protected]>
Bluetooth: add quirk for broken address properties
Johan Hovold <[email protected]>
Bluetooth: qca: fix device-address endianness
Johan Hovold <[email protected]>
arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken
Johan Hovold <[email protected]>
Revert "Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT"
Uros Bizjak <[email protected]>
x86/bpf: Fix IP after emitting call depth accounting
Sean Christopherson <[email protected]>
x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word
Sandipan Das <[email protected]>
x86/cpufeatures: Add new word for scattered features
Heiner Kallweit <[email protected]>
r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
Christian Göttsche <[email protected]>
selinux: avoid dereference of garbage after mount failure
Wujie Duan <[email protected]>
KVM: arm64: Fix out-of-IPA space translation fault handling
Oliver Upton <[email protected]>
KVM: arm64: Fix host-programmed guest events in nVHE
Anup Patel <[email protected]>
RISC-V: KVM: Fix APLIC in_clrip[x] read emulation
Anup Patel <[email protected]>
RISC-V: KVM: Fix APLIC setipnum_le/be write emulation
Bartosz Golaszewski <[email protected]>
gpio: cdev: sanitize the label before requesting the interrupt
Ingo Molnar <[email protected]>
Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."
Peter Xu <[email protected]>
mm/treewide: replace pud_large() with pud_leaf()
Arnd Bergmann <[email protected]>
kbuild: make -Woverride-init warnings more consistent
Masahiro Yamada <[email protected]>
modpost: do not make find_tosym() return NULL
Arnd Bergmann <[email protected]>
dm integrity: fix out-of-range warning
José Roberto de Souza <[email protected]>
drm/i915: Do not print 'pxp init failed with 0' when it succeed
Tejas Upadhyay <[email protected]>
drm/i915/mtl: Update workaround 14018575942
Matt Roper <[email protected]>
drm/i915/xelpg: Extend some workarounds/tuning to gfx version 12.74
Juha-Pekka Heikkila <[email protected]>
drm/i915/display: Disable AuxCCS framebuffers if built for Xe
Ville Syrjälä <[email protected]>
drm/i915: Stop doing double audio enable/disable on SDVO and g4x+ DP
Florian Westphal <[email protected]>
inet: inet_defrag: prevent sk release while still in use
Hariprasad Kelam <[email protected]>
Octeontx2-af: fix pause frame configuration in GMP mode
Raju Lakkaraju <[email protected]>
net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips
Justin Chen <[email protected]>
net: bcmasp: Bring up unimac after PHY link up
Jason Gunthorpe <[email protected]>
iommu: Validate the PASID in iommu_attach_device_pasid()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: skip netdev hook unregistration if table is dormant
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject table flag and netdev basechain updates
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject destroy command to remove basechain hooks
David Howells <[email protected]>
cifs: Fix duplicate fscache cookie warnings
Andrei Matei <[email protected]>
bpf: Protect against int overflow for stack access size
Taimur Hassan <[email protected]>
drm/amd/display: Send DTBCLK disable message on first commit
Charlene Liu <[email protected]>
drm/amd/display: Update P010 scaling cap
David Thompson <[email protected]>
mlxbf_gige: call request_irq() after NAPI initialized
Sabrina Dubroca <[email protected]>
tls: get psock ref after taking rxlock to avoid leak
Sabrina Dubroca <[email protected]>
tls: adjust recv return with async crypto and failed copy to userspace
Sabrina Dubroca <[email protected]>
tls: recv: process_rx_list shouldn't use an offset with kvec
Jian Shen <[email protected]>
net: hns3: mark unexcuted loopback test result as UNEXECUTED
Yonglong Liu <[email protected]>
net: hns3: fix kernel crash when devlink reload during pf initialization
Jie Wang <[email protected]>
net: hns3: fix index limit to support all queue stats
Nikita Kiryushin <[email protected]>
ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields()
Andy Shevchenko <[email protected]>
gpiolib: Fix debug messaging in gpiod_find_and_request()
Ido Schimmel <[email protected]>
selftests: vxlan_mdb: Fix failures with old libnet
Andy Yan <[email protected]>
drm/rockchip: vop2: Remove AR30 and AB30 format support
Bjørn Mork <[email protected]>
net: wwan: t7xx: Split 64bit accesses to fix alignment issues
Eric Dumazet <[email protected]>
tcp: properly terminate timers for kernel sockets
Ravi Gunasekaran <[email protected]>
net: hsr: hsr_slave: Fix the promiscuous mode in offload mode
Alexandra Winter <[email protected]>
s390/qeth: handle deferred cc1
Prasad Pandit <[email protected]>
dpll: indent DPLL option type by a tab
Matthew Auld <[email protected]>
drm/xe/device: fix XE_MAX_TILES_PER_DEVICE check
Matthew Auld <[email protected]>
drm/xe/device: fix XE_MAX_GT_PER_TILE check
Matthew Auld <[email protected]>
drm/xe/queue: fix engine_class bounds check
Matthew Auld <[email protected]>
drm/xe/guc_submit: use jiffies for job timeout
Brian Welty <[email protected]>
drm/xe: Add exec_queue.sched_props.job_timeout_ms
Nirmoy Das <[email protected]>
drm/xe: Remove unused xe_bo->props struct
Kurt Kanzenbach <[email protected]>
igc: Remove stale comment about Tx timestamping
Przemek Kitszel <[email protected]>
ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
Jesse Brandeburg <[email protected]>
ice: fix memory corruption bug with suspend and rebuild
Steven Zou <[email protected]>
ice: Refactor FW data type and fix bitmap casting issue
Simon Trimmer <[email protected]>
ALSA: hda: cs35l56: Set the init_done flag before component_add()
Benjamin Berg <[email protected]>
wifi: iwlwifi: mvm: include link ID when releasing frames
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: rfi: fix potential response leaks
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF
David Thompson <[email protected]>
mlxbf_gige: stop PHY during open() error paths
Jakub Kicinski <[email protected]>
tools: ynl: fix setting presence bits in simple nests
Jan Kara <[email protected]>
nfsd: Fix error cleanup path in nfsd_rename()
Ryosuke Yasuoka <[email protected]>
nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
Artem Savkov <[email protected]>
arm64: bpf: fix 32bit unconditional bswap
Pavel Sakharov <[email protected]>
dma-buf: Fix NULL pointer dereference in sanitycheck()
Puranjay Mohan <[email protected]>
bpf, arm64: fix bug in BPF_LDX_MEMSX
Ilya Leoshkevich <[email protected]>
s390/bpf: Fix bpf_plt pointer arithmetic
Stanislav Fomichev <[email protected]>
xsk: Don't assume metadata is always requested in TX completion
Hangbin Liu <[email protected]>
scripts/bpf_doc: Use silent mode when exec make cmd
-------------
Diffstat:
Makefile | 4 +- arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi | 2 + arch/arm64/kernel/ptrace.c | 5 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 3 +- arch/arm64/kvm/hyp/pgtable.c | 11 +- arch/arm64/kvm/hyp/vhe/tlb.c | 3 +- arch/arm64/kvm/mmu.c | 2 +- arch/arm64/net/bpf_jit_comp.c | 4 +- arch/powerpc/mm/book3s64/pgtable.c | 2 +- arch/riscv/include/asm/uaccess.h | 4 +- arch/riscv/include/uapi/asm/auxvec.h | 2 +- arch/riscv/kernel/patch.c | 8 + arch/riscv/kernel/process.c | 5 +- arch/riscv/kernel/signal.c | 15 +- arch/riscv/kernel/traps.c | 2 +- arch/riscv/kernel/vdso/Makefile | 1 + arch/riscv/kvm/aia_aplic.c | 37 +++- arch/riscv/mm/tlbflush.c | 4 +- arch/s390/boot/vmem.c | 2 +- arch/s390/include/asm/pgtable.h | 4 +- arch/s390/kernel/entry.S | 1 + arch/s390/kernel/perf_pai_crypto.c | 10 +- arch/s390/kernel/perf_pai_ext.c | 10 +- arch/s390/mm/gmap.c | 2 +- arch/s390/mm/hugetlbpage.c | 4 +- arch/s390/mm/pageattr.c | 2 +- arch/s390/mm/pgtable.c | 2 +- arch/s390/mm/vmem.c | 6 +- arch/s390/net/bpf_jit_comp.c | 46 ++--- arch/sparc/mm/init_64.c | 2 +- arch/x86/boot/compressed/Makefile | 2 +- arch/x86/boot/compressed/misc.c | 16 ++ arch/x86/boot/compressed/sev.c | 3 + arch/x86/coco/core.c | 41 +++++ arch/x86/events/intel/ds.c | 8 +- arch/x86/include/asm/boot.h | 1 + arch/x86/include/asm/coco.h | 2 + arch/x86/include/asm/cpufeature.h | 8 +- arch/x86/include/asm/cpufeatures.h | 2 +- arch/x86/include/asm/disabled-features.h | 3 +- arch/x86/include/asm/mem_encrypt.h | 8 +- arch/x86/include/asm/required-features.h | 3 +- arch/x86/include/asm/sev.h | 10 +- arch/x86/include/uapi/asm/bootparam.h | 1 + arch/x86/kernel/cpu/mce/core.c | 4 +- arch/x86/kernel/mpparse.c | 10 +- arch/x86/kernel/setup.c | 2 + arch/x86/kernel/sev-shared.c | 23 +-- arch/x86/kernel/sev.c | 14 +- arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/kvm/reverse_cpuid.h | 2 + arch/x86/kvm/svm/sev.c | 45 +++-- arch/x86/kvm/trace.h | 10 +- arch/x86/lib/Makefile | 13 -- arch/x86/lib/retpoline.S | 6 +- arch/x86/mm/fault.c | 4 +- arch/x86/mm/ident_map.c | 23 +-- arch/x86/mm/init_64.c | 4 +- arch/x86/mm/kasan_init_64.c | 2 +- arch/x86/mm/mem_encrypt_identity.c | 76 +++----- arch/x86/mm/pat/memtype.c | 49 +++-- arch/x86/mm/pat/set_memory.c | 6 +- arch/x86/mm/pgtable.c | 2 +- arch/x86/mm/pti.c | 2 +- arch/x86/net/bpf_jit_comp.c | 2 +- arch/x86/power/hibernate.c | 2 +- arch/x86/xen/mmu_pv.c | 4 +- block/bdev.c | 6 +- drivers/acpi/acpica/dbnames.c | 8 +- drivers/ata/sata_mv.c | 63 ++++--- drivers/ata/sata_sx4.c | 6 +- drivers/base/core.c | 26 ++- drivers/base/regmap/regcache-maple.c | 6 +- drivers/bluetooth/btqca.c | 8 +- drivers/bluetooth/hci_qca.c | 19 +- drivers/dma-buf/st-dma-fence-chain.c | 6 +- drivers/dpll/Kconfig | 2 +- drivers/firmware/efi/libstub/efi-stub-helper.c | 8 + drivers/firmware/efi/libstub/efistub.h | 2 +- drivers/firmware/efi/libstub/x86-stub.c | 14 +- drivers/gpio/gpiolib-cdev.c | 58 +++++- drivers/gpio/gpiolib.c | 31 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 25 ++- drivers/gpu/drm/amd/display/dc/dce110/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dce112/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dce120/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dce60/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dce80/Makefile | 2 +- .../amd/display/dc/resource/dcn35/dcn35_resource.c | 2 +- drivers/gpu/drm/drm_prime.c | 7 +- drivers/gpu/drm/i915/Makefile | 7 +- drivers/gpu/drm/i915/display/g4x_dp.c | 2 - .../gpu/drm/i915/display/intel_display_device.h | 1 + drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/display/intel_dp_mst.c | 2 +- drivers/gpu/drm/i915/display/intel_sdvo.c | 4 - drivers/gpu/drm/i915/display/skl_universal_plane.c | 3 + drivers/gpu/drm/i915/gt/gen8_engine_cs.c | 4 +- drivers/gpu/drm/i915/gt/gen8_ppgtt.c | 3 + drivers/gpu/drm/i915/gt/intel_engine_cs.c | 17 ++ drivers/gpu/drm/i915/gt/intel_gt.c | 6 + drivers/gpu/drm/i915/gt/intel_gt.h | 9 +- drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c | 39 ++++ drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.h | 13 ++ drivers/gpu/drm/i915/gt/intel_gt_regs.h | 6 + drivers/gpu/drm/i915/gt/intel_workarounds.c | 55 ++++-- drivers/gpu/drm/i915/i915_driver.c | 2 +- drivers/gpu/drm/i915/i915_perf.c | 2 +- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 6 +- drivers/gpu/drm/panfrost/panfrost_gpu.c | 6 +- drivers/gpu/drm/rockchip/rockchip_vop2_reg.c | 2 - drivers/gpu/drm/xe/Makefile | 4 +- drivers/gpu/drm/xe/xe_bo.c | 59 +----- drivers/gpu/drm/xe/xe_bo_types.h | 19 -- drivers/gpu/drm/xe/xe_device.h | 4 +- drivers/gpu/drm/xe/xe_exec.c | 31 +--- drivers/gpu/drm/xe/xe_exec_queue.c | 4 +- drivers/gpu/drm/xe/xe_exec_queue_types.h | 7 + drivers/gpu/drm/xe/xe_guc_submit.c | 2 +- drivers/gpu/drm/xe/xe_pt.c | 8 +- drivers/gpu/drm/xe/xe_ring_ops.c | 11 +- drivers/gpu/drm/xe/xe_sched_job.c | 10 + drivers/gpu/drm/xe/xe_sched_job_types.h | 2 + drivers/gpu/drm/xe/xe_vm.c | 27 +-- drivers/gpu/drm/xe/xe_vm.h | 2 +- drivers/gpu/drm/xe/xe_vm_types.h | 8 +- drivers/iommu/iommu.c | 11 +- drivers/md/dm-integrity.c | 2 +- drivers/net/dsa/mv88e6xxx/chip.c | 6 +- drivers/net/dsa/sja1105/sja1105_mdio.c | 2 +- drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 28 ++- drivers/net/ethernet/freescale/fec_main.c | 11 +- .../hns3/hns3_common/hclge_comm_tqp_stats.c | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 19 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 + drivers/net/ethernet/intel/e1000e/hw.h | 2 + drivers/net/ethernet/intel/e1000e/ich8lan.c | 38 ++-- drivers/net/ethernet/intel/e1000e/netdev.c | 24 ++- drivers/net/ethernet/intel/e1000e/phy.c | 184 +++++++++++------- drivers/net/ethernet/intel/e1000e/phy.h | 2 + drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 13 +- drivers/net/ethernet/intel/i40e/i40e_register.h | 3 + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 82 ++++++--- drivers/net/ethernet/intel/i40e/i40e_txrx.h | 1 + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 45 +++-- drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 3 +- drivers/net/ethernet/intel/ice/ice_lag.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 18 +- drivers/net/ethernet/intel/ice/ice_switch.c | 24 ++- drivers/net/ethernet/intel/ice/ice_switch.h | 4 +- .../net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c | 18 +- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 4 +- drivers/net/ethernet/intel/igc/igc_main.c | 4 - drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 16 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 + .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 + .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 2 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 31 +++- drivers/net/ethernet/microchip/lan743x_main.c | 18 ++ drivers/net/ethernet/microchip/lan743x_main.h | 4 + drivers/net/ethernet/microsoft/mana/mana_en.c | 2 +- drivers/net/ethernet/realtek/r8169_main.c | 40 +++- drivers/net/ethernet/renesas/ravb_main.c | 33 ++-- drivers/net/ethernet/renesas/sh_eth.c | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 40 +++- .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 38 +++- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 8 +- drivers/net/phy/micrel.c | 31 +++- drivers/net/usb/ax88179_178a.c | 2 + drivers/net/wireless/intel/iwlwifi/mvm/rfi.c | 8 +- drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 20 +- .../net/wireless/intel/iwlwifi/mvm/time-event.c | 5 +- drivers/net/wwan/t7xx/t7xx_cldma.c | 4 +- drivers/net/wwan/t7xx/t7xx_hif_cldma.c | 9 +- drivers/net/wwan/t7xx/t7xx_pcie_mac.c | 8 +- drivers/net/xen-netfront.c | 1 + drivers/of/dynamic.c | 12 ++ drivers/of/module.c | 8 + drivers/perf/riscv_pmu.c | 4 + drivers/pinctrl/aspeed/Makefile | 2 +- drivers/s390/net/qeth_core_main.c | 38 +++- drivers/scsi/myrb.c | 20 +- drivers/scsi/myrs.c | 24 +-- drivers/scsi/sd.c | 2 +- drivers/scsi/sg.c | 4 +- drivers/spi/spi-pci1xxxx.c | 2 + drivers/spi/spi-s3c64xx.c | 80 +++++--- drivers/thermal/gov_power_allocator.c | 14 +- drivers/usb/typec/ucsi/ucsi.c | 10 +- fs/aio.c | 2 +- fs/bcachefs/mean_and_variance_test.c | 28 +-- fs/nfsd/nfs4state.c | 7 +- fs/nfsd/vfs.c | 3 +- fs/proc/Makefile | 2 +- fs/smb/client/cached_dir.c | 6 +- fs/smb/client/cifs_debug.c | 6 + fs/smb/client/cifsfs.c | 11 ++ fs/smb/client/cifsglob.h | 19 +- fs/smb/client/cifsproto.h | 20 +- fs/smb/client/connect.c | 157 ++++++++++------ fs/smb/client/dfs.c | 51 +++-- fs/smb/client/dfs.h | 33 ++-- fs/smb/client/dfs_cache.c | 53 +++--- fs/smb/client/dir.c | 15 ++ fs/smb/client/file.c | 111 +++++++++-- fs/smb/client/fs_context.c | 6 +- fs/smb/client/fs_context.h | 12 ++ fs/smb/client/fscache.c | 16 +- fs/smb/client/fscache.h | 6 + fs/smb/client/inode.c | 2 + fs/smb/client/ioctl.c | 6 +- fs/smb/client/misc.c | 8 +- fs/smb/client/smb1ops.c | 4 +- fs/smb/client/smb2misc.c | 4 + fs/smb/client/smb2ops.c | 11 +- fs/smb/client/smb2pdu.c | 2 +- fs/smb/server/ksmbd_netlink.h | 3 +- fs/smb/server/mgmt/share_config.c | 7 +- fs/smb/server/smb2ops.c | 10 +- fs/smb/server/smb2pdu.c | 3 +- fs/smb/server/transport_ipc.c | 37 ++++ fs/vboxsf/super.c | 3 +- include/kvm/arm_pmu.h | 2 +- include/linux/bpf.h | 16 +- include/linux/device.h | 1 + include/linux/io_uring_types.h | 1 - include/linux/secretmem.h | 4 +- include/linux/skbuff.h | 7 +- include/linux/stackdepot.h | 46 +++++ include/linux/udp.h | 28 +++ include/net/bluetooth/hci.h | 9 + include/net/inet_connection_sock.h | 1 + include/net/mana/mana.h | 1 - include/net/sock.h | 7 + include/net/xdp_sock.h | 2 + include/sound/hdaudio_ext.h | 3 + io_uring/io_uring.c | 18 +- io_uring/kbuf.c | 116 ++++-------- io_uring/kbuf.h | 8 +- io_uring/rw.c | 9 +- kernel/bpf/Makefile | 2 +- kernel/bpf/syscall.c | 35 +++- kernel/bpf/verifier.c | 5 + kernel/trace/bpf_trace.c | 10 +- lib/stackdepot.c | 47 +---- mm/Makefile | 3 +- mm/memory.c | 4 + net/9p/client.c | 10 +- net/ax25/ax25_dev.c | 2 +- net/bluetooth/hci_debugfs.c | 64 ++++--- net/bluetooth/hci_event.c | 25 +++ net/bluetooth/hci_sync.c | 5 +- net/bridge/netfilter/ebtables.c | 6 + net/core/gro.c | 3 +- net/core/sock_map.c | 6 + net/hsr/hsr_slave.c | 3 +- net/ipv4/inet_connection_sock.c | 44 ++++- net/ipv4/inet_fragment.c | 70 +++++-- net/ipv4/ip_fragment.c | 2 +- net/ipv4/ip_gre.c | 5 + net/ipv4/netfilter/arp_tables.c | 4 + net/ipv4/netfilter/ip_tables.c | 4 + net/ipv4/tcp.c | 2 + net/ipv4/udp.c | 7 + net/ipv4/udp_offload.c | 23 ++- net/ipv6/ip6_fib.c | 14 +- net/ipv6/ip6_gre.c | 3 + net/ipv6/netfilter/ip6_tables.c | 4 + net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/ipv6/udp.c | 2 +- net/ipv6/udp_offload.c | 8 +- net/mptcp/protocol.c | 2 - net/mptcp/sockopt.c | 4 + net/mptcp/subflow.c | 2 + net/netfilter/nf_tables_api.c | 92 +++++++-- net/nfc/nci/core.c | 5 + net/rds/rdma.c | 2 +- net/sched/act_skbmod.c | 10 +- net/sched/sch_api.c | 2 +- net/sunrpc/svcsock.c | 10 +- net/tls/tls_sw.c | 7 +- net/vmw_vsock/virtio_transport.c | 3 +- scripts/Makefile.extrawarn | 10 +- scripts/bpf_doc.py | 4 +- scripts/mod/modpost.c | 7 +- security/selinux/selinuxfs.c | 12 +- sound/pci/emu10k1/emu10k1_callback.c | 7 +- sound/pci/hda/cs35l41_hda_property.c | 6 + sound/pci/hda/cs35l56_hda.c | 4 +- sound/pci/hda/cs35l56_hda_i2c.c | 13 +- sound/pci/hda/cs35l56_hda_spi.c | 13 +- sound/pci/hda/patch_realtek.c | 7 +- sound/soc/amd/acp/acp-pci.c | 13 +- sound/soc/codecs/cs42l43.c | 12 +- sound/soc/codecs/rt5682-sdw.c | 4 +- sound/soc/codecs/rt711-sdca-sdw.c | 4 +- sound/soc/codecs/rt711-sdw.c | 4 +- sound/soc/codecs/rt712-sdca-sdw.c | 5 +- sound/soc/codecs/rt722-sdca-sdw.c | 4 +- sound/soc/codecs/wm_adsp.c | 3 +- sound/soc/soc-ops.c | 2 +- sound/soc/sof/amd/acp.c | 8 +- sound/soc/sof/intel/hda-common-ops.c | 3 + sound/soc/sof/intel/hda-dai-ops.c | 11 ++ sound/soc/sof/intel/hda-pcm.c | 29 +++ sound/soc/sof/intel/hda-stream.c | 70 +++++++ sound/soc/sof/intel/hda.h | 6 + sound/soc/sof/intel/lnl.c | 2 - sound/soc/sof/intel/mtl.c | 14 -- sound/soc/sof/intel/mtl.h | 10 - sound/soc/sof/ipc4-pcm.c | 193 +++++++++++++++---- sound/soc/sof/ipc4-priv.h | 14 -- sound/soc/sof/ipc4-topology.c | 22 ++- sound/soc/sof/ops.h | 24 ++- sound/soc/sof/pcm.c | 8 + sound/soc/sof/sof-audio.h | 9 +- sound/soc/sof/sof-priv.h | 24 ++- tools/net/ynl/ynl-gen-c.py | 7 +- tools/testing/selftests/mm/vm_util.h | 2 +- tools/testing/selftests/net/mptcp/mptcp_connect.sh | 134 ++++++++------ tools/testing/selftests/net/mptcp/mptcp_join.sh | 34 ++-- tools/testing/selftests/net/reuseaddr_conflict.c | 2 +- tools/testing/selftests/net/test_vxlan_mdb.sh | 205 +++++++++++++-------- tools/testing/selftests/net/udpgro_fwd.sh | 10 +- 327 files changed, 3223 insertions(+), 1693 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/273 scripts/bpf_doc: Use silent mode when exec make cmd
6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 5384cc0d1a88c27448a6a4e65b8abe6486de8012 ]
When getting kernel version via make, the result may be polluted by other output, like directory change info. e.g.
$ export MAKEFLAGS="-w" $ make kernelversion make: Entering directory '/home/net' 6.8.0 make: Leaving directory '/home/net'
This will distort the reStructuredText output and make latter rst2man failed like:
[...]
bpf-helpers.rst:20: (WARNING/2) Field list ends without a blank line; unexpected unindent. [...]
Using silent mode would help. e.g.
$ make -s --no-print-directory kernelversion 6.8.0
--- scripts/bpf_doc.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
scripts/bpf_doc.py +2 -2
@@ -414,8 +414,8 @@ class PrinterRST(Printer): version = version.stdout.decode().rstrip() except: try: - version = subprocess.run(['make', 'kernelversion'], cwd=linuxRoot, - capture_output=True, check=True) + version = subprocess.run(['make', '-s', '--no-print-directory', 'kernelversion'], + cwd=linuxRoot, capture_output=True, check=True) version = version.stdout.decode().rstrip() except: return 'Linux'
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/273 xsk: Dont assume metadata is always requested in TX completion
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Fomichev <[email protected]>
[ Upstream commit f6e922365faf4cd576bd1cf3e64b58c8a32e1856 ]
compl->tx_timestam != NULL means that the user has explicitly requested the metadata via XDP_TX_METADATA+XDP_TX_METADATA_TIMESTAMP.
--- include/net/xdp_sock.h | 2 ++ 1 file changed, 2 insertions(+)
include/net/xdp_sock.h +2 -0
@@ -188,6 +188,8 @@ static inline void xsk_tx_metadata_complete(struct xsk_tx_metadata_compl *compl, {if (!compl)return ; +if (!compl->tx_timestamp) +return ; *compl->tx_timestamp = ops->tmo_fill_timestamp (priv); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/273 s390/bpf: Fix bpf_plt pointer arithmetic
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Leoshkevich <[email protected]>
[ Upstream commit 7ded842b356d151ece8ac4985940438e6d3998bb ]
Kui-Feng Lee reported a crash on s390x triggered by the dummy_st_ops/dummy_init_ptr_arg test [1]:
[<0000000000000002>] 0x2
[<00000000009d5cde>] bpf_struct_ops_test_run+0x156/0x250 [<000000000033145a>] __sys_bpf+0xa1a/0xd00 [<00000000003319dc>] __s390x_sys_bpf+0x44/0x50 [<0000000000c4382c>] __do_syscall+0x244/0x300 [<0000000000c59a40>] system_call+0x70/0x98
This is caused by GCC moving memcpy() after assignments in bpf_jit_plt(), resulting in NULL pointers being written instead of the return and the target addresses.
Looking at the GCC internals, the reordering is allowed because the alias analysis thinks that the memcpy() destination and the assignments' left-hand-sides are based on different objects: new_plt and bpf_plt_ret/bpf_plt_target respectively, and therefore they cannot alias.
This is in turn due to a violation of the C standard:
When two pointers are subtracted, both shall point to elements of the same array object, or one past the last element of the array object
...
Quoted 1 line
From the C's perspective,
bpf_plt_retandbpf_pltare distinct objects
and cannot be subtracted. In the practical terms, doing so confuses the GCC's alias analysis.
The code was written this way in order to let the C side know a few offsets defined in the assembly. While nice, this is by no means necessary. Fix the noncompliance by hardcoding these offsets.
[1] https://lore.kernel.org/bpf/[email protected]/
Message-ID: <[email protected]>
--- arch/s390/net/bpf_jit_comp.c | 46 ++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 26 deletions(-)
arch/s390/net/bpf_jit_comp.c +20 -26
@@ -516,11 +516,12 @@ static void bpf_skip(struct bpf_jit *jit, int size)* PLT for hotpatchable calls. The calling convention is the same as for the * ftrace hotpatch trampolines: %r0 is return address, %r1 is clobbered. */ -extern const char bpf_plt[]; -extern const char bpf_plt_ret[]; -extern const char bpf_plt_target[]; -extern const char bpf_plt_end[]; -#define BPF_PLT_SIZE 32 +struct bpf_plt { +char code[16 ]; +void *ret; +void *target; +} __packed; +extern const struct bpf_plt bpf_plt; asm(".pushsection .rodata\n" " .balign 8\n"
@@ -531,15 +532,14 @@ asm(" .balign 8\n" "bpf_plt_ret: .quad 0\n" "bpf_plt_target: .quad 0\n" -"bpf_plt_end:\n" " .popsection\n" ); -static void bpf_jit_plt (void *plt,void *ret,void *target) +static void bpf_jit_plt (struct bpf_plt *plt,void *ret,void *target) { -memcpy (plt, bpf_plt,BPF_PLT_SIZE ); - *(void **)((char *)plt + (bpf_plt_ret - bpf_plt)) = ret; - *(void **)((char *)plt + (bpf_plt_target - bpf_plt)) = target ?: ret; +memcpy (plt, &bpf_plt,sizeof (*plt)); + plt->ret = ret; + plt->target = target; }/*
@@ -662,9 +662,9 @@ static void bpf_jit_epilogue(struct bpf_jit *jit, u32 stack_depth) jit->prg =ALIGN (jit->prg,8 ); jit->prologue_plt = jit->prg;if (jit->prg_buf) -bpf_jit_plt (jit->prg_buf + jit->prg, +bpf_jit_plt ((struct bpf_plt *)(jit->prg_buf + jit->prg), jit->prg_buf + jit->prologue_plt_ret,NULL ); - jit->prg +=BPF_PLT_SIZE ; + jit->prg +=sizeof (struct bpf_plt ); }static int get_probe_mem_regno (const u8 *insn)
@@ -2040,9 +2040,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)struct bpf_jit jit;int pass; -if (WARN_ON_ONCE (bpf_plt_end - bpf_plt !=BPF_PLT_SIZE )) -return orig_fp; -if (!fp->jit_requested)return orig_fp;
@@ -2148,14 +2145,11 @@ bool bpf_jit_supports_far_kfunc_call(void)int bpf_arch_text_poke (void *ip,enum bpf_text_poke_type t,void *old_addr,void *new_addr) { +struct bpf_plt expected_plt, current_plt, new_plt, *plt;struct {u16 opc;s32 disp; } __packed insn; -char expected_plt[BPF_PLT_SIZE ]; -char current_plt[BPF_PLT_SIZE ]; -char new_plt[BPF_PLT_SIZE ]; -char *plt;char *ret;int err;
@@ -2174,18 +2168,18 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t,*/ }else {/* Verify the PLT. */ - plt = (char *)ip + (insn.disp <<1 ); - err =copy_from_kernel_nofault (current_plt, plt,BPF_PLT_SIZE ); + plt = ip + (insn.disp <<1 ); + err =copy_from_kernel_nofault (¤t_plt, plt, +sizeof (current_plt));if (err <0 )return err; ret = (char *)ip +6 ; -bpf_jit_plt (expected_plt, ret, old_addr); -if (memcmp (current_plt, expected_plt,BPF_PLT_SIZE )) +bpf_jit_plt (&expected_plt, ret, old_addr); +if (memcmp (¤t_plt, &expected_plt,sizeof (current_plt)))return -EINVAL ;/* Adjust the call address. */ -bpf_jit_plt (new_plt, ret, new_addr); -s390_kernel_write (plt + (bpf_plt_target - bpf_plt), - new_plt + (bpf_plt_target - bpf_plt), +bpf_jit_plt (&new_plt, ret, new_addr); +s390_kernel_write (&plt->target, &new_plt.target,sizeof (void *)); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/273 bpf, arm64: fix bug in BPF_LDX_MEMSX
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranjay Mohan <[email protected]>
[ Upstream commit 114b5b3b4bde7358624437be2f12cde1b265224e ]
A64_LDRSW() takes three registers: Xt, Xn, Xm as arguments and it loads and sign extends the value at address Xn + Xm into register Xt.
Currently, the offset is being directly used in place of the tmp register which has the offset already loaded by the last emitted instruction.
This will cause JIT failures. The easiest way to reproduce this is to test the following code through test_bpf module:
{
"BPF_LDX_MEMSX | BPF_W",
.u.insns_int = {
BPF_LD_IMM64(R1, 0x00000000deadbeefULL),
BPF_LD_IMM64(R2, 0xffffffffdeadbeefULL),
BPF_STX_MEM(BPF_DW, R10, R1, -7),
BPF_LDX_MEMSX(BPF_W, R0, R10, -7),
BPF_JMP_REG(BPF_JNE, R0, R2, 1),
BPF_ALU64_IMM(BPF_MOV, R0, 0),
BPF_EXIT_INSN(),
},
INTERNAL,
{ },
{ { 0, 0 } },
.stack_depth = 7,
},We need to use the offset as -7 to trigger this code path, there could be other valid ways to trigger this from proper BPF programs as well.
This code is rejected by the JIT because -7 is passed to A64_LDRSW() but it expects a valid register (0 - 31).
roott@pjy:~# modprobe test_bpf test_name="BPF_LDX_MEMSX | BPF_W" [11300.490371] test_bpf: test_bpf: set 'test_bpf' as the default test_suite. [11300.491750] test_bpf: #345 BPF_LDX_MEMSX | BPF_W [11300.493179] aarch64_insn_encode_register: unknown register encoding -7 [11300.494133] aarch64_insn_encode_register: unknown register encoding -7 [11300.495292] FAIL to select_runtime err=-524 [11300.496804] test_bpf: Summary: 0 PASSED, 1 FAILED, [0/0 JIT'ed] modprobe: ERROR: could not insert 'test_bpf': Invalid argument
Applying this patch fixes the issue.
root@pjy:~# modprobe test_bpf test_name="BPF_LDX_MEMSX | BPF_W" [ 292.837436] test_bpf: test_bpf: set 'test_bpf' as the default test_suite. [ 292.839416] test_bpf: #345 BPF_LDX_MEMSX | BPF_W jited:1 156 PASS [ 292.844794] test_bpf: Summary: 1 PASSED, 0 FAILED, [1/1 JIT'ed]
Message-ID: <[email protected]>
--- arch/arm64/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/net/bpf_jit_comp.c +1 -1
@@ -1189,7 +1189,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, }else {emit_a64_mov_i (1 , tmp, off, ctx);if (sign_extend) -emit (A64_LDRSW (dst, src_adj, off_adj), ctx); +emit (A64_LDRSW (dst, src, tmp), ctx);else emit (A64_LDR32 (dst, src, tmp), ctx); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/273 dma-buf: Fix NULL pointer dereference in sanitycheck()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Sakharov <[email protected]>
[ Upstream commit 2295bd846765c766701e666ed2e4b35396be25e6 ]
If due to a memory allocation failure mock_chain() returns NULL, it is passed to dma_fence_enable_sw_signaling() resulting in NULL pointer dereference there.
Call dma_fence_enable_sw_signaling() only if mock_chain() succeeds.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/dma-buf/st-dma-fence-chain.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/dma-buf/st-dma-fence-chain.c +3 -3
@@ -84,11 +84,11 @@ static int sanitycheck(void *arg)return -ENOMEM ; chain =mock_chain (NULL , f,1 ); -if (!chain) +if (chain) +dma_fence_enable_sw_signaling (chain); +else err = -ENOMEM ; -dma_fence_enable_sw_signaling (chain); -dma_fence_signal (f);dma_fence_put (f);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/273 arm64: bpf: fix 32bit unconditional bswap
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Savkov <[email protected]>
[ Upstream commit a51cd6bf8e10793103c5870ff9e4db295a843604 ]
In case when is64 == 1 in emit(A64_REV32(is64, dst, dst), ctx) the generated insn reverses byte order for both high and low 32-bit words, resuling in an incorrect swap as indicated by the jit test:
[ 9757.262607] test_bpf: #312 BSWAP 16: 0x0123456789abcdef -> 0xefcd jited:1 8 PASS [ 9757.264435] test_bpf: #313 BSWAP 32: 0x0123456789abcdef -> 0xefcdab89 jited:1 ret 1460850314 != -271733879 (0x5712ce8a != 0xefcdab89)FAIL (1 times) [ 9757.266260] test_bpf: #314 BSWAP 64: 0x0123456789abcdef -> 0x67452301 jited:1 8 PASS [ 9757.268000] test_bpf: #315 BSWAP 64: 0x0123456789abcdef >> 32 -> 0xefcdab89 jited:1 8 PASS [ 9757.269686] test_bpf: #316 BSWAP 16: 0xfedcba9876543210 -> 0x1032 jited:1 8 PASS [ 9757.271380] test_bpf: #317 BSWAP 32: 0xfedcba9876543210 -> 0x10325476 jited:1 ret -1460850316 != 271733878 (0xa8ed3174 != 0x10325476)FAIL (1 times) [ 9757.273022] test_bpf: #318 BSWAP 64: 0xfedcba9876543210 -> 0x98badcfe jited:1 7 PASS [ 9757.274721] test_bpf: #319 BSWAP 64: 0xfedcba9876543210 >> 32 -> 0x10325476 jited:1 9 PASS
Fix this by forcing 32bit variant of rev32.
Message-ID: <[email protected]>
--- arch/arm64/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/net/bpf_jit_comp.c +1 -1
@@ -876,7 +876,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,emit (A64_UXTH (is64, dst, dst), ctx);break ;case 32 : -emit (A64_REV32 (is64, dst, dst), ctx); +emit (A64_REV32 (0 , dst, dst), ctx);/* upper 32 bits already cleared */ break ;case 64 :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/273 nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryosuke Yasuoka <[email protected]>
[ Upstream commit d24b03535e5eb82e025219c2f632b485409c898f ]
syzbot reported the following uninit-value access issue [1][2]:
nci_rx_work() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded.
This patch resolved this issue by checking payload size before calling each message type handler codes.
--- net/nfc/nci/core.c | 5 +++++ 1 file changed, 5 insertions(+)
net/nfc/nci/core.c +5 -0
@@ -1516,6 +1516,11 @@ static void nci_rx_work(struct work_struct *work)nfc_send_to_raw_sock (ndev->nfc_dev, skb,RAW_PAYLOAD_NCI ,NFC_DIRECTION_RX ); +if (!nci_plen (skb->data)) { +kfree_skb (skb); +break ; + } +/* Process frame */ switch (nci_mt (skb->data)) {case NCI_MT_RSP_PKT :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/273 nfsd: Fix error cleanup path in nfsd_rename()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 9fe6e9e7b58944037714442384075c17cfde1c56 ]
Commit a8b0026847b8 ("rename(): avoid a deadlock in the case of parents having no common ancestor") added an error bail out path. However this path does not drop the remount protection that has been acquired. Fix the cleanup path to properly drop the remount protection.
--- fs/nfsd/vfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfsd/vfs.c +2 -1
@@ -1833,7 +1833,7 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, trap =lock_rename (tdentry, fdentry);if (IS_ERR (trap)) { err = (rqstp->rq_vers ==2 ) ? nfserr_acces : nfserr_xdev; - goto out; + goto out_want_write; } err =fh_fill_pre_attrs (ffhp);if (err != nfs_ok)
@@ -1903,6 +1903,7 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, } out_unlock:unlock_rename (tdentry, fdentry); +out_want_write:fh_drop_write (ffhp);/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/273 tools: ynl: fix setting presence bits in simple nests
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit f6c8f5e8694c7a78c94e408b628afa6255cc428a ]
When we set members of simple nested structures in requests we need to set "presence" bits for all the nesting layers below. This has nothing to do with the presence type of the last layer.
--- tools/net/ynl/ynl-gen-c.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
tools/net/ynl/ynl-gen-c.py +5 -2
@@ -243,8 +243,11 @@ class Type(SpecAttr): presence = '' for i in range(0, len(ref)): presence = f"{var}->{'.'.join(ref[:i] + [''])}_present.{ref[i]}" - if self.presence_type() == 'bit': - code.append(presence + ' = 1;') + # Every layer below last is a nest, so we know it uses bit presence + # last layer is "self" and may be a complex type + if i == len(ref) - 1 and self.presence_type() != 'bit': + continue + code.append(presence + ' = 1;') code += self._setter_lines(ri, member, presence) func_name = f"{op_prefix(ri, direction, deref=deref)}_set_{'_'.join(ref)}"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/273 mlxbf_gige: stop PHY during open() error paths
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
[ Upstream commit d6c30c5a168f8586b8bcc0d8e42e2456eb05209b ]
The mlxbf_gige_open() routine starts the PHY as part of normal initialization. The mlxbf_gige_open() routine must stop the PHY during its error paths.
--- drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +4 -1
@@ -157,7 +157,7 @@ static int mlxbf_gige_open(struct net_device *netdev) err =mlxbf_gige_tx_init (priv);if (err) - goto free_irqs; + goto phy_deinit; err =mlxbf_gige_rx_init (priv);if (err) goto tx_deinit;
@@ -185,6 +185,9 @@ static int mlxbf_gige_open(struct net_device *netdev) tx_deinit:mlxbf_gige_tx_deinit (priv); +phy_deinit: +phy_stop (phydev); + free_irqs:mlxbf_gige_free_irqs (priv);return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/273 wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit bbe806c294c9c4cd1221140d96e5f367673e393a ]
When we want to know whether we should look for the mac_id or the link_id in struct iwl_mvm_session_prot_notif, we should look at the version of SESSION_PROTECTION_NOTIF.
This causes WARNINGs:
WARNING: CPU: 0 PID: 11403 at drivers/net/wireless/intel/iwlwifi/mvm/time-event.c:959 iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] RIP: 0010:iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] Code: 00 49 c7 84 24 48 07 00 00 00 00 00 00 41 c6 84 24 78 07 00 00 ff 4c 89 f7 e8 e9 71 54 d9 e9 7d fd ff ff 0f 0b e9 23 fe ff ff <0f> 0b e9 1c fe ff ff 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffb4bb00003d40 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff9ae63a361000 RCX: ffff9ae4a98b60d4 RDX: ffff9ae4588499c0 RSI: 0000000000000305 RDI: ffff9ae4a98b6358 RBP: ffffb4bb00003d68 R08: 0000000000000003 R09: 0000000000000010 R10: ffffb4bb00003d00 R11: 000000000000000f R12: ffff9ae441399050 R13: ffff9ae4761329e8 R14: 0000000000000001 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff9ae7af400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055fb75680018 CR3: 00000003dae32006 CR4: 0000000000f70ef0 PKRU: 55555554 Call Trace: <IRQ> ? show_regs+0x69/0x80 ? __warn+0x8d/0x150 ? iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] ? report_bug+0x196/0x1c0 ? handle_bug+0x45/0x80 ? exc_invalid_op+0x1c/0xb0 ? asm_exc_invalid_op+0x1f/0x30 ? iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] iwl_mvm_rx_common+0x115/0x340 [iwlmvm] iwl_mvm_rx_mq+0xa6/0x100 [iwlmvm] iwl_pcie_rx_handle+0x263/0xa10 [iwlwifi] iwl_pcie_napi_poll_msix+0x32/0xd0 [iwlwifi]
--- drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +2 -3
@@ -898,9 +898,8 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,struct iwl_rx_packet *pkt =rxb_addr (rxb);struct iwl_mvm_session_prot_notif *notif = (void *)pkt->data;unsigned int ver = -iwl_fw_lookup_cmd_ver (mvm->fw, -WIDE_ID (MAC_CONF_GROUP , -SESSION_PROTECTION_CMD ),2 ); +iwl_fw_lookup_notif_ver (mvm->fw,MAC_CONF_GROUP , +SESSION_PROTECTION_NOTIF ,2 );int id =le32_to_cpu (notif->mac_link_id);struct ieee80211_vif *vif;struct iwl_mvm_vif *mvmvif;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/273 wifi: iwlwifi: mvm: rfi: fix potential response leaks
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 06a093807eb7b5c5b29b6cff49f8174a4e702341 ]
If the rx payload length check fails, or if kmemdup() fails, we still need to free the command response. Fix that.
--- drivers/net/wireless/intel/iwlwifi/mvm/rfi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/rfi.c +6 -2
@@ -132,14 +132,18 @@ struct iwl_rfi_freq_table_resp_cmd *iwl_rfi_get_freq_table(struct iwl_mvm *mvm)if (ret)return ERR_PTR (ret); -if (WARN_ON_ONCE (iwl_rx_packet_payload_len (cmd.resp_pkt) != resp_size)) +if (WARN_ON_ONCE (iwl_rx_packet_payload_len (cmd.resp_pkt) != + resp_size)) { +iwl_free_resp (&cmd);return ERR_PTR (-EIO ); + } resp =kmemdup (cmd.resp_pkt->data, resp_size,GFP_KERNEL ); +iwl_free_resp (&cmd); +if (!resp)return ERR_PTR (-ENOMEM ); -iwl_free_resp (&cmd);return resp; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/273 wifi: iwlwifi: mvm: include link ID when releasing frames
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit e78d7877308989ef91b64a3c746ae31324c07caa ]
When releasing frames from the reorder buffer, the link ID was not included in the RX status information. This subsequently led mac80211 to drop the frame. Change it so that the link information is set immediately when possible so that it doesn't not need to be filled in anymore when submitting the frame to mac80211.
--- drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 20 ++++++++----------- 1 file changed, 8 insertions(+), 12 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +8 -12
@@ -236,21 +236,13 @@ static void iwl_mvm_add_rtap_sniffer_config(struct iwl_mvm *mvm,static void iwl_mvm_pass_packet_to_mac80211 (struct iwl_mvm *mvm,struct napi_struct *napi,struct sk_buff *skb,int queue, -struct ieee80211_sta *sta, -struct ieee80211_link_sta *link_sta) +struct ieee80211_sta *sta) {if (unlikely (iwl_mvm_check_pn (mvm, skb, queue, sta))) {kfree_skb (skb);return ; } -if (sta && sta->valid_links && link_sta) { -struct ieee80211_rx_status *rx_status =IEEE80211_SKB_RXCB (skb); - - rx_status->link_valid =1 ; - rx_status->link_id = link_sta->link_id; - } -ieee80211_rx_napi (mvm->hw, sta, skb, napi); }
@@ -587,7 +579,7 @@ static void iwl_mvm_release_frames(struct iwl_mvm *mvm,while ((skb =__skb_dequeue (skb_list))) {iwl_mvm_pass_packet_to_mac80211 (mvm, napi, skb, reorder_buf->queue, - sta,NULL /* FIXME */ ); + sta); reorder_buf->num_stored--; } }
@@ -2214,6 +2206,11 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,if (IS_ERR (sta)) sta =NULL ; link_sta =rcu_dereference (mvm->fw_id_to_link_sta[id]); + +if (sta && sta->valid_links && link_sta) { + rx_status->link_valid =1 ; + rx_status->link_id = link_sta->link_id; + } } }else if (!is_multicast_ether_addr (hdr->addr2)) {/*
@@ -2357,8 +2354,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi, !(desc->amsdu_info & IWL_RX_MPDU_AMSDU_LAST_SUBFRAME)) rx_status->flag |= RX_FLAG_AMSDU_MORE; -iwl_mvm_pass_packet_to_mac80211 (mvm, napi, skb, queue, sta, - link_sta); +iwl_mvm_pass_packet_to_mac80211 (mvm, napi, skb, queue, sta); } out:rcu_read_unlock ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/273 ALSA: hda: cs35l56: Set the init_done flag before component_add()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Trimmer <[email protected]>
[ Upstream commit cafe9c6a72cf1ffe96d2561d988a141cb5c093db ]
Initialization is completed before adding the component as that can start the process of the device binding and trigger actions that check init_done.
Message-ID: <[email protected]>
--- sound/pci/hda/cs35l56_hda.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/cs35l56_hda.c +2 -2
@@ -1017,14 +1017,14 @@ int cs35l56_hda_common_probe(struct cs35l56_hda *cs35l56, int id)pm_runtime_mark_last_busy (cs35l56->base.dev);pm_runtime_enable (cs35l56->base.dev); + cs35l56->base.init_done = true; + ret =component_add (cs35l56->base.dev, &cs35l56_hda_comp_ops);if (ret) {dev_err (cs35l56->base.dev,"Register component failed: %d\n" , ret); goto pm_err; } - cs35l56->base.init_done = true; -return 0 ; pm_err:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/273 ice: Refactor FW data type and fix bitmap casting issue
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Zou <[email protected]>
[ Upstream commit 817b18965b58a6e5fb6ce97abf01b03a205a6aea ]
According to the datasheet, the recipe association data is an 8-byte little-endian value. It is described as 'Bitmap of the recipe indexes associated with this profile', it is from 24 to 31 byte area in FW. Therefore, it is defined to '__le64 recipe_assoc' in struct ice_aqc_recipe_to_profile. And then fix the bitmap casting issue, as we must never ever use castings for bitmap type.
--- .../net/ethernet/intel/ice/ice_adminq_cmd.h | 3 ++- drivers/net/ethernet/intel/ice/ice_lag.c | 4 ++-- drivers/net/ethernet/intel/ice/ice_switch.c | 24 +++++++++++-------- drivers/net/ethernet/intel/ice/ice_switch.h | 4 ++-- 4 files changed, 20 insertions(+), 15 deletions(-)
drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +2 -1
@@ -593,8 +593,9 @@ struct ice_aqc_recipe_data_elem {struct ice_aqc_recipe_to_profile {__le16 profile_id;u8 rsvd[6 ]; - DECLARE_BITMAP(recipe_assoc, ICE_MAX_NUM_RECIPES); +__le64 recipe_assoc; }; +static_assert (sizeof (struct ice_aqc_recipe_to_profile ) ==16 );/* Add/Update/Remove/Get switch rules (indirect 0x02A0, 0x02A1, 0x02A2, 0x02A3) */
drivers/net/ethernet/intel/ice/ice_lag.c +2 -2
@@ -2041,7 +2041,7 @@ int ice_init_lag(struct ice_pf *pf)/* associate recipes to profiles */ for (n =0 ; n <ICE_PROFID_IPV6_GTPU_IPV6_TCP_INNER ; n++) { err =ice_aq_get_recipe_to_profile (&pf->hw, n, - (u8 *)&recipe_bits,NULL ); + &recipe_bits,NULL );if (err)continue ;
@@ -2049,7 +2049,7 @@ int ice_init_lag(struct ice_pf *pf) recipe_bits |=BIT (lag->pf_recipe) |BIT (lag->lport_recipe);ice_aq_map_recipe_to_profile (&pf->hw, n, - (u8 *)&recipe_bits,NULL ); + recipe_bits,NULL ); } }
drivers/net/ethernet/intel/ice/ice_switch.c +14 -10
@@ -2025,12 +2025,12 @@ ice_update_recipe_lkup_idx(struct ice_hw *hw,* ice_aq_map_recipe_to_profile - Map recipe to packet profile * @hw: pointer to the HW struct * @profile_id: package profile ID to associate the recipe with -* @r_bitmap: Recipe bitmap filled in and need to be returned as response +* @r_assoc: Recipe bitmap filled in and need to be returned as response * @cd: pointer to command details structure or NULL * Recipe to profile association (0x0291) */ int -ice_aq_map_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u8 *r_bitmap, +ice_aq_map_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u64 r_assoc,struct ice_sq_cd *cd) {struct ice_aqc_recipe_to_profile *cmd;
@@ -2042,7 +2042,7 @@ ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,/* Set the recipe ID bit in the bitmask to let the device know which * profile we are associating the recipe to */ -memcpy (cmd->recipe_assoc, r_bitmap,sizeof (cmd->recipe_assoc)); + cmd->recipe_assoc =cpu_to_le64 (r_assoc);return ice_aq_send_cmd (hw, &desc,NULL ,0 , cd); }
@@ -2051,12 +2051,12 @@ ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,* ice_aq_get_recipe_to_profile - Map recipe to packet profile * @hw: pointer to the HW struct * @profile_id: package profile ID to associate the recipe with -* @r_bitmap: Recipe bitmap filled in and need to be returned as response +* @r_assoc: Recipe bitmap filled in and need to be returned as response * @cd: pointer to command details structure or NULL * Associate profile ID with given recipe (0x0293) */ int -ice_aq_get_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u8 *r_bitmap, +ice_aq_get_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u64 *r_assoc,struct ice_sq_cd *cd) {struct ice_aqc_recipe_to_profile *cmd;
@@ -2069,7 +2069,7 @@ ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap, status =ice_aq_send_cmd (hw, &desc,NULL ,0 , cd);if (!status) -memcpy (r_bitmap, cmd->recipe_assoc,sizeof (cmd->recipe_assoc)); + *r_assoc =le64_to_cpu (cmd->recipe_assoc);return status; }
@@ -2108,6 +2108,7 @@ int ice_alloc_recipe(struct ice_hw *hw, u16 *rid)static void ice_get_recp_to_prof_map (struct ice_hw *hw) {DECLARE_BITMAP (r_bitmap,ICE_MAX_NUM_RECIPES ); +u64 recp_assoc;u16 i;for (i =0 ; i < hw->switch_info->max_used_prof_index +1 ; i++) {
@@ -2115,8 +2116,9 @@ static void ice_get_recp_to_prof_map(struct ice_hw *hw)bitmap_zero (profile_to_recipe[i],ICE_MAX_NUM_RECIPES );bitmap_zero (r_bitmap,ICE_MAX_NUM_RECIPES ); -if (ice_aq_get_recipe_to_profile (hw, i, (u8 *)r_bitmap,NULL )) +if (ice_aq_get_recipe_to_profile (hw, i, &recp_assoc,NULL ))continue ; +bitmap_from_arr64 (r_bitmap, &recp_assoc,ICE_MAX_NUM_RECIPES );bitmap_copy (profile_to_recipe[i], r_bitmap,ICE_MAX_NUM_RECIPES );for_each_set_bit (j, r_bitmap,ICE_MAX_NUM_RECIPES )
@@ -5390,22 +5392,24 @@ ice_add_adv_recipe(struct ice_hw *hw, struct ice_adv_lkup_elem *lkups,*/ list_for_each_entry (fvit, &rm->fv_list, list_entry) {DECLARE_BITMAP (r_bitmap,ICE_MAX_NUM_RECIPES ); +u64 recp_assoc;u16 j; status =ice_aq_get_recipe_to_profile (hw, fvit->profile_id, - (u8 *)r_bitmap,NULL ); + &recp_assoc,NULL );if (status) goto err_unroll; +bitmap_from_arr64 (r_bitmap, &recp_assoc,ICE_MAX_NUM_RECIPES );bitmap_or (r_bitmap, r_bitmap, rm->r_bitmap,ICE_MAX_NUM_RECIPES ); status =ice_acquire_change_lock (hw,ICE_RES_WRITE );if (status) goto err_unroll; +bitmap_to_arr64 (&recp_assoc, r_bitmap,ICE_MAX_NUM_RECIPES ); status =ice_aq_map_recipe_to_profile (hw, fvit->profile_id, - (u8 *)r_bitmap, -NULL ); + recp_assoc,NULL );ice_release_change_lock (hw);if (status)
drivers/net/ethernet/intel/ice/ice_switch.h +2 -2
@@ -424,10 +424,10 @@ int ice_aq_add_recipe(struct ice_hw *hw,struct ice_aqc_recipe_data_elem *s_recipe_list, u16 num_recipes, struct ice_sq_cd *cd);int -ice_aq_get_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u8 *r_bitmap, +ice_aq_get_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u64 *r_assoc,struct ice_sq_cd *cd);int -ice_aq_map_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u8 *r_bitmap, +ice_aq_map_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u64 r_assoc,struct ice_sq_cd *cd);#endif /* _ICE_SWITCH_H_ */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/273 ice: fix memory corruption bug with suspend and rebuild
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Brandeburg <[email protected]>
[ Upstream commit 1cb7fdb1dfde1aab66780b4ba44dba6402172111 ]
The ice driver would previously panic after suspend. This is caused from the driver *only* calling the ice_vsi_free_q_vectors() function by itself, when it is suspending. Since commit b3e7b3a6ee92 ("ice: prevent NULL pointer deref during reload") the driver has zeroed out num_q_vectors, and only restored it in ice_vsi_cfg_def().
This further causes the ice_rebuild() function to allocate a zero length buffer, after which num_q_vectors is updated, and then the new value of num_q_vectors is used to index into the zero length buffer, which corrupts memory.
The fix entails making sure all the code referencing num_q_vectors only does so after it has been reset via ice_vsi_cfg_def().
I didn't perform a full bisect, but I was able to test against 6.1.77 kernel and that ice driver works fine for suspend/resume with no panic, so sometime since then, this problem was introduced.
Also clean up an un-needed init of a local variable in the function being modified.
PANIC from 6.8.0-rc1:
[1026674.915596] PM: suspend exit [1026675.664697] ice 0000:17:00.1: PTP reset successful [1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time [1026675.667660] ice 0000:b1:00.0: PTP reset successful [1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time [1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None [1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010 [1026677.192753] ice 0000:17:00.0: PTP reset successful [1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time [1026677.197928] #PF: supervisor read access in kernel mode [1026677.197933] #PF: error_code(0x0000) - not-present page [1026677.197937] PGD 1557a7067 P4D 0 [1026677.212133] ice 0000:b1:00.1: PTP reset successful [1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time [1026677.212575] [1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI [1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G W 6.8.0-rc1+ #1 [1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022 [1026677.269367] Workqueue: ice ice_service_task [ice] [1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed <41> 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6 [1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202 [1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000 [1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828 [1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010 [1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0 [1026677.344472] FS: 0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000 [1026677.353000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0 [1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1026677.381952] PKRU: 55555554 [1026677.385116] Call Trace: [1026677.388023] <TASK> [1026677.390589] ? __die+0x20/0x70 [1026677.394105] ? page_fault_oops+0x82/0x160 [1026677.398576] ? do_user_addr_fault+0x65/0x6a0 [1026677.403307] ? exc_page_fault+0x6a/0x150 [1026677.407694] ? asm_exc_page_fault+0x22/0x30 [1026677.412349] ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.418614] ice_vsi_rebuild+0x34b/0x3c0 [ice] [1026677.423583] ice_vsi_rebuild_by_type+0x76/0x180 [ice] [1026677.429147] ice_rebuild+0x18b/0x520 [ice] [1026677.433746] ? delay_tsc+0x8f/0xc0 [1026677.437630] ice_do_reset+0xa3/0x190 [ice] [1026677.442231] ice_service_task+0x26/0x440 [ice] [1026677.447180] process_one_work+0x174/0x340 [1026677.451669] worker_thread+0x27e/0x390 [1026677.455890] ? __pfx_worker_thread+0x10/0x10 [1026677.460627] kthread+0xee/0x120 [1026677.464235] ? __pfx_kthread+0x10/0x10 [1026677.468445] ret_from_fork+0x2d/0x50 [1026677.472476] ? __pfx_kthread+0x10/0x10 [1026677.476671] ret_from_fork_asm+0x1b/0x30 [1026677.481050] </TASK>
--- drivers/net/ethernet/intel/ice/ice_lib.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/net/ethernet/intel/ice/ice_lib.c +9 -9
@@ -3238,7 +3238,7 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags) {struct ice_vsi_cfg_params params = {};struct ice_coalesce_stored *coalesce; -int prev_num_q_vectors =0 ; +int prev_num_q_vectors;struct ice_pf *pf;int ret;
@@ -3252,13 +3252,6 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags)if (WARN_ON (vsi->type ==ICE_VSI_VF && !vsi->vf))return -EINVAL ; - coalesce =kcalloc (vsi->num_q_vectors, -sizeof (struct ice_coalesce_stored ),GFP_KERNEL ); -if (!coalesce) -return -ENOMEM ; - - prev_num_q_vectors =ice_vsi_rebuild_get_coalesce (vsi, coalesce); - ret =ice_vsi_realloc_stat_arrays (vsi);if (ret) goto err_vsi_cfg;
@@ -3268,6 +3261,13 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags)if (ret) goto err_vsi_cfg; + coalesce =kcalloc (vsi->num_q_vectors, +sizeof (struct ice_coalesce_stored ),GFP_KERNEL ); +if (!coalesce) +return -ENOMEM ; + + prev_num_q_vectors =ice_vsi_rebuild_get_coalesce (vsi, coalesce); + ret =ice_vsi_cfg_tc_lan (pf, vsi);if (ret) {if (vsi_flags &ICE_VSI_FLAG_INIT ) {
@@ -3286,8 +3286,8 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags) err_vsi_cfg_tc_lan:ice_vsi_decfg (vsi); -err_vsi_cfg:kfree (coalesce); +err_vsi_cfg:return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/273 ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemek Kitszel <[email protected]>
[ Upstream commit aec806fb4afba5fe80b09e29351379a4292baa43 ]
Change kzalloc() flags used in ixgbe_ipsec_vf_add_sa() to GFP_ATOMIC, to avoid sleeping in IRQ context.
Dan Carpenter, with the help of Smatch, has found following issue:
The patch eda0333ac293: "ixgbe: add VF IPsec management" from Aug 13, 2018 (linux-next), leads to the following Smatch static checker
warning: drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c:917 ixgbe_ipsec_vf_add_sa()
warn: sleeping in IRQ context
The call tree that Smatch is worried about is:ixgbe_msix_other() <- IRQ handler
-> ixgbe_msg_task()
-> ixgbe_rcv_msg_from_vf()
-> ixgbe_ipsec_vf_add_sa()
--- drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +8 -8
@@ -914,7 +914,13 @@ int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf) goto err_out; } - xs =kzalloc (sizeof (*xs),GFP_KERNEL ); + algo =xfrm_aead_get_byname (aes_gcm_name,IXGBE_IPSEC_AUTH_BITS ,1 ); +if (unlikely (!algo)) { + err = -ENOENT ; + goto err_out; + } + + xs =kzalloc (sizeof (*xs),GFP_ATOMIC );if (unlikely (!xs)) { err = -ENOMEM ; goto err_out;
@@ -930,14 +936,8 @@ int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf)memcpy (&xs->id.daddr.a4, sam->addr,sizeof (xs->id.daddr.a4)); xs->xso.dev = adapter->netdev; - algo =xfrm_aead_get_byname (aes_gcm_name,IXGBE_IPSEC_AUTH_BITS ,1 ); -if (unlikely (!algo)) { - err = -ENOENT ; - goto err_xs; - } - aead_len =sizeof (*xs->aead) +IXGBE_IPSEC_KEY_BITS /8 ; - xs->aead =kzalloc (aead_len,GFP_KERNEL ); + xs->aead =kzalloc (aead_len,GFP_ATOMIC );if (unlikely (!xs->aead)) { err = -ENOMEM ; goto err_xs;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/273 igc: Remove stale comment about Tx timestamping
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Kanzenbach <[email protected]>
[ Upstream commit 47ce2956c7a61ff354723e28235205fa2012265b ]
The initial igc Tx timestamping implementation used only one register for retrieving Tx timestamps. Commit 3ed247e78911 ("igc: Add support for multiple in-flight TX timestamps") added support for utilizing all four of them e.g., for multiple domain support. Remove the stale comment/FIXME.
--- drivers/net/ethernet/intel/igc/igc_main.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/net/ethernet/intel/igc/igc_main.c +0 -4
@@ -1642,10 +1642,6 @@ static netdev_tx_t igc_xmit_frame_ring(struct sk_buff *skb,if (unlikely (test_bit (IGC_RING_FLAG_TX_HWTSTAMP , &tx_ring->flags) &&skb_shinfo (skb)->tx_flags &SKBTX_HW_TSTAMP )) { -/* FIXME: add support for retrieving timestamps from -* the other timer registers before skipping the -* timestamping request. -*/ unsigned long flags;u32 tstamp_flags;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/273 drm/xe: Remove unused xe_bo->props struct
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirmoy Das <[email protected]>
[ Upstream commit fd00fe8cdbb241644131ece133a2eb1c3951f21e ]
Property struct is not being used so remove it and related dead code.
--- drivers/gpu/drm/xe/xe_bo.c | 59 +++++--------------------------- drivers/gpu/drm/xe/xe_bo_types.h | 19 ---------- 2 files changed, 9 insertions(+), 69 deletions(-)
drivers/gpu/drm/xe/xe_bo.c +9 -50
@@ -140,9 +140,6 @@ static void try_add_system(struct xe_device *xe, struct xe_bo *bo, .mem_type = XE_PL_TT, }; *c +=1 ; - -if (bo->props.preferred_mem_type ==XE_BO_PROPS_INVALID ) - bo->props.preferred_mem_type =XE_PL_TT ; } }
@@ -177,25 +174,15 @@ static void add_vram(struct xe_device *xe, struct xe_bo *bo, } places[*c] = place; *c +=1 ; - -if (bo->props.preferred_mem_type ==XE_BO_PROPS_INVALID ) - bo->props.preferred_mem_type = mem_type; }static void try_add_vram (struct xe_device *xe,struct xe_bo *bo,u32 bo_flags,u32 *c) { -if (bo->props.preferred_gt ==XE_GT1 ) { -if (bo_flags &XE_BO_CREATE_VRAM1_BIT ) -add_vram (xe, bo, bo->placements, bo_flags,XE_PL_VRAM1 , c); -if (bo_flags &XE_BO_CREATE_VRAM0_BIT ) -add_vram (xe, bo, bo->placements, bo_flags,XE_PL_VRAM0 , c); - }else { -if (bo_flags &XE_BO_CREATE_VRAM0_BIT ) -add_vram (xe, bo, bo->placements, bo_flags,XE_PL_VRAM0 , c); -if (bo_flags &XE_BO_CREATE_VRAM1_BIT ) -add_vram (xe, bo, bo->placements, bo_flags,XE_PL_VRAM1 , c); - } +if (bo_flags &XE_BO_CREATE_VRAM0_BIT ) +add_vram (xe, bo, bo->placements, bo_flags,XE_PL_VRAM0 , c); +if (bo_flags &XE_BO_CREATE_VRAM1_BIT ) +add_vram (xe, bo, bo->placements, bo_flags,XE_PL_VRAM1 , c); } static void try_add_stolen(struct xe_device *xe, struct xe_bo *bo,
@@ -219,17 +206,8 @@ static int __xe_bo_placement_for_flags(struct xe_device *xe, struct xe_bo *bo, {u32 c =0 ; - bo->props.preferred_mem_type =XE_BO_PROPS_INVALID ; - -/* The order of placements should indicate preferred location */ - -if (bo->props.preferred_mem_class ==DRM_XE_MEM_REGION_CLASS_SYSMEM ) { -try_add_system (xe, bo, bo_flags, &c); -try_add_vram (xe, bo, bo_flags, &c); - }else { -try_add_vram (xe, bo, bo_flags, &c); -try_add_system (xe, bo, bo_flags, &c); - } +try_add_vram (xe, bo, bo_flags, &c); +try_add_system (xe, bo, bo_flags, &c);try_add_stolen (xe, bo, bo_flags, &c);if (!c)
@@ -1106,19 +1084,12 @@ static void xe_gem_object_close(struct drm_gem_object *obj, } } -static bool should_migrate_to_system (struct xe_bo *bo) -{ -struct xe_device *xe =xe_bo_device (bo); - -return xe_device_in_fault_mode (xe) && bo->props.cpu_atomic; -} -static vm_fault_t xe_gem_fault (struct vm_fault *vmf) {struct ttm_buffer_object *tbo = vmf->vma->vm_private_data;struct drm_device *ddev = tbo->base.dev;vm_fault_t ret; -int idx, r =0 ; +int idx; ret =ttm_bo_vm_reserve (tbo, vmf);if (ret)
@@ -1129,17 +1100,8 @@ static vm_fault_t xe_gem_fault(struct vm_fault *vmf)trace_xe_bo_cpu_fault (bo); -if (should_migrate_to_system (bo)) { - r =xe_bo_migrate (bo,XE_PL_TT ); -if (r == -EBUSY || r == -ERESTARTSYS || r == -EINTR ) - ret =VM_FAULT_NOPAGE ; -else if (r) - ret =VM_FAULT_SIGBUS ; - } -if (!ret) - ret =ttm_bo_vm_fault_reserved (vmf, - vmf->vma->vm_page_prot, -TTM_BO_VM_NUM_PREFAULT ); + ret =ttm_bo_vm_fault_reserved (vmf, vmf->vma->vm_page_prot, +TTM_BO_VM_NUM_PREFAULT );drm_dev_exit (idx); }else { ret =ttm_bo_vm_dummy_page (vmf, vmf->vma->vm_page_prot);
@@ -1253,9 +1215,6 @@ struct xe_bo *___xe_bo_create_locked(struct xe_device *xe, struct xe_bo *bo, bo->flags = flags; bo->cpu_caching = cpu_caching; bo->ttm.base.funcs = &xe_gem_object_funcs; - bo->props.preferred_mem_class =XE_BO_PROPS_INVALID ; - bo->props.preferred_gt =XE_BO_PROPS_INVALID ; - bo->props.preferred_mem_type =XE_BO_PROPS_INVALID ; bo->ttm.priority =XE_BO_PRIORITY_NORMAL ;INIT_LIST_HEAD (&bo->pinned_link);#ifdef CONFIG_PROC_FS
drivers/gpu/drm/xe/xe_bo_types.h +0 -19
@@ -56,25 +56,6 @@ struct xe_bo {*/ struct list_head client_link;#endif -/** @props: BO user controlled properties */ -struct { -/** @preferred_mem: preferred memory class for this BO */ -s16 preferred_mem_class; -/** @prefered_gt: preferred GT for this BO */ -s16 preferred_gt; -/** @preferred_mem_type: preferred memory type */ -s32 preferred_mem_type; -/** -* @cpu_atomic: the CPU expects to do atomics operations to -* this BO -*/ -bool cpu_atomic; -/** -* @device_atomic: the device expects to do atomics operations -* to this BO -*/ -bool device_atomic; - } props;/** @freed: List node for delayed put. */ struct llist_node freed;/** @created: Whether the bo has passed initial creation */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/273 drm/xe: Add exec_queue.sched_props.job_timeout_ms
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Welty <[email protected]>
[ Upstream commit 6ae24344e2e3e12e06f7b382af4bba2fd417b2ff ]
The purpose here is to allow to optimize exec_queue_set_job_timeout() in follow-on patch. Currently it does q->ops->set_job_timeout(...). But we'd like to apply exec_queue_user_extensions much earlier and q->ops cannot be called before __xe_exec_queue_init().
It will be much more efficient to instead only have to set q->sched_props.job_timeout_ms when applying user extensions. That value will then be used during q->ops->init().
Stable-dep-of: 9c1256369c10 ("drm/xe/guc_submit: use jiffies for job timeout")
--- drivers/gpu/drm/xe/xe_exec_queue.c | 2 ++ drivers/gpu/drm/xe/xe_exec_queue_types.h | 2 ++ drivers/gpu/drm/xe/xe_guc_submit.c | 2 +- 3 files changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_exec_queue.c +2 -0
@@ -66,6 +66,8 @@ static struct xe_exec_queue *__xe_exec_queue_create(struct xe_device *xe, q->sched_props.timeslice_us = hwe->eclass->sched_props.timeslice_us; q->sched_props.preempt_timeout_us = hwe->eclass->sched_props.preempt_timeout_us; + q->sched_props.job_timeout_ms = + hwe->eclass->sched_props.job_timeout_ms;if (q->flags &EXEC_QUEUE_FLAG_KERNEL && q->flags &EXEC_QUEUE_FLAG_HIGH_PRIORITY ) q->sched_props.priority =XE_EXEC_QUEUE_PRIORITY_KERNEL ;
drivers/gpu/drm/xe/xe_exec_queue_types.h +2 -0
@@ -132,6 +132,8 @@ struct xe_exec_queue {u32 timeslice_us;/** @preempt_timeout_us: preemption timeout in micro-seconds */ u32 preempt_timeout_us; +/** @job_timeout_ms: job timeout in milliseconds */ +u32 job_timeout_ms;/** @priority: priority of this exec queue */ enum xe_exec_queue_priority priority; } sched_props;
drivers/gpu/drm/xe/xe_guc_submit.c +1 -1
@@ -1216,7 +1216,7 @@ static int guc_exec_queue_init(struct xe_exec_queue *q)init_waitqueue_head (&ge->suspend_wait); timeout = (q->vm &&xe_vm_in_lr_mode (q->vm)) ?MAX_SCHEDULE_TIMEOUT : - q->hwe->eclass->sched_props.job_timeout_ms; + q->sched_props.job_timeout_ms; err = xe_sched_init(&ge->sched, &drm_sched_ops, &xe_sched_ops, get_submit_wq(guc), q->lrc[0].ring.size / MAX_JOB_SIZE_BYTES, 64,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/273 drm/xe/guc_submit: use jiffies for job timeout
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <[email protected]>
[ Upstream commit 9c1256369c10e31b5ce6575e4ea27fe2c375fd94 ]
drm_sched_init() expects jiffies for the timeout, but here we are passing the timeout in ms. Convert to jiffies instead.
--- drivers/gpu/drm/xe/xe_guc_submit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_guc_submit.c +1 -1
@@ -1216,7 +1216,7 @@ static int guc_exec_queue_init(struct xe_exec_queue *q)init_waitqueue_head (&ge->suspend_wait); timeout = (q->vm &&xe_vm_in_lr_mode (q->vm)) ?MAX_SCHEDULE_TIMEOUT : - q->sched_props.job_timeout_ms; +msecs_to_jiffies (q->sched_props.job_timeout_ms); err = xe_sched_init(&ge->sched, &drm_sched_ops, &xe_sched_ops, get_submit_wq(guc), q->lrc[0].ring.size / MAX_JOB_SIZE_BYTES, 64,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/273 drm/xe/queue: fix engine_class bounds check
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <[email protected]>
[ Upstream commit b7dce525c4fcc92b373136288309f8c9ca6c375f ]
The engine_class is the index into the user_to_xe_engine_class, therefore it needs to be less than.
--- drivers/gpu/drm/xe/xe_exec_queue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_exec_queue.c +1 -1
@@ -405,7 +405,7 @@ find_hw_engine(struct xe_device *xe, {u32 idx; -if (eci.engine_class >ARRAY_SIZE (user_to_xe_engine_class)) +if (eci.engine_class >=ARRAY_SIZE (user_to_xe_engine_class))return NULL ;if (eci.gt_id >= xe->info.gt_count)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/273 drm/xe/device: fix XE_MAX_GT_PER_TILE check
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <[email protected]>
[ Upstream commit 23e1ee3a2317f41f47d4f7255257431c5f8d1c2c ]
Here XE_MAX_GT_PER_TILE is the total, therefore the gt index should always be less than.
--- drivers/gpu/drm/xe/xe_device.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_device.h +1 -1
@@ -58,7 +58,7 @@ static inline struct xe_tile *xe_device_get_root_tile(struct xe_device *xe)static inline struct xe_gt *xe_tile_get_gt (struct xe_tile *tile,u8 gt_id) { -if (drm_WARN_ON (&tile_to_xe (tile)->drm, gt_id >XE_MAX_GT_PER_TILE )) +if (drm_WARN_ON (&tile_to_xe (tile)->drm, gt_id >=XE_MAX_GT_PER_TILE )) gt_id =0 ;return gt_id ? tile->media_gt : tile->primary_gt;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/273 drm/xe/device: fix XE_MAX_TILES_PER_DEVICE check
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <[email protected]>
[ Upstream commit b45f20fa69cedb6038fdaec31bd600c273c865a5 ]
Here XE_MAX_TILES_PER_DEVICE is the gt array size, therefore the gt index should always be less than.
v2 (Lucas):
- Add fixes tag.
--- drivers/gpu/drm/xe/xe_device.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_device.h +1 -1
@@ -79,7 +79,7 @@ static inline struct xe_gt *xe_device_get_gt(struct xe_device *xe, u8 gt_id)if (MEDIA_VER (xe) >=13 ) { gt =xe_tile_get_gt (root_tile, gt_id); }else { -if (drm_WARN_ON (&xe->drm, gt_id >XE_MAX_TILES_PER_DEVICE )) +if (drm_WARN_ON (&xe->drm, gt_id >=XE_MAX_TILES_PER_DEVICE )) gt_id =0 ; gt = xe->tiles[gt_id].primary_gt;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/273 dpll: indent DPLL option type by a tab
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prasad Pandit <[email protected]>
[ Upstream commit cc2699268152d8e0386a36fe7c9271d7e23668f2 ]
Indent config option type by a tab. It helps Kconfig parsers to read file without error.
--- drivers/dpll/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dpll/Kconfig +1 -1
@@ -4,4 +4,4 @@ # config DPLL - bool + bool
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/273 s390/qeth: handle deferred cc1
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Winter <[email protected]>
[ Upstream commit afb373ff3f54c9d909efc7f810dc80a9742807b2 ]
The IO subsystem expects a driver to retry a ccw_device_start, when the subsequent interrupt response block (irb) contains a deferred condition code 1.
Symptoms before this commit:
On the read channel we always trigger the next read anyhow, so no different behaviour here.
On the write channel we may experience timeout errors, because the expected reply will never be received without the retry. Other callers of qeth_send_control_data() may wrongly assume that the ccw was successful, which may cause problems later.
Note that since
commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") and
commit 5ef1dc40ffa6 ("s390/cio: fix invalid -EBUSY on ccw_device_start") deferred CC1s are much more likely to occur. See the commit message of the latter for more background information.
--- drivers/s390/net/qeth_core_main.c | 38 +++++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-)
drivers/s390/net/qeth_core_main.c +36 -2
@@ -1179,6 +1179,20 @@ static int qeth_check_irb_error(struct qeth_card *card, struct ccw_device *cdev, } } +/** +* qeth_irq() - qeth interrupt handler +* @cdev: ccw device +* @intparm: expect pointer to iob +* @irb: Interruption Response Block +* +* In the good path: +* corresponding qeth channel is locked with last used iob as active_cmd. +* But this function is also called for error interrupts. +* +* Caller ensures that: +* Interrupts are disabled; ccw device lock is held; +* +*/ static void qeth_irq (struct ccw_device *cdev,unsigned long intparm,struct irb *irb) {
@@ -1220,11 +1234,10 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, iob = (struct qeth_cmd_buffer *) (addr_t )intparm; } -qeth_unlock_channel (card, channel); - rc =qeth_check_irb_error (card, cdev, irb);if (rc) {/* IO was terminated, free its resources. */ +qeth_unlock_channel (card, channel);if (iob)qeth_cancel_cmd (iob, rc);return ;
@@ -1268,6 +1281,7 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, rc =qeth_get_problem (card, cdev, irb);if (rc) { card->read_or_write_problem =1 ; +qeth_unlock_channel (card, channel);if (iob)qeth_cancel_cmd (iob, rc);qeth_clear_ipacmd_list (card);
@@ -1276,6 +1290,26 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, } } +if (scsw_cmd_is_valid_cc (&irb->scsw) && irb->scsw.cmd.cc ==1 && iob) { +/* channel command hasn't started: retry. +* active_cmd is still set to last iob +*/ +QETH_CARD_TEXT (card,2 ,"irqcc1" ); + rc =ccw_device_start_timeout (cdev,__ccw_from_cmd (iob), + (addr_t )iob,0 ,0 , iob->timeout); +if (rc) { +QETH_DBF_MESSAGE (2 , +"ccw retry on %x failed, rc = %i\n" , +CARD_DEVID (card), rc); +QETH_CARD_TEXT_ (card,2 ," err%d" , rc); +qeth_unlock_channel (card, channel); +qeth_cancel_cmd (iob, rc); + } +return ; + } + +qeth_unlock_channel (card, channel); +if (iob) {/* sanity check: */ if (irb->scsw.cmd.count > iob->length) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/273 net: hsr: hsr_slave: Fix the promiscuous mode in offload mode
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ravi Gunasekaran <[email protected]>
[ Upstream commit b11c81731c810efe592e510bb0110e0db6877419 ]
commit e748d0fd66ab ("net: hsr: Disable promiscuous mode in offload mode") disables promiscuous mode of slave devices while creating an HSR interface. But while deleting the HSR interface, it does not take care of it. It decreases the promiscuous mode count, which eventually enables promiscuous mode on the slave devices when creating HSR interface again.
Fix this by not decrementing the promiscuous mode count while deleting the HSR interface when offload is enabled.
--- net/hsr/hsr_slave.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/hsr/hsr_slave.c +2 -1
@@ -220,7 +220,8 @@ void hsr_del_port(struct hsr_port *port)netdev_update_features (master->dev);dev_set_mtu (master->dev,hsr_get_max_mtu (hsr));netdev_rx_handler_unregister (port->dev); -dev_set_promiscuity (port->dev,-1 ); +if (!port->hsr->fwd_offloaded) +dev_set_promiscuity (port->dev,-1 );netdev_upper_dev_unlink (port->dev, master->dev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/273 tcp: properly terminate timers for kernel sockets
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada ]
We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled.
Fortunately Josef Bacik could trigger the issue more often, and could test a patch I wrote two years ago.
When TCP sockets are closed, we call inet_csk_clear_xmit_timers() to 'stop' the timers.
inet_csk_clear_xmit_timers() can be called from any context, including when socket lock is held.
This is the reason it uses sk_stop_timer(), aka del_timer(). This means that ongoing timers might finish much later.
For user sockets, this is fine because each running timer holds a reference on the socket, and the user socket holds a reference on the netns.
For kernel sockets, we risk that the netns is freed before timer can complete, because kernel sockets do not hold reference on the netns.
This patch adds inet_csk_clear_xmit_timers_sync() function that using sk_stop_timer_sync() to make sure all timers are terminated before the kernel socket is released. Modules using kernel sockets close them in their netns exit() handler.
Also add sock_not_owned_by_me() helper to get LOCKDEP support : inet_csk_clear_xmit_timers_sync() must not be called while socket lock is held.
It is very possible we can revert in the future commit 3a58f13a881e ("net: rds: acquire refcount on TCP sockets") which attempted to solve the issue in rds only. (net/smc/af_smc.c and net/mptcp/subflow.c have similar code)
We probably can remove the check_net() tests from tcp_out_of_resources() and __tcp_close() in the future.
--- include/net/inet_connection_sock.h | 1 + include/net/sock.h | 7 +++++++ net/ipv4/inet_connection_sock.c | 14 ++++++++++++++ net/ipv4/tcp.c | 2 ++ 4 files changed, 24 insertions(+)
include/net/inet_connection_sock.h +1 -0
@@ -175,6 +175,7 @@ void inet_csk_init_xmit_timers(struct sock *sk,void (*delack_handler)(struct timer_list *), void (*keepalive_handler)(struct timer_list *));void inet_csk_clear_xmit_timers (struct sock *sk); +void inet_csk_clear_xmit_timers_sync (struct sock *sk);static inline void inet_csk_schedule_ack (struct sock *sk) {
include/net/sock.h +7 -0
@@ -1779,6 +1779,13 @@ static inline void sock_owned_by_me(const struct sock *sk)#endif } +static inline void sock_not_owned_by_me (const struct sock *sk) +{ +#ifdef CONFIG_LOCKDEP +WARN_ON_ONCE (lockdep_sock_is_held (sk) && debug_locks); +#endif +} +static inline bool sock_owned_by_user (const struct sock *sk) {sock_owned_by_me (sk);
net/ipv4/inet_connection_sock.c +14 -0
@@ -771,6 +771,20 @@ void inet_csk_clear_xmit_timers(struct sock *sk) }EXPORT_SYMBOL (inet_csk_clear_xmit_timers); +void inet_csk_clear_xmit_timers_sync (struct sock *sk) +{ +struct inet_connection_sock *icsk =inet_csk (sk); + +/* ongoing timer handlers need to acquire socket lock. */ +sock_not_owned_by_me (sk); + + icsk->icsk_pending = icsk->icsk_ack.pending =0 ; + +sk_stop_timer_sync (sk, &icsk->icsk_retransmit_timer); +sk_stop_timer_sync (sk, &icsk->icsk_delack_timer); +sk_stop_timer_sync (sk, &sk->sk_timer); +} +void inet_csk_delete_keepalive_timer (struct sock *sk) {sk_stop_timer (sk, &sk->sk_timer);
net/ipv4/tcp.c +2 -0
@@ -2930,6 +2930,8 @@ void tcp_close(struct sock *sk, long timeout)lock_sock (sk);__tcp_close (sk, timeout);release_sock (sk); +if (!sk->sk_net_refcnt) +inet_csk_clear_xmit_timers_sync (sk);sock_put (sk); }EXPORT_SYMBOL (tcp_close);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/273 net: wwan: t7xx: Split 64bit accesses to fix alignment issues
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <[email protected]>
[ Upstream commit 7d5a7dd5a35876f0ecc286f3602a88887a788217 ]
Some of the registers are aligned on a 32bit boundary, causing alignment faults on 64bit platforms.
Unable to handle kernel paging request at virtual address ffffffc084a1d004 Mem abort info: ESR = 0x0000000096000061 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault Data abort info: ISV = 0, ISS = 0x00000061, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000046ad6000 [ffffffc084a1d004] pgd=100000013ffff003, p4d=100000013ffff003, pud=100000013ffff003, pmd=0068000020a00711 Internal error: Oops: 0000000096000061 [#1] SMP Modules linked in: mtk_t7xx(+) qcserial pppoe ppp_async option nft_fib_inet nf_flow_table_inet mt7921u(O) mt7921s(O) mt7921e(O) mt7921_common(O) iwlmvm(O) iwldvm(O) usb_wwan rndis_host qmi_wwan pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt7996e(O) mt792x_usb(O) mt792x_lib(O) mt7915e(O) mt76_usb(O) mt76_sdio(O) mt76_connac_lib(O) mt76(O) mac80211(O) iwlwifi(O) huawei_cdc_ncm cfg80211(O) cdc_ncm cdc_ether wwan usbserial usbnet slhc sfp rtc_pcf8563 nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 mt6577_auxadc mdio_i2c libcrc32c compat(O) cdc_wdm cdc_acm at24 crypto_safexcel pwm_fan i2c_gpio i2c_smbus industrialio i2c_algo_bit i2c_mux_reg i2c_mux_pca954x i2c_mux_pca9541 i2c_mux_gpio i2c_mux dummy oid_registry tun sha512_arm64 sha1_ce sha1_generic seqiv md5 geniv des_generic libdes cbc authencesn authenc leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd nvme nvme_core gpio_button_hotplug(O) dm_mirror dm_region_hash dm_log dm_crypt dm_mod dax usbcore usb_common ptp aquantia pps_core mii tpm encrypted_keys trusted CPU: 3 PID: 5266 Comm: kworker/u9:1 Tainted: G O 6.6.22 #0 Hardware name: Bananapi BPI-R4 (DT) Workqueue: md_hk_wq t7xx_fsm_uninit [mtk_t7xx] pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : t7xx_cldma_hw_set_start_addr+0x1c/0x3c [mtk_t7xx] lr : t7xx_cldma_start+0xac/0x13c [mtk_t7xx] sp : ffffffc085d63d30 x29: ffffffc085d63d30 x28: 0000000000000000 x27: 0000000000000000 x26: 0000000000000000 x25: ffffff80c804f2c0 x24: ffffff80ca196c05 x23: 0000000000000000 x22: ffffff80c814b9b8 x21: ffffff80c814b128 x20: 0000000000000001 x19: ffffff80c814b080 x18: 0000000000000014 x17: 0000000055c9806b x16: 000000007c5296d0 x15: 000000000f6bca68 x14: 00000000dbdbdce4 x13: 000000001aeaf72a x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffffff80ca1ef6b4 x7 : ffffff80c814b818 x6 : 0000000000000018 x5 : 0000000000000870 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 000000010a947000 x1 : ffffffc084a1d004 x0 : ffffffc084a1d004 Call trace: t7xx_cldma_hw_set_start_addr+0x1c/0x3c [mtk_t7xx] t7xx_fsm_uninit+0x578/0x5ec [mtk_t7xx] process_one_work+0x154/0x2a0 worker_thread+0x2ac/0x488 kthread+0xe0/0xec ret_from_fork+0x10/0x20 Code: f9400800 91001000 8b214001 d50332bf (f9000022) ---[ end trace 0000000000000000 ]---
The inclusion of io-64-nonatomic-lo-hi.h indicates that all 64bit accesses can be replaced by pairs of nonatomic 32bit access. Fix alignment by forcing all accesses to be 32bit on 64bit platforms.
--- drivers/net/wwan/t7xx/t7xx_cldma.c | 4 ++-- drivers/net/wwan/t7xx/t7xx_hif_cldma.c | 9 +++++---- drivers/net/wwan/t7xx/t7xx_pcie_mac.c | 8 ++++---- 3 files changed, 11 insertions(+), 10 deletions(-)
drivers/net/wwan/t7xx/t7xx_cldma.c +2 -2
@@ -106,7 +106,7 @@ bool t7xx_cldma_tx_addr_is_set(struct t7xx_cldma_hw *hw_info, unsigned int qno) {u32 offset =REG_CLDMA_UL_START_ADDRL_0 + qno *ADDR_SIZE ; -return ioread64 (hw_info->ap_pdn_base + offset); +return ioread64_lo_hi (hw_info->ap_pdn_base + offset); } void t7xx_cldma_hw_set_start_addr(struct t7xx_cldma_hw *hw_info, unsigned int qno, u64 address,
@@ -117,7 +117,7 @@ void t7xx_cldma_hw_set_start_addr(struct t7xx_cldma_hw *hw_info, unsigned int qn reg = tx_rx ==MTK_RX ? hw_info->ap_ao_base +REG_CLDMA_DL_START_ADDRL_0 : hw_info->ap_pdn_base +REG_CLDMA_UL_START_ADDRL_0 ; -iowrite64 (address, reg + offset); +iowrite64_lo_hi (address, reg + offset); } void t7xx_cldma_hw_resume_queue(struct t7xx_cldma_hw *hw_info, unsigned int qno,
drivers/net/wwan/t7xx/t7xx_hif_cldma.c +5 -4
@@ -139,8 +139,9 @@ static int t7xx_cldma_gpd_rx_from_q(struct cldma_queue *queue, int budget, boolreturn -ENODEV ; } - gpd_addr =ioread64 (hw_info->ap_pdn_base +REG_CLDMA_DL_CURRENT_ADDRL_0 + - queue->index *sizeof (u64)); + gpd_addr =ioread64_lo_hi (hw_info->ap_pdn_base + +REG_CLDMA_DL_CURRENT_ADDRL_0 + + queue->index *sizeof (u64));if (req->gpd_addr == gpd_addr || hwo_polling_count++ >=100 )return 0 ;
@@ -318,8 +319,8 @@ static void t7xx_cldma_txq_empty_hndl(struct cldma_queue *queue)struct t7xx_cldma_hw *hw_info = &md_ctrl->hw_info;/* Check current processing TGPD, 64-bit address is in a table by Q index */ - ul_curr_addr =ioread64 (hw_info->ap_pdn_base +REG_CLDMA_UL_CURRENT_ADDRL_0 + - queue->index *sizeof (u64)); + ul_curr_addr =ioread64_lo_hi (hw_info->ap_pdn_base +REG_CLDMA_UL_CURRENT_ADDRL_0 + + queue->index *sizeof (u64));if (req->gpd_addr != ul_curr_addr) {spin_unlock_irqrestore (&md_ctrl->cldma_lock, flags); dev_err(md_ctrl->dev, "CLDMA%d queue %d is not empty\n",
drivers/net/wwan/t7xx/t7xx_pcie_mac.c +4 -4
@@ -75,7 +75,7 @@ static void t7xx_pcie_mac_atr_tables_dis(void __iomem *pbase, enum t7xx_atr_src_for (i =0 ; i <ATR_TABLE_NUM_PER_ATR ; i++) { offset =ATR_PORT_OFFSET * port +ATR_TABLE_OFFSET * i; reg = pbase +ATR_PCIE_WIN0_T0_ATR_PARAM_SRC_ADDR + offset; -iowrite64 (0 , reg); +iowrite64_lo_hi (0 , reg); } }
@@ -112,17 +112,17 @@ static int t7xx_pcie_mac_atr_cfg(struct t7xx_pci_dev *t7xx_dev, struct t7xx_atr_ reg = pbase +ATR_PCIE_WIN0_T0_TRSL_ADDR + offset; value = cfg->trsl_addr &ATR_PCIE_WIN0_ADDR_ALGMT ; -iowrite64 (value, reg); +iowrite64_lo_hi (value, reg); reg = pbase +ATR_PCIE_WIN0_T0_TRSL_PARAM + offset;iowrite32 (cfg->trsl_id, reg); reg = pbase +ATR_PCIE_WIN0_T0_ATR_PARAM_SRC_ADDR + offset; value = (cfg->src_addr &ATR_PCIE_WIN0_ADDR_ALGMT ) | (atr_size <<1 ) |BIT (0 ); -iowrite64 (value, reg); +iowrite64_lo_hi (value, reg);/* Ensure ATR is set */ -ioread64 (reg); +ioread64_lo_hi (reg);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/273 drm/rockchip: vop2: Remove AR30 and AB30 format support
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Yan <[email protected]>
[ Upstream commit 905f7d53a1bc105b22d9ffd03dc11b6b42ec6ba6 ]
The Alpha blending for 30 bit RGB/BGR are not
functioning properly for rk3568/rk3588, so remove
it from the format list.
--- drivers/gpu/drm/rockchip/rockchip_vop2_reg.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/rockchip/rockchip_vop2_reg.c +0 -2
@@ -17,9 +17,7 @@static const uint32_t formats_cluster[] = {DRM_FORMAT_XRGB2101010 , -DRM_FORMAT_ARGB2101010 ,DRM_FORMAT_XBGR2101010 , -DRM_FORMAT_ABGR2101010 ,DRM_FORMAT_XRGB8888 ,DRM_FORMAT_ARGB8888 ,DRM_FORMAT_XBGR8888 ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/273 selftests: vxlan_mdb: Fix failures with old libnet
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit f1425529c33def8b46faae4400dd9e2bbaf16a05 ]
Locally generated IP multicast packets (such as the ones used in the test) do not perform routing and simply egress the bound device.
However, as explained in commit 8bcfb4ae4d97 ("selftests: forwarding:
Fix failing tests with old libnet"), old versions of libnet (used by mausezahn) do not use the "SO_BINDTODEVICE" socket option. Specifically, the library started using the option for IPv6 sockets in version 1.1.6 and for IPv4 sockets in version 1.2. This explains why on Ubuntu - which uses version 1.1.6 - the IPv4 overlay tests are failing whereas the IPv6 ones are passing.
Fix by specifying the source and destination MAC of the packets which will cause mausezahn to use a packet socket instead of an IP socket.
--- tools/testing/selftests/net/test_vxlan_mdb.sh | 205 +++++++++++------- 1 file changed, 128 insertions(+), 77 deletions(-)
tools/testing/selftests/net/test_vxlan_mdb.sh +128 -77
@@ -1177,6 +1177,7 @@ encap_params_common() local plen=$1; shift local enc_ethtype=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local src=$1; shift local mz=$1; shift
@@ -1195,11 +1196,11 @@ encap_params_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep2_ip src_vni 10020" run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_dst_ip $vtep1_ip action pass" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Destination IP - match" - run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Destination IP - no match"
@@ -1212,20 +1213,20 @@ encap_params_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip dst_port 1111 src_vni 10020" run_cmd "tc -n $ns2 filter replace dev veth0 ingress pref 1 handle 101 proto $enc_ethtype flower ip_proto udp dst_port 4789 action pass" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev veth0 ingress" 101 1 log_test $? 0 "Default destination port - match" - run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev veth0 ingress" 101 1 log_test $? 0 "Default destination port - no match" run_cmd "tc -n $ns2 filter replace dev veth0 ingress pref 1 handle 101 proto $enc_ethtype flower ip_proto udp dst_port 1111 action pass" - run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev veth0 ingress" 101 1 log_test $? 0 "Non-default destination port - match" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev veth0 ingress" 101 1 log_test $? 0 "Non-default destination port - no match"
@@ -1238,11 +1239,11 @@ encap_params_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip src_vni 10020" run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_key_id 10010 action pass" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Default destination VNI - match" - run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Default destination VNI - no match"
@@ -1250,11 +1251,11 @@ encap_params_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip vni 10010 src_vni 10020" run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_key_id 10020 action pass" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Non-default destination VNI - match" - run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Non-default destination VNI - no match"
@@ -1272,6 +1273,7 @@ encap_params_ipv4_ipv4() local plen=32 local enc_ethtype="ip" local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local src=192.0.2.129 echo
@@ -1279,7 +1281,7 @@ encap_params_ipv4_ipv4() echo "------------------------------------------------------------------" encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \ - $grp $src "mausezahn" + $grp $grp_dmac $src "mausezahn" } encap_params_ipv6_ipv4()
@@ -1291,6 +1293,7 @@ encap_params_ipv6_ipv4() local plen=32 local enc_ethtype="ip" local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local src=2001:db8:100::1 echo
@@ -1298,7 +1301,7 @@ encap_params_ipv6_ipv4() echo "------------------------------------------------------------------" encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \ - $grp $src "mausezahn -6" + $grp $grp_dmac $src "mausezahn -6" } encap_params_ipv4_ipv6()
@@ -1310,6 +1313,7 @@ encap_params_ipv4_ipv6() local plen=128 local enc_ethtype="ipv6" local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local src=192.0.2.129 echo
@@ -1317,7 +1321,7 @@ encap_params_ipv4_ipv6() echo "------------------------------------------------------------------" encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \ - $grp $src "mausezahn" + $grp $grp_dmac $src "mausezahn" } encap_params_ipv6_ipv6()
@@ -1329,6 +1333,7 @@ encap_params_ipv6_ipv6() local plen=128 local enc_ethtype="ipv6" local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local src=2001:db8:100::1 echo
@@ -1336,7 +1341,7 @@ encap_params_ipv6_ipv6() echo "------------------------------------------------------------------" encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \ - $grp $src "mausezahn -6" + $grp $grp_dmac $src "mausezahn -6" } starg_exclude_ir_common()
@@ -1347,6 +1352,7 @@ starg_exclude_ir_common() local vtep2_ip=$1; shift local plen=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local valid_src=$1; shift local invalid_src=$1; shift local mz=$1; shift
@@ -1368,14 +1374,14 @@ starg_exclude_ir_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode exclude source_list $invalid_src dst $vtep2_ip src_vni 10010" # Check that invalid source is not forwarded to any VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 0 log_test $? 0 "Block excluded source - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 0 log_test $? 0 "Block excluded source - second VTEP" # Check that valid source is forwarded to both VTEPs. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Forward valid source - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1385,14 +1391,14 @@ starg_exclude_ir_common() run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep2_ip src_vni 10010" # Check that invalid source is not forwarded to any VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Block excluded source after removal - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1 log_test $? 0 "Block excluded source after removal - second VTEP" # Check that valid source is forwarded to the remaining VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 2 log_test $? 0 "Forward valid source after removal - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1407,6 +1413,7 @@ starg_exclude_ir_ipv4_ipv4() local vtep2_ip=198.51.100.200 local plen=32 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1415,7 +1422,7 @@ starg_exclude_ir_ipv4_ipv4() echo "-------------------------------------------------------------" starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn" + $grp_dmac $valid_src $invalid_src "mausezahn" } starg_exclude_ir_ipv6_ipv4()
@@ -1426,6 +1433,7 @@ starg_exclude_ir_ipv6_ipv4() local vtep2_ip=198.51.100.200 local plen=32 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1434,7 +1442,7 @@ starg_exclude_ir_ipv6_ipv4() echo "-------------------------------------------------------------" starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn -6" + $grp_dmac $valid_src $invalid_src "mausezahn -6" } starg_exclude_ir_ipv4_ipv6()
@@ -1445,6 +1453,7 @@ starg_exclude_ir_ipv4_ipv6() local vtep2_ip=2001:db8:2000::1 local plen=128 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1453,7 +1462,7 @@ starg_exclude_ir_ipv4_ipv6() echo "-------------------------------------------------------------" starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn" + $grp_dmac $valid_src $invalid_src "mausezahn" } starg_exclude_ir_ipv6_ipv6()
@@ -1464,6 +1473,7 @@ starg_exclude_ir_ipv6_ipv6() local vtep2_ip=2001:db8:2000::1 local plen=128 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1472,7 +1482,7 @@ starg_exclude_ir_ipv6_ipv6() echo "-------------------------------------------------------------" starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn -6" + $grp_dmac $valid_src $invalid_src "mausezahn -6" } starg_include_ir_common()
@@ -1483,6 +1493,7 @@ starg_include_ir_common() local vtep2_ip=$1; shift local plen=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local valid_src=$1; shift local invalid_src=$1; shift local mz=$1; shift
@@ -1504,14 +1515,14 @@ starg_include_ir_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode include source_list $valid_src dst $vtep2_ip src_vni 10010" # Check that invalid source is not forwarded to any VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 0 log_test $? 0 "Block excluded source - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 0 log_test $? 0 "Block excluded source - second VTEP" # Check that valid source is forwarded to both VTEPs. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Forward valid source - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1521,14 +1532,14 @@ starg_include_ir_common() run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep2_ip src_vni 10010" # Check that invalid source is not forwarded to any VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Block excluded source after removal - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1 log_test $? 0 "Block excluded source after removal - second VTEP" # Check that valid source is forwarded to the remaining VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 2 log_test $? 0 "Forward valid source after removal - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1543,6 +1554,7 @@ starg_include_ir_ipv4_ipv4() local vtep2_ip=198.51.100.200 local plen=32 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1551,7 +1563,7 @@ starg_include_ir_ipv4_ipv4() echo "-------------------------------------------------------------" starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn" + $grp_dmac $valid_src $invalid_src "mausezahn" } starg_include_ir_ipv6_ipv4()
@@ -1562,6 +1574,7 @@ starg_include_ir_ipv6_ipv4() local vtep2_ip=198.51.100.200 local plen=32 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1570,7 +1583,7 @@ starg_include_ir_ipv6_ipv4() echo "-------------------------------------------------------------" starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn -6" + $grp_dmac $valid_src $invalid_src "mausezahn -6" } starg_include_ir_ipv4_ipv6()
@@ -1581,6 +1594,7 @@ starg_include_ir_ipv4_ipv6() local vtep2_ip=2001:db8:2000::1 local plen=128 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1589,7 +1603,7 @@ starg_include_ir_ipv4_ipv6() echo "-------------------------------------------------------------" starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn" + $grp_dmac $valid_src $invalid_src "mausezahn" } starg_include_ir_ipv6_ipv6()
@@ -1600,6 +1614,7 @@ starg_include_ir_ipv6_ipv6() local vtep2_ip=2001:db8:2000::1 local plen=128 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1608,7 +1623,7 @@ starg_include_ir_ipv6_ipv6() echo "-------------------------------------------------------------" starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn -6" + $grp_dmac $valid_src $invalid_src "mausezahn -6" } starg_exclude_p2mp_common()
@@ -1618,6 +1633,7 @@ starg_exclude_p2mp_common() local mcast_grp=$1; shift local plen=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local valid_src=$1; shift local invalid_src=$1; shift local mz=$1; shift
@@ -1635,12 +1651,12 @@ starg_exclude_p2mp_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode exclude source_list $invalid_src dst $mcast_grp src_vni 10010 via veth0" # Check that invalid source is not forwarded. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 0 log_test $? 0 "Block excluded source" # Check that valid source is forwarded. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Forward valid source"
@@ -1648,7 +1664,7 @@ starg_exclude_p2mp_common() run_cmd "ip -n $ns2 address del $mcast_grp/$plen dev veth0" # Check that valid source is not received anymore. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Receive of valid source after removal from group" }
@@ -1660,6 +1676,7 @@ starg_exclude_p2mp_ipv4_ipv4() local mcast_grp=238.1.1.1 local plen=32 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1667,7 +1684,7 @@ starg_exclude_p2mp_ipv4_ipv4() echo "Data path: (*, G) EXCLUDE - P2MP - IPv4 overlay / IPv4 underlay" echo "---------------------------------------------------------------" - starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn" }
@@ -1678,6 +1695,7 @@ starg_exclude_p2mp_ipv6_ipv4() local mcast_grp=238.1.1.1 local plen=32 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1685,7 +1703,7 @@ starg_exclude_p2mp_ipv6_ipv4() echo "Data path: (*, G) EXCLUDE - P2MP - IPv6 overlay / IPv4 underlay" echo "---------------------------------------------------------------" - starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn -6" }
@@ -1696,6 +1714,7 @@ starg_exclude_p2mp_ipv4_ipv6() local mcast_grp=ff0e::2 local plen=128 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1703,7 +1722,7 @@ starg_exclude_p2mp_ipv4_ipv6() echo "Data path: (*, G) EXCLUDE - P2MP - IPv4 overlay / IPv6 underlay" echo "---------------------------------------------------------------" - starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn" }
@@ -1714,6 +1733,7 @@ starg_exclude_p2mp_ipv6_ipv6() local mcast_grp=ff0e::2 local plen=128 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1721,7 +1741,7 @@ starg_exclude_p2mp_ipv6_ipv6() echo "Data path: (*, G) EXCLUDE - P2MP - IPv6 overlay / IPv6 underlay" echo "---------------------------------------------------------------" - starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn -6" }
@@ -1732,6 +1752,7 @@ starg_include_p2mp_common() local mcast_grp=$1; shift local plen=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local valid_src=$1; shift local invalid_src=$1; shift local mz=$1; shift
@@ -1749,12 +1770,12 @@ starg_include_p2mp_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode include source_list $valid_src dst $mcast_grp src_vni 10010 via veth0" # Check that invalid source is not forwarded. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 0 log_test $? 0 "Block excluded source" # Check that valid source is forwarded. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Forward valid source"
@@ -1762,7 +1783,7 @@ starg_include_p2mp_common() run_cmd "ip -n $ns2 address del $mcast_grp/$plen dev veth0" # Check that valid source is not received anymore. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Receive of valid source after removal from group" }
@@ -1774,6 +1795,7 @@ starg_include_p2mp_ipv4_ipv4() local mcast_grp=238.1.1.1 local plen=32 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1781,7 +1803,7 @@ starg_include_p2mp_ipv4_ipv4() echo "Data path: (*, G) INCLUDE - P2MP - IPv4 overlay / IPv4 underlay" echo "---------------------------------------------------------------" - starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn" }
@@ -1792,6 +1814,7 @@ starg_include_p2mp_ipv6_ipv4() local mcast_grp=238.1.1.1 local plen=32 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1799,7 +1822,7 @@ starg_include_p2mp_ipv6_ipv4() echo "Data path: (*, G) INCLUDE - P2MP - IPv6 overlay / IPv4 underlay" echo "---------------------------------------------------------------" - starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn -6" }
@@ -1810,6 +1833,7 @@ starg_include_p2mp_ipv4_ipv6() local mcast_grp=ff0e::2 local plen=128 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1817,7 +1841,7 @@ starg_include_p2mp_ipv4_ipv6() echo "Data path: (*, G) INCLUDE - P2MP - IPv4 overlay / IPv6 underlay" echo "---------------------------------------------------------------" - starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn" }
@@ -1828,6 +1852,7 @@ starg_include_p2mp_ipv6_ipv6() local mcast_grp=ff0e::2 local plen=128 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1835,7 +1860,7 @@ starg_include_p2mp_ipv6_ipv6() echo "Data path: (*, G) INCLUDE - P2MP - IPv6 overlay / IPv6 underlay" echo "---------------------------------------------------------------" - starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn -6" }
@@ -1847,6 +1872,7 @@ egress_vni_translation_common() local plen=$1; shift local proto=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local src=$1; shift local mz=$1; shift
@@ -1882,20 +1908,20 @@ egress_vni_translation_common() # Make sure that packets sent from the first VTEP over VLAN 10 are # received by the SVI corresponding to the L3VNI (14000 / VLAN 4000) on # the second VTEP, since it is configured as PVID. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev br0.4000 ingress" 101 1 log_test $? 0 "Egress VNI translation - PVID configured" # Remove PVID flag from VLAN 4000 on the second VTEP and make sure # packets are no longer received by the SVI interface. run_cmd "bridge -n $ns2 vlan add vid 4000 dev vx0" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev br0.4000 ingress" 101 1 log_test $? 0 "Egress VNI translation - no PVID configured" # Reconfigure the PVID and make sure packets are received again. run_cmd "bridge -n $ns2 vlan add vid 4000 dev vx0 pvid" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev br0.4000 ingress" 101 2 log_test $? 0 "Egress VNI translation - PVID reconfigured" }
@@ -1908,6 +1934,7 @@ egress_vni_translation_ipv4_ipv4() local plen=32 local proto="ipv4" local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local src=192.0.2.129 echo
@@ -1915,7 +1942,7 @@ egress_vni_translation_ipv4_ipv4() echo "----------------------------------------------------------------" egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \ - $src "mausezahn" + $grp_dmac $src "mausezahn" } egress_vni_translation_ipv6_ipv4()
@@ -1926,6 +1953,7 @@ egress_vni_translation_ipv6_ipv4() local plen=32 local proto="ipv6" local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local src=2001:db8:100::1 echo
@@ -1933,7 +1961,7 @@ egress_vni_translation_ipv6_ipv4() echo "----------------------------------------------------------------" egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \ - $src "mausezahn -6" + $grp_dmac $src "mausezahn -6" } egress_vni_translation_ipv4_ipv6()
@@ -1944,6 +1972,7 @@ egress_vni_translation_ipv4_ipv6() local plen=128 local proto="ipv4" local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local src=192.0.2.129 echo
@@ -1951,7 +1980,7 @@ egress_vni_translation_ipv4_ipv6() echo "----------------------------------------------------------------" egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \ - $src "mausezahn" + $grp_dmac $src "mausezahn" } egress_vni_translation_ipv6_ipv6()
@@ -1962,6 +1991,7 @@ egress_vni_translation_ipv6_ipv6() local plen=128 local proto="ipv6" local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local src=2001:db8:100::1 echo
@@ -1969,7 +1999,7 @@ egress_vni_translation_ipv6_ipv6() echo "----------------------------------------------------------------" egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \ - $src "mausezahn -6" + $grp_dmac $src "mausezahn -6" } all_zeros_mdb_common()
@@ -1982,12 +2012,18 @@ all_zeros_mdb_common() local vtep4_ip=$1; shift local plen=$1; shift local ipv4_grp=239.1.1.1 + local ipv4_grp_dmac=01:00:5e:01:01:01 local ipv4_unreg_grp=239.2.2.2 + local ipv4_unreg_grp_dmac=01:00:5e:02:02:02 local ipv4_ll_grp=224.0.0.100 + local ipv4_ll_grp_dmac=01:00:5e:00:00:64 local ipv4_src=192.0.2.129 local ipv6_grp=ff0e::1 + local ipv6_grp_dmac=33:33:00:00:00:01 local ipv6_unreg_grp=ff0e::2 + local ipv6_unreg_grp_dmac=33:33:00:00:00:02 local ipv6_ll_grp=ff02::1 + local ipv6_ll_grp_dmac=33:33:00:00:00:01 local ipv6_src=2001:db8:100::1 # Install all-zeros (catchall) MDB entries for IPv4 and IPv6 traffic
@@ -2023,7 +2059,7 @@ all_zeros_mdb_common() # Send registered IPv4 multicast and make sure it only arrives to the # first VTEP. - run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_grp_dmac -A $ipv4_src -B $ipv4_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Registered IPv4 multicast - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 0
@@ -2031,7 +2067,7 @@ all_zeros_mdb_common() # Send unregistered IPv4 multicast that is not link-local and make sure # it arrives to the first and second VTEPs. - run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_unreg_grp_dmac -A $ipv4_src -B $ipv4_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 2 log_test $? 0 "Unregistered IPv4 multicast - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -2039,7 +2075,7 @@ all_zeros_mdb_common() # Send IPv4 link-local multicast traffic and make sure it does not # arrive to any VTEP. - run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_ll_grp_dmac -A $ipv4_src -B $ipv4_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 2 log_test $? 0 "Link-local IPv4 multicast - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -2074,7 +2110,7 @@ all_zeros_mdb_common() # Send registered IPv6 multicast and make sure it only arrives to the # third VTEP. - run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_grp_dmac -A $ipv6_src -B $ipv6_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 103 1 log_test $? 0 "Registered IPv6 multicast - third VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 104 0
@@ -2082,7 +2118,7 @@ all_zeros_mdb_common() # Send unregistered IPv6 multicast that is not link-local and make sure # it arrives to the third and fourth VTEPs. - run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_unreg_grp_dmac -A $ipv6_src -B $ipv6_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 103 2 log_test $? 0 "Unregistered IPv6 multicast - third VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 104 1
@@ -2090,7 +2126,7 @@ all_zeros_mdb_common() # Send IPv6 link-local multicast traffic and make sure it does not # arrive to any VTEP. - run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_ll_grp_dmac -A $ipv6_src -B $ipv6_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 103 2 log_test $? 0 "Link-local IPv6 multicast - third VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 104 1
@@ -2165,6 +2201,7 @@ mdb_fdb_common() local plen=$1; shift local proto=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local src=$1; shift local mz=$1; shift
@@ -2188,7 +2225,7 @@ mdb_fdb_common() # Send IP multicast traffic and make sure it is forwarded by the MDB # and only arrives to the first VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "IP multicast - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 0
@@ -2205,7 +2242,7 @@ mdb_fdb_common() # Remove the MDB entry and make sure that IP multicast is now forwarded # by the FDB to the second VTEP. run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep1_ip src_vni 10010" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "IP multicast after removal - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 2
@@ -2221,14 +2258,15 @@ mdb_fdb_ipv4_ipv4() local plen=32 local proto="ipv4" local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local src=192.0.2.129 echo echo "Data path: MDB with FDB - IPv4 overlay / IPv4 underlay" echo "------------------------------------------------------" - mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \ - "mausezahn" + mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \ + $grp_dmac $src "mausezahn" } mdb_fdb_ipv6_ipv4()
@@ -2240,14 +2278,15 @@ mdb_fdb_ipv6_ipv4() local plen=32 local proto="ipv6" local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local src=2001:db8:100::1 echo echo "Data path: MDB with FDB - IPv6 overlay / IPv4 underlay" echo "------------------------------------------------------" - mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \ - "mausezahn -6" + mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \ + $grp_dmac $src "mausezahn -6" } mdb_fdb_ipv4_ipv6()
@@ -2259,14 +2298,15 @@ mdb_fdb_ipv4_ipv6() local plen=128 local proto="ipv4" local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local src=192.0.2.129 echo echo "Data path: MDB with FDB - IPv4 overlay / IPv6 underlay" echo "------------------------------------------------------" - mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \ - "mausezahn" + mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \ + $grp_dmac $src "mausezahn" } mdb_fdb_ipv6_ipv6()
@@ -2278,14 +2318,15 @@ mdb_fdb_ipv6_ipv6() local plen=128 local proto="ipv6" local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local src=2001:db8:100::1 echo echo "Data path: MDB with FDB - IPv6 overlay / IPv6 underlay" echo "------------------------------------------------------" - mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \ - "mausezahn -6" + mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \ + $grp_dmac $src "mausezahn -6" } mdb_grp1_loop()
@@ -2320,7 +2361,9 @@ mdb_torture_common() local vtep1_ip=$1; shift local vtep2_ip=$1; shift local grp1=$1; shift + local grp1_dmac=$1; shift local grp2=$1; shift + local grp2_dmac=$1; shift local src=$1; shift local mz=$1; shift local pid1
@@ -2345,9 +2388,9 @@ mdb_torture_common() pid1=$! mdb_grp2_loop $ns1 $vtep1_ip $vtep2_ip $grp2 & pid2=$! - ip netns exec $ns1 $mz br0.10 -A $src -B $grp1 -t udp sp=12345,dp=54321 -p 100 -c 0 -q & + ip netns exec $ns1 $mz br0.10 -a own -b $grp1_dmac -A $src -B $grp1 -t udp sp=12345,dp=54321 -p 100 -c 0 -q & pid3=$! - ip netns exec $ns1 $mz br0.10 -A $src -B $grp2 -t udp sp=12345,dp=54321 -p 100 -c 0 -q & + ip netns exec $ns1 $mz br0.10 -a own -b $grp2_dmac -A $src -B $grp2 -t udp sp=12345,dp=54321 -p 100 -c 0 -q & pid4=$! sleep 30
@@ -2363,15 +2406,17 @@ mdb_torture_ipv4_ipv4() local vtep1_ip=198.51.100.100 local vtep2_ip=198.51.100.200 local grp1=239.1.1.1 + local grp1_dmac=01:00:5e:01:01:01 local grp2=239.2.2.2 + local grp2_dmac=01:00:5e:02:02:02 local src=192.0.2.129 echo echo "Data path: MDB torture test - IPv4 overlay / IPv4 underlay" echo "----------------------------------------------------------" - mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \ - "mausezahn" + mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \ + $grp2_dmac $src "mausezahn" } mdb_torture_ipv6_ipv4()
@@ -2380,15 +2425,17 @@ mdb_torture_ipv6_ipv4() local vtep1_ip=198.51.100.100 local vtep2_ip=198.51.100.200 local grp1=ff0e::1 + local grp1_dmac=33:33:00:00:00:01 local grp2=ff0e::2 + local grp2_dmac=33:33:00:00:00:02 local src=2001:db8:100::1 echo echo "Data path: MDB torture test - IPv6 overlay / IPv4 underlay" echo "----------------------------------------------------------" - mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \ - "mausezahn -6" + mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \ + $grp2_dmac $src "mausezahn -6" } mdb_torture_ipv4_ipv6()
@@ -2397,15 +2444,17 @@ mdb_torture_ipv4_ipv6() local vtep1_ip=2001:db8:1000::1 local vtep2_ip=2001:db8:2000::1 local grp1=239.1.1.1 + local grp1_dmac=01:00:5e:01:01:01 local grp2=239.2.2.2 + local grp2_dmac=01:00:5e:02:02:02 local src=192.0.2.129 echo echo "Data path: MDB torture test - IPv4 overlay / IPv6 underlay" echo "----------------------------------------------------------" - mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \ - "mausezahn" + mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \ + $grp2_dmac $src "mausezahn" } mdb_torture_ipv6_ipv6()
@@ -2414,15 +2463,17 @@ mdb_torture_ipv6_ipv6() local vtep1_ip=2001:db8:1000::1 local vtep2_ip=2001:db8:2000::1 local grp1=ff0e::1 + local grp1_dmac=33:33:00:00:00:01 local grp2=ff0e::2 + local grp2_dmac=33:33:00:00:00:02 local src=2001:db8:100::1 echo echo "Data path: MDB torture test - IPv6 overlay / IPv6 underlay" echo "----------------------------------------------------------" - mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \ - "mausezahn -6" + mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \ + $grp2_dmac $src "mausezahn -6" } ################################################################################
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/273 gpiolib: Fix debug messaging in gpiod_find_and_request()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 5c887b65bbd1a3fc28e2e20399acede0baa83edb ]
When consolidating GPIO lookups in ACPI code, the debug messaging had been reworked that the user may see
[ 13.401147] (NULL device *): using ACPI '\_SB.LEDS.led-0' for '(null)' GPIO lookup [ 13.401378] gpio gpiochip0: Persistence not supported for GPIO 40 [ 13.401402] gpio-40 (?): no flags found for (null)
instead of
[ 14.182962] gpio gpiochip0: Persistence not supported for GPIO 40 [ 14.182994] gpio-40 (?): no flags found for gpios
The '(null)' parts are less informative and likely scare the users. Replace them by '(default)' which can point out to the default connection IDs, such as 'gpios'.
While at it, amend other places where con_id is used in the messages.
--- drivers/gpio/gpiolib.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-)
drivers/gpio/gpiolib.c +18 -13
@@ -2402,6 +2402,11 @@ char *gpiochip_dup_line_label(struct gpi }EXPORT_SYMBOL_GPL (gpiochip_dup_line_label); +static inline const char *function_name_or_default (const char *con_id) +{ +return con_id ?:"(default)" ; +} +/** * gpiochip_request_own_desc - Allow GPIO chip to request its own descriptor * @gc: GPIO chip
@@ -2430,10 +2435,11 @@ struct gpio_desc *gpiochip_request_own_d enum gpiod_flags dflags) {struct gpio_desc *desc =gpiochip_get_desc (gc, hwnum); +const char *name =function_name_or_default (label);int ret;if (IS_ERR (desc)) { -chip_err (gc,"failed to get GPIO descriptor\n" ); +chip_err (gc,"failed to get GPIO %s descriptor\n" , name);return desc; }
@@ -2443,8 +2449,8 @@ struct gpio_desc *gpiochip_request_own_d ret =gpiod_configure_flags (desc, label, lflags, dflags);if (ret) { -chip_err (gc,"setup of own GPIO %s failed\n" , label);gpiod_free_commit (desc); +chip_err (gc,"setup of own GPIO %s failed\n" , name);return ERR_PTR (ret); }
@@ -4119,19 +4125,17 @@ static struct gpio_desc *gpiod_find_by_fenum gpiod_flags *flags, unsigned long *lookupflags) { + const char *name = function_name_or_default(con_id);struct gpio_desc *desc =ERR_PTR (-ENOENT );if (is_of_node (fwnode)) { -dev_dbg (consumer,"using DT '%pfw' for '%s' GPIO lookup\n" , - fwnode, con_id); +dev_dbg (consumer,"using DT '%pfw' for '%s' GPIO lookup\n" , fwnode, name); desc =of_find_gpio (to_of_node (fwnode), con_id, idx, lookupflags); }else if (is_acpi_node (fwnode)) { -dev_dbg (consumer,"using ACPI '%pfw' for '%s' GPIO lookup\n" , - fwnode, con_id); +dev_dbg (consumer,"using ACPI '%pfw' for '%s' GPIO lookup\n" , fwnode, name); desc =acpi_find_gpio (fwnode, con_id, idx, flags, lookupflags); }else if (is_software_node (fwnode)) { -dev_dbg (consumer,"using swnode '%pfw' for '%s' GPIO lookup\n" , - fwnode, con_id); +dev_dbg (consumer,"using swnode '%pfw' for '%s' GPIO lookup\n" , fwnode, name); desc =swnode_find_gpio (fwnode, con_id, idx, lookupflags); }
@@ -4147,6 +4151,7 @@ struct gpio_desc *gpiod_find_and_request bool platform_lookup_allowed) {unsigned long lookupflags =GPIO_LOOKUP_FLAGS_DEFAULT ; +const char *name =function_name_or_default (con_id);struct gpio_desc *desc;int ret;
@@ -4162,7 +4167,7 @@ struct gpio_desc *gpiod_find_and_request }if (IS_ERR (desc)) { -dev_dbg (consumer,"No GPIO consumer %s found\n" , con_id); +dev_dbg (consumer,"No GPIO consumer %s found\n" , name);return desc; }
@@ -4183,15 +4188,14 @@ struct gpio_desc *gpiod_find_and_request* * FIXME: Make this more sane and safe. */ -dev_info (consumer, -"nonexclusive access to GPIO for %s\n" , con_id); +dev_info (consumer,"nonexclusive access to GPIO for %s\n" , name);return desc; } ret =gpiod_configure_flags (desc, con_id, lookupflags, flags);if (ret <0 ) { -dev_dbg (consumer,"setup of GPIO %s failed\n" , con_id);gpiod_put (desc); +dev_dbg (consumer,"setup of GPIO %s failed\n" , name);return ERR_PTR (ret); }
@@ -4307,6 +4311,7 @@ EXPORT_SYMBOL_GPL(gpiod_get_optional);int gpiod_configure_flags (struct gpio_desc *desc,const char *con_id,unsigned long lflags,enum gpiod_flags dflags) { +const char *name =function_name_or_default (con_id);int ret;if (lflags &GPIO_ACTIVE_LOW )
@@ -4350,7 +4355,7 @@ int gpiod_configure_flags(struct gpio_de/* No particular flag request, return here... */ if (!(dflags &GPIOD_FLAGS_BIT_DIR_SET )) { -gpiod_dbg (desc,"no flags found for %s\n" , con_id); +gpiod_dbg (desc,"no flags found for GPIO %s\n" , name);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 33/273 ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Kiryushin <[email protected]>
[ Upstream commit 40e2710860e57411ab57a1529c5a2748abbe8a19 ]
ACPICA commit 9061cd9aa131205657c811a52a9f8325a040c6c9
Errors in acpi_evaluate_object() can lead to incorrect state of buffer.
This can lead to access to data in previously ACPI_FREEd buffer and secondary ACPI_FREE to the same buffer later.
Handle errors in acpi_evaluate_object the same way it is done earlier with acpi_ns_handle_to_pathname.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/acpica/dbnames.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/acpi/acpica/dbnames.c +6 -2
@@ -550,8 +550,12 @@ acpi_db_walk_for_fields(acpi_handle obj_handle,ACPI_FREE (buffer.pointer); buffer.length =ACPI_ALLOCATE_LOCAL_BUFFER ; -acpi_evaluate_object (obj_handle,NULL ,NULL , &buffer); - + status =acpi_evaluate_object (obj_handle,NULL ,NULL , &buffer); +if (ACPI_FAILURE (status)) { +acpi_os_printf ("Could Not evaluate object %p\n" , + obj_handle); +return (AE_OK ); + }/* * Since this is a field unit, surround the output in braces */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/273 net: hns3: fix index limit to support all queue stats
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Wang <[email protected]>
[ Upstream commit 47e39d213e09c6cae0d6b4d95e454ea404013312 ]
Currently, hns hardware supports more than 512 queues and the index limit in hclge_comm_tqps_update_stats is wrong. So this patch removes it.
--- .../ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c +1 -1
@@ -85,7 +85,7 @@ int hclge_comm_tqps_update_stats(struct hnae3_handle *handle,hclge_comm_cmd_setup_basic_desc (&desc,HCLGE_OPC_QUERY_TX_STATS , true); - desc.data[0 ] =cpu_to_le32 (tqp->index &0x1ff ); + desc.data[0 ] =cpu_to_le32 (tqp->index); ret =hclge_comm_cmd_send (hw, &desc,1 );if (ret) { dev_err(&hw->cmq.csq.pdev->dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/273 net: hns3: fix kernel crash when devlink reload during pf initialization
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonglong Liu <[email protected]>
[ Upstream commit 93305b77ffcb042f1538ecc383505e87d95aa05a ]
The devlink reload process will access the hardware resources, but the register operation is done before the hardware is initialized. So, processing the devlink reload during initialization may lead to kernel crash. This patch fixes this by taking devl_lock during initialization.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +4 -0
@@ -11613,6 +11613,8 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)if (ret) goto err_pci_uninit; +devl_lock (hdev->devlink); +/* Firmware command queue initialize */ ret =hclge_comm_cmd_queue_init (hdev->pdev, &hdev->hw.hw);if (ret)
@@ -11792,6 +11794,7 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)hclge_task_schedule (hdev,round_jiffies_relative (HZ )); +devl_unlock (hdev->devlink);return 0 ; err_mdiobus_unreg:
@@ -11804,6 +11807,7 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev) err_cmd_uninit:hclge_comm_cmd_uninit (hdev->ae_dev, &hdev->hw.hw); err_devlink_uninit: +devl_unlock (hdev->devlink);hclge_devlink_uninit (hdev); err_pci_uninit:pcim_iounmap (pdev, hdev->hw.hw.io_base);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/273 net: hns3: mark unexcuted loopback test result as UNEXECUTED
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Shen <[email protected]>
[ Upstream commit 5bd088d6c21a45ee70e6116879310e54174d75eb ]
Currently, loopback test may be skipped when resetting, but the test result will still show as 'PASS', because the driver doesn't set ETH_TEST_FL_FAILED flag. Fix it by setting the flag and initializating the value to UNEXECUTED.
--- .../ethernet/hisilicon/hns3/hns3_ethtool.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +17 -2
@@ -78,6 +78,9 @@ static const struct hns3_stats hns3_rxq_stats[] = {#define HNS3_NIC_LB_TEST_NO_MEM_ERR 1#define HNS3_NIC_LB_TEST_TX_CNT_ERR 2#define HNS3_NIC_LB_TEST_RX_CNT_ERR 3 +#define HNS3_NIC_LB_TEST_UNEXECUTED 4 + +static int hns3_get_sset_count (struct net_device *netdev,int stringset);static int hns3_lp_setup (struct net_device *ndev,enum hnae3_loop loop,bool en) {
@@ -418,18 +421,26 @@ static void hns3_do_external_lb(struct net_device *ndev,static void hns3_self_test (struct net_device *ndev,struct ethtool_test *eth_test,u64 *data) { +int cnt =hns3_get_sset_count (ndev,ETH_SS_TEST );struct hns3_nic_priv *priv =netdev_priv (ndev);struct hnae3_handle *h = priv->ae_handle;int st_param[HNAE3_LOOP_NONE ][2 ];bool if_running =netif_running (ndev); +int i; + +/* initialize the loopback test result, avoid marking an unexcuted +* loopback test as PASS. +*/ +for (i =0 ; i < cnt; i++) + data[i] =HNS3_NIC_LB_TEST_UNEXECUTED ;if (hns3_nic_resetting (ndev)) {netdev_err (ndev,"dev resetting!" ); -return ; + goto failure; }if (!(eth_test->flags Ð_TEST_FL_OFFLINE )) -return ; + goto failure;if (netif_msg_ifdown (h))netdev_info (ndev,"self test start\n" );
@@ -451,6 +462,10 @@ static void hns3_self_test(struct net_device *ndev,if (netif_msg_ifdown (h))netdev_info (ndev,"self test end\n" ); +return ; + +failure: + eth_test->flags |=ETH_TEST_FL_FAILED ; } static void hns3_update_limit_promisc_mode(struct net_device *netdev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/273 tls: recv: process_rx_list shouldnt use an offset with kvec
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 7608a971fdeb4c3eefa522d1bfe8d4bc6b2481cc ]
Only MSG_PEEK needs to copy from an offset during the final process_rx_list call, because the bytes we copied at the beginning of tls_sw_recvmsg were left on the rx_list. In the KVEC case, we removed data from the rx_list as we were copying it, so there's no need to use an offset, just like in the normal case.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -2152,7 +2152,7 @@ int tls_sw_recvmsg(struct sock *sk, }/* Drain records from the rx_list & copy if required */ -if (is_peek || is_kvec) +if (is_peek) err =process_rx_list (ctx, msg, &control, copied + peeked, decrypted - peeked, is_peek,NULL );else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/273 tls: adjust recv return with async crypto and failed copy to userspace
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 85eef9a41d019b59be7bc91793f26251909c0710 ]
process_rx_list may not copy as many bytes as we want to the userspace buffer, for example in case we hit an EFAULT during the copy. If this happens, we should only count the bytes that were actually copied, which may be 0.
Subtracting async_copy_bytes is correct in both peek and !peek cases, because decrypted == async_copy_bytes + peeked for the peek case: peek is always !ZC, and we can go through either the sync or async path. In the async case, we add chunk to both decrypted and async_copy_bytes. In the sync case, we add chunk to both decrypted and peeked. I missed that in commit 6caaf104423d ("tls: fix peeking with sync+async decryption").
--- net/tls/tls_sw.c | 3 +++ 1 file changed, 3 insertions(+)
net/tls/tls_sw.c +3 -0
@@ -2158,6 +2158,9 @@ int tls_sw_recvmsg(struct sock *sk,else err =process_rx_list (ctx, msg, &control,0 , async_copy_bytes, is_peek,NULL ); + +/* we could have copied less than we wanted, and possibly nothing */ + decrypted +=max (err,0 ) - async_copy_bytes; } copied += decrypted;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/273 tls: get psock ref after taking rxlock to avoid leak
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 417e91e856099e9b8a42a2520e2255e6afe024be ]
At the start of tls_sw_recvmsg, we take a reference on the psock, and then call tls_rx_reader_lock. If that fails, we return directly without releasing the reference.
Instead of adding a new label, just take the reference after locking has succeeded, since we don't need it before.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -1976,10 +1976,10 @@ int tls_sw_recvmsg(struct sock *sk,if (unlikely (flags &MSG_ERRQUEUE ))return sock_recv_errqueue (sk, msg, len,SOL_IP ,IP_RECVERR ); - psock =sk_psock_get (sk); err =tls_rx_reader_lock (sk, ctx, flags &MSG_DONTWAIT );if (err <0 )return err; + psock =sk_psock_get (sk); bpf_strp_enabled =sk_psock_strp_enabled (psock);/* If crypto failed the connection is broken */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/273 mlxbf_gige: call request_irq() after NAPI initialized
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
[ Upstream commit f7442a634ac06b953fc1f7418f307b25acd4cfbc ]
The mlxbf_gige driver encounters a NULL pointer exception in mlxbf_gige_open() when kdump is enabled. The sequence to reproduce the exception is as follows:
a) enable kdump
b) trigger kdump via "echo c > /proc/sysrq-trigger"
c) kdump kernel executes
d) kdump kernel loads mlxbf_gige module
e) the mlxbf_gige module runs its open() as the
the "oob_net0" interface is brought up
f) mlxbf_gige module will experience an exception
during its open(), something like:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000086000004
EC = 0x21: IABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
user pgtable: 4k pages, 48-bit VAs, pgdp=00000000e29a4000
[0000000000000000] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000086000004 [#1] SMP
CPU: 0 PID: 812 Comm: NetworkManager Tainted: G OE 5.15.0-1035-bluefield #37-Ubuntu
Hardware name: https://www.mellanox.com BlueField-3 SmartNIC Main Card/BlueField-3 SmartNIC Main Card, BIOS 4.6.0.13024 Jan 19 2024
pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : 0x0
lr : __napi_poll+0x40/0x230
sp : ffff800008003e00
x29: ffff800008003e00 x28: 0000000000000000 x27: 00000000ffffffff
x26: ffff000066027238 x25: ffff00007cedec00 x24: ffff800008003ec8
x23: 000000000000012c x22: ffff800008003eb7 x21: 0000000000000000
x20: 0000000000000001 x19: ffff000066027238 x18: 0000000000000000
x17: ffff578fcb450000 x16: ffffa870b083c7c0 x15: 0000aaab010441d0
x14: 0000000000000001 x13: 00726f7272655f65 x12: 6769675f6662786c
x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa870b0842398
x8 : 0000000000000004 x7 : fe5a48b9069706ea x6 : 17fdb11fc84ae0d2
x5 : d94a82549d594f35 x4 : 0000000000000000 x3 : 0000000000400100
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000066027238
Call trace:
0x0
net_rx_action+0x178/0x360
__do_softirq+0x15c/0x428
__irq_exit_rcu+0xac/0xec
irq_exit+0x18/0x2c
handle_domain_irq+0x6c/0xa0
gic_handle_irq+0xec/0x1b0
call_on_irq_stack+0x20/0x2c
do_interrupt_handler+0x5c/0x70
el1_interrupt+0x30/0x50
el1h_64_irq_handler+0x18/0x2c
el1h_64_irq+0x7c/0x80
__setup_irq+0x4c0/0x950
request_threaded_irq+0xf4/0x1bc
mlxbf_gige_request_irqs+0x68/0x110 [mlxbf_gige]
mlxbf_gige_open+0x5c/0x170 [mlxbf_gige]
__dev_open+0x100/0x220
__dev_change_flags+0x16c/0x1f0
dev_change_flags+0x2c/0x70
do_setlink+0x220/0xa40
__rtnl_newlink+0x56c/0x8a0
rtnl_newlink+0x58/0x84
rtnetlink_rcv_msg+0x138/0x3c4
netlink_rcv_skb+0x64/0x130
rtnetlink_rcv+0x20/0x30
netlink_unicast+0x2ec/0x360
netlink_sendmsg+0x278/0x490
__sock_sendmsg+0x5c/0x6c
____sys_sendmsg+0x290/0x2d4
___sys_sendmsg+0x84/0xd0
__sys_sendmsg+0x70/0xd0
__arm64_sys_sendmsg+0x2c/0x40
invoke_syscall+0x78/0x100
el0_svc_common.constprop.0+0x54/0x184
do_el0_svc+0x30/0xac
el0_svc+0x48/0x160
el0t_64_sync_handler+0xa4/0x12c
el0t_64_sync+0x1a4/0x1a8
Code: bad PC value
---[ end trace 7d1c3f3bf9d81885 ]---
Kernel panic - not syncing: Oops: Fatal exception in interrupt
Kernel Offset: 0x2870a7a00000 from 0xffff800008000000
PHYS_OFFSET: 0x80000000
CPU features: 0x0,000005c1,a3332a5a
Memory Limit: none
---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---The exception happens because there is a pending RX interrupt before the call to request_irq(RX IRQ) executes. Then, the RX IRQ handler fires immediately after this request_irq() completes. The RX IRQ handler runs "napi_schedule()" before NAPI is fully initialized via "netif_napi_add()" and "napi_enable()", both which happen later in the open() logic.
The logic in mlxbf_gige_open() must fully initialize NAPI before any calls to request_irq() execute.
--- .../mellanox/mlxbf_gige/mlxbf_gige_main.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +11 -7
@@ -139,13 +139,10 @@ static int mlxbf_gige_open(struct net_device *netdev) control |=MLXBF_GIGE_CONTROL_PORT_EN ;writeq (control, priv->base +MLXBF_GIGE_CONTROL ); - err =mlxbf_gige_request_irqs (priv); -if (err) -return err;mlxbf_gige_cache_stats (priv); err =mlxbf_gige_clean_port (priv);if (err) - goto free_irqs; +return err;/* Clear driver's valid_polarity to match hardware, * since the above call to clean_port() resets the
@@ -166,6 +163,10 @@ static int mlxbf_gige_open(struct net_device *netdev)napi_enable (&priv->napi);netif_start_queue (netdev); + err =mlxbf_gige_request_irqs (priv); +if (err) + goto napi_deinit; +/* Set bits in INT_EN that we care about */ int_en =MLXBF_GIGE_INT_EN_HW_ACCESS_ERROR | MLXBF_GIGE_INT_EN_TX_CHECKSUM_INPUTS |
@@ -182,14 +183,17 @@ static int mlxbf_gige_open(struct net_device *netdev)return 0 ; +napi_deinit: +netif_stop_queue (netdev); +napi_disable (&priv->napi); +netif_napi_del (&priv->napi); +mlxbf_gige_rx_deinit (priv); + tx_deinit:mlxbf_gige_tx_deinit (priv); phy_deinit:phy_stop (phydev); - -free_irqs: -mlxbf_gige_free_irqs (priv);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/273 drm/amd/display: Update P010 scaling cap
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charlene Liu <[email protected]>
[ Upstream commit 038c532346418fb5ab09c8fc6d650283d9a02966 ]
[Why]
Keep the same as previous APU and also insert clock dump
Stable-dep-of: f341055b10bd ("drm/amd/display: Send DTBCLK disable message on first commit")
--- .../display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 25 +++++++++---------- .../dc/resource/dcn35/dcn35_resource.c | 2 +- 2 files changed, 13 insertions(+), 14 deletions(-)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c +12 -13
@@ -384,19 +384,6 @@ static void dcn35_enable_pme_wa(struct clk_mgr *clk_mgr_base)dcn35_smu_enable_pme_wa (clk_mgr); } -void dcn35_init_clocks (struct clk_mgr *clk_mgr) -{ -uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz; - -memset (&(clk_mgr->clks),0 ,sizeof (struct dc_clocks )); - -// Assumption is that boot state always supports pstate - clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk;// restore ref_dtbclk - clk_mgr->clks.p_state_change_support = true; - clk_mgr->clks.prev_p_state_change_support = true; - clk_mgr->clks.pwr_state =DCN_PWR_STATE_UNKNOWN ; - clk_mgr->clks.zstate_support =DCN_ZSTATE_SUPPORT_UNKNOWN ; -}bool dcn35_are_clock_states_equal (struct dc_clocks *a,struct dc_clocks *b)
@@ -421,7 +408,19 @@ static void dcn35_dump_clk_registers(struct clk_state_registers_and_bypass *regs struct clk_mgr_dcn35 *clk_mgr) { } +void dcn35_init_clocks (struct clk_mgr *clk_mgr) +{ +uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz; +memset (&(clk_mgr->clks),0 ,sizeof (struct dc_clocks )); + +// Assumption is that boot state always supports pstate + clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk;// restore ref_dtbclk + clk_mgr->clks.p_state_change_support = true; + clk_mgr->clks.prev_p_state_change_support = true; + clk_mgr->clks.pwr_state =DCN_PWR_STATE_UNKNOWN ; + clk_mgr->clks.zstate_support =DCN_ZSTATE_SUPPORT_UNKNOWN ; +}static struct clk_bw_params dcn35_bw_params = { .vram_type = Ddr4MemType, .num_channels =1 ,
drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +1 -1
@@ -701,7 +701,7 @@ static const struct dc_plane_cap plane_cap = {// 6:1 downscaling ratio: 1000/6 = 166.666 .max_downscale_factor = { - .argb8888 = 167, + .argb8888 = 250, .nv12 = 167, .fp16 =167 },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/273 drm/amd/display: Send DTBCLK disable message on first commit
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taimur Hassan <[email protected]>
[ Upstream commit f341055b10bd8be55c3c995dff5f770b236b8ca9 ]
[Why]
Previous patch to allow DTBCLK disable didn't address boot case. Driver thinks DTBCLK is disabled by default, so we don't send disable message to PMFW. DTBCLK is then enabled at idle desktop on boot, burning power.
[How]
Set dtbclk_en to true on boot so that disable message is sent during first commit.
--- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c +1 -0
@@ -415,6 +415,7 @@ void dcn35_init_clocks(struct clk_mgr *clk_mgr)memset (&(clk_mgr->clks),0 ,sizeof (struct dc_clocks ));// Assumption is that boot state always supports pstate + clk_mgr->clks.dtbclk_en = true; clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk;// restore ref_dtbclk clk_mgr->clks.p_state_change_support = true; clk_mgr->clks.prev_p_state_change_support = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/273 bpf: Protect against int overflow for stack access size
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Matei <[email protected]>
[ Upstream commit ecc6a2101840177e57c925c102d2d29f260d37c8 ]
This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int representation. This should not actually happen, as there are other protections along the way, but we should protect against it anyway. One code path was missing such protections (fixed in the previous patch in the series), causing out-of-bounds array accesses in check_stack_range_initialized(). This patch causes the verification of a program with such a non-sensical access size to fail.
This check used to exist in a more indirect way, but was inadvertendly removed in a833a17aeac7.
--- kernel/bpf/verifier.c | 5 +++++ 1 file changed, 5 insertions(+)
kernel/bpf/verifier.c +5 -0
@@ -6618,6 +6618,11 @@ static int check_stack_access_within_bounds( err =check_stack_slot_within_bounds (env, min_off, state, type);if (!err && max_off >0 ) err = -EINVAL ;/* out of stack access into non-negative offsets */ +if (!err && access_size <0 ) +/* access_size should not be negative (or overflow an int); others checks +* along the way should have prevented such an access. +*/ + err = -EFAULT ;/* invalid negative access size; integer overflow? */ if (err) {if (tnum_is_const (reg->var_off)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/273 cifs: Fix duplicate fscache cookie warnings
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 8876a37277cb832e1861c35f8c661825179f73f5 ]
fscache emits a lot of duplicate cookie warnings with cifs because the index key for the fscache cookies does not include everything that the cifs_find_inode() function does. The latter is used with iget5_locked() to distinguish between inodes in the local inode cache.
Fix this by adding the creation time and file type to the fscache cookie key.
Additionally, add a couple of comments to note that if one is changed the other must be also.
--- fs/smb/client/fscache.c | 16 +++++++++++++++- fs/smb/client/inode.c | 2 ++ 2 files changed, 17 insertions(+), 1 deletion(-)
fs/smb/client/fscache.c +15 -1
@@ -12,6 +12,16 @@#include "cifs_fs_sb.h" #include "cifsproto.h" +/* +* Key for fscache inode. [!] Contents must match comparisons in cifs_find_inode(). +*/ +struct cifs_fscache_inode_key { + +__le64 uniqueid;/* server inode number */ +__le64 createtime;/* creation time on server */ +u8 type;/* S_IFMT file type */ +} __packed; +static void cifs_fscache_fill_volume_coherency (struct cifs_tcon *tcon,struct cifs_fscache_volume_coherency_data *cd)
@@ -97,15 +107,19 @@ void cifs_fscache_release_super_cookie(struct cifs_tcon *tcon)void cifs_fscache_get_inode_cookie (struct inode *inode) {struct cifs_fscache_inode_coherency_data cd; +struct cifs_fscache_inode_key key;struct cifsInodeInfo *cifsi =CIFS_I (inode);struct cifs_sb_info *cifs_sb =CIFS_SB (inode->i_sb);struct cifs_tcon *tcon =cifs_sb_master_tcon (cifs_sb); + key.uniqueid =cpu_to_le64 (cifsi->uniqueid); + key.createtime =cpu_to_le64 (cifsi->createtime); + key.type = (inode->i_mode &S_IFMT ) >>12 ;cifs_fscache_fill_coherency (&cifsi->netfs.inode, &cd); cifsi->netfs.cache =fscache_acquire_cookie (tcon->fscache,0 , - &cifsi->uniqueid,sizeof (cifsi->uniqueid), + &key,sizeof (key), &cd,sizeof (cd),i_size_read (&cifsi->netfs.inode));if (cifsi->netfs.cache)
fs/smb/client/inode.c +2 -0
@@ -1414,6 +1414,8 @@ cifs_find_inode(struct inode *inode, void *opaque) {struct cifs_fattr *fattr = opaque; +/* [!] The compared values must be the same in struct cifs_fscache_inode_key. */ +/* don't match inode with different uniqueid */ if (CIFS_I (inode)->uniqueid != fattr->cf_uniqueid)return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/273 netfilter: nf_tables: reject destroy command to remove basechain hooks
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit b32ca27fa238ff83427d23bef2a5b741e2a88a1e ]
Report EOPNOTSUPP if NFT_MSG_DESTROYCHAIN is used to delete hooks in an existing netdev basechain, thus, only NFT_MSG_DELCHAIN is allowed.
--- net/netfilter/nf_tables_api.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +2 -1
@@ -2932,7 +2932,8 @@ static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info,nft_ctx_init (&ctx, net, skb, info->nlh, family, table, chain, nla);if (nla[NFTA_CHAIN_HOOK ]) { -if (chain->flags &NFT_CHAIN_HW_OFFLOAD ) +if (NFNL_MSG_TYPE (info->nlh->nlmsg_type) ==NFT_MSG_DESTROYCHAIN || + chain->flags &NFT_CHAIN_HW_OFFLOAD )return -EOPNOTSUPP ;if (nft_is_base_chain (chain)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/273 netfilter: nf_tables: reject table flag and netdev basechain updates
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 1e1fb6f00f52812277963365d9bd835b9b0ea4e0 ]
netdev basechain updates are stored in the transaction object hook list. When setting on the table dormant flag, it iterates over the existing hooks in the basechain. Thus, skipping the hooks that are being added/deleted in this transaction, which leaves hook registration in inconsistent state.
Reject table flag updates in combination with netdev basechain updates in the same batch:
- Update table flags and add/delete basechain: Check from basechain update path if there are pending flag updates for this table.
- add/delete basechain and update table flags: Iterate over the transaction list to search for basechain updates from the table update path.
In both cases, the batch is rejected. Based on suggestion from Florian Westphal.
--- net/netfilter/nf_tables_api.c | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +30 -1
@@ -1198,6 +1198,25 @@ static void nf_tables_table_disable(struct net *net, struct nft_table *table)#define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \ __NFT_TABLE_F_WAS_AWAKEN) +static bool nft_table_pending_update (const struct nft_ctx *ctx) +{ +struct nftables_pernet *nft_net =nft_pernet (ctx->net); +struct nft_trans *trans; + +if (ctx->table->flags & __NFT_TABLE_F_UPDATE) +return true; + +list_for_each_entry (trans, &nft_net->commit_list, list) { +if ((trans->msg_type ==NFT_MSG_NEWCHAIN || + trans->msg_type ==NFT_MSG_DELCHAIN ) && + trans->ctx.table == ctx->table && +nft_trans_chain_update (trans)) +return true; + } + +return false; +} +static int nf_tables_updtable (struct nft_ctx *ctx) {struct nft_trans *trans;
@@ -1221,7 +1240,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx)return -EOPNOTSUPP ;/* No dormant off/on/off/on games in single transaction */ -if (ctx->table->flags & __NFT_TABLE_F_UPDATE) +if (nft_table_pending_update (ctx))return -EINVAL ; trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
@@ -2619,6 +2638,13 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, } } +if (table->flags & __NFT_TABLE_F_UPDATE && + !list_empty (&hook.list)) { +NL_SET_BAD_ATTR (extack, attr); + err = -EOPNOTSUPP ; + goto err_hooks; + } +if (!(table->flags &NFT_TABLE_F_DORMANT ) &&nft_is_base_chain (chain) && !list_empty (&hook.list)) {
@@ -2848,6 +2874,9 @@ static int nft_delchain_hook(struct nft_ctx *ctx,struct nft_trans *trans;int err; +if (ctx->table->flags & __NFT_TABLE_F_UPDATE) +return -EOPNOTSUPP ; + err =nft_chain_parse_hook (ctx->net, basechain, nla, &chain_hook, ctx->family, chain->flags, extack);if (err <0 )
Signature · 1 line
2.43.0
Re: [PATCH 6.8 046/273] netfilter: nf_tables: reject table flag and netdev basechain updates
Quoted 40 lines · Greg Kroah-Hartman
6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit
1e1fb6f00f52812277963365d9bd835b9b0ea4e0]netdev basechain updates are stored in the transaction object hook list. When setting on the table dormant flag, it iterates over the existing hooks in the basechain. Thus, skipping the hooks that are being added/deleted in this transaction, which leaves hook registration in inconsistent state.
Reject table flag updates in combination with netdev basechain updates in the same batch:
- Update table flags and add/delete basechain: Check from basechain update path if there are pending flag updates for this table.
- add/delete basechain and update table flags: Iterate over the transaction list to search for basechain updates from the table update path.In both cases, the batch is rejected. Based on suggestion from Florian Westphal.
Fixes b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")Fixes 7d937b107108f ("netfilter: nf_tables: support for deleting devices in an existing netdev chain")Signed-off-by Pablo Neira Ayuso <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- net/netfilter/nf_tables_api.c | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-)net/netfilter/nf_tables_api.c +0
-0@@ -1198,6 +1198,25 @@ static void nf_tables_table_disable(struct net *net, struct nft_table *table)#define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \ __NFT_TABLE_F_WAS_AWAKEN)
net/netfilter/nf_tables_api.c static void nf_tables_table_disable(struct net *net, struct nft_table *table) · line 1210
Quoted 10 lines
net/netfilter/nf_tables_api.c +10
-0+static bool nft_table_pending_update (const struct nft_ctx *ctx) +{ +struct nftables_pernet *nft_net =nft_pernet (ctx->net); +struct nft_trans *trans; + +if (ctx->table->flags & __NFT_TABLE_F_UPDATE) +return true; + +list_for_each_entry (trans, &nft_net->commit_list, list) { + if ((trans->msg_type == NFT_MSG_NEWCHAIN ||
^.........................................^
Remove this, only update is narrowed down.
Thanks.
Quoted 50 lines
net/netfilter/nf_tables_api.c +20
-1+ trans->msg_type == NFT_MSG_DELCHAIN) && + trans->ctx.table == ctx->table && + nft_trans_chain_update(trans)) + return true; + } + +return false; +} +static int nf_tables_updtable (struct nft_ctx *ctx) {struct nft_trans *trans;@@ -1221,7 +1240,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx)return -EOPNOTSUPP ;/* No dormant off/on/off/on games in single transaction */ -if (ctx->table->flags & __NFT_TABLE_F_UPDATE) +if (nft_table_pending_update (ctx))return -EINVAL ; trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,@@ -2619,6 +2638,13 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, } } +if (table->flags & __NFT_TABLE_F_UPDATE && + !list_empty (&hook.list)) { +NL_SET_BAD_ATTR (extack, attr); + err = -EOPNOTSUPP ; + goto err_hooks; + } +if (!(table->flags &NFT_TABLE_F_DORMANT ) &&nft_is_base_chain (chain) && !list_empty (&hook.list)) {@@ -2848,6 +2874,9 @@ static int nft_delchain_hook(struct nft_ctx *ctx,struct nft_trans *trans;int err; +if (ctx->table->flags & __NFT_TABLE_F_UPDATE) +return -EOPNOTSUPP ; + err =nft_chain_parse_hook (ctx->net, basechain, nla, &chain_hook, ctx->family, chain->flags, extack);if (err <0 )Signature · 1 line
2.43.0
Re: [PATCH 6.8 046/273] netfilter: nf_tables: reject table flag and netdev basechain updates
Quoted 53 lines · Pablo Neira Ayuso
Quoted 40 lines · Greg Kroah-Hartman
6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit
1e1fb6f00f52812277963365d9bd835b9b0ea4e0]netdev basechain updates are stored in the transaction object hook list. When setting on the table dormant flag, it iterates over the existing hooks in the basechain. Thus, skipping the hooks that are being added/deleted in this transaction, which leaves hook registration in inconsistent state.
Reject table flag updates in combination with netdev basechain updates in the same batch:
- Update table flags and add/delete basechain: Check from basechain update path if there are pending flag updates for this table.
- add/delete basechain and update table flags: Iterate over the transaction list to search for basechain updates from the table update path.In both cases, the batch is rejected. Based on suggestion from Florian Westphal.
Fixes b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")Fixes 7d937b107108f ("netfilter: nf_tables: support for deleting devices in an existing netdev chain")Signed-off-by Pablo Neira Ayuso <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- net/netfilter/nf_tables_api.c | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-)net/netfilter/nf_tables_api.c +0
-0@@ -1198,6 +1198,25 @@ static void nf_tables_table_disable(struct net *net, struct nft_table *table)#define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \ __NFT_TABLE_F_WAS_AWAKEN)net/netfilter/nf_tables_api.c static void nf_tables_table_disable(struct net *net, struct nft_table *table) · line 1210
Quoted 10 lines
net/netfilter/nf_tables_api.c +10
-0+static bool nft_table_pending_update (const struct nft_ctx *ctx) +{ +struct nftables_pernet *nft_net =nft_pernet (ctx->net); +struct nft_trans *trans; + +if (ctx->table->flags & __NFT_TABLE_F_UPDATE) +return true; + +list_for_each_entry (trans, &nft_net->commit_list, list) { + if ((trans->msg_type == NFT_MSG_NEWCHAIN ||^.........................................^
Quoted 1 line
Remove this, only update is narrowed down.
Apologies.
Patch is fine.
Greg Kroah-Hartman
maintainerPATCH 47/273 netfilter: nf_tables: skip netdev hook unregistration if table is dormant
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 216e7bf7402caf73f4939a8e0248392e96d7c0da ]
Skip hook unregistration when adding or deleting devices from an existing netdev basechain. Otherwise, commit/abort path try to unregister hooks which not enabled.
--- net/netfilter/nf_tables_api.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
net/netfilter/nf_tables_api.c +10 -6
@@ -10208,9 +10208,11 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)if (nft_trans_chain_update (trans)) {nf_tables_chain_notify (&trans->ctx,NFT_MSG_DELCHAIN , &nft_trans_chain_hooks (trans)); -nft_netdev_unregister_hooks (net, - &nft_trans_chain_hooks (trans), - true); +if (!(trans->ctx.table->flags &NFT_TABLE_F_DORMANT )) { +nft_netdev_unregister_hooks (net, + &nft_trans_chain_hooks (trans), + true); + } }else {nft_chain_del (trans->ctx.chain); nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,
@@ -10482,9 +10484,11 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)break ;case NFT_MSG_NEWCHAIN :if (nft_trans_chain_update (trans)) { -nft_netdev_unregister_hooks (net, - &nft_trans_chain_hooks (trans), - true); +if (!(trans->ctx.table->flags &NFT_TABLE_F_DORMANT )) { +nft_netdev_unregister_hooks (net, + &nft_trans_chain_hooks (trans), + true); + }free_percpu (nft_trans_chain_stats (trans));kfree (nft_trans_chain_name (trans));nft_trans_destroy (trans);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/273 iommu: Validate the PASID in iommu_attach_device_pasid()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit c404f55c26fc23c70a9f2262f3f36a69fc46289b ]
The SVA code checks that the PASID is valid for the device when assigning the PASID to the MM, but the normal PAGING related path does not check it.
Devices that don't support PASID or PASID values too large for the device should not invoke the driver callback. The drivers should rely on the core code for this enforcement.
--- drivers/iommu/iommu.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/iommu/iommu.c +10 -1
@@ -3547,6 +3547,7 @@ int iommu_attach_device_pasid(struct iommu_domain *domain, {/* Caller must be a probed driver on dev */ struct iommu_group *group = dev->iommu_group; +struct group_device *device;void *curr;int ret;
@@ -3556,10 +3557,18 @@ int iommu_attach_device_pasid(struct iommu_domain *domain,if (!group)return -ENODEV ; -if (!dev_has_iommu (dev) ||dev_iommu_ops (dev) != domain->owner) +if (!dev_has_iommu (dev) ||dev_iommu_ops (dev) != domain->owner || + pasid ==IOMMU_NO_PASID )return -EINVAL ;mutex_lock (&group->mutex); +for_each_group_device (group, device) { +if (pasid >= device->dev->iommu->max_pasids) { + ret = -EINVAL ; + goto out_unlock; + } + } + curr =xa_cmpxchg (&group->pasid_array, pasid,NULL , domain,GFP_KERNEL );if (curr) { ret =xa_err (curr) ? : -EBUSY ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/273 net: bcmasp: Bring up unimac after PHY link up
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <[email protected]>
[ Upstream commit dfd222e2aef68818320a57b13a1c52a44c22bc80 ]
The unimac requires the PHY RX clk during reset or it may be put into a bad state. Bring up the unimac after link up to ensure the PHY RX clk exists.
--- .../net/ethernet/broadcom/asp2/bcmasp_intf.c | 28 +++++++++++++------ 1 file changed, 19 insertions(+), 9 deletions(-)
drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c +19 -9
@@ -391,7 +391,9 @@ static void umac_reset(struct bcmasp_intf *intf)umac_wl (intf,0x0 ,UMC_CMD );umac_wl (intf,UMC_CMD_SW_RESET ,UMC_CMD );usleep_range (10 ,100 ); -umac_wl (intf,0x0 ,UMC_CMD ); +/* We hold the umac in reset and bring it out of +* reset when phy link is up. +*/ } static void umac_set_hw_addr(struct bcmasp_intf *intf,
@@ -411,6 +413,8 @@ static void umac_enable_set(struct bcmasp_intf *intf, u32 mask,u32 reg; reg =umac_rl (intf,UMC_CMD ); +if (reg &UMC_CMD_SW_RESET ) +return ;if (enable) reg |= mask;else
@@ -429,7 +433,6 @@ static void umac_init(struct bcmasp_intf *intf)umac_wl (intf,0x800 ,UMC_FRM_LEN );umac_wl (intf,0xffff ,UMC_PAUSE_CNTRL );umac_wl (intf,0x800 ,UMC_RX_MAX_PKT_SZ ); -umac_enable_set (intf,UMC_CMD_PROMISC ,1 ); }static int bcmasp_tx_poll (struct napi_struct *napi,int budget)
@@ -656,6 +659,12 @@ static void bcmasp_adj_link(struct net_device *dev)UMC_CMD_HD_EN |UMC_CMD_RX_PAUSE_IGNORE | UMC_CMD_TX_PAUSE_IGNORE); reg |= cmd_bits; +if (reg &UMC_CMD_SW_RESET ) { + reg &= ~UMC_CMD_SW_RESET ; +umac_wl (intf, reg,UMC_CMD ); +udelay (2 ); + reg |=UMC_CMD_TX_EN |UMC_CMD_RX_EN |UMC_CMD_PROMISC ; + }umac_wl (intf, reg,UMC_CMD ); intf->eee.eee_active =phy_init_eee (phydev,0 ) >=0 ;
@@ -1063,9 +1072,6 @@ static int bcmasp_netif_init(struct net_device *dev, bool phy_connect)umac_init (intf); -/* Disable the UniMAC RX/TX */ -umac_enable_set (intf, (UMC_CMD_RX_EN |UMC_CMD_TX_EN ),0 ); -umac_set_hw_addr (intf, dev->dev_addr); intf->old_duplex =-1 ;
@@ -1085,9 +1091,6 @@ static int bcmasp_netif_init(struct net_device *dev, bool phy_connect)bcmasp_enable_rx (intf,1 ); -/* Turn on UniMAC TX/RX */ -umac_enable_set (intf, (UMC_CMD_RX_EN |UMC_CMD_TX_EN ),1 ); - intf->crc_fwd = !!(umac_rl (intf,UMC_CMD ) &UMC_CMD_CRC_FWD );bcmasp_netif_start (dev);
@@ -1324,7 +1327,14 @@ static void bcmasp_suspend_to_wol(struct bcmasp_intf *intf)if (intf->wolopts &WAKE_FILTER )bcmasp_netfilt_suspend (intf); -/* UniMAC receive needs to be turned on */ +/* Bring UniMAC out of reset if needed and enable RX */ + reg =umac_rl (intf,UMC_CMD ); +if (reg &UMC_CMD_SW_RESET ) + reg &= ~UMC_CMD_SW_RESET ; + + reg |=UMC_CMD_RX_EN |UMC_CMD_PROMISC ; +umac_wl (intf, reg,UMC_CMD ); +umac_enable_set (intf,UMC_CMD_RX_EN ,1 );if (intf->parent->wol_irq >0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/273 net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Lakkaraju <[email protected]>
[ Upstream commit e4a58989f5c839316ac63675e8800b9eed7dbe96 ]
PCI11x1x Rev B0 devices might drop packets when receiving back to back frames at 2.5G link speed. Change the B0 Rev device's Receive filtering Engine FIFO threshold parameter from its hardware default of 4 to 3 dwords to prevent the problem. Rev C0 and later hardware already defaults to 3 dwords.
--- drivers/net/ethernet/microchip/lan743x_main.c | 18 ++++++++++++++++++ drivers/net/ethernet/microchip/lan743x_main.h | 4 ++++ 2 files changed, 22 insertions(+)
drivers/net/ethernet/microchip/lan743x_main.c +18 -0
@@ -25,6 +25,8 @@#define PCS_POWER_STATE_DOWN 0x6#define PCS_POWER_STATE_UP 0x4 +#define RFE_RD_FIFO_TH_3_DWORDS 0x3 +static void pci11x1x_strap_get_status (struct lan743x_adapter *adapter) {u32 chip_rev;
@@ -3272,6 +3274,21 @@ static void lan743x_full_cleanup(struct lan743x_adapter *adapter)lan743x_pci_cleanup (adapter); } +static void pci11x1x_set_rfe_rd_fifo_threshold (struct lan743x_adapter *adapter) +{ +u16 rev = adapter->csr.id_rev &ID_REV_CHIP_REV_MASK_ ; + +if (rev ==ID_REV_CHIP_REV_PCI11X1X_B0_ ) { +u32 misc_ctl; + + misc_ctl =lan743x_csr_read (adapter,MISC_CTL_0 ); + misc_ctl &= ~MISC_CTL_0_RFE_READ_FIFO_MASK_ ; + misc_ctl |=FIELD_PREP (MISC_CTL_0_RFE_READ_FIFO_MASK_ , +RFE_RD_FIFO_TH_3_DWORDS ); +lan743x_csr_write (adapter,MISC_CTL_0 , misc_ctl); + } +} +static int lan743x_hardware_init (struct lan743x_adapter *adapter,struct pci_dev *pdev) {
@@ -3287,6 +3304,7 @@ static int lan743x_hardware_init(struct lan743x_adapter *adapter,pci11x1x_strap_get_status (adapter);spin_lock_init (&adapter->eth_syslock_spinlock);mutex_init (&adapter->sgmii_rw_lock); +pci11x1x_set_rfe_rd_fifo_threshold (adapter); }else { adapter->max_tx_channels =LAN743X_MAX_TX_CHANNELS ; adapter->used_tx_channels =LAN743X_USED_TX_CHANNELS ;
drivers/net/ethernet/microchip/lan743x_main.h +4 -0
@@ -26,6 +26,7 @@#define ID_REV_CHIP_REV_MASK_ (0x0000FFFF)#define ID_REV_CHIP_REV_A0_ (0x00000000)#define ID_REV_CHIP_REV_B0_ (0x00000010) +#define ID_REV_CHIP_REV_PCI11X1X_B0_ (0x000000B0)#define FPGA_REV (0x04)#define FPGA_REV_GET_MINOR_ (fpga_rev) (((fpga_rev) >> 8) & 0x000000FF)
@@ -311,6 +312,9 @@#define SGMII_CTL_LINK_STATUS_SOURCE_ BIT(8)#define SGMII_CTL_SGMII_POWER_DN_ BIT(1) +#define MISC_CTL_0 (0x920) +#define MISC_CTL_0_RFE_READ_FIFO_MASK_ GENMASK(6, 4) +/* Vendor Specific SGMII MMD details */ #define SR_VSMMD_PCS_ID1 0x0004#define SR_VSMMD_PCS_ID2 0x0005
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/273 Octeontx2-af: fix pause frame configuration in GMP mode
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hariprasad Kelam <[email protected]>
[ Upstream commit 40d4b4807cadd83fb3f46cc8cd67a945b5b25461 ]
The Octeontx2 MAC block (CGX) has separate data paths (SMU and GMP) for different speeds, allowing for efficient data transfer.
The previous patch which added pause frame configuration has a bug due to which pause frame feature is not working in GMP mode.
This patch fixes the issue by configurating appropriate registers.
--- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/marvell/octeontx2/af/cgx.c +5 -0
@@ -808,6 +808,11 @@ static int cgx_lmac_enadis_pause_frm(void *cgxd, int lmac_id,if (!is_lmac_valid (cgx, lmac_id))return -ENODEV ; + cfg =cgx_read (cgx, lmac_id,CGXX_GMP_GMI_RXX_FRM_CTL ); + cfg &= ~CGX_GMP_GMI_RXX_FRM_CTL_CTL_BCK ; + cfg |= rx_pause ?CGX_GMP_GMI_RXX_FRM_CTL_CTL_BCK :0x0 ; +cgx_write (cgx, lmac_id,CGXX_GMP_GMI_RXX_FRM_CTL , cfg); + cfg =cgx_read (cgx, lmac_id,CGXX_SMUX_RX_FRM_CTL ); cfg &= ~CGX_SMUX_RX_FRM_CTL_CTL_BCK ; cfg |= rx_pause ?CGX_SMUX_RX_FRM_CTL_CTL_BCK :0x0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/273 inet: inet_defrag: prevent sk release while still in use
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 18685451fc4e546fc0e718580d32df3c0e5c8272 ]
ip_local_out() and other functions can pass skb->sk as function argument.
If the skb is a fragment and reassembly happens before such function call returns, the sk must not be released.
This affects skb fragments reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline.
Eric Dumazet made an initial analysis of this bug. Quoting Eric:
Calling ip_defrag() in output path is also implying skb_orphan(), which is buggy because output path relies on sk not disappearing.
A relevant old patch about the issue was :
8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()")
[..]
net/ipv4/ip_output.c depends on skb->sk being set, and probably to an inet socket, not an arbitrary one.
If we orphan the packet in ipvlan, then downstream things like FQ packet scheduler will not work properly.
We need to change ip_defrag() to only use skb_orphan() when really needed, ie whenever frag_list is going to be used.
Eric suggested to stash sk in fragment queue and made an initial patch. However there is a problem with this:
If skb is refragmented again right after, ip_do_fragment() will copy head->sk to the new fragments, and sets up destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem accouting to reflect the fully reassembled skb, else wmem will underflow.
This change moves the orphan down into the core, to last possible moment. As ip_defrag_offset is aliased with sk_buff->sk member, we must move the offset into the FRAG_CB, else skb->sk gets clobbered.
This allows to delay the orphaning long enough to learn if the skb has to be queued or if the skb is completing the reasm queue.
In the former case, things work as before, skb is orphaned. This is safe because skb gets queued/stolen and won't continue past reasm engine.
In the latter case, we will steal the skb->sk reference, reattach it to the head skb, and fix up wmem accouting when inet_frag inflates truesize.
--- include/linux/skbuff.h | 7 +-- net/ipv4/inet_fragment.c | 70 ++++++++++++++++++++----- net/ipv4/ip_fragment.c | 2 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- 4 files changed, 60 insertions(+), 21 deletions(-)
include/linux/skbuff.h +1 -6
@@ -748,8 +748,6 @@ typedef unsigned char *sk_buff_data_t;* @list: queue head * @ll_node: anchor in an llist (eg socket defer_list) * @sk: Socket we are owned by -* @ip_defrag_offset: (aka @sk) alternate use of @sk, used in -* fragmentation management * @dev: Device we arrived on/are leaving by * @dev_scratch: (aka @dev) alternate use of @dev when @dev would be %NULL * @cb: Control buffer. Free for use by every layer. Put private vars here
@@ -870,10 +868,7 @@ struct sk_buff {struct llist_node ll_node; }; -union { -struct sock *sk; -int ip_defrag_offset; - }; +struct sock *sk;union {ktime_t tstamp;
net/ipv4/inet_fragment.c +57 -13
158 lines not on this page · raw message
net/ipv4/ip_fragment.c +1 -1
@@ -384,6 +384,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) }skb_dst_drop (skb); +skb_orphan (skb);return -EINPROGRESS ; insert_error:
@@ -487,7 +488,6 @@ int ip_defrag(struct net *net, struct sk_buff *skb, u32 user)struct ipq *qp;__IP_INC_STATS (net,IPSTATS_MIB_REASMREQDS ); -skb_orphan (skb);/* Lookup (or create) queue header */ qp =ip_find (net,ip_hdr (skb), user, vif);
net/ipv6/netfilter/nf_conntrack_reasm.c +1 -1
@@ -294,6 +294,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, }skb_dst_drop (skb); +skb_orphan (skb);return -EINPROGRESS ; insert_error:
@@ -469,7 +470,6 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) hdr =ipv6_hdr (skb); fhdr = (struct frag_hdr *)skb_transport_header (skb); -skb_orphan (skb); fq =fq_find (net, fhdr->identification, user, hdr, skb->dev ? skb->dev->ifindex :0 );if (fq ==NULL ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/273 drm/i915: Stop doing double audio enable/disable on SDVO and g4x+ DP
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
[ Upstream commit f378ab7870046704fb92e64d50a67dda2cae8420 ]
Looks like I misplaced a few hunks when I moved the audio enable/disable out from the encoder enable/disable hooks. So we are now doing a double audio enable/disable on SDVO and g4x+ DP. Probably harmless as doing it twice shouldn't really change anything, but let's do it just once, as intended.
--- drivers/gpu/drm/i915/display/g4x_dp.c | 2 -- drivers/gpu/drm/i915/display/intel_sdvo.c | 4 ---- 2 files changed, 6 deletions(-)
drivers/gpu/drm/i915/display/g4x_dp.c +0 -2
@@ -717,7 +717,6 @@ static void g4x_enable_dp(struct intel_atomic_state *state, {intel_enable_dp (state, encoder, pipe_config, conn_state);intel_edp_backlight_on (pipe_config, conn_state); - encoder->audio_enable (encoder, pipe_config, conn_state); } static void vlv_enable_dp(struct intel_atomic_state *state,
@@ -726,7 +725,6 @@ static void vlv_enable_dp(struct intel_atomic_state *state, const struct drm_connector_state *conn_state) {intel_edp_backlight_on (pipe_config, conn_state); - encoder->audio_enable (encoder, pipe_config, conn_state); } static void g4x_pre_enable_dp(struct intel_atomic_state *state,
drivers/gpu/drm/i915/display/intel_sdvo.c +0 -4
@@ -1830,8 +1830,6 @@ static void intel_disable_sdvo(struct intel_atomic_state *state,struct intel_crtc *crtc =to_intel_crtc (old_crtc_state->uapi.crtc);u32 temp; - encoder->audio_disable (encoder, old_crtc_state, conn_state); -intel_sdvo_set_active_outputs (intel_sdvo,0 );if (0 ) intel_sdvo_set_encoder_power_state(intel_sdvo,
@@ -1923,8 +1921,6 @@ static void intel_enable_sdvo(struct intel_atomic_state *state,intel_sdvo_set_encoder_power_state (intel_sdvo,DRM_MODE_DPMS_ON );intel_sdvo_set_active_outputs (intel_sdvo, intel_sdvo_connector->output_flag); - - encoder->audio_enable (encoder, pipe_config, conn_state); } static enum drm_mode_status
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/273 drm/i915/display: Disable AuxCCS framebuffers if built for Xe
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juha-Pekka Heikkila <[email protected]>
[ Upstream commit cf48bddd31deefb9ab07de9a4d0150da6610198a ]
AuxCCS framebuffers don't work on Xe driver hence disable them from plane capabilities until they are fixed. FlatCCS framebuffers work and they are left enabled. CCS is left untouched for i915 driver.
--- drivers/gpu/drm/i915/display/skl_universal_plane.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/i915/display/skl_universal_plane.c +3 -0
@@ -2290,6 +2290,9 @@ static u8 skl_get_plane_caps(struct drm_i915_private *i915,if (HAS_4TILE (i915)) caps |=INTEL_PLANE_CAP_TILING_4 ; +if (!IS_ENABLED (I915 ) && !HAS_FLAT_CCS (i915)) +return caps; +if (skl_plane_has_rc_ccs (i915, pipe, plane_id)) { caps |=INTEL_PLANE_CAP_CCS_RC ;if (DISPLAY_VER (i915) >=12 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/273 drm/i915/xelpg: Extend some workarounds/tuning to gfx version 12.74
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Roper <[email protected]>
[ Upstream commit c44d4ef47fdad0a33966de89f9064e19736bb52f ]
Some of our existing Xe_LPG workarounds and tuning are also applicable to the version 12.74 variant. Extend the condition bounds accordingly. Also fix the comment on Wa_14018575942 while we're at it.
v2: Extend some more workarounds (Harish)
Stable-dep-of: 186bce682772 ("drm/i915/mtl: Update workaround 14018575942")
--- drivers/gpu/drm/i915/gt/gen8_engine_cs.c | 4 ++-- drivers/gpu/drm/i915/gt/intel_workarounds.c | 24 +++++++++++++-------- drivers/gpu/drm/i915/i915_perf.c | 2 +- 3 files changed, 18 insertions(+), 12 deletions(-)
drivers/gpu/drm/i915/gt/gen8_engine_cs.c +2 -2
@@ -226,7 +226,7 @@ u32 *gen12_emit_aux_table_inv(struct intel_engine_cs *engine, u32 *cs)static int mtl_dummy_pipe_control (struct i915_request *rq) {/* Wa_14016712196 */ -if (IS_GFX_GT_IP_RANGE (rq->engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,71 )) || +if (IS_GFX_GT_IP_RANGE (rq->engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,74 )) ||IS_DG2 (rq->i915)) {u32 *cs;
@@ -822,7 +822,7 @@ u32 *gen12_emit_fini_breadcrumb_rcs(struct i915_request *rq, u32 *cs) flags |=PIPE_CONTROL_FLUSH_L3 ;/* Wa_14016712196 */ -if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 )) ||IS_DG2 (i915)) +if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,74 )) ||IS_DG2 (i915))/* dummy PIPE_CONTROL + depth flush */ cs =gen12_emit_pipe_control (cs,0 ,PIPE_CONTROL_DEPTH_CACHE_FLUSH ,0 );
drivers/gpu/drm/i915/gt/intel_workarounds.c +15 -9
@@ -789,8 +789,13 @@ static void xelpg_ctx_gt_tuning_init(struct intel_engine_cs *engine,dg2_ctx_gt_tuning_init (engine, wal); -if (IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,70 ),STEP_B0 ,STEP_FOREVER ) || -IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,71 ),STEP_B0 ,STEP_FOREVER )) +/* +* Due to Wa_16014892111, the DRAW_WATERMARK tuning must be done in +* gen12_emit_indirect_ctx_rcs() rather than here on some early +* steppings. +*/ +if (!(IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,70 ),STEP_A0 ,STEP_B0 ) || +IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,71 ),STEP_A0 ,STEP_B0 )))wa_add (wal,DRAW_WATERMARK ,VERT_WM_VAL ,0x3FF ,0 , false); }
@@ -908,7 +913,7 @@ __intel_engine_init_ctx_wa(struct intel_engine_cs *engine,if (engine->class !=RENDER_CLASS ) goto done; -if (IS_GFX_GT_IP_RANGE (engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) +if (IS_GFX_GT_IP_RANGE (engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,74 )))xelpg_ctx_workarounds_init (engine, wal);else if (IS_PONTEVECCHIO (i915)) ;/* noop; none at this time */
@@ -1643,7 +1648,7 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)static void xelpg_gt_workarounds_init (struct intel_gt *gt,struct i915_wa_list *wal) { -/* Wa_14018778641 / Wa_18018781329 */ +/* Wa_14018575942 / Wa_18018781329 */ wa_mcr_write_or (wal,COMP_MOD_CTRL ,FORCE_MISS_FTLB );/* Wa_22016670082 */
@@ -1710,7 +1715,7 @@ xelpmp_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)*/ static void gt_tuning_settings (struct intel_gt *gt,struct i915_wa_list *wal) { -if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) { +if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,74 ))) {wa_mcr_write_or (wal,XEHP_L3SCQREG7 ,BLEND_FILL_CACHING_OPT_DIS );wa_mcr_write_or (wal,XEHP_SQCM ,EN_32B_ACCESS ); }
@@ -1743,7 +1748,7 @@ gt_init_workarounds(struct intel_gt *gt, struct i915_wa_list *wal)return ; } -if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) +if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,74 )))xelpg_gt_workarounds_init (gt, wal);else if (IS_PONTEVECCHIO (i915))pvc_gt_workarounds_init (gt, wal);
@@ -2216,7 +2221,7 @@ void intel_engine_init_whitelist(struct intel_engine_cs *engine)if (engine->gt->type ==GT_MEDIA ) ;/* none yet */ -else if (IS_GFX_GT_IP_RANGE (engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) +else if (IS_GFX_GT_IP_RANGE (engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,74 )))xelpg_whitelist_build (engine);else if (IS_PONTEVECCHIO (i915))pvc_whitelist_build (engine);
@@ -2828,7 +2833,7 @@ add_render_compute_tuning_settings(struct intel_gt *gt, {struct drm_i915_private *i915 = gt->i915; -if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 )) ||IS_DG2 (i915)) +if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,74 )) ||IS_DG2 (i915))wa_mcr_write_clr_set (wal,RT_CTRL ,STACKID_CTRL ,STACKID_CTRL_512 );/*
@@ -2881,7 +2886,8 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li }if (IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,70 ),STEP_B0 ,STEP_FOREVER ) || -IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,71 ),STEP_B0 ,STEP_FOREVER )) +IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,71 ),STEP_B0 ,STEP_FOREVER ) || +IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,74 ),IP_VER (12 ,74 )))/* Wa_14017856879 */ wa_mcr_masked_en (wal,GEN9_ROW_CHICKEN3 ,MTL_DISABLE_FIX_FOR_EOT_FLUSH );
drivers/gpu/drm/i915/i915_perf.c +1 -1
@@ -3225,7 +3225,7 @@ u32 i915_perf_oa_timestamp_frequency(struct drm_i915_private *i915)struct intel_gt *gt =to_gt (i915);/* Wa_18013179988 */ -if (IS_DG2 (i915) ||IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) { +if (IS_DG2 (i915) ||IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,74 ))) {intel_wakeref_t wakeref;u32 reg, shift;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/273 drm/i915/mtl: Update workaround 14018575942
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejas Upadhyay <[email protected]>
[ Upstream commit 186bce682772e7346bf7ced5325b5f4ff050ccfb ]
Applying WA 14018575942 only on Compute engine has impact on some apps like chrome. Updating this WA to apply on Render engine as well as it is helping with performance on Chrome.
Note: There is no concern from media team thus not applying WA on media engines. We will revisit if any issues reported from media team.
V2(Matt):
- Use correct WA number
--- drivers/gpu/drm/i915/gt/intel_workarounds.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/i915/gt/intel_workarounds.c +1 -0
@@ -1649,6 +1649,7 @@ static void xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) {/* Wa_14018575942 / Wa_18018781329 */ +wa_mcr_write_or (wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);wa_mcr_write_or (wal,COMP_MOD_CTRL ,FORCE_MISS_FTLB );/* Wa_22016670082 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/273 drm/i915: Do not print pxp init failed with 0 when it succeed
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Roberto de Souza <[email protected]>
[ Upstream commit d392e1b9c2e8c60550a2a467732107f0f98b8e97 ]
It is misleading, if the intention was to also print something in case it succeed it should have a different string.
--- drivers/gpu/drm/i915/i915_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/i915_driver.c +1 -1
@@ -799,7 +799,7 @@ int i915_driver_probe(struct pci_dev *pdev, const struct pci_device_id *ent) goto out_cleanup_modeset2; ret =intel_pxp_init (i915); -if (ret != -ENODEV ) +if (ret && ret != -ENODEV )drm_dbg (&i915->drm,"pxp init failed with %d\n" , ret); ret =intel_display_driver_probe (i915);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/273 dm integrity: fix out-of-range warning
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 8e91c2342351e0f5ef6c0a704384a7f6fc70c3b2 ]
Depending on the value of CONFIG_HZ, clang complains about a pointless comparison:
drivers/md/dm-integrity.c:4085:12: error: result of comparison of
constant 42949672950 with expression of type 'unsigned int' is always false [-Werror,-Wtautological-constant-out-of-range-compare] if (val >= (uint64_t)UINT_MAX * 1000 / HZ) {
As the check remains useful for other configurations, shut up the warning by adding a second type cast to uint64_t.
--- drivers/md/dm-integrity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-integrity.c +1 -1
@@ -4221,7 +4221,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv }else if (sscanf (opt_string,"sectors_per_bit:%llu%c" , &llval, &dummy) ==1 ) { log2_sectors_per_bitmap_bit = !llval ?0 :__ilog2_u64 (llval); }else if (sscanf (opt_string,"bitmap_flush_interval:%u%c" , &val, &dummy) ==1 ) { -if (val >= (uint64_t )UINT_MAX *1000 /HZ ) { +if ((uint64_t )val >= (uint64_t )UINT_MAX *1000 /HZ ) { r = -EINVAL ; ti->error ="Invalid bitmap_flush_interval argument" ; goto bad;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/273 modpost: do not make find_tosym() return NULL
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 1102f9f85bf66b1a7bd6a40afb40efbbe05dfc05 ]
As mentioned in commit 397586506c3d ("modpost: Add '.ltext' and '.ltext.*' to TEXT_SECTIONS"), modpost can result in a segmentation fault due to a NULL pointer dereference in default_mismatch_handler().
find_tosym() can return the original symbol pointer instead of NULL if a better one is not found.
This fixes the reported segmentation fault.
--- scripts/mod/modpost.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
scripts/mod/modpost.c +5 -2
@@ -1007,6 +1007,8 @@ static Elf_Sym *find_fromsym(struct elf_info *elf, Elf_Addr addr,static Elf_Sym *find_tosym (struct elf_info *elf,Elf_Addr addr,Elf_Sym *sym) { +Elf_Sym *new_sym; +/* If the supplied symbol has a valid name, return it */ if (is_valid_name (elf, sym))return sym;
@@ -1015,8 +1017,9 @@ static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym)* Strive to find a better symbol name, but the resulting name may not * match the symbol referenced in the original code. */ -return symsearch_find_nearest (elf, addr,get_secindex (elf, sym), - true,20 ); + new_sym =symsearch_find_nearest (elf, addr,get_secindex (elf, sym), + true,20 ); +return new_sym ? new_sym : sym; }static bool is_executable_section (struct elf_info *elf,unsigned int secndx)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/273 kbuild: make -Woverride-init warnings more consistent
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit c40845e3195d074b34f8f8e400e28c9403a06588 ]
The -Woverride-init warn about code that may be intentional or not, but the inintentional ones tend to be real bugs, so there is a bit of disagreement on whether this warning option should be enabled by default and we have multiple settings in scripts/Makefile.extrawarn as well as individual subsystems.
Older versions of clang only supported -Wno-initializer-overrides with the same meaning as gcc's -Woverride-init, though all supported versions now work with both. Because of this difference, an earlier cleanup of mine accidentally turned the clang warning off for W=1 builds and only left it on for W=2, while it's still enabled for gcc with W=1.
There is also one driver that only turns the warning off for newer versions of gcc but not other compilers, and some but not all the Makefiles still use a cc-disable-warning conditional that is no longer needed with supported compilers here.
Address all of the above by removing the special cases for clang and always turning the warning off unconditionally where it got in the way, using the syntax that is supported by both compilers.
--- drivers/gpu/drm/amd/display/dc/dce110/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dce112/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dce120/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dce60/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dce80/Makefile | 2 +- drivers/gpu/drm/i915/Makefile | 6 +++--- drivers/gpu/drm/xe/Makefile | 4 ++-- drivers/net/ethernet/renesas/sh_eth.c | 2 +- drivers/pinctrl/aspeed/Makefile | 2 +- fs/proc/Makefile | 2 +- kernel/bpf/Makefile | 2 +- mm/Makefile | 3 +-- scripts/Makefile.extrawarn | 10 +++------- 13 files changed, 18 insertions(+), 23 deletions(-)
drivers/gpu/drm/amd/display/dc/dce110/Makefile +1 -1
@@ -23,7 +23,7 @@ # Makefile for the 'controller' sub-component of DAL. # It provides the control and status of HW CRTC block. -CFLAGS_$(AMDDALPATH)/dc/dce110/dce110_resource.o = $(call cc-disable-warning, override-init) +CFLAGS_$(AMDDALPATH)/dc/dce110/dce110_resource.o = -Wno-override-init DCE110 = dce110_timing_generator.o \ dce110_compressor.o dce110_opp_regamma_v.o \
drivers/gpu/drm/amd/display/dc/dce112/Makefile +1 -1
@@ -23,7 +23,7 @@ # Makefile for the 'controller' sub-component of DAL. # It provides the control and status of HW CRTC block. -CFLAGS_$(AMDDALPATH)/dc/dce112/dce112_resource.o = $(call cc-disable-warning, override-init) +CFLAGS_$(AMDDALPATH)/dc/dce112/dce112_resource.o = -Wno-override-init DCE112 = dce112_compressor.o
drivers/gpu/drm/amd/display/dc/dce120/Makefile +1 -1
@@ -24,7 +24,7 @@ # It provides the control and status of HW CRTC block. -CFLAGS_$(AMDDALPATH)/dc/dce120/dce120_resource.o = $(call cc-disable-warning, override-init) +CFLAGS_$(AMDDALPATH)/dc/dce120/dce120_resource.o = -Wno-override-init DCE120 = dce120_timing_generator.o
drivers/gpu/drm/amd/display/dc/dce60/Makefile +1 -1
@@ -23,7 +23,7 @@ # Makefile for the 'controller' sub-component of DAL. # It provides the control and status of HW CRTC block. -CFLAGS_$(AMDDALPATH)/dc/dce60/dce60_resource.o = $(call cc-disable-warning, override-init) +CFLAGS_$(AMDDALPATH)/dc/dce60/dce60_resource.o = -Wno-override-init DCE60 = dce60_timing_generator.o dce60_hw_sequencer.o \ dce60_resource.o
drivers/gpu/drm/amd/display/dc/dce80/Makefile +1 -1
@@ -23,7 +23,7 @@ # Makefile for the 'controller' sub-component of DAL. # It provides the control and status of HW CRTC block. -CFLAGS_$(AMDDALPATH)/dc/dce80/dce80_resource.o = $(call cc-disable-warning, override-init) +CFLAGS_$(AMDDALPATH)/dc/dce80/dce80_resource.o = -Wno-override-init DCE80 = dce80_timing_generator.o
drivers/gpu/drm/i915/Makefile +3 -3
@@ -33,9 +33,9 @@ endif subdir-ccflags-$(CONFIG_DRM_I915_WERROR) += -Werror # Fine grained warnings disable -CFLAGS_i915_pci.o = $(call cc-disable-warning, override-init) -CFLAGS_display/intel_display_device.o = $(call cc-disable-warning, override-init) -CFLAGS_display/intel_fbdev.o = $(call cc-disable-warning, override-init) +CFLAGS_i915_pci.o = -Wno-override-init +CFLAGS_display/intel_display_device.o = -Wno-override-init +CFLAGS_display/intel_fbdev.o = -Wno-override-init # Support compiling the display code separately for both i915 and xe # drivers. Define I915 when building i915.
drivers/gpu/drm/xe/Makefile +2 -2
@@ -162,8 +162,8 @@ subdir-ccflags-$(CONFIG_DRM_XE_DISPLAY) += \ -Ddrm_i915_gem_object=xe_bo \ -Ddrm_i915_private=xe_device -CFLAGS_i915-display/intel_fbdev.o = $(call cc-disable-warning, override-init) -CFLAGS_i915-display/intel_display_device.o = $(call cc-disable-warning, override-init) +CFLAGS_i915-display/intel_fbdev.o = -Wno-override-init +CFLAGS_i915-display/intel_display_device.o = -Wno-override-init # Rule to build SOC code shared with i915 $(obj)/i915-soc/%.o: $(srctree)/drivers/gpu/drm/i915/soc/%.c FORCE
drivers/net/ethernet/renesas/sh_eth.c +1 -1
@@ -50,7 +50,7 @@* the macros available to do this only define GCC 8. */ __diag_push (); -__diag_ignore (GCC ,8 ,"-Woverride-init" , +__diag_ignore_all ("-Woverride-init" ,"logic to initialize all and then override some is OK" );static const u16 sh_eth_offset_gigabit[SH_ETH_MAX_REGISTER_OFFSET ] = {SH_ETH_OFFSET_DEFAULTS ,
drivers/pinctrl/aspeed/Makefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0-only # Aspeed pinctrl support -ccflags-y += $(call cc-option,-Woverride-init) +ccflags-y += -Woverride-init obj-$(CONFIG_PINCTRL_ASPEED) += pinctrl-aspeed.o pinmux-aspeed.o obj-$(CONFIG_PINCTRL_ASPEED_G4) += pinctrl-aspeed-g4.o obj-$(CONFIG_PINCTRL_ASPEED_G5) += pinctrl-aspeed-g5.o
fs/proc/Makefile +1 -1
@@ -5,7 +5,7 @@ obj-y += proc.o -CFLAGS_task_mmu.o += $(call cc-option,-Wno-override-init,) +CFLAGS_task_mmu.o += -Wno-override-init proc-y := nommu.o task_nommu.o proc-$(CONFIG_MMU) := task_mmu.o
kernel/bpf/Makefile +1 -1
@@ -4,7 +4,7 @@ ifneq ($(CONFIG_BPF_JIT_ALWAYS_ON),y) # ___bpf_prog_run() needs GCSE disabled on x86; see 3193c0836f203 for details cflags-nogcse-$(CONFIG_X86)$(CONFIG_CC_IS_GCC) := -fno-gcse endif -CFLAGS_core.o += $(call cc-disable-warning, override-init) $(cflags-nogcse-yy) +CFLAGS_core.o += -Wno-override-init $(cflags-nogcse-yy) obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o log.o obj-$(CONFIG_BPF_SYSCALL) += bpf_iter.o map_iter.o task_iter.o prog_iter.o link_iter.o
mm/Makefile +1 -2
@@ -29,8 +29,7 @@ KCOV_INSTRUMENT_mmzone.o := n KCOV_INSTRUMENT_vmstat.o := n KCOV_INSTRUMENT_failslab.o := n -CFLAGS_init-mm.o += $(call cc-disable-warning, override-init) -CFLAGS_init-mm.o += $(call cc-disable-warning, initializer-overrides) +CFLAGS_init-mm.o += -Wno-override-init mmu-y := nommu.o mmu-$(CONFIG_MMU) := highmem.o memory.o mincore.o \
scripts/Makefile.extrawarn +3 -7
@@ -114,6 +114,8 @@ KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow) KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation) KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation) +KBUILD_CFLAGS += -Wno-override-init # alias for -Wno-initializer-overrides in clang + ifdef CONFIG_CC_IS_CLANG # Clang before clang-16 would warn on default argument promotions. ifneq ($(call clang-min-version, 160000),y)
@@ -151,10 +153,6 @@ KBUILD_CFLAGS += -Wtype-limits KBUILD_CFLAGS += $(call cc-option, -Wmaybe-uninitialized) KBUILD_CFLAGS += $(call cc-option, -Wunused-macros) -ifdef CONFIG_CC_IS_CLANG -KBUILD_CFLAGS += -Winitializer-overrides -endif - KBUILD_CPPFLAGS += -DKBUILD_EXTRA_WARN2 else
@@ -164,9 +162,7 @@ KBUILD_CFLAGS += -Wno-missing-field-initializers KBUILD_CFLAGS += -Wno-type-limits KBUILD_CFLAGS += -Wno-shift-negative-value -ifdef CONFIG_CC_IS_CLANG -KBUILD_CFLAGS += -Wno-initializer-overrides -else +ifdef CONFIG_CC_IS_GCC KBUILD_CFLAGS += -Wno-maybe-uninitialized endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/273 mm/treewide: replace pud_large() with pud_leaf()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Xu <[email protected]>
[ Upstream commit 0a845e0f6348ccfa2dcc8c450ffd1c9ffe8c4add ]
pud_large() is always defined as pud_leaf(). Merge their usages. Chose pud_leaf() because pud_leaf() is a global API, while pud_large() is not.
Stable-dep-of: c567f2948f57 ("Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."")
--- arch/powerpc/mm/book3s64/pgtable.c | 2 +- arch/s390/boot/vmem.c | 2 +- arch/s390/include/asm/pgtable.h | 4 ++-- arch/s390/mm/gmap.c | 2 +- arch/s390/mm/hugetlbpage.c | 4 ++-- arch/s390/mm/pageattr.c | 2 +- arch/s390/mm/pgtable.c | 2 +- arch/s390/mm/vmem.c | 6 +++--- arch/sparc/mm/init_64.c | 2 +- arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/mm/fault.c | 4 ++-- arch/x86/mm/ident_map.c | 2 +- arch/x86/mm/init_64.c | 4 ++-- arch/x86/mm/kasan_init_64.c | 2 +- arch/x86/mm/mem_encrypt_identity.c | 2 +- arch/x86/mm/pat/set_memory.c | 6 +++--- arch/x86/mm/pgtable.c | 2 +- arch/x86/mm/pti.c | 2 +- arch/x86/power/hibernate.c | 2 +- arch/x86/xen/mmu_pv.c | 4 ++-- 20 files changed, 29 insertions(+), 29 deletions(-)
arch/powerpc/mm/book3s64/pgtable.c +1 -1
@@ -130,7 +130,7 @@ void set_pud_at(struct mm_struct *mm, unsigned long addr,WARN_ON (pte_hw_valid (pud_pte (*pudp)));assert_spin_locked (pud_lockptr (mm, pudp)); -WARN_ON (!(pud_large (pud))); +WARN_ON (!(pud_leaf (pud)));#endif trace_hugepage_set_pud (addr,pud_val (pud));return set_pte_at (mm, addr,pudp_ptep (pudp),pud_pte (pud));
arch/s390/boot/vmem.c +1 -1
@@ -366,7 +366,7 @@ static void pgtable_pud_populate(p4d_t *p4d, unsigned long addr, unsigned long e } pmd =boot_crst_alloc (_SEGMENT_ENTRY_EMPTY);pud_populate (&init_mm, pud, pmd); - }else if (pud_large (*pud)) { + }else if (pud_leaf (*pud)) {continue ; }pgtable_pmd_populate (pud, addr, next, mode);
arch/s390/include/asm/pgtable.h +2 -2
@@ -730,7 +730,7 @@ static inline int pud_bad(pud_t pud) {unsigned long type =pud_val (pud) & _REGION_ENTRY_TYPE_MASK; -if (type > _REGION_ENTRY_TYPE_R3 ||pud_large (pud)) +if (type > _REGION_ENTRY_TYPE_R3 ||pud_leaf (pud))return 1 ;if (type < _REGION_ENTRY_TYPE_R3)return 0 ;
@@ -1398,7 +1398,7 @@ static inline unsigned long pud_deref(pud_t pud)unsigned long origin_mask; origin_mask = _REGION_ENTRY_ORIGIN; -if (pud_large (pud)) +if (pud_leaf (pud)) origin_mask = _REGION3_ENTRY_ORIGIN_LARGE;return (unsigned long )__va (pud_val (pud) & origin_mask); }
arch/s390/mm/gmap.c +1 -1
@@ -596,7 +596,7 @@ int __gmap_link(struct gmap *gmap, unsigned long gaddr, unsigned long vmaddr) pud =pud_offset (p4d, vmaddr);VM_BUG_ON (pud_none (*pud));/* large puds cannot yet be handled */ -if (pud_large (*pud)) +if (pud_leaf (*pud))return -EFAULT ; pmd =pmd_offset (pud, vmaddr);VM_BUG_ON (pmd_none (*pmd));
arch/s390/mm/hugetlbpage.c +2 -2
@@ -224,7 +224,7 @@ pte_t *huge_pte_offset(struct mm_struct *mm,if (p4d_present (*p4dp)) { pudp =pud_offset (p4dp, addr);if (pud_present (*pudp)) { -if (pud_large (*pudp)) +if (pud_leaf (*pudp))return (pte_t *) pudp; pmdp =pmd_offset (pudp, addr); }
@@ -240,7 +240,7 @@ int pmd_huge(pmd_t pmd)int pud_huge (pud_t pud) { -return pud_large (pud); +return pud_leaf (pud); }bool __init arch_hugetlb_valid_size (unsigned long size)
arch/s390/mm/pageattr.c +1 -1
@@ -274,7 +274,7 @@ static int walk_pud_level(p4d_t *p4d, unsigned long addr, unsigned long end,if (pud_none (*pudp))return -EINVAL ; next =pud_addr_end (addr, end); -if (pud_large (*pudp)) { +if (pud_leaf (*pudp)) { need_split = !!(flags &SET_MEMORY_4K ); need_split |= !!(addr & ~PUD_MASK ); need_split |= !!(addr +PUD_SIZE > next);
arch/s390/mm/pgtable.c +1 -1
@@ -470,7 +470,7 @@ static int pmd_lookup(struct mm_struct *mm, unsigned long addr, pmd_t **pmdp)return -ENOENT ;/* Large PUDs are not supported yet. */ -if (pud_large (*pud)) +if (pud_leaf (*pud))return -EFAULT ; *pmdp =pmd_offset (pud, addr);
arch/s390/mm/vmem.c +3 -3
@@ -323,7 +323,7 @@ static int modify_pud_table(p4d_t *p4d, unsigned long addr, unsigned long end,if (!add) {if (pud_none (*pud))continue ; -if (pud_large (*pud)) { +if (pud_leaf (*pud)) {if (IS_ALIGNED (addr,PUD_SIZE ) &&IS_ALIGNED (next,PUD_SIZE )) {pud_clear (pud);
@@ -344,7 +344,7 @@ static int modify_pud_table(p4d_t *p4d, unsigned long addr, unsigned long end,if (!pmd) goto out;pud_populate (&init_mm, pud, pmd); - }else if (pud_large (*pud)) { + }else if (pud_leaf (*pud)) {continue ; } ret =modify_pmd_table (pud, addr, next, add, direct);
@@ -591,7 +591,7 @@ pte_t *vmem_get_alloc_pte(unsigned long addr, bool alloc)if (!pmd) goto out;pud_populate (&init_mm, pud, pmd); - }else if (WARN_ON_ONCE (pud_large (*pud))) { + }else if (WARN_ON_ONCE (pud_leaf (*pud))) { goto out; } pmd =pmd_offset (pud, addr);
arch/sparc/mm/init_64.c +1 -1
@@ -1665,7 +1665,7 @@ bool kern_addr_valid(unsigned long addr)if (pud_none (*pud))return false; -if (pud_large (*pud)) +if (pud_leaf (*pud))return pfn_valid (pud_pfn (*pud)); pmd =pmd_offset (pud, addr);
arch/x86/kvm/mmu/mmu.c +1 -1
@@ -3126,7 +3126,7 @@ static int host_pfn_mapping_level(struct kvm *kvm, gfn_t gfn,if (pud_none (pud) || !pud_present (pud)) goto out; -if (pud_large (pud)) { +if (pud_leaf (pud)) { level =PG_LEVEL_1G ; goto out; }
arch/x86/mm/fault.c +2 -2
@@ -376,7 +376,7 @@ static void dump_pagetable(unsigned long address) goto bad;pr_cont ("PUD %lx " ,pud_val (*pud)); -if (!pud_present (*pud) ||pud_large (*pud)) +if (!pud_present (*pud) ||pud_leaf (*pud)) goto out; pmd =pmd_offset (pud, address);
@@ -1037,7 +1037,7 @@ spurious_kernel_fault(unsigned long error_code, unsigned long address)if (!pud_present (*pud))return 0 ; -if (pud_large (*pud)) +if (pud_leaf (*pud))return spurious_kernel_fault_check (error_code, (pte_t *) pud); pmd =pmd_offset (pud, address);
arch/x86/mm/ident_map.c +1 -1
@@ -33,7 +33,7 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page, next = end;/* if this is already a gbpage, this portion is already mapped */ -if (pud_large (*pud)) +if (pud_leaf (*pud))continue ;/* Is using a gbpage allowed? */
arch/x86/mm/init_64.c +2 -2
@@ -617,7 +617,7 @@ phys_pud_init(pud_t *pud_page, unsigned long paddr, unsigned long paddr_end, }if (!pud_none (*pud)) { -if (!pud_large (*pud)) { +if (!pud_leaf (*pud)) { pmd =pmd_offset (pud,0 ); paddr_last = phys_pmd_init(pmd, paddr, paddr_end,
@@ -1163,7 +1163,7 @@ remove_pud_table(pud_t *pud_start, unsigned long addr, unsigned long end,if (!pud_present (*pud))continue ; -if (pud_large (*pud) && +if (pud_leaf (*pud) &&IS_ALIGNED (addr,PUD_SIZE ) &&IS_ALIGNED (next,PUD_SIZE )) {spin_lock (&init_mm.page_table_lock);
arch/x86/mm/kasan_init_64.c +1 -1
@@ -115,7 +115,7 @@ static void __init kasan_populate_p4d(p4d_t *p4d, unsigned long addr, pud =pud_offset (p4d, addr);do { next =pud_addr_end (addr, end); -if (!pud_large (*pud)) +if (!pud_leaf (*pud))kasan_populate_pud (pud, addr, next, nid); }while (pud++, addr = next, addr != end); }
arch/x86/mm/mem_encrypt_identity.c +1 -1
@@ -144,7 +144,7 @@ static pud_t __init *sme_prepare_pgd(struct sme_populate_pgd_data *ppd)set_pud (pud,__pud (PUD_FLAGS |__pa (pmd))); } -if (pud_large (*pud)) +if (pud_leaf (*pud))return NULL ;return pud;
arch/x86/mm/pat/set_memory.c +3 -3
@@ -684,7 +684,7 @@ pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,return NULL ; *level =PG_LEVEL_1G ; -if (pud_large (*pud) || !pud_present (*pud)) +if (pud_leaf (*pud) || !pud_present (*pud))return (pte_t *)pud; pmd =pmd_offset (pud, address);
@@ -743,7 +743,7 @@ pmd_t *lookup_pmd_address(unsigned long address)return NULL ; pud =pud_offset (p4d, address); -if (pud_none (*pud) ||pud_large (*pud) || !pud_present (*pud)) +if (pud_none (*pud) ||pud_leaf (*pud) || !pud_present (*pud))return NULL ;return pmd_offset (pud, address);
@@ -1278,7 +1278,7 @@ static void unmap_pud_range(p4d_t *p4d, unsigned long start, unsigned long end)*/ while (end - start >=PUD_SIZE ) { -if (pud_large (*pud)) +if (pud_leaf (*pud))pud_clear (pud);else unmap_pmd_range (pud, start, start +PUD_SIZE );
arch/x86/mm/pgtable.c +1 -1
@@ -777,7 +777,7 @@ int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot)*/ int pud_clear_huge (pud_t *pud) { -if (pud_large (*pud)) { +if (pud_leaf (*pud)) {pud_clear (pud);return 1 ; }
arch/x86/mm/pti.c +1 -1
@@ -217,7 +217,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address) pud =pud_offset (p4d, address);/* The user page tables do not use large mappings: */ -if (pud_large (*pud)) { +if (pud_leaf (*pud)) {WARN_ON (1 );return NULL ; }
arch/x86/power/hibernate.c +1 -1
@@ -170,7 +170,7 @@ int relocate_restore_code(void) goto out; } pud =pud_offset (p4d, relocated_restore_code); -if (pud_large (*pud)) { +if (pud_leaf (*pud)) {set_pud (pud,__pud (pud_val (*pud) & ~_PAGE_NX)); goto out; }
arch/x86/xen/mmu_pv.c +2 -2
@@ -1082,7 +1082,7 @@ static void __init xen_cleanmfnmap_pud(pud_t *pud, bool unpin)pmd_t *pmd_tbl;int i; -if (pud_large (*pud)) { +if (pud_leaf (*pud)) { pa =pud_val (*pud) &PHYSICAL_PAGE_MASK ;xen_free_ro_pages (pa,PUD_SIZE );return ;
@@ -1863,7 +1863,7 @@ static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr)if (!pud_present (pud))return 0 ; pa =pud_val (pud) &PTE_PFN_MASK ; -if (pud_large (pud)) +if (pud_leaf (pud))return pa + (vaddr & ~PUD_MASK ); pmd = native_make_pmd(xen_read_phys_ulong(pa + pmd_index(vaddr) *
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/273 Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ingo Molnar <[email protected]>
[ Upstream commit c567f2948f57bdc03ed03403ae0234085f376b7d ]
This reverts commit d794734c9bbfe22f86686dc2909c25f5ffe1a572.
While the original change tries to fix a bug, it also unintentionally broke existing systems, see the regressions reported at:
https://lore.kernel.org/all/[email protected]/
Since d794734c9bbf was also marked for -stable, let's back it out before causing more damage.
Note that due to another upstream change the revert was not 100% automatic:
0a845e0f6348 mm/treewide: replace pud_large() with pud_leaf()
--- arch/x86/mm/ident_map.c | 23 +++++------------------ 1 file changed, 5 insertions(+), 18 deletions(-)
arch/x86/mm/ident_map.c +5 -18
@@ -26,31 +26,18 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page,for (; addr < end; addr = next) {pud_t *pud = pud_page +pud_index (addr);pmd_t *pmd; -bool use_gbpage; next = (addr &PUD_MASK ) +PUD_SIZE ;if (next > end) next = end; -/* if this is already a gbpage, this portion is already mapped */ -if (pud_leaf (*pud)) -continue ; - -/* Is using a gbpage allowed? */ - use_gbpage = info->direct_gbpages; - -/* Don't use gbpage if it maps more than the requested region. */ -/* at the begining: */ - use_gbpage &= ((addr & ~PUD_MASK ) ==0 ); -/* ... or at the end: */ - use_gbpage &= ((next & ~PUD_MASK ) ==0 ); - -/* Never overwrite existing mappings */ - use_gbpage &= !pud_present (*pud); - -if (use_gbpage) { +if (info->direct_gbpages) {pud_t pudval; +if (pud_present (*pud)) +continue ; + + addr &=PUD_MASK ; pudval =__pud ((addr - info->offset) | info->page_flag);set_pud (pud, pudval);continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/273 gpio: cdev: sanitize the label before requesting the interrupt
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
commit b34490879baa847d16fc529c8ea6e6d34f004b38 upstream.
When an interrupt is requested, a procfs directory is created under "/proc/irq/<irqnum>/<label>" where <label> is the string passed to one of the request_irq() variants.
What follows is that the string must not contain the "/" character or the procfs mkdir operation will fail. We don't have such constraints for GPIO consumer labels which are used verbatim as interrupt labels for GPIO irqs. We must therefore sanitize the consumer string before requesting the interrupt.
Let's replace all "/" with ":".
--- drivers/gpio/gpiolib-cdev.c | 38 ++++++++++++++++++++++++++++++++------ 1 file changed, 32 insertions(+), 6 deletions(-)
drivers/gpio/gpiolib-cdev.c +32 -6
@@ -1089,10 +1089,20 @@ static u32 gpio_v2_line_config_debounce_return 0 ; } +static inline char *make_irq_label (const char *orig) +{ +return kstrdup_and_replace (orig,'/' ,':' ,GFP_KERNEL ); +} + +static inline void free_irq_label (const char *label) +{ +kfree (label); +} +static void edge_detector_stop (struct line *line) {if (line->irq) { -free_irq (line->irq, line); +free_irq_label (free_irq (line->irq, line)); line->irq =0 ; }
@@ -1116,6 +1126,7 @@ static int edge_detector_setup(struct liunsigned long irqflags =0 ;u64 eflags;int irq, ret; +char *label; eflags = edflags &GPIO_V2_LINE_EDGE_FLAGS ;if (eflags && !kfifo_initialized (&line->req->events)) {
@@ -1152,11 +1163,17 @@ static int edge_detector_setup(struct li IRQF_TRIGGER_RISING :IRQF_TRIGGER_FALLING ; irqflags |=IRQF_ONESHOT ; + label =make_irq_label (line->req->label); +if (!label) +return -ENOMEM ; +/* Request a thread to read the events */ ret =request_threaded_irq (irq, edge_irq_handler, edge_irq_thread, - irqflags, line->req->label, line); -if (ret) + irqflags, label, line); +if (ret) { +free_irq_label (label);return ret; + } line->irq = irq;return 0 ;
@@ -1979,7 +1996,7 @@ static void lineevent_free(struct lineevblocking_notifier_chain_unregister (&le->gdev->device_notifier, &le->device_unregistered_nb);if (le->irq) -free_irq (le->irq, le); +free_irq_label (free_irq (le->irq, le));if (le->desc)gpiod_free (le->desc);kfree (le->label);
@@ -2120,6 +2137,7 @@ static int lineevent_create(struct gpio_int fd;int ret;int irq, irqflags =0 ; +char *label;if (copy_from_user (&eventreq, ip,sizeof (eventreq)))return -EFAULT ;
@@ -2204,15 +2222,23 @@ static int lineevent_create(struct gpio_if (ret) goto out_free_le; + label =make_irq_label (le->label); +if (!label) { + ret = -ENOMEM ; + goto out_free_le; + } +/* Request a thread to read the events */ ret =request_threaded_irq (irq, lineevent_irq_handler, lineevent_irq_thread, irqflags, - le->label, + label, le); -if (ret) +if (ret) { +free_irq_label (label); goto out_free_le; + } le->irq = irq;
Greg Kroah-Hartman
maintainerPATCH 64/273 RISC-V: KVM: Fix APLIC setipnum_le/be write emulation
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anup Patel <[email protected]>
commit d8dd9f113e16bef3b29c9dcceb584a6f144f55e4 upstream.
The writes to setipnum_le/be register for APLIC in MSI-mode have special consideration for level-triggered interrupts as-per the section "4.9.2 Special consideration for level-sensitive interrupt sources" of the RISC-V AIA specification.
Particularly, the below text from the RISC-V AIA specification defines the behaviour of writes to setipnum_le/be register for level-triggered interrupts:
"A second option is for the interrupt service routine to write the APLIC’s source identity number for the interrupt to the domain’s setipnum register just before exiting. This will cause the interrupt’s pending bit to be set to one again if the source is still asserting an interrupt, but not if the source is not asserting an interrupt."
Fix setipnum_le/be write emulation for in-kernel APLIC by implementing the above behaviour in aplic_write_pending() function.
--- arch/riscv/kvm/aia_aplic.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
arch/riscv/kvm/aia_aplic.c +13 -3
@@ -137,11 +137,21 @@ static void aplic_write_pending(struct araw_spin_lock_irqsave (&irqd->lock, flags); sm = irqd->sourcecfg &APLIC_SOURCECFG_SM_MASK ; -if (!pending && - ((sm ==APLIC_SOURCECFG_SM_LEVEL_HIGH ) || - (sm ==APLIC_SOURCECFG_SM_LEVEL_LOW ))) +if (sm ==APLIC_SOURCECFG_SM_INACTIVE ) goto skip_write_pending; +if (sm ==APLIC_SOURCECFG_SM_LEVEL_HIGH || + sm ==APLIC_SOURCECFG_SM_LEVEL_LOW ) { +if (!pending) + goto skip_write_pending; +if ((irqd->state &APLIC_IRQ_STATE_INPUT ) && + sm ==APLIC_SOURCECFG_SM_LEVEL_LOW ) + goto skip_write_pending; +if (!(irqd->state &APLIC_IRQ_STATE_INPUT ) && + sm ==APLIC_SOURCECFG_SM_LEVEL_HIGH ) + goto skip_write_pending; + } +if (pending) irqd->state |=APLIC_IRQ_STATE_PENDING ;else
Greg Kroah-Hartman
maintainerPATCH 65/273 RISC-V: KVM: Fix APLIC in_clrip[x] read emulation
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anup Patel <[email protected]>
commit 8e936e98718f005c986be0bfa1ee6b355acf96be upstream.
The reads to APLIC in_clrip[x] registers returns rectified input values of the interrupt sources.
A rectified input value of an interrupt source is defined by the section "4.5.2 Source configurations (sourcecfg[1]–sourcecfg[1023])" of the RISC-V AIA specification as:
rectified input value = (incoming wire value) XOR (source is inverted)
Update the riscv_aplic_input() implementation to match the above.
--- arch/riscv/kvm/aia_aplic.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
arch/riscv/kvm/aia_aplic.c +18 -3
@@ -197,16 +197,31 @@ static void aplic_write_enabled(struct astatic bool aplic_read_input (struct aplic *aplic,u32 irq) { -bool ret; -unsigned long flags; +u32 sourcecfg, sm, raw_input, irq_inverted;struct aplic_irq *irqd; +unsigned long flags; +bool ret = false;if (!irq || aplic->nr_irqs <= irq)return false; irqd = &aplic->irqs[irq];raw_spin_lock_irqsave (&irqd->lock, flags); - ret = (irqd->state &APLIC_IRQ_STATE_INPUT ) ? true : false; + + sourcecfg = irqd->sourcecfg; +if (sourcecfg &APLIC_SOURCECFG_D ) + goto skip; + + sm = sourcecfg &APLIC_SOURCECFG_SM_MASK ; +if (sm ==APLIC_SOURCECFG_SM_INACTIVE ) + goto skip; + + raw_input = (irqd->state &APLIC_IRQ_STATE_INPUT ) ?1 :0 ; + irq_inverted = (sm ==APLIC_SOURCECFG_SM_LEVEL_LOW || + sm ==APLIC_SOURCECFG_SM_EDGE_FALL ) ?1 :0 ; + ret = !!(raw_input ^ irq_inverted); + +skip:raw_spin_unlock_irqrestore (&irqd->lock, flags);return ret;
Greg Kroah-Hartman
maintainerPATCH 66/273 KVM: arm64: Fix host-programmed guest events in nVHE
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Upton <[email protected]>
commit e89c928bedd77d181edc2df01cb6672184775140 upstream.
Programming PMU events in the host that count during guest execution is a feature supported by perf, e.g.
perf stat -e cpu_cycles:G ./lkvm run
While this works for VHE, the guest/host event bitmaps are not carried through to the hypervisor in the nVHE configuration. Make kvm_pmu_update_vcpu_events() conditional on whether or not _hardware_ supports PMUv3 rather than if the vCPU as vPMU enabled.
--- include/kvm/arm_pmu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/kvm/arm_pmu.h +1 -1
@@ -86,7 +86,7 @@ void kvm_vcpu_pmu_resync_el0(void);*/ #define kvm_pmu_update_vcpu_events (vcpu) \ do { \ - if (!has_vhe() && kvm_vcpu_has_pmu(vcpu)) \ + if (!has_vhe() && kvm_arm_support_pmu_v3()) \ vcpu->arch.pmu.events = *kvm_get_pmu_events(); \ } while (0)
Greg Kroah-Hartman
maintainerPATCH 67/273 KVM: arm64: Fix out-of-IPA space translation fault handling
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wujie Duan <[email protected]>
commit f5fe0adeed6019df495497a64cb57d563ead2296 upstream.
Commit 11e5ea5242e3 ("KVM: arm64: Use helpers to classify exception types reported via ESR") tried to abstract the translation fault check when handling an out-of IPA space condition, but incorrectly replaced it with a permission fault check.
Restore the previous translation fault check.
--- arch/arm64/kvm/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kvm/mmu.c +1 -1
@@ -1631,7 +1631,7 @@ int kvm_handle_guest_abort(struct kvm_vc fault_ipa =kvm_vcpu_get_fault_ipa (vcpu); is_iabt =kvm_vcpu_trap_is_iabt (vcpu); -if (esr_fsc_is_permission_fault (esr)) { +if (esr_fsc_is_translation_fault (esr)) {/* Beyond sanitised PARange (which is the IPA limit) */ if (fault_ipa >=BIT_ULL (get_kvm_ipa_limit ())) {kvm_inject_size_fault (vcpu);
Greg Kroah-Hartman
maintainerPATCH 68/273 selinux: avoid dereference of garbage after mount failure
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Göttsche <[email protected]>
commit 37801a36b4d68892ce807264f784d818f8d0d39b upstream.
In case kern_mount() fails and returns an error pointer return in the error branch instead of continuing and dereferencing the error pointer.
While on it drop the never read static variable selinuxfs_mount.
--- security/selinux/selinuxfs.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
security/selinux/selinuxfs.c +7 -5
@@ -2123,7 +2123,6 @@ static struct file_system_type sel_fs_ty .kill_sb = sel_kill_sb, }; -static struct vfsmount *selinuxfs_mount__ro_after_init ;struct path selinux_null__ro_after_init ;static int __init init_sel_fs (void )
@@ -2145,18 +2144,21 @@ static int __init init_sel_fs(void)return err; } - selinux_null.mnt = selinuxfs_mount =kern_mount (&sel_fs_type); -if (IS_ERR (selinuxfs_mount)) { + selinux_null.mnt =kern_mount (&sel_fs_type); +if (IS_ERR (selinux_null.mnt)) {pr_err ("selinuxfs: could not mount!\n" ); - err =PTR_ERR (selinuxfs_mount); - selinuxfs_mount =NULL ; + err =PTR_ERR (selinux_null.mnt); + selinux_null.mnt =NULL ; +return err; } + selinux_null.dentry =d_hash_and_lookup (selinux_null.mnt->mnt_root, &null_name);if (IS_ERR (selinux_null.dentry)) {pr_err ("selinuxfs: could not lookup null!\n" ); err =PTR_ERR (selinux_null.dentry); selinux_null.dentry =NULL ; +return err; }return err;
Greg Kroah-Hartman
maintainerPATCH 69/273 r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
commit 5d872c9f46bd2ea3524af3c2420a364a13667135 upstream.
On some boards with this chip version the BIOS is buggy and misses to reset the PHY page selector. This results in the PHY ID read accessing registers on a different page, returning a more or less random value. Fix this by resetting the page selector first.
--- drivers/net/ethernet/realtek/r8169_main.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/ethernet/realtek/r8169_main.c +9 -0
@@ -5027,6 +5027,15 @@ static int r8169_mdio_register(struct rtstruct mii_bus *new_bus;int ret; +/* On some boards with this chip version the BIOS is buggy and misses +* to reset the PHY page selector. This results in the PHY ID read +* accessing registers on a different page, returning a more or +* less random value. Fix this by resetting the page selector first. +*/ +if (tp->mac_version ==RTL_GIGA_MAC_VER_25 || + tp->mac_version ==RTL_GIGA_MAC_VER_26 ) +r8169_mdio_write (tp,0x1f ,0 ); + new_bus =devm_mdiobus_alloc (&pdev->dev);if (!new_bus)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 70/273 x86/cpufeatures: Add new word for scattered features
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <[email protected]>
commit 7f274e609f3d5f45c22b1dd59053f6764458b492 upstream.
Add a new word for scattered features because all free bits among the existing Linux-defined auxiliary flags have been exhausted.
--- arch/x86/include/asm/cpufeature.h | 6 ++++-- arch/x86/include/asm/cpufeatures.h | 2 +- arch/x86/include/asm/disabled-features.h | 3 ++- arch/x86/include/asm/required-features.h | 3 ++- 4 files changed, 9 insertions(+), 5 deletions(-)
arch/x86/include/asm/cpufeature.h +4 -2
@@ -91,8 +91,9 @@ extern const char * const x86_bug_flags[ CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 18, feature_bit) || \ CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 19, feature_bit) || \ CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 20, feature_bit) || \ + CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 21, feature_bit) || \ REQUIRED_MASK_CHECK || \ - BUILD_BUG_ON_ZERO(NCAPINTS != 21)) + BUILD_BUG_ON_ZERO(NCAPINTS != 22))#define DISABLED_MASK_BIT_SET (feature_bit) \ ( CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 0, feature_bit) || \
@@ -116,8 +117,9 @@ extern const char * const x86_bug_flags[ CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 18, feature_bit) || \ CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 19, feature_bit) || \ CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 20, feature_bit) || \ + CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 21, feature_bit) || \ DISABLED_MASK_CHECK || \ - BUILD_BUG_ON_ZERO(NCAPINTS != 21)) + BUILD_BUG_ON_ZERO(NCAPINTS != 22))#define cpu_has (c, bit) \ (__builtin_constant_p(bit) && REQUIRED_MASK_BIT_SET(bit) ? 1 : \
arch/x86/include/asm/cpufeatures.h +1 -1
@@ -13,7 +13,7 @@/* * Defines x86 CPU feature bits */ -#define NCAPINTS 21/* N 32-bit words worth of info */ +#define NCAPINTS 22/* N 32-bit words worth of info */ #define NBUGINTS 2/* N 32-bit bug flags */ /*
arch/x86/include/asm/disabled-features.h +2 -1
@@ -143,6 +143,7 @@#define DISABLED_MASK18 (DISABLE_IBT)#define DISABLED_MASK19 0#define DISABLED_MASK20 0 -#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 21) +#define DISABLED_MASK21 0 +#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 22)#endif /* _ASM_X86_DISABLED_FEATURES_H */
arch/x86/include/asm/required-features.h +2 -1
@@ -99,6 +99,7 @@#define REQUIRED_MASK18 0#define REQUIRED_MASK19 0#define REQUIRED_MASK20 0 -#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 21) +#define REQUIRED_MASK21 0 +#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 22)#endif /* _ASM_X86_REQUIRED_FEATURES_H */
Greg Kroah-Hartman
maintainerPATCH 71/273 x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 8cb4a9a82b21623dbb4b3051dd30d98356cf95bc upstream.
Add CPUID_LNX_5 to track cpufeatures' word 21, and add the appropriate compile-time assert in KVM to prevent direct lookups on the features in CPUID_LNX_5. KVM uses X86_FEATURE_* flags to manage guest CPUID, and so must translate features that are scattered by Linux from the Linux-defined bit to the hardware-defined bit, i.e. should never try to directly access scattered features in guest CPUID.
Opportunistically add NR_CPUID_WORDS to enum cpuid_leafs, along with a compile-time assert in KVM's CPUID infrastructure to ensure that future additions update cpuid_leafs along with NCAPINTS.
No functional change intended.
--- arch/x86/include/asm/cpufeature.h | 2 ++ arch/x86/kvm/reverse_cpuid.h | 2 ++ 2 files changed, 4 insertions(+)
arch/x86/include/asm/cpufeature.h +2 -0
@@ -33,6 +33,8 @@ enum cpuid_leafsCPUID_7_EDX ,CPUID_8000_001F_EAX ,CPUID_8000_0021_EAX , +CPUID_LNX_5 , + NR_CPUID_WORDS, };#define X86_CAP_FMT_NUM "%d:%d"
arch/x86/kvm/reverse_cpuid.h +2 -0
@@ -102,10 +102,12 @@ static const struct cpuid_reg reverse_cp*/ static __always_inline void reverse_cpuid_check(unsigned int x86_leaf) { +BUILD_BUG_ON (NR_CPUID_WORDS !=NCAPINTS );BUILD_BUG_ON (x86_leaf ==CPUID_LNX_1 );BUILD_BUG_ON (x86_leaf ==CPUID_LNX_2 );BUILD_BUG_ON (x86_leaf ==CPUID_LNX_3 );BUILD_BUG_ON (x86_leaf ==CPUID_LNX_4 ); +BUILD_BUG_ON (x86_leaf ==CPUID_LNX_5 );BUILD_BUG_ON (x86_leaf >=ARRAY_SIZE (reverse_cpuid));BUILD_BUG_ON (reverse_cpuid[x86_leaf].function ==0 ); }
Greg Kroah-Hartman
maintainerPATCH 72/273 x86/bpf: Fix IP after emitting call depth accounting
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uros Bizjak <[email protected]>
commit 9d98aa088386aee3db1b7b60b800c0fde0654a4a upstream.
Adjust the IP passed to emit_patch so it calculates the correct offset for the CALL instruction if x86_call_depth_emit_accounting emits code. Otherwise we will skip some instructions and most likely crash.
--- arch/x86/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/net/bpf_jit_comp.c +1 -1
@@ -466,7 +466,7 @@ static int emit_call(u8 **pprog, void *fstatic int emit_rsb_call (u8 **pprog,void *func,void *ip) {OPTIMIZER_HIDE_VAR (func); -x86_call_depth_emit_accounting (pprog, func); + ip +=x86_call_depth_emit_accounting (pprog, func);return emit_patch (pprog, func, ip,0xE8 ); }
Greg Kroah-Hartman
maintainerPATCH 73/273 Revert "Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT"
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 4790a73ace86f3d165bbedba898e0758e6e1b82d upstream.
This reverts commit 7dcd3e014aa7faeeaf4047190b22d8a19a0db696.
Qualcomm Bluetooth controllers like WCN6855 do not have persistent storage for the Bluetooth address and must therefore start as unconfigured to allow the user to set a valid address unless one has been provided by the boot firmware in the devicetree.
A recent change snuck into v6.8-rc7 and incorrectly started marking the default (non-unique) address as valid. This specifically also breaks the Bluetooth setup for some user of the Lenovo ThinkPad X13s.
Note that this is the second time Qualcomm breaks the driver this way and that this was fixed last year by commit 6945795bc81a ("Bluetooth:
fix use-bdaddr-property quirk"), which also has some further details.
--- drivers/bluetooth/hci_qca.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-)
drivers/bluetooth/hci_qca.c +1 -12
@@ -7,7 +7,6 @@* * Copyright (C) 2007 Texas Instruments, Inc. * Copyright (c) 2010, 2012, 2018 The Linux Foundation. All rights reserved. -* Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. * * Acknowledgements: * This file is based on hci_ll.c, which was...
@@ -1904,17 +1903,7 @@ retry:case QCA_WCN6750 :case QCA_WCN6855 :case QCA_WCN7850 : - -/* Set BDA quirk bit for reading BDA value from fwnode property -* only if that property exist in DT. -*/ -if (fwnode_property_present (dev_fwnode (hdev->dev.parent),"local-bd-address" )) { -set_bit (HCI_QUIRK_USE_BDADDR_PROPERTY , &hdev->quirks); -bt_dev_info (hdev,"setting quirk bit to read BDA from fwnode later" ); - }else { -bt_dev_dbg (hdev,"local-bd-address` is not present in the devicetree so not setting quirk bit for BDA" ); - } - +set_bit (HCI_QUIRK_USE_BDADDR_PROPERTY , &hdev->quirks);hci_set_aosp_capable (hdev); ret =qca_read_soc_version (hdev, &ver, soc_type);
Greg Kroah-Hartman
maintainerPATCH 74/273 arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit e12e28009e584c8f8363439f6a928ec86278a106 upstream.
Several Qualcomm Bluetooth controllers lack persistent storage for the device address and instead one can be provided by the boot firmware using the 'local-bd-address' devicetree property.
The Bluetooth bindings clearly states that the address should be specified in little-endian order, but due to a long-standing bug in the Qualcomm driver which reversed the address some boot firmware has been providing the address in big-endian order instead.
The boot firmware in SC7180 Trogdor Chromebooks is known to be affected so mark the 'local-bd-address' property as broken to maintain backwards compatibility with older firmware when fixing the underlying driver bug.
Note that ChromeOS always updates the kernel and devicetree in lockstep so that there is no need to handle backwards compatibility with older devicetrees.
--- arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi +2 -0
@@ -943,6 +943,8 @@ ap_spi_fp: &spi10 { vddrf-supply = <&pp1300_l2c>; vddch0-supply = <&pp3300_l10c>; max-speed = <3200000>; + + qcom,local-bd-address-broken; }; };
Greg Kroah-Hartman
maintainerPATCH 75/273 Bluetooth: qca: fix device-address endianness
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 77f45cca8bc55d00520a192f5a7715133591c83e upstream.
The WCN6855 firmware on the Lenovo ThinkPad X13s expects the Bluetooth device address in big-endian order when setting it using the EDL_WRITE_BD_ADDR_OPCODE command.
Presumably, this is the case for all non-ROME devices which all use the EDL_WRITE_BD_ADDR_OPCODE command for this (unlike the ROME devices which use a different command and expect the address in little-endian order).
Reverse the little-endian address before setting it to make sure that the address can be configured using tools like btmgmt or using the 'local-bd-address' devicetree property.
Note that this can potentially break systems with boot firmware which has started relying on the broken behaviour and is incorrectly passing the address via devicetree in big-endian order.
The only device affected by this should be the WCN3991 used in some Chromebooks. As ChromeOS updates the kernel and devicetree in lockstep, the new 'qcom,local-bd-address-broken' property can be used to determine if the firmware is buggy so that the underlying driver bug can be fixed without breaking backwards compatibility.
Set the HCI_QUIRK_BDADDR_PROPERTY_BROKEN quirk for such platforms so that the address is reversed when parsing the address property.
--- drivers/bluetooth/btqca.c | 8 ++++++-- drivers/bluetooth/hci_qca.c | 10 ++++++++++ 2 files changed, 16 insertions(+), 2 deletions(-)
drivers/bluetooth/btqca.c +6 -2
@@ -826,11 +826,15 @@ EXPORT_SYMBOL_GPL(qca_uart_setup);int qca_set_bdaddr (struct hci_dev *hdev,const bdaddr_t *bdaddr) { +bdaddr_t bdaddr_swapped;struct sk_buff *skb;int err; - skb =__hci_cmd_sync_ev (hdev,EDL_WRITE_BD_ADDR_OPCODE ,6 , bdaddr, -HCI_EV_VENDOR ,HCI_INIT_TIMEOUT ); +baswap (&bdaddr_swapped, bdaddr); + + skb =__hci_cmd_sync_ev (hdev,EDL_WRITE_BD_ADDR_OPCODE ,6 , + &bdaddr_swapped,HCI_EV_VENDOR , +HCI_INIT_TIMEOUT );if (IS_ERR (skb)) { err =PTR_ERR (skb);bt_dev_err (hdev,"QCA Change address cmd failed (%d)" , err);
drivers/bluetooth/hci_qca.c +10 -0
@@ -225,6 +225,7 @@ struct qca_serdev {struct qca_power *bt_power;u32 init_speed;u32 oper_speed; +bool bdaddr_property_broken;const char *firmware_name; };
@@ -1842,6 +1843,7 @@ static int qca_setup(struct hci_uart *huconst char *firmware_name =qca_get_firmware_name (hu);int ret;struct qca_btsoc_version ver; +struct qca_serdev *qcadev;const char *soc_name; ret =qca_check_speeds (hu);
@@ -1904,6 +1906,11 @@ retry:case QCA_WCN6855 :case QCA_WCN7850 :set_bit (HCI_QUIRK_USE_BDADDR_PROPERTY , &hdev->quirks); + + qcadev =serdev_device_get_drvdata (hu->serdev); +if (qcadev->bdaddr_property_broken) +set_bit (HCI_QUIRK_BDADDR_PROPERTY_BROKEN , &hdev->quirks); +hci_set_aosp_capable (hdev); ret =qca_read_soc_version (hdev, &ver, soc_type);
@@ -2284,6 +2291,9 @@ static int qca_serdev_probe(struct serdeif (!qcadev->oper_speed)BT_DBG ("UART will pick default operating speed" ); + qcadev->bdaddr_property_broken =device_property_read_bool (&serdev->dev, +"qcom,local-bd-address-broken" ); +if (data) qcadev->btsoc_type = data->soc_type;else
Greg Kroah-Hartman
maintainerPATCH 76/273 Bluetooth: add quirk for broken address properties
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 39646f29b100566451d37abc4cc8cdd583756dfe upstream.
Some Bluetooth controllers lack persistent storage for the device address and instead one can be provided by the boot firmware using the 'local-bd-address' devicetree property.
The Bluetooth devicetree bindings clearly states that the address should be specified in little-endian order, but due to a long-standing bug in the Qualcomm driver which reversed the address some boot firmware has been providing the address in big-endian order instead.
Add a new quirk that can be set on platforms with broken firmware and use it to reverse the address when parsing the property so that the underlying driver bug can be fixed.
--- include/net/bluetooth/hci.h | 9 +++++++++ net/bluetooth/hci_sync.c | 5 ++++- 2 files changed, 13 insertions(+), 1 deletion(-)
include/net/bluetooth/hci.h +9 -0
@@ -176,6 +176,15 @@ enum {*/ HCI_QUIRK_USE_BDADDR_PROPERTY , +/* When this quirk is set, the Bluetooth Device Address provided by +* the 'local-bd-address' fwnode property is incorrectly specified in +* big-endian order. +* +* This quirk can be set before hci_register_dev is called or +* during the hdev->setup vendor callback. +*/ + HCI_QUIRK_BDADDR_PROPERTY_BROKEN, +/* When this quirk is set, the duplicate filtering during * scanning is based on Bluetooth devices addresses. To allow * RSSI based updates, restart scanning if needed.
net/bluetooth/hci_sync.c +4 -1
@@ -3224,7 +3224,10 @@ static void hci_dev_get_bd_addr_from_proif (ret <0 || !bacmp (&ba,BDADDR_ANY ))return ; -bacpy (&hdev->public_addr, &ba); +if (test_bit (HCI_QUIRK_BDADDR_PROPERTY_BROKEN , &hdev->quirks)) +baswap (&hdev->public_addr, &ba); +else +bacpy (&hdev->public_addr, &ba); }struct hci_init_stage {
Greg Kroah-Hartman
maintainerPATCH 77/273 Bluetooth: hci_event: set the conn encrypted before conn establishes
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
commit c569242cd49287d53b73a94233db40097d838535 upstream.
We have a BT headset (Lenovo Thinkplus XT99), the pairing and connecting has no problem, once this headset is paired, bluez will remember this device and will auto re-connect it whenever the device is powered on. The auto re-connecting works well with Windows and Android, but with Linux, it always fails. Through debugging, we found at the rfcomm connection stage, the bluetooth stack reports "Connection refused - security block (0x0003)".
For this device, the re-connecting negotiation process is different from other BT headsets, it sends the Link_KEY_REQUEST command before the CONNECT_REQUEST completes, and it doesn't send ENCRYPT_CHANGE command during the negotiation. When the device sends the "connect complete" to hci, the ev->encr_mode is 1.
So here in the conn_complete_evt(), if ev->encr_mode is 1, link type is ACL and HCI_CONN_ENCRYPT is not set, we set HCI_CONN_ENCRYPT to this conn, and update conn->enc_key_size accordingly.
After this change, this BT headset could re-connect with Linux successfully. This is the btmon log after applying the patch, after receiving the "Connect Complete" with "Encryption: Enabled", will send the command to read encryption key size:
Quoted 1 line
HCI Event: Connect Request (
0x04) plen 10
Address: 8C:3C:AA:D8:11:67 (OUI 8C-3C-AA)
Class: 0x240404
Major class: Audio/Video (headset, speaker, stereo, video, vcr) Minor class: Wearable Headset Device
Rendering (Printing, Speaker)
Audio (Speaker, Microphone, Headset)
Link type: ACL (0x01)
...
Quoted 1 line
HCI Event: Link Key Request (
0x17) plen 6
Address: 8C:3C:AA:D8:11:67 (OUI 8C-3C-AA)
< HCI Command: Link Key Request Reply (0x01|0x000b) plen 22
Address: 8C:3C:AA:D8:11:67 (OUI 8C-3C-AA)
Link key: ${32-hex-digits-key}...
Quoted 1 line
HCI Event: Connect Complete (
0x03) plen 11
Status: Success (0x00)
Handle: 256
Address: 8C:3C:AA:D8:11:67 (OUI 8C-3C-AA)
Link type: ACL (0x01)
Encryption: Enabled (0x01)
< HCI Command: Read Encryption Key... (0x05|0x0008) plen 2
Handle: 256
< ACL Data TX: Handle 256 flags 0x00 dlen 10
L2CAP: Information Request (0x0a) ident 1 len 2
Type: Extended features supported (0x0002)Quoted 1 line
HCI Event: Command Complete (
0x0e) plen 7
Read Encryption Key Size (0x05|0x0008) ncmd 1
Status: Success (0x00)
Handle: 256
Key size: 16--- net/bluetooth/hci_event.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
net/bluetooth/hci_event.c +25 -0
@@ -3219,6 +3219,31 @@ static void hci_conn_complete_evt(structif (test_bit (HCI_ENCRYPT , &hdev->flags))set_bit (HCI_CONN_ENCRYPT , &conn->flags); +/* "Link key request" completed ahead of "connect request" completes */ +if (ev->encr_mode ==1 && !test_bit (HCI_CONN_ENCRYPT , &conn->flags) && + ev->link_type ==ACL_LINK ) { +struct link_key *key; +struct hci_cp_read_enc_key_size cp; + + key =hci_find_link_key (hdev, &ev->bdaddr); +if (key) { +set_bit (HCI_CONN_ENCRYPT , &conn->flags); + +if (!(hdev->commands[20 ] &0x10 )) { + conn->enc_key_size =HCI_LINK_KEY_SIZE ; + }else { + cp.handle =cpu_to_le16 (conn->handle); +if (hci_send_cmd (hdev,HCI_OP_READ_ENC_KEY_SIZE , +sizeof (cp), &cp)) { +bt_dev_err (hdev,"sending read key size failed" ); + conn->enc_key_size =HCI_LINK_KEY_SIZE ; + } + } + +hci_encrypt_cfm (conn, ev->status); + } + } +/* Get remote features */ if (conn->type ==ACL_LINK ) {struct hci_cp_read_remote_features cp;
Greg Kroah-Hartman
maintainerPATCH 78/273 Bluetooth: Fix TOCTOU in HCI debugfs implementation
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bastien Nocera <[email protected]>
commit 7835fcfd132eb88b87e8eb901f88436f63ab60f7 upstream.
struct hci_dev members conn_info_max_age, conn_info_min_age, le_conn_max_interval, le_conn_min_interval, le_adv_max_interval, and le_adv_min_interval can be modified from the HCI core code, as well through debugfs.
The debugfs implementation, that's only available to privileged users, will check for boundaries, making sure that the minimum value being set is strictly above the maximum value that already exists, and vice-versa.
However, as both minimum and maximum values can be changed concurrently to us modifying them, we need to make sure that the value we check is the value we end up using.
For example, with ->conn_info_max_age set to 10, conn_info_min_age_set() gets called from vfs handlers to set conn_info_min_age to 8.
In conn_info_min_age_set(), this goes through:
if (val == 0 || val > hdev->conn_info_max_age) return -EINVAL;
Concurrently, conn_info_max_age_set() gets called to set to set the conn_info_max_age to 7:
if (val == 0 || val > hdev->conn_info_max_age) return -EINVAL;
That check will also pass because we used the old value (10) for conn_info_max_age.
After those checks that both passed, the struct hci_dev access is mutex-locked, disabling concurrent access, but that does not matter because the invalid value checks both passed, and we'll end up with conn_info_min_age = 8 and conn_info_max_age = 7
To fix this problem, we need to lock the structure access before so the check and assignment are not interrupted.
This fix was originally devised by the BassCheck[1] team, and considered the problem to be an atomicity one. This isn't the case as there aren't any concerns about the variable changing while we check it, but rather after we check it parallel to another change.
This patch fixes CVE-2024-24858 and CVE-2024-24857.
[1] https://sites.google.com/view/basscheck/
--- net/bluetooth/hci_debugfs.c | 48 +++++++++++++++++++++++++++++--------------- 1 file changed, 32 insertions(+), 16 deletions(-)
net/bluetooth/hci_debugfs.c +32 -16
@@ -218,10 +218,12 @@ static int conn_info_min_age_set(void *d {struct hci_dev *hdev = data; -if (val ==0 || val > hdev->conn_info_max_age) +hci_dev_lock (hdev); +if (val ==0 || val > hdev->conn_info_max_age) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->conn_info_min_age = val;hci_dev_unlock (hdev);
@@ -246,10 +248,12 @@ static int conn_info_max_age_set(void *d {struct hci_dev *hdev = data; -if (val ==0 || val < hdev->conn_info_min_age) +hci_dev_lock (hdev); +if (val ==0 || val < hdev->conn_info_min_age) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->conn_info_max_age = val;hci_dev_unlock (hdev);
@@ -567,10 +571,12 @@ static int sniff_min_interval_set(void * {struct hci_dev *hdev = data; -if (val ==0 || val %2 || val > hdev->sniff_max_interval) +hci_dev_lock (hdev); +if (val ==0 || val %2 || val > hdev->sniff_max_interval) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->sniff_min_interval = val;hci_dev_unlock (hdev);
@@ -595,10 +601,12 @@ static int sniff_max_interval_set(void * {struct hci_dev *hdev = data; -if (val ==0 || val %2 || val < hdev->sniff_min_interval) +hci_dev_lock (hdev); +if (val ==0 || val %2 || val < hdev->sniff_min_interval) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->sniff_max_interval = val;hci_dev_unlock (hdev);
@@ -850,10 +858,12 @@ static int conn_min_interval_set(void *d {struct hci_dev *hdev = data; -if (val <0x0006 || val >0x0c80 || val > hdev->le_conn_max_interval) +hci_dev_lock (hdev); +if (val <0x0006 || val >0x0c80 || val > hdev->le_conn_max_interval) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->le_conn_min_interval = val;hci_dev_unlock (hdev);
@@ -878,10 +888,12 @@ static int conn_max_interval_set(void *d {struct hci_dev *hdev = data; -if (val <0x0006 || val >0x0c80 || val < hdev->le_conn_min_interval) +hci_dev_lock (hdev); +if (val <0x0006 || val >0x0c80 || val < hdev->le_conn_min_interval) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->le_conn_max_interval = val;hci_dev_unlock (hdev);
@@ -990,10 +1002,12 @@ static int adv_min_interval_set(void *da {struct hci_dev *hdev = data; -if (val <0x0020 || val >0x4000 || val > hdev->le_adv_max_interval) +hci_dev_lock (hdev); +if (val <0x0020 || val >0x4000 || val > hdev->le_adv_max_interval) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->le_adv_min_interval = val;hci_dev_unlock (hdev);
@@ -1018,10 +1032,12 @@ static int adv_max_interval_set(void *da {struct hci_dev *hdev = data; -if (val <0x0020 || val >0x4000 || val < hdev->le_adv_min_interval) +hci_dev_lock (hdev); +if (val <0x0020 || val >0x4000 || val < hdev->le_adv_min_interval) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->le_adv_max_interval = val;hci_dev_unlock (hdev);
Greg Kroah-Hartman
maintainerPATCH 79/273 netfilter: nf_tables: release batch on table validation from abort path
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit a45e6889575c2067d3c0212b6bc1022891e65b91 upstream.
Unlike early commit path stage which triggers a call to abort, an explicit release of the batch is required on abort, otherwise mutex is released and commit_list remains in place.
Add WARN_ON_ONCE to ensure commit_list is empty from the abort path before releasing the mutex.
After this patch, commit_list is always assumed to be empty before grabbing the mutex, therefore
03c1f1ef1584 ("netfilter: Cleanup nft_net->module_list from nf_tables_exit_net()")
only needs to release the pending modules for registration.
--- net/netfilter/nf_tables_api.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
net/netfilter/nf_tables_api.c +10 -5
@@ -10451,10 +10451,11 @@ static int __nf_tables_abort(struct netstruct nft_trans *trans, *next;LIST_HEAD (set_update_list);struct nft_trans_elem *te; +int err =0 ;if (action ==NFNL_ABORT_VALIDATE &&nf_tables_validate (net) <0 ) -return -EAGAIN ; + err = -EAGAIN ;list_for_each_entry_safe_reverse (trans, next, &nft_net->commit_list, list) {
@@ -10647,7 +10648,7 @@ static int __nf_tables_abort(struct netelse nf_tables_module_autoload_cleanup (net); -return 0 ; +return err; } static int nf_tables_abort(struct net *net, struct sk_buff *skb,
@@ -10660,6 +10661,9 @@ static int nf_tables_abort(struct net *n gc_seq =nft_gc_seq_begin (nft_net); ret =__nf_tables_abort (net, action);nft_gc_seq_end (nft_net, gc_seq); + +WARN_ON_ONCE (!list_empty (&nft_net->commit_list)); +mutex_unlock (&nft_net->commit_mutex);return ret;
@@ -11461,9 +11465,10 @@ static void __net_exit nf_tables_exit_ne gc_seq =nft_gc_seq_begin (nft_net); -if (!list_empty (&nft_net->commit_list) || - !list_empty (&nft_net->module_list)) -__nf_tables_abort (net,NFNL_ABORT_NONE ); +WARN_ON_ONCE (!list_empty (&nft_net->commit_list)); + +if (!list_empty (&nft_net->module_list)) +nf_tables_module_autoload_cleanup (net);__nft_release_tables (net);
Greg Kroah-Hartman
maintainerPATCH 80/273 netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 0d459e2ffb541841714839e8228b845458ed3b27 upstream.
The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC worker could collect expired objects and get the released commit lock within the same GC sequence.
nf_tables_module_autoload() temporarily releases the mutex to load module dependencies, then it goes back to replay the transaction again. Move it at the end of the abort phase after nft_gc_seq_end() is called.
--- net/netfilter/nf_tables_api.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
net/netfilter/nf_tables_api.c +8 -5
@@ -10643,11 +10643,6 @@ static int __nf_tables_abort(struct netnf_tables_abort_release (trans); } -if (action ==NFNL_ABORT_AUTOLOAD ) -nf_tables_module_autoload (net); -else -nf_tables_module_autoload_cleanup (net); -return err; }
@@ -10664,6 +10659,14 @@ static int nf_tables_abort(struct net *nWARN_ON_ONCE (!list_empty (&nft_net->commit_list)); +/* module autoload needs to happen after GC sequence update because it +* temporarily releases and grabs mutex again. +*/ +if (action ==NFNL_ABORT_AUTOLOAD ) +nf_tables_module_autoload (net); +else +nf_tables_module_autoload_cleanup (net); +mutex_unlock (&nft_net->commit_mutex);return ret;
Greg Kroah-Hartman
maintainerPATCH 81/273 selftests: mptcp: join: fix dev in check_endpoint
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
commit 40061817d95bce6dd5634a61a65cd5922e6ccc92 upstream.
There's a bug in pm_nl_check_endpoint(), 'dev' didn't be parsed correctly. If calling it in the 2nd test of endpoint_tests() too, it fails with an error like this:
creation [FAIL] expected '10.0.2.2 id 2 subflow dev dev' \
found '10.0.2.2 id 2 subflow dev ns2eth2'
The reason is '$2' should be set to 'dev', not '$1'. This patch fixes it.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +3 -1
@@ -773,7 +773,7 @@ pm_nl_check_endpoint() [ -n "$_flags" ]; flags="flags $_flags" shift elif [ $1 = "dev" ]; then - [ -n "$2" ]; dev="dev $1" + [ -n "$2" ]; dev="dev $2" shift elif [ $1 = "id" ]; then _id=$2
@@ -3589,6 +3589,8 @@ endpoint_tests() local tests_pid=$! wait_mpj $ns2 + pm_nl_check_endpoint "creation" \ + $ns2 10.0.2.2 id 2 flags subflow dev ns2eth2 chk_subflow_nr "before delete" 2 chk_mptcp_info subflows 1 subflows 1
Greg Kroah-Hartman
maintainerPATCH 82/273 xen-netfront: Add missing skb_mark_for_recycle
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesper Dangaard Brouer <[email protected]>
commit 037965402a010898d34f4e35327d22c0a95cd51f upstream.
Notice that skb_mark_for_recycle() is introduced later than fixes tag in commit 6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling").
It is believed that fixes tag were missing a call to page_pool_release_page() between v5.9 to v5.14, after which is should have used skb_mark_for_recycle(). Since v6.6 the call page_pool_release_page() were removed (in commit 535b9c61bdef ("net: page_pool: hide page_pool_release_page()") and remaining callers converted (in commit 6bfef2ec0172 ("Merge branch 'net-page_pool-remove-page_pool_release_page'")).
This leak became visible in v6.8 via commit dba1b8a7ab68 ("mm/page_pool: catch page_pool memory leaks").
--- drivers/net/xen-netfront.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/xen-netfront.c +1 -0
@@ -285,6 +285,7 @@ static struct sk_buff *xennet_alloc_one_return NULL ; }skb_add_rx_frag (skb,0 , page,0 ,0 ,PAGE_SIZE ); +skb_mark_for_recycle (skb);/* Align ip header to a 16 bytes boundary */ skb_reserve (skb,NET_IP_ALIGN );
Greg Kroah-Hartman
maintainerPATCH 83/273 net/rds: fix possible cp null dereference
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahmoud Adam <[email protected]>
commit 62fc3357e079a07a22465b9b6ef71bb6ea75ee4b upstream.
cp might be null, calling cp->cp_conn would produce null dereference
[Simon Horman adds:]
Analysis:
* cp is a parameter of __rds_rdma_map and is not reassigned.
* The following call-sites pass a NULL cp argument to __rds_rdma_map()
- rds_get_mr()
- rds_get_mr_for_dest
* Prior to the code above, the following assumes that cp may be NULL (which is indicative, but could itself be unnecessary)
trans_private = rs->rs_transport->get_mr( sg, nents, rs, &mr->r_key, cp ? cp->cp_conn : NULL, args->vec.addr, args->vec.bytes, need_odp ? ODP_ZEROBASED : ODP_NOT_NEEDED);
* The code modified by this patch is guarded by IS_ERR(trans_private), where trans_private is assigned as per the previous point in this analysis.
The only implementation of get_mr that I could locate is rds_ib_get_mr() which can return an ERR_PTR if the conn (4th) argument is NULL.
* ret is set to PTR_ERR(trans_private).
rds_ib_get_mr can return ERR_PTR(-ENODEV) if the conn (4th) argument is NULL. Thus ret may be -ENODEV in which case the code in question will execute.
Conclusion:
* cp may be NULL at the point where this patch adds a check; this patch does seem to address a possible bug
--- net/rds/rdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rds/rdma.c +1 -1
@@ -302,7 +302,7 @@ static int __rds_rdma_map(struct rds_soc } ret =PTR_ERR (trans_private);/* Trigger connection so that its ready for the next retry */ -if (ret == -ENODEV ) +if (ret == -ENODEV && cp)rds_conn_connect_if_down (cp->cp_conn); goto out; }
Greg Kroah-Hartman
maintainerPATCH 84/273 net: usb: ax88179_178a: avoid the interface always configured as random address
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Ignacio Tornos Martinez <[email protected]>
commit 2e91bb99b9d4f756e92e83c4453f894dda220f09 upstream.
After the commit d2689b6a86b9 ("net: usb: ax88179_178a: avoid two consecutive device resets"), reset is not executed from bind operation and mac address is not read from the device registers or the devicetree at that moment. Since the check to configure if the assigned mac address is random or not for the interface, happens after the bind operation from usbnet_probe, the interface keeps configured as random address, although the address is correctly read and set during open operation (the only reset now).
In order to keep only one reset for the device and to avoid the interface always configured as random address, after reset, configure correctly the suitable field from the driver, if the mac address is read successfully from the device registers or the devicetree. Take into account if a locally administered address (random) was previously stored.
--- drivers/net/usb/ax88179_178a.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/ax88179_178a.c +2 -0
@@ -1273,6 +1273,8 @@ static void ax88179_get_mac_addr(structif (is_valid_ether_addr (mac)) {eth_hw_addr_set (dev->net, mac); +if (!is_local_ether_addr (mac)) + dev->net->addr_assign_type =NET_ADDR_PERM ; }else {netdev_info (dev->net,"invalid MAC address, using random\n" );eth_hw_addr_random (dev->net);
Greg Kroah-Hartman
maintainerPATCH 85/273 net: mana: Fix Rx DMA datasize and skb_over_panic
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haiyang Zhang <[email protected]>
commit c0de6ab920aafb56feab56058e46b688e694a246 upstream.
mana_get_rxbuf_cfg() aligns the RX buffer's DMA datasize to be multiple of 64. So a packet slightly bigger than mtu+14, say 1536, can be received and cause skb_over_panic.
Sample dmesg:
[ 5325.237162] skbuff: skb_over_panic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev:<NULL> [ 5325.243689] ------------[ cut here ]------------ [ 5325.245748] kernel BUG at net/core/skbuff.c:192! [ 5325.247838] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 5325.258374] RIP: 0010:skb_panic+0x4f/0x60 [ 5325.302941] Call Trace: [ 5325.304389] <IRQ> [ 5325.315794] ? skb_panic+0x4f/0x60 [ 5325.317457] ? asm_exc_invalid_op+0x1f/0x30 [ 5325.319490] ? skb_panic+0x4f/0x60 [ 5325.321161] skb_put+0x4e/0x50 [ 5325.322670] mana_poll+0x6fa/0xb50 [mana] [ 5325.324578] __napi_poll+0x33/0x1e0 [ 5325.326328] net_rx_action+0x12e/0x280
As discussed internally, this alignment is not necessary. To fix this bug, remove it from the code. So oversized packets will be marked as CQE_RX_TRUNCATED by NIC, and dropped.
--- drivers/net/ethernet/microsoft/mana/mana_en.c | 2 +- include/net/mana/mana.h | 1 - 2 files changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/microsoft/mana/mana_en.c +1 -1
@@ -601,7 +601,7 @@ static void mana_get_rxbuf_cfg(int mtu, *alloc_size = mtu +MANA_RXBUF_PAD + *headroom; - *datasize =ALIGN (mtu +ETH_HLEN ,MANA_RX_DATA_ALIGN ); + *datasize = mtu +ETH_HLEN ; }static int mana_pre_alloc_rxbufs (struct mana_port_context *mpc,int new_mtu)
include/net/mana/mana.h +0 -1
@@ -39,7 +39,6 @@ enum TRI_STATE {#define COMP_ENTRY_SIZE 64#define RX_BUFFERS_PER_QUEUE 512 -#define MANA_RX_DATA_ALIGN 64#define MAX_SEND_BUFFERS_PER_QUEUE 256
Greg Kroah-Hartman
maintainerPATCH 86/273 vsock/virtio: fix packet delivery to tap device
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Pinna <[email protected]>
commit b32a09ea7c38849ff925489a6bf5bd8914bc45df upstream.
Commit 82dfb540aeb2 ("VSOCK: Add virtio vsock vsockmon hooks") added virtio_transport_deliver_tap_pkt() for handing packets to the vsockmon device. However, in virtio_transport_send_pkt_work(), the function is called before actually sending the packet (i.e. before placing it in the virtqueue with virtqueue_add_sgs() and checking whether it returned successfully).
Queuing the packet in the virtqueue can fail even multiple times. However, in virtio_transport_deliver_tap_pkt() we deliver the packet to the monitoring tap interface only the first time we call it. This certainly avoids seeing the same packet replicated multiple times in the monitoring interface, but it can show the packet sent with the wrong timestamp or even before we succeed to queue it in the virtqueue.
Move virtio_transport_deliver_tap_pkt() after calling virtqueue_add_sgs() and making sure it returned successfully.
--- net/vmw_vsock/virtio_transport.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/vmw_vsock/virtio_transport.c +2 -1
@@ -120,7 +120,6 @@ virtio_transport_send_pkt_work(struct woif (!skb)break ; -virtio_transport_deliver_tap_pkt (skb); reply =virtio_vsock_skb_reply (skb); sgs = vsock->out_sgs; sg_init_one(sgs[out_sg], virtio_vsock_hdr(skb),
@@ -170,6 +169,8 @@ virtio_transport_send_pkt_work(struct wobreak ; } +virtio_transport_deliver_tap_pkt (skb); +if (reply) {struct virtqueue *rx_vq = vsock->vqs[VSOCK_VQ_RX ];int val;
Greg Kroah-Hartman
maintainerPATCH 87/273 netfilter: nf_tables: reject new basechain after table flag update
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 994209ddf4f430946f6247616b2e33d179243769 upstream.
When dormant flag is toggled, hooks are disabled in the commit phase by iterating over current chains in table (existing and new).
The following configuration allows for an inconsistent state:
add table x
add chain x y { type filter hook input priority 0; } add table x { flags dormant; }
add chain x w { type filter hook input priority 1; }
which triggers the following warning when trying to unregister chain w which is already unregistered.
[ 127.322252] WARNING: CPU: 7 PID: 1211 at net/netfilter/core.c:50 1 __nf_unregister_net_hook+0x21a/0x260 [...] [ 127.322519] Call Trace: [ 127.322521] <TASK> [ 127.322524] ? __warn+0x9f/0x1a0 [ 127.322531] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322537] ? report_bug+0x1b1/0x1e0 [ 127.322545] ? handle_bug+0x3c/0x70 [ 127.322552] ? exc_invalid_op+0x17/0x40 [ 127.322556] ? asm_exc_invalid_op+0x1a/0x20 [ 127.322563] ? kasan_save_free_info+0x3b/0x60 [ 127.322570] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322577] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322583] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322590] ? __nf_tables_unregister_hook+0x8a/0xe0 [nf_tables] [ 127.322655] nft_table_disable+0x75/0xf0 [nf_tables] [ 127.322717] nf_tables_commit+0x2571/0x2620 [nf_tables]
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -2437,6 +2437,9 @@ static int nf_tables_addchain(struct nftstruct nft_stats __percpu *stats =NULL ;struct nft_chain_hook hook = {}; +if (table->flags & __NFT_TABLE_F_UPDATE) +return -EINVAL ; +if (flags &NFT_CHAIN_BINDING )return -EOPNOTSUPP ;
Greg Kroah-Hartman
maintainerPATCH 88/273 netfilter: nf_tables: flush pending destroy work before exit_net release
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 24cea9677025e0de419989ecb692acd4bb34cac2 upstream.
Similar to 2c9f0293280e ("netfilter: nf_tables: flush pending destroy work before netlink notifier") to address a race between exit_net and the destroy workqueue.
The trace below shows an element to be released via destroy workqueue while exit_net path (triggered via module removal) has already released the set that is used in such transaction.
[ 1360.547789] BUG: KASAN: slab-use-after-free in nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.547861] Read of size 8 at addr ffff888140500cc0 by task kworker/4:1/152465 [ 1360.547870] CPU: 4 PID: 152465 Comm: kworker/4:1 Not tainted 6.8.0+ #359 [ 1360.547882] Workqueue: events nf_tables_trans_destroy_work [nf_tables] [ 1360.547984] Call Trace: [ 1360.547991] <TASK> [ 1360.547998] dump_stack_lvl+0x53/0x70 [ 1360.548014] print_report+0xc4/0x610 [ 1360.548026] ? __virt_addr_valid+0xba/0x160 [ 1360.548040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 1360.548054] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548176] kasan_report+0xae/0xe0 [ 1360.548189] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548312] nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548447] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [nf_tables] [ 1360.548577] ? _raw_spin_unlock_irq+0x18/0x30 [ 1360.548591] process_one_work+0x2f1/0x670 [ 1360.548610] worker_thread+0x4d3/0x760 [ 1360.548627] ? __pfx_worker_thread+0x10/0x10 [ 1360.548640] kthread+0x16b/0x1b0 [ 1360.548653] ? __pfx_kthread+0x10/0x10 [ 1360.548665] ret_from_fork+0x2f/0x50 [ 1360.548679] ? __pfx_kthread+0x10/0x10 [ 1360.548690] ret_from_fork_asm+0x1a/0x30 [ 1360.548707] </TASK>
[ 1360.548719] Allocated by task 192061: [ 1360.548726] kasan_save_stack+0x20/0x40 [ 1360.548739] kasan_save_track+0x14/0x30 [ 1360.548750] __kasan_kmalloc+0x8f/0xa0 [ 1360.548760] __kmalloc_node+0x1f1/0x450 [ 1360.548771] nf_tables_newset+0x10c7/0x1b50 [nf_tables] [ 1360.548883] nfnetlink_rcv_batch+0xbc4/0xdc0 [nfnetlink] [ 1360.548909] nfnetlink_rcv+0x1a8/0x1e0 [nfnetlink] [ 1360.548927] netlink_unicast+0x367/0x4f0 [ 1360.548935] netlink_sendmsg+0x34b/0x610 [ 1360.548944] ____sys_sendmsg+0x4d4/0x510 [ 1360.548953] ___sys_sendmsg+0xc9/0x120 [ 1360.548961] __sys_sendmsg+0xbe/0x140 [ 1360.548971] do_syscall_64+0x55/0x120 [ 1360.548982] entry_SYSCALL_64_after_hwframe+0x55/0x5d
[ 1360.548994] Freed by task 192222: [ 1360.548999] kasan_save_stack+0x20/0x40 [ 1360.549009] kasan_save_track+0x14/0x30 [ 1360.549019] kasan_save_free_info+0x3b/0x60 [ 1360.549028] poison_slab_object+0x100/0x180 [ 1360.549036] __kasan_slab_free+0x14/0x30 [ 1360.549042] kfree+0xb6/0x260 [ 1360.549049] __nft_release_table+0x473/0x6a0 [nf_tables] [ 1360.549131] nf_tables_exit_net+0x170/0x240 [nf_tables] [ 1360.549221] ops_exit_list+0x50/0xa0 [ 1360.549229] free_exit_list+0x101/0x140 [ 1360.549236] unregister_pernet_operations+0x107/0x160 [ 1360.549245] unregister_pernet_subsys+0x1c/0x30 [ 1360.549254] nf_tables_module_exit+0x43/0x80 [nf_tables] [ 1360.549345] __do_sys_delete_module+0x253/0x370 [ 1360.549352] do_syscall_64+0x55/0x120 [ 1360.549360] entry_SYSCALL_64_after_hwframe+0x55/0x5d
(gdb) list *__nft_release_table+0x4730x1e033 is in __nft_release_table (net/netfilter/nf_tables_api.c:11354).
11349 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
11350 list_del(&flowtable->list);
11351 nft_use_dec(&table->use);
11352 nf_tables_flowtable_destroy(flowtable);
11353 }
11354 list_for_each_entry_safe(set, ns, &table->sets, list) {
11355 list_del(&set->list);
11356 nft_use_dec(&table->use);
11357 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))11358 nft_map_deactivate(&ctx, set);
(gdb)
[ 1360.549372] Last potentially related work creation: [ 1360.549376] kasan_save_stack+0x20/0x40 [ 1360.549384] __kasan_record_aux_stack+0x9b/0xb0 [ 1360.549392] __queue_work+0x3fb/0x780 [ 1360.549399] queue_work_on+0x4f/0x60 [ 1360.549407] nft_rhash_remove+0x33b/0x340 [nf_tables] [ 1360.549516] nf_tables_commit+0x1c6a/0x2620 [nf_tables] [ 1360.549625] nfnetlink_rcv_batch+0x728/0xdc0 [nfnetlink] [ 1360.549647] nfnetlink_rcv+0x1a8/0x1e0 [nfnetlink] [ 1360.549671] netlink_unicast+0x367/0x4f0 [ 1360.549680] netlink_sendmsg+0x34b/0x610 [ 1360.549690] ____sys_sendmsg+0x4d4/0x510 [ 1360.549697] ___sys_sendmsg+0xc9/0x120 [ 1360.549706] __sys_sendmsg+0xbe/0x140 [ 1360.549715] do_syscall_64+0x55/0x120 [ 1360.549725] entry_SYSCALL_64_after_hwframe+0x55/0x5d
--- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nf_tables_api.c +1 -0
@@ -11566,6 +11566,7 @@ static void __exit nf_tables_module_exitunregister_netdevice_notifier (&nf_tables_flowtable_notifier);nft_chain_filter_fini ();nft_chain_route_fini (); +nf_tables_trans_destroy_flush_work ();unregister_pernet_subsys (&nf_tables_net_ops);cancel_work_sync (&trans_gc_work);cancel_work_sync (&trans_destroy_work);
Greg Kroah-Hartman
maintainerPATCH 89/273 netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Xuan <[email protected]>
commit 24225011d81b471acc0e1e315b7d9905459a6304 upstream.
nft_unregister_flowtable_type() within nf_flow_inet_module_exit() can concurrent with __nft_flowtable_type_get() within nf_tables_newflowtable(). And thhere is not any protection when iterate over nf_tables_flowtables list in __nft_flowtable_type_get(). Therefore, there is pertential data-race of nf_tables_flowtables list entry.
Use list_for_each_entry_rcu() to iterate over nf_tables_flowtables list in __nft_flowtable_type_get(), and use rcu_read_lock() in the caller nft_flowtable_type_get() to protect the entire type query process.
--- net/netfilter/nf_tables_api.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +7 -2
@@ -8292,11 +8292,12 @@ static int nft_flowtable_parse_hook(consreturn err; } +/* call under rcu_read_lock */ static const struct nf_flowtable_type *__nft_flowtable_type_get (u8 family) {const struct nf_flowtable_type *type; -list_for_each_entry (type, &nf_tables_flowtables, list) { +list_for_each_entry_rcu (type, &nf_tables_flowtables, list) {if (family == type->family)return type; }
@@ -8308,9 +8309,13 @@ nft_flowtable_type_get(struct net *net, {const struct nf_flowtable_type *type; +rcu_read_lock (); type =__nft_flowtable_type_get (family); -if (type !=NULL &&try_module_get (type->owner)) +if (type !=NULL &&try_module_get (type->owner)) { +rcu_read_unlock ();return type; + } +rcu_read_unlock ();lockdep_nfnl_nft_mutex_not_held ();#ifdef CONFIG_MODULES
Greg Kroah-Hartman
maintainerPATCH 90/273 netfilter: nf_tables: discard table flag update with pending basechain deletion
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 1bc83a019bbe268be3526406245ec28c2458a518 upstream.
Hook unregistration is deferred to the commit phase, same occurs with hook updates triggered by the table dormant flag. When both commands are combined, this results in deleting a basechain while leaving its hook still registered in the core.
--- net/netfilter/nf_tables_api.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/netfilter/nf_tables_api.c +5 -4
@@ -1207,10 +1207,11 @@ static bool nft_table_pending_update(conreturn true;list_for_each_entry (trans, &nft_net->commit_list, list) { -if ((trans->msg_type ==NFT_MSG_NEWCHAIN || - trans->msg_type ==NFT_MSG_DELCHAIN ) && - trans->ctx.table == ctx->table && -nft_trans_chain_update (trans)) +if (trans->ctx.table == ctx->table && + ((trans->msg_type ==NFT_MSG_NEWCHAIN && +nft_trans_chain_update (trans)) || + (trans->msg_type ==NFT_MSG_DELCHAIN && +nft_is_base_chain (trans->ctx.chain))))return true; }
Greg Kroah-Hartman
maintainerPATCH 91/273 netfilter: validate user input for expected length
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 0c83842df40f86e529db6842231154772c20edcc upstream.
I got multiple syzbot reports showing old bugs exposed by BPF after commit 20f2505fb436 ("bpf: Try to avoid kzalloc in cgroup/{s,g}etsockopt")
setsockopt() @optlen argument should be taken into account before copying data.
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline] BUG: KASAN: slab-out-of-bounds in do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627 Read of size 96 at addr ffff88802cd73da0 by task syz-executor.4/7238 CPU: 1 PID: 7238 Comm: syz-executor.4 Not tainted 6.9.0-rc2-next-20240403-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] copy_from_sockptr include/linux/sockptr.h:55 [inline] do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline] do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627 nf_setsockopt+0x295/0x2c0 net/netfilter/nf_sockopt.c:101 do_sock_setsockopt+0x3af/0x720 net/socket.c:2311 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x72/0x7a RIP: 0033:0x7fd22067dde9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd21f9ff0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fd2207abf80 RCX: 00007fd22067dde9 RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007fd2206ca47a R08: 0000000000000001 R09: 0000000000000000 R10: 0000000020000880 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fd2207abf80 R15: 00007ffd2d0170d8 </TASK> Allocated by task 7238: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:4069 [inline] __kmalloc_noprof+0x200/0x410 mm/slub.c:4082 kmalloc_noprof include/linux/slab.h:664 [inline] __cgroup_bpf_run_filter_setsockopt+0xd47/0x1050 kernel/bpf/cgroup.c:1869 do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x72/0x7a The buggy address belongs to the object at ffff88802cd73da0 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes inside of
allocated 1-byte region [ffff88802cd73da0, ffff88802cd73da1)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802cd73020 pfn:0x2cd73
flags: 0xfff80000000000(node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffefff(slab)
raw: 00fff80000000000 ffff888015041280 dead000000000100 dead000000000122
raw: ffff88802cd73020 000000008080007f 00000001ffffefff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5103, tgid 2119833701 (syz-executor.4), ts 5103, free_ts 70804600828
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1490
prep_new_page mm/page_alloc.c:1498 [inline]
get_page_from_freelist+0x2e7e/0x2f40 mm/page_alloc.c:3454
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4712
__alloc_pages_node_noprof include/linux/gfp.h:244 [inline]
alloc_pages_node_noprof include/linux/gfp.h:271 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2249
allocate_slab+0x5a/0x2e0 mm/slub.c:2412
new_slab mm/slub.c:2465 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3615
__slab_alloc+0x58/0xa0 mm/slub.c:3705
__slab_alloc_node mm/slub.c:3758 [inline]
slab_alloc_node mm/slub.c:3936 [inline]
__do_kmalloc_node mm/slub.c:4068 [inline]
kmalloc_node_track_caller_noprof+0x286/0x450 mm/slub.c:4089
kstrdup+0x3a/0x80 mm/util.c:62
device_rename+0xb5/0x1b0 drivers/base/core.c:4558
dev_change_name+0x275/0x860 net/core/dev.c:1232
do_setlink+0xa4b/0x41f0 net/core/rtnetlink.c:2864
__rtnl_newlink net/core/rtnetlink.c:3680 [inline]
rtnl_newlink+0x180b/0x20a0 net/core/rtnetlink.c:3727
rtnetlink_rcv_msg+0x89b/0x10d0 net/core/rtnetlink.c:6594
netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2559
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1361
page last free pid 5146 tgid 5146 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1110 [inline]
free_unref_page+0xd3c/0xec0 mm/page_alloc.c:2617
discard_slab mm/slub.c:2511 [inline]
__put_partials+0xeb/0x130 mm/slub.c:2980
put_cpu_partial+0x17c/0x250 mm/slub.c:3055
__slab_free+0x2ea/0x3d0 mm/slub.c:4254
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3888 [inline]
slab_alloc_node mm/slub.c:3948 [inline]
__do_kmalloc_node mm/slub.c:4068 [inline]
__kmalloc_node_noprof+0x1d7/0x450 mm/slub.c:4076
kmalloc_node_noprof include/linux/slab.h:681 [inline]
kvmalloc_node_noprof+0x72/0x190 mm/util.c:634
bucket_table_alloc lib/rhashtable.c:186 [inline]
rhashtable_rehash_alloc+0x9e/0x290 lib/rhashtable.c:367
rht_deferred_worker+0x4e1/0x2440 lib/rhashtable.c:427
process_one_work kernel/workqueue.c:3218 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3299
worker_thread+0x86d/0xd70 kernel/workqueue.c:3380
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
Memory state around the buggy address:
ffff88802cd73c80: 07 fc fc fc 05 fc fc fc 05 fc fc fc fa fc fc fc
ffff88802cd73d00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
>ffff88802cd73d80: fa fc fc fc 01 fc fc fc fa fc fc fc fa fc fc fc
^
ffff88802cd73e00: fa fc fc fc fa fc fc fc 05 fc fc fc 07 fc fc fc
ffff88802cd73e80: 07 fc fc fc 07 fc fc fc 07 fc fc fc 07 fc fc fc--- net/bridge/netfilter/ebtables.c | 6 ++++++ net/ipv4/netfilter/arp_tables.c | 4 ++++ net/ipv4/netfilter/ip_tables.c | 4 ++++ net/ipv6/netfilter/ip6_tables.c | 4 ++++ 4 files changed, 18 insertions(+)
net/bridge/netfilter/ebtables.c +6 -0
@@ -1111,6 +1111,8 @@ static int do_replace(struct net *net, sstruct ebt_table_info *newinfo;struct ebt_replace tmp; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
@@ -1423,6 +1425,8 @@ static int update_counters(struct net *n {struct ebt_replace hlp; +if (len <sizeof (hlp)) +return -EINVAL ;if (copy_from_sockptr (&hlp, arg,sizeof (hlp)))return -EFAULT ;
@@ -2352,6 +2356,8 @@ static int compat_update_counters(struct {struct compat_ebt_replace hlp; +if (len <sizeof (hlp)) +return -EINVAL ;if (copy_from_sockptr (&hlp, arg,sizeof (hlp)))return -EFAULT ;
net/ipv4/netfilter/arp_tables.c +4 -0
@@ -956,6 +956,8 @@ static int do_replace(struct net *net, svoid *loc_cpu_entry;struct arpt_entry *iter; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
@@ -1254,6 +1256,8 @@ static int compat_do_replace(struct netvoid *loc_cpu_entry;struct arpt_entry *iter; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
net/ipv4/netfilter/ip_tables.c +4 -0
@@ -1108,6 +1108,8 @@ do_replace(struct net *net, sockptr_t arvoid *loc_cpu_entry;struct ipt_entry *iter; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
@@ -1492,6 +1494,8 @@ compat_do_replace(struct net *net, sockpvoid *loc_cpu_entry;struct ipt_entry *iter; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
net/ipv6/netfilter/ip6_tables.c +4 -0
@@ -1125,6 +1125,8 @@ do_replace(struct net *net, sockptr_t arvoid *loc_cpu_entry;struct ip6t_entry *iter; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
@@ -1501,6 +1503,8 @@ compat_do_replace(struct net *net, sockpvoid *loc_cpu_entry;struct ip6t_entry *iter; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 92/273 vboxsf: Avoid an spurious warning if load_nls_xxx() fails
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
commit de3f64b738af57e2732b91a0774facc675b75b54 upstream.
If an load_nls_xxx() function fails a few lines above, the 'sbi->bdi_id' is still 0.
So, in the error handling path, we will call ida_simple_remove(..., 0) which is not allocated yet.
In order to prevent a spurious "ida_free called for id=0 which is not allocated." message, tweak the error handling path and add a new label.
--- fs/vboxsf/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/vboxsf/super.c +2 -1
@@ -151,7 +151,7 @@ static int vboxsf_fill_super(struct supeif (!sbi->nls) {vbg_err ("vboxsf: Count not load '%s' nls\n" , nls_name); err = -EINVAL ; - goto fail_free; + goto fail_destroy_idr; } }
@@ -224,6 +224,7 @@ fail_free:ida_simple_remove (&vboxsf_bdi_ida, sbi->bdi_id);if (sbi->nls)unload_nls (sbi->nls); +fail_destroy_idr:idr_destroy (&sbi->ino_idr);kfree (sbi);return err;
Greg Kroah-Hartman
maintainerPATCH 93/273 bpf, sockmap: Prevent lock inversion deadlock in map delete elem
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Sitnicki <[email protected]>
commit ff91059932401894e6c86341915615c5eb0eca48 upstream.
syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any interrupt context, locks taken during a map_delete_elem operation must be hardirq-safe. Otherwise a deadlock due to lock inversion is possible, as reported by lockdep:
CPU0 CPU1
---- ----
lock(&htab->buckets[i].lock);
local_irq_disable();
lock(&host->lock);
lock(&htab->buckets[i].lock);
<Interrupt>
lock(&host->lock);Locks in sockmap are hardirq-unsafe by design. We expects elements to be deleted from sockmap/sockhash only in task (normal) context with interrupts enabled, or in softirq context.
Detect when map_delete_elem operation is invoked from a context which is _not_ hardirq-unsafe, that is interrupts are disabled, and bail out with an error.
Note that map updates are not affected by this issue. BPF verifier does not allow updating sockmap/sockhash from a BPF tracing program today.
--- net/core/sock_map.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/core/sock_map.c +6 -0
@@ -411,6 +411,9 @@ static int __sock_map_delete(struct bpf_struct sock *sk;int err =0 ; +if (irqs_disabled ()) +return -EOPNOTSUPP ;/* locks here are hardirq-unsafe */ +spin_lock_bh (&stab->lock); sk = *psk;if (!sk_test || sk_test == sk)
@@ -933,6 +936,9 @@ static long sock_hash_delete_elem(structstruct bpf_shtab_elem *elem;int ret = -ENOENT ; +if (irqs_disabled ()) +return -EOPNOTSUPP ;/* locks here are hardirq-unsafe */ + hash =sock_hash_bucket_hash (key, key_size); bucket =sock_hash_select_bucket (htab, hash);
Greg Kroah-Hartman
maintainerPATCH 94/273 mptcp: prevent BPF accessing lowat from a subflow socket.
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit fcf4692fa39e86a590c14a4af2de704e1d20a3b5 upstream.
Alexei reported the following splat:
WARNING: CPU: 32 PID: 3276 at net/mptcp/subflow.c:1430 subflow_data_ready+0x147/0x1c0 Modules linked in: dummy bpf_testmod(O) [last unloaded: bpf_test_no_cfi(O)] CPU: 32 PID: 3276 Comm: test_progs Tainted: GO 6.8.0-12873-g2c43c33bfd23 Call Trace: <TASK> mptcp_set_rcvlowat+0x79/0x1d0 sk_setsockopt+0x6c0/0x1540 __bpf_setsockopt+0x6f/0x90 bpf_sock_ops_setsockopt+0x3c/0x90 bpf_prog_509ce5db2c7f9981_bpf_test_sockopt_int+0xb4/0x11b bpf_prog_dce07e362d941d2b_bpf_test_socket_sockopt+0x12b/0x132 bpf_prog_348c9b5faaf10092_skops_sockopt+0x954/0xe86 __cgroup_bpf_run_filter_sock_ops+0xbc/0x250 tcp_connect+0x879/0x1160 tcp_v6_connect+0x50c/0x870 mptcp_connect+0x129/0x280 __inet_stream_connect+0xce/0x370 inet_stream_connect+0x36/0x50 bpf_trampoline_6442491565+0x49/0xef inet_stream_connect+0x5/0x50 __sys_connect+0x63/0x90 __x64_sys_connect+0x14/0x20
The root cause of the issue is that bpf allows accessing mptcp-level proto_ops from a tcp subflow scope.
Fix the issue detecting the problematic call and preventing any action.
--- net/mptcp/sockopt.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mptcp/sockopt.c +4 -0
@@ -1500,6 +1500,10 @@ int mptcp_set_rcvlowat(struct sock *sk,struct mptcp_subflow_context *subflow;int space, cap; +/* bpf can land here with a wrong sk type */ +if (sk->sk_protocol ==IPPROTO_TCP ) +return -EINVAL ; +if (sk->sk_userlocks &SOCK_RCVBUF_LOCK ) cap = sk->sk_rcvbuf >>1 ;else
Greg Kroah-Hartman
maintainerPATCH 95/273 x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit 0e110732473e14d6520e49d75d2c88ef7d46fe67 upstream.
The srso_alias_untrain_ret() dummy thunk in the !CONFIG_MITIGATION_SRSO case is there only for the altenative in CALL_UNTRAIN_RET to have a symbol to resolve.
However, testing with kernels which don't have CONFIG_MITIGATION_SRSO enabled, leads to the warning in patch_return() to fire:
missing return thunk: srso_alias_untrain_ret+0x0/0x10-0x0: eb 0e 66 66 2e
WARNING: CPU: 0 PID: 0 at arch/x86/kernel/alternative.c:826 apply_returns (arch/x86/kernel/alternative.c:826
Put in a plain "ret" there so that gcc doesn't put a return thunk in in its place which special and gets checked.
In addition:
ERROR: modpost: "srso_alias_untrain_ret" [arch/x86/kvm/kvm-amd.ko] undefined! make[2]: *** [scripts/Makefile.modpost:145: Module.symvers] Chyba 1 make[1]: *** [/usr/src/linux-6.8.3/Makefile:1873: modpost] Chyba 2
make: *** [Makefile:240: __sub-make] Chyba 2
since !SRSO builds would use the dummy return thunk as reported by [email protected], https://bugzilla.kernel.org/show_bug.cgi?id=218679.
--- arch/x86/lib/retpoline.S | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/lib/retpoline.S +4 -1
@@ -229,8 +229,11 @@ SYM_CODE_END(srso_return_thunk) #define JMP_SRSO_UNTRAIN_RET "ud2" /* Dummy for the alternative in CALL_UNTRAIN_RET. */ SYM_CODE_START(srso_alias_untrain_ret) - RET + ANNOTATE_UNRET_SAFE + ret + int3 SYM_FUNC_END(srso_alias_untrain_ret) +__EXPORT_THUNK(srso_alias_untrain_ret) #endif /* CONFIG_CPU_SRSO */ #ifdef CONFIG_CPU_UNRET_ENTRY
Greg Kroah-Hartman
maintainerPATCH 96/273 KVM: arm64: Use TLBI_TTL_UNKNOWN in __kvm_tlb_flush_vmid_range()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 0f0ff097bf77663b8d2692e33d56119947611bb0 upstream.
Commit c910f2b65518 ("arm64/mm: Update tlb invalidation routines for FEAT_LPA2") updated the __tlbi_level() macro to take the target level as an argument, with TLBI_TTL_UNKNOWN (rather than 0) indicating that the caller cannot provide level information. Unfortunately, the two implementations of __kvm_tlb_flush_vmid_range() were not updated and so now ask for an level 0 invalidation if FEAT_LPA2 is implemented.
Fix the problem by passing TLBI_TTL_UNKNOWN instead of 0 as the level argument to __flush_s2_tlb_range_op() in __kvm_tlb_flush_vmid_range().
--- arch/arm64/kvm/hyp/nvhe/tlb.c | 3 ++- arch/arm64/kvm/hyp/vhe/tlb.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
arch/arm64/kvm/hyp/nvhe/tlb.c +2 -1
@@ -154,7 +154,8 @@ void __kvm_tlb_flush_vmid_range(struct k/* Switch to requested VMID */ __tlb_switch_to_guest (mmu, &cxt, false); -__flush_s2_tlb_range_op (ipas2e1is, start, pages, stride,0 ); +__flush_s2_tlb_range_op (ipas2e1is, start, pages, stride, +TLBI_TTL_UNKNOWN );dsb (ish);__tlbi (vmalle1is);
arch/arm64/kvm/hyp/vhe/tlb.c +2 -1
@@ -171,7 +171,8 @@ void __kvm_tlb_flush_vmid_range(struct k/* Switch to requested VMID */ __tlb_switch_to_guest (mmu, &cxt); -__flush_s2_tlb_range_op (ipas2e1is, start, pages, stride,0 ); +__flush_s2_tlb_range_op (ipas2e1is, start, pages, stride, +TLBI_TTL_UNKNOWN );dsb (ish);__tlbi (vmalle1is);
Greg Kroah-Hartman
maintainerPATCH 97/273 KVM: arm64: Ensure target address is granule-aligned for range TLBI
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 4c36a156738887c1edd78589fe192d757989bcde upstream.
When zapping a table entry in stage2_try_break_pte(), we issue range TLB invalidation for the region that was mapped by the table. However, we neglect to align the base address down to the granule size and so if we ended up reaching the table entry via a misaligned address then we will accidentally skip invalidation for some prefix of the affected address range.
Align 'ctx->addr' down to the granule size when performing TLB invalidation for an unmapped table in stage2_try_break_pte().
--- arch/arm64/kvm/hyp/pgtable.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
arch/arm64/kvm/hyp/pgtable.c +7 -4
@@ -829,12 +829,15 @@ static bool stage2_try_break_pte(const s* Perform the appropriate TLB invalidation based on the * evicted pte value (if any). */ -if (kvm_pte_table (ctx->old, ctx->level)) -kvm_tlb_flush_vmid_range (mmu, ctx->addr, -kvm_granule_size (ctx->level)); -else if (kvm_pte_valid (ctx->old)) +if (kvm_pte_table (ctx->old, ctx->level)) { +u64 size =kvm_granule_size (ctx->level); +u64 addr =ALIGN_DOWN (ctx->addr, size); + +kvm_tlb_flush_vmid_range (mmu, addr, size); + }else if (kvm_pte_valid (ctx->old)) {kvm_call_hyp (__kvm_tlb_flush_vmid_ipa, mmu, ctx->addr, ctx->level); + } }if (stage2_pte_is_counted (ctx->old))
Greg Kroah-Hartman
maintainerPATCH 98/273 net/sched: act_skbmod: prevent kernel-infoleak
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit d313eb8b77557a6d5855f42d2234bd592c7b50dd upstream.
syzbot found that tcf_skbmod_dump() was copying four bytes from kernel stack to user space [1].
The issue here is that 'struct tc_skbmod' has a four bytes hole.
We need to clear the structure before filling fields.
[1]
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 copy_to_iter include/linux/uio.h:196 [inline] simple_copy_to_iter net/core/datagram.c:532 [inline] __skb_datagram_iter+0x185/0x1000 net/core/datagram.c:420 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:4050 [inline] netlink_recvmsg+0x432/0x1610 net/netlink/af_netlink.c:1962 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x2c4/0x340 net/socket.c:1068 __sys_recvfrom+0x35a/0x5f0 net/socket.c:2242 __do_sys_recvfrom net/socket.c:2260 [inline] __se_sys_recvfrom net/socket.c:2256 [inline] __x64_sys_recvfrom+0x126/0x1d0 net/socket.c:2256 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was stored to memory at:
pskb_expand_head+0x30f/0x19d0 net/core/skbuff.c:2253 netlink_trim+0x2c2/0x330 net/netlink/af_netlink.c:1317 netlink_unicast+0x9f/0x1260 net/netlink/af_netlink.c:1351 nlmsg_unicast include/net/netlink.h:1144 [inline] nlmsg_notify+0x21d/0x2f0 net/netlink/af_netlink.c:2610 rtnetlink_send+0x73/0x90 net/core/rtnetlink.c:741 rtnetlink_maybe_send include/linux/rtnetlink.h:17 [inline] tcf_add_notify net/sched/act_api.c:2048 [inline] tcf_action_add net/sched/act_api.c:2071 [inline] tc_ctl_action+0x146e/0x19d0 net/sched/act_api.c:2119 rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6613 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was stored to memory at:
__nla_put lib/nlattr.c:1041 [inline] nla_put+0x1c6/0x230 lib/nlattr.c:1099 tcf_skbmod_dump+0x23f/0xc20 net/sched/act_skbmod.c:256 tcf_action_dump_old net/sched/act_api.c:1191 [inline] tcf_action_dump_1+0x85e/0x970 net/sched/act_api.c:1227 tcf_action_dump+0x1fd/0x460 net/sched/act_api.c:1251 tca_get_fill+0x519/0x7a0 net/sched/act_api.c:1628 tcf_add_notify_msg net/sched/act_api.c:2023 [inline] tcf_add_notify net/sched/act_api.c:2042 [inline] tcf_action_add net/sched/act_api.c:2071 [inline] tc_ctl_action+0x1365/0x19d0 net/sched/act_api.c:2119 rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6613 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Local variable opt created at:
tcf_skbmod_dump+0x9d/0xc20 net/sched/act_skbmod.c:244 tcf_action_dump_old net/sched/act_api.c:1191 [inline] tcf_action_dump_1+0x85e/0x970 net/sched/act_api.c:1227
Bytes 188-191 of 248 are uninitialized Memory access of size 248 starts at ffff888117697680 Data copied to user address 00007ffe56d855f0
--- net/sched/act_skbmod.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/sched/act_skbmod.c +5 -5
@@ -241,13 +241,13 @@ static int tcf_skbmod_dump(struct sk_bufstruct tcf_skbmod *d =to_skbmod (a);unsigned char *b =skb_tail_pointer (skb);struct tcf_skbmod_params *p; -struct tc_skbmod opt = { - .index = d->tcf_index, - .refcnt =refcount_read (&d->tcf_refcnt) - ref, - .bindcnt =atomic_read (&d->tcf_bindcnt) - bind, - }; +struct tc_skbmod opt;struct tcf_t t; +memset (&opt,0 ,sizeof (opt)); + opt.index = d->tcf_index; + opt.refcnt =refcount_read (&d->tcf_refcnt) - ref, + opt.bindcnt =atomic_read (&d->tcf_bindcnt) - bind;spin_lock_bh (&d->tcf_lock); opt.action = d->tcf_action; p = rcu_dereference_protected(d->skbmod_p,
Greg Kroah-Hartman
maintainerPATCH 99/273 net: dsa: sja1105: Fix parameters order in sja1110_pcs_mdio_write_c45()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
commit c120209bce34c49dcaba32f15679574327d09f63 upstream.
The definition and declaration of sja1110_pcs_mdio_write_c45() don't have parameters in the same order.
Knowing that sja1110_pcs_mdio_write_c45() is used as a function pointer in 'sja1105_info' structure with .pcs_mdio_write_c45, and that we have:
int (*pcs_mdio_write_c45)(struct mii_bus *bus, int phy, int mmd,
int reg, u16 val);
it is likely that the definition is the one to change.
Found with cppcheck, funcArgOrderDifferent.
--- drivers/net/dsa/sja1105/sja1105_mdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/sja1105/sja1105_mdio.c +1 -1
@@ -94,7 +94,7 @@ int sja1110_pcs_mdio_read_c45(struct miireturn tmp &0xffff ; } -int sja1110_pcs_mdio_write_c45 (struct mii_bus *bus,int phy,int reg,int mmd, +int sja1110_pcs_mdio_write_c45 (struct mii_bus *bus,int phy,int mmd,int reg,u16 val) {struct sja1105_mdio_private *mdio_priv = bus->priv;
Greg Kroah-Hartman
maintainerPATCH 100/273 net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 7eb322360b0266481e560d1807ee79e0cef5742b upstream.
qdisc_tree_reduce_backlog() is called with the qdisc lock held, not RTNL.
We must use qdisc_lookup_rcu() instead of qdisc_lookup()
syzbot reported:
WARNING: suspicious RCU usage
6.1.74-syzkaller #0 Not tainted
-----------------------------net/sched/sch_api.c:305 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
3 locks held by udevd/1142:
#0: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:306 [inline] #0: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline] #0: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: net_tx_action+0x64a/0x970 net/core/dev.c:5282 #1: ffff888171861108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:350 [inline] #1: ffff888171861108 (&sch->q.lock){+.-.}-{2:2}, at: net_tx_action+0x754/0x970 net/core/dev.c:5297 #2: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:306 [inline] #2: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline] #2: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: qdisc_tree_reduce_backlog+0x84/0x580 net/sched/sch_api.c:792
stack backtrace: CPU: 1 PID: 1142 Comm: udevd Not tainted 6.1.74-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: <TASK> [<ffffffff85b85f14>] __dump_stack lib/dump_stack.c:88 [inline] [<ffffffff85b85f14>] dump_stack_lvl+0x1b1/0x28f lib/dump_stack.c:106 [<ffffffff85b86007>] dump_stack+0x15/0x1e lib/dump_stack.c:113 [<ffffffff81802299>] lockdep_rcu_suspicious+0x1b9/0x260 kernel/locking/lockdep.c:6592 [<ffffffff84f0054c>] qdisc_lookup+0xac/0x6f0 net/sched/sch_api.c:305 [<ffffffff84f037c3>] qdisc_tree_reduce_backlog+0x243/0x580 net/sched/sch_api.c:811 [<ffffffff84f5b78c>] pfifo_tail_enqueue+0x32c/0x4b0 net/sched/sch_fifo.c:51 [<ffffffff84fbcf63>] qdisc_enqueue include/net/sch_generic.h:833 [inline] [<ffffffff84fbcf63>] netem_dequeue+0xeb3/0x15d0 net/sched/sch_netem.c:723 [<ffffffff84eecab9>] dequeue_skb net/sched/sch_generic.c:292 [inline] [<ffffffff84eecab9>] qdisc_restart net/sched/sch_generic.c:397 [inline] [<ffffffff84eecab9>] __qdisc_run+0x249/0x1e60 net/sched/sch_generic.c:415 [<ffffffff84d7aa96>] qdisc_run+0xd6/0x260 include/net/pkt_sched.h:125 [<ffffffff84d85d29>] net_tx_action+0x7c9/0x970 net/core/dev.c:5313 [<ffffffff85e002bd>] __do_softirq+0x2bd/0x9bd kernel/softirq.c:616 [<ffffffff81568bca>] invoke_softirq kernel/softirq.c:447 [inline] [<ffffffff81568bca>] __irq_exit_rcu+0xca/0x230 kernel/softirq.c:700 [<ffffffff81568ae9>] irq_exit_rcu+0x9/0x20 kernel/softirq.c:712 [<ffffffff85b89f52>] sysvec_apic_timer_interrupt+0x42/0x90 arch/x86/kernel/apic/apic.c:1107 [<ffffffff85c00ccb>] asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:656
--- net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_api.c +1 -1
@@ -809,7 +809,7 @@ void qdisc_tree_reduce_backlog(struct Qd notify = !sch->q.qlen && !WARN_ON_ONCE (!n && !qdisc_is_offloaded);/* TODO: perform the search on a per txq basis */ - sch =qdisc_lookup (qdisc_dev (sch),TC_H_MAJ (parentid)); + sch =qdisc_lookup_rcu (qdisc_dev (sch),TC_H_MAJ (parentid));if (sch ==NULL ) {WARN_ON_ONCE (parentid !=TC_H_ROOT );break ;
Greg Kroah-Hartman
maintainerPATCH 101/273 net: stmmac: fix rx queue priority assignment
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piotr Wejman <[email protected]>
commit b3da86d432b7cd65b025a11f68613e333d2483db upstream.
The driver should ensure that same priority is not mapped to multiple rx queues. From DesignWare Cores Ethernet Quality-of-Service Databook, section 17.1.29 MAC_RxQ_Ctrl2:
"[...]The software must ensure that the content of this field is mutually exclusive to the PSRQ fields for other queues, that is, the same priority is not mapped to multiple Rx queues[...]"
Previously rx_queue_priority() function was:
- clearing all priorities from a queue
- adding new priorities to that queue
After this patch it will:
- first assign new priorities to a queue
- then remove those priorities from all other queues
- keep other priorities previously assigned to that queue
--- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 40 +++++++++++++++----- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 38 +++++++++++++++---- 2 files changed, 62 insertions(+), 16 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +31 -9
@@ -92,19 +92,41 @@ static void dwmac4_rx_queue_priority(str u32 prio, u32 queue) { void __iomem *ioaddr = hw->pcsr; -u32 base_register; -u32 value; +u32 clear_mask =0 ; +u32 ctrl2, ctrl3; +int i; - base_register = (queue <4 ) ?GMAC_RXQ_CTRL2 :GMAC_RXQ_CTRL3 ; -if (queue >=4 ) - queue -=4 ; + ctrl2 =readl (ioaddr +GMAC_RXQ_CTRL2 ); + ctrl3 =readl (ioaddr +GMAC_RXQ_CTRL3 ); + +/* The software must ensure that the same priority +* is not mapped to multiple Rx queues +*/ +for (i =0 ; i <4 ; i++) + clear_mask |= ((prio <<GMAC_RXQCTRL_PSRQX_SHIFT (i)) & +GMAC_RXQCTRL_PSRQX_MASK (i)); - value =readl (ioaddr + base_register); + ctrl2 &= ~clear_mask; + ctrl3 &= ~clear_mask; - value &= ~GMAC_RXQCTRL_PSRQX_MASK (queue); - value |= (prio <<GMAC_RXQCTRL_PSRQX_SHIFT (queue)) & +/* First assign new priorities to a queue, then +* clear them from others queues +*/ +if (queue <4 ) { + ctrl2 |= (prio <<GMAC_RXQCTRL_PSRQX_SHIFT (queue)) &GMAC_RXQCTRL_PSRQX_MASK (queue); -writel (value, ioaddr + base_register); + +writel (ctrl2, ioaddr +GMAC_RXQ_CTRL2 ); +writel (ctrl3, ioaddr +GMAC_RXQ_CTRL3 ); + }else { + queue -=4 ; + + ctrl3 |= (prio <<GMAC_RXQCTRL_PSRQX_SHIFT (queue)) & +GMAC_RXQCTRL_PSRQX_MASK (queue); + +writel (ctrl3, ioaddr +GMAC_RXQ_CTRL3 ); +writel (ctrl2, ioaddr +GMAC_RXQ_CTRL2 ); + } } static void dwmac4_tx_queue_priority(struct mac_device_info *hw,
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +31 -7
@@ -105,17 +105,41 @@ static void dwxgmac2_rx_queue_prio(struc u32 queue) {void __iomem *ioaddr = hw->pcsr; -u32 value, reg; +u32 clear_mask =0 ; +u32 ctrl2, ctrl3; +int i; - reg = (queue <4 ) ?XGMAC_RXQ_CTRL2 :XGMAC_RXQ_CTRL3 ; -if (queue >=4 ) + ctrl2 =readl (ioaddr +XGMAC_RXQ_CTRL2 ); + ctrl3 =readl (ioaddr +XGMAC_RXQ_CTRL3 ); + +/* The software must ensure that the same priority +* is not mapped to multiple Rx queues +*/ +for (i =0 ; i <4 ; i++) + clear_mask |= ((prio <<XGMAC_PSRQ_SHIFT (i)) & +XGMAC_PSRQ (i)); + + ctrl2 &= ~clear_mask; + ctrl3 &= ~clear_mask; + +/* First assign new priorities to a queue, then +* clear them from others queues +*/ +if (queue <4 ) { + ctrl2 |= (prio <<XGMAC_PSRQ_SHIFT (queue)) & +XGMAC_PSRQ (queue); + +writel (ctrl2, ioaddr +XGMAC_RXQ_CTRL2 ); +writel (ctrl3, ioaddr +XGMAC_RXQ_CTRL3 ); + }else { queue -=4 ; - value =readl (ioaddr + reg); - value &= ~XGMAC_PSRQ (queue); - value |= (prio <<XGMAC_PSRQ_SHIFT (queue)) &XGMAC_PSRQ (queue); + ctrl3 |= (prio <<XGMAC_PSRQ_SHIFT (queue)) & +XGMAC_PSRQ (queue); -writel (value, ioaddr + reg); +writel (ctrl3, ioaddr +XGMAC_RXQ_CTRL3 ); +writel (ctrl2, ioaddr +XGMAC_RXQ_CTRL2 ); + } } static void dwxgmac2_tx_queue_prio(struct mac_device_info *hw, u32 prio,
Greg Kroah-Hartman
maintainerPATCH 102/273 net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
commit de99e1ea3a35f23ff83a31d6b08f43d27b2c6345 upstream.
There are 2 issues with the blamed commit.
1. When the phy is initialized, it would enable the disabled of UDPv4 checksums. The UDPv6 checksum is already enabled by default. So when 1-step is configured then it would clear these flags.
2. After the 1-step is configured, then if 2-step is configured then the 1-step would be still configured because it is not clearing the flag. So the sync frames will still have origin timestamps set.
Fix this by reading first the value of the register and then just change bit 12 as this one determines if the timestamp needs to be inserted in the frame, without changing any other bits.
--- drivers/net/phy/micrel.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/phy/micrel.c +8 -2
@@ -2416,6 +2416,7 @@ static int lan8814_hwtstamp(struct mii_tstruct lan8814_ptp_rx_ts *rx_ts, *tmp;int txcfg =0 , rxcfg =0 ;int pkt_ts_enable; +int tx_mod; ptp_priv->hwts_tx_type = config->tx_type; ptp_priv->rx_filter = config->rx_filter;
@@ -2462,9 +2463,14 @@ static int lan8814_hwtstamp(struct mii_tlanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_RX_TIMESTAMP_EN , pkt_ts_enable);lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_TIMESTAMP_EN , pkt_ts_enable); -if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ONESTEP_SYNC ) + tx_mod =lanphy_read_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD ); +if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ONESTEP_SYNC ) {lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , -PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); + tx_mod |PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); + }else if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ON ) { +lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , + tx_mod & ~PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); + }if (config->rx_filter !=HWTSTAMP_FILTER_NONE )lan8814_config_ts_intr (ptp_priv->phydev, true);
Greg Kroah-Hartman
maintainerPATCH 103/273 net: txgbe: fix i2c dev name cannot match clkdev
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duanqiang Wen <[email protected]>
commit c644920ce9220d83e070f575a4df711741c07f07 upstream.
txgbe clkdev shortened clk_name, so i2c_dev info_name also need to shorten. Otherwise, i2c_dev cannot initialize clock.
--- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c +5 -3
@@ -20,6 +20,8 @@#include "txgbe_phy.h" #include "txgbe_hw.h" +#define TXGBE_I2C_CLK_DEV_NAME "i2c_dw" +static int txgbe_swnodes_register (struct txgbe *txgbe) {struct txgbe_nodes *nodes = &txgbe->nodes;
@@ -556,8 +558,8 @@ static int txgbe_clock_register(struct tchar clk_name[32 ];struct clk *clk; -snprintf (clk_name,sizeof (clk_name),"i2c_dw.%d" , -pci_dev_id (pdev)); +snprintf (clk_name,sizeof (clk_name),"%s.%d" , +TXGBE_I2C_CLK_DEV_NAME ,pci_dev_id (pdev)); clk =clk_register_fixed_rate (NULL , clk_name,NULL ,0 ,156250000 );if (IS_ERR (clk))
@@ -619,7 +621,7 @@ static int txgbe_i2c_register(struct txg info.parent = &pdev->dev; info.fwnode =software_node_fwnode (txgbe->nodes.group[SWNODE_I2C ]); - info.name ="i2c_designware" ; + info.name =TXGBE_I2C_CLK_DEV_NAME ; info.id =pci_dev_id (pdev); info.res = &DEFINE_RES_IRQ (pdev->irq);
Greg Kroah-Hartman
maintainerPATCH 104/273 net: fec: Set mac_managed_pm during probe
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
commit cbc17e7802f5de37c7c262204baadfad3f7f99e5 upstream.
Setting mac_managed_pm during interface up is too late.
In situations where the link is not brought up yet and the system suspends the regular PHY power management will run. Since the FEC ETHEREN control bit is cleared (automatically) on suspend the controller is off in resume. When the regular PHY power management resume path runs in this context it will write to the MII_DATA register but nothing will be transmitted on the MDIO bus.
This can be observed by the following log:
fec 5b040000.ethernet eth0: MDIO read timeout
Microchip LAN87xx T1 5b040000.ethernet-1:04: PM: dpm_run_callback(): mdio_bus_phy_resume+0x0/0xc8 returns -110
Microchip LAN87xx T1 5b040000.ethernet-1:04: PM: failed to resume: error -110The data written will however remain in the MII_DATA register.
When the link later is set to administrative up it will trigger a call to fec_restart() which will restore the MII_SPEED register. This triggers the quirk explained in f166f890c8f0 ("net: ethernet: fec: Replace interrupt driven MDIO with polled IO") causing an extra MII_EVENT.
This extra event desynchronizes all the MDIO register reads, causing them to complete too early. Leading all reads to read as 0 because fec_enet_mdio_wait() returns too early.
When a Microchip LAN8700R PHY is connected to the FEC, the 0 reads causes the PHY to be initialized incorrectly and the PHY will not transmit any ethernet signal in this state. It cannot be brought out of this state without a power cycle of the PHY.
--- drivers/net/ethernet/freescale/fec_main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/fec_main.c +9 -2
@@ -2406,8 +2406,6 @@ static int fec_enet_mii_probe(struct net fep->link =0 ; fep->full_duplex =0 ; - phy_dev->mac_managed_pm = true; -phy_attached_info (phy_dev);return 0 ;
@@ -2419,10 +2417,12 @@ static int fec_enet_mii_init(struct platstruct net_device *ndev =platform_get_drvdata (pdev);struct fec_enet_private *fep =netdev_priv (ndev);bool suppress_preamble = false; +struct phy_device *phydev;struct device_node *node;int err = -ENXIO ;u32 mii_speed, holdtime;u32 bus_freq; +int addr;/* * The i.MX28 dual fec interfaces are not equal.
@@ -2536,6 +2536,13 @@ static int fec_enet_mii_init(struct plat goto err_out_free_mdiobus;of_node_put (node); +/* find all the PHY devices on the bus and set mac_managed_pm to true */ +for (addr =0 ; addr <PHY_MAX_ADDR ; addr++) { + phydev =mdiobus_get_phy (fep->mii_bus, addr); +if (phydev) + phydev->mac_managed_pm = true; + } + mii_cnt++;/* save fec0 mii_bus */
Greg Kroah-Hartman
maintainerPATCH 105/273 net: phy: micrel: Fix potential null pointer dereference
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
commit 96c155943a703f0655c0c4cab540f67055960e91 upstream.
In lan8814_get_sig_rx() and lan8814_get_sig_tx() ptp_parse_header() may return NULL as ptp_header due to abnormal packet type or corrupted packet. Fix this bug by adding ptp_header check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/phy/micrel.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
drivers/net/phy/micrel.c +16 -5
@@ -2528,7 +2528,7 @@ static void lan8814_txtstamp(struct mii_ } } -static void lan8814_get_sig_rx (struct sk_buff *skb,u16 *sig) +static bool lan8814_get_sig_rx (struct sk_buff *skb,u16 *sig) {struct ptp_header *ptp_header;u32 type;
@@ -2538,7 +2538,11 @@ static void lan8814_get_sig_rx(struct sk ptp_header =ptp_parse_header (skb, type);skb_pull_inline (skb,ETH_HLEN ); +if (!ptp_header) +return false; + *sig = (__force u16)(ntohs (ptp_header->sequence_id)); +return true; } static bool lan8814_match_rx_skb(struct kszphy_ptp_priv *ptp_priv,
@@ -2550,7 +2554,8 @@ static bool lan8814_match_rx_skb(structbool ret = false;u16 skb_sig; -lan8814_get_sig_rx (skb, &skb_sig); +if (!lan8814_get_sig_rx (skb, &skb_sig)) +return ret;/* Iterate over all RX timestamps and match it with the received skbs */ spin_lock_irqsave (&ptp_priv->rx_ts_lock, flags);
@@ -2830,7 +2835,7 @@ static int lan8814_ptpci_adjfine(structreturn 0 ; } -static void lan8814_get_sig_tx (struct sk_buff *skb,u16 *sig) +static bool lan8814_get_sig_tx (struct sk_buff *skb,u16 *sig) {struct ptp_header *ptp_header;u32 type;
@@ -2838,7 +2843,11 @@ static void lan8814_get_sig_tx(struct sk type =ptp_classify_raw (skb); ptp_header =ptp_parse_header (skb, type); +if (!ptp_header) +return false; + *sig = (__force u16)(ntohs (ptp_header->sequence_id)); +return true; } static void lan8814_match_tx_skb(struct kszphy_ptp_priv *ptp_priv,
@@ -2852,7 +2861,8 @@ static void lan8814_match_tx_skb(structspin_lock_irqsave (&ptp_priv->tx_queue.lock, flags); skb_queue_walk_safe(&ptp_priv->tx_queue, skb, skb_tmp) { -lan8814_get_sig_tx (skb, &skb_sig); +if (!lan8814_get_sig_tx (skb, &skb_sig)) +continue ;if (memcmp (&skb_sig, &seq_id,sizeof (seq_id)))continue ;
@@ -2906,7 +2916,8 @@ static bool lan8814_match_skb(struct kszspin_lock_irqsave (&ptp_priv->rx_queue.lock, flags); skb_queue_walk_safe(&ptp_priv->rx_queue, skb, skb_tmp) { -lan8814_get_sig_rx (skb, &skb_sig); +if (!lan8814_get_sig_rx (skb, &skb_sig)) +continue ;if (memcmp (&skb_sig, &rx_ts->seq_id,sizeof (rx_ts->seq_id)))continue ;
Greg Kroah-Hartman
maintainerPATCH 106/273 net: dsa: mv88e6xxx: fix usable ports on 88e6020
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Krummsdorf <[email protected]>
commit 625aefac340f45a4fc60908da763f437599a0d6f upstream.
The switch has 4 ports with 2 internal PHYs, but ports are numbered up to 6, with ports 0, 1, 5 and 6 being usable.
--- drivers/net/dsa/mv88e6xxx/chip.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx/chip.c +5 -1
@@ -5500,8 +5500,12 @@ static const struct mv88e6xxx_info mv88e .family = MV88E6XXX_FAMILY_6250, .name = "Marvell 88E6020", .num_databases = 64, - .num_ports = 4, +/* Ports 2-4 are not routed to pins +* => usable ports 0, 1, 5, 6 +*/ + .num_ports = 7, .num_internal_phys = 2, + .invalid_port_mask = BIT(2) | BIT(3) | BIT(4), .max_vid = 4095, .port_base_addr = 0x8, .phy_base_addr = 0x0,
Greg Kroah-Hartman
maintainerPATCH 107/273 selftests: net: gro fwd: update vxlan GRO test expectations
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoine Tenart <[email protected]>
commit 0fb101be97ca27850c5ecdbd1269423ce4d1f607 upstream.
UDP tunnel packets can't be GRO in-between their endpoints as this causes different issues. The UDP GRO fwd vxlan tests were relying on this and their expectations have to be fixed.
We keep both vxlan tests and expected no GRO from happening. The vxlan UDP GRO bench test was removed as it's not providing any valuable information now.
--- tools/testing/selftests/net/udpgro_fwd.sh | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
tools/testing/selftests/net/udpgro_fwd.sh +2 -8
@@ -241,7 +241,7 @@ for family in 4 6; do create_vxlan_pair ip netns exec $NS_DST ethtool -K veth$DST rx-gro-list on - run_test "GRO frag list over UDP tunnel" $OL_NET$DST 1 1 + run_test "GRO frag list over UDP tunnel" $OL_NET$DST 10 10 cleanup # use NAT to circumvent GRO FWD check
@@ -254,13 +254,7 @@ for family in 4 6; do # load arp cache before running the test to reduce the amount of # stray traffic on top of the UDP tunnel ip netns exec $NS_SRC $PING -q -c 1 $OL_NET$DST_NAT >/dev/null - run_test "GRO fwd over UDP tunnel" $OL_NET$DST_NAT 1 1 $OL_NET$DST - cleanup - - create_vxlan_pair - run_bench "UDP tunnel fwd perf" $OL_NET$DST - ip netns exec $NS_DST ethtool -K veth$DST rx-udp-gro-forwarding on - run_bench "UDP tunnel GRO fwd perf" $OL_NET$DST + run_test "GRO fwd over UDP tunnel" $OL_NET$DST_NAT 10 10 $OL_NET$DST cleanup done
Greg Kroah-Hartman
maintainerPATCH 108/273 gro: fix ownership transfer
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoine Tenart <[email protected]>
commit ed4cccef64c1d0d5b91e69f7a8a6697c3a865486 upstream.
If packets are GROed with fraglist they might be segmented later on and continue their journey in the stack. In skb_segment_list those skbs can be reused as-is. This is an issue as their destructor was removed in skb_gro_receive_list but not the reference to their socket, and then they can't be orphaned. Fix this by also removing the reference to the socket.
For example this could be observed,
kernel BUG at include/linux/skbuff.h:3131! (skb_orphan)
RIP: 0010:ip6_rcv_core+0x11bc/0x19a0 Call Trace: ipv6_list_rcv+0x250/0x3f0 __netif_receive_skb_list_core+0x49d/0x8f0 netif_receive_skb_list_internal+0x634/0xd40 napi_complete_done+0x1d2/0x7d0 gro_cell_poll+0x118/0x1f0
A similar construction is found in skb_gro_receive, apply the same change there.
--- net/core/gro.c | 3 ++- net/ipv4/udp_offload.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/core/gro.c +2 -1
@@ -195,8 +195,9 @@ int skb_gro_receive(struct sk_buff *p, s } merge: -/* sk owenrship - if any - completely transferred to the aggregated packet */ +/* sk ownership - if any - completely transferred to the aggregated packet */ skb->destructor =NULL ; + skb->sk =NULL ; delta_truesize = skb->truesize;if (offset > headlen) {unsigned int eat = offset - headlen;
net/ipv4/udp_offload.c +2 -1
@@ -449,8 +449,9 @@ static int skb_gro_receive_list(struct sNAPI_GRO_CB (p)->count++; p->data_len += skb->len; -/* sk owenrship - if any - completely transferred to the aggregated packet */ +/* sk ownership - if any - completely transferred to the aggregated packet */ skb->destructor =NULL ; + skb->sk =NULL ; p->truesize += skb->truesize; p->len += skb->len;
Greg Kroah-Hartman
maintainerPATCH 109/273 idpf: fix kernel panic on unknown packet types
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Hay <[email protected]>
commit dd19e827d63ac60debf117676d1126bff884bdb8 upstream.
In the very rare case where a packet type is unknown to the driver, idpf_rx_process_skb_fields would return early without calling eth_type_trans to set the skb protocol / the network layer handler. This is especially problematic if tcpdump is running when such a packet is received, i.e. it would cause a kernel panic.
Instead, call eth_type_trans for every single packet, even when the packet type is unknown.
--- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/idpf/idpf_txrx.c +2 -2
@@ -2940,6 +2940,8 @@ static int idpf_rx_process_skb_fields(st rx_ptype =le16_get_bits (rx_desc->ptype_err_fflags0,VIRTCHNL2_RX_FLEX_DESC_ADV_PTYPE_M ); + skb->protocol =eth_type_trans (skb, rxq->vport->netdev); + decoded = rxq->vport->rx_ptype_lkup[rx_ptype];/* If we don't know the ptype we can't do anything else with it. Just * pass it up the stack as-is.
@@ -2950,8 +2952,6 @@ static int idpf_rx_process_skb_fields(st/* process RSS/hash */ idpf_rx_hash (rxq, skb, rx_desc, &decoded); - skb->protocol =eth_type_trans (skb, rxq->vport->netdev); -if (le16_get_bits (rx_desc->hdrlen_flags,VIRTCHNL2_RX_FLEX_DESC_ADV_RSC_M ))return idpf_rx_rsc (rxq, skb, rx_desc, &decoded);
Greg Kroah-Hartman
maintainerPATCH 110/273 ice: fix enabling RX VLAN filtering
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
commit 8edfc7a40e3300fc6c5fa7a3228a24d5bcd86ba5 upstream.
ice_port_vlan_on/off() was introduced in commit 2946204b3fa8 ("ice:
implement bridge port vlan"). But ice_port_vlan_on() incorrectly assigns ena_rx_filtering to inner_vlan_ops in DVM mode.
This causes an error when rx_filtering cannot be enabled in legacy mode.
Reproducer:
echo 1 > /sys/class/net/$PF/device/sriov_numvfs
ip link set $PF vf 0 spoofchk off trust on vlan 3
dmesg:
ice 0000:41:00.0: failed to enable Rx VLAN filtering for VF 0 VSI 9 during VF rebuild, error -95
--- drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c +8 -10
@@ -26,24 +26,22 @@ static void ice_port_vlan_on(struct ice_struct ice_vsi_vlan_ops *vlan_ops;struct ice_pf *pf = vsi->back; -if (ice_is_dvm_ena (&pf->hw)) { - vlan_ops = &vsi->outer_vlan_ops; +/* setup inner VLAN ops */ + vlan_ops = &vsi->inner_vlan_ops; -/* setup outer VLAN ops */ - vlan_ops->set_port_vlan = ice_vsi_set_outer_port_vlan; - vlan_ops->clear_port_vlan = ice_vsi_clear_outer_port_vlan; - -/* setup inner VLAN ops */ - vlan_ops = &vsi->inner_vlan_ops; +if (ice_is_dvm_ena (&pf->hw)) { vlan_ops->add_vlan = noop_vlan_arg; vlan_ops->del_vlan = noop_vlan_arg; vlan_ops->ena_stripping = ice_vsi_ena_inner_stripping; vlan_ops->dis_stripping = ice_vsi_dis_inner_stripping; vlan_ops->ena_insertion = ice_vsi_ena_inner_insertion; vlan_ops->dis_insertion = ice_vsi_dis_inner_insertion; - }else { - vlan_ops = &vsi->inner_vlan_ops; +/* setup outer VLAN ops */ + vlan_ops = &vsi->outer_vlan_ops; + vlan_ops->set_port_vlan = ice_vsi_set_outer_port_vlan; + vlan_ops->clear_port_vlan = ice_vsi_clear_outer_port_vlan; + }else { vlan_ops->set_port_vlan = ice_vsi_set_inner_port_vlan; vlan_ops->clear_port_vlan = ice_vsi_clear_inner_port_vlan; }
Greg Kroah-Hartman
maintainerPATCH 111/273 i40e: Fix VF MAC filter removal
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Vecera <[email protected]>
commit ea2a1cfc3b2019bdea6324acd3c03606b60d71ad upstream.
Commit 73d9629e1c8c ("i40e: Do not allow untrusted VF to remove administratively set MAC") fixed an issue where untrusted VF was allowed to remove its own MAC address although this was assigned administratively from PF. Unfortunately the introduced check is wrong because it causes that MAC filters for other MAC addresses including multi-cast ones are not removed.
<snip>
if (ether_addr_equal(addr, vf->default_lan_addr.addr) &&
i40e_can_vf_change_mac(vf))
was_unimac_deleted = true;
else
continue;
if (i40e_del_mac_filter(vsi, al->list[i].addr)) {
...</snip>
The else path with continue effectively skips any MAC filter removal except one for primary MAC addr when VF is allowed to do so. Fix the check condition so the continue is only done for primary MAC address.
--- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +6 -5
@@ -3143,11 +3143,12 @@ static int i40e_vc_del_mac_addr_msg(stru/* Allow to delete VF primary MAC only if it was not set * administratively by PF or if VF is trusted. */ -if (ether_addr_equal (addr, vf->default_lan_addr.addr) && -i40e_can_vf_change_mac (vf)) - was_unimac_deleted = true; -else -continue ; +if (ether_addr_equal (addr, vf->default_lan_addr.addr)) { +if (i40e_can_vf_change_mac (vf)) + was_unimac_deleted = true; +else +continue ; + }if (i40e_del_mac_filter (vsi, al->list[i].addr)) { ret = -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 112/273 tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses.
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
commit ea111449501ea32bf6da82750de860243691efc7 upstream.
Commit 5e07e672412b ("tcp: Use bhash2 for v4-mapped-v6 non-wildcard address.") introduced bind() regression for v4-mapped-v6 address.
When we bind() the following two addresses on the same port, the 2nd bind() should succeed but fails now.
1. [::] w/ IPV6_ONLY
2. ::ffff:127.0.0.1
After the chagne, v4-mapped-v6 uses bhash2 instead of bhash to detect conflict faster, but I forgot to add a necessary change.
During the 2nd bind(), inet_bind2_bucket_match_addr_any() returns the tb2 bucket of [::], and inet_bhash2_conflict() finally calls inet_bind_conflict(), which returns true, meaning conflict.
inet_bhash2_addr_any_conflict
|- inet_bind2_bucket_match_addr_any <-- return [::] bucket `- inet_bhash2_conflict
`- __inet_bhash2_conflict <-- checks IPV6_ONLY for AF_INET
| but not for v4-mapped-v6 address
`- inet_bind_conflict <-- does not check address
inet_bind_conflict() does not check socket addresses because __inet_bhash2_conflict() is expected to do so.
However, it checks IPV6_V6ONLY attribute only against AF_INET socket, and not for v4-mapped-v6 address.
As a result, v4-mapped-v6 address conflicts with v6-only wildcard address.
To avoid that, let's add the missing test to use bhash2 for v4-mapped-v6 address.
--- net/ipv4/inet_connection_sock.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/ipv4/inet_connection_sock.c +9 -2
@@ -203,8 +203,15 @@ static bool __inet_bhash2_conflict(const struct sock *sk, struct sock *sk2, kuid_t sk_uid, bool relax, bool reuseport_cb_ok, bool reuseport_ok) { - if (sk->sk_family == AF_INET && ipv6_only_sock(sk2)) - return false; + if (ipv6_only_sock(sk2)) { + if (sk->sk_family == AF_INET) + return false; + +#if IS_ENABLED (CONFIG_IPV6 ) +if (ipv6_addr_v4mapped (&sk->sk_v6_rcv_saddr)) +return false; +#endif + }return inet_bind_conflict (sk, sk2, sk_uid, relax, reuseport_cb_ok, reuseport_ok);
Signature · 1 line
2.44.0
Greg Kroah-Hartman
maintainerPATCH 113/273 erspan: make sure erspan_base_hdr is present in skb->head
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 17af420545a750f763025149fa7b833a4fc8b8f0 upstream.
syzbot reported a problem in ip6erspan_rcv() [1]
Issue is that ip6erspan_rcv() (and erspan_rcv()) no longer make sure erspan_base_hdr is present in skb linear part (skb->head) before getting @ver field from it.
Add the missing pskb_may_pull() calls.
v2: Reload iph pointer in erspan_rcv() after pskb_may_pull()
because skb->head might have changed.
[1]
BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2742 [inline] BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2756 [inline] BUG: KMSAN: uninit-value in ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline] BUG: KMSAN: uninit-value in gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610 pskb_may_pull_reason include/linux/skbuff.h:2742 [inline] pskb_may_pull include/linux/skbuff.h:2756 [inline] ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline] gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610 ip6_protocol_deliver_rcu+0x1d4c/0x2ca0 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish+0x955/0x970 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:314 [inline] ipv6_rcv+0xde/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5538 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5652 netif_receive_skb_internal net/core/dev.c:5738 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5798 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1549 tun_get_user+0x5566/0x69e0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb63/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xe0 fs/read_write.c:652 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795 tun_alloc_skb drivers/net/tun.c:1525 [inline] tun_get_user+0x209a/0x69e0 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb63/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xe0 fs/read_write.c:652 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 1 PID: 5045 Comm: syz-executor114 Not tainted 6.9.0-rc1-syzkaller-00021-g962490525cff #0
--- net/ipv4/ip_gre.c | 5 +++++ net/ipv6/ip6_gre.c | 3 +++ 2 files changed, 8 insertions(+)
net/ipv4/ip_gre.c +5 -0
@@ -280,8 +280,13 @@ static int erspan_rcv(struct sk_buff *sk tpi->flags |TUNNEL_NO_KEY , iph->saddr, iph->daddr, 0); }else { +if (unlikely (!pskb_may_pull (skb, + gre_hdr_len +sizeof (*ershdr)))) +return PACKET_REJECT ; + ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len); ver = ershdr->ver; + iph =ip_hdr (skb); tunnel =ip_tunnel_lookup (itn, skb->dev->ifindex, tpi->flags |TUNNEL_KEY , iph->saddr, iph->daddr, tpi->key);
net/ipv6/ip6_gre.c +3 -0
@@ -528,6 +528,9 @@ static int ip6erspan_rcv(struct sk_buffstruct ip6_tnl *tunnel;u8 ver; +if (unlikely (!pskb_may_pull (skb,sizeof (*ershdr)))) +return PACKET_REJECT ; + ipv6h =ipv6_hdr (skb); ershdr = (struct erspan_base_hdr *)skb->data; ver = ershdr->ver;
Greg Kroah-Hartman
maintainerPATCH 114/273 selftests: reuseaddr_conflict: add missing new line at the end of the output
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
commit 31974122cfdeaf56abc18d8ab740d580d9833e90 upstream.
The netdev CI runs in a VM and captures serial, so stdout and stderr get combined. Because there's a missing new line in stderr the test ends up corrupting KTAP:
# Successok 1 selftests: net: reuseaddr_conflict
which should have been:
# Success
ok 1 selftests: net: reuseaddr_conflict
--- tools/testing/selftests/net/reuseaddr_conflict.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/reuseaddr_conflict.c +1 -1
@@ -109,6 +109,6 @@ int main(void) fd1 =open_port (0 ,1 );if (fd1 >=0 )error (1 ,0 ,"Was allowed to create an ipv4 reuseport on an already bound non-reuseport socket with no ipv6" ); -fprintf (stderr,"Success" ); +fprintf (stderr,"Success\n" );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 115/273 tcp: Fix bind() regression for v6-only wildcard and v4(-mapped-v6) non-wildcard addresses.
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
commit d91ef1e1b55f730bee8ce286b02b7bdccbc42973 upstream.
Jianguo Wu reported another bind() regression introduced by bhash2.
Calling bind() for the following 3 addresses on the same port, the 3rd one should fail but now succeeds.
1. 0.0.0.0 or ::ffff:0.0.0.0
2. [::] w/ IPV6_V6ONLY
3. IPv4 non-wildcard address or v4-mapped-v6 non-wildcard address
The first two bind() create tb2 like this:
bhash2 -> tb2(:: w/ IPV6_V6ONLY) -> tb2(0.0.0.0)
The 3rd bind() will match with the IPv6 only wildcard address bucket in inet_bind2_bucket_match_addr_any(), however, no conflicting socket exists in the bucket. So, inet_bhash2_conflict() will returns false, and thus, inet_bhash2_addr_any_conflict() returns false consequently.
As a result, the 3rd bind() bypasses conflict check, which should be done against the IPv4 wildcard address bucket.
So, in inet_bhash2_addr_any_conflict(), we must iterate over all buckets.
Note that we cannot add ipv6_only flag for inet_bind2_bucket as it would confuse the following patetrn.
1. [::] w/ SO_REUSE{ADDR,PORT} and IPV6_V6ONLY
2. [::] w/ SO_REUSE{ADDR,PORT}
3. IPv4 non-wildcard address or v4-mapped-v6 non-wildcard address
The first bind() would create a bucket with ipv6_only flag true, the second bind() would add the [::] socket into the same bucket, and the third bind() could succeed based on the wrong assumption that ipv6_only bucket would not conflict with v4(-mapped-v6) address.
--- net/ipv4/inet_connection_sock.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
net/ipv4/inet_connection_sock.c +12 -9
@@ -294,6 +294,7 @@ static bool inet_bhash2_addr_any_conflicstruct sock_reuseport *reuseport_cb;struct inet_bind_hashbucket *head2;struct inet_bind2_bucket *tb2; +bool conflict = false;bool reuseport_cb_ok;rcu_read_lock ();
@@ -306,18 +307,20 @@ static bool inet_bhash2_addr_any_conflicspin_lock (&head2->lock); -inet_bind_bucket_for_each (tb2, &head2->chain) -if (inet_bind2_bucket_match_addr_any (tb2, net, port, l3mdev, sk)) -break ; - -if (tb2 &&inet_bhash2_conflict (sk, tb2, uid, relax, reuseport_cb_ok, - reuseport_ok)) { -spin_unlock (&head2->lock); -return true; +inet_bind_bucket_for_each (tb2, &head2->chain) { +if (!inet_bind2_bucket_match_addr_any (tb2, net, port, l3mdev, sk)) +continue ; + +if (!inet_bhash2_conflict (sk, tb2, uid, relax, reuseport_cb_ok, reuseport_ok)) +continue ; + + conflict = true; +break ; }spin_unlock (&head2->lock); -return false; + +return conflict; }/*
Greg Kroah-Hartman
maintainerPATCH 116/273 ax25: fix use-after-free bugs caused by ax25_ds_del_timer
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
commit fd819ad3ecf6f3c232a06b27423ce9ed8c20da89 upstream.
When the ax25 device is detaching, the ax25_dev_device_down() calls ax25_ds_del_timer() to cleanup the slave_timer. When the timer handler is running, the ax25_ds_del_timer() that calls del_timer() in it will return directly. As a result, the use-after-free bugs could happen, one of the scenarios is shown below:
(Thread 1) | (Thread 2)
| ax25_ds_timeout()
ax25_dev_device_down() |
ax25_ds_del_timer() |
del_timer() |
ax25_dev_put() //FREE |
| ax25_dev-> //USEIn order to mitigate bugs, when the device is detaching, use timer_shutdown_sync() to stop the timer.
--- net/ax25/ax25_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ax25/ax25_dev.c +1 -1
@@ -105,7 +105,7 @@ void ax25_dev_device_down(struct net_devspin_lock_bh (&ax25_dev_lock);#ifdef CONFIG_AX25_DAMA_SLAVE -ax25_ds_del_timer (ax25_dev); +timer_shutdown_sync (&ax25_dev->dama.slave_timer);#endif /*
Greg Kroah-Hartman
maintainerPATCH 117/273 e1000e: Workaround for sporadic MDI error on Meteor Lake systems
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Lifshits <[email protected]>
commit 6dbdd4de0362c37e54e8b049781402e5a409e7d0 upstream.
On some Meteor Lake systems accessing the PHY via the MDIO interface may result in an MDI error. This issue happens sporadically and in most cases a second access to the PHY via the MDIO interface results in success.
As a workaround, introduce a retry counter which is set to 3 on Meteor Lake systems. The driver will only return an error if 3 consecutive PHY access attempts fail. The retry mechanism is disabled in specific flows, where MDI errors are expected.
--- drivers/net/ethernet/intel/e1000e/hw.h | 2 drivers/net/ethernet/intel/e1000e/ich8lan.c | 33 ++++ drivers/net/ethernet/intel/e1000e/phy.c | 190 +++++++++++++++++----------- drivers/net/ethernet/intel/e1000e/phy.h | 2 4 files changed, 154 insertions(+), 73 deletions(-)
drivers/net/ethernet/intel/e1000e/hw.h +2 -0
@@ -628,6 +628,7 @@ struct e1000_phy_info {u32 id;u32 reset_delay_us;/* in usec */ u32 revision; +u32 retry_count;enum e1000_media_type media_type;
@@ -644,6 +645,7 @@ struct e1000_phy_info {bool polarity_correction;bool speed_downgraded;bool autoneg_wait_to_complete; +bool retry_enabled; };struct e1000_nvm_info {
drivers/net/ethernet/intel/e1000e/ich8lan.c +33 -0
@@ -222,11 +222,18 @@ out:if (hw->mac.type >= e1000_pch_lpt) {/* Only unforce SMBus if ME is not active */ if (!(er32 (FWSM ) &E1000_ICH_FWSM_FW_VALID )) { +/* Switching PHY interface always returns MDI error +* so disable retry mechanism to avoid wasting time +*/ +e1000e_disable_phy_retry (hw); +/* Unforce SMBus mode in PHY */ e1e_rphy_locked (hw,CV_SMB_CTRL , &phy_reg); phy_reg &= ~CV_SMB_CTRL_FORCE_SMBUS ;e1e_wphy_locked (hw,CV_SMB_CTRL , phy_reg); +e1000e_enable_phy_retry (hw); +/* Unforce SMBus mode in MAC */ mac_reg =er32 (CTRL_EXT ); mac_reg &= ~E1000_CTRL_EXT_FORCE_SMBUS ;
@@ -310,6 +317,11 @@ static s32 e1000_init_phy_workarounds_pc goto out; } +/* There is no guarantee that the PHY is accessible at this time +* so disable retry mechanism to avoid wasting time +*/ +e1000e_disable_phy_retry (hw); +/* The MAC-PHY interconnect may be in SMBus mode. If the PHY is * inaccessible and resetting the PHY is not blocked, toggle the * LANPHYPC Value bit to force the interconnect to PCIe mode.
@@ -380,6 +392,8 @@ static s32 e1000_init_phy_workarounds_pcbreak ; } +e1000e_enable_phy_retry (hw); + hw->phy.ops.release (hw);if (!ret_val) {
@@ -449,6 +463,11 @@ static s32 e1000_init_phy_params_pchlan( phy->id = e1000_phy_unknown; +if (hw->mac.type == e1000_pch_mtp) { + phy->retry_count =2 ; +e1000e_enable_phy_retry (hw); + } + ret_val =e1000_init_phy_workarounds_pchlan (hw);if (ret_val)return ret_val;
@@ -1146,6 +1165,11 @@ s32 e1000_enable_ulp_lpt_lp(struct e1000if (ret_val) goto out; +/* Switching PHY interface always returns MDI error +* so disable retry mechanism to avoid wasting time +*/ +e1000e_disable_phy_retry (hw); +/* Force SMBus mode in PHY */ ret_val =e1000_read_phy_reg_hv_locked (hw,CV_SMB_CTRL , &phy_reg);if (ret_val)
@@ -1153,6 +1177,8 @@ s32 e1000_enable_ulp_lpt_lp(struct e1000 phy_reg |=CV_SMB_CTRL_FORCE_SMBUS ;e1000_write_phy_reg_hv_locked (hw,CV_SMB_CTRL , phy_reg); +e1000e_enable_phy_retry (hw); +/* Force SMBus mode in MAC */ mac_reg =er32 (CTRL_EXT ); mac_reg |=E1000_CTRL_EXT_FORCE_SMBUS ;
@@ -1313,6 +1339,11 @@ static s32 e1000_disable_ulp_lpt_lp(stru/* Toggle LANPHYPC Value bit */ e1000_toggle_lanphypc_pch_lpt (hw); +/* Switching PHY interface always returns MDI error +* so disable retry mechanism to avoid wasting time +*/ +e1000e_disable_phy_retry (hw); +/* Unforce SMBus mode in PHY */ ret_val =e1000_read_phy_reg_hv_locked (hw,CV_SMB_CTRL , &phy_reg);if (ret_val) {
@@ -1333,6 +1364,8 @@ static s32 e1000_disable_ulp_lpt_lp(stru phy_reg &= ~CV_SMB_CTRL_FORCE_SMBUS ;e1000_write_phy_reg_hv_locked (hw,CV_SMB_CTRL , phy_reg); +e1000e_enable_phy_retry (hw); +/* Unforce SMBus mode in MAC */ mac_reg =er32 (CTRL_EXT ); mac_reg &= ~E1000_CTRL_EXT_FORCE_SMBUS ;
drivers/net/ethernet/intel/e1000e/phy.c +117 -73
234 lines not on this page · raw message
drivers/net/ethernet/intel/e1000e/phy.h +2 -0
@@ -51,6 +51,8 @@ s32 e1000e_read_phy_reg_bm2(struct e1000s32 e1000e_write_phy_reg_bm2 (struct e1000_hw *hw,u32 offset,u16 data);void e1000_power_up_phy_copper (struct e1000_hw *hw);void e1000_power_down_phy_copper (struct e1000_hw *hw); +void e1000e_disable_phy_retry (struct e1000_hw *hw); +void e1000e_enable_phy_retry (struct e1000_hw *hw);s32 e1000e_read_phy_reg_mdic (struct e1000_hw *hw,u32 offset,u16 *data);s32 e1000e_write_phy_reg_mdic (struct e1000_hw *hw,u32 offset,u16 data);s32 e1000_read_phy_reg_hv (struct e1000_hw *hw,u32 offset,u16 *data);
Re: [PATCH 6.8 117/273] e1000e: Workaround for sporadic MDI error on Meteor Lake systems
Quoted 16 lines · Greg Kroah-Hartman
6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Lifshits <[email protected]>
commit
6dbdd4de0362c37e54e8b049781402e5a409e7d0upstream.On some Meteor Lake systems accessing the PHY via the MDIO interface may result in an MDI error. This issue happens sporadically and in most cases a second access to the PHY via the MDIO interface results in success.
As a workaround, introduce a retry counter which is set to 3 on Meteor Lake systems. The driver will only return an error if 3 consecutive PHY access attempts fail. The retry mechanism is disabled in specific flows, where MDI errors are expected.
...
Quoted 72 lines
drivers/net/ethernet/intel/e1000e/phy.c +19
-29@@ -107,6 +107,16 @@ s32 e1000e_phy_reset_dsp(struct e1000_hwreturn e1e_wphy (hw,M88E1000_PHY_GEN_CONTROL ,0 ); } +void e1000e_disable_phy_retry (struct e1000_hw *hw) +{ + hw->phy.retry_enabled = false; +} + +void e1000e_enable_phy_retry (struct e1000_hw *hw) +{ + hw->phy.retry_enabled = true; +} +/** * e1000e_read_phy_reg_mdic - Read MDI control register * @hw: pointer to the HW structure @@ -118,55 +128,73 @@ s32 e1000e_phy_reset_dsp(struct e1000_hw**/ s32 e1000e_read_phy_reg_mdic (struct e1000_hw *hw,u32 offset,u16 *data) { +u32 i, mdic =0 , retry_counter, retry_max;struct e1000_phy_info *phy = &hw->phy; -u32 i, mdic =0 ; +bool success;if (offset >MAX_PHY_REG_ADDRESS ) {e_dbg ("PHY Address %d is out of range\n" , offset);return -E1000_ERR_PARAM ; } + retry_max = phy->retry_enabled ? phy->retry_count :0 ; +/* Set up Op-code, Phy Address, and register offset in the MDI * Control register. The MAC will take care of interfacing with the * PHY to retrieve the desired data. */ - mdic = ((offset <<E1000_MDIC_REG_SHIFT ) | - (phy->addr <<E1000_MDIC_PHY_SHIFT ) | - (E1000_MDIC_OP_READ )); - -ew32 (MDIC , mdic); - -/* Poll the ready bit to see if the MDI read completed -* Increasing the time out as testing showed failures with -* the lower time out -*/ -for (i =0 ; i < (E1000_GEN_POLL_TIMEOUT *3 ); i++) { -udelay (50 ); - mdic =er32 (MDIC ); -if (mdic &E1000_MDIC_READY ) -break ; - } -if (!(mdic &E1000_MDIC_READY )) { -e_dbg ("MDI Read PHY Reg Address %d did not complete\n" , offset); -return -E1000_ERR_PHY ; - } -if (mdic &E1000_MDIC_ERROR ) { -e_dbg ("MDI Read PHY Reg Address %d Error\n" , offset); -return -E1000_ERR_PHY ; - } -if (FIELD_GET (E1000_MDIC_REG_MASK , mdic) != offset) { -e_dbg ("MDI Read offset error - requested %d, returned %d\n" , - offset,FIELD_GET (E1000_MDIC_REG_MASK , mdic)); -return -E1000_ERR_PHY ; +for (retry_counter =0 ; retry_counter <= retry_max; retry_counter++) { + success = true; + + mdic = ((offset << E1000_MDIC_REG_SHIFT) | + (phy->addr << E1000_MDIC_PHY_SHIFT) |
drivers/net/ethernet/intel/e1000e/phy.c s32 e1000e_phy_reset_dsp(struct e1000_hw · line 160
Quoted 10 lines
drivers/net/ethernet/intel/e1000e/phy.c +10
-0+ (E1000_MDIC_OP_READ)); + +ew32 (MDIC , mdic); + +/* Poll the ready bit to see if the MDI read completed +* Increasing the time out as testing showed failures with +* the lower time out +*/ +for (i =0 ; i < (E1000_GEN_POLL_TIMEOUT *3 ); i++) { +usleep_range (50 ,60 );
This crashes the kernel as a spinlock is held upper in the call stack in e1000_watchdog_task():
spin_lock(&adapter->stats64_lock);
e1000e_update_stats(adapter);
-> e1000e_update_phy_stats()
-> e1000e_read_phy_reg_mdic()
-> usleep_range() ----> Boom.It was reported to our bugzilla:
https://bugzilla.suse.com/show_bug.cgi?id=1223109
I believe, the mainline has the same bug.
Any ideas?
thanks,
Signature · 2 lines
js suse labs
Re: [PATCH 6.8 117/273] e1000e: Workaround for sporadic MDI error on Meteor Lake systems
Quoted 106 lines · Jiri Slaby
Quoted 16 lines · Greg Kroah-Hartman
6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Lifshits <[email protected]>
commit
6dbdd4de0362c37e54e8b049781402e5a409e7d0upstream.On some Meteor Lake systems accessing the PHY via the MDIO interface may result in an MDI error. This issue happens sporadically and in most cases a second access to the PHY via the MDIO interface results in success.
As a workaround, introduce a retry counter which is set to 3 on Meteor Lake systems. The driver will only return an error if 3 consecutive PHY access attempts fail. The retry mechanism is disabled in specific flows, where MDI errors are expected.
...
Quoted 70 lines
drivers/net/ethernet/intel/e1000e/phy.c +19
-29@@ -107,6 +107,16 @@ s32 e1000e_phy_reset_dsp(struct e1000_hw return e1e_wphy(hw, M88E1000_PHY_GEN_CONTROL, 0); } +void e1000e_disable_phy_retry (struct e1000_hw *hw) +{ + hw->phy.retry_enabled = false; +} + +void e1000e_enable_phy_retry (struct e1000_hw *hw) +{ + hw->phy.retry_enabled = true; +} + /*** e1000e_read_phy_reg_mdic - Read MDI control register * @hw: pointer to the HW structure @@ -118,55 +128,73 @@ s32 e1000e_phy_reset_dsp(struct e1000_hw**/ s32 e1000e_read_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 *data) { + u32 i, mdic = 0, retry_counter, retry_max; struct e1000_phy_info *phy = &hw->phy; - u32 i, mdic = 0; + bool success; if (offset > MAX_PHY_REG_ADDRESS) { e_dbg("PHY Address %d is out of range\n", offset); return -E1000_ERR_PARAM; } + retry_max = phy->retry_enabled ? phy->retry_count : 0; + /* Set up Op-code, Phy Address, and register offset in the MDI * Control register. The MAC will take care of interfacing with the * PHY to retrieve the desired data. */ - mdic = ((offset << E1000_MDIC_REG_SHIFT) | - (phy->addr << E1000_MDIC_PHY_SHIFT) | - (E1000_MDIC_OP_READ)); - - ew32(MDIC, mdic); - - /* Poll the ready bit to see if the MDI read completed - * Increasing the time out as testing showed failures with - * the lower time out - */ - for (i = 0; i < (E1000_GEN_POLL_TIMEOUT * 3); i++) { - udelay(50); - mdic = er32(MDIC); - if (mdic & E1000_MDIC_READY) - break; - } - if (!(mdic & E1000_MDIC_READY)) { - e_dbg("MDI Read PHY Reg Address %d did not complete\n", offset); - return -E1000_ERR_PHY; - } - if (mdic & E1000_MDIC_ERROR) { - e_dbg("MDI Read PHY Reg Address %d Error\n", offset); - return -E1000_ERR_PHY; - } - if (FIELD_GET(E1000_MDIC_REG_MASK, mdic) != offset) { - e_dbg("MDI Read offset error - requested %d, returned %d\n", - offset, FIELD_GET(E1000_MDIC_REG_MASK, mdic)); - return -E1000_ERR_PHY; + for (retry_counter = 0; retry_counter <= retry_max; retry_counter++) { + success = true; + + mdic = ((offset << E1000_MDIC_REG_SHIFT) | + (phy->addr << E1000_MDIC_PHY_SHIFT) |drivers/net/ethernet/intel/e1000e/phy.c s32 e1000e_phy_reset_dsp(struct e1000_hw · line 159
Quoted 10 lines
drivers/net/ethernet/intel/e1000e/phy.c +10
-0+ (E1000_MDIC_OP_READ)); + + ew32(MDIC, mdic); + + /* Poll the ready bit to see if the MDI read completed + * Increasing the time out as testing showed failures with + * the lower time out + */ + for (i = 0; i < (E1000_GEN_POLL_TIMEOUT * 3); i++) { + usleep_range(50, 60);This crashes the kernel as a spinlock is held upper in the call stack in
e1000_watchdog_task():
spin_lock(&adapter->stats64_lock);
e1000e_update_stats(adapter);
->e1000e_update_phy_stats()
->e1000e_read_phy_reg_mdic()
->usleep_range()----> Boom.
Quoted 6 lines
It was reported to our bugzilla:
https://bugzilla.suse.com/show_bug.cgi?id=1223109I believe, the mainline has the same bug.
Any ideas?
Obviously change the usleeps back to udelays? Or maybe only when retry_enabled is set?
Quoted 1 line
thanks,
Signature · 2 lines
js suse labs
Re: [PATCH 6.8 117/273] e1000e: Workaround for sporadic MDI error on Meteor Lake systems
Quoted 111 lines · Jiri Slaby
Quoted 110 lines · Jiri Slaby
Quoted 16 lines · Greg Kroah-Hartman
6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Lifshits <[email protected]>
commit
6dbdd4de0362c37e54e8b049781402e5a409e7d0upstream.On some Meteor Lake systems accessing the PHY via the MDIO interface may result in an MDI error. This issue happens sporadically and in most cases a second access to the PHY via the MDIO interface results in success.
As a workaround, introduce a retry counter which is set to 3 on Meteor Lake systems. The driver will only return an error if 3 consecutive PHY access attempts fail. The retry mechanism is disabled in specific flows, where MDI errors are expected.
...
Quoted 71 lines
drivers/net/ethernet/intel/e1000e/phy.c +19
-29@@ -107,6 +107,16 @@ s32 e1000e_phy_reset_dsp(struct e1000_hw return e1e_wphy(hw, M88E1000_PHY_GEN_CONTROL, 0); } +void e1000e_disable_phy_retry (struct e1000_hw *hw) +{ + hw->phy.retry_enabled = false; +} + +void e1000e_enable_phy_retry (struct e1000_hw *hw) +{ + hw->phy.retry_enabled = true; +} + /*** e1000e_read_phy_reg_mdic - Read MDI control register * @hw: pointer to the HW structure @@ -118,55 +128,73 @@ s32 e1000e_phy_reset_dsp(struct e1000_hw**/ s32 e1000e_read_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 *data) { + u32 i, mdic = 0, retry_counter, retry_max; struct e1000_phy_info *phy = &hw->phy; - u32 i, mdic = 0; + bool success; if (offset > MAX_PHY_REG_ADDRESS) { e_dbg("PHY Address %d is out of range\n", offset); return -E1000_ERR_PARAM; } + retry_max = phy->retry_enabled ? phy->retry_count : 0; + /* Set up Op-code, Phy Address, and register offset in the MDI* Control register. The MAC will take care of interfacing with the * PHY to retrieve the desired data. */ - mdic = ((offset << E1000_MDIC_REG_SHIFT) | - (phy->addr << E1000_MDIC_PHY_SHIFT) | - (E1000_MDIC_OP_READ)); - - ew32(MDIC, mdic); - - /* Poll the ready bit to see if the MDI read completed - * Increasing the time out as testing showed failures with - * the lower time out - */ - for (i = 0; i < (E1000_GEN_POLL_TIMEOUT * 3); i++) { - udelay(50); - mdic = er32(MDIC); - if (mdic & E1000_MDIC_READY) - break; - } - if (!(mdic & E1000_MDIC_READY)) { - e_dbg("MDI Read PHY Reg Address %d did not complete\n", offset); - return -E1000_ERR_PHY; - } - if (mdic & E1000_MDIC_ERROR) { - e_dbg("MDI Read PHY Reg Address %d Error\n", offset); - return -E1000_ERR_PHY; - } - if (FIELD_GET(E1000_MDIC_REG_MASK, mdic) != offset) { - e_dbg("MDI Read offset error - requested %d, returned %d\n", - offset, FIELD_GET(E1000_MDIC_REG_MASK, mdic)); - return -E1000_ERR_PHY; + for (retry_counter = 0; retry_counter <= retry_max; retry_counter++) { + success = true; + + mdic = ((offset << E1000_MDIC_REG_SHIFT) | + (phy->addr << E1000_MDIC_PHY_SHIFT) |drivers/net/ethernet/intel/e1000e/phy.c s32 e1000e_phy_reset_dsp(struct e1000_hw · line 160
Quoted 10 lines
drivers/net/ethernet/intel/e1000e/phy.c +10
-0+ (E1000_MDIC_OP_READ)); + + ew32(MDIC, mdic); + + /* Poll the ready bit to see if the MDI read completed + * Increasing the time out as testing showed failures with + * the lower time out + */ + for (i = 0; i < (E1000_GEN_POLL_TIMEOUT * 3); i++) { + usleep_range(50, 60);This crashes the kernel as a spinlock is held upper in the call stack in
e1000_watchdog_task():
spin_lock(&adapter->stats64_lock);
e1000e_update_stats(adapter);
->e1000e_update_phy_stats()
->e1000e_read_phy_reg_mdic()
->usleep_range()----> Boom.It was reported to our bugzilla:
https://bugzilla.suse.com/show_bug.cgi?id=1223109
Quoted 6 lines
Quoted 3 lines
I believe, the mainline has the same bug.
Any ideas?
Obviously change the usleeps back to udelays? Or maybe only when
retry_enabledis set?
Hi Jiri,
Should be the former. Could you give this patch a try?
https://lore.kernel.org/intel-wired-lan/[email protected]/T/#u
Thanks,
Tony
Re: [PATCH 6.8 117/273] e1000e: Workaround for sporadic MDI error on Meteor Lake systems
Quoted 16 lines · Tony Nguyen
Quoted 15 lines · Jiri Slaby
Quoted 13 lines · Jiri Slaby
This crashes the kernel as a spinlock is held upper in the call stack in
e1000_watchdog_task():
spin_lock(&adapter->stats64_lock);
e1000e_update_stats(adapter);
->e1000e_update_phy_stats()
->e1000e_read_phy_reg_mdic()
->usleep_range()----> Boom.It was reported to our bugzilla:
https://bugzilla.suse.com/show_bug.cgi?id=1223109I believe, the mainline has the same bug.
Any ideas?
Quoted 7 lines
Quoted 2 lines
Obviously change the usleeps back to udelays? Or maybe only when
retry_enabledis set?Hi Jiri,
Should be the former. Could you give this patch a try?
https://lore.kernel.org/intel-wired-lan/[email protected]/T/#u
Thanks, now pushed to the openSUSE kernel.
Signature · 2 lines
js suse labs
Greg Kroah-Hartman
maintainerPATCH 118/273 ipv6: Fix infinite recursion in fib6_dump_done().
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
commit d21d40605bca7bd5fc23ef03d4c1ca1f48bc2cae upstream.
syzkaller reported infinite recursive calls of fib6_dump_done() during netlink socket destruction. [1]
Quoted 1 line
From the log, syzkaller sent an
AF_UNSPECRTM_GETROUTEmessage, and then
the response was generated. The following recvmmsg() resumed the dump for IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due to the fault injection. [0]
12:01:34 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, ... snip ...)
recvmmsg(r0, ... snip ...) (fail_nth: 8)
Here, fib6_dump_done() was set to nlk_sk(sk)->cb.done, and the next call of inet6_dump_fib() set it to nlk_sk(sk)->cb.args[3]. syzkaller stopped receiving the response halfway through, and finally netlink_sock_destruct() called nlk_sk(sk)->cb.done().
fib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)->cb.done() if it is still not NULL. fib6_dump_end() rewrites nlk_sk(sk)->cb.done() by nlk_sk(sk)->cb.args[3], but it has the same function, not NULL, calling itself recursively and hitting the stack guard page.
To avoid the issue, let's set the destructor after kzalloc().
[0]:FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:117) should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153) should_failslab (mm/slub.c:3733) kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992) inet6_dump_fib (./include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662) rtnl_dump_all (net/core/rtnetlink.c:4029) netlink_dump (net/netlink/af_netlink.c:2269) netlink_recvmsg (net/netlink/af_netlink.c:1988) ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801) ___sys_recvmsg (net/socket.c:2846) do_recvmmsg (net/socket.c:2943) __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034)
[1]:
BUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb) stack guard page: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: events netlink_sock_destruct_work RIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570) Code: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd <53> 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc9000d980000 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3 RDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358 RBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000 R13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68 FS: 0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <#DF> </#DF> <TASK> fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) ... fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) netlink_sock_destruct (net/netlink/af_netlink.c:401) __sk_destruct (net/core/sock.c:2177 (discriminator 2)) sk_destruct (net/core/sock.c:2224) __sk_free (net/core/sock.c:2235) sk_free (net/core/sock.c:2246) process_one_work (kernel/workqueue.c:3259) worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:256) Modules linked in:
--- net/ipv6/ip6_fib.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
net/ipv6/ip6_fib.c +7 -7
@@ -645,19 +645,19 @@ static int inet6_dump_fib(struct sk_buffif (!w) {/* New dump: * -* 1. hook callback destructor. -*/ - cb->args[3 ] = (long )cb->done; - cb->done = fib6_dump_done; - -/* -* 2. allocate and initialize walker. +* 1. allocate and initialize walker. */ w =kzalloc (sizeof (*w),GFP_ATOMIC );if (!w)return -ENOMEM ; w->func = fib6_dump_node; cb->args[2 ] = (long )w; + +/* 2. hook callback destructor. +*/ + cb->args[3 ] = (long )cb->done; + cb->done = fib6_dump_done; + } arg.skb = skb;
Greg Kroah-Hartman
maintainerPATCH 119/273 mlxbf_gige: stop interface during shutdown
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
commit 09ba28e1cd3cf715daab1fca6e1623e22fd754a6 upstream.
The mlxbf_gige driver intermittantly encounters a NULL pointer exception while the system is shutting down via "reboot" command. The mlxbf_driver will experience an exception right after executing its shutdown() method. One example of this exception is:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000011d373000 [0000000000000070] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 96000004 [#1] SMP CPU: 0 PID: 13 Comm: ksoftirqd/0 Tainted: G S OE 5.15.0-bf.6.gef6992a #1 Hardware name: https://www.mellanox.com BlueField SoC/BlueField SoC, BIOS 4.0.2.12669 Apr 21 2023 pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mlxbf_gige_handle_tx_complete+0xc8/0x170 [mlxbf_gige] lr : mlxbf_gige_poll+0x54/0x160 [mlxbf_gige]
sp : ffff8000080d3c10
x29: ffff8000080d3c10 x28: ffffcce72cbb7000 x27: ffff8000080d3d58
x26: ffff0000814e7340 x25: ffff331cd1a05000 x24: ffffcce72c4ea008
x23: ffff0000814e4b40 x22: ffff0000814e4d10 x21: ffff0000814e4128
x20: 0000000000000000 x19: ffff0000814e4a80 x18: ffffffffffffffff
x17: 000000000000001c x16: ffffcce72b4553f4 x15: ffff80008805b8a7
x14: 0000000000000000 x13: 0000000000000030 x12: 0101010101010101
x11: 7f7f7f7f7f7f7f7f x10: c2ac898b17576267 x9 : ffffcce720fa5404 x8 : ffff000080812138 x7 : 0000000000002e9a x6 : 0000000000000080 x5 : ffff00008de3b000 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace: mlxbf_gige_handle_tx_complete+0xc8/0x170 [mlxbf_gige] mlxbf_gige_poll+0x54/0x160 [mlxbf_gige] __napi_poll+0x40/0x1c8 net_rx_action+0x314/0x3a0 __do_softirq+0x128/0x334 run_ksoftirqd+0x54/0x6c smpboot_thread_fn+0x14c/0x190 kthread+0x10c/0x110 ret_from_fork+0x10/0x20 Code: 8b070000 f9000ea0 f95056c0 f86178a1 (b9407002) ---[ end trace 7cc3941aa0d8e6a4 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt
Kernel Offset: 0x4ce722520000 from 0xffff800008000000PHYS_OFFSET: 0x80000000
CPU features: 0x000005c1,a3330e5a
Memory Limit: none
---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---
During system shutdown, the mlxbf_gige driver's shutdown() is always executed. However, the driver's stop() method will only execute if networking interface configuration logic within the Linux distribution has been setup to do so.
If shutdown() executes but stop() does not execute, NAPI remains enabled and this can lead to an exception if NAPI is scheduled while the hardware interface has only been partially deinitialized.
The networking interface managed by the mlxbf_gige driver must be properly stopped during system shutdown so that IFF_UP is cleared, the hardware interface is put into a clean state, and NAPI is fully deinitialized.
--- drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +8 -2
@@ -14,6 +14,7 @@#include <linux/module.h> #include <linux/phy.h> #include <linux/platform_device.h> +#include <linux/rtnetlink.h> #include <linux/skbuff.h> #include "mlxbf_gige.h"
@@ -492,8 +493,13 @@ static void mlxbf_gige_shutdown(struct p {struct mlxbf_gige *priv =platform_get_drvdata (pdev); -writeq (0 , priv->base +MLXBF_GIGE_INT_EN ); -mlxbf_gige_clean_port (priv); +rtnl_lock (); +netif_device_detach (priv->netdev); + +if (netif_running (priv->netdev)) +dev_close (priv->netdev); + +rtnl_unlock (); }static const struct acpi_device_id __maybe_unused mlxbf_gige_acpi_match[] = {