6.6.103-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 560/587 Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <[email protected]>
[ Upstream commit 0eaf7c7e85da7495c0e03a99375707fc954f5e7b ]
The commit e07a06b4eb41 ("Bluetooth: Convert SCO configure_datapath to hci_sync") missed to update the *return* statement under the *case* of BT_CODEC_TRANSPARENT in hci_enhanced_setup_sync(), which led to returning success (0) instead of the negative error code (-EINVAL). However, the result of hci_enhanced_setup_sync() seems to be ignored anyway, since NULL gets passed to hci_cmd_sync_queue() as the last argument in that case and the only function interested in that result is specified by that argument.
--- net/bluetooth/hci_conn.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/bluetooth/hci_conn.c +2 -1
@@ -339,7 +339,8 @@ static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)case BT_CODEC_TRANSPARENT :if (!find_next_esco_param (conn, esco_param_msbc,ARRAY_SIZE (esco_param_msbc))) -return false; +return -EINVAL ; + param = &esco_param_msbc[conn->attempt -1 ]; cp.tx_coding_format.id =0x03 ; cp.rx_coding_format.id =0x03 ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 561/587 mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit f604d3aaf64ff0d90cc875295474d3abf4155629 ]
By default, the device does not forward IPv4 packets with a link-local source IP (i.e., 169.254.0.0/16). This behavior does not align with the kernel which does forward them.
Fix by instructing the device to forward such packets instead of dropping them.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 ++ drivers/net/ethernet/mellanox/mlxsw/trap.h | 1 + 2 files changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +2 -0
@@ -2528,6 +2528,8 @@ static const struct mlxsw_listener mlxsw_sp_listener[] = { ROUTER_EXP, false),MLXSW_SP_RXL_NO_MARK (DISCARD_ING_ROUTER_DIP_LINK_LOCAL ,FORWARD ,ROUTER_EXP , false), +MLXSW_SP_RXL_NO_MARK (DISCARD_ING_ROUTER_SIP_LINK_LOCAL ,FORWARD , +ROUTER_EXP , false),/* Multicast Router Traps */ MLXSW_SP_RXL_MARK (ACL1 ,TRAP_TO_CPU ,MULTICAST , false), MLXSW_SP_RXL_L3_MARK(ACL2, TRAP_TO_CPU, MULTICAST, false),
drivers/net/ethernet/mellanox/mlxsw/trap.h +1 -0
@@ -95,6 +95,7 @@ enum {MLXSW_TRAP_ID_DISCARD_ING_ROUTER_IPV4_SIP_BC =0x16A ,MLXSW_TRAP_ID_DISCARD_ING_ROUTER_IPV4_DIP_LOCAL_NET =0x16B ,MLXSW_TRAP_ID_DISCARD_ING_ROUTER_DIP_LINK_LOCAL =0x16C , +MLXSW_TRAP_ID_DISCARD_ING_ROUTER_SIP_LINK_LOCAL =0x16D ,MLXSW_TRAP_ID_DISCARD_ROUTER_IRIF_EN =0x178 ,MLXSW_TRAP_ID_DISCARD_ROUTER_ERIF_EN =0x179 , MLXSW_TRAP_ID_DISCARD_ROUTER_LPM4 = 0x17B,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 562/587 drm/hisilicon/hibmc: fix the hibmc loaded failed bug
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baihan Li <[email protected]>
[ Upstream commit 93a08f856fcc5aaeeecad01f71bef3088588216a ]
When hibmc loaded failed, the driver use hibmc_unload to free the resource, but the mutexes in mode.config are not init, which will access an NULL pointer. Just change goto statement to return, because hibnc_hw_init() doesn't need to free anything.
--- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c +2 -2
@@ -258,13 +258,13 @@ static int hibmc_load(struct drm_device *dev) ret =hibmc_hw_init (priv);if (ret) - goto err; +return ret; ret =drmm_vram_helper_init (dev,pci_resource_start (pdev,0 ),pci_resource_len (pdev,0 ));if (ret) {drm_err (dev,"Error initializing VRAM MM; %d\n" , ret); - goto err; +return ret; } ret =hibmc_kms_init (priv);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 563/587 ALSA: usb-audio: Fix size validation in convert_chmap_v3()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 89f0addeee3cb2dc49837599330ed9c4612f05b0 ]
The "p" pointer is void so sizeof(*p) is 1. The intent was to check sizeof(*cs_desc), which is 3, instead.
--- sound/usb/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/stream.c +1 -1
@@ -349,7 +349,7 @@ snd_pcm_chmap_elem *convert_chmap_v3(struct uac3_cluster_header_descriptoru16 cs_len;u8 cs_type; -if (len <sizeof (*p)) +if (len <sizeof (*cs_desc))break ; cs_len =le16_to_cpu (cs_desc->wLength);if (len < cs_len)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 564/587 drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenyuan Yang <[email protected]>
[ Upstream commit 7a2ca2ea64b1b63c8baa94a8f5deb70b2248d119 ]
The function mod_hdcp_hdcp1_create_session() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lead to a null pointer dereference.
Add a null pointer check for get_first_active_display() and return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null.
This is similar to the commit c3e9826a2202
("drm/amd/display: Add null pointer check for get_first_active_display()").
--- drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c +3 -0
@@ -260,6 +260,9 @@ enum mod_hdcp_status mod_hdcp_hdcp1_create_session(struct mod_hdcp *hdcp)return MOD_HDCP_STATUS_FAILURE ; } +if (!display) +return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND ; + hdcp_cmd = (struct ta_hdcp_shared_memory *)psp->hdcp_context.context.mem_context.shared_buf;mutex_lock (&psp->hdcp_context.mutex);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 565/587 net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Ramaseuski <[email protected]>
[ Upstream commit 864e3396976ef41de6cc7bc366276bf4e084fff2 ]
When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incorrectly requests checksum offload if the egress device only advertises NETIF_F_IPV6_CSUM feature, which has a strict contract: it supports checksum offload only for plain TCP or UDP over IPv6 and explicitly does not support packets with extension headers. The current GSO logic violates this contract by failing to disable the feature for packets with extension headers, such as those used in GREoIPv6 tunnels.
This violation results in the device being asked to perform an operation it cannot support, leading to a skb_warn_bad_offload warning and a collapse of network throughput. While device TSO/USO is correctly bypassed in favor of software GSO for these packets, the GSO stack must be explicitly told not to request checksum offload.
Mask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4
in gso_features_check if the IPv6 header contains extension headers to compute checksum in software.
The exception is a BIG TCP extension, which, as stated in commit 68e068cabd2c6c53 ("net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets"):
"The feature is only enabled on devices that support BIG TCP TSO. The header is only present for PF_PACKET taps like tcpdump,
and not transmitted by physical devices."
kernel log output (truncated):
WARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140 ... Call Trace: <TASK> skb_checksum_help+0x12a/0x1f0 validate_xmit_skb+0x1a3/0x2d0 validate_xmit_skb_list+0x4f/0x80 sch_direct_xmit+0x1a2/0x380 __dev_xmit_skb+0x242/0x670 __dev_queue_xmit+0x3fc/0x7f0 ip6_finish_output2+0x25e/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel] ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre] dev_hard_start_xmit+0x63/0x1c0 __dev_queue_xmit+0x6d0/0x7f0 ip6_finish_output2+0x214/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 inet6_csk_xmit+0xeb/0x150 __tcp_transmit_skb+0x555/0xa80 tcp_write_xmit+0x32a/0xe90 tcp_sendmsg_locked+0x437/0x1110 tcp_sendmsg+0x2f/0x50 ... skb linear: 00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e skb linear: 00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00 skb linear: 00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00 skb linear: 00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00 skb linear: 00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00 skb linear: 00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00 skb linear: 00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9 skb linear: 00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01 skb linear: 00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a
--- net/core/dev.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
net/core/dev.c +12 -0
@@ -3559,6 +3559,18 @@ static netdev_features_t gso_features_check(const struct sk_buff *skb, features &= ~NETIF_F_TSO_MANGLEID ; } +/* NETIF_F_IPV6_CSUM does not support IPv6 extension headers, +* so neither does TSO that depends on it. +*/ +if (features &NETIF_F_IPV6_CSUM && + (skb_shinfo (skb)->gso_type &SKB_GSO_TCPV6 || + (skb_shinfo (skb)->gso_type &SKB_GSO_UDP_L4 && +vlan_get_protocol (skb) ==htons (ETH_P_IPV6 ))) && +skb_transport_header_was_set (skb) && +skb_network_header_len (skb) !=sizeof (struct ipv6hdr ) && + !ipv6_has_hopopt_jumbo (skb)) + features &= ~(NETIF_F_IPV6_CSUM |NETIF_F_TSO6 |NETIF_F_GSO_UDP_L4 ); +return features; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 566/587 ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minhong He <[email protected]>
[ Upstream commit 84967deee9d9870b15bc4c3acb50f1d401807902 ]
The seg6_genl_sethmac() directly uses the algorithm ID provided by the userspace without verifying whether it is an HMAC algorithm supported by the system.
If an unsupported HMAC algorithm ID is configured, packets using SRv6 HMAC will be dropped during encapsulation or decapsulation.
--- net/ipv6/seg6_hmac.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv6/seg6_hmac.c +3 -0
@@ -294,6 +294,9 @@ int seg6_hmac_info_add(struct net *net, u32 key, struct seg6_hmac_info *hinfo)struct seg6_pernet_data *sdata =seg6_pernet (net);int err; +if (!__hmac_get_algo (hinfo->alg_id)) +return -EINVAL ; + err =rhashtable_lookup_insert_fast (&sdata->hmac_infos, &hinfo->node, rht_params);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 567/587 net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingfang Deng <[email protected]>
[ Upstream commit 62c30c544359aa18b8fb2734166467a07d435c2d ]
Ensure ndo_fill_forward_path() is called with RCU lock held.
--- drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mediatek/mtk_ppe_offload.c +2 -0
@@ -101,7 +101,9 @@ mtk_flow_get_wdma_info(struct net_device *dev, const u8 *addr, struct mtk_wdma_iif (!IS_ENABLED (CONFIG_NET_MEDIATEK_SOC_WED ))return -1 ; +rcu_read_lock (); err =dev_fill_forward_path (dev, addr, &stack); +rcu_read_unlock ();if (err)return err;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 568/587 ppp: fix race conditions in ppp_fill_forward_path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingfang Deng <[email protected]>
[ Upstream commit 0417adf367a0af11adf7ace849af4638cfb573f7 ]
ppp_fill_forward_path() has two race conditions:
1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic.
2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels.
Fix these by using a lockless RCU approach:
- Use list_first_or_null_rcu() to safely test and access the first list entry.
- Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal.
- Check for a NULL pch->chan before dereferencing it.
--- drivers/net/ppp/ppp_generic.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/net/ppp/ppp_generic.c +11 -6
@@ -33,6 +33,7 @@#include <linux/ppp_channel.h> #include <linux/ppp-comp.h> #include <linux/skbuff.h> +#include <linux/rculist.h> #include <linux/rtnetlink.h> #include <linux/if_arp.h> #include <linux/ip.h>
@@ -1613,11 +1614,14 @@ static int ppp_fill_forward_path(struct net_device_path_ctx *ctx,if (ppp->flags &SC_MULTILINK )return -EOPNOTSUPP ; -if (list_empty (&ppp->channels)) + pch = list_first_or_null_rcu(&ppp->channels, struct channel, clist); +if (!pch) +return -ENODEV ; + + chan =READ_ONCE (pch->chan); +if (!chan)return -ENODEV ; - pch = list_first_entry(&ppp->channels, struct channel, clist); - chan = pch->chan;if (!chan->ops->fill_forward_path)return -EOPNOTSUPP ;
@@ -3000,7 +3004,7 @@ ppp_unregister_channel(struct ppp_channel *chan)*/ down_write (&pch->chan_sem);spin_lock_bh (&pch->downl); - pch->chan =NULL ; +WRITE_ONCE (pch->chan,NULL );spin_unlock_bh (&pch->downl);up_write (&pch->chan_sem);ppp_disconnect_channel (pch);
@@ -3506,7 +3510,7 @@ ppp_connect_channel(struct channel *pch, int unit) hdrlen = pch->file.hdrlen +2 ;/* for protocol bytes */ if (hdrlen > ppp->dev->hard_header_len) ppp->dev->hard_header_len = hdrlen; -list_add_tail (&pch->clist, &ppp->channels); +list_add_tail_rcu (&pch->clist, &ppp->channels); ++ppp->n_channels; pch->ppp = ppp;refcount_inc (&ppp->file.refcnt);
@@ -3536,10 +3540,11 @@ ppp_disconnect_channel(struct channel *pch)if (ppp) {/* remove it from the ppp unit's list */ ppp_lock (ppp); -list_del (&pch->clist); +list_del_rcu (&pch->clist);if (--ppp->n_channels ==0 )wake_up_interruptible (&ppp->file.rwait);ppp_unlock (ppp); +synchronize_net ();if (refcount_dec_and_test (&ppp->file.refcnt))ppp_destroy_interface (ppp); err =0 ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 569/587 phy: mscc: Fix timestamping for vsc8584
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit bc1a59cff9f797bfbf8f3104507584d89e9ecf2e ]
There was a problem when we received frames and the frames were timestamped. The driver is configured to store the nanosecond part of the timestmap in the ptp reserved bits and it would take the second part by reading the LTC. The problem is that when reading the LTC we are in atomic context and to read the second part will go over mdio bus which might sleep, so we get an error.
The fix consists in actually put all the frames in a queue and start the aux work and in that work to read the LTC and then calculate the full received time.
--- drivers/net/phy/mscc/mscc.h | 12 ++++++++ drivers/net/phy/mscc/mscc_main.c | 12 ++++++++ drivers/net/phy/mscc/mscc_ptp.c | 49 ++++++++++++++++++++++++-------- 3 files changed, 61 insertions(+), 12 deletions(-)
drivers/net/phy/mscc/mscc.h +12 -0
@@ -362,6 +362,13 @@ struct vsc85xx_hw_stat {u16 mask; }; +struct vsc8531_skb_cb { +u32 ns; +}; + +#define VSC8531_SKB_CB (skb) \ + ((struct vsc8531_skb_cb *)((skb)->cb)) +struct vsc8531_private {int rate_magic;u16 supp_led_modes;
@@ -410,6 +417,11 @@ struct vsc8531_private {*/ struct mutex ts_lock;struct mutex phc_lock; + +/* list of skbs that were received and need timestamp information but it +* didn't received it yet +*/ +struct sk_buff_head rx_skbs_list; };/* Shared structure between the PHYs of the same package.
drivers/net/phy/mscc/mscc_main.c +12 -0
@@ -2335,6 +2335,13 @@ static int vsc85xx_probe(struct phy_device *phydev)return vsc85xx_dt_led_modes_get (phydev, default_mode); } +static void vsc85xx_remove (struct phy_device *phydev) +{ +struct vsc8531_private *priv = phydev->priv; + +skb_queue_purge (&priv->rx_skbs_list); +} +/* Microsemi VSC85xx PHYs */ static struct phy_driver vsc85xx_driver[] = { {
@@ -2589,6 +2596,7 @@ static struct phy_driver vsc85xx_driver[] = { .config_intr = &vsc85xx_config_intr, .suspend = &genphy_suspend, .resume = &genphy_resume, + .remove = &vsc85xx_remove, .probe = &vsc8574_probe, .set_wol = &vsc85xx_wol_set, .get_wol = &vsc85xx_wol_get,
@@ -2614,6 +2622,7 @@ static struct phy_driver vsc85xx_driver[] = { .config_intr = &vsc85xx_config_intr, .suspend = &genphy_suspend, .resume = &genphy_resume, + .remove = &vsc85xx_remove, .probe = &vsc8574_probe, .set_wol = &vsc85xx_wol_set, .get_wol = &vsc85xx_wol_get,
@@ -2639,6 +2648,7 @@ static struct phy_driver vsc85xx_driver[] = { .config_intr = &vsc85xx_config_intr, .suspend = &genphy_suspend, .resume = &genphy_resume, + .remove = &vsc85xx_remove, .probe = &vsc8584_probe, .get_tunable = &vsc85xx_get_tunable, .set_tunable = &vsc85xx_set_tunable,
@@ -2662,6 +2672,7 @@ static struct phy_driver vsc85xx_driver[] = { .config_intr = &vsc85xx_config_intr, .suspend = &genphy_suspend, .resume = &genphy_resume, + .remove = &vsc85xx_remove, .probe = &vsc8584_probe, .get_tunable = &vsc85xx_get_tunable, .set_tunable = &vsc85xx_set_tunable,
@@ -2685,6 +2696,7 @@ static struct phy_driver vsc85xx_driver[] = { .config_intr = &vsc85xx_config_intr, .suspend = &genphy_suspend, .resume = &genphy_resume, + .remove = &vsc85xx_remove, .probe = &vsc8584_probe, .get_tunable = &vsc85xx_get_tunable, .set_tunable = &vsc85xx_set_tunable,
drivers/net/phy/mscc/mscc_ptp.c +37 -12
85 lines not on this page · raw message
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 570/587 net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuichiro Tsuji <[email protected]>
[ Upstream commit 24ef2f53c07f273bad99173e27ee88d44d135b1c ]
Syzbot reported shift-out-of-bounds exception on MDIO bus initialization.
The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations.
Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.
--- drivers/net/usb/asix_devices.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/usb/asix_devices.c +1 -1
@@ -676,7 +676,7 @@ static int ax88772_init_mdio(struct usbnet *dev) priv->mdio->read = &asix_mdio_bus_read; priv->mdio->write = &asix_mdio_bus_write; priv->mdio->name ="Asix MDIO Bus" ; - priv->mdio->phy_mask = ~(BIT (priv->phy_addr) |BIT (AX_EMBD_PHY_ADDR )); + priv->mdio->phy_mask = ~(BIT (priv->phy_addr &0x1f ) |BIT (AX_EMBD_PHY_ADDR ));/* mii bus name is usb-<usb bus number>-<usb device number> */ snprintf (priv->mdio->id,MII_BUS_ID_SIZE ,"usb-%03d:%03d" , dev->udev->bus->busnum, dev->udev->devnum);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 571/587 gve: prevent ethtool ops after shutdown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rhee <[email protected]>
[ Upstream commit 75a9a46d67f46d608205888f9b34e315c1786345 ]
A crash can occur if an ethtool operation is invoked after shutdown() is called.
shutdown() is invoked during system shutdown to stop DMA operations without performing expensive deallocations. It is discouraged to unregister the netdev in this path, so the device may still be visible to userspace and kernel helpers.
In gve, shutdown() tears down most internal data structures. If an ethtool operation is dispatched after shutdown(), it will dereference freed or NULL pointers, leading to a kernel panic. While graceful shutdown normally quiesces userspace before invoking the reboot syscall, forced shutdowns (as observed on GCP VMs) can still trigger this path.
Fix by calling netif_device_detach() in shutdown(). This marks the device as detached so the ethtool ioctl handler will skip dispatching operations to the driver.
--- drivers/net/ethernet/google/gve/gve_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/google/gve/gve_main.c +2 -0
@@ -2373,6 +2373,8 @@ static void gve_shutdown(struct pci_dev *pdev)struct gve_priv *priv =netdev_priv (netdev);bool was_up =netif_carrier_ok (priv->dev); +netif_device_detach (netdev); +rtnl_lock ();if (was_up &&gve_close (priv->dev)) {/* If the dev was up, attempt to close, if close fails, reset */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 572/587 net/smc: fix UAF on smcsk after smc_listen_out()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: D. Wythe <[email protected]>
[ Upstream commit d9cef55ed49117bd63695446fb84b4b91815c0b4 ]
BPF CI testing report a UAF issue:
[ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0 [ 16.447134] #PF: supervisor read access in kernel mod e [ 16.447516] #PF: error_code(0x0000) - not-present pag e [ 16.447878] PGD 0 P4D 0 [ 16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT I [ 16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G OE 6.13.0-rc3-g89e8a75fda73-dirty #4 2 [ 16.449124] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODUL E [ 16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201 4 [ 16.450201] Workqueue: smc_hs_wq smc_listen_wor k [ 16.450531] RIP: 0010:smc_listen_work+0xc02/0x159 0 [ 16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024 6 [ 16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030 0 [ 16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000 0 [ 16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000 5 [ 16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640 0 [ 16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092 0 [ 16.454996] FS: 0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000 0 [ 16.455557] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003 3 [ 16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef 0 [ 16.456459] PKRU: 5555555 4 [ 16.456654] Call Trace : [ 16.456832] <TASK > [ 16.456989] ? __die+0x23/0x7 0 [ 16.457215] ? page_fault_oops+0x180/0x4c 0 [ 16.457508] ? __lock_acquire+0x3e6/0x249 0 [ 16.457801] ? exc_page_fault+0x68/0x20 0 [ 16.458080] ? asm_exc_page_fault+0x26/0x3 0 [ 16.458389] ? smc_listen_work+0xc02/0x159 0 [ 16.458689] ? smc_listen_work+0xc02/0x159 0 [ 16.458987] ? lock_is_held_type+0x8f/0x10 0 [ 16.459284] process_one_work+0x1ea/0x6d 0 [ 16.459570] worker_thread+0x1c3/0x38 0 [ 16.459839] ? __pfx_worker_thread+0x10/0x1 0 [ 16.460144] kthread+0xe0/0x11 0 [ 16.460372] ? __pfx_kthread+0x10/0x1 0 [ 16.460640] ret_from_fork+0x31/0x5 0 [ 16.460896] ? __pfx_kthread+0x10/0x1 0 [ 16.461166] ret_from_fork_asm+0x1a/0x3 0 [ 16.461453] </TASK > [ 16.461616] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE) ] [ 16.462134] CR2: 000000000000003 0 [ 16.462380] ---[ end trace 0000000000000000 ]--- [ 16.462710] RIP: 0010:smc_listen_work+0xc02/0x1590
The direct cause of this issue is that after smc_listen_out_connected(), newclcsock->sk may be NULL since it will releases the smcsk. Therefore, if the application closes the socket immediately after accept, newclcsock->sk can be NULL. A possible execution order could be as follows:
smc_listen_work | userspace
-----------------------------------------------------------------
lock_sock(sk) |
smc_listen_out_connected() |
| \- smc_listen_out |
| | \- release_sock |
| |- sk->sk_data_ready() |
| fd = accept();
| close(fd);
| \- socket->sk = NULL;/* newclcsock->sk is NULL now */
SMC_STAT_SERV_SUCC_INC(sock_net(newclcsock->sk))
Since smc_listen_out_connected() will not fail, simply swapping the order of the code can easily fix this issue.
--- net/smc/af_smc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/smc/af_smc.c +2 -1
@@ -2553,8 +2553,9 @@ static void smc_listen_work(struct work_struct *work) goto out_decl; } -smc_listen_out_connected (new_smc);SMC_STAT_SERV_SUCC_INC (sock_net (newclcsock->sk), ini); +/* smc_listen_out() will release smcsk */ +smc_listen_out_connected (new_smc); goto out_free; out_unlock:
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 573/587 LoongArch: Optimize module load time by optimizing PLT/GOT counting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kanglong Wang <[email protected]>
[ Upstream commit 63dbd8fb2af3a89466538599a9acb2d11ef65c06 ]
When enabling CONFIG_KASAN, CONFIG_PREEMPT_VOLUNTARY_BUILD and CONFIG_PREEMPT_VOLUNTARY at the same time, there will be soft deadlock, the relevant logs are as follows:
rcu: INFO: rcu_sched self-detected stall on CPU ... Call Trace: [<900000000024f9e4>] show_stack+0x5c/0x180 [<90000000002482f4>] dump_stack_lvl+0x94/0xbc [<9000000000224544>] rcu_dump_cpu_stacks+0x1fc/0x280 [<900000000037ac80>] rcu_sched_clock_irq+0x720/0xf88 [<9000000000396c34>] update_process_times+0xb4/0x150 [<90000000003b2474>] tick_nohz_handler+0xf4/0x250 [<9000000000397e28>] __hrtimer_run_queues+0x1d0/0x428 [<9000000000399b2c>] hrtimer_interrupt+0x214/0x538 [<9000000000253634>] constant_timer_interrupt+0x64/0x80 [<9000000000349938>] __handle_irq_event_percpu+0x78/0x1a0 [<9000000000349a78>] handle_irq_event_percpu+0x18/0x88 [<9000000000354c00>] handle_percpu_irq+0x90/0xf0 [<9000000000348c74>] handle_irq_desc+0x94/0xb8 [<9000000001012b28>] handle_cpu_irq+0x68/0xa0 [<9000000001def8c0>] handle_loongarch_irq+0x30/0x48 [<9000000001def958>] do_vint+0x80/0xd0 [<9000000000268a0c>] kasan_mem_to_shadow.part.0+0x2c/0x2a0 [<90000000006344f4>] __asan_load8+0x4c/0x120 [<900000000025c0d0>] module_frob_arch_sections+0x5c8/0x6b8 [<90000000003895f0>] load_module+0x9e0/0x2958 [<900000000038b770>] __do_sys_init_module+0x208/0x2d0 [<9000000001df0c34>] do_syscall+0x94/0x190 [<900000000024d6fc>] handle_syscall+0xbc/0x158
After analysis, this is because the slow speed of loading the amdgpu module leads to the long time occupation of the cpu and then the soft deadlock.
When loading a module, module_frob_arch_sections() tries to figure out the number of PLTs/GOTs that will be needed to handle all the RELAs. It will call the count_max_entries() to find in an out-of-order date which counting algorithm has O(n^2) complexity.
To make it faster, we sort the relocation list by info and addend. That way, to check for a duplicate relocation, it just needs to compare with the previous entry. This reduces the complexity of the algorithm to O(n
log n), as done in commit d4e0340919fb ("arm64/module: Optimize module
load time by optimizing PLT counting"). This gives sinificant reduction in module load time for modules with large number of relocations.
After applying this patch, the soft deadlock problem has been solved, and the kernel starts normally without "Call Trace".
Using the default configuration to test some modules, the results are as follows:
Module Size ip_tables 36K fat 143K radeon 2.5MB amdgpu 16MB
Without this patch:
Module Module load time (ms) Count(PLTs/GOTs) ip_tables 18 59/6 fat 0 162/14 radeon 54 1221/84 amdgpu 1411 4525/1098
With this patch:
Module Module load time (ms) Count(PLTs/GOTs) ip_tables 18 59/6 fat 0 162/14 radeon 22 1221/84 amdgpu 45 4525/1098
--- arch/loongarch/kernel/module-sections.c | 36 ++++++++++++------------- 1 file changed, 18 insertions(+), 18 deletions(-)
arch/loongarch/kernel/module-sections.c +18 -18
@@ -8,6 +8,7 @@#include <linux/module.h> #include <linux/moduleloader.h> #include <linux/ftrace.h> +#include <linux/sort.h> Elf_Addr module_emit_got_entry (struct module *mod,Elf_Shdr *sechdrs,Elf_Addr val) {
@@ -61,39 +62,38 @@ Elf_Addr module_emit_plt_entry(struct module *mod, Elf_Shdr *sechdrs, Elf_Addr vreturn (Elf_Addr)&plt[nr]; } -static int is_rela_equal (const Elf_Rela *x,const Elf_Rela *y) -{ -return x->r_info == y->r_info && x->r_addend == y->r_addend; -} +#define cmp_3way (a, b) ((a) < (b) ? -1 : (a) > (b)) -static bool duplicate_rela (const Elf_Rela *rela,int idx) +static int compare_rela (const void *x,const void *y) { -int i; +int ret; +const Elf_Rela *rela_x = x, *rela_y = y; -for (i =0 ; i < idx; i++) { -if (is_rela_equal (&rela[i], &rela[idx])) -return true; - } + ret =cmp_3way (rela_x->r_info, rela_y->r_info); +if (ret ==0 ) + ret =cmp_3way (rela_x->r_addend, rela_y->r_addend); -return false; +return ret; }static void count_max_entries (Elf_Rela *relas,int num,unsigned int *plts,unsigned int *gots) { -unsigned int i, type; +unsigned int i; + +sort (relas, num,sizeof (Elf_Rela), compare_rela,NULL );for (i =0 ; i < num; i++) { - type =ELF_R_TYPE (relas[i].r_info); -switch (type) { +if (i && !compare_rela (&relas[i-1 ], &relas[i])) +continue ; + +switch (ELF_R_TYPE (relas[i].r_info)) {case R_LARCH_SOP_PUSH_PLT_PCREL :case R_LARCH_B26 : -if (!duplicate_rela (relas, i)) - (*plts)++; + (*plts)++;break ;case R_LARCH_GOT_PC_HI20 : -if (!duplicate_rela (relas, i)) - (*gots)++; + (*gots)++;break ;default :break ;/* Do nothing. */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 574/587 ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 4d4d9ef9dfee877d494e5418f68a1016ef08cad6 ]
Resolve the budget negative overflow which leads to returning true in ixgbe_xmit_zc even when the budget of descs are thoroughly consumed.
Before this patch, when the budget is decreased to zero and finishes sending the last allowed desc in ixgbe_xmit_zc, it will always turn back and enter into the while() statement to see if it should keep processing packets, but in the meantime it unexpectedly decreases the value again to 'unsigned int (0--)', namely, UINT_MAX. Finally, the ixgbe_xmit_zc returns true, showing 'we complete cleaning the budget'. That also means 'clean_complete = true' in ixgbe_poll.
The true theory behind this is if that budget number of descs are consumed, it implies that we might have more descs to be done. So we should return false in ixgbe_xmit_zc to tell napi poll to find another chance to start polling to handle the rest of descs. On the contrary, returning true here means job done and we know we finish all the possible descs this time and we don't intend to start a new napi poll.
It is apparently against our expectations. Please also see how ixgbe_clean_tx_irq() handles the problem: it uses do..while() statement to make sure the budget can be decreased to zero at most and the negative overflow never happens.
The patch adds 'likely' because we rarely would not hit the loop condition since the standard budget is 256.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c +3 -1
@@ -403,7 +403,7 @@ static bool ixgbe_xmit_zc(struct ixgbe_ring *xdp_ring, unsigned int budget)dma_addr_t dma;u32 cmd_type; -while (budget-- >0 ) { +while (likely (budget)) {if (unlikely (!ixgbe_desc_unused (xdp_ring))) { work_done = false;break ;
@@ -438,6 +438,8 @@ static bool ixgbe_xmit_zc(struct ixgbe_ring *xdp_ring, unsigned int budget) xdp_ring->next_to_use++;if (xdp_ring->next_to_use == xdp_ring->count) xdp_ring->next_to_use =0 ; + + budget--; }if (tx_desc) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 575/587 igc: fix disabling L1.2 PCI-E link substate on I226 on init
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ValdikSS <[email protected]>
[ Upstream commit 1468c1f97cf32418e34dbb40b784ed9333b9e123 ]
Device ID comparison in igc_is_device_id_i226 is performed before the ID is set, resulting in always failing check on init.
Before the patch:
* L1.2 is not disabled on init
* L1.2 is properly disabled after suspend-resume cycle
With the patch:
* L1.2 is properly disabled both on init and after suspend-resume
How to test:
Connect to the 1G link with 300+ mbit/s Internet speed, and run the download speed test, such as:
curl -o /dev/null http://speedtest.selectel.ru/1GB
Without L1.2 disabled, the speed would be no more than ~200 mbit/s. With L1.2 disabled, the speed would reach 1 gbit/s.
Note: it's required that the latency between your host and the remote be around 3-5 ms, the test inside LAN (<1 ms latency) won't trigger the issue.
--- drivers/net/ethernet/intel/igc/igc_main.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/igc/igc_main.c +7 -7
@@ -6772,6 +6772,13 @@ static int igc_probe(struct pci_dev *pdev, adapter->port_num = hw->bus.func; adapter->msg_enable =netif_msg_init (debug,DEFAULT_MSG_ENABLE ); +/* PCI config space info */ + hw->vendor_id = pdev->vendor; + hw->device_id = pdev->device; + hw->revision_id = pdev->revision; + hw->subsystem_vendor_id = pdev->subsystem_vendor; + hw->subsystem_device_id = pdev->subsystem_device; +/* Disable ASPM L1.2 on I226 devices to avoid packet loss */ if (igc_is_device_id_i226 (hw))pci_disable_link_state (pdev,PCIE_LINK_STATE_L1_2 );
@@ -6797,13 +6804,6 @@ static int igc_probe(struct pci_dev *pdev, netdev->mem_start =pci_resource_start (pdev,0 ); netdev->mem_end =pci_resource_end (pdev,0 ); -/* PCI config space info */ - hw->vendor_id = pdev->vendor; - hw->device_id = pdev->device; - hw->revision_id = pdev->revision; - hw->subsystem_vendor_id = pdev->subsystem_vendor; - hw->subsystem_device_id = pdev->subsystem_device; -/* Copy the default MAC and PHY function pointers */ memcpy (&hw->mac.ops, ei->mac_ops,sizeof (hw->mac.ops));memcpy (&hw->phy.ops, ei->phy_ops,sizeof (hw->phy.ops));
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 576/587 net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Liu <[email protected]>
[ Upstream commit 15de71d06a400f7fdc15bf377a2552b0ec437cf5 ]
The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen
tc qdisc del dev lo root
tc qdisc add dev lo root handle 1: htb default 1
tc class add dev lo parent 1: classid 1:1 \
htb rate 64bit
tc qdisc add dev lo parent 1:1 handle f: \
cake memlimit 1b
ping -I lo -f -c1 -s64 -W0.001 127.0.0.1
This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow.
I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.
--- net/sched/sch_cake.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
net/sched/sch_cake.c +12 -2
@@ -1762,7 +1762,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,ktime_t now =ktime_get ();struct cake_tin_data *b;struct cake_flow *flow; -u32 idx; +u32 idx, tin;/* choose flow to insert into */ idx =cake_classify (sch, &b, skb, q->flow_mode, &ret);
@@ -1772,6 +1772,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,__qdisc_drop (skb, to_free);return ret; } + tin = (u32)(b - q->tins); idx--; flow = &b->flows[idx];
@@ -1939,13 +1940,22 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, q->buffer_max_used = q->buffer_used;if (q->buffer_used > q->buffer_limit) { +bool same_flow = false;u32 dropped =0 ; +u32 drop_id;while (q->buffer_used > q->buffer_limit) { dropped++; -cake_drop (sch, to_free); + drop_id =cake_drop (sch, to_free); + +if ((drop_id >>16 ) == tin && + (drop_id &0xFFFF ) == idx) + same_flow = true; } b->drop_overlimit += dropped; + +if (same_flow) +return NET_XMIT_CN ; }return NET_XMIT_SUCCESS ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 577/587 net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Liu <[email protected]>
[ Upstream commit 2c2192e5f9c7c2892fe2363244d1387f62710d83 ]
The WARN_ON trigger based on !cl->leaf.q->q.qlen is unnecessary in htb_activate. htb_dequeue_tree already accounts for that scenario.
--- net/sched/sch_htb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_htb.c +1 -1
@@ -592,7 +592,7 @@ htb_change_class_mode(struct htb_sched *q, struct htb_class *cl, s64 *diff)*/ static inline void htb_activate (struct htb_sched *q,struct htb_class *cl) { -WARN_ON (cl->level || !cl->leaf.q || !cl->leaf.q->q.qlen); +WARN_ON (cl->level || !cl->leaf.q);if (!cl->prio_activity) { cl->prio_activity =1 << cl->prio;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 578/587 bonding: update LACP activity flag after setting lacp_active
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit b64d035f77b1f02ab449393342264b44950a75ae ]
The port's actor_oper_port_state activity flag should be updated immediately after changing the lacp_active option to reflect the current mode correctly.
--- drivers/net/bonding/bond_3ad.c | 25 +++++++++++++++++++++++++ drivers/net/bonding/bond_options.c | 1 + include/net/bond_3ad.h | 1 + 3 files changed, 27 insertions(+)
drivers/net/bonding/bond_3ad.c +25 -0
@@ -2734,6 +2734,31 @@ void bond_3ad_update_lacp_rate(struct bonding *bond)spin_unlock_bh (&bond->mode_lock); } +/** +* bond_3ad_update_lacp_active - change the lacp active +* @bond: bonding struct +* +* Update actor_oper_port_state when lacp_active is modified. +*/ +void bond_3ad_update_lacp_active (struct bonding *bond) +{ +struct port *port =NULL ; +struct list_head *iter; +struct slave *slave; +int lacp_active; + + lacp_active = bond->params.lacp_active; +spin_lock_bh (&bond->mode_lock); +bond_for_each_slave (bond, slave, iter) { + port = &(SLAVE_AD_INFO (slave)->port); +if (lacp_active) + port->actor_oper_port_state |=LACP_STATE_LACP_ACTIVITY ; +else + port->actor_oper_port_state &= ~LACP_STATE_LACP_ACTIVITY ; + } +spin_unlock_bh (&bond->mode_lock); +} +size_t bond_3ad_stats_size (void ) { return nla_total_size_64bit(sizeof(u64)) + /* BOND_3AD_STAT_LACPDU_RX */
drivers/net/bonding/bond_options.c +1 -0
@@ -1618,6 +1618,7 @@ static int bond_option_lacp_active_set(struct bonding *bond,netdev_dbg (bond->dev,"Setting LACP active to %s (%llu)\n" , newval->string, newval->value); bond->params.lacp_active = newval->value; +bond_3ad_update_lacp_active (bond);return 0 ; }
include/net/bond_3ad.h +1 -0
@@ -302,6 +302,7 @@ int bond_3ad_lacpdu_recv(const struct sk_buff *skb, struct bonding *bond, struct slave *slave);int bond_3ad_set_carrier (struct bonding *bond);void bond_3ad_update_lacp_rate (struct bonding *bond); +void bond_3ad_update_lacp_active (struct bonding *bond);void bond_3ad_update_ad_actor_settings (struct bonding *bond);int bond_3ad_stats_fill (struct sk_buff *skb,struct bond_3ad_stats *stats);size_t bond_3ad_stats_size (void );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 579/587 bonding: Add independent control state machine
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aahil Awatramani <[email protected]>
[ Upstream commit 240fd405528bbf7fafa0559202ca7aa524c9cd96 ]
Add support for the independent control state machine per IEEE 802.1AX-2008 5.4.15 in addition to the existing implementation of the coupled control state machine.
Introduces two new states, AD_MUX_COLLECTING and AD_MUX_DISTRIBUTING in the LACP MUX state machine for separated handling of an initial Collecting state before the Collecting and Distributing state. This enables a port to be in a state where it can receive incoming packets while not still distributing. This is useful for reducing packet loss when a port begins distributing before its partner is able to collect.
Added new functions such as bond_set_slave_tx_disabled_flags and bond_set_slave_rx_enabled_flags to precisely manage the port's collecting and distributing states. Previously, there was no dedicated method to disable TX while keeping RX enabled, which this patch addresses.
Note that the regular flow process in the kernel's bonding driver remains unaffected by this patch. The extension requires explicit opt-in by the user (in order to ensure no disruptions for existing setups) via netlink support using the new bonding parameter coupled_control. The default value for coupled_control is set to 1 so as to preserve existing behaviour.
Stable-dep-of: 0599640a21e9 ("bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU")
--- Documentation/networking/bonding.rst | 12 ++ drivers/net/bonding/bond_3ad.c | 157 +++++++++++++++++++++++++-- drivers/net/bonding/bond_main.c | 1 + drivers/net/bonding/bond_netlink.c | 16 +++ drivers/net/bonding/bond_options.c | 28 ++++- include/net/bond_3ad.h | 2 + include/net/bond_options.h | 1 + include/net/bonding.h | 23 ++++ include/uapi/linux/if_link.h | 1 + tools/include/uapi/linux/if_link.h | 1 + 10 files changed, 234 insertions(+), 8 deletions(-)
Documentation/networking/bonding.rst +12 -0
@@ -444,6 +444,18 @@ arp_missed_max The default value is 2, and the allowable range is 1 - 255. +coupled_control + + Specifies whether the LACP state machine's MUX in the 802.3ad mode + should have separate Collecting and Distributing states. + + This is by implementing the independent control state machine per + IEEE 802.1AX-2008 5.4.15 in addition to the existing coupled control + state machine. + + The default value is 1. This setting does not separate the Collecting + and Distributing states, maintaining the bond in coupled control. + downdelay Specifies the time, in milliseconds, to wait before disabling
drivers/net/bonding/bond_3ad.c +150 -7
226 lines not on this page · raw message
drivers/net/bonding/bond_main.c +1 -0
@@ -6399,6 +6399,7 @@ static int __init bond_check_params(struct bond_params *params) params->ad_actor_sys_prio = ad_actor_sys_prio;eth_zero_addr (params->ad_actor_system); params->ad_user_port_key = ad_user_port_key; + params->coupled_control =1 ;if (packets_per_slave >0 ) { params->reciprocal_packets_per_slave =reciprocal_value (packets_per_slave);
drivers/net/bonding/bond_netlink.c +16 -0
@@ -122,6 +122,7 @@ static const struct nla_policy bond_policy[IFLA_BOND_MAX + 1] = { [IFLA_BOND_PEER_NOTIF_DELAY] = NLA_POLICY_FULL_RANGE(NLA_U32, &delay_range), [IFLA_BOND_MISSED_MAX] = { .type = NLA_U8 }, [IFLA_BOND_NS_IP6_TARGET] = { .type = NLA_NESTED }, + [IFLA_BOND_COUPLED_CONTROL] = { .type = NLA_U8 }, };static const struct nla_policy bond_slave_policy[IFLA_BOND_SLAVE_MAX +1 ] = {
@@ -549,6 +550,16 @@ static int bond_changelink(struct net_device *bond_dev, struct nlattr *tb[],return err; } +if (data[IFLA_BOND_COUPLED_CONTROL ]) { +int coupled_control =nla_get_u8 (data[IFLA_BOND_COUPLED_CONTROL ]); + +bond_opt_initval (&newval, coupled_control); + err =__bond_opt_set (bond,BOND_OPT_COUPLED_CONTROL , &newval, + data[IFLA_BOND_COUPLED_CONTROL ], extack); +if (err) +return err; + } +return 0 ; }
@@ -615,6 +626,7 @@ static size_t bond_get_size(const struct net_device *bond_dev)/* IFLA_BOND_NS_IP6_TARGET */ nla_total_size (sizeof (struct nlattr )) +nla_total_size (sizeof (struct in6_addr )) *BOND_MAX_NS_TARGETS + +nla_total_size (sizeof (u8)) +/* IFLA_BOND_COUPLED_CONTROL */ 0 ; }
@@ -774,6 +786,10 @@ static int bond_fill_info(struct sk_buff *skb, bond->params.missed_max)) goto nla_put_failure; +if (nla_put_u8 (skb,IFLA_BOND_COUPLED_CONTROL , + bond->params.coupled_control)) + goto nla_put_failure; +if (BOND_MODE (bond) ==BOND_MODE_8023AD ) {struct ad_info info;
drivers/net/bonding/bond_options.c +27 -1
@@ -85,7 +85,8 @@ static int bond_option_ad_user_port_key_set(struct bonding *bond, const struct bond_opt_value *newval);static int bond_option_missed_max_set (struct bonding *bond,const struct bond_opt_value *newval); - +static int bond_option_coupled_control_set (struct bonding *bond, +const struct bond_opt_value *newval);static const struct bond_opt_value bond_mode_tbl[] = { {"balance-rr" ,BOND_MODE_ROUNDROBIN ,BOND_VALFLAG_DEFAULT },
@@ -233,6 +234,12 @@ static const struct bond_opt_value bond_missed_max_tbl[] = { { NULL, -1, 0}, }; +static const struct bond_opt_value bond_coupled_control_tbl[] = { + { "on", 1, BOND_VALFLAG_DEFAULT}, + { "off", 0, 0}, + { NULL, -1, 0}, +}; + static const struct bond_option bond_opts[BOND_OPT_LAST] = { [BOND_OPT_MODE] = { .id = BOND_OPT_MODE,
@@ -497,6 +504,15 @@ static const struct bond_option bond_opts[BOND_OPT_LAST] = { .desc = "Delay between each peer notification on failover event, in milliseconds", .values = bond_peer_notif_delay_tbl, .set = bond_option_peer_notif_delay_set + }, + [BOND_OPT_COUPLED_CONTROL] = { + .id = BOND_OPT_COUPLED_CONTROL, + .name = "coupled_control", + .desc = "Opt into using coupled control MUX for LACP states", + .unsuppmodes = BOND_MODE_ALL_EX(BIT(BOND_MODE_8023AD)), + .flags = BOND_OPTFLAG_IFDOWN, + .values = bond_coupled_control_tbl, + .set = bond_option_coupled_control_set, } };
@@ -1812,3 +1828,13 @@ static int bond_option_ad_user_port_key_set(struct bonding *bond, bond->params.ad_user_port_key = newval->value;return 0 ; } + +static int bond_option_coupled_control_set (struct bonding *bond, +const struct bond_opt_value *newval) +{ +netdev_info (bond->dev,"Setting coupled_control to %s (%llu)\n" , + newval->string, newval->value); + + bond->params.coupled_control = newval->value; +return 0 ; +}
include/net/bond_3ad.h +2 -0
@@ -54,6 +54,8 @@ typedef enum {AD_MUX_DETACHED ,/* mux machine */ AD_MUX_WAITING ,/* mux machine */ AD_MUX_ATTACHED ,/* mux machine */ +AD_MUX_COLLECTING ,/* mux machine */ +AD_MUX_DISTRIBUTING ,/* mux machine */ AD_MUX_COLLECTING_DISTRIBUTING /* mux machine */ } mux_states_t;
include/net/bond_options.h +1 -0
@@ -76,6 +76,7 @@ enum {BOND_OPT_MISSED_MAX ,BOND_OPT_NS_TARGETS ,BOND_OPT_PRIO , +BOND_OPT_COUPLED_CONTROL , BOND_OPT_LAST };
include/net/bonding.h +23 -0
@@ -148,6 +148,7 @@ struct bond_params {#if IS_ENABLED (CONFIG_IPV6 )struct in6_addr ns_targets[BOND_MAX_NS_TARGETS ];#endif +int coupled_control;/* 2 bytes of padding : see ether_addr_equal_64bits() */ u8 ad_actor_system[ETH_ALEN +2 ];
@@ -167,6 +168,7 @@ struct slave { u8 backup:1, /* indicates backup slave. Value corresponds withBOND_STATE_ACTIVE and BOND_STATE_BACKUP */ inactive:1, /* indicates inactive slave */ + rx_disabled:1, /* indicates whether slave's Rx is disabled */ should_notify:1, /* indicates whether the state changed */ should_notify_link:1; /* indicates whether the link changed */u8 duplex;
@@ -568,6 +570,14 @@ static inline void bond_set_slave_inactive_flags(struct slave *slave,bond_set_slave_state (slave,BOND_STATE_BACKUP , notify);if (!slave->bond->params.all_slaves_active) slave->inactive =1 ; +if (BOND_MODE (slave->bond) ==BOND_MODE_8023AD ) + slave->rx_disabled =1 ; +} + +static inline void bond_set_slave_tx_disabled_flags (struct slave *slave, +bool notify) +{ +bond_set_slave_state (slave,BOND_STATE_BACKUP , notify); } static inline void bond_set_slave_active_flags(struct slave *slave,
@@ -575,6 +585,14 @@ static inline void bond_set_slave_active_flags(struct slave *slave, {bond_set_slave_state (slave,BOND_STATE_ACTIVE , notify); slave->inactive =0 ; +if (BOND_MODE (slave->bond) ==BOND_MODE_8023AD ) + slave->rx_disabled =0 ; +} + +static inline void bond_set_slave_rx_enabled_flags (struct slave *slave, +bool notify) +{ + slave->rx_disabled =0 ; }static inline bool bond_is_slave_inactive (struct slave *slave)
@@ -582,6 +600,11 @@ static inline bool bond_is_slave_inactive(struct slave *slave)return slave->inactive; } +static inline bool bond_is_slave_rx_disabled (struct slave *slave) +{ +return slave->rx_disabled; +} +static inline void bond_propose_link_state (struct slave *slave,int state) { slave->link_new_state = state;
include/uapi/linux/if_link.h +1 -0
@@ -950,6 +950,7 @@ enum {IFLA_BOND_AD_LACP_ACTIVE ,IFLA_BOND_MISSED_MAX ,IFLA_BOND_NS_IP6_TARGET , +IFLA_BOND_COUPLED_CONTROL , __IFLA_BOND_MAX, };
tools/include/uapi/linux/if_link.h +1 -0
@@ -865,6 +865,7 @@ enum {IFLA_BOND_AD_LACP_ACTIVE ,IFLA_BOND_MISSED_MAX ,IFLA_BOND_NS_IP6_TARGET , +IFLA_BOND_COUPLED_CONTROL , __IFLA_BOND_MAX, };
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 580/587 bonding: send LACPDUs periodically in passive mode after receiving partners LACPDU
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 0599640a21e98f0d6a3e9ff85c0a687c90a8103b ]
When lacp_active is set to off, the bond operates in passive mode, meaning it only "speaks when spoken to." However, the current kernel implementation only sends an LACPDU in response when the partner's state changes.
As a result, once LACP negotiation succeeds, the actor stops sending LACPDUs until the partner times out and sends an "expired" LACPDU. This causes continuous LACP state flapping.
According to IEEE 802.1AX-2014, 6.4.13 Periodic Transmission machine. The values of Partner_Oper_Port_State.LACP_Activity and Actor_Oper_Port_State.LACP_Activity determine whether periodic transmissions take place. If either or both parameters are set to Active LACP, then periodic transmissions occur; if both are set to Passive LACP, then periodic transmissions do not occur.
To comply with this, we remove the !bond->params.lacp_active check in ad_periodic_machine(). Instead, we initialize the actor's port's LACP_STATE_LACP_ACTIVITY state based on lacp_active setting.
Additionally, we avoid setting the partner's state to LACP_STATE_LACP_ACTIVITY in the EXPIRED state, since we should not assume the partner is active by default.
This ensures that in passive mode, the bond starts sending periodic LACPDUs after receiving one from the partner, and avoids flapping due to inactivity.
--- drivers/net/bonding/bond_3ad.c | 42 +++++++++++++++++++--------------- 1 file changed, 24 insertions(+), 18 deletions(-)
drivers/net/bonding/bond_3ad.c +24 -18
@@ -99,13 +99,13 @@ static int ad_marker_send(struct port *port, struct bond_marker *marker);static void ad_mux_machine (struct port *port,bool *update_slave_arr);static void ad_rx_machine (struct lacpdu *lacpdu,struct port *port);static void ad_tx_machine (struct port *port); -static void ad_periodic_machine (struct port *port,struct bond_params *bond_params); +static void ad_periodic_machine (struct port *port);static void ad_port_selection_logic (struct port *port,bool *update_slave_arr);static void ad_agg_selection_logic (struct aggregator *aggregator,bool *update_slave_arr);static void ad_clear_agg (struct aggregator *aggregator);static void ad_initialize_agg (struct aggregator *aggregator); -static void ad_initialize_port (struct port *port,int lacp_fast); +static void ad_initialize_port (struct port *port,const struct bond_params *bond_params);static void ad_enable_collecting (struct port *port);static void ad_disable_distributing (struct port *port,bool *update_slave_arr);
@@ -1300,10 +1300,16 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)* case of EXPIRED even if LINK_DOWN didn't arrive for * the port. */ - port->partner_oper.port_state &= ~LACP_STATE_SYNCHRONIZATION ; port->sm_vars &= ~AD_PORT_MATCHED ; +/* Based on IEEE 8021AX-2014, Figure 6-18 - Receive +* machine state diagram, the statue should be +* Partner_Oper_Port_State.Synchronization = FALSE; +* Partner_Oper_Port_State.LACP_Timeout = Short Timeout; +* start current_while_timer(Short Timeout); +* Actor_Oper_Port_State.Expired = TRUE; +*/ + port->partner_oper.port_state &= ~LACP_STATE_SYNCHRONIZATION ; port->partner_oper.port_state |=LACP_STATE_LACP_TIMEOUT ; - port->partner_oper.port_state |=LACP_STATE_LACP_ACTIVITY ; port->sm_rx_timer_counter =__ad_timer_to_ticks (AD_CURRENT_WHILE_TIMER , (u16)(AD_SHORT_TIMEOUT )); port->actor_oper_port_state |=LACP_STATE_EXPIRED ; port->sm_vars |=AD_PORT_CHURNED ;
@@ -1409,11 +1415,10 @@ static void ad_tx_machine(struct port *port)/** * ad_periodic_machine - handle a port's periodic state machine * @port: the port we're looking at -* @bond_params: bond parameters we will use * * Turn ntt flag on priodically to perform periodic transmission of lacpdu's. */ -static void ad_periodic_machine (struct port *port,struct bond_params *bond_params) +static void ad_periodic_machine (struct port *port) {periodic_states_t last_state;
@@ -1422,8 +1427,7 @@ static void ad_periodic_machine(struct port *port, struct bond_params *bond_para/* check if port was reinitialized */ if (((port->sm_vars &AD_PORT_BEGIN ) || !(port->sm_vars &AD_PORT_LACP_ENABLED ) || !port->is_enabled) || - (!(port->actor_oper_port_state &LACP_STATE_LACP_ACTIVITY ) && !(port->partner_oper.port_state &LACP_STATE_LACP_ACTIVITY )) || - !bond_params->lacp_active) { + (!(port->actor_oper_port_state &LACP_STATE_LACP_ACTIVITY ) && !(port->partner_oper.port_state &LACP_STATE_LACP_ACTIVITY ))) { port->sm_periodic_state =AD_NO_PERIODIC ; }/* check if state machine should change state */
@@ -1947,16 +1951,16 @@ static void ad_initialize_agg(struct aggregator *aggregator)/** * ad_initialize_port - initialize a given port's parameters * @port: the port we're looking at -* @lacp_fast: boolean. whether fast periodic should be used +* @bond_params: bond parameters we will use */ -static void ad_initialize_port (struct port *port,int lacp_fast) +static void ad_initialize_port (struct port *port,const struct bond_params *bond_params) {static const struct port_params tmpl = { .system_priority =0xffff , .key =1 , .port_number =1 , .port_priority =0xff , - .port_state =1 , + .port_state =0 , };static const struct lacpdu lacpdu = { .subtype =0x01 ,
@@ -1974,12 +1978,14 @@ static void ad_initialize_port(struct port *port, int lacp_fast) port->actor_port_priority =0xff ; port->actor_port_aggregator_identifier =0 ; port->ntt = false; - port->actor_admin_port_state =LACP_STATE_AGGREGATION | -LACP_STATE_LACP_ACTIVITY ; - port->actor_oper_port_state =LACP_STATE_AGGREGATION | -LACP_STATE_LACP_ACTIVITY ; + port->actor_admin_port_state =LACP_STATE_AGGREGATION ; + port->actor_oper_port_state =LACP_STATE_AGGREGATION ; +if (bond_params->lacp_active) { + port->actor_admin_port_state |=LACP_STATE_LACP_ACTIVITY ; + port->actor_oper_port_state |=LACP_STATE_LACP_ACTIVITY ; + } -if (lacp_fast) +if (bond_params->lacp_fast) port->actor_oper_port_state |=LACP_STATE_LACP_TIMEOUT ;memcpy (&port->partner_admin, &tmpl,sizeof (tmpl));
@@ -2195,7 +2201,7 @@ void bond_3ad_bind_slave(struct slave *slave)/* port initialization */ port = &(SLAVE_AD_INFO (slave)->port); -ad_initialize_port (port, bond->params.lacp_fast); +ad_initialize_port (port, &bond->params); port->slave = slave; port->actor_port_number =SLAVE_AD_INFO (slave)->id;
@@ -2507,7 +2513,7 @@ void bond_3ad_state_machine_handler(struct work_struct *work) }ad_rx_machine (NULL , port); -ad_periodic_machine (port, &bond->params); +ad_periodic_machine (port);ad_port_selection_logic (port, &update_slave_arr);ad_mux_machine (port, &update_slave_arr);ad_tx_machine (port);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 581/587 Octeontx2-af: Skip overlap check for SPI field
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hariprasad Kelam <[email protected]>
[ Upstream commit 8c5d95988c34f0aeba1f34cd5e4ba69494c90c5f ]
Octeontx2/CN10K silicon supports generating a 256-bit key per packet. The specific fields to be extracted from a packet for key generation are configurable via a Key Extraction (MKEX) Profile.
The AF driver scans the configured extraction profile to ensure that fields from upper layers do not overwrite fields from lower layers in the key.
Example Packet Field Layout:
LA: DMAC + SMAC
LB: VLAN
LC: IPv4/IPv6
LD: TCP/UDP
Valid MKEX Profile Configuration:
LA -> DMAC -> key_offset[0-5] LC -> SIP -> key_offset[20-23] LD -> SPORT -> key_offset[30-31]
Invalid MKEX profile configuration:
LA -> DMAC -> key_offset[0-5] LC -> SIP -> key_offset[20-23] LD -> SPORT -> key_offset[2-3] // Overlaps with DMAC field
In another scenario, if the MKEX profile is configured to extract the SPI field from both AH and ESP headers at the same key offset, the driver rejecting this configuration. In a regular traffic, ipsec packet will be having either AH(LD) or ESP (LE). This patch relaxes the check for the same.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c +2 -2
@@ -580,8 +580,8 @@ static void npc_set_features(struct rvu *rvu, int blkaddr, u8 intf)if (!npc_check_field (rvu, blkaddr,NPC_LB , intf)) *features &= ~BIT_ULL (NPC_OUTER_VID ); -/* Set SPI flag only if AH/ESP and IPSEC_SPI are in the key */ -if (npc_check_field (rvu, blkaddr,NPC_IPSEC_SPI , intf) && +/* Allow extracting SPI field from AH and ESP headers at same offset */ +if (npc_is_field_present (rvu,NPC_IPSEC_SPI , intf) && (*features & (BIT_ULL (NPC_IPPROTO_ESP ) |BIT_ULL (NPC_IPPROTO_AH )))) *features |=BIT_ULL (NPC_IPSEC_SPI );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 582/587 net/mlx5: Base ECVF devlink port attrs from 0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Jurgens <[email protected]>
[ Upstream commit bc17455bc843b2f4b206e0bb8139013eb3d3c08b ]
Adjust the vport number by the base ECVF vport number so the port attributes start at 0. Previously the port attributes would start 1 after the maximum number of host VFs.
--- drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c +3 -1
@@ -47,10 +47,12 @@ static void mlx5_esw_offloads_pf_vf_devlink_port_attrs_set(struct mlx5_eswitch *devlink_port_attrs_pci_vf_set (dl_port, controller_num, pfnum, vport_num -1 , external); }else if (mlx5_core_is_ec_vf_vport (esw->dev, vport_num)) { +u16 base_vport =mlx5_core_ec_vf_vport_base (dev); +memcpy (dl_port->attrs.switch_id.id, ppid.id, ppid.id_len); dl_port->attrs.switch_id.id_len = ppid.id_len;devlink_port_attrs_pci_vf_set (dl_port,0 , pfnum, - vport_num -1 , false); + vport_num - base_vport, false); } }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 583/587 net/mlx5e: Preserve shared buffer capacity during headroom updates
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armen Ratner <[email protected]>
[ Upstream commit 8b0587a885fdb34fd6090a3f8625cb7ac1444826 ]
When port buffer headroom changes, port_update_shared_buffer() recalculates the shared buffer size and splits it in a 3:1 ratio (lossy:lossless) - Currently, the calculation is:
lossless = shared / 4;
lossy = (shared / 4) * 3;
Meaning, the calculation dropped the remainder of shared % 4 due to integer division, unintentionally reducing the total shared buffer by up to three cells on each update. Over time, this could shrink the buffer below usable size.
Fix it by changing the calculation to:
lossless = shared / 4;
lossy = shared - lossless;
This retains all buffer cells while still approximating the intended 3:1 split, preventing capacity loss over time.
While at it, perform headroom calculations in units of cells rather than in bytes for more accurate calculations avoiding extra divisions.
--- .../mellanox/mlx5/core/en/port_buffer.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c +8 -10
@@ -272,8 +272,8 @@ static int port_update_shared_buffer(struct mlx5_core_dev *mdev,/* Total shared buffer size is split in a ratio of 3:1 between * lossy and lossless pools respectively. */ - lossy_epool_size = (shared_buffer_size /4 ) *3 ; lossless_ipool_size = shared_buffer_size /4 ; + lossy_epool_size = shared_buffer_size - lossless_ipool_size;mlx5e_port_set_sbpr (mdev,0 ,MLX5_EGRESS_DIR ,MLX5_LOSSY_POOL ,0 , lossy_epool_size);
@@ -288,14 +288,12 @@ static int port_set_buffer(struct mlx5e_priv *priv,u16 port_buff_cell_sz = priv->dcbx.port_buff_cell_sz;struct mlx5_core_dev *mdev = priv->mdev;int sz =MLX5_ST_SZ_BYTES (pbmc_reg); -u32 new_headroom_size =0 ; -u32 current_headroom_size; +u32 current_headroom_cells =0 ; +u32 new_headroom_cells =0 ;void *in;int err;int i; - current_headroom_size = port_buffer->headroom_size; - in =kzalloc (sz,GFP_KERNEL );if (!in)return -ENOMEM ;
@@ -306,12 +304,14 @@ static int port_set_buffer(struct mlx5e_priv *priv,for (i =0 ; i <MLX5E_MAX_NETWORK_BUFFER ; i++) {void *buffer =MLX5_ADDR_OF (pbmc_reg, in, buffer[i]); + current_headroom_cells +=MLX5_GET (bufferx_reg, buffer, size); +u64 size = port_buffer->buffer[i].size;u64 xoff = port_buffer->buffer[i].xoff;u64 xon = port_buffer->buffer[i].xon; - new_headroom_size += size;do_div (size, port_buff_cell_sz); + new_headroom_cells += size;do_div (xoff, port_buff_cell_sz);do_div (xon, port_buff_cell_sz);MLX5_SET (bufferx_reg, buffer, size, size);
@@ -320,10 +320,8 @@ static int port_set_buffer(struct mlx5e_priv *priv,MLX5_SET (bufferx_reg, buffer, xon_threshold, xon); } - new_headroom_size /= port_buff_cell_sz; - current_headroom_size /= port_buff_cell_sz; - err =port_update_shared_buffer (priv->mdev, current_headroom_size, - new_headroom_size); + err =port_update_shared_buffer (priv->mdev, current_headroom_cells, + new_headroom_cells);if (err) goto out;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 584/587 ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 8410fe81093ff231e964891e215b624dabb734b0 ]
The entry of the validators table for UAC3 feature unit is defined with a wrong sub-type UAC_FEATURE (= 0x06) while it should have been UAC3_FEATURE (= 0x07). This patch corrects the entry value.
--- sound/usb/validate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/validate.c +1 -1
@@ -285,7 +285,7 @@ static const struct usb_desc_validator audio_validators[] = {/* UAC_VERSION_3, UAC3_EXTENDED_TERMINAL: not implemented yet */ FUNC (UAC_VERSION_3 ,UAC3_MIXER_UNIT , validate_mixer_unit),FUNC (UAC_VERSION_3 ,UAC3_SELECTOR_UNIT , validate_selector_unit), -FUNC (UAC_VERSION_3 ,UAC_FEATURE_UNIT , validate_uac3_feature_unit), +FUNC (UAC_VERSION_3 ,UAC3_FEATURE_UNIT , validate_uac3_feature_unit),/* UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */ FUNC (UAC_VERSION_3 ,UAC3_PROCESSING_UNIT , validate_processing_unit), FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 585/587 s390/hypfs: Avoid unnecessary ioctl registration in debugfs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <[email protected]>
[ Upstream commit fec7bdfe7f8694a0c39e6c3ec026ff61ca1058b9 ]
Currently, hypfs registers ioctl callbacks for all debugfs files, despite only one file requiring them. This leads to unintended exposure of unused interfaces to user space and can trigger side effects such as restricted access when kernel lockdown is enabled.
Restrict ioctl registration to only those files that implement ioctl functionality to avoid interface clutter and unnecessary access restrictions.
--- arch/s390/hypfs/hypfs_dbfs.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
arch/s390/hypfs/hypfs_dbfs.c +11 -7
@@ -64,24 +64,28 @@ static long dbfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg)long rc;mutex_lock (&df->lock); -if (df->unlocked_ioctl) - rc = df->unlocked_ioctl (file, cmd, arg); -else - rc = -ENOTTY ; + rc = df->unlocked_ioctl (file, cmd, arg);mutex_unlock (&df->lock);return rc; } -static const struct file_operations dbfs_ops = { +static const struct file_operations dbfs_ops_ioctl = { .read = dbfs_read, .llseek = no_llseek, .unlocked_ioctl = dbfs_ioctl, }; +static const struct file_operations dbfs_ops = { + .read = dbfs_read, +}; +void hypfs_dbfs_create_file (struct hypfs_dbfs_file *df) { - df->dentry =debugfs_create_file (df->name,0400 , dbfs_dir, df, - &dbfs_ops); +const struct file_operations *fops = &dbfs_ops; + +if (df->unlocked_ioctl) + fops = &dbfs_ops_ioctl; + df->dentry =debugfs_create_file (df->name,0400 , dbfs_dir, df, fops);mutex_init (&df->lock); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 586/587 s390/hypfs: Enable limited access during lockdown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <[email protected]>
[ Upstream commit 3868f910440c47cd5d158776be4ba4e2186beda7 ]
When kernel lockdown is active, debugfs_locked_down() blocks access to hypfs files that register ioctl callbacks, even if the ioctl interface is not required for a function. This unnecessarily breaks userspace tools that only rely on read operations.
Resolve this by registering a minimal set of file operations during lockdown, avoiding ioctl registration and preserving access for affected tooling.
Note that this change restores hypfs functionality when lockdown is active from early boot (e.g. via lockdown=integrity kernel parameter), but does not apply to scenarios where lockdown is enabled dynamically while Linux is running.
--- arch/s390/hypfs/hypfs_dbfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/s390/hypfs/hypfs_dbfs.c +2 -1
@@ -6,6 +6,7 @@* Author(s): Michael Holzheu <[email protected]> */ +#include <linux/security.h> #include <linux/slab.h> #include "hypfs.h"
@@ -83,7 +84,7 @@ void hypfs_dbfs_create_file(struct hypfs_dbfs_file *df) {const struct file_operations *fops = &dbfs_ops; -if (df->unlocked_ioctl) +if (df->unlocked_ioctl && !security_locked_down (LOCKDOWN_DEBUGFS )) fops = &dbfs_ops_ioctl; df->dentry =debugfs_create_file (df->name,0400 , dbfs_dir, df, fops);mutex_init (&df->lock);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 587/587 netfilter: nf_reject: dont leak dst refcount for loopback packets
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 91a79b792204313153e1bdbbe5acbfc28903b3a5 ]
recent patches to add a WARN() when replacing skb dst entry found an old bug:
WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] ..
This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage.
Instead of checking hook just check if the skb already has a route attached to it.
--- net/ipv4/netfilter/nf_reject_ipv4.c | 6 ++---- net/ipv6/netfilter/nf_reject_ipv6.c | 5 ++--- 2 files changed, 4 insertions(+), 7 deletions(-)
net/ipv4/netfilter/nf_reject_ipv4.c +2 -4
@@ -247,8 +247,7 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,if (!oth)return ; -if ((hook ==NF_INET_PRE_ROUTING || hook ==NF_INET_INGRESS ) && -nf_reject_fill_skb_dst (oldskb) <0 ) +if (!skb_dst (oldskb) &&nf_reject_fill_skb_dst (oldskb) <0 )return ;if (skb_rtable (oldskb)->rt_flags & (RTCF_BROADCAST |RTCF_MULTICAST ))
@@ -321,8 +320,7 @@ void nf_send_unreach(struct sk_buff *skb_in, int code, int hook)if (iph->frag_off &htons (IP_OFFSET ))return ; -if ((hook ==NF_INET_PRE_ROUTING || hook ==NF_INET_INGRESS ) && -nf_reject_fill_skb_dst (skb_in) <0 ) +if (!skb_dst (skb_in) &&nf_reject_fill_skb_dst (skb_in) <0 )return ; if (skb_csum_unnecessary(skb_in) ||
net/ipv6/netfilter/nf_reject_ipv6.c +2 -3
@@ -293,7 +293,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb, fl6.fl6_sport = otcph->dest; fl6.fl6_dport = otcph->source; -if (hook ==NF_INET_PRE_ROUTING || hook ==NF_INET_INGRESS ) { +if (!skb_dst (oldskb)) {nf_ip6_route (net, &dst,flowi6_to_flowi (&fl6), false);if (!dst)return ;
@@ -397,8 +397,7 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in,if (hooknum ==NF_INET_LOCAL_OUT && skb_in->dev ==NULL ) skb_in->dev = net->loopback_dev; -if ((hooknum ==NF_INET_PRE_ROUTING || hooknum ==NF_INET_INGRESS ) && -nf_reject6_fill_skb_dst (skb_in) <0 ) +if (!skb_dst (skb_in) &&nf_reject6_fill_skb_dst (skb_in) <0 )return ;icmpv6_send (skb_in,ICMPV6_DEST_UNREACH , code,0 );
Signature · 1 line
2.50.1
Quoted 8 lines · On Tue, 26 Aug 2025 13:02:29 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.6.103 release. There are 587 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 28 Aug 2025 11:08:24 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64:
Thanks!
Cheers,
Miguel
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.103 release. There are 587 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 28 Aug 2025 11:08:24 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.103-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.6:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
120 tests: 120 pass, 0 failLinux version: 6.6.103-rc1-gdd454ff512a6
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Upstream commit:9e30ecf23b1b ("net: ipv4: fix incorrect MTU in broadcast routes")
introduces a regression which breaks IPv4 broadcast, which stops WOL working (breaking my CI system), among other things:
https://lore.kernel.org/regressions/[email protected]
Mainline fix pending.
# Librecast Test Results
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.6.103-rc1-gdd454ff512a6 #49 SMP PREEMPT_DYNAMIC Tue Aug 26 12:01:51 -00 2025 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.103 release. There are 587 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 28 Aug 2025 11:08:24 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.103-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Am 26.08.2025 um 13:02 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.6.103 release. There are 587 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.103 release. There are 587 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 28 Aug 2025 11:08:24 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.103-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.103 release. There are 587 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 28 Aug 2025 11:08:24 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.103-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro's test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.6.103-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: dd454ff512a6e333a3ff003fb0ab6297d90867be
* git describe: v6.6.102-588-gdd454ff512a6
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.102-588-gdd454ff512a6
## Test Regressions (compared to v6.6.101-263-g7ec7f0298ca2)
## Metric Regressions (compared to v6.6.101-263-g7ec7f0298ca2)
## Test Fixes (compared to v6.6.101-263-g7ec7f0298ca2)
## Metric Fixes (compared to v6.6.101-263-g7ec7f0298ca2)
## Test result summary
total: 278693, pass: 259513, fail: 6340, skip: 12440, xfail: 400
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 129 total, 129 passed, 0 failed
* arm64: 44 total, 44 passed, 0 failed
* i386: 23 total, 23 passed, 0 failed
* mips: 26 total, 25 passed, 1 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 32 total, 31 passed, 1 failed
* riscv: 15 total, 15 passed, 0 failed
* s390: 14 total, 13 passed, 1 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 7 total, 7 passed, 0 failed
* x86_64: 37 total, 36 passed, 1 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mm
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* modules
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.103 release. There are 587 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.