1. 18 Oct, 2021 1 commit
    • Randy Dunlap's avatar
      hamradio: baycom_epp: fix build for UML · 0a9bb11a
      Randy Dunlap authored
      On i386, the baycom_epp driver wants to inspect X86 CPU features (TSC)
      and then act on that data, but that info is not available when running
      on UML, so prevent that test and do the default action.
      
      Prevents this build error on UML + i386:
      
      ../drivers/net/hamradio/baycom_epp.c: In function ‘epp_bh’:
      ../drivers/net/hamradio/baycom_epp.c:630:6: error: implicit declaration of function ‘boot_cpu_has’; did you mean ‘get_cpu_mask’? [-Werror=implicit-function-declaration]
        if (boot_cpu_has(X86_FEATURE_TSC))   \
            ^
      ../drivers/net/hamradio/baycom_epp.c:658:2: note: in expansion of macro ‘GETTICK’
        GETTICK(time1);
      
      Fixes: 68f5d3f3 ("um: add PCI over virtio emulation driver")
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Cc: linux-um@lists.infradead.org
      Cc: Jeff Dike <jdike@addtoit.com>
      Cc: Richard Weinberger <richard@nod.at>
      Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: Thomas Sailer <t.sailer@alumni.ethz.ch>
      Cc: linux-hams@vger.kernel.org
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0a9bb11a
  2. 16 Oct, 2021 3 commits
    • Nikolay Aleksandrov's avatar
      net: bridge: mcast: use multicast_membership_interval for IGMPv3 · fac3cb82
      Nikolay Aleksandrov authored
      When I added IGMPv3 support I decided to follow the RFC for computing
      the GMI dynamically:
      " 8.4. Group Membership Interval
      
         The Group Membership Interval is the amount of time that must pass
         before a multicast router decides there are no more members of a
         group or a particular source on a network.
      
         This value MUST be ((the Robustness Variable) times (the Query
         Interval)) plus (one Query Response Interval)."
      
      But that actually is inconsistent with how the bridge used to compute it
      for IGMPv2, where it was user-configurable that has a correct default value
      but it is up to user-space to maintain it. This would make it consistent
      with the other timer values which are also maintained correct by the user
      instead of being dynamically computed. It also changes back to the previous
      user-expected GMI behaviour for IGMPv3 queries which were supported before
      IGMPv3 was added. Note that to properly compute it dynamically we would
      need to add support for "Robustness Variable" which is currently missing.
      Reported-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Fixes: 0436862e ("net: bridge: mcast: support for IGMPv3/MLDv2 ALLOW_NEW_SOURCES report")
      Signed-off-by: default avatarNikolay Aleksandrov <nikolay@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fac3cb82
    • Stefano Garzarella's avatar
      vsock_diag_test: remove free_sock_stat() call in test_no_sockets · ba95a622
      Stefano Garzarella authored
      In `test_no_sockets` we don't expect any sockets, indeed
      check_no_sockets() prints an error and exits if `sockets` list is
      not empty, so free_sock_stat() call is unnecessary since it would
      only be called when the `sockets` list is empty.
      
      This was discovered by a strange warning printed by gcc v11.2.1:
        In file included from ../../include/linux/list.h:7,
                         from vsock_diag_test.c:18:
        vsock_diag_test.c: In function ‘test_no_sockets’:
        ../../include/linux/kernel.h:35:45: error: array subscript ‘struct vsock_stat[0]’ is partly outside array bound
        s of ‘struct list_head[1]’ [-Werror=array-bounds]
           35 |         const typeof(((type *)0)->member) * __mptr = (ptr);     \
              |                                             ^~~~~~
        ../../include/linux/list.h:352:9: note: in expansion of macro ‘container_of’
          352 |         container_of(ptr, type, member)
              |         ^~~~~~~~~~~~
        ../../include/linux/list.h:393:9: note: in expansion of macro ‘list_entry’
          393 |         list_entry((pos)->member.next, typeof(*(pos)), member)
              |         ^~~~~~~~~~
        ../../include/linux/list.h:522:21: note: in expansion of macro ‘list_next_entry’
          522 |                 n = list_next_entry(pos, member);                       \
              |                     ^~~~~~~~~~~~~~~
        vsock_diag_test.c:325:9: note: in expansion of macro ‘list_for_each_entry_safe’
          325 |         list_for_each_entry_safe(st, next, sockets, list) {
              |         ^~~~~~~~~~~~~~~~~~~~~~~~
        In file included from vsock_diag_test.c:18:
        vsock_diag_test.c:333:19: note: while referencing ‘sockets’
          333 |         LIST_HEAD(sockets);
              |                   ^~~~~~~
        ../../include/linux/list.h:23:26: note: in definition of macro ‘LIST_HEAD’
           23 |         struct list_head name = LIST_HEAD_INIT(name)
      
      It seems related to some compiler optimization and assumption
      about the empty `sockets` list, since this warning is printed
      only with -02 or -O3. Also removing `exit(1)` from
      check_no_sockets() makes the warning disappear since in that
      case free_sock_stat() can be reached also when the list is
      not empty.
      Reported-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
      Signed-off-by: default avatarStefano Garzarella <sgarzare@redhat.com>
      Link: https://lore.kernel.org/r/20211014152045.173872-1-sgarzare@redhat.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      ba95a622
    • Jakub Kicinski's avatar
      Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue · 2151135a
      Jakub Kicinski authored
      Tony Nguyen says:
      
      ====================
      Intel Wired LAN Driver Updates 2021-10-14
      
      Brett ensures RDMA nodes are removed during release and rebuild. He also
      corrects fw.mgmt.api to include the patch number for proper
      identification.
      
      Dave stops ida_free() being called when an IDA has not been allocated.
      
      Michal corrects the order of parameters being provided and the number of
      entries skipped for UDP tunnels.
      ====================
      
      Link: https://lore.kernel.org/r/20211014181953.3538330-1-anthony.l.nguyen@intel.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      2151135a
  3. 15 Oct, 2021 9 commits
  4. 14 Oct, 2021 17 commits
    • Linus Torvalds's avatar
      Merge tag 'net-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · ec681c53
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Quite calm.
      
        The noisy DSA driver (embedded switches) changes, and adjustment to
        IPv6 IOAM behavior add to diffstat's bottom line but are not scary.
      
        Current release - regressions:
      
         - af_unix: rename UNIX-DGRAM to UNIX to maintain backwards
           compatibility
      
         - procfs: revert "add seq_puts() statement for dev_mcast", minor
           format change broke user space
      
        Current release - new code bugs:
      
         - dsa: fix bridge_num not getting cleared after ports leaving the
           bridge, resource leak
      
         - dsa: tag_dsa: send packets with TX fwd offload from VLAN-unaware
           bridges using VID 0, prevent packet drops if pvid is removed
      
         - dsa: mv88e6xxx: keep the pvid at 0 when VLAN-unaware, prevent HW
           getting confused about station to VLAN mapping
      
        Previous releases - regressions:
      
         - virtio-net: fix for skb_over_panic inside big mode
      
         - phy: do not shutdown PHYs in READY state
      
         - dsa: mv88e6xxx: don't use PHY_DETECT on internal PHY's, fix link
           LED staying lit after ifdown
      
         - mptcp: fix possible infinite wait on recvmsg(MSG_WAITALL)
      
         - mqprio: Correct stats in mqprio_dump_class_stats()
      
         - ice: fix deadlock for Tx timestamp tracking flush
      
         - stmmac: fix feature detection on old hardware
      
        Previous releases - always broken:
      
         - sctp: account stream padding length for reconf chunk
      
         - icmp: fix icmp_ext_echo_iio parsing in icmp_build_probe()
      
         - isdn: cpai: check ctr->cnr to avoid array index out of bound
      
         - isdn: mISDN: fix sleeping function called from invalid context
      
         - nfc: nci: fix potential UAF of rf_conn_info object
      
         - dsa: microchip: prevent ksz_mib_read_work from kicking back in
           after it's canceled in .remove and crashing
      
         - dsa: mv88e6xxx: isolate the ATU databases of standalone and bridged
           ports
      
         - dsa: sja1105, ocelot: break circular dependency between switch and
           tag drivers
      
         - dsa: felix: improve timestamping in presence of packe loss
      
         - mlxsw: thermal: fix out-of-bounds memory accesses
      
        Misc:
      
         - ipv6: ioam: move the check for undefined bits to improve
           interoperability"
      
      * tag 'net-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (60 commits)
        icmp: fix icmp_ext_echo_iio parsing in icmp_build_probe
        MAINTAINERS: Update the devicetree documentation path of imx fec driver
        sctp: account stream padding length for reconf chunk
        mlxsw: thermal: Fix out-of-bounds memory accesses
        ethernet: s2io: fix setting mac address during resume
        NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
        NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
        nfc: fix error handling of nfc_proto_register()
        Revert "net: procfs: add seq_puts() statement for dev_mcast"
        net: encx24j600: check error in devm_regmap_init_encx24j600
        net: korina: select CRC32
        net: arc: select CRC32
        net: dsa: felix: break at first CPU port during init and teardown
        net: dsa: tag_ocelot_8021q: fix inability to inject STP BPDUs into BLOCKING ports
        net: dsa: felix: purge skb from TX timestamping queue if it cannot be sent
        net: dsa: tag_ocelot_8021q: break circular dependency with ocelot switch lib
        net: dsa: tag_ocelot: break circular dependency with ocelot switch lib driver
        net: mscc: ocelot: cross-check the sequence id from the timestamp FIFO with the skb PTP header
        net: mscc: ocelot: deny TX timestamping of non-PTP packets
        net: mscc: ocelot: warn when a PTP IRQ is raised for an unknown skb
        ...
      ec681c53
    • Brett Creeley's avatar
      ice: Print the api_patch as part of the fw.mgmt.api · b726ddf9
      Brett Creeley authored
      Currently when a user uses "devlink dev info", the fw.mgmt.api will be
      the major.minor numbers as shown below:
      
      devlink dev info pci/0000:3b:00.0
      pci/0000:3b:00.0:
        driver ice
        serial_number 00-01-00-ff-ff-00-00-00
        versions:
            fixed:
              board.id K91258-000
            running:
              fw.mgmt 6.1.2
              fw.mgmt.api 1.7 <--- No patch number included
              fw.mgmt.build 0xd75e7d06
              fw.mgmt.srev 5
              fw.undi 1.2992.0
              fw.undi.srev 5
              fw.psid.api 3.10
              fw.bundle_id 0x800085cc
              fw.app.name ICE OS Default Package
              fw.app 1.3.27.0
              fw.app.bundle_id 0xc0000001
              fw.netlist 3.10.2000-3.1e.0
              fw.netlist.build 0x2a76e110
            stored:
              fw.mgmt.srev 5
              fw.undi 1.2992.0
              fw.undi.srev 5
              fw.psid.api 3.10
              fw.bundle_id 0x800085cc
              fw.netlist 3.10.2000-3.1e.0
              fw.netlist.build 0x2a76e110
      
      There are many features in the driver that depend on the major, minor,
      and patch version of the FW. Without the patch number in the output for
      fw.mgmt.api debugging issues related to the FW API version is difficult.
      Also, using major.minor.patch aligns with the existing firmware version
      which uses a 3 digit value.
      
      Fix this by making the fw.mgmt.api print the major.minor.patch
      versions. Shown below is the result:
      
      devlink dev info pci/0000:3b:00.0
      pci/0000:3b:00.0:
        driver ice
        serial_number 00-01-00-ff-ff-00-00-00
        versions:
            fixed:
              board.id K91258-000
            running:
              fw.mgmt 6.1.2
              fw.mgmt.api 1.7.9 <--- patch number included
              fw.mgmt.build 0xd75e7d06
              fw.mgmt.srev 5
              fw.undi 1.2992.0
              fw.undi.srev 5
              fw.psid.api 3.10
              fw.bundle_id 0x800085cc
              fw.app.name ICE OS Default Package
              fw.app 1.3.27.0
              fw.app.bundle_id 0xc0000001
              fw.netlist 3.10.2000-3.1e.0
              fw.netlist.build 0x2a76e110
            stored:
              fw.mgmt.srev 5
              fw.undi 1.2992.0
              fw.undi.srev 5
              fw.psid.api 3.10
              fw.bundle_id 0x800085cc
              fw.netlist 3.10.2000-3.1e.0
              fw.netlist.build 0x2a76e110
      
      Fixes: ff2e5c70 ("ice: add basic handler for devlink .info_get")
      Signed-off-by: default avatarBrett Creeley <brett.creeley@intel.com>
      Tested-by: default avatarGurucharan G <gurucharanx.g@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      b726ddf9
    • Michal Swiatkowski's avatar
      ice: fix getting UDP tunnel entry · e4c2efa1
      Michal Swiatkowski authored
      Correct parameters order in call to ice_tunnel_idx_to_entry function.
      
      Entry in sparse port table is correct when the idx is 0. For idx 1 one
      correct entry should be skipped, for idx 2 two of them should be skipped
      etc. Change if condition to be true when idx is 0, which means that
      previous valid entry of this tunnel type were skipped.
      
      Fixes: b20e6c17 ("ice: convert to new udp_tunnel infrastructure")
      Signed-off-by: default avatarMichal Swiatkowski <michal.swiatkowski@linux.intel.com>
      Tested-by: default avatarGurucharan G <gurucharanx.g@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      e4c2efa1
    • Dave Ertman's avatar
      ice: Avoid crash from unnecessary IDA free · 73e30a62
      Dave Ertman authored
      In the remove path, there is an attempt to free the aux_idx IDA whether
      it was allocated or not.  This can potentially cause a crash when
      unloading the driver on systems that do not initialize support for RDMA.
      But, this free cannot be gated by the status bit for RDMA, since it is
      allocated if the driver detects support for RDMA at probe time, but the
      driver can enter into a state where RDMA is not supported after the IDA
      has been allocated at probe time and this would lead to a memory leak.
      
      Initialize aux_idx to an invalid value and check for a valid value when
      unloading to determine if an IDA free is necessary.
      
      Fixes: d25a0fc4 ("ice: Initialize RDMA support")
      Reported-by: default avatarJun Miao <jun.miao@windriver.com>
      Signed-off-by: default avatarDave Ertman <david.m.ertman@intel.com>
      Tested-by: default avatarJesse Brandeburg <jesse.brandeburg@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      73e30a62
    • Brett Creeley's avatar
      ice: Fix failure to re-add LAN/RDMA Tx queues · ff7e9321
      Brett Creeley authored
      Currently if the VSI is rebuilt/removed and the RDMA PF driver is active
      the RDMA Tx queue scheduler node configuration will not be cleaned up.
      This will cause the rebuild/re-add of the VSI to fail due to the
      software structures not being correctly cleaned up for the VSI index.
      Fix this by always calling ice_rm_vsi_rdma_cfg() for all VSI. If there
      are no RDMA scheduler nodes created, then there is no harm in calling
      ice_rm_vsi_rdma_cfg(). This change applies to all VSI types, so if
      RDMA support is added for other VSI types they will also get this
      change.
      
      Fixes: 348048e7 ("ice: Implement iidc operations")
      Signed-off-by: default avatarBrett Creeley <brett.creeley@intel.com>
      Tested-by: default avatarJerzy Wiktor Jurkowski <jerzy.wiktor.jurkowski@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      ff7e9321
    • Xin Long's avatar
      icmp: fix icmp_ext_echo_iio parsing in icmp_build_probe · 1fcd7945
      Xin Long authored
      In icmp_build_probe(), the icmp_ext_echo_iio parsing should be done
      step by step and skb_header_pointer() return value should always be
      checked, this patch fixes 3 places in there:
      
        - On case ICMP_EXT_ECHO_CTYPE_NAME, it should only copy ident.name
          from skb by skb_header_pointer(), its len is ident_len. Besides,
          the return value of skb_header_pointer() should always be checked.
      
        - On case ICMP_EXT_ECHO_CTYPE_INDEX, move ident_len check ahead of
          skb_header_pointer(), and also do the return value check for
          skb_header_pointer().
      
        - On case ICMP_EXT_ECHO_CTYPE_ADDR, before accessing iio->ident.addr.
          ctype3_hdr.addrlen, skb_header_pointer() should be called first,
          then check its return value and ident_len.
          On subcases ICMP_AFI_IP and ICMP_AFI_IP6, also do check for ident.
          addr.ctype3_hdr.addrlen and skb_header_pointer()'s return value.
          On subcase ICMP_AFI_IP, the len for skb_header_pointer() should be
          "sizeof(iio->extobj_hdr) + sizeof(iio->ident.addr.ctype3_hdr) +
          sizeof(struct in_addr)" or "ident_len".
      
      v1->v2:
        - To make it more clear, call skb_header_pointer() once only for
          iio->indent's parsing as Jakub Suggested.
      v2->v3:
        - The extobj_hdr.length check against sizeof(_iio) should be done
          before calling skb_header_pointer(), as Eric noticed.
      
      Fixes: d329ea5b ("icmp: add response to RFC 8335 PROBE messages")
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Link: https://lore.kernel.org/r/31628dd76657ea62f5cf78bb55da6b35240831f1.1634205050.git.lucien.xin@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      1fcd7945
    • Cai Huoqing's avatar
      MAINTAINERS: Update the devicetree documentation path of imx fec driver · ea142b09
      Cai Huoqing authored
      Change the devicetree documentation path
      to "Documentation/devicetree/bindings/net/fsl,fec.yaml"
      since 'fsl-fec.txt' has been converted to 'fsl,fec.yaml' already.
      Signed-off-by: default avatarCai Huoqing <caihuoqing@baidu.com>
      Link: https://lore.kernel.org/r/20211014110214.3254-1-caihuoqing@baidu.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      ea142b09
    • Eiichi Tsukata's avatar
      sctp: account stream padding length for reconf chunk · a2d859e3
      Eiichi Tsukata authored
      sctp_make_strreset_req() makes repeated calls to sctp_addto_chunk()
      which will automatically account for padding on each call. inreq and
      outreq are already 4 bytes aligned, but the payload is not and doing
      SCTP_PAD4(a + b) (which _sctp_make_chunk() did implicitly here) is
      different from SCTP_PAD4(a) + SCTP_PAD4(b) and not enough. It led to
      possible attempt to use more buffer than it was allocated and triggered
      a BUG_ON.
      
      Cc: Vlad Yasevich <vyasevich@gmail.com>
      Cc: Neil Horman <nhorman@tuxdriver.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Fixes: cc16f00f ("sctp: add support for generating stream reconf ssn reset request chunk")
      Reported-by: default avatarEiichi Tsukata <eiichi.tsukata@nutanix.com>
      Signed-off-by: default avatarEiichi Tsukata <eiichi.tsukata@nutanix.com>
      Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarMarcelo Ricardo Leitner <mleitner@redhat.com>
      Reviewed-by: default avatarXin Long <lucien.xin@gmail.com>
      Link: https://lore.kernel.org/r/b97c1f8b0c7ff79ac4ed206fc2c49d3612e0850c.1634156849.git.mleitner@redhat.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      a2d859e3
    • Ido Schimmel's avatar
      mlxsw: thermal: Fix out-of-bounds memory accesses · 332fdf95
      Ido Schimmel authored
      Currently, mlxsw allows cooling states to be set above the maximum
      cooling state supported by the driver:
      
       # cat /sys/class/thermal/thermal_zone2/cdev0/type
       mlxsw_fan
       # cat /sys/class/thermal/thermal_zone2/cdev0/max_state
       10
       # echo 18 > /sys/class/thermal/thermal_zone2/cdev0/cur_state
       # echo $?
       0
      
      This results in out-of-bounds memory accesses when thermal state
      transition statistics are enabled (CONFIG_THERMAL_STATISTICS=y), as the
      transition table is accessed with a too large index (state) [1].
      
      According to the thermal maintainer, it is the responsibility of the
      driver to reject such operations [2].
      
      Therefore, return an error when the state to be set exceeds the maximum
      cooling state supported by the driver.
      
      To avoid dead code, as suggested by the thermal maintainer [3],
      partially revert commit a421ce08 ("mlxsw: core: Extend cooling
      device with cooling levels") that tried to interpret these invalid
      cooling states (above the maximum) in a special way. The cooling levels
      array is not removed in order to prevent the fans going below 20% PWM,
      which would cause them to get stuck at 0% PWM.
      
      [1]
      BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x271/0x290
      Read of size 4 at addr ffff8881052f7bf8 by task kworker/0:0/5
      
      CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.15.0-rc3-custom-45935-gce1adf704b14 #122
      Hardware name: Mellanox Technologies Ltd. "MSN2410-CB2FO"/"SA000874", BIOS 4.6.5 03/08/2016
      Workqueue: events_freezable_power_ thermal_zone_device_check
      Call Trace:
       dump_stack_lvl+0x8b/0xb3
       print_address_description.constprop.0+0x1f/0x140
       kasan_report.cold+0x7f/0x11b
       thermal_cooling_device_stats_update+0x271/0x290
       __thermal_cdev_update+0x15e/0x4e0
       thermal_cdev_update+0x9f/0xe0
       step_wise_throttle+0x770/0xee0
       thermal_zone_device_update+0x3f6/0xdf0
       process_one_work+0xa42/0x1770
       worker_thread+0x62f/0x13e0
       kthread+0x3ee/0x4e0
       ret_from_fork+0x1f/0x30
      
      Allocated by task 1:
       kasan_save_stack+0x1b/0x40
       __kasan_kmalloc+0x7c/0x90
       thermal_cooling_device_setup_sysfs+0x153/0x2c0
       __thermal_cooling_device_register.part.0+0x25b/0x9c0
       thermal_cooling_device_register+0xb3/0x100
       mlxsw_thermal_init+0x5c5/0x7e0
       __mlxsw_core_bus_device_register+0xcb3/0x19c0
       mlxsw_core_bus_device_register+0x56/0xb0
       mlxsw_pci_probe+0x54f/0x710
       local_pci_probe+0xc6/0x170
       pci_device_probe+0x2b2/0x4d0
       really_probe+0x293/0xd10
       __driver_probe_device+0x2af/0x440
       driver_probe_device+0x51/0x1e0
       __driver_attach+0x21b/0x530
       bus_for_each_dev+0x14c/0x1d0
       bus_add_driver+0x3ac/0x650
       driver_register+0x241/0x3d0
       mlxsw_sp_module_init+0xa2/0x174
       do_one_initcall+0xee/0x5f0
       kernel_init_freeable+0x45a/0x4de
       kernel_init+0x1f/0x210
       ret_from_fork+0x1f/0x30
      
      The buggy address belongs to the object at ffff8881052f7800
       which belongs to the cache kmalloc-1k of size 1024
      The buggy address is located 1016 bytes inside of
       1024-byte region [ffff8881052f7800, ffff8881052f7c00)
      The buggy address belongs to the page:
      page:0000000052355272 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1052f0
      head:0000000052355272 order:3 compound_mapcount:0 compound_pincount:0
      flags: 0x200000000010200(slab|head|node=0|zone=2)
      raw: 0200000000010200 ffffea0005034800 0000000300000003 ffff888100041dc0
      raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
      page dumped because: kasan: bad access detected
      
      Memory state around the buggy address:
       ffff8881052f7a80: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc
       ffff8881052f7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      >ffff8881052f7b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                                      ^
       ffff8881052f7c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
       ffff8881052f7c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      
      [2] https://lore.kernel.org/linux-pm/9aca37cb-1629-5c67-1895-1fdc45c0244e@linaro.org/
      [3] https://lore.kernel.org/linux-pm/af9857f2-578e-de3a-e62b-6baff7e69fd4@linaro.org/
      
      CC: Daniel Lezcano <daniel.lezcano@linaro.org>
      Fixes: a50c1e35 ("mlxsw: core: Implement thermal zone")
      Fixes: a421ce08 ("mlxsw: core: Extend cooling device with cooling levels")
      Signed-off-by: default avatarIdo Schimmel <idosch@nvidia.com>
      Tested-by: default avatarVadim Pasternak <vadimp@nvidia.com>
      Link: https://lore.kernel.org/r/20211012174955.472928-1-idosch@idosch.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      332fdf95
    • Arnd Bergmann's avatar
      ethernet: s2io: fix setting mac address during resume · 40507e7a
      Arnd Bergmann authored
      After recent cleanups, gcc started warning about a suspicious
      memcpy() call during the s2io_io_resume() function:
      
      In function '__dev_addr_set',
          inlined from 'eth_hw_addr_set' at include/linux/etherdevice.h:318:2,
          inlined from 's2io_set_mac_addr' at drivers/net/ethernet/neterion/s2io.c:5205:2,
          inlined from 's2io_io_resume' at drivers/net/ethernet/neterion/s2io.c:8569:7:
      arch/x86/include/asm/string_32.h:182:25: error: '__builtin_memcpy' accessing 6 bytes at offsets 0 and 2 overlaps 4 bytes at offset 2 [-Werror=restrict]
        182 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
            |                         ^~~~~~~~~~~~~~~~~~~~~~~~~
      include/linux/netdevice.h:4648:9: note: in expansion of macro 'memcpy'
       4648 |         memcpy(dev->dev_addr, addr, len);
            |         ^~~~~~
      
      What apparently happened is that an old cleanup changed the calling
      conventions for s2io_set_mac_addr() from taking an ethernet address
      as a character array to taking a struct sockaddr, but one of the
      callers was not changed at the same time.
      
      Change it to instead call the low-level do_s2io_prog_unicast() function
      that still takes the old argument type.
      
      Fixes: 2fd37688 ("S2io: Added support set_mac_address driver entry point")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Link: https://lore.kernel.org/r/20211013143613.2049096-1-arnd@kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      40507e7a
    • Dinh Nguyen's avatar
      MAINTAINERS: Update entry for the Stratix10 firmware · 26d65741
      Dinh Nguyen authored
      Richard Gong is no longer at Intel, so update the MAINTAINER's entry for
      the Stratix10 firmware drivers.
      Signed-off-by: default avatarDinh Nguyen <dinguyen@kernel.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      26d65741
    • Linus Torvalds's avatar
      Merge tag 'sound-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 1626d9a3
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This contains quite a few device-specific fixes for usual HD- and
        USB-audio in addition to a couple of ALSA core fixes (a UAF fix in
        sequencer and a fix for a misplaced PCM 32bit compat ioctl).
      
        Nothing really stands out"
      
      * tag 'sound-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: usb-audio: Add quirk for VF0770
        ALSA: hda: avoid write to STATESTS if controller is in reset
        ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW
        ALSA: pcm: Workaround for a wrong offset in SYNC_PTR compat ioctl
        ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo 13s Gen2
        ALSA: hda: intel: Allow repeatedly probing on codec configuration errors
        ALSA: hda/realtek: Add quirk for TongFang PHxTxX1
        ALSA: hda/realtek - ALC236 headset MIC recording issue
        ALSA: usb-audio: Enable rate validation for Scarlett devices
        ALSA: hda/realtek: Add quirk for Clevo X170KM-G
        ALSA: hda/realtek: Complete partial device name to avoid ambiguity
        ALSA: hda - Enable headphone mic on Dell Latitude laptops with ALC3254
        ALSA: seq: Fix a potential UAF by wrong private_free call order
        ALSA: hda/realtek: Enable 4-speaker output for Dell Precision 5560 laptop
        ALSA: usb-audio: Fix a missing error check in scarlett gen2 mixer
      1626d9a3
    • Jakub Kicinski's avatar
      Merge branch 'fix-two-possible-memory-leak-problems-in-nfc-digital-module' · cbcc5072
      Jakub Kicinski authored
      Ziyang Xuan says:
      
      ====================
      Fix two possible memory leak problems in NFC digital module.
      ====================
      
      Link: https://lore.kernel.org/r/cover.1634111083.git.william.xuanziyang@huawei.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      cbcc5072
    • Ziyang Xuan's avatar
      NFC: digital: fix possible memory leak in digital_in_send_sdd_req() · 291c932f
      Ziyang Xuan authored
      'skb' is allocated in digital_in_send_sdd_req(), but not free when
      digital_in_send_cmd() failed, which will cause memory leak. Fix it
      by freeing 'skb' if digital_in_send_cmd() return failed.
      
      Fixes: 2c66daec ("NFC Digital: Add NFC-A technology support")
      Signed-off-by: default avatarZiyang Xuan <william.xuanziyang@huawei.com>
      Reviewed-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      291c932f
    • Ziyang Xuan's avatar
      NFC: digital: fix possible memory leak in digital_tg_listen_mdaa() · 58e7dcc9
      Ziyang Xuan authored
      'params' is allocated in digital_tg_listen_mdaa(), but not free when
      digital_send_cmd() failed, which will cause memory leak. Fix it by
      freeing 'params' if digital_send_cmd() return failed.
      
      Fixes: 1c7a4c24 ("NFC Digital: Add target NFC-DEP support")
      Signed-off-by: default avatarZiyang Xuan <william.xuanziyang@huawei.com>
      Reviewed-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      58e7dcc9
    • Ziyang Xuan's avatar
      nfc: fix error handling of nfc_proto_register() · 0911ab31
      Ziyang Xuan authored
      When nfc proto id is using, nfc_proto_register() return -EBUSY error
      code, but forgot to unregister proto. Fix it by adding proto_unregister()
      in the error handling case.
      
      Fixes: c7fe3b52 ("NFC: add NFC socket family")
      Signed-off-by: default avatarZiyang Xuan <william.xuanziyang@huawei.com>
      Reviewed-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
      Link: https://lore.kernel.org/r/20211013034932.2833737-1-william.xuanziyang@huawei.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      0911ab31
    • Vladimir Oltean's avatar
      Revert "net: procfs: add seq_puts() statement for dev_mcast" · 1f922d9e
      Vladimir Oltean authored
      This reverts commit ec18e845.
      
      It turns out that there are user space programs which got broken by that
      change. One example is the "ifstat" program shipped by Debian:
      https://packages.debian.org/source/bullseye/ifstat
      which, confusingly enough, seems to not have anything in common with the
      much more familiar (at least to me) ifstat program from iproute2:
      https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/misc/ifstat.c
      
      root@debian:~# ifstat
      ifstat: /proc/net/dev: unsupported format.
      
      This change modified the header (first two lines of text) in
      /proc/net/dev so that it looks like this:
      
      root@debian:~# cat /proc/net/dev
      Interface|                            Receive                                       |                                 Transmit
               |            bytes      packets errs   drop fifo frame compressed multicast|            bytes      packets errs   drop fifo colls carrier compressed
             lo:            97400         1204    0      0    0     0          0         0            97400         1204    0      0    0     0       0          0
          bond0:                0            0    0      0    0     0          0         0                0            0    0      0    0     0       0          0
           sit0:                0            0    0      0    0     0          0         0                0            0    0      0    0     0       0          0
           eno2:          5002206         6651    0      0    0     0          0         0        105518642      1465023    0      0    0     0       0          0
           swp0:           134531         2448    0      0    0     0          0         0         99599598      1464381    0      0    0     0       0          0
           swp1:                0            0    0      0    0     0          0         0                0            0    0      0    0     0       0          0
           swp2:          4867675         4203    0      0    0     0          0         0            58134          631    0      0    0     0       0          0
          sw0p0:                0            0    0      0    0     0          0         0                0            0    0      0    0     0       0          0
          sw0p1:           124739         2448    0   1422    0     0          0         0         93741184      1464369    0      0    0     0       0          0
          sw0p2:                0            0    0      0    0     0          0         0                0            0    0      0    0     0       0          0
          sw2p0:          4850863         4203    0      0    0     0          0         0            54722          619    0      0    0     0       0          0
          sw2p1:                0            0    0      0    0     0          0         0                0            0    0      0    0     0       0          0
          sw2p2:                0            0    0      0    0     0          0         0                0            0    0      0    0     0       0          0
          sw2p3:                0            0    0      0    0     0          0         0                0            0    0      0    0     0       0          0
            br0:            10508          212    0    212    0     0          0       212         61369558       958857    0      0    0     0       0          0
      
      whereas before it looked like this:
      
      root@debian:~# cat /proc/net/dev
      Inter-|   Receive                                                |  Transmit
       face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
          lo:   13160     164    0    0    0     0          0         0    13160     164    0    0    0     0       0          0
       bond0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
        sit0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
        eno2:   30824     268    0    0    0     0          0         0     3332      37    0    0    0     0       0          0
        swp0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
        swp1:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
        swp2:   30824     268    0    0    0     0          0         0     2428      27    0    0    0     0       0          0
       sw0p0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
       sw0p1:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
       sw0p2:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
       sw2p0:   29752     268    0    0    0     0          0         0     1564      17    0    0    0     0       0          0
       sw2p1:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
       sw2p2:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
       sw2p3:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
      
      The reason why the ifstat shipped by Debian (v1.1, with a Debian patch
      upgrading it to 1.1-8.1 at the time of writing) is broken is because its
      "proc" driver/backend parses the header very literally:
      
      main/drivers.c#L825
        if (!data->checked && strncmp(buf, "Inter-|", 7))
          goto badproc;
      
      and there's no way in which the header can be changed such that programs
      parsing like that would not get broken.
      
      Even if we fix this ancient and very "lightly" maintained program to
      parse the text output of /proc/net/dev in a more sensible way, this
      story seems bound to repeat again with other programs, and modifying
      them all could cause more trouble than it's worth. On the other hand,
      the reverted patch had no other reason than an aesthetic one, so
      reverting it is the simplest way out.
      
      I don't know what other distributions would be affected; the fact that
      Debian doesn't ship the iproute2 version of the program (a different
      code base altogether, which uses netlink and not /proc/net/dev) is
      surprising in itself.
      
      Fixes: ec18e845 ("net: procfs: add seq_puts() statement for dev_mcast")
      Link: https://lore.kernel.org/netdev/20211009163511.vayjvtn3rrteglsu@skbuf/
      Cc: Yajun Deng <yajun.deng@linux.dev>
      Cc: Matthieu Baerts <matthieu.baerts@tessares.net>
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Link: https://lore.kernel.org/r/20211013001909.3164185-1-vladimir.oltean@nxp.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      1f922d9e
  5. 13 Oct, 2021 10 commits
    • Nanyong Sun's avatar
      net: encx24j600: check error in devm_regmap_init_encx24j600 · f03dca0c
      Nanyong Sun authored
      devm_regmap_init may return error which caused by like out of memory,
      this will results in null pointer dereference later when reading
      or writing register:
      
      general protection fault in encx24j600_spi_probe
      KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
      CPU: 0 PID: 286 Comm: spi-encx24j600- Not tainted 5.15.0-rc2-00142-g9978db750e31-dirty #11 9c53a778c1306b1b02359f3c2bbedc0222cba652
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
      RIP: 0010:regcache_cache_bypass drivers/base/regmap/regcache.c:540
      Code: 54 41 89 f4 55 53 48 89 fb 48 83 ec 08 e8 26 94 a8 fe 48 8d bb a0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 4a 03 00 00 4c 8d ab b0 00 00 00 48 8b ab a0 00
      RSP: 0018:ffffc900010476b8 EFLAGS: 00010207
      RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: 0000000000000000
      RDX: 0000000000000012 RSI: ffff888002de0000 RDI: 0000000000000094
      RBP: ffff888013c9a000 R08: 0000000000000000 R09: fffffbfff3f9cc6a
      R10: ffffc900010476e8 R11: fffffbfff3f9cc69 R12: 0000000000000001
      R13: 000000000000000a R14: ffff888013c9af54 R15: ffff888013c9ad08
      FS:  00007ffa984ab580(0000) GS:ffff88801fe00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 000055a6384136c8 CR3: 000000003bbe6003 CR4: 0000000000770ef0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      PKRU: 55555554
      Call Trace:
       encx24j600_spi_probe drivers/net/ethernet/microchip/encx24j600.c:459
       spi_probe drivers/spi/spi.c:397
       really_probe drivers/base/dd.c:517
       __driver_probe_device drivers/base/dd.c:751
       driver_probe_device drivers/base/dd.c:782
       __device_attach_driver drivers/base/dd.c:899
       bus_for_each_drv drivers/base/bus.c:427
       __device_attach drivers/base/dd.c:971
       bus_probe_device drivers/base/bus.c:487
       device_add drivers/base/core.c:3364
       __spi_add_device drivers/spi/spi.c:599
       spi_add_device drivers/spi/spi.c:641
       spi_new_device drivers/spi/spi.c:717
       new_device_store+0x18c/0x1f1 [spi_stub 4e02719357f1ff33f5a43d00630982840568e85e]
       dev_attr_store drivers/base/core.c:2074
       sysfs_kf_write fs/sysfs/file.c:139
       kernfs_fop_write_iter fs/kernfs/file.c:300
       new_sync_write fs/read_write.c:508 (discriminator 4)
       vfs_write fs/read_write.c:594
       ksys_write fs/read_write.c:648
       do_syscall_64 arch/x86/entry/common.c:50
       entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:113
      
      Add error check in devm_regmap_init_encx24j600 to avoid this situation.
      
      Fixes: 04fbfce7 ("net: Microchip encx24j600 driver")
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarNanyong Sun <sunnanyong@huawei.com>
      Link: https://lore.kernel.org/r/20211012125901.3623144-1-sunnanyong@huawei.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      f03dca0c
    • Jakub Kicinski's avatar
      Merge tag 'mlx5-fixes-2021-10-12' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux · b70b1521
      Jakub Kicinski authored
      Saeed Mahameed says:
      
      ====================
      mlx5 fixes 2021-10-12
      
      * tag 'mlx5-fixes-2021-10-12' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux:
        net/mlx5e: Fix division by 0 in mlx5e_select_queue for representors
        net/mlx5e: Mutually exclude RX-FCS and RX-port-timestamp
        net/mlx5e: Switchdev representors are not vlan challenged
        net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path
        net/mlx5e: Allow only complete TXQs partition in MQPRIO channel mode
        net/mlx5: Fix cleanup of bridge delayed work
      ====================
      
      Link: https://lore.kernel.org/r/20211012205323.20123-1-saeed@kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      b70b1521
    • Vegard Nossum's avatar
      net: korina: select CRC32 · 427f974d
      Vegard Nossum authored
      Fix the following build/link error by adding a dependency on the CRC32
      routines:
      
        ld: drivers/net/ethernet/korina.o: in function `korina_multicast_list':
        korina.c:(.text+0x1af): undefined reference to `crc32_le'
      
      Fixes: ef11291b ("Add support the Korina (IDT RC32434) Ethernet MAC")
      Cc: Arnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
      Acked-by: default avatarFlorian fainelli <f.fainelli@gmail.com>
      Link: https://lore.kernel.org/r/20211012152509.21771-1-vegard.nossum@oracle.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      427f974d
    • Vegard Nossum's avatar
      net: arc: select CRC32 · e599ee23
      Vegard Nossum authored
      Fix the following build/link error by adding a dependency on the CRC32
      routines:
      
        ld: drivers/net/ethernet/arc/emac_main.o: in function `arc_emac_set_rx_mode':
        emac_main.c:(.text+0xb11): undefined reference to `crc32_le'
      
      The crc32_le() call comes through the ether_crc_le() call in
      arc_emac_set_rx_mode().
      
      [v2: moved the select to ARC_EMAC_CORE; the Makefile is a bit confusing,
      but the error comes from emac_main.o, which is part of the arc_emac module,
      which in turn is enabled by CONFIG_ARC_EMAC_CORE. Note that arc_emac is
      different from emac_arc...]
      
      Fixes: 775dd682 ("arc_emac: implement promiscuous mode and multicast filtering")
      Cc: Arnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
      Link: https://lore.kernel.org/r/20211012093446.1575-1-vegard.nossum@oracle.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      e599ee23
    • Linus Torvalds's avatar
      Merge tag 'modules-for-v5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux · 348949d9
      Linus Torvalds authored
      Pull modules fix from Jessica Yu:
      
       - Build fix for cfi_init() when CONFIG_MODULE_UNLOAD=n
      
      * tag 'modules-for-v5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux:
        module: fix clang CFI with MODULE_UNLOAD=n
      348949d9
    • Jakub Kicinski's avatar
      Merge branch 'felix-dsa-driver-fixes' · 847c6bdb
      Jakub Kicinski authored
      Vladimir Oltean says:
      
      ====================
      Felix DSA driver fixes
      
      This is an assorted collection of fixes for issues seen on the NXP
      LS1028A switch.
      
      - PTP packet drops due to switch congestion result in catastrophic
        damage to the driver's state
      - loops are not blocked by STP if using the ocelot-8021q tagger
      - driver uses the wrong CPU port when two of them are defined in DT
      - module autoloading is broken* with both tagging protocol drivers
        (ocelot and ocelot-8021q)
      
      Changes in v2:
      - Stop printing that we aren't going to take TX timestamps if we don't
        have TX timestamping anyway, and we are just carrying PTP frames for a
        cascaded DSA switch.
      - Shorten the deferred xmit kthread name so that it fits the 16
        character limit (TASK_COMM_LEN)
      ====================
      
      Link: https://lore.kernel.org/r/20211012114044.2526146-1-vladimir.oltean@nxp.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      847c6bdb
    • Vladimir Oltean's avatar
      net: dsa: felix: break at first CPU port during init and teardown · 8d5f7954
      Vladimir Oltean authored
      The NXP LS1028A switch has two Ethernet ports towards the CPU, but only
      one of them is capable of acting as an NPI port at a time (inject and
      extract packets using DSA tags).
      
      However, using the alternative ocelot-8021q tagging protocol, it should
      be possible to use both CPU ports symmetrically, but for that we need to
      mark both ports in the device tree as DSA masters.
      
      In the process of doing that, it can be seen that traffic to/from the
      network stack gets broken, and this is because the Felix driver iterates
      through all DSA CPU ports and configures them as NPI ports. But since
      there can only be a single NPI port, we effectively end up in a
      situation where DSA thinks the default CPU port is the first one, but
      the hardware port configured to be an NPI is the last one.
      
      I would like to treat this as a bug, because if the updated device trees
      are going to start circulating, it would be really good for existing
      kernels to support them, too.
      
      Fixes: adb3dccf ("net: dsa: felix: convert to the new .change_tag_protocol DSA API")
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      8d5f7954
    • Vladimir Oltean's avatar
      net: dsa: tag_ocelot_8021q: fix inability to inject STP BPDUs into BLOCKING ports · 43ba33b4
      Vladimir Oltean authored
      When setting up a bridge with stp_state 1, topology changes are not
      detected and loops are not blocked. This is because the standard way of
      transmitting a packet, based on VLAN IDs redirected by VCAP IS2 to the
      right egress port, does not override the port STP state (in the case of
      Ocelot switches, that's really the PGID_SRC masks).
      
      To force a packet to be injected into a port that's BLOCKING, we must
      send it as a control packet, which means in the case of this tagger to
      send it using the manual register injection method. We already do this
      for PTP frames, extend the logic to apply to any link-local MAC DA.
      
      Fixes: 7c83a7c5 ("net: dsa: add a second tagger for Ocelot switches based on tag_8021q")
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      43ba33b4
    • Vladimir Oltean's avatar
      net: dsa: felix: purge skb from TX timestamping queue if it cannot be sent · 1328a883
      Vladimir Oltean authored
      At present, when a PTP packet which requires TX timestamping gets
      dropped under congestion by the switch, things go downhill very fast.
      The driver keeps a clone of that skb in a queue of packets awaiting TX
      timestamp interrupts, but interrupts will never be raised for the
      dropped packets.
      
      Moreover, matching timestamped packets to timestamps is done by a 2-bit
      timestamp ID, and this can wrap around and we can match on the wrong skb.
      
      Since with the default NPI-based tagging protocol, we get no notification
      about packet drops, the best we can do is eventually recover from the
      drop of a PTP frame: its skb will be dead memory until another skb which
      was assigned the same timestamp ID happens to find it.
      
      However, with the ocelot-8021q tagger which injects packets using the
      manual register interface, it appears that we can check for more
      information, such as:
      
      - whether the input queue has reached the high watermark or not
      - whether the injection group's FIFO can accept additional data or not
      
      so we know that a PTP frame is likely to get dropped before actually
      sending it, and drop it ourselves (because DSA uses NETIF_F_LLTX, so it
      can't return NETDEV_TX_BUSY to ask the qdisc to requeue the packet).
      
      But when we do that, we can also remove the skb from the timestamping
      queue, because there surely won't be any timestamp that matches it.
      
      Fixes: 0a6f17c6 ("net: dsa: tag_ocelot_8021q: add support for PTP timestamping")
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      1328a883
    • Vladimir Oltean's avatar
      net: dsa: tag_ocelot_8021q: break circular dependency with ocelot switch lib · 49f885b2
      Vladimir Oltean authored
      Michael reported that when using the "ocelot-8021q" tagging protocol,
      the switch driver module must be manually loaded before the tagging
      protocol can be loaded/is available.
      
      This appears to be the same problem described here:
      https://lore.kernel.org/netdev/20210908220834.d7gmtnwrorhharna@skbuf/
      where due to the fact that DSA tagging protocols make use of symbols
      exported by the switch drivers, circular dependencies appear and this
      breaks module autoloading.
      
      The ocelot_8021q driver needs the ocelot_can_inject() and
      ocelot_port_inject_frame() functions from the switch library. Previously
      the wrong approach was taken to solve that dependency: shims were
      provided for the case where the ocelot switch library was compiled out,
      but that turns out to be insufficient, because the dependency when the
      switch lib _is_ compiled is problematic too.
      
      We cannot declare ocelot_can_inject() and ocelot_port_inject_frame() as
      static inline functions, because these access I/O functions like
      __ocelot_write_ix() which is called by ocelot_write_rix(). Making those
      static inline basically means exposing the whole guts of the ocelot
      switch library, not ideal...
      
      We already have one tagging protocol driver which calls into the switch
      driver during xmit but not using any exported symbol: sja1105_defer_xmit.
      We can do the same thing here: create a kthread worker and one work item
      per skb, and let the switch driver itself do the register accesses to
      send the skb, and then consume it.
      
      Fixes: 0a6f17c6 ("net: dsa: tag_ocelot_8021q: add support for PTP timestamping")
      Reported-by: default avatarMichael Walle <michael@walle.cc>
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      49f885b2