1. 16 Oct, 2019 5 commits
    • MarkLee's avatar
      arm: dts: mediatek: Update mt7629 dts to reflect the latest dt-binding · 2618500d
      MarkLee authored
      * Removes mediatek,physpeed property from dtsi that is useless in PHYLINK
      * Use the fixed-link property speed = <2500> to set the phy in 2.5Gbit.
      * Set gmac1 to gmii mode that connect to a internal gphy
      Signed-off-by: default avatarMarkLee <Mark-MC.Lee@mediatek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2618500d
    • MarkLee's avatar
      net: ethernet: mediatek: Fix MT7629 missing GMII mode support · 4e3eff5b
      MarkLee authored
      In the original design, mtk_phy_connect function will set ge_mode=1
      if phy-mode is GMII(PHY_INTERFACE_MODE_GMII) and then set the correct
      ge_mode to ETHSYS_SYSCFG0 register. This logic was broken after apply
      mediatek PHYLINK patch(Fixes tag), the new mtk_mac_config function will
      not set ge_mode=1 for GMII mode hence the final ETHSYS_SYSCFG0 setting
      will be incorrect for mt7629 GMII mode. This patch add the missing logic
      back to fix it.
      
      Fixes: b8fc9f30 ("net: ethernet: mediatek: Add basic PHYLINK support")
      Signed-off-by: default avatarMarkLee <Mark-MC.Lee@mediatek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4e3eff5b
    • David S. Miller's avatar
      Merge branch 'mpls-push-pop-fix' · 8d045995
      David S. Miller authored
      Davide Caratti says:
      
      ====================
      net/sched: fix wrong behavior of MPLS push/pop action
      
      this series contains two fixes for TC 'act_mpls', that try to address
      two problems that can be observed configuring simple 'push' / 'pop'
      operations:
      - patch 1/2 avoids dropping non-MPLS packets that pass through the MPLS
        'pop' action.
      - patch 2/2 fixes corruption of the L2 header that occurs when 'push'
        or 'pop' actions are configured in TC egress path.
      
      v2: - change commit message in patch 1/2 to better describe that the
            patch impacts only TC, thanks to Simon Horman
          - fix missing documentation of 'mac_len' in patch 2/2
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8d045995
    • Davide Caratti's avatar
      net/sched: fix corrupted L2 header with MPLS 'push' and 'pop' actions · fa4e0f88
      Davide Caratti authored
      the following script:
      
       # tc qdisc add dev eth0 clsact
       # tc filter add dev eth0 egress protocol ip matchall \
       > action mpls push protocol mpls_uc label 0x355aa bos 1
      
      causes corruption of all IP packets transmitted by eth0. On TC egress, we
      can't rely on the value of skb->mac_len, because it's 0 and a MPLS 'push'
      operation will result in an overwrite of the first 4 octets in the packet
      L2 header (e.g. the Destination Address if eth0 is an Ethernet); the same
      error pattern is present also in the MPLS 'pop' operation. Fix this error
      in act_mpls data plane, computing 'mac_len' as the difference between the
      network header and the mac header (when not at TC ingress), and use it in
      MPLS 'push'/'pop' core functions.
      
      v2: unbreak 'make htmldocs' because of missing documentation of 'mac_len'
          in skb_mpls_pop(), reported by kbuild test robot
      
      CC: Lorenzo Bianconi <lorenzo@kernel.org>
      Fixes: 2a2ea508 ("net: sched: add mpls manipulation actions to TC")
      Reviewed-by: default avatarSimon Horman <simon.horman@netronome.com>
      Acked-by: default avatarJohn Hurley <john.hurley@netronome.com>
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fa4e0f88
    • Davide Caratti's avatar
      net: avoid errors when trying to pop MLPS header on non-MPLS packets · dedc5a08
      Davide Caratti authored
      the following script:
      
       # tc qdisc add dev eth0 clsact
       # tc filter add dev eth0 egress matchall action mpls pop
      
      implicitly makes the kernel drop all packets transmitted by eth0, if they
      don't have a MPLS header. This behavior is uncommon: other encapsulations
      (like VLAN) just let the packet pass unmodified. Since the result of MPLS
      'pop' operation would be the same regardless of the presence / absence of
      MPLS header(s) in the original packet, we can let skb_mpls_pop() return 0
      when dealing with non-MPLS packets.
      
      For the OVS use-case, this is acceptable because __ovs_nla_copy_actions()
      already ensures that MPLS 'pop' operation only occurs with packets having
      an MPLS Ethernet type (and there are no other callers in current code, so
      the semantic change should be ok).
      
      v2: better documentation of use-cases for skb_mpls_pop(), thanks to Simon
          Horman
      
      Fixes: 2a2ea508 ("net: sched: add mpls manipulation actions to TC")
      Reviewed-by: default avatarSimon Horman <simon.horman@netronome.com>
      Acked-by: default avatarJohn Hurley <john.hurley@netronome.com>
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dedc5a08
  2. 15 Oct, 2019 12 commits
  3. 14 Oct, 2019 1 commit
    • Miaoqing Pan's avatar
      ath10k: fix latency issue for QCA988x · d79749f7
      Miaoqing Pan authored
      (kvalo: cherry picked from commit 1340cc63 in
      wireless-drivers-next to wireless-drivers as this a frequently reported
      regression)
      
      Bad latency is found on QCA988x, the issue was introduced by
      commit 4504f0e5 ("ath10k: sdio: workaround firmware UART
      pin configuration bug"). If uart_pin_workaround is false, this
      change will set uart pin even if uart_print is false.
      
      Tested HW: QCA9880
      Tested FW: 10.2.4-1.0-00037
      
      Fixes: 4504f0e5 ("ath10k: sdio: workaround firmware UART pin configuration bug")
      Signed-off-by: default avatarMiaoqing Pan <miaoqing@codeaurora.org>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      d79749f7
  4. 13 Oct, 2019 13 commits
    • YueHaibing's avatar
      netdevsim: Fix error handling in nsim_fib_init and nsim_fib_exit · 33902b4a
      YueHaibing authored
      In nsim_fib_init(), if register_fib_notifier failed, nsim_fib_net_ops
      should be unregistered before return.
      
      In nsim_fib_exit(), unregister_fib_notifier should be called before
      nsim_fib_net_ops be unregistered, otherwise may cause use-after-free:
      
      BUG: KASAN: use-after-free in nsim_fib_event_nb+0x342/0x570 [netdevsim]
      Read of size 8 at addr ffff8881daaf4388 by task kworker/0:3/3499
      
      CPU: 0 PID: 3499 Comm: kworker/0:3 Not tainted 5.3.0-rc7+ #30
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
      Workqueue: ipv6_addrconf addrconf_dad_work [ipv6]
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0xa9/0x10e lib/dump_stack.c:113
       print_address_description+0x65/0x380 mm/kasan/report.c:351
       __kasan_report+0x149/0x18d mm/kasan/report.c:482
       kasan_report+0xe/0x20 mm/kasan/common.c:618
       nsim_fib_event_nb+0x342/0x570 [netdevsim]
       notifier_call_chain+0x52/0xf0 kernel/notifier.c:95
       __atomic_notifier_call_chain+0x78/0x140 kernel/notifier.c:185
       call_fib_notifiers+0x30/0x60 net/core/fib_notifier.c:30
       call_fib6_entry_notifiers+0xc1/0x100 [ipv6]
       fib6_add+0x92e/0x1b10 [ipv6]
       __ip6_ins_rt+0x40/0x60 [ipv6]
       ip6_ins_rt+0x84/0xb0 [ipv6]
       __ipv6_ifa_notify+0x4b6/0x550 [ipv6]
       ipv6_ifa_notify+0xa5/0x180 [ipv6]
       addrconf_dad_completed+0xca/0x640 [ipv6]
       addrconf_dad_work+0x296/0x960 [ipv6]
       process_one_work+0x5c0/0xc00 kernel/workqueue.c:2269
       worker_thread+0x5c/0x670 kernel/workqueue.c:2415
       kthread+0x1d7/0x200 kernel/kthread.c:255
       ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
      
      Allocated by task 3388:
       save_stack+0x19/0x80 mm/kasan/common.c:69
       set_track mm/kasan/common.c:77 [inline]
       __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:493
       kmalloc include/linux/slab.h:557 [inline]
       kzalloc include/linux/slab.h:748 [inline]
       ops_init+0xa9/0x220 net/core/net_namespace.c:127
       __register_pernet_operations net/core/net_namespace.c:1135 [inline]
       register_pernet_operations+0x1d4/0x420 net/core/net_namespace.c:1212
       register_pernet_subsys+0x24/0x40 net/core/net_namespace.c:1253
       nsim_fib_init+0x12/0x70 [netdevsim]
       veth_get_link_ksettings+0x2b/0x50 [veth]
       do_one_initcall+0xd4/0x454 init/main.c:939
       do_init_module+0xe0/0x330 kernel/module.c:3490
       load_module+0x3c2f/0x4620 kernel/module.c:3841
       __do_sys_finit_module+0x163/0x190 kernel/module.c:3931
       do_syscall_64+0x72/0x2e0 arch/x86/entry/common.c:296
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Freed by task 3534:
       save_stack+0x19/0x80 mm/kasan/common.c:69
       set_track mm/kasan/common.c:77 [inline]
       __kasan_slab_free+0x130/0x180 mm/kasan/common.c:455
       slab_free_hook mm/slub.c:1423 [inline]
       slab_free_freelist_hook mm/slub.c:1474 [inline]
       slab_free mm/slub.c:3016 [inline]
       kfree+0xe9/0x2d0 mm/slub.c:3957
       ops_free net/core/net_namespace.c:151 [inline]
       ops_free_list.part.7+0x156/0x220 net/core/net_namespace.c:184
       ops_free_list net/core/net_namespace.c:182 [inline]
       __unregister_pernet_operations net/core/net_namespace.c:1165 [inline]
       unregister_pernet_operations+0x221/0x2a0 net/core/net_namespace.c:1224
       unregister_pernet_subsys+0x1d/0x30 net/core/net_namespace.c:1271
       nsim_fib_exit+0x11/0x20 [netdevsim]
       nsim_module_exit+0x16/0x21 [netdevsim]
       __do_sys_delete_module kernel/module.c:1015 [inline]
       __se_sys_delete_module kernel/module.c:958 [inline]
       __x64_sys_delete_module+0x244/0x330 kernel/module.c:958
       do_syscall_64+0x72/0x2e0 arch/x86/entry/common.c:296
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Fixes: 59c84b9f ("netdevsim: Restore per-network namespace accounting for fib entries")
      Signed-off-by: default avatarYueHaibing <yuehaibing@huawei.com>
      Acked-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      33902b4a
    • Cédric Le Goater's avatar
      net/ibmvnic: Fix EOI when running in XIVE mode. · 11d49ce9
      Cédric Le Goater authored
      pSeries machines on POWER9 processors can run with the XICS (legacy)
      interrupt mode or with the XIVE exploitation interrupt mode. These
      interrupt contollers have different interfaces for interrupt
      management : XICS uses hcalls and XIVE loads and stores on a page.
      H_EOI being a XICS interface the enable_scrq_irq() routine can fail
      when the machine runs in XIVE mode.
      
      Fix that by calling the EOI handler of the interrupt chip.
      
      Fixes: f23e0643 ("ibmvnic: Clear pending interrupt after device reset")
      Signed-off-by: default avatarCédric Le Goater <clg@kaod.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      11d49ce9
    • Alexandre Belloni's avatar
      net: lpc_eth: avoid resetting twice · c23936fa
      Alexandre Belloni authored
      __lpc_eth_shutdown is called after __lpc_eth_reset but it is already
      calling __lpc_eth_reset. Avoid resetting the IP twice.
      Signed-off-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c23936fa
    • David S. Miller's avatar
      Merge branch 'tcp-address-KCSAN-reports-in-tcp_poll-part-I' · 3f233809
      David S. Miller authored
      Eric Dumazet says:
      
      ====================
      tcp: address KCSAN reports in tcp_poll() (part I)
      
      This all started with a KCSAN report (included
      in "tcp: annotate tp->rcv_nxt lockless reads" changelog)
      
      tcp_poll() runs in a lockless way. This means that about
      all accesses of tcp socket fields done in tcp_poll() context
      need annotations otherwise KCSAN will complain about data-races.
      
      While doing this detective work, I found a more serious bug,
      addressed by the first patch ("tcp: add rcu protection around
      tp->fastopen_rsk").
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3f233809
    • Eric Dumazet's avatar
      tcp: annotate sk->sk_wmem_queued lockless reads · ab4e846a
      Eric Dumazet authored
      For the sake of tcp_poll(), there are few places where we fetch
      sk->sk_wmem_queued while this field can change from IRQ or other cpu.
      
      We need to add READ_ONCE() annotations, and also make sure write
      sides use corresponding WRITE_ONCE() to avoid store-tearing.
      
      sk_wmem_queued_add() helper is added so that we can in
      the future convert to ADD_ONCE() or equivalent if/when
      available.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ab4e846a
    • Eric Dumazet's avatar
      tcp: annotate sk->sk_sndbuf lockless reads · e292f05e
      Eric Dumazet authored
      For the sake of tcp_poll(), there are few places where we fetch
      sk->sk_sndbuf while this field can change from IRQ or other cpu.
      
      We need to add READ_ONCE() annotations, and also make sure write
      sides use corresponding WRITE_ONCE() to avoid store-tearing.
      
      Note that other transports probably need similar fixes.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e292f05e
    • Eric Dumazet's avatar
      tcp: annotate sk->sk_rcvbuf lockless reads · ebb3b78d
      Eric Dumazet authored
      For the sake of tcp_poll(), there are few places where we fetch
      sk->sk_rcvbuf while this field can change from IRQ or other cpu.
      
      We need to add READ_ONCE() annotations, and also make sure write
      sides use corresponding WRITE_ONCE() to avoid store-tearing.
      
      Note that other transports probably need similar fixes.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ebb3b78d
    • Eric Dumazet's avatar
      tcp: annotate tp->urg_seq lockless reads · d9b55bf7
      Eric Dumazet authored
      There two places where we fetch tp->urg_seq while
      this field can change from IRQ or other cpu.
      
      We need to add READ_ONCE() annotations, and also make
      sure write side use corresponding WRITE_ONCE() to avoid
      store-tearing.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d9b55bf7
    • Eric Dumazet's avatar
      tcp: annotate tp->snd_nxt lockless reads · e0d694d6
      Eric Dumazet authored
      There are few places where we fetch tp->snd_nxt while
      this field can change from IRQ or other cpu.
      
      We need to add READ_ONCE() annotations, and also make
      sure write sides use corresponding WRITE_ONCE() to avoid
      store-tearing.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e0d694d6
    • Eric Dumazet's avatar
      tcp: annotate tp->write_seq lockless reads · 0f317464
      Eric Dumazet authored
      There are few places where we fetch tp->write_seq while
      this field can change from IRQ or other cpu.
      
      We need to add READ_ONCE() annotations, and also make
      sure write sides use corresponding WRITE_ONCE() to avoid
      store-tearing.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0f317464
    • Eric Dumazet's avatar
      tcp: annotate tp->copied_seq lockless reads · 7db48e98
      Eric Dumazet authored
      There are few places where we fetch tp->copied_seq while
      this field can change from IRQ or other cpu.
      
      We need to add READ_ONCE() annotations, and also make
      sure write sides use corresponding WRITE_ONCE() to avoid
      store-tearing.
      
      Note that tcp_inq_hint() was already using READ_ONCE(tp->copied_seq)
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7db48e98
    • Eric Dumazet's avatar
      tcp: annotate tp->rcv_nxt lockless reads · dba7d9b8
      Eric Dumazet authored
      There are few places where we fetch tp->rcv_nxt while
      this field can change from IRQ or other cpu.
      
      We need to add READ_ONCE() annotations, and also make
      sure write sides use corresponding WRITE_ONCE() to avoid
      store-tearing.
      
      Note that tcp_inq_hint() was already using READ_ONCE(tp->rcv_nxt)
      
      syzbot reported :
      
      BUG: KCSAN: data-race in tcp_poll / tcp_queue_rcv
      
      write to 0xffff888120425770 of 4 bytes by interrupt on cpu 0:
       tcp_rcv_nxt_update net/ipv4/tcp_input.c:3365 [inline]
       tcp_queue_rcv+0x180/0x380 net/ipv4/tcp_input.c:4638
       tcp_rcv_established+0xbf1/0xf50 net/ipv4/tcp_input.c:5616
       tcp_v4_do_rcv+0x381/0x4e0 net/ipv4/tcp_ipv4.c:1542
       tcp_v4_rcv+0x1a03/0x1bf0 net/ipv4/tcp_ipv4.c:1923
       ip_protocol_deliver_rcu+0x51/0x470 net/ipv4/ip_input.c:204
       ip_local_deliver_finish+0x110/0x140 net/ipv4/ip_input.c:231
       NF_HOOK include/linux/netfilter.h:305 [inline]
       NF_HOOK include/linux/netfilter.h:299 [inline]
       ip_local_deliver+0x133/0x210 net/ipv4/ip_input.c:252
       dst_input include/net/dst.h:442 [inline]
       ip_rcv_finish+0x121/0x160 net/ipv4/ip_input.c:413
       NF_HOOK include/linux/netfilter.h:305 [inline]
       NF_HOOK include/linux/netfilter.h:299 [inline]
       ip_rcv+0x18f/0x1a0 net/ipv4/ip_input.c:523
       __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:5004
       __netif_receive_skb+0x37/0xf0 net/core/dev.c:5118
       netif_receive_skb_internal+0x59/0x190 net/core/dev.c:5208
       napi_skb_finish net/core/dev.c:5671 [inline]
       napi_gro_receive+0x28f/0x330 net/core/dev.c:5704
       receive_buf+0x284/0x30b0 drivers/net/virtio_net.c:1061
      
      read to 0xffff888120425770 of 4 bytes by task 7254 on cpu 1:
       tcp_stream_is_readable net/ipv4/tcp.c:480 [inline]
       tcp_poll+0x204/0x6b0 net/ipv4/tcp.c:554
       sock_poll+0xed/0x250 net/socket.c:1256
       vfs_poll include/linux/poll.h:90 [inline]
       ep_item_poll.isra.0+0x90/0x190 fs/eventpoll.c:892
       ep_send_events_proc+0x113/0x5c0 fs/eventpoll.c:1749
       ep_scan_ready_list.constprop.0+0x189/0x500 fs/eventpoll.c:704
       ep_send_events fs/eventpoll.c:1793 [inline]
       ep_poll+0xe3/0x900 fs/eventpoll.c:1930
       do_epoll_wait+0x162/0x180 fs/eventpoll.c:2294
       __do_sys_epoll_pwait fs/eventpoll.c:2325 [inline]
       __se_sys_epoll_pwait fs/eventpoll.c:2311 [inline]
       __x64_sys_epoll_pwait+0xcd/0x170 fs/eventpoll.c:2311
       do_syscall_64+0xcf/0x2f0 arch/x86/entry/common.c:296
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      Reported by Kernel Concurrency Sanitizer on:
      CPU: 1 PID: 7254 Comm: syz-fuzzer Not tainted 5.3.0+ #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dba7d9b8
    • Eric Dumazet's avatar
      tcp: add rcu protection around tp->fastopen_rsk · d983ea6f
      Eric Dumazet authored
      Both tcp_v4_err() and tcp_v6_err() do the following operations
      while they do not own the socket lock :
      
      	fastopen = tp->fastopen_rsk;
       	snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
      
      The problem is that without appropriate barrier, the compiler
      might reload tp->fastopen_rsk and trigger a NULL deref.
      
      request sockets are protected by RCU, we can simply add
      the missing annotations and barriers to solve the issue.
      
      Fixes: 168a8f58 ("tcp: TCP Fast Open Server - main code path")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d983ea6f
  5. 12 Oct, 2019 2 commits
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf · 8caf8a91
      David S. Miller authored
      Alexei Starovoitov says:
      
      ====================
      pull-request: bpf 2019-10-12
      
      The following pull-request contains BPF updates for your *net* tree.
      
      The main changes are:
      
      1) a bunch of small fixes. Nothing critical.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8caf8a91
    • David Howells's avatar
      rxrpc: Fix possible NULL pointer access in ICMP handling · f0308fb0
      David Howells authored
      If an ICMP packet comes in on the UDP socket backing an AF_RXRPC socket as
      the UDP socket is being shut down, rxrpc_error_report() may get called to
      deal with it after sk_user_data on the UDP socket has been cleared, leading
      to a NULL pointer access when this local endpoint record gets accessed.
      
      Fix this by just returning immediately if sk_user_data was NULL.
      
      The oops looks like the following:
      
      #PF: supervisor read access in kernel mode
      #PF: error_code(0x0000) - not-present page
      ...
      RIP: 0010:rxrpc_error_report+0x1bd/0x6a9
      ...
      Call Trace:
       ? sock_queue_err_skb+0xbd/0xde
       ? __udp4_lib_err+0x313/0x34d
       __udp4_lib_err+0x313/0x34d
       icmp_unreach+0x1ee/0x207
       icmp_rcv+0x25b/0x28f
       ip_protocol_deliver_rcu+0x95/0x10e
       ip_local_deliver+0xe9/0x148
       __netif_receive_skb_one_core+0x52/0x6e
       process_backlog+0xdc/0x177
       net_rx_action+0xf9/0x270
       __do_softirq+0x1b6/0x39a
       ? smpboot_register_percpu_thread+0xce/0xce
       run_ksoftirqd+0x1d/0x42
       smpboot_thread_fn+0x19e/0x1b3
       kthread+0xf1/0xf6
       ? kthread_delayed_work_timer_fn+0x83/0x83
       ret_from_fork+0x24/0x30
      
      Fixes: 17926a79 ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
      Reported-by: syzbot+611164843bd48cc2190c@syzkaller.appspotmail.com
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f0308fb0
  6. 11 Oct, 2019 4 commits
  7. 10 Oct, 2019 3 commits
    • Jacob Keller's avatar
      net: update net_dim documentation after rename · 2168da45
      Jacob Keller authored
      Commit 8960b389 ("linux/dim: Rename externally used net_dim
      members") renamed the net_dim API, removing the "net_" prefix from the
      structures and functions. The patch didn't update the net_dim.txt
      documentation file.
      
      Fix the documentation so that its examples match the current code.
      
      Fixes: 8960b389 ("linux/dim: Rename externally used net_dim members", 2019-06-25)
      Fixes: c002bd52 ("linux/dim: Rename externally exposed macros", 2019-06-25)
      Fixes: 4f75da36 ("linux/dim: Move implementation to .c files")
      Cc: Tal Gilboa <talgi@mellanox.com>
      Signed-off-by: default avatarJacob Keller <jacob.e.keller@intel.com>
      Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      2168da45
    • Heiner Kallweit's avatar
      r8169: fix jumbo packet handling on resume from suspend · 4ebcb113
      Heiner Kallweit authored
      Mariusz reported that invalid packets are sent after resume from
      suspend if jumbo packets are active. It turned out that his BIOS
      resets chip settings to non-jumbo on resume. Most chip settings are
      re-initialized on resume from suspend by calling rtl_hw_start(),
      so let's add configuring jumbo to this function.
      There's nothing wrong with the commit marked as fixed, it's just
      the first one where the patch applies cleanly.
      
      Fixes: 7366016d ("r8169: read common register for PCI commit")
      Reported-by: default avatarMariusz Bialonczyk <manio@skyboo.net>
      Tested-by: default avatarMariusz Bialonczyk <manio@skyboo.net>
      Signed-off-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
      Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      4ebcb113
    • Eric Dumazet's avatar
      net: silence KCSAN warnings about sk->sk_backlog.len reads · 70c26558
      Eric Dumazet authored
      sk->sk_backlog.len can be written by BH handlers, and read
      from process contexts in a lockless way.
      
      Note the write side should also use WRITE_ONCE() or a variant.
      We need some agreement about the best way to do this.
      
      syzbot reported :
      
      BUG: KCSAN: data-race in tcp_add_backlog / tcp_grow_window.isra.0
      
      write to 0xffff88812665f32c of 4 bytes by interrupt on cpu 1:
       sk_add_backlog include/net/sock.h:934 [inline]
       tcp_add_backlog+0x4a0/0xcc0 net/ipv4/tcp_ipv4.c:1737
       tcp_v4_rcv+0x1aba/0x1bf0 net/ipv4/tcp_ipv4.c:1925
       ip_protocol_deliver_rcu+0x51/0x470 net/ipv4/ip_input.c:204
       ip_local_deliver_finish+0x110/0x140 net/ipv4/ip_input.c:231
       NF_HOOK include/linux/netfilter.h:305 [inline]
       NF_HOOK include/linux/netfilter.h:299 [inline]
       ip_local_deliver+0x133/0x210 net/ipv4/ip_input.c:252
       dst_input include/net/dst.h:442 [inline]
       ip_rcv_finish+0x121/0x160 net/ipv4/ip_input.c:413
       NF_HOOK include/linux/netfilter.h:305 [inline]
       NF_HOOK include/linux/netfilter.h:299 [inline]
       ip_rcv+0x18f/0x1a0 net/ipv4/ip_input.c:523
       __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:5004
       __netif_receive_skb+0x37/0xf0 net/core/dev.c:5118
       netif_receive_skb_internal+0x59/0x190 net/core/dev.c:5208
       napi_skb_finish net/core/dev.c:5671 [inline]
       napi_gro_receive+0x28f/0x330 net/core/dev.c:5704
       receive_buf+0x284/0x30b0 drivers/net/virtio_net.c:1061
       virtnet_receive drivers/net/virtio_net.c:1323 [inline]
       virtnet_poll+0x436/0x7d0 drivers/net/virtio_net.c:1428
       napi_poll net/core/dev.c:6352 [inline]
       net_rx_action+0x3ae/0xa50 net/core/dev.c:6418
      
      read to 0xffff88812665f32c of 4 bytes by task 7292 on cpu 0:
       tcp_space include/net/tcp.h:1373 [inline]
       tcp_grow_window.isra.0+0x6b/0x480 net/ipv4/tcp_input.c:413
       tcp_event_data_recv+0x68f/0x990 net/ipv4/tcp_input.c:717
       tcp_rcv_established+0xbfe/0xf50 net/ipv4/tcp_input.c:5618
       tcp_v4_do_rcv+0x381/0x4e0 net/ipv4/tcp_ipv4.c:1542
       sk_backlog_rcv include/net/sock.h:945 [inline]
       __release_sock+0x135/0x1e0 net/core/sock.c:2427
       release_sock+0x61/0x160 net/core/sock.c:2943
       tcp_recvmsg+0x63b/0x1a30 net/ipv4/tcp.c:2181
       inet_recvmsg+0xbb/0x250 net/ipv4/af_inet.c:838
       sock_recvmsg_nosec net/socket.c:871 [inline]
       sock_recvmsg net/socket.c:889 [inline]
       sock_recvmsg+0x92/0xb0 net/socket.c:885
       sock_read_iter+0x15f/0x1e0 net/socket.c:967
       call_read_iter include/linux/fs.h:1864 [inline]
       new_sync_read+0x389/0x4f0 fs/read_write.c:414
       __vfs_read+0xb1/0xc0 fs/read_write.c:427
       vfs_read fs/read_write.c:461 [inline]
       vfs_read+0x143/0x2c0 fs/read_write.c:446
      
      Reported by Kernel Concurrency Sanitizer on:
      CPU: 0 PID: 7292 Comm: syz-fuzzer Not tainted 5.3.0+ #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      70c26558