1. 12 Feb, 2023 2 commits
    • David Chen's avatar
      Fix page corruption caused by racy check in __free_pages · 462a8e08
      David Chen authored
      When we upgraded our kernel, we started seeing some page corruption like
      the following consistently:
      
        BUG: Bad page state in process ganesha.nfsd  pfn:1304ca
        page:0000000022261c55 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x1304ca
        flags: 0x17ffffc0000000()
        raw: 0017ffffc0000000 ffff8a513ffd4c98 ffffeee24b35ec08 0000000000000000
        raw: 0000000000000000 0000000000000001 00000000ffffff7f 0000000000000000
        page dumped because: nonzero mapcount
        CPU: 0 PID: 15567 Comm: ganesha.nfsd Kdump: loaded Tainted: P    B      O      5.10.158-1.nutanix.20221209.el7.x86_64 #1
        Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016
        Call Trace:
         dump_stack+0x74/0x96
         bad_page.cold+0x63/0x94
         check_new_page_bad+0x6d/0x80
         rmqueue+0x46e/0x970
         get_page_from_freelist+0xcb/0x3f0
         ? _cond_resched+0x19/0x40
         __alloc_pages_nodemask+0x164/0x300
         alloc_pages_current+0x87/0xf0
         skb_page_frag_refill+0x84/0x110
         ...
      
      Sometimes, it would also show up as corruption in the free list pointer
      and cause crashes.
      
      After bisecting the issue, we found the issue started from commit
      e320d301 ("mm/page_alloc.c: fix freeing non-compound pages"):
      
      	if (put_page_testzero(page))
      		free_the_page(page, order);
      	else if (!PageHead(page))
      		while (order-- > 0)
      			free_the_page(page + (1 << order), order);
      
      So the problem is the check PageHead is racy because at this point we
      already dropped our reference to the page.  So even if we came in with
      compound page, the page can already be freed and PageHead can return
      false and we will end up freeing all the tail pages causing double free.
      
      Fixes: e320d301 ("mm/page_alloc.c: fix freeing non-compound pages")
      Link: https://lore.kernel.org/lkml/BYAPR02MB448855960A9656EEA81141FC94D99@BYAPR02MB4488.namprd02.prod.outlook.com/
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarChunwei Chen <david.chen@nutanix.com>
      Reviewed-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Reviewed-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      462a8e08
    • Linus Torvalds's avatar
      Merge tag 'spi-fix-v6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · f339c259
      Linus Torvalds authored
      Pull spi fixes from Mark Brown:
       "A couple of hopefully final fixes for spi: one driver specific fix for
        an issue with very large transfers and a fix for an issue with the
        locking fixes in spidev merged earlier this release cycle which was
        missed"
      
      * tag 'spi-fix-v6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: spidev: fix a recursive locking error
        spi: dw: Fix wrong FIFO level setting for long xfers
      f339c259
  2. 11 Feb, 2023 5 commits
  3. 10 Feb, 2023 16 commits
  4. 09 Feb, 2023 17 commits
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-6.2-2023-02-09' of... · 777c1e01
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-6.2-2023-02-09' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
      
      amd-drm-fixes-6.2-2023-02-09:
      
      amdgpu:
      - Add a parameter to disable S/G display
      - Re-enable S/G display on all DCNs
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20230209174504.7577-1-alexander.deucher@amd.com
      777c1e01
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2023-02-09' of... · 0ed90416
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2023-02-09' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      - Display watermark fix (Ville)
      - fbdev fix for PSR, FBC, DRRS (Jouni)
      - Move fd_install after last use of fence (Rob)
      - Initialize the obj flags for shmem objects (Aravind)
      - Fix VBT DSI DVO port handling (Ville)
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Rodrigo Vivi <rodrigo.vivi@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/Y+UZ0rh2YlhTrE4t@intel.com
      0ed90416
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2023-02-09' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · 337d5b5e
      Dave Airlie authored
      A fix for a circular refcounting in drm/client, one for a memory leak in
      amdgpu and a virtio fence fix when interrupted
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Maxime Ripard <maxime@cerno.tech>
      Link: https://patchwork.freedesktop.org/patch/msgid/20230209083600.7hi6roht6xxgldgz@houat
      337d5b5e
    • Guo Ren's avatar
      riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte · 950b879b
      Guo Ren authored
      In commit 588a513d ("arm64: Fix race condition on PG_dcache_clean
      in __sync_icache_dcache()"), we found RISC-V has the same issue as the
      previous arm64. The previous implementation didn't guarantee the correct
      sequence of operations, which means flush_icache_all() hasn't been
      called when the PG_dcache_clean was set. That would cause a risk of page
      synchronization.
      
      Fixes: 08f051ed ("RISC-V: Flush I$ when making a dirty page executable")
      Signed-off-by: default avatarGuo Ren <guoren@linux.alibaba.com>
      Signed-off-by: default avatarGuo Ren <guoren@kernel.org>
      Reviewed-by: default avatarAndrew Jones <ajones@ventanamicro.com>
      Reviewed-by: default avatarConor Dooley <conor.dooley@microchip.com>
      Link: https://lore.kernel.org/r/20230127035306.1819561-1-guoren@kernel.org
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPalmer Dabbelt <palmer@rivosinc.com>
      950b879b
    • Guo Ren's avatar
      riscv: kprobe: Fixup misaligned load text · eb742327
      Guo Ren authored
      The current kprobe would cause a misaligned load for the probe point.
      This patch fixup it with two half-word loads instead.
      
      Fixes: c22b0bcb ("riscv: Add kprobes supported")
      Signed-off-by: default avatarGuo Ren <guoren@linux.alibaba.com>
      Signed-off-by: default avatarGuo Ren <guoren@kernel.org>
      Link: https://lore.kernel.org/linux-riscv/878rhig9zj.fsf@all.your.base.are.belong.to.us/Reported-by: default avatarBjorn Topel <bjorn.topel@gmail.com>
      Reviewed-by: default avatarBjörn Töpel <bjorn@kernel.org>
      Link: https://lore.kernel.org/r/20230204063531.740220-1-guoren@kernel.org
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPalmer Dabbelt <palmer@rivosinc.com>
      eb742327
    • Linus Torvalds's avatar
      Merge tag 'pm-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · e544a074
      Linus Torvalds authored
      Pull power management fix from Rafael Wysocki:
       "Fix the incorrect value returned by cpufreq driver's ->get() callback
        for Qualcomm platforms (Douglas Anderson)"
      
      * tag 'pm-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        cpufreq: qcom-hw: Fix cpufreq_driver->get() for non-LMH systems
      e544a074
    • Linus Torvalds's avatar
      Merge tag 'net-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 35674e78
      Linus Torvalds authored
      Pull networking fixes from Paolo Abeni:
       "Including fixes from can and ipsec subtrees.
      
        Current release - regressions:
      
         - sched: fix off by one in htb_activate_prios()
      
         - eth: mana: fix accessing freed irq affinity_hint
      
         - eth: ice: fix out-of-bounds KASAN warning in virtchnl
      
        Current release - new code bugs:
      
         - eth: mtk_eth_soc: enable special tag when any MAC uses DSA
      
        Previous releases - always broken:
      
         - core: fix sk->sk_txrehash default
      
         - neigh: make sure used and confirmed times are valid
      
         - mptcp: be careful on subflow status propagation on errors
      
         - xfrm: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
      
         - phylink: move phy_device_free() to correctly release phy device
      
         - eth: mlx5:
            - fix crash unsetting rx-vlan-filter in switchdev mode
            - fix hang on firmware reset
            - serialize module cleanup with reload and remove"
      
      * tag 'net-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (57 commits)
        selftests: forwarding: lib: quote the sysctl values
        net: mscc: ocelot: fix all IPv6 getting trapped to CPU when PTP timestamping is used
        rds: rds_rm_zerocopy_callback() use list_first_entry()
        net: txgbe: Update support email address
        selftests: Fix failing VXLAN VNI filtering test
        selftests: mptcp: stop tests earlier
        selftests: mptcp: allow more slack for slow test-case
        mptcp: be careful on subflow status propagation on errors
        mptcp: fix locking for in-kernel listener creation
        mptcp: fix locking for setsockopt corner-case
        mptcp: do not wait for bare sockets' timeout
        net: ethernet: mtk_eth_soc: fix DSA TX tag hwaccel for switch port 0
        nfp: ethtool: fix the bug of setting unsupported port speed
        txhash: fix sk->sk_txrehash default
        net: ethernet: mtk_eth_soc: fix wrong parameters order in __xdp_rxq_info_reg()
        net: ethernet: mtk_eth_soc: enable special tag when any MAC uses DSA
        net: sched: sch: Fix off by one in htb_activate_prios()
        igc: Add ndo_tx_timeout support
        net: mana: Fix accessing freed irq affinity_hint
        hv_netvsc: Allocate memory in netvsc_dma_map() with GFP_ATOMIC
        ...
      35674e78
    • Linus Torvalds's avatar
      Merge tag 'for-linus-2023020901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid · 0b028189
      Linus Torvalds authored
      Pull HID fixes from Benjamin Tissoires:
      
       - fix potential infinite loop with a badly crafted HID device (Xin
         Zhao)
      
       - fix regression from 6.1 in USB logitech devices potentially making
         their mouse wheel not working (Bastien Nocera)
      
       - clean up in AMD sensors, which fixes a long time resume bug (Mario
         Limonciello)
      
       - few device small fixes and quirks
      
      * tag 'for-linus-2023020901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
        HID: Ignore battery for ELAN touchscreen 29DF on HP
        HID: amd_sfh: if no sensors are enabled, clean up
        HID: logitech: Disable hi-res scrolling on USB
        HID: core: Fix deadloop in hid_apply_multiplier.
        HID: Ignore battery for Elan touchscreen on Asus TP420IA
        HID: elecom: add support for TrackBall 056E:011C
      0b028189
    • Linus Torvalds's avatar
      Merge tag '6.2-rc8-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6 · 94a1f56d
      Linus Torvalds authored
      Pull cifx fix from Steve French:
       "Small fix for use after free"
      
      * tag '6.2-rc8-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: Fix use-after-free in rdata->read_into_pages()
      94a1f56d
    • Alex Deucher's avatar
      Revert "drm/amd/display: disable S/G display on DCN 3.1.5" · e7d63647
      Alex Deucher authored
      This reverts commit 3cc67fe1.
      
      Some users have reported flickerng with S/G display.  We've
      tried extensively to reproduce and debug the issue on a wide
      variety of platform configurations (DRAM bandwidth, etc.) and
      a variety of monitors, but so far have not been able to.  We
      disabled S/G display on a number of platforms to address this
      but that leads to failure to pin framebuffers errors and
      blank displays when there is memory pressure or no displays
      at all on systems with limited carveout (e.g., Chromebooks).
      We have a parameter to disable this as a debugging option as a
      way for users to disable this, depending on their use case,
      and for us to help debug this further.  Having this enabled
      seems like the lesser of to evils.
      Reviewed-by: default avatarHarry Wentland <harry.wentland@amd.com>
      Acked-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      e7d63647
    • Alex Deucher's avatar
      Revert "drm/amd/display: disable S/G display on DCN 2.1.0" · 1b7ac798
      Alex Deucher authored
      This reverts commit 2404f9b0.
      
      Some users have reported flickerng with S/G display.  We've
      tried extensively to reproduce and debug the issue on a wide
      variety of platform configurations (DRAM bandwidth, etc.) and
      a variety of monitors, but so far have not been able to.  We
      disabled S/G display on a number of platforms to address this
      but that leads to failure to pin framebuffers errors and
      blank displays when there is memory pressure or no displays
      at all on systems with limited carveout (e.g., Chromebooks).
      We have a parameter to disable this as a debugging option as a
      way for users to disable this, depending on their use case,
      and for us to help debug this further.  Having this enabled
      seems like the lesser of to evils.
      Reviewed-by: default avatarHarry Wentland <harry.wentland@amd.com>
      Acked-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      1b7ac798
    • Alex Deucher's avatar
      Revert "drm/amd/display: disable S/G display on DCN 3.1.2/3" · 9734a75c
      Alex Deucher authored
      This reverts commit f081cd4c.
      
      Some users have reported flickerng with S/G display.  We've
      tried extensively to reproduce and debug the issue on a wide
      variety of platform configurations (DRAM bandwidth, etc.) and
      a variety of monitors, but so far have not been able to.  We
      disabled S/G display on a number of platforms to address this
      but that leads to failure to pin framebuffers errors and
      blank displays when there is memory pressure or no displays
      at all on systems with limited carveout (e.g., Chromebooks).
      We have a parameter to disable this as a debugging option as a
      way for users to disable this, depending on their use case,
      and for us to help debug this further.  Having this enabled
      seems like the lesser of to evils.
      Reviewed-by: default avatarHarry Wentland <harry.wentland@amd.com>
      Acked-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      9734a75c
    • Alex Deucher's avatar
      drm/amdgpu: add S/G display parameter · 4693e852
      Alex Deucher authored
      Some users have reported flickerng with S/G display.  We've
      tried extensively to reproduce and debug the issue on a wide
      variety of platform configurations (DRAM bandwidth, etc.) and
      a variety of monitors, but so far have not been able to.  We
      disabled S/G display on a number of platforms to address this
      but that leads to failure to pin framebuffers errors and
      blank displays when there is memory pressure or no displays
      at all on systems with limited carveout (e.g., Chromebooks).
      Add a option to disable this as a debugging option as a
      way for users to disable this, depending on their use case,
      and for us to help debug this further.
      
      v2: fix typo
      Reviewed-by: default avatarHarry Wentland <harry.wentland@amd.com>
      Acked-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      4693e852
    • Jens Axboe's avatar
      Merge tag 'nvme-6.2-2023-02-09' of git://git.infradead.org/nvme into block-6.2 · 38c33ece
      Jens Axboe authored
      Pull NVMe fix from Christoph:
      
      "nvme fixes for Linux 6.2
      
       - fix a static checker warning for a variable introduces in the last
         pull request (Tom Rix)"
      
      * tag 'nvme-6.2-2023-02-09' of git://git.infradead.org/nvme:
        nvme-auth: mark nvme_auth_wq static
      38c33ece
    • Hangbin Liu's avatar
      selftests: forwarding: lib: quote the sysctl values · 3a082086
      Hangbin Liu authored
      When set/restore sysctl value, we should quote the value as some keys
      may have multi values, e.g. net.ipv4.ping_group_range
      
      Fixes: f5ae5778 ("selftests: forwarding: lib: Add sysctl_set(), sysctl_restore()")
      Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Reviewed-by: default avatarPetr Machata <petrm@nvidia.com>
      Link: https://lore.kernel.org/r/20230208032110.879205-1-liuhangbin@gmail.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      3a082086
    • Vladimir Oltean's avatar
      net: mscc: ocelot: fix all IPv6 getting trapped to CPU when PTP timestamping is used · 2fcde9fe
      Vladimir Oltean authored
      While running this selftest which usually passes:
      
      ~/selftests/drivers/net/dsa# ./local_termination.sh eno0 swp0
      TEST: swp0: Unicast IPv4 to primary MAC address                     [ OK ]
      TEST: swp0: Unicast IPv4 to macvlan MAC address                     [ OK ]
      TEST: swp0: Unicast IPv4 to unknown MAC address                     [ OK ]
      TEST: swp0: Unicast IPv4 to unknown MAC address, promisc            [ OK ]
      TEST: swp0: Unicast IPv4 to unknown MAC address, allmulti           [ OK ]
      TEST: swp0: Multicast IPv4 to joined group                          [ OK ]
      TEST: swp0: Multicast IPv4 to unknown group                         [ OK ]
      TEST: swp0: Multicast IPv4 to unknown group, promisc                [ OK ]
      TEST: swp0: Multicast IPv4 to unknown group, allmulti               [ OK ]
      TEST: swp0: Multicast IPv6 to joined group                          [ OK ]
      TEST: swp0: Multicast IPv6 to unknown group                         [ OK ]
      TEST: swp0: Multicast IPv6 to unknown group, promisc                [ OK ]
      TEST: swp0: Multicast IPv6 to unknown group, allmulti               [ OK ]
      
      if I start PTP timestamping then run it again (debug prints added by me),
      the unknown IPv6 MC traffic is seen by the CPU port even when it should
      have been dropped:
      
      ~/selftests/drivers/net/dsa# ptp4l -i swp0 -2 -P -m
      ptp4l[225.410]: selected /dev/ptp1 as PTP clock
      [  225.445746] mscc_felix 0000:00:00.5: ocelot_l2_ptp_trap_add: port 0 adding L2 PTP trap
      [  225.453815] mscc_felix 0000:00:00.5: ocelot_ipv4_ptp_trap_add: port 0 adding IPv4 PTP event trap
      [  225.462703] mscc_felix 0000:00:00.5: ocelot_ipv4_ptp_trap_add: port 0 adding IPv4 PTP general trap
      [  225.471768] mscc_felix 0000:00:00.5: ocelot_ipv6_ptp_trap_add: port 0 adding IPv6 PTP event trap
      [  225.480651] mscc_felix 0000:00:00.5: ocelot_ipv6_ptp_trap_add: port 0 adding IPv6 PTP general trap
      ptp4l[225.488]: port 1: INITIALIZING to LISTENING on INIT_COMPLETE
      ptp4l[225.488]: port 0: INITIALIZING to LISTENING on INIT_COMPLETE
      ^C
      ~/selftests/drivers/net/dsa# ./local_termination.sh eno0 swp0
      TEST: swp0: Unicast IPv4 to primary MAC address                     [ OK ]
      TEST: swp0: Unicast IPv4 to macvlan MAC address                     [ OK ]
      TEST: swp0: Unicast IPv4 to unknown MAC address                     [ OK ]
      TEST: swp0: Unicast IPv4 to unknown MAC address, promisc            [ OK ]
      TEST: swp0: Unicast IPv4 to unknown MAC address, allmulti           [ OK ]
      TEST: swp0: Multicast IPv4 to joined group                          [ OK ]
      TEST: swp0: Multicast IPv4 to unknown group                         [ OK ]
      TEST: swp0: Multicast IPv4 to unknown group, promisc                [ OK ]
      TEST: swp0: Multicast IPv4 to unknown group, allmulti               [ OK ]
      TEST: swp0: Multicast IPv6 to joined group                          [ OK ]
      TEST: swp0: Multicast IPv6 to unknown group                         [FAIL]
              reception succeeded, but should have failed
      TEST: swp0: Multicast IPv6 to unknown group, promisc                [ OK ]
      TEST: swp0: Multicast IPv6 to unknown group, allmulti               [ OK ]
      
      The PGID_MCIPV6 is configured correctly to not flood to the CPU,
      I checked that.
      
      Furthermore, when I disable back PTP RX timestamping (ptp4l doesn't do
      that when it exists), packets are RX filtered again as they should be:
      
      ~/selftests/drivers/net/dsa# hwstamp_ctl -i swp0 -r 0
      [  218.202854] mscc_felix 0000:00:00.5: ocelot_l2_ptp_trap_del: port 0 removing L2 PTP trap
      [  218.212656] mscc_felix 0000:00:00.5: ocelot_ipv4_ptp_trap_del: port 0 removing IPv4 PTP event trap
      [  218.222975] mscc_felix 0000:00:00.5: ocelot_ipv4_ptp_trap_del: port 0 removing IPv4 PTP general trap
      [  218.233133] mscc_felix 0000:00:00.5: ocelot_ipv6_ptp_trap_del: port 0 removing IPv6 PTP event trap
      [  218.242251] mscc_felix 0000:00:00.5: ocelot_ipv6_ptp_trap_del: port 0 removing IPv6 PTP general trap
      current settings:
      tx_type 1
      rx_filter 12
      new settings:
      tx_type 1
      rx_filter 0
      ~/selftests/drivers/net/dsa# ./local_termination.sh eno0 swp0
      TEST: swp0: Unicast IPv4 to primary MAC address                     [ OK ]
      TEST: swp0: Unicast IPv4 to macvlan MAC address                     [ OK ]
      TEST: swp0: Unicast IPv4 to unknown MAC address                     [ OK ]
      TEST: swp0: Unicast IPv4 to unknown MAC address, promisc            [ OK ]
      TEST: swp0: Unicast IPv4 to unknown MAC address, allmulti           [ OK ]
      TEST: swp0: Multicast IPv4 to joined group                          [ OK ]
      TEST: swp0: Multicast IPv4 to unknown group                         [ OK ]
      TEST: swp0: Multicast IPv4 to unknown group, promisc                [ OK ]
      TEST: swp0: Multicast IPv4 to unknown group, allmulti               [ OK ]
      TEST: swp0: Multicast IPv6 to joined group                          [ OK ]
      TEST: swp0: Multicast IPv6 to unknown group                         [ OK ]
      TEST: swp0: Multicast IPv6 to unknown group, promisc                [ OK ]
      TEST: swp0: Multicast IPv6 to unknown group, allmulti               [ OK ]
      
      So it's clear that something in the PTP RX trapping logic went wrong.
      
      Looking a bit at the code, I can see that there are 4 typos, which
      populate "ipv4" VCAP IS2 key filter fields for IPv6 keys.
      
      VCAP IS2 keys of type OCELOT_VCAP_KEY_IPV4 and OCELOT_VCAP_KEY_IPV6 are
      handled by is2_entry_set(). OCELOT_VCAP_KEY_IPV4 looks at
      &filter->key.ipv4, and OCELOT_VCAP_KEY_IPV6 at &filter->key.ipv6.
      Simply put, when we populate the wrong key field, &filter->key.ipv6
      fields "proto.mask" and "proto.value" remain all zeroes (or "don't care").
      So is2_entry_set() will enter the "else" of this "if" condition:
      
      	if (msk == 0xff && (val == IPPROTO_TCP || val == IPPROTO_UDP))
      
      and proceed to ignore the "proto" field. The resulting rule will match
      on all IPv6 traffic, trapping it to the CPU.
      
      This is the reason why the local_termination.sh selftest sees it,
      because control traps are stronger than the PGID_MCIPV6 used for
      flooding (from the forwarding data path).
      
      But the problem is in fact much deeper. We trap all IPv6 traffic to the
      CPU, but if we're bridged, we set skb->offload_fwd_mark = 1, so software
      forwarding will not take place and IPv6 traffic will never reach its
      destination.
      
      The fix is simple - correct the typos.
      
      I was intentionally inaccurate in the commit message about the breakage
      occurring when any PTP timestamping is enabled. In fact it only happens
      when L4 timestamping is requested (HWTSTAMP_FILTER_PTP_V2_EVENT or
      HWTSTAMP_FILTER_PTP_V2_L4_EVENT). But ptp4l requests a larger RX
      timestamping filter than it needs for "-2": HWTSTAMP_FILTER_PTP_V2_EVENT.
      I wanted people skimming through git logs to not think that the bug
      doesn't affect them because they only use ptp4l in L2 mode.
      
      Fixes: 96ca08c0 ("net: mscc: ocelot: set up traps for PTP packets")
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
      Link: https://lore.kernel.org/r/20230207183117.1745754-1-vladimir.oltean@nxp.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      2fcde9fe
    • Pietro Borrello's avatar
      rds: rds_rm_zerocopy_callback() use list_first_entry() · f753a689
      Pietro Borrello authored
      rds_rm_zerocopy_callback() uses list_entry() on the head of a list
      causing a type confusion.
      Use list_first_entry() to actually access the first element of the
      rs_zcookie_queue list.
      
      Fixes: 9426bbc6 ("rds: use list structure to track information for zerocopy completion notification")
      Reviewed-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarPietro Borrello <borrello@diag.uniroma1.it>
      Link: https://lore.kernel.org/r/20230202-rds-zerocopy-v3-1-83b0df974f9a@diag.uniroma1.itSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      f753a689