1. 30 Jan, 2023 1 commit
  2. 28 Jan, 2023 18 commits
  3. 27 Jan, 2023 1 commit
    • Kui-Feng Lee's avatar
      bpf: Fix the kernel crash caused by bpf_setsockopt(). · 5416c9ae
      Kui-Feng Lee authored
      The kernel crash was caused by a BPF program attached to the
      "lsm_cgroup/socket_sock_rcv_skb" hook, which performed a call to
      `bpf_setsockopt()` in order to set the TCP_NODELAY flag as an
      example. Flags like TCP_NODELAY can prompt the kernel to flush a
      socket's outgoing queue, and this hook
      "lsm_cgroup/socket_sock_rcv_skb" is frequently triggered by
      softirqs. The issue was that in certain circumstances, when
      `tcp_write_xmit()` was called to flush the queue, it would also allow
      BH (bottom-half) to run. This could lead to our program attempting to
      flush the same socket recursively, which caused a `skbuff` to be
      unlinked twice.
      
      `security_sock_rcv_skb()` is triggered by `tcp_filter()`. This occurs
      before the sock ownership is checked in `tcp_v4_rcv()`. Consequently,
      if a bpf program runs on `security_sock_rcv_skb()` while under softirq
      conditions, it may not possess the lock needed for `bpf_setsockopt()`,
      thus presenting an issue.
      
      The patch fixes this issue by ensuring that a BPF program attached to
      the "lsm_cgroup/socket_sock_rcv_skb" hook is not allowed to call
      `bpf_setsockopt()`.
      
      The differences from v1 are
       - changing commit log to explain holding the lock of the sock,
       - emphasizing that TCP_NODELAY is not the only flag, and
       - adding the fixes tag.
      
      v1: https://lore.kernel.org/bpf/20230125000244.1109228-1-kuifeng@meta.com/Signed-off-by: default avatarKui-Feng Lee <kuifeng@meta.com>
      Fixes: 9113d7e4 ("bpf: expose bpf_{g,s}etsockopt to lsm cgroup")
      Link: https://lore.kernel.org/r/20230127001732.4162630-1-kuifeng@meta.comSigned-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
      5416c9ae
  4. 26 Jan, 2023 6 commits
    • Linus Torvalds's avatar
      Merge tag 'net-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 28b4387f
      Linus Torvalds authored
      Pull networking fixes from Paolo Abeni:
       "Including fixes from netfilter.
      
        Current release - regressions:
      
         - sched: sch_taprio: do not schedule in taprio_reset()
      
        Previous releases - regressions:
      
         - core: fix UaF in netns ops registration error path
      
         - ipv4: prevent potential spectre v1 gadgets
      
         - ipv6: fix reachability confirmation with proxy_ndp
      
         - netfilter: fix for the set rbtree
      
         - eth: fec: use page_pool_put_full_page when freeing rx buffers
      
         - eth: iavf: fix temporary deadlock and failure to set MAC address
      
        Previous releases - always broken:
      
         - netlink: prevent potential spectre v1 gadgets
      
         - netfilter: fixes for SCTP connection tracking
      
         - mctp: struct sock lifetime fixes
      
         - eth: ravb: fix possible hang if RIS2_QFF1 happen
      
         - eth: tg3: resolve deadlock in tg3_reset_task() during EEH
      
        Misc:
      
         - Mat stepped out as MPTCP co-maintainer"
      
      * tag 'net-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (40 commits)
        net: mdio-mux-meson-g12a: force internal PHY off on mux switch
        docs: networking: Fix bridge documentation URL
        tsnep: Fix TX queue stop/wake for multiple queues
        net/tg3: resolve deadlock in tg3_reset_task() during EEH
        net: mctp: mark socks as dead on unhash, prevent re-add
        net: mctp: hold key reference when looking up a general key
        net: mctp: move expiry timer delete to unhash
        net: mctp: add an explicit reference from a mctp_sk_key to sock
        net: ravb: Fix possible hang if RIS2_QFF1 happen
        net: ravb: Fix lack of register setting after system resumed for Gen3
        net/x25: Fix to not accept on connected socket
        ice: move devlink port creation/deletion
        sctp: fail if no bound addresses can be used for a given scope
        net/sched: sch_taprio: do not schedule in taprio_reset()
        Revert "Merge branch 'ethtool-mac-merge'"
        netrom: Fix use-after-free of a listening socket.
        netfilter: conntrack: unify established states for SCTP paths
        Revert "netfilter: conntrack: add sctp DATA_SENT state"
        netfilter: conntrack: fix bug in for_each_sctp_chunk
        netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
        ...
      28b4387f
    • Linus Torvalds's avatar
      treewide: fix up files incorrectly marked executable · 262b42e0
      Linus Torvalds authored
      I'm not exactly clear on what strange workflow causes people to do it,
      but clearly occasionally some files end up being committed as executable
      even though they clearly aren't.
      
      This is a reprise of commit 90fda63f ("treewide: fix up files
      incorrectly marked executable"), just with a different set of files (but
      with the same trivial shell scripting).
      
      So apparently we need to re-do this every five years or so, and Joe
      needs to just keep reminding me to do so ;)
      Reported-by: default avatarJoe Perches <joe@perches.com>
      Fixes: 523375c9 ("drm/vmwgfx: Port vmwgfx to arm64")
      Fixes: 5c439937 ("ASoC: codecs: add support for ES8326")
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      262b42e0
    • Jerome Brunet's avatar
      net: mdio-mux-meson-g12a: force internal PHY off on mux switch · 7083df59
      Jerome Brunet authored
      Force the internal PHY off then on when switching to the internal path.
      This fixes problems where the PHY ID is not properly set.
      
      Fixes: 70904251 ("net: phy: add amlogic g12a mdio mux support")
      Suggested-by: default avatarQi Duan <qi.duan@amlogic.com>
      Co-developed-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
      Signed-off-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
      Signed-off-by: default avatarJerome Brunet <jbrunet@baylibre.com>
      Link: https://lore.kernel.org/r/20230124101157.232234-1-jbrunet@baylibre.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      7083df59
    • Ivan Vecera's avatar
    • Gerhard Engleder's avatar
      tsnep: Fix TX queue stop/wake for multiple queues · 3d53aaef
      Gerhard Engleder authored
      netif_stop_queue() and netif_wake_queue() act on TX queue 0. This is ok
      as long as only a single TX queue is supported. But support for multiple
      TX queues was introduced with 76203137 and I missed to adapt stop
      and wake of TX queues.
      
      Use netif_stop_subqueue() and netif_tx_wake_queue() to act on specific
      TX queue.
      
      Fixes: 76203137 ("tsnep: Support multiple TX/RX queue pairs")
      Signed-off-by: default avatarGerhard Engleder <gerhard@engleder-embedded.com>
      Link: https://lore.kernel.org/r/20230124191440.56887-1-gerhard@engleder-embedded.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      3d53aaef
    • David Christensen's avatar
      net/tg3: resolve deadlock in tg3_reset_task() during EEH · 6c4ca03b
      David Christensen authored
      During EEH error injection testing, a deadlock was encountered in the tg3
      driver when tg3_io_error_detected() was attempting to cancel outstanding
      reset tasks:
      
      crash> foreach UN bt
      ...
      PID: 159    TASK: c0000000067c6000  CPU: 8   COMMAND: "eehd"
      ...
       #5 [c00000000681f990] __cancel_work_timer at c00000000019fd18
       #6 [c00000000681fa30] tg3_io_error_detected at c00800000295f098 [tg3]
       #7 [c00000000681faf0] eeh_report_error at c00000000004e25c
      ...
      
      PID: 290    TASK: c000000036e5f800  CPU: 6   COMMAND: "kworker/6:1"
      ...
       #4 [c00000003721fbc0] rtnl_lock at c000000000c940d8
       #5 [c00000003721fbe0] tg3_reset_task at c008000002969358 [tg3]
       #6 [c00000003721fc60] process_one_work at c00000000019e5c4
      ...
      
      PID: 296    TASK: c000000037a65800  CPU: 21  COMMAND: "kworker/21:1"
      ...
       #4 [c000000037247bc0] rtnl_lock at c000000000c940d8
       #5 [c000000037247be0] tg3_reset_task at c008000002969358 [tg3]
       #6 [c000000037247c60] process_one_work at c00000000019e5c4
      ...
      
      PID: 655    TASK: c000000036f49000  CPU: 16  COMMAND: "kworker/16:2"
      ...:1
      
       #4 [c0000000373ebbc0] rtnl_lock at c000000000c940d8
       #5 [c0000000373ebbe0] tg3_reset_task at c008000002969358 [tg3]
       #6 [c0000000373ebc60] process_one_work at c00000000019e5c4
      ...
      
      Code inspection shows that both tg3_io_error_detected() and
      tg3_reset_task() attempt to acquire the RTNL lock at the beginning of
      their code blocks.  If tg3_reset_task() should happen to execute between
      the times when tg3_io_error_deteced() acquires the RTNL lock and
      tg3_reset_task_cancel() is called, a deadlock will occur.
      
      Moving tg3_reset_task_cancel() call earlier within the code block, prior
      to acquiring RTNL, prevents this from happening, but also exposes another
      deadlock issue where tg3_reset_task() may execute AFTER
      tg3_io_error_detected() has executed:
      
      crash> foreach UN bt
      PID: 159    TASK: c0000000067d2000  CPU: 9   COMMAND: "eehd"
      ...
       #4 [c000000006867a60] rtnl_lock at c000000000c940d8
       #5 [c000000006867a80] tg3_io_slot_reset at c0080000026c2ea8 [tg3]
       #6 [c000000006867b00] eeh_report_reset at c00000000004de88
      ...
      PID: 363    TASK: c000000037564000  CPU: 6   COMMAND: "kworker/6:1"
      ...
       #3 [c000000036c1bb70] msleep at c000000000259e6c
       #4 [c000000036c1bba0] napi_disable at c000000000c6b848
       #5 [c000000036c1bbe0] tg3_reset_task at c0080000026d942c [tg3]
       #6 [c000000036c1bc60] process_one_work at c00000000019e5c4
      ...
      
      This issue can be avoided by aborting tg3_reset_task() if EEH error
      recovery is already in progress.
      
      Fixes: db84bf43 ("tg3: tg3_reset_task() needs to use rtnl_lock to synchronize")
      Signed-off-by: default avatarDavid Christensen <drc@linux.vnet.ibm.com>
      Reviewed-by: default avatarPavan Chebbi <pavan.chebbi@broadcom.com>
      Link: https://lore.kernel.org/r/20230124185339.225806-1-drc@linux.vnet.ibm.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      6c4ca03b
  5. 25 Jan, 2023 14 commits