1. 31 Jul, 2022 3 commits
  2. 30 Jul, 2022 2 commits
  3. 29 Jul, 2022 31 commits
  4. 28 Jul, 2022 4 commits
    • Alistair Popple's avatar
      nouveau/svm: Fix to migrate all requested pages · 66cee909
      Alistair Popple authored
      Users may request that pages from an OpenCL SVM allocation be migrated
      to the GPU with clEnqueueSVMMigrateMem(). In Nouveau this will call into
      nouveau_dmem_migrate_vma() to do the migration. If the total range to be
      migrated exceeds SG_MAX_SINGLE_ALLOC the pages will be migrated in
      chunks of size SG_MAX_SINGLE_ALLOC. However a typo in updating the
      starting address means that only the first chunk will get migrated.
      
      Fix the calculation so that the entire range will get migrated if
      possible.
      Signed-off-by: default avatarAlistair Popple <apopple@nvidia.com>
      Fixes: e3d8b089 ("drm/nouveau/svm: map pages after migration")
      Reviewed-by: default avatarRalph Campbell <rcampbell@nvidia.com>
      Reviewed-by: default avatarLyude Paul <lyude@redhat.com>
      Signed-off-by: default avatarLyude Paul <lyude@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220720062745.960701-1-apopple@nvidia.com
      Cc: <stable@vger.kernel.org> # v5.8+
      66cee909
    • Linus Torvalds's avatar
      Merge tag 'net-5.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 33ea1340
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Including fixes from bluetooth and netfilter, no known blockers for
        the release.
      
        Current release - regressions:
      
         - wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop(), fix
           taking the lock before its initialized
      
         - Bluetooth: mgmt: fix double free on error path
      
        Current release - new code bugs:
      
         - eth: ice: fix tunnel checksum offload with fragmented traffic
      
        Previous releases - regressions:
      
         - tcp: md5: fix IPv4-mapped support after refactoring, don't take the
           pure v6 path
      
         - Revert "tcp: change pingpong threshold to 3", improving detection
           of interactive sessions
      
         - mld: fix netdev refcount leak in mld_{query | report}_work() due to
           a race
      
         - Bluetooth:
            - always set event mask on suspend, avoid early wake ups
            - L2CAP: fix use-after-free caused by l2cap_chan_put
      
         - bridge: do not send empty IFLA_AF_SPEC attribute
      
        Previous releases - always broken:
      
         - ping6: fix memleak in ipv6_renew_options()
      
         - sctp: prevent null-deref caused by over-eager error paths
      
         - virtio-net: fix the race between refill work and close, resulting
           in NAPI scheduled after close and a BUG()
      
         - macsec:
            - fix three netlink parsing bugs
            - avoid breaking the device state on invalid change requests
            - fix a memleak in another error path
      
        Misc:
      
         - dt-bindings: net: ethernet-controller: rework 'fixed-link' schema
      
         - two more batches of sysctl data race adornment"
      
      * tag 'net-5.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (67 commits)
        stmmac: dwmac-mediatek: fix resource leak in probe
        ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
        net: ping6: Fix memleak in ipv6_renew_options().
        net/funeth: Fix fun_xdp_tx() and XDP packet reclaim
        sctp: leave the err path free in sctp_stream_init to sctp_stream_free
        sfc: disable softirqs for ptp TX
        ptp: ocp: Select CRC16 in the Kconfig.
        tcp: md5: fix IPv4-mapped support
        virtio-net: fix the race between refill work and close
        mptcp: Do not return EINPROGRESS when subflow creation succeeds
        Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
        Bluetooth: Always set event mask on suspend
        Bluetooth: mgmt: Fix double free on error path
        wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()
        ice: do not setup vlan for loopback VSI
        ice: check (DD | EOF) bits on Rx descriptor rather than (EOP | RS)
        ice: Fix VSIs unable to share unicast MAC
        ice: Fix tunnel checksum offload with fragmented traffic
        ice: Fix max VLANs available for VF
        netfilter: nft_queue: only allow supported familes and hooks
        ...
      33ea1340
    • Dan Carpenter's avatar
      stmmac: dwmac-mediatek: fix resource leak in probe · 4d3d3a1b
      Dan Carpenter authored
      If mediatek_dwmac_clks_config() fails, then call stmmac_remove_config_dt()
      before returning.  Otherwise it is a resource leak.
      
      Fixes: fa4b3ca6 ("stmmac: dwmac-mediatek: fix clock issue")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Link: https://lore.kernel.org/r/YuJ4aZyMUlG6yGGa@kiliSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      4d3d3a1b
    • Ziyang Xuan's avatar
      ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr · 85f0173d
      Ziyang Xuan authored
      Change net device's MTU to smaller than IPV6_MIN_MTU or unregister
      device while matching route. That may trigger null-ptr-deref bug
      for ip6_ptr probability as following.
      
      =========================================================
      BUG: KASAN: null-ptr-deref in find_match.part.0+0x70/0x134
      Read of size 4 at addr 0000000000000308 by task ping6/263
      
      CPU: 2 PID: 263 Comm: ping6 Not tainted 5.19.0-rc7+ #14
      Call trace:
       dump_backtrace+0x1a8/0x230
       show_stack+0x20/0x70
       dump_stack_lvl+0x68/0x84
       print_report+0xc4/0x120
       kasan_report+0x84/0x120
       __asan_load4+0x94/0xd0
       find_match.part.0+0x70/0x134
       __find_rr_leaf+0x408/0x470
       fib6_table_lookup+0x264/0x540
       ip6_pol_route+0xf4/0x260
       ip6_pol_route_output+0x58/0x70
       fib6_rule_lookup+0x1a8/0x330
       ip6_route_output_flags_noref+0xd8/0x1a0
       ip6_route_output_flags+0x58/0x160
       ip6_dst_lookup_tail+0x5b4/0x85c
       ip6_dst_lookup_flow+0x98/0x120
       rawv6_sendmsg+0x49c/0xc70
       inet_sendmsg+0x68/0x94
      
      Reproducer as following:
      Firstly, prepare conditions:
      $ip netns add ns1
      $ip netns add ns2
      $ip link add veth1 type veth peer name veth2
      $ip link set veth1 netns ns1
      $ip link set veth2 netns ns2
      $ip netns exec ns1 ip -6 addr add 2001:0db8:0:f101::1/64 dev veth1
      $ip netns exec ns2 ip -6 addr add 2001:0db8:0:f101::2/64 dev veth2
      $ip netns exec ns1 ifconfig veth1 up
      $ip netns exec ns2 ifconfig veth2 up
      $ip netns exec ns1 ip -6 route add 2000::/64 dev veth1 metric 1
      $ip netns exec ns2 ip -6 route add 2001::/64 dev veth2 metric 1
      
      Secondly, execute the following two commands in two ssh windows
      respectively:
      $ip netns exec ns1 sh
      $while true; do ip -6 addr add 2001:0db8:0:f101::1/64 dev veth1; ip -6 route add 2000::/64 dev veth1 metric 1; ping6 2000::2; done
      
      $ip netns exec ns1 sh
      $while true; do ip link set veth1 mtu 1000; ip link set veth1 mtu 1500; sleep 5; done
      
      It is because ip6_ptr has been assigned to NULL in addrconf_ifdown() firstly,
      then ip6_ignore_linkdown() accesses ip6_ptr directly without NULL check.
      
      	cpu0			cpu1
      fib6_table_lookup
      __find_rr_leaf
      			addrconf_notify [ NETDEV_CHANGEMTU ]
      			addrconf_ifdown
      			RCU_INIT_POINTER(dev->ip6_ptr, NULL)
      find_match
      ip6_ignore_linkdown
      
      So we can add NULL check for ip6_ptr before using in ip6_ignore_linkdown() to
      fix the null-ptr-deref bug.
      
      Fixes: dcd1f572 ("net/ipv6: Remove fib6_idev")
      Signed-off-by: default avatarZiyang Xuan <william.xuanziyang@huawei.com>
      Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
      Link: https://lore.kernel.org/r/20220728013307.656257-1-william.xuanziyang@huawei.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      85f0173d