1. 17 Feb, 2022 8 commits
    • Jonas Gorski's avatar
      Revert "net: ethernet: bgmac: Use devm_platform_ioremap_resource_byname" · 6aba04ee
      Jonas Gorski authored
      This reverts commit 3710e809.
      
      Since idm_base and nicpm_base are still optional resources not present
      on all platforms, this breaks the driver for everything except Northstar
      2 (which has both).
      
      The same change was already reverted once with 755f5738 ("net:
      broadcom: fix a mistake about ioremap resource").
      
      So let's do it again.
      
      Fixes: 3710e809 ("net: ethernet: bgmac: Use devm_platform_ioremap_resource_byname")
      Signed-off-by: default avatarJonas Gorski <jonas.gorski@gmail.com>
      [florian: Added comments to explain the resources are optional]
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Link: https://lore.kernel.org/r/20220216184634.2032460-1-f.fainelli@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      6aba04ee
    • Xin Long's avatar
      ping: fix the dif and sdif check in ping_lookup · 35a79e64
      Xin Long authored
      When 'ping' changes to use PING socket instead of RAW socket by:
      
         # sysctl -w net.ipv4.ping_group_range="0 100"
      
      There is another regression caused when matching sk_bound_dev_if
      and dif, RAW socket is using inet_iif() while PING socket lookup
      is using skb->dev->ifindex, the cmd below fails due to this:
      
        # ip link add dummy0 type dummy
        # ip link set dummy0 up
        # ip addr add 192.168.111.1/24 dev dummy0
        # ping -I dummy0 192.168.111.1 -c1
      
      The issue was also reported on:
      
        https://github.com/iputils/iputils/issues/104
      
      But fixed in iputils in a wrong way by not binding to device when
      destination IP is on device, and it will cause some of kselftests
      to fail, as Jianlin noticed.
      
      This patch is to use inet(6)_iif and inet(6)_sdif to get dif and
      sdif for PING socket, and keep consistent with RAW socket.
      
      Fixes: c319b4d7 ("net: ipv4: add IPPROTO_ICMP socket kind")
      Reported-by: default avatarJianlin Shi <jishi@redhat.com>
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      35a79e64
    • Daniele Palmas's avatar
      net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 · 21e8a963
      Daniele Palmas authored
      Add quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE for Telit FN990
      0x1071 composition in order to avoid bind error.
      Signed-off-by: default avatarDaniele Palmas <dnlplm@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      21e8a963
    • Eric Dumazet's avatar
      net: sched: limit TC_ACT_REPEAT loops · 5740d068
      Eric Dumazet authored
      We have been living dangerously, at the mercy of malicious users,
      abusing TC_ACT_REPEAT, as shown by this syzpot report [1].
      
      Add an arbitrary limit (32) to the number of times an action can
      return TC_ACT_REPEAT.
      
      v2: switch the limit to 32 instead of 10.
          Use net_warn_ratelimited() instead of pr_err_once().
      
      [1] (C repro available on demand)
      
      rcu: INFO: rcu_preempt self-detected stall on CPU
      rcu:    1-...!: (10500 ticks this GP) idle=021/1/0x4000000000000000 softirq=5592/5592 fqs=0
              (t=10502 jiffies g=5305 q=190)
      rcu: rcu_preempt kthread timer wakeup didn't happen for 10502 jiffies! g5305 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
      rcu:    Possible timer handling issue on cpu=0 timer-softirq=3527
      rcu: rcu_preempt kthread starved for 10505 jiffies! g5305 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
      rcu:    Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
      rcu: RCU grace-period kthread stack dump:
      task:rcu_preempt     state:I stack:29344 pid:   14 ppid:     2 flags:0x00004000
      Call Trace:
       <TASK>
       context_switch kernel/sched/core.c:4986 [inline]
       __schedule+0xab2/0x4db0 kernel/sched/core.c:6295
       schedule+0xd2/0x260 kernel/sched/core.c:6368
       schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1881
       rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1963
       rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2136
       kthread+0x2e9/0x3a0 kernel/kthread.c:377
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
       </TASK>
      rcu: Stack dump where RCU GP kthread last ran:
      Sending NMI from CPU 1 to CPUs 0:
      NMI backtrace for cpu 0
      CPU: 0 PID: 3646 Comm: syz-executor358 Not tainted 5.17.0-rc3-syzkaller-00149-gbf8e59fd #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      RIP: 0010:rep_nop arch/x86/include/asm/vdso/processor.h:13 [inline]
      RIP: 0010:cpu_relax arch/x86/include/asm/vdso/processor.h:18 [inline]
      RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:437 [inline]
      RIP: 0010:__pv_queued_spin_lock_slowpath+0x3b8/0xb40 kernel/locking/qspinlock.c:508
      Code: 48 89 eb c6 45 01 01 41 bc 00 80 00 00 48 c1 e9 03 83 e3 07 41 be 01 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8d 2c 01 eb 0c <f3> 90 41 83 ec 01 0f 84 72 04 00 00 41 0f b6 45 00 38 d8 7f 08 84
      RSP: 0018:ffffc9000283f1b0 EFLAGS: 00000206
      RAX: 0000000000000003 RBX: 0000000000000000 RCX: 1ffff1100fc0071e
      RDX: 0000000000000001 RSI: 0000000000000201 RDI: 0000000000000000
      RBP: ffff88807e0038f0 R08: 0000000000000001 R09: ffffffff8ffbf9ff
      R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000004c1e
      R13: ffffed100fc0071e R14: 0000000000000001 R15: ffff8880b9c3aa80
      FS:  00005555562bf300(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007ffdbfef12b8 CR3: 00000000723c2000 CR4: 00000000003506f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       <TASK>
       pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:591 [inline]
       queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline]
       queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
       do_raw_spin_lock+0x200/0x2b0 kernel/locking/spinlock_debug.c:115
       spin_lock_bh include/linux/spinlock.h:354 [inline]
       sch_tree_lock include/net/sch_generic.h:610 [inline]
       sch_tree_lock include/net/sch_generic.h:605 [inline]
       prio_tune+0x3b9/0xb50 net/sched/sch_prio.c:211
       prio_init+0x5c/0x80 net/sched/sch_prio.c:244
       qdisc_create.constprop.0+0x44a/0x10f0 net/sched/sch_api.c:1253
       tc_modify_qdisc+0x4c5/0x1980 net/sched/sch_api.c:1660
       rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5594
       netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
       netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
       netlink_unicast+0x539/0x7e0 net/netlink/af_netlink.c:1343
       netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1919
       sock_sendmsg_nosec net/socket.c:705 [inline]
       sock_sendmsg+0xcf/0x120 net/socket.c:725
       ____sys_sendmsg+0x6e8/0x810 net/socket.c:2413
       ___sys_sendmsg+0xf3/0x170 net/socket.c:2467
       __sys_sendmsg+0xe5/0x1b0 net/socket.c:2496
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      RIP: 0033:0x7f7ee98aae99
      Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
      RSP: 002b:00007ffdbfef12d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
      RAX: ffffffffffffffda RBX: 00007ffdbfef1300 RCX: 00007f7ee98aae99
      RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003
      RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d
      R10: 000000000000000d R11: 0000000000000246 R12: 00007ffdbfef12f0
      R13: 00000000000f4240 R14: 000000000004ca47 R15: 00007ffdbfef12e4
       </TASK>
      INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 2.293 msecs
      NMI backtrace for cpu 1
      CPU: 1 PID: 3260 Comm: kworker/1:3 Not tainted 5.17.0-rc3-syzkaller-00149-gbf8e59fd #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Workqueue: mld mld_ifc_work
      Call Trace:
       <IRQ>
       __dump_stack lib/dump_stack.c:88 [inline]
       dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
       nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111
       nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
       trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
       rcu_dump_cpu_stacks+0x25e/0x3f0 kernel/rcu/tree_stall.h:343
       print_cpu_stall kernel/rcu/tree_stall.h:604 [inline]
       check_cpu_stall kernel/rcu/tree_stall.h:688 [inline]
       rcu_pending kernel/rcu/tree.c:3919 [inline]
       rcu_sched_clock_irq.cold+0x5c/0x759 kernel/rcu/tree.c:2617
       update_process_times+0x16d/0x200 kernel/time/timer.c:1785
       tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226
       tick_sched_timer+0x1b0/0x2d0 kernel/time/tick-sched.c:1428
       __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
       __hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749
       hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
       local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
       __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
       sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
       </IRQ>
       <TASK>
       asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
      RIP: 0010:__sanitizer_cov_trace_const_cmp4+0xc/0x70 kernel/kcov.c:286
      Code: 00 00 00 48 89 7c 30 e8 48 89 4c 30 f0 4c 89 54 d8 20 48 89 10 5b c3 0f 1f 80 00 00 00 00 41 89 f8 bf 03 00 00 00 4c 8b 14 24 <89> f1 65 48 8b 34 25 00 70 02 00 e8 14 f9 ff ff 84 c0 74 4b 48 8b
      RSP: 0018:ffffc90002c5eea8 EFLAGS: 00000246
      RAX: 0000000000000007 RBX: ffff88801c625800 RCX: 0000000000000000
      RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
      RBP: ffff8880137d3100 R08: 0000000000000000 R09: 0000000000000000
      R10: ffffffff874fcd88 R11: 0000000000000000 R12: ffff88801d692dc0
      R13: ffff8880137d3104 R14: 0000000000000000 R15: ffff88801d692de8
       tcf_police_act+0x358/0x11d0 net/sched/act_police.c:256
       tcf_action_exec net/sched/act_api.c:1049 [inline]
       tcf_action_exec+0x1a6/0x530 net/sched/act_api.c:1026
       tcf_exts_exec include/net/pkt_cls.h:326 [inline]
       route4_classify+0xef0/0x1400 net/sched/cls_route.c:179
       __tcf_classify net/sched/cls_api.c:1549 [inline]
       tcf_classify+0x3e8/0x9d0 net/sched/cls_api.c:1615
       prio_classify net/sched/sch_prio.c:42 [inline]
       prio_enqueue+0x3a7/0x790 net/sched/sch_prio.c:75
       dev_qdisc_enqueue+0x40/0x300 net/core/dev.c:3668
       __dev_xmit_skb net/core/dev.c:3756 [inline]
       __dev_queue_xmit+0x1f61/0x3660 net/core/dev.c:4081
       neigh_hh_output include/net/neighbour.h:533 [inline]
       neigh_output include/net/neighbour.h:547 [inline]
       ip_finish_output2+0x14dc/0x2170 net/ipv4/ip_output.c:228
       __ip_finish_output net/ipv4/ip_output.c:306 [inline]
       __ip_finish_output+0x396/0x650 net/ipv4/ip_output.c:288
       ip_finish_output+0x32/0x200 net/ipv4/ip_output.c:316
       NF_HOOK_COND include/linux/netfilter.h:296 [inline]
       ip_output+0x196/0x310 net/ipv4/ip_output.c:430
       dst_output include/net/dst.h:451 [inline]
       ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:126
       iptunnel_xmit+0x628/0xa50 net/ipv4/ip_tunnel_core.c:82
       geneve_xmit_skb drivers/net/geneve.c:966 [inline]
       geneve_xmit+0x10c8/0x3530 drivers/net/geneve.c:1077
       __netdev_start_xmit include/linux/netdevice.h:4683 [inline]
       netdev_start_xmit include/linux/netdevice.h:4697 [inline]
       xmit_one net/core/dev.c:3473 [inline]
       dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3489
       __dev_queue_xmit+0x2985/0x3660 net/core/dev.c:4116
       neigh_hh_output include/net/neighbour.h:533 [inline]
       neigh_output include/net/neighbour.h:547 [inline]
       ip6_finish_output2+0xf7a/0x14f0 net/ipv6/ip6_output.c:126
       __ip6_finish_output net/ipv6/ip6_output.c:191 [inline]
       __ip6_finish_output+0x61e/0xe90 net/ipv6/ip6_output.c:170
       ip6_finish_output+0x32/0x200 net/ipv6/ip6_output.c:201
       NF_HOOK_COND include/linux/netfilter.h:296 [inline]
       ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:224
       dst_output include/net/dst.h:451 [inline]
       NF_HOOK include/linux/netfilter.h:307 [inline]
       NF_HOOK include/linux/netfilter.h:301 [inline]
       mld_sendpack+0x9a3/0xe40 net/ipv6/mcast.c:1826
       mld_send_cr net/ipv6/mcast.c:2127 [inline]
       mld_ifc_work+0x71c/0xdc0 net/ipv6/mcast.c:2659
       process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
       worker_thread+0x657/0x1110 kernel/workqueue.c:2454
       kthread+0x2e9/0x3a0 kernel/kthread.c:377
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
       </TASK>
      ----------------
      Code disassembly (best guess):
         0:   48 89 eb                mov    %rbp,%rbx
         3:   c6 45 01 01             movb   $0x1,0x1(%rbp)
         7:   41 bc 00 80 00 00       mov    $0x8000,%r12d
         d:   48 c1 e9 03             shr    $0x3,%rcx
        11:   83 e3 07                and    $0x7,%ebx
        14:   41 be 01 00 00 00       mov    $0x1,%r14d
        1a:   48 b8 00 00 00 00 00    movabs $0xdffffc0000000000,%rax
        21:   fc ff df
        24:   4c 8d 2c 01             lea    (%rcx,%rax,1),%r13
        28:   eb 0c                   jmp    0x36
      * 2a:   f3 90                   pause <-- trapping instruction
        2c:   41 83 ec 01             sub    $0x1,%r12d
        30:   0f 84 72 04 00 00       je     0x4a8
        36:   41 0f b6 45 00          movzbl 0x0(%r13),%eax
        3b:   38 d8                   cmp    %bl,%al
        3d:   7f 08                   jg     0x47
        3f:   84                      .byte 0x84
      
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Cc: Cong Wang <xiyou.wangcong@gmail.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Link: https://lore.kernel.org/r/20220215235305.3272331-1-eric.dumazet@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      5740d068
    • Jon Maloy's avatar
      tipc: fix wrong notification node addresses · c08e5843
      Jon Maloy authored
      The previous bug fix had an unfortunate side effect that broke
      distribution of binding table entries between nodes. The updated
      tipc_sock_addr struct is also used further down in the same
      function, and there the old value is still the correct one.
      
      Fixes: 032062f3 ("tipc: fix wrong publisher node address in link publications")
      Signed-off-by: default avatarJon Maloy <jmaloy@redhat.com>
      Link: https://lore.kernel.org/r/20220216020009.3404578-1-jmaloy@redhat.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      c08e5843
    • Alexey Khoroshilov's avatar
      net: dsa: lantiq_gswip: fix use after free in gswip_remove() · 8c6ae461
      Alexey Khoroshilov authored
      of_node_put(priv->ds->slave_mii_bus->dev.of_node) should be
      done before mdiobus_free(priv->ds->slave_mii_bus).
      Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
      Fixes: 0d120dfb ("net: dsa: lantiq_gswip: don't use devres for mdiobus")
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Link: https://lore.kernel.org/r/1644921768-26477-1-git-send-email-khoroshilov@ispras.ruSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      8c6ae461
    • Willem de Bruijn's avatar
      ipv6: per-netns exclusive flowlabel checks · 0b0dff5b
      Willem de Bruijn authored
      Ipv6 flowlabels historically require a reservation before use.
      Optionally in exclusive mode (e.g., user-private).
      
      Commit 59c820b2 ("ipv6: elide flowlabel check if no exclusive
      leases exist") introduced a fastpath that avoids this check when no
      exclusive leases exist in the system, and thus any flowlabel use
      will be granted.
      
      That allows skipping the control operation to reserve a flowlabel
      entirely. Though with a warning if the fast path fails:
      
        This is an optimization. Robust applications still have to revert to
        requesting leases if the fast path fails due to an exclusive lease.
      
      Still, this is subtle. Better isolate network namespaces from each
      other. Flowlabels are per-netns. Also record per-netns whether
      exclusive leases are in use. Then behavior does not change based on
      activity in other netns.
      
      Changes
        v2
          - wrap in IS_ENABLED(CONFIG_IPV6) to avoid breakage if disabled
      
      Fixes: 59c820b2 ("ipv6: elide flowlabel check if no exclusive leases exist")
      Link: https://lore.kernel.org/netdev/MWHPR2201MB1072BCCCFCE779E4094837ACD0329@MWHPR2201MB1072.namprd22.prod.outlook.com/Reported-by: default avatarCongyu Liu <liu3101@purdue.edu>
      Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
      Tested-by: default avatarCongyu Liu <liu3101@purdue.edu>
      Link: https://lore.kernel.org/r/20220215160037.1976072-1-willemdebruijn.kernel@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      0b0dff5b
    • Oleksandr Mazur's avatar
      net: bridge: multicast: notify switchdev driver whenever MC processing gets disabled · c832962a
      Oleksandr Mazur authored
      Whenever bridge driver hits the max capacity of MDBs, it disables
      the MC processing (by setting corresponding bridge option), but never
      notifies switchdev about such change (the notifiers are called only upon
      explicit setting of this option, through the registered netlink interface).
      
      This could lead to situation when Software MDB processing gets disabled,
      but this event never gets offloaded to the underlying Hardware.
      
      Fix this by adding a notify message in such case.
      
      Fixes: 147c1e9b ("switchdev: bridge: Offload multicast disabled")
      Signed-off-by: default avatarOleksandr Mazur <oleksandr.mazur@plvision.eu>
      Acked-by: default avatarNikolay Aleksandrov <nikolay@nvidia.com>
      Link: https://lore.kernel.org/r/20220215165303.31908-1-oleksandr.mazur@plvision.euSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      c832962a
  2. 15 Feb, 2022 11 commits
    • Oliver Neukum's avatar
      CDC-NCM: avoid overflow in sanity checking · 8d2b1a1e
      Oliver Neukum authored
      A broken device may give an extreme offset like 0xFFF0
      and a reasonable length for a fragment. In the sanity
      check as formulated now, this will create an integer
      overflow, defeating the sanity check. Both offset
      and offset + len need to be checked in such a manner
      that no overflow can occur.
      And those quantities should be unsigned.
      Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
      Reviewed-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8d2b1a1e
    • Tom Rix's avatar
      mctp: fix use after free · 7e5b6a5c
      Tom Rix authored
      Clang static analysis reports this problem
      route.c:425:4: warning: Use of memory after it is freed
        trace_mctp_key_acquire(key);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~
      When mctp_key_add() fails, key is freed but then is later
      used in trace_mctp_key_acquire().  Add an else statement
      to use the key only when mctp_key_add() is successful.
      
      Fixes: 4f9e1ba6 ("mctp: Add tracepoints for tag/key handling")
      Signed-off-by: default avatarTom Rix <trix@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7e5b6a5c
    • Vladimir Oltean's avatar
      net: mscc: ocelot: fix use-after-free in ocelot_vlan_del() · ef576405
      Vladimir Oltean authored
      ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if
      this is the same as the port's pvid_vlan which we access afterwards,
      what we're accessing is freed memory.
      
      Fix the bug by determining whether to clear ocelot_port->pvid_vlan prior
      to calling ocelot_vlan_member_del().
      
      Fixes: d4004422 ("net: mscc: ocelot: track the port pvid using a pointer")
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ef576405
    • Eric Dumazet's avatar
      bonding: fix data-races around agg_select_timer · 9ceaf6f7
      Eric Dumazet authored
      syzbot reported that two threads might write over agg_select_timer
      at the same time. Make agg_select_timer atomic to fix the races.
      
      BUG: KCSAN: data-race in bond_3ad_initiate_agg_selection / bond_3ad_state_machine_handler
      
      read to 0xffff8881242aea90 of 4 bytes by task 1846 on cpu 1:
       bond_3ad_state_machine_handler+0x99/0x2810 drivers/net/bonding/bond_3ad.c:2317
       process_one_work+0x3f6/0x960 kernel/workqueue.c:2307
       worker_thread+0x616/0xa70 kernel/workqueue.c:2454
       kthread+0x1bf/0x1e0 kernel/kthread.c:377
       ret_from_fork+0x1f/0x30
      
      write to 0xffff8881242aea90 of 4 bytes by task 25910 on cpu 0:
       bond_3ad_initiate_agg_selection+0x18/0x30 drivers/net/bonding/bond_3ad.c:1998
       bond_open+0x658/0x6f0 drivers/net/bonding/bond_main.c:3967
       __dev_open+0x274/0x3a0 net/core/dev.c:1407
       dev_open+0x54/0x190 net/core/dev.c:1443
       bond_enslave+0xcef/0x3000 drivers/net/bonding/bond_main.c:1937
       do_set_master net/core/rtnetlink.c:2532 [inline]
       do_setlink+0x94f/0x2500 net/core/rtnetlink.c:2736
       __rtnl_newlink net/core/rtnetlink.c:3414 [inline]
       rtnl_newlink+0xfeb/0x13e0 net/core/rtnetlink.c:3529
       rtnetlink_rcv_msg+0x745/0x7e0 net/core/rtnetlink.c:5594
       netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494
       rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612
       netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
       netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343
       netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919
       sock_sendmsg_nosec net/socket.c:705 [inline]
       sock_sendmsg net/socket.c:725 [inline]
       ____sys_sendmsg+0x39a/0x510 net/socket.c:2413
       ___sys_sendmsg net/socket.c:2467 [inline]
       __sys_sendmsg+0x195/0x230 net/socket.c:2496
       __do_sys_sendmsg net/socket.c:2505 [inline]
       __se_sys_sendmsg net/socket.c:2503 [inline]
       __x64_sys_sendmsg+0x42/0x50 net/socket.c:2503
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      value changed: 0x00000050 -> 0x0000004f
      
      Reported by Kernel Concurrency Sanitizer on:
      CPU: 0 PID: 25910 Comm: syz-executor.1 Tainted: G        W         5.17.0-rc4-syzkaller-dirty #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Cc: Jay Vosburgh <j.vosburgh@gmail.com>
      Cc: Veaceslav Falico <vfalico@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9ceaf6f7
    • Radu Bulie's avatar
      dpaa2-eth: Initialize mutex used in one step timestamping path · 07dd4485
      Radu Bulie authored
      1588 Single Step Timestamping code path uses a mutex to
      enforce atomicity for two events:
      - update of ptp single step register
      - transmit ptp event packet
      
      Before this patch the mutex was not initialized. This
      caused unexpected crashes in the Tx function.
      
      Fixes: c5521189 ("dpaa2-eth: support PTP Sync packet one-step timestamping")
      Signed-off-by: default avatarRadu Bulie <radu-andrei.bulie@nxp.com>
      Reviewed-by: default avatarIoana Ciornei <ioana.ciornei@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      07dd4485
    • Tom Rix's avatar
      dpaa2-switch: fix default return of dpaa2_switch_flower_parse_mirror_key · 2a36ed7c
      Tom Rix authored
      Clang static analysis reports this representative problem
      dpaa2-switch-flower.c:616:24: warning: The right operand of '=='
        is a garbage value
        tmp->cfg.vlan_id == vlan) {
                         ^  ~~~~
      vlan is set in dpaa2_switch_flower_parse_mirror_key(). However
      this function can return success without setting vlan.  So
      change the default return to -EOPNOTSUPP.
      
      Fixes: 0f3faece ("dpaa2-switch: add VLAN based mirroring")
      Signed-off-by: default avatarTom Rix <trix@redhat.com>
      Reviewed-by: default avatarIoana Ciornei <ioana.ciornei@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2a36ed7c
    • Zhang Yunkai's avatar
      ipv4: add description about martian source · 9d2d38c3
      Zhang Yunkai authored
      When multiple containers are running in the environment and multiple
      macvlan network port are configured in each container, a lot of martian
      source prints will appear after martian_log is enabled. they are almost
      the same, and printed by net_warn_ratelimited. Each arp message will
      trigger this print on each network port.
      
      Such as:
      IPv4: martian source 173.254.95.16 from 173.254.100.109,
      on dev eth0
      ll header: 00000000: ff ff ff ff ff ff 40 00 ad fe 64 6d
      08 06        ......@...dm..
      IPv4: martian source 173.254.95.16 from 173.254.100.109,
      on dev eth1
      ll header: 00000000: ff ff ff ff ff ff 40 00 ad fe 64 6d
      08 06        ......@...dm..
      
      There is no description of this kind of source in the RFC1812.
      Signed-off-by: default avatarZhang Yunkai <zhang.yunkai@zte.com.cn>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9d2d38c3
    • Eric Dumazet's avatar
      crypto: af_alg - get rid of alg_memory_allocated · 25206111
      Eric Dumazet authored
      alg_memory_allocated does not seem to be really used.
      
      alg_proto does have a .memory_allocated field, but no
      corresponding .sysctl_mem.
      
      This means sk_has_account() returns true, but all sk_prot_mem_limits()
      users will trigger a NULL dereference [1].
      
      THis was not a problem until SO_RESERVE_MEM addition.
      
      general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
      KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
      CPU: 1 PID: 3591 Comm: syz-executor153 Not tainted 5.17.0-rc3-syzkaller-00316-gb81b1829 #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      RIP: 0010:sk_prot_mem_limits include/net/sock.h:1523 [inline]
      RIP: 0010:sock_reserve_memory+0x1d7/0x330 net/core/sock.c:1000
      Code: 08 00 74 08 48 89 ef e8 27 20 bb f9 4c 03 7c 24 10 48 8b 6d 00 48 83 c5 08 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 ef e8 fb 1f bb f9 48 8b 6d 00 4c 89 ff 48
      RSP: 0018:ffffc90001f1fb68 EFLAGS: 00010202
      RAX: 0000000000000001 RBX: ffff88814aabc000 RCX: dffffc0000000000
      RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff90e18120
      RBP: 0000000000000008 R08: dffffc0000000000 R09: fffffbfff21c3025
      R10: fffffbfff21c3025 R11: 0000000000000000 R12: ffffffff8d109840
      R13: 0000000000001002 R14: 0000000000000001 R15: 0000000000000001
      FS:  0000555556e08300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007fc74416f130 CR3: 0000000073d9e000 CR4: 00000000003506e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       <TASK>
       sock_setsockopt+0x14a9/0x3a30 net/core/sock.c:1446
       __sys_setsockopt+0x5af/0x980 net/socket.c:2176
       __do_sys_setsockopt net/socket.c:2191 [inline]
       __se_sys_setsockopt net/socket.c:2188 [inline]
       __x64_sys_setsockopt+0xb1/0xc0 net/socket.c:2188
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      RIP: 0033:0x7fc7440fddc9
      Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
      RSP: 002b:00007ffe98f07968 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
      RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc7440fddc9
      RDX: 0000000000000049 RSI: 0000000000000001 RDI: 0000000000000004
      RBP: 0000000000000000 R08: 0000000000000004 R09: 00007ffe98f07990
      R10: 0000000020000000 R11: 0000000000000246 R12: 00007ffe98f0798c
      R13: 00007ffe98f079a0 R14: 00007ffe98f079e0 R15: 0000000000000000
       </TASK>
      Modules linked in:
      ---[ end trace 0000000000000000 ]---
      RIP: 0010:sk_prot_mem_limits include/net/sock.h:1523 [inline]
      RIP: 0010:sock_reserve_memory+0x1d7/0x330 net/core/sock.c:1000
      Code: 08 00 74 08 48 89 ef e8 27 20 bb f9 4c 03 7c 24 10 48 8b 6d 00 48 83 c5 08 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 ef e8 fb 1f bb f9 48 8b 6d 00 4c 89 ff 48
      RSP: 0018:ffffc90001f1fb68 EFLAGS: 00010202
      RAX: 0000000000000001 RBX: ffff88814aabc000 RCX: dffffc0000000000
      RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff90e18120
      RBP: 0000000000000008 R08: dffffc0000000000 R09: fffffbfff21c3025
      R10: fffffbfff21c3025 R11: 0000000000000000 R12: ffffffff8d109840
      R13: 0000000000001002 R14: 0000000000000001 R15: 0000000000000001
      FS:  0000555556e08300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007fc74416f130 CR3: 0000000073d9e000 CR4: 00000000003506e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      
      Fixes: 2bb2f5fb ("net: add new socket option SO_RESERVE_MEM")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Wei Wang <weiwan@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      25206111
    • David S. Miller's avatar
      Merge tag 'ieee802154-for-net-2022-02-15' of... · b465c0dc
      David S. Miller authored
      Merge tag 'ieee802154-for-net-2022-02-15' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan
      
      Stefan Schmidt says:
      
      ====================
      Only a single fix this time.
      Miquel Raynal fixed the lifs/sifs periods in the ca82010 to take the actual
      symbol duration time into account.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b465c0dc
    • DENG Qingfang's avatar
      net: phy: mediatek: remove PHY mode check on MT7531 · 525b108e
      DENG Qingfang authored
      The function mt7531_phy_mode_supported in the DSA driver set supported
      mode to PHY_INTERFACE_MODE_GMII instead of PHY_INTERFACE_MODE_INTERNAL
      for the internal PHY, so this check breaks the PHY initialization:
      
      mt7530 mdio-bus:00 wan (uninitialized): failed to connect to PHY: -EINVAL
      
      Remove the check to make it work again.
      Reported-by: default avatarHauke Mehrtens <hauke@hauke-m.de>
      Fixes: e40d2cca ("net: phy: add MediaTek Gigabit Ethernet PHY driver")
      Signed-off-by: default avatarDENG Qingfang <dqfext@gmail.com>
      Acked-by: default avatarArınç ÜNAL <arinc.unal@arinc9.com>
      Tested-by: default avatarHauke Mehrtens <hauke@hauke-m.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      525b108e
    • Jon Maloy's avatar
      tipc: fix wrong publisher node address in link publications · 032062f3
      Jon Maloy authored
      When a link comes up we add its presence to the name table to make it
      possible for users to subscribe for link up/down events. However, after
      a previous call signature change the binding is wrongly published with
      the peer node as publishing node, instead of the own node as it should
      be. This has the effect that the command 'tipc name table show' will
      list the link binding (service type 2) with node scope and a peer node
      as originator, something that obviously is impossible.
      
      We correct this bug here.
      
      Fixes: 50a3499a ("tipc: simplify signature of tipc_namtbl_publish()")
      Signed-off-by: default avatarJon Maloy <jmaloy@redhat.com>
      Link: https://lore.kernel.org/r/20220214013852.2803940-1-jmaloy@redhat.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      032062f3
  3. 14 Feb, 2022 7 commits
    • Oliver Neukum's avatar
      USB: zaurus: support another broken Zaurus · 6605cc67
      Oliver Neukum authored
      This SL-6000 says Direct Line, not Ethernet
      
      v2: added Reporter and Link
      Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
      Reported-by: default avatarRoss Maynard <bids.7405@bigpond.com>
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=215361Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6605cc67
    • Nikolay Aleksandrov's avatar
      MAINTAINERS: bridge: update my email · 603c692d
      Nikolay Aleksandrov authored
      I'm leaving NVIDIA and my email account will stop working in a week, update
      it with my personal account.
      Signed-off-by: default avatarNikolay Aleksandrov <nikolay@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      603c692d
    • Alex Maydanik's avatar
      net: fix documentation for kernel_getsockname · 0fc95dec
      Alex Maydanik authored
      Fixes return value documentation of kernel_getsockname()
      and kernel_getpeername() functions.
      
      The previous documentation wrongly specified that the return
      value is 0 in case of success, however sock->ops->getname returns
      the length of the address in bytes in case of success.
      Signed-off-by: default avatarAlex Maydanik <alexander.maydanik@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0fc95dec
    • Eric Dumazet's avatar
      net_sched: add __rcu annotation to netdev->qdisc · 5891cd5e
      Eric Dumazet authored
      syzbot found a data-race [1] which lead me to add __rcu
      annotations to netdev->qdisc, and proper accessors
      to get LOCKDEP support.
      
      [1]
      BUG: KCSAN: data-race in dev_activate / qdisc_lookup_rcu
      
      write to 0xffff888168ad6410 of 8 bytes by task 13559 on cpu 1:
       attach_default_qdiscs net/sched/sch_generic.c:1167 [inline]
       dev_activate+0x2ed/0x8f0 net/sched/sch_generic.c:1221
       __dev_open+0x2e9/0x3a0 net/core/dev.c:1416
       __dev_change_flags+0x167/0x3f0 net/core/dev.c:8139
       rtnl_configure_link+0xc2/0x150 net/core/rtnetlink.c:3150
       __rtnl_newlink net/core/rtnetlink.c:3489 [inline]
       rtnl_newlink+0xf4d/0x13e0 net/core/rtnetlink.c:3529
       rtnetlink_rcv_msg+0x745/0x7e0 net/core/rtnetlink.c:5594
       netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494
       rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612
       netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
       netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343
       netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919
       sock_sendmsg_nosec net/socket.c:705 [inline]
       sock_sendmsg net/socket.c:725 [inline]
       ____sys_sendmsg+0x39a/0x510 net/socket.c:2413
       ___sys_sendmsg net/socket.c:2467 [inline]
       __sys_sendmsg+0x195/0x230 net/socket.c:2496
       __do_sys_sendmsg net/socket.c:2505 [inline]
       __se_sys_sendmsg net/socket.c:2503 [inline]
       __x64_sys_sendmsg+0x42/0x50 net/socket.c:2503
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      read to 0xffff888168ad6410 of 8 bytes by task 13560 on cpu 0:
       qdisc_lookup_rcu+0x30/0x2e0 net/sched/sch_api.c:323
       __tcf_qdisc_find+0x74/0x3a0 net/sched/cls_api.c:1050
       tc_del_tfilter+0x1c7/0x1350 net/sched/cls_api.c:2211
       rtnetlink_rcv_msg+0x5ba/0x7e0 net/core/rtnetlink.c:5585
       netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494
       rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612
       netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
       netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343
       netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919
       sock_sendmsg_nosec net/socket.c:705 [inline]
       sock_sendmsg net/socket.c:725 [inline]
       ____sys_sendmsg+0x39a/0x510 net/socket.c:2413
       ___sys_sendmsg net/socket.c:2467 [inline]
       __sys_sendmsg+0x195/0x230 net/socket.c:2496
       __do_sys_sendmsg net/socket.c:2505 [inline]
       __se_sys_sendmsg net/socket.c:2503 [inline]
       __x64_sys_sendmsg+0x42/0x50 net/socket.c:2503
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      value changed: 0xffffffff85dee080 -> 0xffff88815d96ec00
      
      Reported by Kernel Concurrency Sanitizer on:
      CPU: 0 PID: 13560 Comm: syz-executor.2 Not tainted 5.17.0-rc3-syzkaller-00116-gf1baf68e-dirty #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      
      Fixes: 470502de ("net: sched: unlock rules update API")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Vlad Buslov <vladbu@mellanox.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Cong Wang <xiyou.wangcong@gmail.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5891cd5e
    • Vladimir Oltean's avatar
      net: dsa: mv88e6xxx: flush switchdev FDB workqueue before removing VLAN · a2614140
      Vladimir Oltean authored
      mv88e6xxx is special among DSA drivers in that it requires the VTU to
      contain the VID of the FDB entry it modifies in
      mv88e6xxx_port_db_load_purge(), otherwise it will return -EOPNOTSUPP.
      
      Sometimes due to races this is not always satisfied even if external
      code does everything right (first deletes the FDB entries, then the
      VLAN), because DSA commits to hardware FDB entries asynchronously since
      commit c9eb3e0f ("net: dsa: Add support for learning FDB through
      notification").
      
      Therefore, the mv88e6xxx driver must close this race condition by
      itself, by asking DSA to flush the switchdev workqueue of any FDB
      deletions in progress, prior to exiting a VLAN.
      
      Fixes: c9eb3e0f ("net: dsa: Add support for learning FDB through notification")
      Reported-by: default avatarRafael Richter <rafael.richter@gin.de>
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a2614140
    • Ignat Korchagin's avatar
      ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() · 26394fc1
      Ignat Korchagin authored
      Some time ago 8965779d ("ipv6,mcast: always hold idev->lock before mca_lock")
      switched ipv6_get_lladdr() to __ipv6_get_lladdr(), which is rcu-unsafe
      version. That was OK, because idev->lock was held for these codepaths.
      
      In 88e2ca30 ("mld: convert ifmcaddr6 to RCU") these external locks were
      removed, so we probably need to restore the original rcu-safe call.
      
      Otherwise, we occasionally get a machine crashed/stalled with the following
      in dmesg:
      
      [ 3405.966610][T230589] general protection fault, probably for non-canonical address 0xdead00000000008c: 0000 [#1] SMP NOPTI
      [ 3405.982083][T230589] CPU: 44 PID: 230589 Comm: kworker/44:3 Tainted: G           O      5.15.19-cloudflare-2022.2.1 #1
      [ 3405.998061][T230589] Hardware name: SUPA-COOL-SERV
      [ 3406.009552][T230589] Workqueue: mld mld_ifc_work
      [ 3406.017224][T230589] RIP: 0010:__ipv6_get_lladdr+0x34/0x60
      [ 3406.025780][T230589] Code: 57 10 48 83 c7 08 48 89 e5 48 39 d7 74 3e 48 8d 82 38 ff ff ff eb 13 48 8b 90 d0 00 00 00 48 8d 82 38 ff ff ff 48 39 d7 74 22 <66> 83 78 32 20 77 1b 75 e4 89 ca 23 50 2c 75 dd 48 8b 50 08 48 8b
      [ 3406.055748][T230589] RSP: 0018:ffff94e4b3fc3d10 EFLAGS: 00010202
      [ 3406.065617][T230589] RAX: dead00000000005a RBX: ffff94e4b3fc3d30 RCX: 0000000000000040
      [ 3406.077477][T230589] RDX: dead000000000122 RSI: ffff94e4b3fc3d30 RDI: ffff8c3a31431008
      [ 3406.089389][T230589] RBP: ffff94e4b3fc3d10 R08: 0000000000000000 R09: 0000000000000000
      [ 3406.101445][T230589] R10: ffff8c3a31430000 R11: 000000000000000b R12: ffff8c2c37887100
      [ 3406.113553][T230589] R13: ffff8c3a39537000 R14: 00000000000005dc R15: ffff8c3a31431000
      [ 3406.125730][T230589] FS:  0000000000000000(0000) GS:ffff8c3b9fc80000(0000) knlGS:0000000000000000
      [ 3406.138992][T230589] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 3406.149895][T230589] CR2: 00007f0dfea1db60 CR3: 000000387b5f2000 CR4: 0000000000350ee0
      [ 3406.162421][T230589] Call Trace:
      [ 3406.170235][T230589]  <TASK>
      [ 3406.177736][T230589]  mld_newpack+0xfe/0x1a0
      [ 3406.186686][T230589]  add_grhead+0x87/0xa0
      [ 3406.195498][T230589]  add_grec+0x485/0x4e0
      [ 3406.204310][T230589]  ? newidle_balance+0x126/0x3f0
      [ 3406.214024][T230589]  mld_ifc_work+0x15d/0x450
      [ 3406.223279][T230589]  process_one_work+0x1e6/0x380
      [ 3406.232982][T230589]  worker_thread+0x50/0x3a0
      [ 3406.242371][T230589]  ? rescuer_thread+0x360/0x360
      [ 3406.252175][T230589]  kthread+0x127/0x150
      [ 3406.261197][T230589]  ? set_kthread_struct+0x40/0x40
      [ 3406.271287][T230589]  ret_from_fork+0x22/0x30
      [ 3406.280812][T230589]  </TASK>
      [ 3406.288937][T230589] Modules linked in: ... [last unloaded: kheaders]
      [ 3406.476714][T230589] ---[ end trace 3525a7655f2f3b9e ]---
      
      Fixes: 88e2ca30 ("mld: convert ifmcaddr6 to RCU")
      Reported-by: default avatarDavid Pinilla Caparros <dpini@cloudflare.com>
      Signed-off-by: default avatarIgnat Korchagin <ignat@cloudflare.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      26394fc1
    • Jesse Brandeburg's avatar
      ice: enable parsing IPSEC SPI headers for RSS · 86006f99
      Jesse Brandeburg authored
      The COMMS package can enable the hardware parser to recognize IPSEC
      frames with ESP header and SPI identifier.  If this package is available
      and configured for loading in /lib/firmware, then the driver will
      succeed in enabling this protocol type for RSS.
      
      This in turn allows the hardware to hash over the SPI and use it to pick
      a consistent receive queue for the same secure flow. Without this all
      traffic is steered to the same queue for multiple traffic threads from
      the same IP address. For that reason this is marked as a fix, as the
      driver supports the model, but it wasn't enabled.
      
      If the package is not available, adding this type will fail, but the
      failure is ignored on purpose as it has no negative affect.
      
      Fixes: c90ed40c ("ice: Enable writing hardware filtering tables")
      Signed-off-by: default avatarJesse Brandeburg <jesse.brandeburg@intel.com>
      Tested-by: Gurucharan G <gurucharanx.g@intel.com> (A Contingent worker at Intel)
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      86006f99
  4. 13 Feb, 2022 1 commit
  5. 11 Feb, 2022 8 commits
    • Gatis Peisenieks's avatar
      atl1c: fix tx timeout after link flap on Mikrotik 10/25G NIC · bf8e59fd
      Gatis Peisenieks authored
      If NIC had packets in tx queue at the moment link down event
      happened, it could result in tx timeout when link got back up.
      
      Since device has more than one tx queue we need to reset them
      accordingly.
      
      Fixes: 057f4af2 ("atl1c: add 4 RX/TX queue support for Mikrotik 10/25G NIC")
      Signed-off-by: default avatarGatis Peisenieks <gatis@mikrotik.com>
      Link: https://lore.kernel.org/r/20220211065123.4187615-1-gatis@mikrotik.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      bf8e59fd
    • Jeremy Kerr's avatar
      mctp: serial: Cancel pending work from ndo_uninit handler · 6c342ce2
      Jeremy Kerr authored
      We cannot do the cancel_work_sync from after the unregister_netdev, as
      the dev pointer is no longer valid, causing a uaf on ldisc unregister
      (or device close).
      
      Instead, do the cancel_work_sync from the ndo_uninit op, where the dev
      still exists, but the queue has stopped.
      
      Fixes: 7bd9890f ("mctp: serial: cancel tx work on ldisc close")
      Reported-by: default avatarLuo Likang <luolikang@nsfocus.com>
      Tested-by: default avatarLuo Likang <luolikang@nsfocus.com>
      Signed-off-by: default avatarJeremy Kerr <jk@codeconstruct.com.au>
      Link: https://lore.kernel.org/r/20220211011552.1861886-1-jk@codeconstruct.com.auSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      6c342ce2
    • Mans Rullgard's avatar
      net: dsa: lan9303: fix reset on probe · 6bb9681a
      Mans Rullgard authored
      The reset input to the LAN9303 chip is active low, and devicetree
      gpio handles reflect this.  Therefore, the gpio should be requested
      with an initial state of high in order for the reset signal to be
      asserted.  Other uses of the gpio already use the correct polarity.
      
      Fixes: a1292595 ("net: dsa: add new DSA switch driver for the SMSC-LAN9303")
      Signed-off-by: default avatarMans Rullgard <mans@mansr.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Reviewed-by: default avatarFlorian Fianelil <f.fainelli@gmail.com>
      Link: https://lore.kernel.org/r/20220209145454.19749-1-mans@mansr.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      6bb9681a
    • David S. Miller's avatar
      Merge tag 'wireless-2022-02-11' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless · 85d24ad3
      David S. Miller authored
      wireless fixes for v5.17
      
      Second set of fixes for v5.17. This is the first pull request with
      both driver and stack patches.
      
      Most important here are a regression fix for brcmfmac USB devices and
      an iwlwifi fix for use after free when the firmware was missing. We
      have new maintainers for ath9k and wcn36xx as well as ath6kl is now
      orphaned. Also smaller fixes to iwlwifi and stack.
      85d24ad3
    • David S. Miller's avatar
      Merge ra.kernel.org:/pub/scm/linux/kernel/git/netfilter/nf · 525de9a7
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for net:
      
      1) Add selftest for nft_synproxy, from Florian Westphal.
      
      2) xt_socket destroy path incorrectly disables IPv4 defrag for
         IPv6 traffic (typo), from Eric Dumazet.
      
      3) Fix exit value selftest nft_concat_range.sh, from Hangbin Liu.
      
      4) nft_synproxy disables the IPv4 hooks if the IPv6 hooks fail
         to be registered.
      
      5) disable rp_filter on router in selftest nft_fib.sh, also
         from Hangbin Liu.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      525de9a7
    • Eric Dumazet's avatar
      drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit · dcd54265
      Eric Dumazet authored
      trace_napi_poll_hit() is reading stat->dev while another thread can write
      on it from dropmon_net_event()
      
      Use READ_ONCE()/WRITE_ONCE() here, RCU rules are properly enforced already,
      we only have to take care of load/store tearing.
      
      BUG: KCSAN: data-race in dropmon_net_event / trace_napi_poll_hit
      
      write to 0xffff88816f3ab9c0 of 8 bytes by task 20260 on cpu 1:
       dropmon_net_event+0xb8/0x2b0 net/core/drop_monitor.c:1579
       notifier_call_chain kernel/notifier.c:84 [inline]
       raw_notifier_call_chain+0x53/0xb0 kernel/notifier.c:392
       call_netdevice_notifiers_info net/core/dev.c:1919 [inline]
       call_netdevice_notifiers_extack net/core/dev.c:1931 [inline]
       call_netdevice_notifiers net/core/dev.c:1945 [inline]
       unregister_netdevice_many+0x867/0xfb0 net/core/dev.c:10415
       ip_tunnel_delete_nets+0x24a/0x280 net/ipv4/ip_tunnel.c:1123
       vti_exit_batch_net+0x2a/0x30 net/ipv4/ip_vti.c:515
       ops_exit_list net/core/net_namespace.c:173 [inline]
       cleanup_net+0x4dc/0x8d0 net/core/net_namespace.c:597
       process_one_work+0x3f6/0x960 kernel/workqueue.c:2307
       worker_thread+0x616/0xa70 kernel/workqueue.c:2454
       kthread+0x1bf/0x1e0 kernel/kthread.c:377
       ret_from_fork+0x1f/0x30
      
      read to 0xffff88816f3ab9c0 of 8 bytes by interrupt on cpu 0:
       trace_napi_poll_hit+0x89/0x1c0 net/core/drop_monitor.c:292
       trace_napi_poll include/trace/events/napi.h:14 [inline]
       __napi_poll+0x36b/0x3f0 net/core/dev.c:6366
       napi_poll net/core/dev.c:6432 [inline]
       net_rx_action+0x29e/0x650 net/core/dev.c:6519
       __do_softirq+0x158/0x2de kernel/softirq.c:558
       do_softirq+0xb1/0xf0 kernel/softirq.c:459
       __local_bh_enable_ip+0x68/0x70 kernel/softirq.c:383
       __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
       _raw_spin_unlock_bh+0x33/0x40 kernel/locking/spinlock.c:210
       spin_unlock_bh include/linux/spinlock.h:394 [inline]
       ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline]
       wg_packet_decrypt_worker+0x73c/0x780 drivers/net/wireguard/receive.c:506
       process_one_work+0x3f6/0x960 kernel/workqueue.c:2307
       worker_thread+0x616/0xa70 kernel/workqueue.c:2454
       kthread+0x1bf/0x1e0 kernel/kthread.c:377
       ret_from_fork+0x1f/0x30
      
      value changed: 0xffff88815883e000 -> 0x0000000000000000
      
      Reported by Kernel Concurrency Sanitizer on:
      CPU: 0 PID: 26435 Comm: kworker/0:1 Not tainted 5.17.0-rc1-syzkaller #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Workqueue: wg-crypt-wg2 wg_packet_decrypt_worker
      
      Fixes: 4ea7e386 ("dropmon: add ability to detect when hardware dropsrxpackets")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Neil Horman <nhorman@tuxdriver.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dcd54265
    • Wen Gu's avatar
      net/smc: Avoid overwriting the copies of clcsock callback functions · 1de9770d
      Wen Gu authored
      The callback functions of clcsock will be saved and replaced during
      the fallback. But if the fallback happens more than once, then the
      copies of these callback functions will be overwritten incorrectly,
      resulting in a loop call issue:
      
      clcsk->sk_error_report
       |- smc_fback_error_report() <------------------------------|
           |- smc_fback_forward_wakeup()                          | (loop)
               |- clcsock_callback()  (incorrectly overwritten)   |
                   |- smc->clcsk_error_report() ------------------|
      
      So this patch fixes the issue by saving these function pointers only
      once in the fallback and avoiding overwriting.
      
      Reported-by: syzbot+4de3c0e8a263e1e499bc@syzkaller.appspotmail.com
      Fixes: 341adeec ("net/smc: Forward wakeup to smc socket waitqueue after fallback")
      Link: https://lore.kernel.org/r/0000000000006d045e05d78776f6@google.comSigned-off-by: default avatarWen Gu <guwen@linux.alibaba.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1de9770d
    • Linus Torvalds's avatar
      Merge tag 'net-5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · f1baf68e
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Including fixes from netfilter and can.
      
      Current release - new code bugs:
      
         - sparx5: fix get_stat64 out-of-bound access and crash
      
         - smc: fix netdev ref tracker misuse
      
        Previous releases - regressions:
      
         - eth: ixgbevf: require large buffers for build_skb on 82599VF, avoid
           overflows
      
         - eth: ocelot: fix all IP traffic getting trapped to CPU with PTP
           over IP
      
         - bonding: fix rare link activation misses in 802.3ad mode
      
        Previous releases - always broken:
      
         - tcp: fix tcp sock mem accounting in zero-copy corner cases
      
         - remove the cached dst when uncloning an skb dst and its metadata,
           since we only have one ref it'd lead to an UaF
      
         - netfilter:
            - conntrack: don't refresh sctp entries in closed state
            - conntrack: re-init state for retransmitted syn-ack, avoid
              connection establishment getting stuck with strange stacks
            - ctnetlink: disable helper autoassign, avoid it getting lost
            - nft_payload: don't allow transport header access for fragments
      
         - dsa: fix use of devres for mdio throughout drivers
      
         - eth: amd-xgbe: disable interrupts during pci removal
      
         - eth: dpaa2-eth: unregister netdev before disconnecting the PHY
      
         - eth: ice: fix IPIP and SIT TSO offload"
      
      * tag 'net-5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (53 commits)
        net: dsa: mv88e6xxx: fix use-after-free in mv88e6xxx_mdios_unregister
        net: mscc: ocelot: fix mutex lock error during ethtool stats read
        ice: Avoid RTNL lock when re-creating auxiliary device
        ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler
        ice: fix IPIP and SIT TSO offload
        ice: fix an error code in ice_cfg_phy_fec()
        net: mpls: Fix GCC 12 warning
        dpaa2-eth: unregister the netdev before disconnecting from the PHY
        skbuff: cleanup double word in comment
        net: macb: Align the dma and coherent dma masks
        mptcp: netlink: process IPv6 addrs in creating listening sockets
        selftests: mptcp: add missing join check
        net: usb: qmi_wwan: Add support for Dell DW5829e
        vlan: move dev_put into vlan_dev_uninit
        vlan: introduce vlan_dev_free_egress_priority
        ax25: fix UAF bugs of net_device caused by rebinding operation
        net: dsa: fix panic when DSA master device unbinds on shutdown
        net: amd-xgbe: disable interrupts during pci removal
        tipc: rate limit warning for received illegal binding update
        net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE
        ...
      f1baf68e
  6. 10 Feb, 2022 5 commits