1. 18 Apr, 2024 20 commits
    • Linus Torvalds's avatar
      Merge tag 'net-6.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 7586c850
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "A little calmer than usual, probably just the timing of sub-tree PRs.
      
        Including fixes from netfilter.
      
        Current release - regressions:
      
         - inet: bring NLM_DONE out to a separate recv() again, fix user space
           which assumes multiple recv()s will happen and gets blocked forever
      
         - drv: mlx5:
             - restore mistakenly dropped parts in register devlink flow
             - use channel mdev reference instead of global mdev instance for
               coalescing
             - acquire RTNL lock before RQs/SQs activation/deactivation
      
        Previous releases - regressions:
      
         - net: change maximum number of UDP segments to 128, fix virtio
           compatibility with Windows peers
      
         - usb: ax88179_178a: avoid writing the mac address before first
           reading
      
        Previous releases - always broken:
      
         - sched: fix mirred deadlock on device recursion
      
         - netfilter:
             - br_netfilter: skip conntrack input hook for promisc packets
             - fixes removal of duplicate elements in the pipapo set backend
             - various fixes for abort paths and error handling
      
         - af_unix: don't peek OOB data without MSG_OOB
      
         - drv: flower: fix fragment flags handling in multiple drivers
      
         - drv: ravb: fix jumbo frames and packet stats accounting
      
        Misc:
      
         - kselftest_harness: fix Clang warning about zero-length format
      
         - tun: limit printing rate when illegal packet received by tun dev"
      
      * tag 'net-6.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (46 commits)
        net: ethernet: ti: am65-cpsw-nuss: cleanup DMA Channels before using them
        net: usb: ax88179_178a: avoid writing the mac address before first reading
        net: ravb: Fix RX byte accounting for jumbo packets
        net: ravb: Fix GbEth jumbo packet RX checksum handling
        net: ravb: Allow RX loop to move past DMA mapping errors
        net: ravb: Count packets instead of descriptors in R-Car RX path
        net: ethernet: mtk_eth_soc: fix WED + wifi reset
        net:usb:qmi_wwan: support Rolling modules
        selftests: kselftest_harness: fix Clang warning about zero-length format
        net/sched: Fix mirred deadlock on device recursion
        netfilter: nf_tables: fix memleak in map from abort path
        netfilter: nf_tables: restore set elements when delete set fails
        netfilter: nf_tables: missing iterator type in lookup walk
        s390/ism: Properly fix receive message buffer allocation
        net: dsa: mt7530: fix port mirroring for MT7988 SoC switch
        net: dsa: mt7530: fix mirroring frames received on local port
        tun: limit printing rate when illegal packet received by tun dev
        ice: Fix checking for unsupported keys on non-tunnel device
        ice: tc: allow zero flags in parsing tc flower
        ice: tc: check src_vsi in case of traffic from VF
        ...
      7586c850
    • Linus Torvalds's avatar
      Merge tag 'gpio-fixes-for-v6.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux · 360a348f
      Linus Torvalds authored
      Pull gpio fixes from Bartosz Golaszewski:
      
       - use -ENOTSUPP consistently in Intel GPIO drivers
      
       - don't include dt-bindings headers in gpio-swnode code
      
       - add missing of device table to gpio-lpc32xx and fix autoloading
      
      * tag 'gpio-fixes-for-v6.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
        gpiolib: swnode: Remove wrong header inclusion
        gpio: lpc32xx: fix module autoloading
        gpio: crystalcove: Use -ENOTSUPP consistently
        gpio: wcove: Use -ENOTSUPP consistently
      360a348f
    • Siddharth Vadapalli's avatar
      net: ethernet: ti: am65-cpsw-nuss: cleanup DMA Channels before using them · c24cd679
      Siddharth Vadapalli authored
      The TX and RX DMA Channels used by the driver to exchange data with CPSW
      are not guaranteed to be in a clean state during driver initialization.
      The Bootloader could have used the same DMA Channels without cleaning them
      up in the event of failure. Thus, reset and disable the DMA Channels to
      ensure that they are in a clean state before using them.
      
      Fixes: 93a76530 ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver")
      Reported-by: default avatarSchuyler Patton <spatton@ti.com>
      Signed-off-by: default avatarSiddharth Vadapalli <s-vadapalli@ti.com>
      Reviewed-by: default avatarRoger Quadros <rogerq@kernel.org>
      Link: https://lore.kernel.org/r/20240417095425.2253876-1-s-vadapalli@ti.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      c24cd679
    • Jose Ignacio Tornos Martinez's avatar
      net: usb: ax88179_178a: avoid writing the mac address before first reading · 56f78615
      Jose Ignacio Tornos Martinez authored
      After the commit d2689b6a ("net: usb: ax88179_178a: avoid two
      consecutive device resets"), reset operation, in which the default mac
      address from the device is read, is not executed from bind operation and
      the random address, that is pregenerated just in case, is direclty written
      the first time in the device, so the default one from the device is not
      even read. This writing is not dangerous because is volatile and the
      default mac address is not missed.
      
      In order to avoid this and keep the simplification to have only one
      reset and reduce the delays, restore the reset from bind operation and
      remove the reset that is commanded from open operation. The behavior is
      the same but everything is ready for usbnet_probe.
      
      Tested with ASIX AX88179 USB Gigabit Ethernet devices.
      Restore the old behavior for the rest of possible devices because I don't
      have the hardware to test.
      
      cc: stable@vger.kernel.org # 6.6+
      Fixes: d2689b6a ("net: usb: ax88179_178a: avoid two consecutive device resets")
      Reported-by: default avatarJarkko Palviainen <jarkko.palviainen@gmail.com>
      Signed-off-by: default avatarJose Ignacio Tornos Martinez <jtornosm@redhat.com>
      Link: https://lore.kernel.org/r/20240417085524.219532-1-jtornosm@redhat.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      56f78615
    • Linus Torvalds's avatar
      Merge tag 'random-6.9-rc5-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random · e4add020
      Linus Torvalds authored
      Pull random number generator fixes from Jason Donenfeld:
      
       - The input subsystem contributes entropy in some places where a
         spinlock is held, but the entropy accounting code only handled
         callers being in an interrupt or non-atomic process context, but not
         atomic process context. We fix this by removing an optimization and
         just calling queue_work() unconditionally.
      
       - Greg accidently sent up a patch not intended for his tree and that
         had been nack'd, so that's now reverted.
      
      * tag 'random-6.9-rc5-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random:
        Revert "vmgenid: emit uevent when VMGENID updates"
        random: handle creditable entropy from atomic process context
      e4add020
    • Linus Torvalds's avatar
      Merge tag 'platform-drivers-x86-v6.9-3' of... · c2d88559
      Linus Torvalds authored
      Merge tag 'platform-drivers-x86-v6.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
      
      Pull x86 platform driver fixes from Ilpo Järvinen:
      
       - amd/pmf: Add SPS notifications quirk (+ quirk support)
      
       - amd/pmf: Lower Smart PC check message severity
      
       - x86/ISST: New HW support
      
       - x86/intel-uncore-freq: Bump minor version to avoid "unsupported" message
      
       - amd/pmc: New BIOS version still needs Spurious IRQ1 quirk
      
      * tag 'platform-drivers-x86-v6.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
        platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes
        platform/x86/intel-uncore-freq: Increase minor number support
        platform/x86: ISST: Add Granite Rapids-D to HPM CPU list
        platform/x86/amd: pmf: Add quirk for ROG Zephyrus G14
        platform/x86/amd: pmf: Add infrastructure for quirking supported funcs
        platform/x86/amd: pmf: Decrease error message to debug
      c2d88559
    • Jason A. Donenfeld's avatar
      Revert "vmgenid: emit uevent when VMGENID updates" · 3aadf100
      Jason A. Donenfeld authored
      This reverts commit ad6bcdad. I had
      nak'd it, and Greg said on the thread that it links that he wasn't going
      to take it either, especially since it's not his code or his tree, but
      then, seemingly accidentally, it got pushed up some months later, in
      what looks like a mistake, with no further discussion in the linked
      thread. So revert it, since it's clearly not intended.
      
      Fixes: ad6bcdad ("vmgenid: emit uevent when VMGENID updates")
      Cc: stable@vger.kernel.org
      Acked-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Link: https://lore.kernel.org/r/20230531095119.11202-2-bchalios@amazon.esSigned-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
      3aadf100
    • Paolo Abeni's avatar
      Merge tag 'nf-24-04-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf · ac1a21db
      Paolo Abeni authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for net:
      
      Patch #1 amends a missing spot where the set iterator type is unset.
      	 This is fixing a issue in the previous pull request.
      
      Patch #2 fixes the delete set command abort path by restoring state
               of the elements. Reverse logic for the activate (abort) case
      	 otherwise element state is not restored, this requires to move
      	 the check for active/inactive elements to the set iterator
      	 callback. From the deactivate path, toggle the next generation
      	 bit and from the activate (abort) path, clear the next generation
      	 bitmask.
      
      Patch #3 skips elements already restored by delete set command from the
      	 abort path in case there is a previous delete element command in
      	 the batch. Check for the next generation bit just like it is done
      	 via set iteration to restore maps.
      
      netfilter pull request 24-04-18
      
      * tag 'nf-24-04-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
        netfilter: nf_tables: fix memleak in map from abort path
        netfilter: nf_tables: restore set elements when delete set fails
        netfilter: nf_tables: missing iterator type in lookup walk
      ====================
      
      Link: https://lore.kernel.org/r/20240418010948.3332346-1-pablo@netfilter.orgSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      ac1a21db
    • Paolo Abeni's avatar
      Merge branch 'ravb-ethernet-driver-bugfixes' · d10a7f55
      Paolo Abeni authored
      Paul Barker says:
      
      ====================
      ravb Ethernet driver bugfixes
      
      These patches fix bugs found during recent work on the ravb driver.
      
      Patches 1 & 2 affect the R-Car code paths so have been tested on an
      R-Car M3N Salvator-XS board - this is the only R-Car board I currently
      have access to.
      
      Patches 2, 3 & 4 affect the GbEth code paths so have been tested on
      RZ/G2L and RZ/G2UL SMARC EVK boards.
      
      Changes v2->v3:
        * Incorporate feedback from Niklas and add Reviewed-by tag to patch
          "net: ravb: Count packets instead of descriptors in R-Car RX path".
      Changes v1->v2:
        * Fixed typos in commit message of patch
          "net: ravb: Allow RX loop to move past DMA mapping errors".
        * Added Sergey's Reviewed-by tags.
        * Expanded Cc list as Patchwork complained that I had missed people.
        * Trimmed the call trace in accordance with the docs [1] in patch
          "net: ravb: Fix GbEth jumbo packet RX checksum handling".
      
      [1]: https://docs.kernel.org/process/submitting-patches.html#backtraces-in-commit-messages
      ====================
      
      Link: https://lore.kernel.org/r/20240416120254.2620-1-paul.barker.ct@bp.renesas.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      d10a7f55
    • Paul Barker's avatar
      net: ravb: Fix RX byte accounting for jumbo packets · 2e36c9fb
      Paul Barker authored
      The RX byte accounting for jumbo packets was changed to fix a potential
      use-after-free bug. However, that fix used the wrong variable and so
      only accounted for the number of bytes in the final descriptor, not the
      number of bytes in the whole packet.
      
      To fix this, we can simply update our stats with the correct number of
      bytes before calling napi_gro_receive().
      
      Also rename pkt_len to desc_len in ravb_rx_gbeth() to avoid any future
      confusion. The variable name pkt_len is correct in ravb_rx_rcar() as
      that function does not handle packets spanning multiple descriptors.
      
      Fixes: 5a5a3e56 ("ravb: Fix potential use-after-free in ravb_rx_gbeth()")
      Signed-off-by: default avatarPaul Barker <paul.barker.ct@bp.renesas.com>
      Reviewed-by: default avatarSergey Shtylyov <s.shtylyov@omp.ru>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      2e36c9fb
    • Paul Barker's avatar
      net: ravb: Fix GbEth jumbo packet RX checksum handling · c7c44950
      Paul Barker authored
      Sending a 7kB ping packet to the RZ/G2L in v6.9-rc2 causes the following
      backtrace:
      
      	WARNING: CPU: 0 PID: 0 at include/linux/skbuff.h:3127 skb_trim+0x30/0x38
      	Hardware name: Renesas SMARC EVK based on r9a07g044l2 (DT)
      	pc : skb_trim+0x30/0x38
      	lr : ravb_rx_csum_gbeth+0x40/0x90
      	Call trace:
      	 skb_trim+0x30/0x38
      	 ravb_rx_gbeth+0x56c/0x5cc
      	 ravb_poll+0xa0/0x204
      	 __napi_poll+0x38/0x17c
      
      This is caused by ravb_rx_gbeth() calling ravb_rx_csum_gbeth() with the
      wrong skb for a packet which spans multiple descriptors. To fix this,
      use the correct skb.
      
      Fixes: c2da9408 ("ravb: Add Rx checksum offload support for GbEth")
      Signed-off-by: default avatarPaul Barker <paul.barker.ct@bp.renesas.com>
      Reviewed-by: default avatarSergey Shtylyov <s.shtylyov@omp.ru>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      c7c44950
    • Paul Barker's avatar
      net: ravb: Allow RX loop to move past DMA mapping errors · a892493a
      Paul Barker authored
      The RX loops in ravb_rx_gbeth() and ravb_rx_rcar() skip to the next loop
      iteration if a zero-length descriptor is seen (indicating a DMA mapping
      error). However, the current RX descriptor index `priv->cur_rx[q]` was
      incremented at the end of the loop and so would not be incremented when
      we skip to the next loop iteration. This would cause the loop to keep
      seeing the same zero-length descriptor instead of moving on to the next
      descriptor.
      
      As the loop counter `i` still increments, the loop would eventually
      terminate so there is no risk of being stuck here forever - but we
      should still fix this to avoid wasting cycles.
      
      To fix this, the RX descriptor index is incremented at the top of the
      loop, in the for statement itself. The assignments of `entry` and `desc`
      are brought into the loop to avoid the need for duplication.
      
      Fixes: d8b48911 ("ravb: fix ring memory allocation")
      Signed-off-by: default avatarPaul Barker <paul.barker.ct@bp.renesas.com>
      Reviewed-by: default avatarSergey Shtylyov <s.shtylyov@omp.ru>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      a892493a
    • Paul Barker's avatar
      net: ravb: Count packets instead of descriptors in R-Car RX path · def52db4
      Paul Barker authored
      The units of "work done" in the RX path should be packets instead of
      descriptors.
      
      Descriptors which are used by the hardware to record error conditions or
      are empty in the case of a DMA mapping error should not count towards
      our RX work budget.
      
      Also make the limit variable unsigned as it can never be negative.
      
      Fixes: c156633f ("Renesas Ethernet AVB driver proper")
      Signed-off-by: default avatarPaul Barker <paul.barker.ct@bp.renesas.com>
      Reviewed-by: default avatarSergey Shtylyov <s.shtylyov@omp.ru>
      Reviewed-by: default avatarNiklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      def52db4
    • Felix Fietkau's avatar
      net: ethernet: mtk_eth_soc: fix WED + wifi reset · 94667949
      Felix Fietkau authored
      The WLAN + WED reset sequence relies on being able to receive interrupts from
      the card, in order to synchronize individual steps with the firmware.
      When WED is stopped, leave interrupts running and rely on the driver turning
      off unwanted ones.
      WED DMA also needs to be disabled before resetting.
      
      Fixes: f78cd9c7 ("net: ethernet: mtk_wed: update mtk_wed_stop")
      Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
      Link: https://lore.kernel.org/r/20240416082330.82564-1-nbd@nbd.nameSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      94667949
    • Vanillan Wang's avatar
      net:usb:qmi_wwan: support Rolling modules · d3620460
      Vanillan Wang authored
      Update the qmi_wwan driver support for the Rolling
      LTE modules.
      
      - VID:PID 33f8:0104, RW101-GL for laptop debug M.2 cards(with RMNET
      interface for /Linux/Chrome OS)
      0x0104: RMNET, diag, at, pipe
      
      Here are the outputs of usb-devices:
      T:  Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=5000 MxCh= 0
      D:  Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
      P:  Vendor=33f8 ProdID=0104 Rev=05.04
      S:  Manufacturer=Rolling Wireless S.a.r.l.
      S:  Product=Rolling Module
      S:  SerialNumber=ba2eb033
      C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA
      I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
      E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
      E:  Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
      E:  Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=85(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
      E:  Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=87(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      I:  If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
      E:  Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=88(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
      E:  Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      I:  If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs
      E:  Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=89(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      Signed-off-by: default avatarVanillan Wang <vanillanwang@163.com>
      Link: https://lore.kernel.org/r/20240416120713.24777-1-vanillanwang@163.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      d3620460
    • Jakub Kicinski's avatar
      Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue · e59b4954
      Jakub Kicinski authored
      Tony Nguyen says:
      
      ====================
      Intel Wired LAN Driver Updates 2024-04-16 (ice)
      
      This series contains updates to ice driver only.
      
      Michal fixes a couple of issues with TC filter parsing; always add match
      for src_vsi and remove flag check that could prevent addition of valid
      filters.
      
      Marcin adds additional checks for unsupported flower filters.
      
      * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:
        ice: Fix checking for unsupported keys on non-tunnel device
        ice: tc: allow zero flags in parsing tc flower
        ice: tc: check src_vsi in case of traffic from VF
      ====================
      
      Link: https://lore.kernel.org/r/20240416202409.2008383-1-anthony.l.nguyen@intel.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      e59b4954
    • Jakub Kicinski's avatar
      selftests: kselftest_harness: fix Clang warning about zero-length format · caed8eba
      Jakub Kicinski authored
      Apparently it's more legal to pass the format as NULL, than
      it is to use an empty string. Clang complains about empty
      formats:
      
      ./../kselftest_harness.h:1207:30: warning: format string is empty
      [-Wformat-zero-length]
       1207 |            diagnostic ? "%s" : "", diagnostic);
            |                                 ^~
      1 warning generated.
      Reported-by: default avatarSean Christopherson <seanjc@google.com>
      Link: https://lore.kernel.org/all/20240409224256.1581292-1-seanjc@google.com
      Fixes: 378193ef ("selftests: kselftest_harness: let PASS / FAIL provide diagnostic")
      Tested-by: default avatarSean Christopherson <seanjc@google.com>
      Reviewed-by: default avatarMuhammad Usama Anjum <usama.anjum@collabora.com>
      Link: https://lore.kernel.org/r/20240416151048.1682352-1-kuba@kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      caed8eba
    • Linus Torvalds's avatar
      Merge tag 'for-6.9-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 8cd26fd9
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
      
       - fixup in zoned mode for out-of-order writes of metadata that are no
         longer necessary, this used to be tracked in a separate list but now
         the old locaion needs to be zeroed out, also add assertions
      
       - fix bulk page allocation retry, this may stall after first failure
         for compression read/write
      
      * tag 'for-6.9-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: do not wait for short bulk allocation
        btrfs: zoned: add ASSERT and WARN for EXTENT_BUFFER_ZONED_ZEROOUT handling
        btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer
      8cd26fd9
    • Eric Dumazet's avatar
      net/sched: Fix mirred deadlock on device recursion · 0f022d32
      Eric Dumazet authored
      When the mirred action is used on a classful egress qdisc and a packet is
      mirrored or redirected to self we hit a qdisc lock deadlock.
      See trace below.
      
      [..... other info removed for brevity....]
      [   82.890906]
      [   82.890906] ============================================
      [   82.890906] WARNING: possible recursive locking detected
      [   82.890906] 6.8.0-05205-g77fadd89fe2d-dirty #213 Tainted: G        W
      [   82.890906] --------------------------------------------
      [   82.890906] ping/418 is trying to acquire lock:
      [   82.890906] ffff888006994110 (&sch->q.lock){+.-.}-{3:3}, at:
      __dev_queue_xmit+0x1778/0x3550
      [   82.890906]
      [   82.890906] but task is already holding lock:
      [   82.890906] ffff888006994110 (&sch->q.lock){+.-.}-{3:3}, at:
      __dev_queue_xmit+0x1778/0x3550
      [   82.890906]
      [   82.890906] other info that might help us debug this:
      [   82.890906]  Possible unsafe locking scenario:
      [   82.890906]
      [   82.890906]        CPU0
      [   82.890906]        ----
      [   82.890906]   lock(&sch->q.lock);
      [   82.890906]   lock(&sch->q.lock);
      [   82.890906]
      [   82.890906]  *** DEADLOCK ***
      [   82.890906]
      [..... other info removed for brevity....]
      
      Example setup (eth0->eth0) to recreate
      tc qdisc add dev eth0 root handle 1: htb default 30
      tc filter add dev eth0 handle 1: protocol ip prio 2 matchall \
           action mirred egress redirect dev eth0
      
      Another example(eth0->eth1->eth0) to recreate
      tc qdisc add dev eth0 root handle 1: htb default 30
      tc filter add dev eth0 handle 1: protocol ip prio 2 matchall \
           action mirred egress redirect dev eth1
      
      tc qdisc add dev eth1 root handle 1: htb default 30
      tc filter add dev eth1 handle 1: protocol ip prio 2 matchall \
           action mirred egress redirect dev eth0
      
      We fix this by adding an owner field (CPU id) to struct Qdisc set after
      root qdisc is entered. When the softirq enters it a second time, if the
      qdisc owner is the same CPU, the packet is dropped to break the loop.
      Reported-by: default avatarMingshuai Ren <renmingshuai@huawei.com>
      Closes: https://lore.kernel.org/netdev/20240314111713.5979-1-renmingshuai@huawei.com/
      Fixes: 3bcb846c ("net: get rid of spin_trylock() in net_tx_action()")
      Fixes: e578d9c0 ("net: sched: use counter to break reclassify loops")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reviewed-by: default avatarVictor Nogueira <victor@mojatatu.com>
      Reviewed-by: default avatarPedro Tammela <pctammela@mojatatu.com>
      Tested-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Link: https://lore.kernel.org/r/20240415210728.36949-1-victor@mojatatu.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      0f022d32
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: fix memleak in map from abort path · 86a1471d
      Pablo Neira Ayuso authored
      The delete set command does not rely on the transaction object for
      element removal, therefore, a combination of delete element + delete set
      from the abort path could result in restoring twice the refcount of the
      mapping.
      
      Check for inactive element in the next generation for the delete element
      command in the abort path, skip restoring state if next generation bit
      has been already cleared. This is similar to the activate logic using
      the set walk iterator.
      
      [ 6170.286929] ------------[ cut here ]------------
      [ 6170.286939] WARNING: CPU: 6 PID: 790302 at net/netfilter/nf_tables_api.c:2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]
      [ 6170.287071] Modules linked in: [...]
      [ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 Not tainted 6.9.0-rc3+ #365
      [ 6170.287768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]
      [ 6170.287886] Code: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b df 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 <0f> 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 0f
      [ 6170.287895] RSP: 0018:ffff888134b8fd08 EFLAGS: 00010202
      [ 6170.287904] RAX: 0000000000000001 RBX: ffff888125bffb28 RCX: dffffc0000000000
      [ 6170.287912] RDX: 0000000000000003 RSI: ffffffffa20298ab RDI: ffff88811ebe4750
      [ 6170.287919] RBP: ffff88811ebe4700 R08: ffff88838e812650 R09: fffffbfff0623a55
      [ 6170.287926] R10: ffffffff8311d2af R11: 0000000000000001 R12: ffff888125bffb10
      [ 6170.287933] R13: ffff888125bffb10 R14: dead000000000122 R15: dead000000000100
      [ 6170.287940] FS:  0000000000000000(0000) GS:ffff888390b00000(0000) knlGS:0000000000000000
      [ 6170.287948] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 6170.287955] CR2: 00007fd31fc00710 CR3: 0000000133f60004 CR4: 00000000001706f0
      [ 6170.287962] Call Trace:
      [ 6170.287967]  <TASK>
      [ 6170.287973]  ? __warn+0x9f/0x1a0
      [ 6170.287986]  ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]
      [ 6170.288092]  ? report_bug+0x1b1/0x1e0
      [ 6170.287986]  ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]
      [ 6170.288092]  ? report_bug+0x1b1/0x1e0
      [ 6170.288104]  ? handle_bug+0x3c/0x70
      [ 6170.288112]  ? exc_invalid_op+0x17/0x40
      [ 6170.288120]  ? asm_exc_invalid_op+0x1a/0x20
      [ 6170.288132]  ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables]
      [ 6170.288243]  ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]
      [ 6170.288366]  ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables]
      [ 6170.288483]  nf_tables_trans_destroy_work+0x588/0x590 [nf_tables]
      
      Fixes: 59105446 ("netfilter: nf_tables: revisit chain/object refcounting from elements")
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      86a1471d
  2. 17 Apr, 2024 11 commits
    • Andy Shevchenko's avatar
      gpiolib: swnode: Remove wrong header inclusion · 69ffed4b
      Andy Shevchenko authored
      The flags in the software node properties are supposed to be
      the GPIO lookup flags, which are provided by gpio/machine.h,
      as the software nodes are the kernel internal thing and doesn't
      need to rely to any of ABIs.
      
      Fixes: e7f9ff5d ("gpiolib: add support for software nodes")
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Signed-off-by: default avatarBartosz Golaszewski <bartosz.golaszewski@linaro.org>
      69ffed4b
    • Linus Torvalds's avatar
      Merge tag 'pwm/for-6.9-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux · 4b6b5132
      Linus Torvalds authored
      Pull pwm fixes from Uwe Kleine-König:
       "The first patch fixes a regression in the suspend/resume path for the
        dwc pwm driver that was introduced in v6.9-rc1 when support for 16
        channel devices was added.
      
        The second patch fixes a bunch of device tree binding check warnings"
      
      * tag 'pwm/for-6.9-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
        dt-bindings: pwm: mediatek,pwm-disp: Document power-domains property
        pwm: dwc: allow suspend/resume for 16 channels
      4b6b5132
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: restore set elements when delete set fails · e79b47a8
      Pablo Neira Ayuso authored
      From abort path, nft_mapelem_activate() needs to restore refcounters to
      the original state. Currently, it uses the set->ops->walk() to iterate
      over these set elements. The existing set iterator skips inactive
      elements in the next generation, this does not work from the abort path
      to restore the original state since it has to skip active elements
      instead (not inactive ones).
      
      This patch moves the check for inactive elements to the set iterator
      callback, then it reverses the logic for the .activate case which
      needs to skip active elements.
      
      Toggle next generation bit for elements when delete set command is
      invoked and call nft_clear() from .activate (abort) path to restore the
      next generation bit.
      
      The splat below shows an object in mappings memleak:
      
      [43929.457523] ------------[ cut here ]------------
      [43929.457532] WARNING: CPU: 0 PID: 1139 at include/net/netfilter/nf_tables.h:1237 nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]
      [...]
      [43929.458014] RIP: 0010:nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]
      [43929.458076] Code: 83 f8 01 77 ab 49 8d 7c 24 08 e8 37 5e d0 de 49 8b 6c 24 08 48 8d 7d 50 e8 e9 5c d0 de 8b 45 50 8d 50 ff 89 55 50 85 c0 75 86 <0f> 0b eb 82 0f 0b eb b3 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90
      [43929.458081] RSP: 0018:ffff888140f9f4b0 EFLAGS: 00010246
      [43929.458086] RAX: 0000000000000000 RBX: ffff8881434f5288 RCX: dffffc0000000000
      [43929.458090] RDX: 00000000ffffffff RSI: ffffffffa26d28a7 RDI: ffff88810ecc9550
      [43929.458093] RBP: ffff88810ecc9500 R08: 0000000000000001 R09: ffffed10281f3e8f
      [43929.458096] R10: 0000000000000003 R11: ffff0000ffff0000 R12: ffff8881434f52a0
      [43929.458100] R13: ffff888140f9f5f4 R14: ffff888151c7a800 R15: 0000000000000002
      [43929.458103] FS:  00007f0c687c4740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000
      [43929.458107] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [43929.458111] CR2: 00007f58dbe5b008 CR3: 0000000123602005 CR4: 00000000001706f0
      [43929.458114] Call Trace:
      [43929.458118]  <TASK>
      [43929.458121]  ? __warn+0x9f/0x1a0
      [43929.458127]  ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]
      [43929.458188]  ? report_bug+0x1b1/0x1e0
      [43929.458196]  ? handle_bug+0x3c/0x70
      [43929.458200]  ? exc_invalid_op+0x17/0x40
      [43929.458211]  ? nft_setelem_data_deactivate+0xd7/0xf0 [nf_tables]
      [43929.458271]  ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]
      [43929.458332]  nft_mapelem_deactivate+0x24/0x30 [nf_tables]
      [43929.458392]  nft_rhash_walk+0xdd/0x180 [nf_tables]
      [43929.458453]  ? __pfx_nft_rhash_walk+0x10/0x10 [nf_tables]
      [43929.458512]  ? rb_insert_color+0x2e/0x280
      [43929.458520]  nft_map_deactivate+0xdc/0x1e0 [nf_tables]
      [43929.458582]  ? __pfx_nft_map_deactivate+0x10/0x10 [nf_tables]
      [43929.458642]  ? __pfx_nft_mapelem_deactivate+0x10/0x10 [nf_tables]
      [43929.458701]  ? __rcu_read_unlock+0x46/0x70
      [43929.458709]  nft_delset+0xff/0x110 [nf_tables]
      [43929.458769]  nft_flush_table+0x16f/0x460 [nf_tables]
      [43929.458830]  nf_tables_deltable+0x501/0x580 [nf_tables]
      
      Fixes: 628bd3e4 ("netfilter: nf_tables: drop map element references from preparation phase")
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      e79b47a8
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: missing iterator type in lookup walk · efefd4f0
      Pablo Neira Ayuso authored
      Add missing decorator type to lookup expression and tighten WARN_ON_ONCE
      check in pipapo to spot earlier that this is unset.
      
      Fixes: 29b359cf ("netfilter: nft_set_pipapo: walk over current view on netlink dump")
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      efefd4f0
    • Mario Limonciello's avatar
      platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes · f609e7b1
      Mario Limonciello authored
      BIOS 03.05 still hasn't fixed the spurious IRQ1 issue.  As it's still
      being worked on there is still a possibility that it won't need to
      apply to future BIOS releases.
      
      Add a quirk for BIOS 03.05 as well.
      Signed-off-by: default avatarMario Limonciello <mario.limonciello@amd.com>
      Reviewed-by: default avatarHans de Goede <hdegoede@redhat.com>
      Link: https://lore.kernel.org/r/20240410141046.433-1-mario.limonciello@amd.comReviewed-by: default avatarIlpo Järvinen <ilpo.jarvinen@linux.intel.com>
      Signed-off-by: default avatarIlpo Järvinen <ilpo.jarvinen@linux.intel.com>
      f609e7b1
    • Gerd Bayer's avatar
      s390/ism: Properly fix receive message buffer allocation · 83781384
      Gerd Bayer authored
      Since [1], dma_alloc_coherent() does not accept requests for GFP_COMP
      anymore, even on archs that may be able to fulfill this. Functionality that
      relied on the receive buffer being a compound page broke at that point:
      The SMC-D protocol, that utilizes the ism device driver, passes receive
      buffers to the splice processor in a struct splice_pipe_desc with a
      single entry list of struct pages. As the buffer is no longer a compound
      page, the splice processor now rejects requests to handle more than a
      page worth of data.
      
      Replace dma_alloc_coherent() and allocate a buffer with folio_alloc and
      create a DMA map for it with dma_map_page(). Since only receive buffers
      on ISM devices use DMA, qualify the mapping as FROM_DEVICE.
      Since ISM devices are available on arch s390, only, and on that arch all
      DMA is coherent, there is no need to introduce and export some kind of
      dma_sync_to_cpu() method to be called by the SMC-D protocol layer.
      
      Analogously, replace dma_free_coherent by a two step dma_unmap_page,
      then folio_put to free the receive buffer.
      
      [1] https://lore.kernel.org/all/20221113163535.884299-1-hch@lst.de/
      
      Fixes: c08004ee ("s390/ism: don't pass bogus GFP_ flags to dma_alloc_coherent")
      Signed-off-by: default avatarGerd Bayer <gbayer@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      83781384
    • Jason A. Donenfeld's avatar
      random: handle creditable entropy from atomic process context · e871abcd
      Jason A. Donenfeld authored
      The entropy accounting changes a static key when the RNG has
      initialized, since it only ever initializes once. Static key changes,
      however, cannot be made from atomic context, so depending on where the
      last creditable entropy comes from, the static key change might need to
      be deferred to a worker.
      
      Previously the code used the execute_in_process_context() helper
      function, which accounts for whether or not the caller is
      in_interrupt(). However, that doesn't account for the case where the
      caller is actually in process context but is holding a spinlock.
      
      This turned out to be the case with input_handle_event() in
      drivers/input/input.c contributing entropy:
      
        [<ffffffd613025ba0>] die+0xa8/0x2fc
        [<ffffffd613027428>] bug_handler+0x44/0xec
        [<ffffffd613016964>] brk_handler+0x90/0x144
        [<ffffffd613041e58>] do_debug_exception+0xa0/0x148
        [<ffffffd61400c208>] el1_dbg+0x60/0x7c
        [<ffffffd61400c000>] el1h_64_sync_handler+0x38/0x90
        [<ffffffd613011294>] el1h_64_sync+0x64/0x6c
        [<ffffffd613102d88>] __might_resched+0x1fc/0x2e8
        [<ffffffd613102b54>] __might_sleep+0x44/0x7c
        [<ffffffd6130b6eac>] cpus_read_lock+0x1c/0xec
        [<ffffffd6132c2820>] static_key_enable+0x14/0x38
        [<ffffffd61400ac08>] crng_set_ready+0x14/0x28
        [<ffffffd6130df4dc>] execute_in_process_context+0xb8/0xf8
        [<ffffffd61400ab30>] _credit_init_bits+0x118/0x1dc
        [<ffffffd6138580c8>] add_timer_randomness+0x264/0x270
        [<ffffffd613857e54>] add_input_randomness+0x38/0x48
        [<ffffffd613a80f94>] input_handle_event+0x2b8/0x490
        [<ffffffd613a81310>] input_event+0x6c/0x98
      
      According to Guoyong, it's not really possible to refactor the various
      drivers to never hold a spinlock there. And in_atomic() isn't reliable.
      
      So, rather than trying to be too fancy, just punt the change in the
      static key to a workqueue always. There's basically no drawback of doing
      this, as the code already needed to account for the static key not
      changing immediately, and given that it's just an optimization, there's
      not exactly a hurry to change the static key right away, so deferal is
      fine.
      Reported-by: default avatarGuoyong Wang <guoyong.wang@mediatek.com>
      Cc: stable@vger.kernel.org
      Fixes: f5bda35f ("random: use static branch for crng_ready()")
      Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
      e871abcd
    • David S. Miller's avatar
      Merge branch 'mt7530-fixes' · cb178ccb
      David S. Miller authored
      Merge branch 'mr7530-fixes'
      
      Arınç ÜNAL says:
      
      ====================
      Fix port mirroring on MT7530 DSA subdriver
      
      This patch series fixes the frames received on the local port (monitor
      port) not being mirrored, and port mirroring for the MT7988 SoC switch.
      ====================
      Signed-off-by: default avatarArınç ÜNAL <arinc.unal@arinc9.com>
      cb178ccb
    • Arınç ÜNAL's avatar
      net: dsa: mt7530: fix port mirroring for MT7988 SoC switch · 2c606d13
      Arınç ÜNAL authored
      The "MT7988A Wi-Fi 7 Generation Router Platform: Datasheet (Open Version)
      v0.1" document shows bits 16 to 18 as the MIRROR_PORT field of the CPU
      forward control register. Currently, the MT7530 DSA subdriver configures
      bits 0 to 2 of the CPU forward control register which breaks the port
      mirroring feature for the MT7988 SoC switch.
      
      Fix this by using the MT7531_MIRROR_PORT_GET() and MT7531_MIRROR_PORT_SET()
      macros which utilise the correct bits.
      
      Fixes: 110c18bf ("net: dsa: mt7530: introduce driver for MT7988 built-in switch")
      Signed-off-by: default avatarArınç ÜNAL <arinc.unal@arinc9.com>
      Acked-by: default avatarDaniel Golle <daniel@makrotopia.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2c606d13
    • Arınç ÜNAL's avatar
      net: dsa: mt7530: fix mirroring frames received on local port · d59cf049
      Arınç ÜNAL authored
      This switch intellectual property provides a bit on the ARL global control
      register which controls allowing mirroring frames which are received on the
      local port (monitor port). This bit is unset after reset.
      
      This ability must be enabled to fully support the port mirroring feature on
      this switch intellectual property.
      
      Therefore, this patch fixes the traffic not being reflected on a port,
      which would be configured like below:
      
        tc qdisc add dev swp0 clsact
      
        tc filter add dev swp0 ingress matchall skip_sw \
        action mirred egress mirror dev swp0
      
      As a side note, this configuration provides the hairpinning feature for a
      single port.
      
      Fixes: 37feab60 ("net: dsa: mt7530: add support for port mirroring")
      Signed-off-by: default avatarArınç ÜNAL <arinc.unal@arinc9.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d59cf049
    • Lei Chen's avatar
      tun: limit printing rate when illegal packet received by tun dev · f8bbc07a
      Lei Chen authored
      vhost_worker will call tun call backs to receive packets. If too many
      illegal packets arrives, tun_do_read will keep dumping packet contents.
      When console is enabled, it will costs much more cpu time to dump
      packet and soft lockup will be detected.
      
      net_ratelimit mechanism can be used to limit the dumping rate.
      
      PID: 33036    TASK: ffff949da6f20000  CPU: 23   COMMAND: "vhost-32980"
       #0 [fffffe00003fce50] crash_nmi_callback at ffffffff89249253
       #1 [fffffe00003fce58] nmi_handle at ffffffff89225fa3
       #2 [fffffe00003fceb0] default_do_nmi at ffffffff8922642e
       #3 [fffffe00003fced0] do_nmi at ffffffff8922660d
       #4 [fffffe00003fcef0] end_repeat_nmi at ffffffff89c01663
          [exception RIP: io_serial_in+20]
          RIP: ffffffff89792594  RSP: ffffa655314979e8  RFLAGS: 00000002
          RAX: ffffffff89792500  RBX: ffffffff8af428a0  RCX: 0000000000000000
          RDX: 00000000000003fd  RSI: 0000000000000005  RDI: ffffffff8af428a0
          RBP: 0000000000002710   R8: 0000000000000004   R9: 000000000000000f
          R10: 0000000000000000  R11: ffffffff8acbf64f  R12: 0000000000000020
          R13: ffffffff8acbf698  R14: 0000000000000058  R15: 0000000000000000
          ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
       #5 [ffffa655314979e8] io_serial_in at ffffffff89792594
       #6 [ffffa655314979e8] wait_for_xmitr at ffffffff89793470
       #7 [ffffa65531497a08] serial8250_console_putchar at ffffffff897934f6
       #8 [ffffa65531497a20] uart_console_write at ffffffff8978b605
       #9 [ffffa65531497a48] serial8250_console_write at ffffffff89796558
       #10 [ffffa65531497ac8] console_unlock at ffffffff89316124
       #11 [ffffa65531497b10] vprintk_emit at ffffffff89317c07
       #12 [ffffa65531497b68] printk at ffffffff89318306
       #13 [ffffa65531497bc8] print_hex_dump at ffffffff89650765
       #14 [ffffa65531497ca8] tun_do_read at ffffffffc0b06c27 [tun]
       #15 [ffffa65531497d38] tun_recvmsg at ffffffffc0b06e34 [tun]
       #16 [ffffa65531497d68] handle_rx at ffffffffc0c5d682 [vhost_net]
       #17 [ffffa65531497ed0] vhost_worker at ffffffffc0c644dc [vhost]
       #18 [ffffa65531497f10] kthread at ffffffff892d2e72
       #19 [ffffa65531497f50] ret_from_fork at ffffffff89c0022f
      
      Fixes: ef3db4a5 ("tun: avoid BUG, dump packet on GSO errors")
      Signed-off-by: default avatarLei Chen <lei.chen@smartx.com>
      Reviewed-by: default avatarWillem de Bruijn <willemb@google.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Link: https://lore.kernel.org/r/20240415020247.2207781-1-lei.chen@smartx.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      f8bbc07a
  3. 16 Apr, 2024 9 commits