- 27 Jun, 2019 13 commits
-
-
Maxim Mikityanskiy authored
When an XDP program returns XDP_TX, and the RQ is XSK-enabled, it requires careful handling, because convert_to_xdp_frame creates a new page and copies the data there, while our driver expects the xdp_frame to point to the same memory as the xdp_buff. Handle this case separately: map the page, and in the end unmap it and call xdp_return_frame. Signed-off-by:
Maxim Mikityanskiy <maximmi@mellanox.com> Signed-off-by:
Tariq Toukan <tariqt@mellanox.com> Acked-by:
Saeed Mahameed <saeedm@mellanox.com> Signed-off-by:
Daniel Borkmann <daniel@iogearbox.net>
-
Maxim Mikityanskiy authored
Put the XDP SQ that is used for XDP_TX into the channel. It used to be a part of the RQ, but with introduction of AF_XDP there will be one more RQ that could share the same XDP SQ. This patch is a preparation for that change. Separate XDP_TX statistics per RQ were implemented in one of the previous patches. Signed-off-by:
-
Maxim Mikityanskiy authored
Currently, struct mlx5e_xdp_info has some issues that have to be cleaned up before the upcoming AF_XDP support makes things too complicated and messy. This structure is used both when sending the packet and on completion. Moreover, the cleanup procedure on completion depends on the origin of the packet (XDP_REDIRECT, XDP_TX). Adding AF_XDP support will add new flows that use this structure even differently. To avoid overcomplicating the code, this commit refactors the usage of this structure in the following ways: 1. struct mlx5e_xdp_info is split into two different structures. One is struct mlx5e_xdp_xmit_data, a transient structure that doesn't need to be stored and is only used while sending the packet. The other is still struct mlx5e_xdp_info that is stored in a FIFO and contains the fields needed on completion. 2. The fields of struct mlx5e_xdp_info that are used in different flows are put into a union. A special enum indicates the cleanup mode and helps choose the right union member. This approach is clear and explicit. Although it could be possible to "guess" the mode by looking at the values of the fields and at the XDP SQ type, it wouldn't be that clear and extendable and would require looking through the whole chain to understand what's going on. For the reference, there are the fields of struct mlx5e_xdp_info that are used in different flows (including AF_XDP ones): Packet origin | Fields used on completion | Cleanup steps -----------------------+---------------------------+------------------ XDP_REDIRECT, | xdpf, dma_addr | DMA unmap and XDP_TX from XSK RQ | | xdp_return_frame. -----------------------+---------------------------+------------------ XDP_TX from regular RQ | di | Recycle page. -----------------------+---------------------------+------------------ AF_XDP TX | (none) | Increment the | | producer index in | | Completion Ring. On send, the same set of mlx5e_xdp_xmit_data fields is used in all flows: DMA and virtual addresses and length. Signed-off-by: -
Maxim Mikityanskiy authored
Prepare to creation of the XSK RQ, which will require posting UMRs, too. The same ICO SQ will be used for both RQs and also to trigger interrupts by posting NOPs. UMR WQEs can't be reused any more. Optimization introduced in commit ab966d7e ("net/mlx5e: RX, Recycle buffer of UMR WQEs") is reverted. Signed-off-by:
-
Maxim Mikityanskiy authored
Additional conditions introduced: - XSK implies XDP. - Headroom includes the XSK headroom if it exists. - No space is reserved for struct shared_skb_info in XSK mode. - Fragment size smaller than the XSK chunk size is not allowed. A new auxiliary function mlx5e_get_linear_rq_headroom with the support for XSK is introduced. Use this function in the implementation of mlx5e_get_rq_headroom. Change headroom to u32 to match the headroom field in struct xdp_umem. Signed-off-by:
-
Maxim Mikityanskiy authored
The PCI API for DMA is deprecated, and PCI_DMA_TODEVICE is just defined to DMA_TO_DEVICE for backward compatibility. Just use DMA_TO_DEVICE. Signed-off-by:
-
Maxim Mikityanskiy authored
Some drivers want to access the data transmitted in order to implement acceleration features of the NICs. It is also useful in AF_XDP TX flow. Change the xsk_umem_consume_tx API to return the whole xdp_desc, that contains the data pointer, length and DMA address, instead of only the latter two. Adapt the implementation of i40e and ixgbe to this change. Signed-off-by:
Björn Töpel <bjorn.topel@intel.com> Signed-off-by:
-
Maxim Mikityanskiy authored
The typical XDP memory scheme is one packet per page. Change the AF_XDP frame size in libbpf to 4096, which is the page size on x86, to allow libbpf to be used with the drivers with the packet-per-page scheme. Add a command line option -f to xdpsock to allow to specify a custom frame size. Signed-off-by:
-
Maxim Mikityanskiy authored
Query XDP_OPTIONS in libbpf to determine if the zero-copy mode is active or not. Signed-off-by:
-
Maxim Mikityanskiy authored
Make it possible for the application to determine whether the AF_XDP socket is running in zero-copy mode. To achieve this, add a new getsockopt option XDP_OPTIONS that returns flags. The only flag supported for now is the zero-copy mode indicator. Signed-off-by:
-
Maxim Mikityanskiy authored
Add a function that checks whether the Fill Ring has the specified amount of descriptors available. It will be useful for mlx5e that wants to check in advance, whether it can allocate a bulk of RX descriptors, to get the best performance. Signed-off-by:
-
Maxim Mikityanskiy authored
When an XDP program is set, a full reopen of all channels happens in two cases: 1. When there was no program set, and a new one is being set. 2. When there was a program set, but it's being unset. The full reopen is necessary, because the channel parameters may change if XDP is enabled or disabled. However, it's performed in an unsafe way: if the new channels fail to open, the old ones are already closed, and the interface goes down. Use the safe way to switch channels instead. The same way is already used for other configuration changes. Signed-off-by:
-
Roman Gushchin authored
Since commit 4bfc0bb2 ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself"), cgroup_bpf release occurs asynchronously (from a worker context), and before the release of the cgroup itself. This introduced a previously non-existing race between the release and update paths. E.g. if a leaf's cgroup_bpf is released and a new bpf program is attached to the one of ancestor cgroups at the same time. The race may result in double-free and other memory corruptions. To fix the problem, let's protect the body of cgroup_bpf_release() with cgroup_mutex, as it was effectively previously, when all this code was called from the cgroup release path with cgroup mutex held. Also let's skip cgroups, which have no chances to invoke a bpf program, on the update path. If the cgroup bpf refcnt reached 0, it means that the cgroup is offline (no attached processes), and there are no associated sockets left. It means there is no point in updating effective progs array! And it can lead to a leak, if it happens after the release. So, let's skip such cgroups. Big thanks for Tejun Heo for discovering and debugging of this problem! Fixes: 4bfc0bb2 ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself") Reported-by:
Tejun Heo <tj@kernel.org> Signed-off-by:
Roman Gushchin <guro@fb.com> Signed-off-by:
Alexei Starovoitov <ast@kernel.org> Signed-off-by:
-
- 26 Jun, 2019 5 commits
-
-
YueHaibing authored
Fix sparse warning: net/core/xdp.c:88:6: warning: symbol '__mem_id_disconnect' was not declared. Should it be static? Reported-by:
Hulk Robot <hulkci@huawei.com> Signed-off-by:
YueHaibing <yuehaibing@huawei.com> Acked-by:
Jesper Dangaard Brouer <brouer@redhat.com> Acked-by:
Song Liu <songliubraving@fb.com> Signed-off-by:
-
Daniel T. Lee authored
Currently, each xdp samples are inconsistent in the use. Most of the samples fetch the interface with it's name. (ex. xdp1, xdp2skb, xdp_redirect_cpu, xdp_sample_pkts, etc.) But some of the xdp samples are fetching the interface with ifindex by command argument. This commit enables xdp samples to fetch interface with it's name without changing the original index interface fetching. (<ifname|ifindex> fetching in the same way as xdp_sample_pkts_user.c does.) Signed-off-by:
Daniel T. Lee <danieltimlee@gmail.com> Acked-by:
Toke Høiland-Jørgensen <toke@redhat.com> Acked-by:
-
Yonghong Song authored
With CONFIG_MODULES=n, the following compiler warning occurs: /data/users/yhs/work/net-next/kernel/trace/bpf_trace.c:605:13: warning: ‘do_bpf_send_signal’ defined but not used [-Wunused-function] static void do_bpf_send_signal(struct irq_work *entry) The __init function send_signal_irq_work_init(), which calls do_bpf_send_signal(), is defined under CONFIG_MODULES. Hence, when CONFIG_MODULES=n, nobody calls static function do_bpf_send_signal(), hence the warning. The init function send_signal_irq_work_init() should work without CONFIG_MODULES. Moving it out of CONFIG_MODULES code section fixed the compiler warning, and also make bpf_send_signal() helper work without CONFIG_MODULES. Fixes: 8b401f9e ("bpf: implement bpf_send_signal() helper") Reported-By:Arnd Bergmann <arnd@arndb.de> Signed-off-by:
Yonghong Song <yhs@fb.com> Acked-by:
-
Andrii Nakryiko authored
Non-BPF (user land) part of selftests is built without debug info making occasional debugging with gdb terrible. Build with debug info always. Signed-off-by:
Andrii Nakryiko <andriin@fb.com> Signed-off-by:
-
Ivan Khoronzhuk authored
It fixes build error for 32bit caused by type mismatch size_t/unsigned long. Fixes: bf829271 ("libbpf: refactor map initialization") Acked-by:
Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org> Signed-off-by:
-
- 25 Jun, 2019 6 commits
-
-
Toshiaki Makita authored
XDP_TX is similar to XDP_REDIRECT as it essentially redirects packets to the device itself. XDP_REDIRECT has bulk transmit mechanism to avoid the heavy cost of indirect call but it also reduces lock acquisition on the destination device that needs locks like veth and tun. XDP_TX does not use indirect calls but drivers which require locks can benefit from the bulk transmit for XDP_TX as well. This patch introduces bulk transmit mechanism in veth using bulk queue on stack, and improves XDP_TX performance by about 9%. Here are single-core/single-flow XDP_TX test results. CPU consumptions are taken from "perf report --no-child". - Before: 7.26 Mpps _raw_spin_lock 7.83% veth_xdp_xmit 12.23% - After: 7.94 Mpps _raw_spin_lock 1.08% veth_xdp_xmit 6.10% v2: - Use stack for bulk queue instead of a global variable. Signed-off-by:
Toshiaki Makita <toshiaki.makita1@gmail.com> Acked-by:
-
Toshiaki Makita authored
This is introduced for admins to check what is happening on XDP_TX when bulk XDP_TX is in use, which will be first introduced in veth in next commit. v3: - Add act field to be in line with other XDP tracepoints. Signed-off-by:
-
Toshiaki Makita authored
Add a test case for veth native XDP. It checks if XDP_PASS, XDP_TX and XDP_REDIRECT work properly. $ cd tools/testing/selftests/bpf $ make \ TEST_CUSTOM_PROGS= \ TEST_GEN_PROGS= \ TEST_GEN_PROGS_EXTENDED= \ TEST_PROGS_EXTENDED= \ TEST_PROGS="test_xdp_veth.sh" \ run_tests TAP version 13 1..1 # selftests: bpf: test_xdp_veth.sh # PING 10.1.1.33 (10.1.1.33) 56(84) bytes of data. # 64 bytes from 10.1.1.33: icmp_seq=1 ttl=64 time=0.073 ms # # --- 10.1.1.33 ping statistics --- # 1 packets transmitted, 1 received, 0% packet loss, time 0ms # rtt min/avg/max/mdev = 0.073/0.073/0.073/0.000 ms # selftests: xdp_veth [PASS] ok 1 selftests: bpf: test_xdp_veth.sh Signed-off-by:
-
Eric Leblond authored
Fix documentation that mention xdpsock_kern.c which has been replaced by code embedded in libbpf. Signed-off-by:
Eric Leblond <eric@regit.org> Acked-by:
-
Colin Ian King authored
There are several spelling mistakes in pr_warning messages. Fix these. Signed-off-by:
Colin Ian King <colin.king@canonical.com> Acked-by:
-
Michal Rostecki authored
ibumad example was implementing the bpf_debug macro which is exactly the same as the bpf_printk macro available in bpf_helpers.h. This change makes use of bpf_printk instead of bpf_debug. Signed-off-by:
Michal Rostecki <mrostecki@opensuse.org> Acked-by:
-
- 23 Jun, 2019 11 commits
-
-
David S. Miller authored
Wei Wang says: ==================== ipv6: avoid taking refcnt on dst during route lookup Ipv6 route lookup code always grabs refcnt on the dst for the caller. But for certain cases, grabbing refcnt is not always necessary if the call path is rcu protected and the caller does not cache the dst. Another issue in the route lookup logic is: When there are multiple custom rules, we have to do the lookup into each table associated to each rule individually. And when we can't find the route in one table, we grab and release refcnt on net->ipv6.ip6_null_entry before going to the next table. This operation is completely redundant, and causes false issue because net->ipv6.ip6_null_entry is a shared object. This patch set introduces a new flag RT6_LOOKUP_F_DST_NOREF for route lookup callers to set, to avoid any manipulation on the dst refcnt. And it converts the major input and output path to use it. The performance gain is noticable. I ran synflood tests between 2 hosts under the same switch. Both hosts have 20G mlx NIC, and 8 tx/rx queues. Sender sends pure SYN flood with random src IPs and ports using trafgen. Receiver has a simple TCP listener on the target port. Both hosts have multiple custom rules: - For incoming packets, only local table is traversed. - For outgoing packets, 3 tables are traversed to find the route. The packet processing rate on the receiver is as follows: - Before the fix: 3.78Mpps - After the fix: 5.50Mpps v2->v3: - Handled fib6_rule_lookup() when CONFIG_IPV6_MULTIPLE_TABLES is not configured in patch 03 (suggested by David Ahern) - Removed the renaming of l3mdev_link_scope_lookup() in patch 05 (suggested by David Ahern) - Moved definition of ip6_route_output_flags() from an inline function in /net/ipv6/route.c to net/ipv6/route.c in order to address kbuild error in patch 05 v1->v2: - Added a helper ip6_rt_put_flags() in patch 3 suggested by David Miller ==================== Reviewed-by:
David Ahern <dsahern@gmail.com> Reviewed-by:
Eric Dumazet <edumazet@google.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Wei Wang authored
For tx path, in most cases, we still have to take refcnt on the dst cause the caller is caching the dst somewhere. But it still is beneficial to make use of RT6_LOOKUP_F_DST_NOREF flag while doing the route lookup. It is cause this flag prevents manipulating refcnt on net->ipv6.ip6_null_entry when doing fib6_rule_lookup() to traverse each routing table. The null_entry is a shared object and constant updates on it cause false sharing. We converted the current major lookup function ip6_route_output_flags() to make use of RT6_LOOKUP_F_DST_NOREF. Together with the change in the rx path, we see noticable performance boost: I ran synflood tests between 2 hosts under the same switch. Both hosts have 20G mlx NIC, and 8 tx/rx queues. Sender sends pure SYN flood with random src IPs and ports using trafgen. Receiver has a simple TCP listener on the target port. Both hosts have multiple custom rules: - For incoming packets, only local table is traversed. - For outgoing packets, 3 tables are traversed to find the route. The packet processing rate on the receiver is as follows: - Before the fix: 3.78Mpps - After the fix: 5.50Mpps Signed-off-by:
Wei Wang <weiwan@google.com> Signed-off-by:
-
Wei Wang authored
ip6_route_input() is the key function to do the route lookup in the rx data path. All the callers to this function are already holding rcu lock. So it is fairly easy to convert it to not take refcnt on the dst: We pass in flag RT6_LOOKUP_F_DST_NOREF and do skb_dst_set_noref(). This saves a few atomic inc or dec operations and should boost performance overall. This also makes the logic more aligned with v4. Signed-off-by:
Mahesh Bandewar <maheshb@google.com> Signed-off-by:
-
Wei Wang authored
This patch specifically converts the rule lookup logic to honor this flag and not release refcnt when traversing each rule and calling lookup() on each routing table. Similar to previous patch, we also need some special handling of dst entries in uncached list because there is always 1 refcnt taken for them even if RT6_LOOKUP_F_DST_NOREF flag is set. Signed-off-by:
-
Wei Wang authored
Initialize rt6->rt6i_uncached on the following pre-allocated dsts: net->ipv6.ip6_null_entry net->ipv6.ip6_prohibit_entry net->ipv6.ip6_blk_hole_entry This is a preparation patch for later commits to be able to distinguish dst entries in uncached list by doing: !list_empty(rt6->rt6i_uncached) Signed-off-by:
-
Wei Wang authored
This new flag is to instruct the route lookup function to not take refcnt on the dst entry. The user which does route lookup with this flag must properly use rcu protection. ip6_pol_route() is the major route lookup function for both tx and rx path. In this function: Do not take refcnt on dst if RT6_LOOKUP_F_DST_NOREF flag is set, and directly return the route entry. The caller should be holding rcu lock when using this flag, and decide whether to take refcnt or not. One note on the dst cache in the uncached_list: As uncached_list does not consume refcnt, one refcnt is always returned back to the caller even if RT6_LOOKUP_F_DST_NOREF flag is set. Uncached dst is only possible in the output path. So in such call path, caller MUST check if the dst is in the uncached_list before assuming that there is no refcnt taken on the returned dst. Signed-off-by:
-
Russell King authored
There seems to be some confusion surrounding three PHY interface modes, specifically 1000BASE-X, 2500BASE-X and SGMII. Add some documentation to phylib detailing precisely what these interface modes refer to. Signed-off-by:
Russell King <rmk+kernel@armlinux.org.uk> Reviewed-by:
Andrew Lunn <andrew@lunn.ch> Signed-off-by:
-
Qian Cai authored
The linux-next commit "inet: fix various use-after-free in defrags units" [1] introduced compilation warnings, ./include/net/inet_frag.h:117:1: warning: 'inline' is not at beginning of declaration [-Wold-style-declaration] static void inline fqdir_pre_exit(struct fqdir *fqdir) ^~~~~~ In file included from ./include/net/netns/ipv4.h:10, from ./include/net/net_namespace.h:20, from ./include/linux/netdevice.h:38, from ./include/linux/icmpv6.h:13, from ./include/linux/ipv6.h:86, from ./include/net/ipv6.h:12, from ./include/rdma/ib_verbs.h:51, from ./include/linux/mlx5/device.h:37, from ./include/linux/mlx5/driver.h:51, from drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c:37: [1] https://lore.kernel.org/netdev/20190618180900.88939-3-edumazet@google.com/Signed-off-by:Qian Cai <cai@lca.pw> Signed-off-by:
-
Rasmus Villemoes authored
This is a no-op that simply moves all locking and unlocking of ->reg_lock into trivial helpers. I did that to be able to easily add some ad hoc instrumentation to those helpers to get some information on contention and hold times of the mutex. Perhaps others want to do something similar at some point, so this frees them from doing the 'sed -i' yoga, and have a much smaller 'git diff' while fiddling. Signed-off-by:
Rasmus Villemoes <rasmus.villemoes@prevas.dk> Reviewed-by:
Vivien Didelot <vivien.didelot@gmail.com> Signed-off-by:
-
Sameeh Jubran authored
The current code of create_queues_with_size_backoff() allows the ring size to become as small as ENA_MIN_RING_SIZE/2. This is a bug since we don't want the queue ring to be smaller than ENA_MIN_RING_SIZE In this commit we change the loop's termination condition to look at the queue size of the next iteration instead of that of the current one, so that the minimal queue size again becomes ENA_MIN_RING_SIZE. Fixes: eece4d2a ("net: ena: add ethtool function for changing io queue sizes") Signed-off-by:
Arthur Kiyanovski <akiyano@amazon.com> Signed-off-by:
Sameeh Jubran <sameehj@amazon.com> Signed-off-by:
-
Colin Ian King authored
Currently pointer hwdev is dereferenced when assigning hwif before hwdev is null checked. Fix this by only derefencing hwdev after the null check. Addresses-Coverity: ("Dereference before null check") Fixes: 4fdc51bb ("hinic: add support for rss parameters with ethtool") Signed-off-by:
-
- 22 Jun, 2019 5 commits
-
-
David S. Miller authored
René van Dorst says: ==================== net: mediatek: Add MT7621 TRGMII mode support Like many other mediatek SOCs, the MT7621 SOC and the internal MT7530 switch both supports TRGMII mode. MT7621 TRGMII speed is fix 1200MBit. v1->v2: - Fix breakage on non MT7621 SOC - Support 25MHz and 40MHz XTAL as MT7530 clocksource ==================== Tested-by:
"Frank Wunderlich" <frank-w@public-files.de> Acked-by:
Sean Wang <sean.wang@kernel.org> Signed-off-by:
-
René van Dorst authored
This patch add support TRGMII mode for MT7621 internal MT7530 switch. MT7621 TRGMII has only one fix speed mode of 1200MBit. Also adding support for mt7530 25MHz and 40MHz crystal clocksource. Values are based on Banana Pi R2 bsp [1]. Don't change MT7623 registers on a MT7621 device. [1] https://github.com/BPI-SINOVOIP/BPI-R2-bsp/blob/master/linux-mt/drivers/net/ethernet/mediatek/gsw_mt7623.c#L769Signed-off-by:
René van Dorst <opensource@vdorst.com> Tested-by:
-
René van Dorst authored
MT7621 SOC also supports TRGMII. TRGMII speed is 1200MBit. Signed-off-by:
-
Li RongQing authored
ops has been iterated to first element when call pre_exit, and it needs to restore from save_ops, not save ops to save_ops Fixes: d7d99872 ("netns: add pre_exit method to struct pernet_operations") Signed-off-by:
Li RongQing <lirongqing@baidu.com> Reviewed-by:
-
Ido Schimmel authored
When user space sends invalid information in RTA_MULTIPATH, the nexthop list in ip6_route_multipath_add() is empty and 'rt_notif' is set to NULL. The code that emits the in-kernel notifications does not check for this condition, which results in a NULL pointer dereference [1]. Fix this by bailing earlier in the function if the parsed nexthop list is empty. This is consistent with the corresponding IPv4 code. v2: * Check if parsed nexthop list is empty and bail with extack set [1] kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 9190 Comm: syz-executor149 Not tainted 5.2.0-rc5+ #38 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:call_fib6_multipath_entry_notifiers+0xd1/0x1a0 net/ipv6/ip6_fib.c:396 Code: 8b b5 30 ff ff ff 48 c7 85 68 ff ff ff 00 00 00 00 48 c7 85 70 ff ff ff 00 00 00 00 89 45 88 4c 89 e0 48 c1 e8 03 4c 89 65 80 <42> 80 3c 28 00 0f 85 9a 00 00 00 48 b8 00 00 00 00 00 fc ff df 4d RSP: 0018:ffff88809788f2c0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff11012f11e59 RCX: 00000000ffffffff RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88809788f390 R08: ffff88809788f8c0 R09: 000000000000000c R10: ffff88809788f5d8 R11: ffff88809788f527 R12: 0000000000000000 R13: dffffc0000000000 R14: ffff88809788f8c0 R15: ffffffff89541d80 FS: 000055555632c880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000080 CR3: 000000009ba7c000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ip6_route_multipath_add+0xc55/0x1490 net/ipv6/route.c:5094 inet6_rtm_newroute+0xed/0x180 net/ipv6/route.c:5208 rtnetlink_rcv_msg+0x463/0xb00 net/core/rtnetlink.c:5219 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5237 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x531/0x710 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:665 ___sys_sendmsg+0x803/0x920 net/socket.c:2286 __sys_sendmsg+0x105/0x1d0 net/socket.c:2324 __do_sys_sendmsg net/socket.c:2333 [inline] __se_sys_sendmsg net/socket.c:2331 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2331 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4401f9 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffc09fd0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004401f9 RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a80 R13: 0000000000401b10 R14: 0000000000000000 R15: 0000000000000000 Reported-by: syzbot+382566d339d52cd1a204@syzkaller.appspotmail.com Fixes: ebee3cad ("ipv6: Add IPv6 multipath notifications for add / replace") Signed-off-by:
Ido Schimmel <idosch@mellanox.com> Reviewed-by:
Jiri Pirko <jiri@mellanox.com> Reviewed-by:
-
