1. 03 Mar, 2023 7 commits
    • David S. Miller's avatar
      Merge branch 'net-tools-ynl-fixes' · 8f632a0a
      David S. Miller authored
      Jakub Kicinski says:
      
      ====================
      tools: ynl: fix subset use and change default value for attrs/ops
      
      Fix a problem in subsetting, which will become apparent when
      the devlink family comes after the merge window. Even tho none
      of the existing families need this, we don't want someone to
      get "inspired" by the current, incorrect code when using specs
      in other languages.
      
      Change the default value for the first attr/op. This is a slight
      behavior change so needs to go in now. The diffstat of the last
      patch should serve as the clearest justification there..
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8f632a0a
    • Jakub Kicinski's avatar
      netlink: specs: update for codegen enumerating from 1 · bcec7171
      Jakub Kicinski authored
      Now that the codegen rules had been changed we can update
      the specs to reflect the new default.
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bcec7171
    • Jakub Kicinski's avatar
      tools: ynl: use 1 as the default for first entry in attrs/ops · ad4fafcd
      Jakub Kicinski authored
      Pretty much all families use value: 1 or reserve as unspec
      the first entry in attribute set and the first operation.
      Make this the default. Update documentation (the doc for
      values of operations just refers back to doc for attrs
      so updating only attrs).
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ad4fafcd
    • Jakub Kicinski's avatar
      tools: ynl: fully inherit attrs in subsets · 7cf93538
      Jakub Kicinski authored
      To avoid having to repeat the entire definition of an attribute
      (including the value) use the Attr object from the original set.
      In fact this is already the documented expectation.
      
      Fixes: be5bea1c ("net: add basic C code generators for Netlink")
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7cf93538
    • Jakub Kicinski's avatar
      Merge tag 'ieee802154-for-net-2023-03-02' of... · ad93bab6
      Jakub Kicinski authored
      Merge tag 'ieee802154-for-net-2023-03-02' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan
      
      Stefan Schmidt says:
      
      ====================
      ieee802154 for net 2023-03-02
      
      Two small fixes this time.
      
      Alexander Aring fixed a potential negative array access in the ca8210
      driver.
      
      Miquel Raynal fixed a crash that could have been triggered through
      the extended netlink API for 802154. This only came in this merge window.
      Found by syzkaller.
      
      * tag 'ieee802154-for-net-2023-03-02' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan:
        ieee802154: Prevent user from crashing the host
        ca8210: fix mac_len negative array access
      ====================
      
      Link: https://lore.kernel.org/r/20230302153032.1312755-1-stefan@datenfreihafen.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      ad93bab6
    • Shigeru Yoshida's avatar
      net: caif: Fix use-after-free in cfusbl_device_notify() · 9781e98a
      Shigeru Yoshida authored
      syzbot reported use-after-free in cfusbl_device_notify() [1].  This
      causes a stack trace like below:
      
      BUG: KASAN: use-after-free in cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138
      Read of size 8 at addr ffff88807ac4e6f0 by task kworker/u4:6/1214
      
      CPU: 0 PID: 1214 Comm: kworker/u4:6 Not tainted 5.19.0-rc3-syzkaller-00146-g92f20ff7 #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Workqueue: netns cleanup_net
      Call Trace:
       <TASK>
       __dump_stack lib/dump_stack.c:88 [inline]
       dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
       print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313
       print_report mm/kasan/report.c:429 [inline]
       kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
       cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138
       notifier_call_chain+0xb5/0x200 kernel/notifier.c:87
       call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945
       call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]
       call_netdevice_notifiers net/core/dev.c:1997 [inline]
       netdev_wait_allrefs_any net/core/dev.c:10227 [inline]
       netdev_run_todo+0xbc0/0x10f0 net/core/dev.c:10341
       default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334
       ops_exit_list+0x125/0x170 net/core/net_namespace.c:167
       cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594
       process_one_work+0x996/0x1610 kernel/workqueue.c:2289
       worker_thread+0x665/0x1080 kernel/workqueue.c:2436
       kthread+0x2e9/0x3a0 kernel/kthread.c:376
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
       </TASK>
      
      When unregistering a net device, unregister_netdevice_many_notify()
      sets the device's reg_state to NETREG_UNREGISTERING, calls notifiers
      with NETDEV_UNREGISTER, and adds the device to the todo list.
      
      Later on, devices in the todo list are processed by netdev_run_todo().
      netdev_run_todo() waits devices' reference count become 1 while
      rebdoadcasting NETDEV_UNREGISTER notification.
      
      When cfusbl_device_notify() is called with NETDEV_UNREGISTER multiple
      times, the parent device might be freed.  This could cause UAF.
      Processing NETDEV_UNREGISTER multiple times also causes inbalance of
      reference count for the module.
      
      This patch fixes the issue by accepting only first NETDEV_UNREGISTER
      notification.
      
      Fixes: 7ad65bf6 ("caif: Add support for CAIF over CDC NCM USB interface")
      CC: sjur.brandeland@stericsson.com <sjur.brandeland@stericsson.com>
      Reported-by: syzbot+b563d33852b893653a9e@syzkaller.appspotmail.com
      Link: https://syzkaller.appspot.com/bug?id=c3bfd8e2450adab3bffe4d80821fbbced600407f [1]
      Signed-off-by: default avatarShigeru Yoshida <syoshida@redhat.com>
      Link: https://lore.kernel.org/r/20230301163913.391304-1-syoshida@redhat.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      9781e98a
    • Yuiko Oshino's avatar
      net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver · e57cf363
      Yuiko Oshino authored
      Move the LAN7800 internal phy (phy ID  0x0007c132) specific register
      accesses to the phy driver (microchip.c).
      
      Fix the error reported by Enguerrand de Ribaucourt in December 2022,
      "Some operations during the cable switch workaround modify the register
      LAN88XX_INT_MASK of the PHY. However, this register is specific to the
      LAN8835 PHY. For instance, if a DP8322I PHY is connected to the LAN7801,
      that register (0x19), corresponds to the LED and MAC address
      configuration, resulting in unapropriate behavior."
      
      I did not test with the DP8322I PHY, but I tested with an EVB-LAN7800
      with the internal PHY.
      
      Fixes: 14437e3f ("lan78xx: workaround of forced 100 Full/Half duplex mode error")
      Signed-off-by: default avatarYuiko Oshino <yuiko.oshino@microchip.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Link: https://lore.kernel.org/r/20230301154307.30438-1-yuiko.oshino@microchip.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      e57cf363
  2. 02 Mar, 2023 6 commits
  3. 01 Mar, 2023 8 commits
    • Pablo Neira Ayuso's avatar
      netfilter: nft_quota: copy content when cloning expression · aabef97a
      Pablo Neira Ayuso authored
      If the ruleset contains consumed quota, restore them accordingly.
      Otherwise, listing after restoration shows never used items.
      
      Restore the user-defined quota and flags too.
      
      Fixes: ed0a0c60 ("netfilter: nft_quota: move stateful fields out of expression data")
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      aabef97a
    • Pablo Neira Ayuso's avatar
      netfilter: nft_last: copy content when cloning expression · 860e8742
      Pablo Neira Ayuso authored
      If the ruleset contains last timestamps, restore them accordingly.
      Otherwise, listing after restoration shows never used items.
      
      Fixes: 33a24de3 ("netfilter: nft_last: move stateful fields out of expression data")
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      860e8742
    • Hangbin Liu's avatar
      selftests: nft_nat: ensuring the listening side is up before starting the client · 2067e7a0
      Hangbin Liu authored
      The test_local_dnat_portonly() function initiates the client-side as
      soon as it sets the listening side to the background. This could lead to
      a race condition where the server may not be ready to listen. To ensure
      that the server-side is up and running before initiating the
      client-side, a delay is introduced to the test_local_dnat_portonly()
      function.
      
      Before the fix:
        # ./nft_nat.sh
        PASS: netns routing/connectivity: ns0-rthlYrBU can reach ns1-rthlYrBU and ns2-rthlYrBU
        PASS: ping to ns1-rthlYrBU was ip NATted to ns2-rthlYrBU
        PASS: ping to ns1-rthlYrBU OK after ip nat output chain flush
        PASS: ipv6 ping to ns1-rthlYrBU was ip6 NATted to ns2-rthlYrBU
        2023/02/27 04:11:03 socat[6055] E connect(5, AF=2 10.0.1.99:2000, 16): Connection refused
        ERROR: inet port rewrite
      
      After the fix:
        # ./nft_nat.sh
        PASS: netns routing/connectivity: ns0-9sPJV6JJ can reach ns1-9sPJV6JJ and ns2-9sPJV6JJ
        PASS: ping to ns1-9sPJV6JJ was ip NATted to ns2-9sPJV6JJ
        PASS: ping to ns1-9sPJV6JJ OK after ip nat output chain flush
        PASS: ipv6 ping to ns1-9sPJV6JJ was ip6 NATted to ns2-9sPJV6JJ
        PASS: inet port rewrite without l3 address
      
      Fixes: 282e5f8f ("netfilter: nat: really support inet nat without l3 address")
      Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      2067e7a0
    • Horatiu Vultur's avatar
      net: lan966x: Fix port police support using tc-matchall · 81563d85
      Horatiu Vultur authored
      When the police was removed from the port, then it was trying to
      remove the police from the police id and not from the actual
      police index.
      The police id represents the id of the police and police index
      represents the position in HW where the police is situated.
      The port police id can be any number while the port police index
      is a number based on the port chip port.
      Fix this by deleting the police from HW that is situated at the
      police index and not police id.
      
      Fixes: 5390334b ("net: lan966x: Add port police support using tc-matchall")
      Signed-off-by: default avatarHoratiu Vultur <horatiu.vultur@microchip.com>
      Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
      Reviewed-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      81563d85
    • Eric Dumazet's avatar
      net/sched: flower: fix fl_change() error recovery path · dfd2f0eb
      Eric Dumazet authored
      The two "goto errout;" paths in fl_change() became wrong
      after cited commit.
      
      Indeed we only must not call __fl_put() until the net pointer
      has been set in tcf_exts_init_ex()
      
      This is a minimal fix. We might in the future validate TCA_FLOWER_FLAGS
      before we allocate @fnew.
      
      BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:72 [inline]
      BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
      BUG: KASAN: null-ptr-deref in refcount_read include/linux/refcount.h:147 [inline]
      BUG: KASAN: null-ptr-deref in __refcount_add_not_zero include/linux/refcount.h:152 [inline]
      BUG: KASAN: null-ptr-deref in __refcount_inc_not_zero include/linux/refcount.h:227 [inline]
      BUG: KASAN: null-ptr-deref in refcount_inc_not_zero include/linux/refcount.h:245 [inline]
      BUG: KASAN: null-ptr-deref in maybe_get_net include/net/net_namespace.h:269 [inline]
      BUG: KASAN: null-ptr-deref in tcf_exts_get_net include/net/pkt_cls.h:260 [inline]
      BUG: KASAN: null-ptr-deref in __fl_put net/sched/cls_flower.c:513 [inline]
      BUG: KASAN: null-ptr-deref in __fl_put+0x13e/0x3b0 net/sched/cls_flower.c:508
      Read of size 4 at addr 000000000000014c by task syz-executor548/5082
      
      CPU: 0 PID: 5082 Comm: syz-executor548 Not tainted 6.2.0-syzkaller-05251-g5b7c4cab #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
      Call Trace:
      <TASK>
      __dump_stack lib/dump_stack.c:88 [inline]
      dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
      print_report mm/kasan/report.c:420 [inline]
      kasan_report+0xec/0x130 mm/kasan/report.c:517
      check_region_inline mm/kasan/generic.c:183 [inline]
      kasan_check_range+0x141/0x190 mm/kasan/generic.c:189
      instrument_atomic_read include/linux/instrumented.h:72 [inline]
      atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
      refcount_read include/linux/refcount.h:147 [inline]
      __refcount_add_not_zero include/linux/refcount.h:152 [inline]
      __refcount_inc_not_zero include/linux/refcount.h:227 [inline]
      refcount_inc_not_zero include/linux/refcount.h:245 [inline]
      maybe_get_net include/net/net_namespace.h:269 [inline]
      tcf_exts_get_net include/net/pkt_cls.h:260 [inline]
      __fl_put net/sched/cls_flower.c:513 [inline]
      __fl_put+0x13e/0x3b0 net/sched/cls_flower.c:508
      fl_change+0x101b/0x4ab0 net/sched/cls_flower.c:2341
      tc_new_tfilter+0x97c/0x2290 net/sched/cls_api.c:2310
      rtnetlink_rcv_msg+0x996/0xd50 net/core/rtnetlink.c:6165
      netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2574
      netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
      netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
      netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1942
      sock_sendmsg_nosec net/socket.c:722 [inline]
      sock_sendmsg+0xde/0x190 net/socket.c:745
      ____sys_sendmsg+0x334/0x900 net/socket.c:2504
      ___sys_sendmsg+0x110/0x1b0 net/socket.c:2558
      __sys_sendmmsg+0x18f/0x460 net/socket.c:2644
      __do_sys_sendmmsg net/socket.c:2673 [inline]
      __se_sys_sendmmsg net/socket.c:2670 [inline]
      __x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2670
      
      Fixes: 08a0063d ("net/sched: flower: Move filter handle initialization earlier")
      Reported-by: syzbot+baabf3efa7c1e57d28b2@syzkaller.appspotmail.com
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Paul Blakey <paulb@nvidia.com>
      Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dfd2f0eb
    • Eric Dumazet's avatar
      ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() · 693aa2c0
      Eric Dumazet authored
      ila_xlat_nl_cmd_get_mapping() generates an empty skb,
      triggerring a recent sanity check [1].
      
      Instead, return an error code, so that user space
      can get it.
      
      [1]
      skb_assert_len
      WARNING: CPU: 0 PID: 5923 at include/linux/skbuff.h:2527 skb_assert_len include/linux/skbuff.h:2527 [inline]
      WARNING: CPU: 0 PID: 5923 at include/linux/skbuff.h:2527 __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156
      Modules linked in:
      CPU: 0 PID: 5923 Comm: syz-executor269 Not tainted 6.2.0-syzkaller-18300-g2ebd1fbb946d #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
      pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
      pc : skb_assert_len include/linux/skbuff.h:2527 [inline]
      pc : __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156
      lr : skb_assert_len include/linux/skbuff.h:2527 [inline]
      lr : __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156
      sp : ffff80001e0d6c40
      x29: ffff80001e0d6e60 x28: dfff800000000000 x27: ffff0000c86328c0
      x26: dfff800000000000 x25: ffff0000c8632990 x24: ffff0000c8632a00
      x23: 0000000000000000 x22: 1fffe000190c6542 x21: ffff0000c8632a10
      x20: ffff0000c8632a00 x19: ffff80001856e000 x18: ffff80001e0d5fc0
      x17: 0000000000000000 x16: ffff80001235d16c x15: 0000000000000000
      x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001
      x11: ff80800008353a30 x10: 0000000000000000 x9 : 21567eaf25bfb600
      x8 : 21567eaf25bfb600 x7 : 0000000000000001 x6 : 0000000000000001
      x5 : ffff80001e0d6558 x4 : ffff800015c74760 x3 : ffff800008596744
      x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000000e
      Call trace:
      skb_assert_len include/linux/skbuff.h:2527 [inline]
      __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156
      dev_queue_xmit include/linux/netdevice.h:3033 [inline]
      __netlink_deliver_tap_skb net/netlink/af_netlink.c:307 [inline]
      __netlink_deliver_tap+0x45c/0x6f8 net/netlink/af_netlink.c:325
      netlink_deliver_tap+0xf4/0x174 net/netlink/af_netlink.c:338
      __netlink_sendskb net/netlink/af_netlink.c:1283 [inline]
      netlink_sendskb+0x6c/0x154 net/netlink/af_netlink.c:1292
      netlink_unicast+0x334/0x8d4 net/netlink/af_netlink.c:1380
      nlmsg_unicast include/net/netlink.h:1099 [inline]
      genlmsg_unicast include/net/genetlink.h:433 [inline]
      genlmsg_reply include/net/genetlink.h:443 [inline]
      ila_xlat_nl_cmd_get_mapping+0x620/0x7d0 net/ipv6/ila/ila_xlat.c:493
      genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline]
      genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
      genl_rcv_msg+0x938/0xc1c net/netlink/genetlink.c:1065
      netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2574
      genl_rcv+0x38/0x50 net/netlink/genetlink.c:1076
      netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
      netlink_unicast+0x660/0x8d4 net/netlink/af_netlink.c:1365
      netlink_sendmsg+0x800/0xae0 net/netlink/af_netlink.c:1942
      sock_sendmsg_nosec net/socket.c:714 [inline]
      sock_sendmsg net/socket.c:734 [inline]
      ____sys_sendmsg+0x558/0x844 net/socket.c:2479
      ___sys_sendmsg net/socket.c:2533 [inline]
      __sys_sendmsg+0x26c/0x33c net/socket.c:2562
      __do_sys_sendmsg net/socket.c:2571 [inline]
      __se_sys_sendmsg net/socket.c:2569 [inline]
      __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2569
      __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
      invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
      el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
      do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193
      el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
      el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
      el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
      irq event stamp: 136484
      hardirqs last enabled at (136483): [<ffff800008350244>] __up_console_sem+0x60/0xb4 kernel/printk/printk.c:345
      hardirqs last disabled at (136484): [<ffff800012358d60>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
      softirqs last enabled at (136418): [<ffff800008020ea8>] softirq_handle_end kernel/softirq.c:414 [inline]
      softirqs last enabled at (136418): [<ffff800008020ea8>] __do_softirq+0xd4c/0xfa4 kernel/softirq.c:600
      softirqs last disabled at (136371): [<ffff80000802b4a4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
      ---[ end trace 0000000000000000 ]---
      skb len=0 headroom=0 headlen=0 tailroom=192
      mac=(0,0) net=(0,-1) trans=-1
      shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0))
      csum(0x0 ip_summed=0 complete_sw=0 valid=0 level=0)
      hash(0x0 sw=0 l4=0) proto=0x0010 pkttype=6 iif=0
      dev name=nlmon0 feat=0x0000000000005861
      
      Fixes: 7f00feaf ("ila: Add generic ILA translation facility")
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      693aa2c0
    • Pedro Tammela's avatar
      net/sched: act_connmark: handle errno on tcf_idr_check_alloc · fb073904
      Pedro Tammela authored
      Smatch reports that 'ci' can be used uninitialized.
      The current code ignores errno coming from tcf_idr_check_alloc, which
      will lead to the incorrect usage of 'ci'. Handle the errno as it should.
      
      Fixes: 288864ef ("net/sched: act_connmark: transition to percpu stats and rcu")
      Reviewed-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarPedro Tammela <pctammela@mojatatu.com>
      Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fb073904
    • Eric Dumazet's avatar
      net: avoid skb end_offset change in __skb_unclone_keeptruesize() · 880ce5f2
      Eric Dumazet authored
      Once initial skb->head has been allocated from skb_small_head_cache,
      we need to make sure to use the same strategy whenever skb->head
      has to be re-allocated, as found by syzbot [1]
      
      This means kmalloc_reserve() can not fallback from using
      skb_small_head_cache to generic (power-of-two) kmem caches.
      
      It seems that we probably want to rework things in the future,
      to partially revert following patch, because we no longer use
      ksize() for skb allocated in TX path.
      
      2b88cba5 ("net: preserve skb_end_offset() in skb_unclone_keeptruesize()")
      
      Ideally, TCP stack should never put payload in skb->head,
      this effort has to be completed.
      
      In the mean time, add a sanity check.
      
      [1]
      BUG: KASAN: invalid-free in slab_free mm/slub.c:3787 [inline]
      BUG: KASAN: invalid-free in kmem_cache_free+0xee/0x5c0 mm/slub.c:3809
      Free of addr ffff88806cdee800 by task syz-executor239/5189
      
      CPU: 0 PID: 5189 Comm: syz-executor239 Not tainted 6.2.0-rc8-syzkaller-02400-gd1fabc68 #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
      Call Trace:
      <TASK>
      __dump_stack lib/dump_stack.c:88 [inline]
      dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
      print_address_description mm/kasan/report.c:306 [inline]
      print_report+0x15e/0x45d mm/kasan/report.c:417
      kasan_report_invalid_free+0x9b/0x1b0 mm/kasan/report.c:482
      ____kasan_slab_free+0x1a5/0x1c0 mm/kasan/common.c:216
      kasan_slab_free include/linux/kasan.h:177 [inline]
      slab_free_hook mm/slub.c:1781 [inline]
      slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
      slab_free mm/slub.c:3787 [inline]
      kmem_cache_free+0xee/0x5c0 mm/slub.c:3809
      skb_kfree_head net/core/skbuff.c:857 [inline]
      skb_kfree_head net/core/skbuff.c:853 [inline]
      skb_free_head+0x16f/0x1a0 net/core/skbuff.c:872
      skb_release_data+0x57a/0x820 net/core/skbuff.c:901
      skb_release_all net/core/skbuff.c:966 [inline]
      __kfree_skb+0x4f/0x70 net/core/skbuff.c:980
      tcp_wmem_free_skb include/net/tcp.h:302 [inline]
      tcp_rtx_queue_purge net/ipv4/tcp.c:3061 [inline]
      tcp_write_queue_purge+0x617/0xcf0 net/ipv4/tcp.c:3074
      tcp_v4_destroy_sock+0x125/0x810 net/ipv4/tcp_ipv4.c:2302
      inet_csk_destroy_sock+0x19a/0x440 net/ipv4/inet_connection_sock.c:1195
      __tcp_close+0xb96/0xf50 net/ipv4/tcp.c:3021
      tcp_close+0x2d/0xc0 net/ipv4/tcp.c:3033
      inet_release+0x132/0x270 net/ipv4/af_inet.c:426
      __sock_release+0xcd/0x280 net/socket.c:651
      sock_close+0x1c/0x20 net/socket.c:1393
      __fput+0x27c/0xa90 fs/file_table.c:320
      task_work_run+0x16f/0x270 kernel/task_work.c:179
      resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
      exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
      exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:203
      __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
      syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296
      do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
      entry_SYSCALL_64_after_hwframe+0x63/0xcd
      RIP: 0033:0x7f2511f546c3
      Code: c7 c2 c0 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8
      RSP: 002b:00007ffef0103d48 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
      RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f2511f546c3
      RDX: 0000000000000978 RSI: 00000000200000c0 RDI: 0000000000000003
      RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000003434
      R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffef0103d6c
      R13: 00007ffef0103d80 R14: 00007ffef0103dc0 R15: 0000000000000003
      </TASK>
      
      Allocated by task 5189:
      kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
      kasan_set_track+0x25/0x30 mm/kasan/common.c:52
      ____kasan_kmalloc mm/kasan/common.c:374 [inline]
      ____kasan_kmalloc mm/kasan/common.c:333 [inline]
      __kasan_kmalloc+0xa5/0xb0 mm/kasan/common.c:383
      kasan_kmalloc include/linux/kasan.h:211 [inline]
      __do_kmalloc_node mm/slab_common.c:968 [inline]
      __kmalloc_node_track_caller+0x5b/0xc0 mm/slab_common.c:988
      kmalloc_reserve+0xf1/0x230 net/core/skbuff.c:539
      pskb_expand_head+0x237/0x1160 net/core/skbuff.c:1995
      __skb_unclone_keeptruesize+0x93/0x220 net/core/skbuff.c:2094
      skb_unclone_keeptruesize include/linux/skbuff.h:1910 [inline]
      skb_prepare_for_shift net/core/skbuff.c:3804 [inline]
      skb_shift+0xef8/0x1e20 net/core/skbuff.c:3877
      tcp_skb_shift net/ipv4/tcp_input.c:1538 [inline]
      tcp_shift_skb_data net/ipv4/tcp_input.c:1646 [inline]
      tcp_sacktag_walk+0x93b/0x18a0 net/ipv4/tcp_input.c:1713
      tcp_sacktag_write_queue+0x1599/0x31d0 net/ipv4/tcp_input.c:1974
      tcp_ack+0x2e9f/0x5a10 net/ipv4/tcp_input.c:3847
      tcp_rcv_established+0x667/0x2230 net/ipv4/tcp_input.c:6006
      tcp_v4_do_rcv+0x670/0x9b0 net/ipv4/tcp_ipv4.c:1721
      sk_backlog_rcv include/net/sock.h:1113 [inline]
      __release_sock+0x133/0x3b0 net/core/sock.c:2921
      release_sock+0x58/0x1b0 net/core/sock.c:3488
      tcp_sendmsg+0x3a/0x50 net/ipv4/tcp.c:1485
      inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:825
      sock_sendmsg_nosec net/socket.c:722 [inline]
      sock_sendmsg+0xde/0x190 net/socket.c:745
      sock_write_iter+0x295/0x3d0 net/socket.c:1136
      call_write_iter include/linux/fs.h:2189 [inline]
      new_sync_write fs/read_write.c:491 [inline]
      vfs_write+0x9ed/0xdd0 fs/read_write.c:584
      ksys_write+0x1ec/0x250 fs/read_write.c:637
      do_syscall_x64 arch/x86/entry/common.c:50 [inline]
      do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
      entry_SYSCALL_64_after_hwframe+0x63/0xcd
      
      The buggy address belongs to the object at ffff88806cdee800
      which belongs to the cache kmalloc-1k of size 1024
      The buggy address is located 0 bytes inside of
      1024-byte region [ffff88806cdee800, ffff88806cdeec00)
      
      The buggy address belongs to the physical page:
      page:ffffea0001b37a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6cde8
      head:ffffea0001b37a00 order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0
      flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
      raw: 00fff00000010200 ffff888012441dc0 dead000000000122 0000000000000000
      raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
      page dumped because: kasan: bad access detected
      page_owner tracks the page as allocated
      page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1f2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_MEMALLOC|__GFP_HARDWALL), pid 75, tgid 75 (kworker/u4:4), ts 96369578780, free_ts 26734162530
      prep_new_page mm/page_alloc.c:2531 [inline]
      get_page_from_freelist+0x119c/0x2ce0 mm/page_alloc.c:4283
      __alloc_pages+0x1cb/0x5b0 mm/page_alloc.c:5549
      alloc_pages+0x1aa/0x270 mm/mempolicy.c:2287
      alloc_slab_page mm/slub.c:1851 [inline]
      allocate_slab+0x25f/0x350 mm/slub.c:1998
      new_slab mm/slub.c:2051 [inline]
      ___slab_alloc+0xa91/0x1400 mm/slub.c:3193
      __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292
      __slab_alloc_node mm/slub.c:3345 [inline]
      slab_alloc_node mm/slub.c:3442 [inline]
      __kmem_cache_alloc_node+0x1a4/0x430 mm/slub.c:3491
      __do_kmalloc_node mm/slab_common.c:967 [inline]
      __kmalloc_node_track_caller+0x4b/0xc0 mm/slab_common.c:988
      kmalloc_reserve+0xf1/0x230 net/core/skbuff.c:539
      __alloc_skb+0x129/0x330 net/core/skbuff.c:608
      __netdev_alloc_skb+0x74/0x410 net/core/skbuff.c:672
      __netdev_alloc_skb_ip_align include/linux/skbuff.h:3203 [inline]
      netdev_alloc_skb_ip_align include/linux/skbuff.h:3213 [inline]
      batadv_iv_ogm_aggregate_new+0x106/0x4e0 net/batman-adv/bat_iv_ogm.c:558
      batadv_iv_ogm_queue_add net/batman-adv/bat_iv_ogm.c:670 [inline]
      batadv_iv_ogm_schedule_buff+0xe6b/0x1450 net/batman-adv/bat_iv_ogm.c:849
      batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:868 [inline]
      batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:861 [inline]
      batadv_iv_send_outstanding_bat_ogm_packet+0x744/0x910 net/batman-adv/bat_iv_ogm.c:1712
      process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
      worker_thread+0x669/0x1090 kernel/workqueue.c:2436
      page last free stack trace:
      reset_page_owner include/linux/page_owner.h:24 [inline]
      free_pages_prepare mm/page_alloc.c:1446 [inline]
      free_pcp_prepare+0x66a/0xc20 mm/page_alloc.c:1496
      free_unref_page_prepare mm/page_alloc.c:3369 [inline]
      free_unref_page+0x1d/0x490 mm/page_alloc.c:3464
      free_contig_range+0xb5/0x180 mm/page_alloc.c:9488
      destroy_args+0xa8/0x64c mm/debug_vm_pgtable.c:998
      debug_vm_pgtable+0x28de/0x296f mm/debug_vm_pgtable.c:1318
      do_one_initcall+0x141/0x790 init/main.c:1306
      do_initcall_level init/main.c:1379 [inline]
      do_initcalls init/main.c:1395 [inline]
      do_basic_setup init/main.c:1414 [inline]
      kernel_init_freeable+0x6f9/0x782 init/main.c:1634
      kernel_init+0x1e/0x1d0 init/main.c:1522
      ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
      
      Memory state around the buggy address:
      ffff88806cdee700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      ffff88806cdee780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      >ffff88806cdee800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      ^
      ffff88806cdee880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      
      Fixes: bf9f1baa ("net: add dedicated kmem_cache for typical/small skb->head")
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Tested-by: default avatarChristoph Paasch <cpaasch@apple.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      880ce5f2
  4. 28 Feb, 2023 7 commits
  5. 27 Feb, 2023 12 commits
    • Linus Torvalds's avatar
      Merge tag 'net-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 5ca26d60
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Including fixes from wireless and netfilter.
      
        The notable fixes here are the EEE fix which restores boot for many
        embedded platforms (real and QEMU); WiFi warning suppression and the
        ICE Kconfig cleanup.
      
        Current release - regressions:
      
         - phy: multiple fixes for EEE rework
      
         - wifi: wext: warn about usage only once
      
         - wifi: ath11k: allow system suspend to survive ath11k
      
        Current release - new code bugs:
      
         - mlx5: Fix memory leak in IPsec RoCE creation
      
         - ibmvnic: assign XPS map to correct queue index
      
        Previous releases - regressions:
      
         - netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
      
         - netfilter: ctnetlink: make event listener tracking global
      
         - nf_tables: allow to fetch set elements when table has an owner
      
         - mlx5:
            - fix skb leak while fifo resync and push
            - fix possible ptp queue fifo use-after-free
      
        Previous releases - always broken:
      
         - sched: fix action bind logic
      
         - ptp: vclock: use mutex to fix "sleep on atomic" bug if driver also
           uses a mutex
      
         - netfilter: conntrack: fix rmmod double-free race
      
         - netfilter: xt_length: use skb len to match in length_mt6, avoid
           issues with BIG TCP
      
        Misc:
      
         - ice: remove unnecessary CONFIG_ICE_GNSS
      
         - mlx5e: remove hairpin write debugfs files
      
         - sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy"
      
      * tag 'net-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (53 commits)
        tcp: tcp_check_req() can be called from process context
        net: phy: c45: fix network interface initialization failures on xtensa, arm:cubieboard
        xen-netback: remove unused variables pending_idx and index
        net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy
        net: dsa: ocelot_ext: remove unnecessary phylink.h include
        net: mscc: ocelot: fix duplicate driver name error
        net: dsa: felix: fix internal MDIO controller resource length
        net: dsa: seville: ignore mscc-miim read errors from Lynx PCS
        net/sched: act_sample: fix action bind logic
        net/sched: act_mpls: fix action bind logic
        net/sched: act_pedit: fix action bind logic
        wifi: wext: warn about usage only once
        wifi: mt76: usb: fix use-after-free in mt76u_free_rx_queue
        qede: avoid uninitialized entries in coal_entry array
        nfc: fix memory leak of se_io context in nfc_genl_se_io
        ice: remove unnecessary CONFIG_ICE_GNSS
        net/sched: cls_api: Move call to tcf_exts_miss_cookie_base_destroy()
        ibmvnic: Assign XPS map to correct queue index
        docs: net: fix inaccuracies in msg_zerocopy.rst
        tools: net: add __pycache__ to gitignore
        ...
      5ca26d60
    • Eric Dumazet's avatar
      tcp: tcp_check_req() can be called from process context · 580f98cc
      Eric Dumazet authored
      This is a follow up of commit 0a375c82 ("tcp: tcp_rtx_synack()
      can be called from process context").
      
      Frederick Lawler reported another "__this_cpu_add() in preemptible"
      warning caused by the same reason.
      
      In my former patch I took care of tcp_rtx_synack()
      but forgot that tcp_check_req() also contained some SNMP updates.
      
      Note that some parts of tcp_check_req() always run in BH context,
      I added a comment to clarify this.
      
      Fixes: 8336886f ("tcp: TCP Fast Open Server - support TFO listeners")
      Link: https://lore.kernel.org/netdev/8cd33923-a21d-397c-e46b-2a068c287b03@cloudflare.com/T/Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarFrederick Lawler <fred@cloudflare.com>
      Tested-by: default avatarFrederick Lawler <fred@cloudflare.com>
      Link: https://lore.kernel.org/r/20230227083336.4153089-1-edumazet@google.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      580f98cc
    • Oleksij Rempel's avatar
      net: phy: c45: fix network interface initialization failures on xtensa, arm:cubieboard · 972074ea
      Oleksij Rempel authored
      Without proper initialization, "changed" returned random numbers and caused
      interface initialization failures.
      
      Fixes: 022c3f87 ("net: phy: add genphy_c45_ethtool_get/set_eee() support")
      Reported-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Tested-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
      Link: https://lore.kernel.org/r/20230225071644.2754893-1-o.rempel@pengutronix.deSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      972074ea
    • Tom Rix's avatar
      xen-netback: remove unused variables pending_idx and index · ccf8f7d7
      Tom Rix authored
      building with gcc and W=1 reports
      drivers/net/xen-netback/netback.c:886:21: error: variable
        ‘pending_idx’ set but not used [-Werror=unused-but-set-variable]
        886 |                 u16 pending_idx;
            |                     ^~~~~~~~~~~
      
      pending_idx is not used so remove it.  Since index was only
      used to set pending_idx, remove index as well.
      Signed-off-by: default avatarTom Rix <trix@redhat.com>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Link: https://lore.kernel.org/r/20230226163429.2351600-1-trix@redhat.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      ccf8f7d7
    • Jakub Kicinski's avatar
      Merge tag 'wireless-2023-02-27' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless · 4db692d6
      Jakub Kicinski authored
      Kalle Valo says:
      
      ====================
      wireless fixes for v6.3
      
      First set of fixes for v6.3. We have only three oneliners. The most
      important one is the patch reducing warnings about the Wireless
      Extensions usage, reported by Linus.
      
      * tag 'wireless-2023-02-27' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
        wifi: wext: warn about usage only once
        wifi: mt76: usb: fix use-after-free in mt76u_free_rx_queue
        wifi: ath11k: allow system suspend to survive ath11k
      ====================
      
      Link: https://lore.kernel.org/r/20230227131053.BD779C433D2@smtp.kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      4db692d6
    • Linus Torvalds's avatar
      Merge tag 'arm-fixes-6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · 98281842
      Linus Torvalds authored
      Pull ARM SoC fixes from Arnd Bergmann:
       "A few bugfixes already came up during the merge window. Samsung,
        ASpeed, Spear have minor DT changes, in case of Samsung this fixes a
        regression compared to earlier versions.
      
        Bartosz takes over as the primary maintainer for the TI DaVinci
        platform, and we get a few last minute defconfig changes"
      
      * tag 'arm-fixes-6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
        ARM: dts: spear320-hmi: correct STMPE GPIO compatible
        ARM: dts: aspeed: p10bmc: Update battery node name
        arm64: defconfig: Add IOSCHED_BFQ to the default configs
        arm64: defconfig: Fix unintentional disablement of PCI on i.MX
        ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
        ARM: dts: exynos: correct TMU phandle in Odroid HC1
        ARM: dts: exynos: correct TMU phandle in Odroid XU
        ARM: dts: exynos: correct TMU phandle in Exynos5250
        ARM: dts: exynos: correct TMU phandle in Exynos4210
        ARM: dts: exynos: correct TMU phandle in Exynos4
        MAINTAINERS: make me the maintainer of DaVinci platforms
      98281842
    • Linus Torvalds's avatar
      Merge tag 'soc-drivers-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · 11c70529
      Linus Torvalds authored
      Pull ARM SoC driver updates from Arnd Bergmann:
       "As usual, there are lots of minor driver changes across SoC platforms
        from NXP, Amlogic, AMD Zynq, Mediatek, Qualcomm, Apple and Samsung.
        These usually add support for additional chip variations in existing
        drivers, but also add features or bugfixes.
      
        The SCMI firmware subsystem gains a unified raw userspace interface
        through debugfs, which can be used for validation purposes.
      
        Newly added drivers include:
      
         - New power management drivers for StarFive JH7110, Allwinner D1 and
           Renesas RZ/V2M
      
         - A driver for Qualcomm battery and power supply status
      
         - A SoC device driver for identifying Nuvoton WPCM450 chips
      
         - A regulator coupler driver for Mediatek MT81xxv"
      
      * tag 'soc-drivers-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (165 commits)
        power: supply: Introduce Qualcomm PMIC GLINK power supply
        soc: apple: rtkit: Do not copy the reg state structure to the stack
        soc: sunxi: SUN20I_PPU should depend on PM
        memory: renesas-rpc-if: Remove redundant division of dummy
        soc: qcom: socinfo: Add IDs for IPQ5332 and its variant
        dt-bindings: arm: qcom,ids: Add IDs for IPQ5332 and its variant
        dt-bindings: power: qcom,rpmpd: add RPMH_REGULATOR_LEVEL_LOW_SVS_L1
        firmware: qcom_scm: Move qcom_scm.h to include/linux/firmware/qcom/
        MAINTAINERS: Update qcom CPR maintainer entry
        dt-bindings: firmware: document Qualcomm SM8550 SCM
        dt-bindings: firmware: qcom,scm: add qcom,scm-sa8775p compatible
        soc: qcom: socinfo: Add Soc IDs for IPQ8064 and variants
        dt-bindings: arm: qcom,ids: Add Soc IDs for IPQ8064 and variants
        soc: qcom: socinfo: Add support for new field in revision 17
        soc: qcom: smd-rpm: Add IPQ9574 compatible
        soc: qcom: pmic_glink: remove redundant calculation of svid
        soc: qcom: stats: Populate all subsystem debugfs files
        dt-bindings: soc: qcom,rpmh-rsc: Update to allow for generic nodes
        soc: qcom: pmic_glink: add CONFIG_NET/CONFIG_OF dependencies
        soc: qcom: pmic_glink: Introduce altmode support
        ...
      11c70529
    • Linus Torvalds's avatar
      Merge tag 'fuse-update-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse · d40b2f4c
      Linus Torvalds authored
      Pull fuse updates from Miklos Szeredi:
      
       - Fix regression in fileattr permission checking
      
       - Fix possible hang during PID namespace destruction
      
       - Add generic support for request extensions
      
       - Add supplementary group list extension
      
       - Add limited support for supplying supplementary groups in create
         requests
      
       - Documentation fixes
      
      * tag 'fuse-update-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
        fuse: add inode/permission checks to fileattr_get/fileattr_set
        fuse: fix all W=1 kernel-doc warnings
        fuse: in fuse_flush only wait if someone wants the return code
        fuse: optional supplementary group in create requests
        fuse: add request extension
      d40b2f4c
    • Linus Torvalds's avatar
      Merge tag 'mmc-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · da15efe1
      Linus Torvalds authored
      Pull MMC updates from Ulf Hansson:
       "MMC core:
         - Extend slot-gpio to be used for host specific card detect interrupts
         - Align to common busy polling behaviour for mmc ioctls
         - Suggest the BFQ I/O scheduler to be built along with MMC/SD support
         - Add devm_mmc_alloc_host() to enable further cleanups in host drivers
      
        MMC host:
         - atmel-mci: Fix race condition when stopping/starting a command
         - dw_mmc-starfive: Add new driver to support the StarFive JH7110 variant
         - dw_mmc-rockchip: Add support for the RK3588 variant
         - jz4740: Add support for the vqmmc power supply
         - meson-gx: Convert the DT bindings to the dt-schema
         - meson-gx: Enable the platform interrupt to be used for card detect
         - moxart: Set the supported maximum request/block/segment sizes
         - renesas,sdhi: Add support for the RZ/V2M variants
         - sdhci: Rework code to drop SDHCI_QUIRK_MISSING_CAPS
         - sdhci-esdhc-imx: Improve tuning logic support
         - sdhci-msm: Add support for the IPQ5332 and the IPQ9574 variants
         - sdhci-of-dwcmshc: Add the missing device table IDs for acpi
         - sdhci-of-dwcmshc: Improve clock support for the Rockchip variant
         - sdhci-of-dwcmshc: Enable support of V4 host for the BlueField-3 variant
         - sdhci-pxav2: Add support for the PXA168 V1 variant
         - sdhci-pxav2: Add support for SDIO IRQs for the PXA168 V1 variant
         - uniphier-sd: Add support for SD UHS-I speed modes"
      
      * tag 'mmc-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (59 commits)
        mmc: meson-gx: Use devm_platform_get_and_ioremap_resource()
        mmc: meson-gx: constify member data of struct meson_host
        mmc: meson-gx: use devm_clk_get_enabled() for core clock
        mmc: core: fix return value check in devm_mmc_alloc_host()
        dt-bindings: mmc: meson-gx: fix interrupt binding
        mmc: meson-gx: support platform interrupt as card detect interrupt
        dt-bindings: mmc: meson-gx: support specifying cd interrupt
        mmc: core: support setting card detect interrupt from drivers
        mmc: starfive: Add sdio/emmc driver support
        dt-bindings: mmc: Add StarFive MMC module
        dt-bindings: mmc: sdhci-msm: Allow 1 icc path
        dt-bindings: mmc: rockchip-dw-mshc: Add RK3588 compatible string
        mmc: core: Align to common busy polling behaviour for mmc ioctls
        dt-bindings: mmc: Add resets property to cadence SDHCI binding
        mmc: meson-gx: remove meson_mmc_get_cd
        mmc: moxart: set maximum request/block/segment sizes
        mmc: sdhci-brcmstb: Use devm_platform_get_and_ioremap_resource()
        mmc: sdhci-of-dwcmshc: add the missing device table IDs for acpi
        mmc: sdhci-of-dwcmshc: Update DLL and pre-change delay for rockchip platform
        mmc: jz4740: Add support for vqmmc power supply
        ...
      da15efe1
    • Linus Torvalds's avatar
      Merge tag 'dma-mapping-6.3-2022-02-27' of git://git.infradead.org/users/hch/dma-mapping · 6ffb575b
      Linus Torvalds authored
      Pull dma-mapping updates from Christoph Hellwig:
      
       - remove a not very useful and now unused swiotlb API (Christoph
         Hellwig)
      
       - fix a section mismatch (Randy Dunlap)
      
      * tag 'dma-mapping-6.3-2022-02-27' of git://git.infradead.org/users/hch/dma-mapping:
        swiotlb: mark swiotlb_memblock_alloc() as __init
        swiotlb: remove swiotlb_max_segment
      6ffb575b
    • Linus Torvalds's avatar
      Merge tag 'memblock-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock · 5a6d9249
      Linus Torvalds authored
      Pull memblock updates from Mike Rapoport:
       "Small optimizations:
      
         - fix off-by-one in the check whether memblock_add_range() should
           reallocate memory to accommodate newly inserted range
      
         - check only for relevant regions in memblock_merge_regions() rather
           than swipe over the entire array"
      
      * tag 'memblock-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:
        memblock: Avoid useless checks in memblock_merge_regions().
        memblock: Make a boundary tighter in memblock_add_range().
      5a6d9249
    • Linus Torvalds's avatar
      Merge tag 'm68knommu-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu · 02a737f4
      Linus Torvalds authored
      Pull m68knommu updates from Greg Ungerer:
      
       - spelling fixes
      
      * tag 'm68knommu-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
        m68k: nommu: Fix misspellings of "DragonEngine"
        m68k: nommu: Fix misspellings of "uCdimm"
      02a737f4