1. 13 May, 2020 9 commits
    • Florian Fainelli's avatar
      net: broadcom: Select BROADCOM_PHY for BCMGENET · 99addbe3
      Florian Fainelli authored
      The GENET controller on the Raspberry Pi 4 (2711) is typically
      interfaced with an external Broadcom PHY via a RGMII electrical
      interface. To make sure that delays are properly configured at the PHY
      side, ensure that we the dedicated Broadcom PHY driver
      (CONFIG_BROADCOM_PHY) is enabled for this to happen.
      
      Fixes: 402482a6 ("net: bcmgenet: Clear ID_MODE_DIS in EXT_RGMII_OOB_CTRL when not needed")
      Reported-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      99addbe3
    • David S. Miller's avatar
      Merge branch 'tipc-fixes' · 69cad59d
      David S. Miller authored
      Tuong Lien says:
      
      ====================
      tipc: add some patches
      
      This series adds patches to fix some issues in TIPC streaming & service
      subscription.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      69cad59d
    • Tuong Lien's avatar
      tipc: fix failed service subscription deletion · 88690b10
      Tuong Lien authored
      When a service subscription is expired or canceled by user, it needs to
      be deleted from the subscription list, so that new subscriptions can be
      registered (max = 65535 per net). However, there are two issues in code
      that can cause such an unused subscription to persist:
      
      1) The 'tipc_conn_delete_sub()' has a loop on the subscription list but
      it makes a break shortly when the 1st subscription differs from the one
      specified, so the subscription will not be deleted.
      
      2) In case a subscription is canceled, the code to remove the
      'TIPC_SUB_CANCEL' flag from the subscription filter does not work if it
      is a local subscription (i.e. the little endian isn't involved). So, it
      will be no matches when looking for the subscription to delete later.
      
      The subscription(s) will be removed eventually when the user terminates
      its topology connection but that could be a long time later. Meanwhile,
      the number of available subscriptions may be exhausted.
      
      This commit fixes the two issues above, so as needed a subscription can
      be deleted correctly.
      Acked-by: default avatarYing Xue <ying.xue@windriver.com>
      Acked-by: default avatarJon Maloy <jmaloy@redhat.com>
      Signed-off-by: default avatarTuong Lien <tuong.t.lien@dektech.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      88690b10
    • Tuong Lien's avatar
      tipc: fix memory leak in service subscripting · 0771d7df
      Tuong Lien authored
      Upon receipt of a service subscription request from user via a topology
      connection, one 'sub' object will be allocated in kernel, so it will be
      able to send an event of the service if any to the user correspondingly
      then. Also, in case of any failure, the connection will be shutdown and
      all the pertaining 'sub' objects will be freed.
      
      However, there is a race condition as follows resulting in memory leak:
      
             receive-work       connection        send-work
                    |                |                |
              sub-1 |<------//-------|                |
              sub-2 |<------//-------|                |
                    |                |<---------------| evt for sub-x
              sub-3 |<------//-------|                |
                    :                :                :
                    :                :                :
                    |       /--------|                |
                    |       |        * peer closed    |
                    |       |        |                |
                    |       |        |<-------X-------| evt for sub-y
                    |       |        |<===============|
              sub-n |<------/        X    shutdown    |
          -> orphan |                                 |
      
      That is, the 'receive-work' may get the last subscription request while
      the 'send-work' is shutting down the connection due to peer close.
      
      We had a 'lock' on the connection, so the two actions cannot be carried
      out simultaneously. If the last subscription is allocated e.g. 'sub-n',
      before the 'send-work' closes the connection, there will be no issue at
      all, the 'sub' objects will be freed. In contrast the last subscription
      will become orphan since the connection was closed, and we released all
      references.
      
      This commit fixes the issue by simply adding one test if the connection
      remains in 'connected' state right after we obtain the connection lock,
      then a subscription object can be created as usual, otherwise we ignore
      it.
      Acked-by: default avatarYing Xue <ying.xue@windriver.com>
      Acked-by: default avatarJon Maloy <jmaloy@redhat.com>
      Reported-by: default avatarThang Ngo <thang.h.ngo@dektech.com.au>
      Signed-off-by: default avatarTuong Lien <tuong.t.lien@dektech.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0771d7df
    • Tuong Lien's avatar
      tipc: fix large latency in smart Nagle streaming · c7268589
      Tuong Lien authored
      Currently when a connection is in Nagle mode, we set the 'ack_required'
      bit in the last sending buffer and wait for the corresponding ACK prior
      to pushing more data. However, on the receiving side, the ACK is issued
      only when application really  reads the whole data. Even if part of the
      last buffer is received, we will not do the ACK as required. This might
      cause an unnecessary delay since the receiver does not always fetch the
      message as fast as the sender, resulting in a large latency in the user
      message sending, which is: [one RTT + the receiver processing time].
      
      The commit makes Nagle ACK as soon as possible i.e. when a message with
      the 'ack_required' arrives in the receiving side's stack even before it
      is processed or put in the socket receive queue...
      This way, we can limit the streaming latency to one RTT as committed in
      Nagle mode.
      Acked-by: default avatarYing Xue <ying.xue@windriver.com>
      Acked-by: default avatarJon Maloy <jmaloy@redhat.com>
      Signed-off-by: default avatarTuong Lien <tuong.t.lien@dektech.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c7268589
    • David S. Miller's avatar
      Merge branch 's390-fixes' · f3fbc5a3
      David S. Miller authored
      Ursula Braun says:
      
      ====================
      s390/net: updates 2020-05-13
      
      please apply the fix from Wei Yongjun to netdev's net tree and
      add Karsten Graul as co-maintainer for drivers/s390/net.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f3fbc5a3
    • Ursula Braun's avatar
      MAINTAINERS: add Karsten Graul as S390 NETWORK DRIVERS maintainer · be7fa20f
      Ursula Braun authored
      Add Karsten as additional maintainer for drivers/s390/net .
      One of his focal points is the ism driver.
      
      Cc: Julian Wiedmann <jwi@linux.ibm.com>
      Acked-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
      Signed-off-by: default avatarUrsula Braun <ubraun@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      be7fa20f
    • Wei Yongjun's avatar
      s390/ism: fix error return code in ism_probe() · 29b74cb7
      Wei Yongjun authored
      Fix to return negative error code -ENOMEM from the smcd_alloc_dev()
      error handling case instead of 0, as done elsewhere in this function.
      
      Fixes: 684b89bc ("s390/ism: add device driver for internal shared memory")
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarWei Yongjun <weiyongjun1@huawei.com>
      Signed-off-by: default avatarUrsula Braun <ubraun@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      29b74cb7
    • Paolo Abeni's avatar
      netlabel: cope with NULL catmap · eead1c2e
      Paolo Abeni authored
      The cipso and calipso code can set the MLS_CAT attribute on
      successful parsing, even if the corresponding catmap has
      not been allocated, as per current configuration and external
      input.
      
      Later, selinux code tries to access the catmap if the MLS_CAT flag
      is present via netlbl_catmap_getlong(). That may cause null ptr
      dereference while processing incoming network traffic.
      
      Address the issue setting the MLS_CAT flag only if the catmap is
      really allocated. Additionally let netlbl_catmap_getlong() cope
      with NULL catmap.
      Reported-by: default avatarMatthew Sheets <matthew.sheets@gd-ms.com>
      Fixes: 4b8feff2 ("netlabel: fix the horribly broken catmap functions")
      Fixes: ceba1832 ("calipso: Set the calipso socket label to match the secattr.")
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Acked-by: default avatarPaul Moore <paul@paul-moore.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      eead1c2e
  2. 12 May, 2020 7 commits
  3. 11 May, 2020 4 commits
    • David S. Miller's avatar
      Merge branch 'net-ipa-fix-cleanup-after-modem-crash' · 1abfb181
      David S. Miller authored
      Alex Elder says:
      
      ====================
      net: ipa: fix cleanup after modem crash
      
      The first patch in this series fixes a bug where the size of a data
      transfer request was never set, meaning it was 0.  The consequence
      of this was that such a transfer request would never complete if
      attempted, and led to a hung task timeout.
      
      This data transfer is required for cleaning up IPA hardware state
      when recovering from a modem crash.  The code to implement this
      cleanup is already present, but its use was commented out because
      it hit the bug described above.  So the second patch in this series
      enables the use of that "tag process" cleanup code.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1abfb181
    • Alex Elder's avatar
      net: ipa: use tag process on modem crash · 2c4bb809
      Alex Elder authored
      One part of recovering from a modem crash is performing a "tag
      sequence" of several IPA immediate commands, to clear the hardware
      pipeline.  The sequence ends with a data transfer request on the
      command endpoint (which is not otherwise done).  Unfortunately,
      attempting to do the data transfer led to a hang, so that request
      plus two other commands were commented out.
      
      The previous commit fixes the bug that was causing that hang.  And
      with that bug fixed we can properly issue the tag sequence when the
      modem crashes, to return the hardware to a known state.
      Signed-off-by: default avatarAlex Elder <elder@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2c4bb809
    • Alex Elder's avatar
      net: ipa: set DMA length in gsi_trans_cmd_add() · c781e1d4
      Alex Elder authored
      When a command gets added to a transaction for the AP->command
      channel we set the DMA address of its scatterlist entry, but not
      its DMA length.  Fix this bug.
      Signed-off-by: default avatarAlex Elder <elder@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c781e1d4
    • Luo bin's avatar
      hinic: fix a bug of ndo_stop · e8a1b0ef
      Luo bin authored
      if some function in ndo_stop interface returns failure because of
      hardware fault, must go on excuting rest steps rather than return
      failure directly, otherwise will cause memory leak.And bump the
      timeout for SET_FUNC_STATE to ensure that cmd won't return failure
      when hw is busy. Otherwise hw may stomp host memory if we free
      memory regardless of the return value of SET_FUNC_STATE.
      
      Fixes: 51ba902a ("net-next/hinic: Initialize hw interface")
      Signed-off-by: default avatarLuo bin <luobin9@huawei.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      e8a1b0ef
  4. 10 May, 2020 2 commits
    • Florian Fainelli's avatar
      net: dsa: loop: Add module soft dependency · 3047211c
      Florian Fainelli authored
      There is a soft dependency against dsa_loop_bdinfo.ko which sets up the
      MDIO device registration, since there are no symbols referenced by
      dsa_loop.ko, there is no automatic loading of dsa_loop_bdinfo.ko which
      is needed.
      
      Fixes: 98cd1552 ("net: dsa: Mock-up driver")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      3047211c
    • Zefan Li's avatar
      netprio_cgroup: Fix unlimited memory leak of v2 cgroups · 090e28b2
      Zefan Li authored
      If systemd is configured to use hybrid mode which enables the use of
      both cgroup v1 and v2, systemd will create new cgroup on both the default
      root (v2) and netprio_cgroup hierarchy (v1) for a new session and attach
      task to the two cgroups. If the task does some network thing then the v2
      cgroup can never be freed after the session exited.
      
      One of our machines ran into OOM due to this memory leak.
      
      In the scenario described above when sk_alloc() is called
      cgroup_sk_alloc() thought it's in v2 mode, so it stores
      the cgroup pointer in sk->sk_cgrp_data and increments
      the cgroup refcnt, but then sock_update_netprioidx()
      thought it's in v1 mode, so it stores netprioidx value
      in sk->sk_cgrp_data, so the cgroup refcnt will never be freed.
      
      Currently we do the mode switch when someone writes to the ifpriomap
      cgroup control file. The easiest fix is to also do the switch when
      a task is attached to a new cgroup.
      
      Fixes: bd1060a1 ("sock, cgroup: add sock->sk_cgroup")
      Reported-by: default avatarYang Yingliang <yangyingliang@huawei.com>
      Tested-by: default avatarYang Yingliang <yangyingliang@huawei.com>
      Signed-off-by: default avatarZefan Li <lizefan@huawei.com>
      Acked-by: default avatarTejun Heo <tj@kernel.org>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      090e28b2
  5. 09 May, 2020 8 commits
  6. 08 May, 2020 6 commits
    • Kelly Littlepage's avatar
      net: tcp: fix rx timestamp behavior for tcp_recvmsg · cc4de047
      Kelly Littlepage authored
      The stated intent of the original commit is to is to "return the timestamp
      corresponding to the highest sequence number data returned." The current
      implementation returns the timestamp for the last byte of the last fully
      read skb, which is not necessarily the last byte in the recv buffer. This
      patch converts behavior to the original definition, and to the behavior of
      the previous draft versions of commit 98aaa913 ("tcp: Extend
      SOF_TIMESTAMPING_RX_SOFTWARE to TCP recvmsg") which also match this
      behavior.
      
      Fixes: 98aaa913 ("tcp: Extend SOF_TIMESTAMPING_RX_SOFTWARE to TCP recvmsg")
      Co-developed-by: default avatarIris Liu <iris@onechronos.com>
      Signed-off-by: default avatarIris Liu <iris@onechronos.com>
      Signed-off-by: default avatarKelly Littlepage <kelly@onechronos.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
      Acked-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      cc4de047
    • Cong Wang's avatar
      net: fix a potential recursive NETDEV_FEAT_CHANGE · dd912306
      Cong Wang authored
      syzbot managed to trigger a recursive NETDEV_FEAT_CHANGE event
      between bonding master and slave. I managed to find a reproducer
      for this:
      
        ip li set bond0 up
        ifenslave bond0 eth0
        brctl addbr br0
        ethtool -K eth0 lro off
        brctl addif br0 bond0
        ip li set br0 up
      
      When a NETDEV_FEAT_CHANGE event is triggered on a bonding slave,
      it captures this and calls bond_compute_features() to fixup its
      master's and other slaves' features. However, when syncing with
      its lower devices by netdev_sync_lower_features() this event is
      triggered again on slaves when the LRO feature fails to change,
      so it goes back and forth recursively until the kernel stack is
      exhausted.
      
      Commit 17b85d29 intentionally lets __netdev_update_features()
      return -1 for such a failure case, so we have to just rely on
      the existing check inside netdev_sync_lower_features() and skip
      NETDEV_FEAT_CHANGE event only for this specific failure case.
      
      Fixes: fd867d51 ("net/core: generic support for disabling netdev features down stack")
      Reported-by: syzbot+e73ceacfd8560cc8a3ca@syzkaller.appspotmail.com
      Reported-by: syzbot+c2fb6f9ddcea95ba49b5@syzkaller.appspotmail.com
      Cc: Jarod Wilson <jarod@redhat.com>
      Cc: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Jann Horn <jannh@google.com>
      Reviewed-by: default avatarJay Vosburgh <jay.vosburgh@canonical.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Acked-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dd912306
    • Paolo Abeni's avatar
      mptcp: set correct vfs info for subflows · 7d14b0d2
      Paolo Abeni authored
      When a subflow is created via mptcp_subflow_create_socket(),
      a new 'struct socket' is allocated, with a new i_ino value.
      
      When inspecting TCP sockets via the procfs and or the diag
      interface, the above ones are not related to the process owning
      the MPTCP master socket, even if they are a logical part of it
      ('ss -p' shows an empty process field)
      
      Additionally, subflows created by the path manager get
      the uid/gid from the running workqueue.
      
      Subflows are part of the owning MPTCP master socket, let's
      adjust the vfs info to reflect this.
      
      After this patch, 'ss' correctly displays subflows as belonging
      to the msk socket creator.
      
      Fixes: 2303f994 ("mptcp: Associate MPTCP context with TCP socket")
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7d14b0d2
    • Chuhong Yuan's avatar
      net: microchip: encx24j600: add missed kthread_stop · ff8ce319
      Chuhong Yuan authored
      This driver calls kthread_run() in probe, but forgets to call
      kthread_stop() in probe failure and remove.
      Add the missed kthread_stop() to fix it.
      Signed-off-by: default avatarChuhong Yuan <hslester96@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ff8ce319
    • Maciej Żenczykowski's avatar
      Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu" · 09454fd0
      Maciej Żenczykowski authored
      This reverts commit 19bda36c:
      
      | ipv6: add mtu lock check in __ip6_rt_update_pmtu
      |
      | Prior to this patch, ipv6 didn't do mtu lock check in ip6_update_pmtu.
      | It leaded to that mtu lock doesn't really work when receiving the pkt
      | of ICMPV6_PKT_TOOBIG.
      |
      | This patch is to add mtu lock check in __ip6_rt_update_pmtu just as ipv4
      | did in __ip_rt_update_pmtu.
      
      The above reasoning is incorrect.  IPv6 *requires* icmp based pmtu to work.
      There's already a comment to this effect elsewhere in the kernel:
      
        $ git grep -p -B1 -A3 'RTAX_MTU lock'
        net/ipv6/route.c=4813=
      
        static int rt6_mtu_change_route(struct fib6_info *f6i, void *p_arg)
        ...
          /* In IPv6 pmtu discovery is not optional,
             so that RTAX_MTU lock cannot disable it.
             We still use this lock to block changes
             caused by addrconf/ndisc.
          */
      
      This reverts to the pre-4.9 behaviour.
      
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Willem de Bruijn <willemb@google.com>
      Cc: Xin Long <lucien.xin@gmail.com>
      Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarMaciej Żenczykowski <maze@google.com>
      Fixes: 19bda36c ("ipv6: add mtu lock check in __ip6_rt_update_pmtu")
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      09454fd0
    • Arnd Bergmann's avatar
      net: bareudp: avoid uninitialized variable warning · ee287556
      Arnd Bergmann authored
      clang points out that building without IPv6 would lead to returning
      an uninitialized variable if a packet with family!=AF_INET is
      passed into bareudp_udp_encap_recv():
      
      drivers/net/bareudp.c:139:6: error: variable 'err' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized]
              if (family == AF_INET)
                  ^~~~~~~~~~~~~~~~~
      drivers/net/bareudp.c:146:15: note: uninitialized use occurs here
              if (unlikely(err)) {
                           ^~~
      include/linux/compiler.h:78:42: note: expanded from macro 'unlikely'
       # define unlikely(x)    __builtin_expect(!!(x), 0)
                                                  ^
      drivers/net/bareudp.c:139:2: note: remove the 'if' if its condition is always true
              if (family == AF_INET)
              ^~~~~~~~~~~~~~~~~~~~~~
      
      This cannot happen in practice, so change the condition in a way that
      gcc sees the IPv4 case as unconditionally true here.
      For consistency, change all the similar constructs in this file the
      same way, using "if(IS_ENABLED())" instead of #if IS_ENABLED()".
      
      Fixes: 571912c6 ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Reviewed-by: default avatarNathan Chancellor <natechancellor@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ee287556
  7. 07 May, 2020 4 commits