1. 15 Jun, 2024 6 commits
  2. 14 Jun, 2024 24 commits
  3. 13 Jun, 2024 10 commits
    • Jakub Kicinski's avatar
      Merge branch 'mana-shared' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · cf157f33
      Jakub Kicinski authored
      Leon Romanovsky says:
      
      ====================
      net: mana: Allow variable size indirection table
      
      Like we talked, I created new shared branch for this patch:
      https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/log/?h=mana-shared
      
      * 'mana-shared' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        net: mana: Allow variable size indirection table
      ====================
      
      Link: https://lore.kernel.org/all/20240612183051.GE4966@unrealSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      cf157f33
    • Jakub Kicinski's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 4c7d3d79
      Jakub Kicinski authored
      Cross-merge networking fixes after downstream PR.
      
      No conflicts, no adjacent changes.
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      4c7d3d79
    • Linus Torvalds's avatar
      Merge tag 'net-6.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · d20f6b3d
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Including fixes from bluetooth and netfilter.
      
        Slim pickings this time, probably a combination of summer, DevConf.cz,
        and the end of first half of the year at corporations.
      
        Current release - regressions:
      
         - Revert "igc: fix a log entry using uninitialized netdev", it traded
           lack of netdev name in a printk() for a crash
      
        Previous releases - regressions:
      
         - Bluetooth: L2CAP: fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
      
         - geneve: fix incorrectly setting lengths of inner headers in the
           skb, confusing the drivers and causing mangled packets
      
         - sched: initialize noop_qdisc owner to avoid false-positive
           recursion detection (recursing on CPU 0), which bubbles up to user
           space as a sendmsg() error, while noop_qdisc should silently drop
      
         - netdevsim: fix backwards compatibility in nsim_get_iflink()
      
        Previous releases - always broken:
      
         - netfilter: ipset: fix race between namespace cleanup and gc in the
           list:set type"
      
      * tag 'net-6.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (35 commits)
        bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send()
        af_unix: Read with MSG_PEEK loops if the first unread byte is OOB
        bnxt_en: Cap the size of HWRM_PORT_PHY_QCFG forwarded response
        gve: Clear napi->skb before dev_kfree_skb_any()
        ionic: fix use after netif_napi_del()
        Revert "igc: fix a log entry using uninitialized netdev"
        net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
        net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state
        net/ipv6: Fix the RT cache flush via sysctl using a previous delay
        net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs parameters
        gve: ignore nonrelevant GSO type bits when processing TSO headers
        net: pse-pd: Use EOPNOTSUPP error code instead of ENOTSUPP
        netfilter: Use flowlabel flow key when re-routing mangled packets
        netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
        netfilter: nft_inner: validate mandatory meta and payload
        tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
        mailmap: map Geliang's new email address
        mptcp: pm: update add_addr counters after connect
        mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID
        mptcp: ensure snd_una is properly initialized on connect
        ...
      d20f6b3d
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-6.10-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · fd88e181
      Linus Torvalds authored
      Pull NFS client fixes from Trond Myklebust:
       "Bugfixes:
         - NFSv4.2: Fix a memory leak in nfs4_set_security_label
         - NFSv2/v3: abort nfs_atomic_open_v23 if the name is too long.
         - NFS: Add appropriate memory barriers to the sillyrename code
         - Propagate readlink errors in nfs_symlink_filler
         - NFS: don't invalidate dentries on transient errors
         - NFS: fix unnecessary synchronous writes in random write workloads
         - NFSv4.1: enforce rootpath check when deciding whether or not to trunk
      
        Other:
         - Change email address for Trond Myklebust due to email server concerns"
      
      * tag 'nfs-for-6.10-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        NFS: add barriers when testing for NFS_FSDATA_BLOCKED
        SUNRPC: return proper error from gss_wrap_req_priv
        NFSv4.1 enforce rootpath check in fs_location query
        NFS: abort nfs_atomic_open_v23 if name is too long.
        nfs: don't invalidate dentries on transient errors
        nfs: Avoid flushing many pages with NFS_FILE_SYNC
        nfs: propagate readlink errors in nfs_symlink_filler
        MAINTAINERS: Change email address for Trond Myklebust
        NFSv4: Fix memory leak in nfs4_set_security_label
      fd88e181
    • Linus Torvalds's avatar
      Merge tag 'fixes-2024-06-13' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock · 3572597c
      Linus Torvalds authored
      Pull memblock fixes from Mike Rapoport:
       "Fix validation of NUMA coverage.
      
        memblock_validate_numa_coverage() was checking for a unset node ID
        using NUMA_NO_NODE, but x86 used MAX_NUMNODES when no node ID was
        specified by buggy firmware.
      
        Update memblock to substitute MAX_NUMNODES with NUMA_NO_NODE in
        memblock_set_node() and use NUMA_NO_NODE in x86::numa_init()"
      
      * tag 'fixes-2024-06-13' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:
        x86/mm/numa: Use NUMA_NO_NODE when calling memblock_set_node()
        memblock: make memblock_set_node() also warn about use of MAX_NUMNODES
      3572597c
    • Aleksandr Mishin's avatar
      bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() · a9b97418
      Aleksandr Mishin authored
      In case of token is released due to token->state == BNXT_HWRM_DEFERRED,
      released token (set to NULL) is used in log messages. This issue is
      expected to be prevented by HWRM_ERR_CODE_PF_UNAVAILABLE error code. But
      this error code is returned by recent firmware. So some firmware may not
      return it. This may lead to NULL pointer dereference.
      Adjust this issue by adding token pointer check.
      
      Found by Linux Verification Center (linuxtesting.org) with SVACE.
      
      Fixes: 8fa4219d ("bnxt_en: add dynamic debug support for HWRM messages")
      Suggested-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarAleksandr Mishin <amishin@t-argos.ru>
      Reviewed-by: default avatarWojciech Drewek <wojciech.drewek@intel.com>
      Reviewed-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Link: https://lore.kernel.org/r/20240611082547.12178-1-amishin@t-argos.ruSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      a9b97418
    • Rao Shoaib's avatar
      af_unix: Read with MSG_PEEK loops if the first unread byte is OOB · a6736a0a
      Rao Shoaib authored
      Read with MSG_PEEK flag loops if the first byte to read is an OOB byte.
      commit 22dd70eb ("af_unix: Don't peek OOB data without MSG_OOB.")
      addresses the loop issue but does not address the issue that no data
      beyond OOB byte can be read.
      
      >>> from socket import *
      >>> c1, c2 = socketpair(AF_UNIX, SOCK_STREAM)
      >>> c1.send(b'a', MSG_OOB)
      1
      >>> c1.send(b'b')
      1
      >>> c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
      b'b'
      
      >>> from socket import *
      >>> c1, c2 = socketpair(AF_UNIX, SOCK_STREAM)
      >>> c2.setsockopt(SOL_SOCKET, SO_OOBINLINE, 1)
      >>> c1.send(b'a', MSG_OOB)
      1
      >>> c1.send(b'b')
      1
      >>> c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
      b'a'
      >>> c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
      b'a'
      >>> c2.recv(1, MSG_DONTWAIT)
      b'a'
      >>> c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
      b'b'
      >>>
      
      Fixes: 314001f0 ("af_unix: Add OOB support")
      Signed-off-by: default avatarRao Shoaib <Rao.Shoaib@oracle.com>
      Reviewed-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
      Link: https://lore.kernel.org/r/20240611084639.2248934-1-Rao.Shoaib@oracle.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      a6736a0a
    • Michael Chan's avatar
      bnxt_en: Cap the size of HWRM_PORT_PHY_QCFG forwarded response · 7d9df38c
      Michael Chan authored
      Firmware interface 1.10.2.118 has increased the size of
      HWRM_PORT_PHY_QCFG response beyond the maximum size that can be
      forwarded.  When the VF's link state is not the default auto state,
      the PF will need to forward the response back to the VF to indicate
      the forced state.  This regression may cause the VF to fail to
      initialize.
      
      Fix it by capping the HWRM_PORT_PHY_QCFG response to the maximum
      96 bytes.  The SPEEDS2_SUPPORTED flag needs to be cleared because the
      new speeds2 fields are beyond the legacy structure.  Also modify
      bnxt_hwrm_fwd_resp() to print a warning if the message size exceeds 96
      bytes to make this failure more obvious.
      
      Fixes: 84a911db ("bnxt_en: Update firmware interface to 1.10.2.118")
      Reviewed-by: default avatarSomnath Kotur <somnath.kotur@broadcom.com>
      Reviewed-by: default avatarPavan Chebbi <pavan.chebbi@broadcom.com>
      Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Link: https://lore.kernel.org/r/20240612231736.57823-1-michael.chan@broadcom.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      7d9df38c
    • Ziwei Xiao's avatar
      gve: Clear napi->skb before dev_kfree_skb_any() · 6f4d93b7
      Ziwei Xiao authored
      gve_rx_free_skb incorrectly leaves napi->skb referencing an skb after it
      is freed with dev_kfree_skb_any(). This can result in a subsequent call
      to napi_get_frags returning a dangling pointer.
      
      Fix this by clearing napi->skb before the skb is freed.
      
      Fixes: 9b8dd5e5 ("gve: DQO: Add RX path")
      Cc: stable@vger.kernel.org
      Reported-by: default avatarShailend Chand <shailend@google.com>
      Signed-off-by: default avatarZiwei Xiao <ziweixiao@google.com>
      Reviewed-by: default avatarHarshitha Ramamurthy <hramamurthy@google.com>
      Reviewed-by: default avatarShailend Chand <shailend@google.com>
      Reviewed-by: default avatarPraveen Kaligineedi <pkaligineedi@google.com>
      Link: https://lore.kernel.org/r/20240612001654.923887-1-ziweixiao@google.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      6f4d93b7
    • Taehee Yoo's avatar
      ionic: fix use after netif_napi_del() · 79f18a41
      Taehee Yoo authored
      When queues are started, netif_napi_add() and napi_enable() are called.
      If there are 4 queues and only 3 queues are used for the current
      configuration, only 3 queues' napi should be registered and enabled.
      The ionic_qcq_enable() checks whether the .poll pointer is not NULL for
      enabling only the using queue' napi. Unused queues' napi will not be
      registered by netif_napi_add(), so the .poll pointer indicates NULL.
      But it couldn't distinguish whether the napi was unregistered or not
      because netif_napi_del() doesn't reset the .poll pointer to NULL.
      So, ionic_qcq_enable() calls napi_enable() for the queue, which was
      unregistered by netif_napi_del().
      
      Reproducer:
         ethtool -L <interface name> rx 1 tx 1 combined 0
         ethtool -L <interface name> rx 0 tx 0 combined 1
         ethtool -L <interface name> rx 0 tx 0 combined 4
      
      Splat looks like:
      kernel BUG at net/core/dev.c:6666!
      Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
      CPU: 3 PID: 1057 Comm: kworker/3:3 Not tainted 6.10.0-rc2+ #16
      Workqueue: events ionic_lif_deferred_work [ionic]
      RIP: 0010:napi_enable+0x3b/0x40
      Code: 48 89 c2 48 83 e2 f6 80 b9 61 09 00 00 00 74 0d 48 83 bf 60 01 00 00 00 74 03 80 ce 01 f0 4f
      RSP: 0018:ffffb6ed83227d48 EFLAGS: 00010246
      RAX: 0000000000000000 RBX: ffff97560cda0828 RCX: 0000000000000029
      RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff97560cda0a28
      RBP: ffffb6ed83227d50 R08: 0000000000000400 R09: 0000000000000001
      R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
      R13: ffff97560ce3c1a0 R14: 0000000000000000 R15: ffff975613ba0a20
      FS:  0000000000000000(0000) GS:ffff975d5f780000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007f8f734ee200 CR3: 0000000103e50000 CR4: 00000000007506f0
      PKRU: 55555554
      Call Trace:
       <TASK>
       ? die+0x33/0x90
       ? do_trap+0xd9/0x100
       ? napi_enable+0x3b/0x40
       ? do_error_trap+0x83/0xb0
       ? napi_enable+0x3b/0x40
       ? napi_enable+0x3b/0x40
       ? exc_invalid_op+0x4e/0x70
       ? napi_enable+0x3b/0x40
       ? asm_exc_invalid_op+0x16/0x20
       ? napi_enable+0x3b/0x40
       ionic_qcq_enable+0xb7/0x180 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]
       ionic_start_queues+0xc4/0x290 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]
       ionic_link_status_check+0x11c/0x170 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]
       ionic_lif_deferred_work+0x129/0x280 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]
       process_one_work+0x145/0x360
       worker_thread+0x2bb/0x3d0
       ? __pfx_worker_thread+0x10/0x10
       kthread+0xcc/0x100
       ? __pfx_kthread+0x10/0x10
       ret_from_fork+0x2d/0x50
       ? __pfx_kthread+0x10/0x10
       ret_from_fork_asm+0x1a/0x30
      
      Fixes: 0f3154e6 ("ionic: Add Tx and Rx handling")
      Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Reviewed-by: default avatarBrett Creeley <brett.creeley@amd.com>
      Reviewed-by: default avatarShannon Nelson <shannon.nelson@amd.com>
      Link: https://lore.kernel.org/r/20240612060446.1754392-1-ap420073@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      79f18a41