1. 25 Aug, 2022 13 commits
    • Aleksander Jan Bajkowski's avatar
      net: lantiq_xrx200: restore buffer if memory allocation failed · c9c3b177
      Aleksander Jan Bajkowski authored
      In a situation where memory allocation fails, an invalid buffer address
      is stored. When this descriptor is used again, the system panics in the
      build_skb() function when accessing memory.
      
      Fixes: 7ea6cd16 ("lantiq: net: fix duplicated skb in rx descriptor ring")
      Signed-off-by: default avatarAleksander Jan Bajkowski <olek2@wp.pl>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      c9c3b177
    • Aleksander Jan Bajkowski's avatar
      net: lantiq_xrx200: fix lock under memory pressure · c4b6e934
      Aleksander Jan Bajkowski authored
      When the xrx200_hw_receive() function returns -ENOMEM, the NAPI poll
      function immediately returns an error.
      This is incorrect for two reasons:
      * the function terminates without enabling interrupts or scheduling NAPI,
      * the error code (-ENOMEM) is returned instead of the number of received
      packets.
      
      After the first memory allocation failure occurs, packet reception is
      locked due to disabled interrupts from DMA..
      
      Fixes: fe1a5642 ("net: lantiq: Add Lantiq / Intel VRX200 Ethernet driver")
      Signed-off-by: default avatarAleksander Jan Bajkowski <olek2@wp.pl>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      c4b6e934
    • Aleksander Jan Bajkowski's avatar
      net: lantiq_xrx200: confirm skb is allocated before using · c8b04370
      Aleksander Jan Bajkowski authored
      xrx200_hw_receive() assumes build_skb() always works and goes straight
      to skb_reserve(). However, build_skb() can fail under memory pressure.
      
      Add a check in case build_skb() failed to allocate and return NULL.
      
      Fixes: e0155935 ("net: lantiq_xrx200: convert to build_skb")
      Reported-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarAleksander Jan Bajkowski <olek2@wp.pl>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      c8b04370
    • Heiner Kallweit's avatar
      net: stmmac: work around sporadic tx issue on link-up · a3a57bf0
      Heiner Kallweit authored
      This is a follow-up to the discussion in [0]. It seems to me that
      at least the IP version used on Amlogic SoC's sometimes has a problem
      if register MAC_CTRL_REG is written whilst the chip is still processing
      a previous write. But that's just a guess.
      Adding a delay between two writes to this register helps, but we can
      also simply omit the offending second write. This patch uses the second
      approach and is based on a suggestion from Qi Duan.
      Benefit of this approach is that we can save few register writes, also
      on not affected chip versions.
      
      [0] https://www.spinics.net/lists/netdev/msg831526.html
      
      Fixes: bfab27a1 ("stmmac: add the experimental PCI support")
      Suggested-by: default avatarQi Duan <qi.duan@amlogic.com>
      Suggested-by: default avatarJerome Brunet <jbrunet@baylibre.com>
      Signed-off-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
      Link: https://lore.kernel.org/r/e99857ce-bd90-5093-ca8c-8cd480b5a0a2@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      a3a57bf0
    • Jakub Kicinski's avatar
      Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue · ef332fe1
      Jakub Kicinski authored
      Tony Nguyen says:
      
      ====================
      Intel Wired LAN Driver Updates 2022-08-24 (ixgbe, i40e)
      
      This series contains updates to ixgbe and i40e drivers.
      
      Jake stops incorrect resetting of SYSTIME registers when starting
      cyclecounter for ixgbe.
      
      Sylwester corrects a check on source IP address when validating destination
      for i40e.
      
      * '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:
        i40e: Fix incorrect address type for IPv6 flow rules
        ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter
      ====================
      
      Link: https://lore.kernel.org/r/20220824193748.874343-1-anthony.l.nguyen@intel.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      ef332fe1
    • Jakub Kicinski's avatar
      Merge branch 'ionic-bug-fixes' · 92df825a
      Jakub Kicinski authored
      Shannon Nelson says:
      
      ====================
      ionic: bug fixes
      
      These are a couple of maintenance bug fixes for the Pensando ionic
      networking driver.
      
      Mohamed takes care of a "plays well with others" issue where the
      VF spec is a bit vague on VF mac addresses, but certain customers
      have come to expect behavior based on other vendor drivers.
      
      Shannon addresses a couple of corner cases seen in internal
      stress testing.
      ====================
      
      Link: https://lore.kernel.org/r/20220824165051.6185-1-snelson@pensando.ioSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      92df825a
    • R Mohamed Shah's avatar
      ionic: VF initial random MAC address if no assigned mac · 19058be7
      R Mohamed Shah authored
      Assign a random mac address to the VF interface station
      address if it boots with a zero mac address in order to match
      similar behavior seen in other VF drivers.  Handle the errors
      where the older firmware does not allow the VF to set its own
      station address.
      
      Newer firmware will allow the VF to set the station mac address
      if it hasn't already been set administratively through the PF.
      Setting it will also be allowed if the VF has trust.
      
      Fixes: fbb39807 ("ionic: support sr-iov operations")
      Signed-off-by: default avatarR Mohamed Shah <mohamed@pensando.io>
      Signed-off-by: default avatarShannon Nelson <snelson@pensando.io>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      19058be7
    • Shannon Nelson's avatar
      ionic: fix up issues with handling EAGAIN on FW cmds · 0fc4dd45
      Shannon Nelson authored
      In looping on FW update tests we occasionally see the
      FW_ACTIVATE_STATUS command fail while it is in its EAGAIN loop
      waiting for the FW activate step to finsh inside the FW.  The
      firmware is complaining that the done bit is set when a new
      dev_cmd is going to be processed.
      
      Doing a clean on the cmd registers and doorbell before exiting
      the wait-for-done and cleaning the done bit before the sleep
      prevents this from occurring.
      
      Fixes: fbfb8031 ("ionic: Add hardware init and device commands")
      Signed-off-by: default avatarShannon Nelson <snelson@pensando.io>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      0fc4dd45
    • Shannon Nelson's avatar
      ionic: clear broken state on generation change · 9cb9dadb
      Shannon Nelson authored
      There is a case found in heavy testing where a link flap happens just
      before a firmware Recovery event and the driver gets stuck in the
      BROKEN state.  This comes from the driver getting interrupted by a FW
      generation change when coming back up from the link flap, and the call
      to ionic_start_queues() in ionic_link_status_check() fails.  This can be
      addressed by having the fw_up code clear the BROKEN bit if seen, rather
      than waiting for a user to manually force the interface down and then
      back up.
      
      Fixes: 9e8eaf84 ("ionic: stop watchdog when in broken state")
      Signed-off-by: default avatarShannon Nelson <snelson@pensando.io>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      9cb9dadb
    • David Howells's avatar
      rxrpc: Fix locking in rxrpc's sendmsg · b0f571ec
      David Howells authored
      Fix three bugs in the rxrpc's sendmsg implementation:
      
       (1) rxrpc_new_client_call() should release the socket lock when returning
           an error from rxrpc_get_call_slot().
      
       (2) rxrpc_wait_for_tx_window_intr() will return without the call mutex
           held in the event that we're interrupted by a signal whilst waiting
           for tx space on the socket or relocking the call mutex afterwards.
      
           Fix this by: (a) moving the unlock/lock of the call mutex up to
           rxrpc_send_data() such that the lock is not held around all of
           rxrpc_wait_for_tx_window*() and (b) indicating to higher callers
           whether we're return with the lock dropped.  Note that this means
           recvmsg() will not block on this call whilst we're waiting.
      
       (3) After dropping and regaining the call mutex, rxrpc_send_data() needs
           to go and recheck the state of the tx_pending buffer and the
           tx_total_len check in case we raced with another sendmsg() on the same
           call.
      
      Thinking on this some more, it might make sense to have different locks for
      sendmsg() and recvmsg().  There's probably no need to make recvmsg() wait
      for sendmsg().  It does mean that recvmsg() can return MSG_EOR indicating
      that a call is dead before a sendmsg() to that call returns - but that can
      currently happen anyway.
      
      Without fix (2), something like the following can be induced:
      
      	WARNING: bad unlock balance detected!
      	5.16.0-rc6-syzkaller #0 Not tainted
      	-------------------------------------
      	syz-executor011/3597 is trying to release lock (&call->user_mutex) at:
      	[<ffffffff885163a3>] rxrpc_do_sendmsg+0xc13/0x1350 net/rxrpc/sendmsg.c:748
      	but there are no more locks to release!
      
      	other info that might help us debug this:
      	no locks held by syz-executor011/3597.
      	...
      	Call Trace:
      	 <TASK>
      	 __dump_stack lib/dump_stack.c:88 [inline]
      	 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
      	 print_unlock_imbalance_bug include/trace/events/lock.h:58 [inline]
      	 __lock_release kernel/locking/lockdep.c:5306 [inline]
      	 lock_release.cold+0x49/0x4e kernel/locking/lockdep.c:5657
      	 __mutex_unlock_slowpath+0x99/0x5e0 kernel/locking/mutex.c:900
      	 rxrpc_do_sendmsg+0xc13/0x1350 net/rxrpc/sendmsg.c:748
      	 rxrpc_sendmsg+0x420/0x630 net/rxrpc/af_rxrpc.c:561
      	 sock_sendmsg_nosec net/socket.c:704 [inline]
      	 sock_sendmsg+0xcf/0x120 net/socket.c:724
      	 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409
      	 ___sys_sendmsg+0xf3/0x170 net/socket.c:2463
      	 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492
      	 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
      	 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
      	 entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      [Thanks to Hawkins Jiawei and Khalid Masum for their attempts to fix this]
      
      Fixes: bc5e3a54 ("rxrpc: Use MSG_WAITALL to tell sendmsg() to temporarily ignore signals")
      Reported-by: syzbot+7f0483225d0c94cb3441@syzkaller.appspotmail.com
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Reviewed-by: default avatarMarc Dionne <marc.dionne@auristor.com>
      Tested-by: syzbot+7f0483225d0c94cb3441@syzkaller.appspotmail.com
      cc: Hawkins Jiawei <yin31149@gmail.com>
      cc: Khalid Masum <khalid.masum.92@gmail.com>
      cc: Dan Carpenter <dan.carpenter@oracle.com>
      cc: linux-afs@lists.infradead.org
      Link: https://lore.kernel.org/r/166135894583.600315.7170979436768124075.stgit@warthog.procyon.org.ukSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      b0f571ec
    • Lorenzo Bianconi's avatar
      net: ethernet: mtk_eth_soc: fix hw hash reporting for MTK_NETSYS_V2 · 0cf731f9
      Lorenzo Bianconi authored
      Properly report hw rx hash for mt7986 chipset accroding to the new dma
      descriptor layout.
      
      Fixes: 197c9e9b ("net: ethernet: mtk_eth_soc: introduce support for mt7986 chipset")
      Signed-off-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
      Link: https://lore.kernel.org/r/091394ea4e705fbb35f828011d98d0ba33808f69.1661257293.git.lorenzo@kernel.orgSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      0cf731f9
    • Jakub Kicinski's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf · 24c7a64e
      Jakub Kicinski authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      1) Fix crash with malformed ebtables blob which do not provide all
         entry points, from Florian Westphal.
      
      2) Fix possible TCP connection clogging up with default 5-days
         timeout in conntrack, from Florian.
      
      3) Fix crash in nf_tables tproxy with unsupported chains, also from Florian.
      
      4) Do not allow to update implicit chains.
      
      5) Make table handle allocation per-netns to fix data race.
      
      6) Do not truncated payload length and offset, and checksum offset.
         Instead report EINVAl.
      
      7) Enable chain stats update via static key iff no error occurs.
      
      8) Restrict osf expression to ip, ip6 and inet families.
      
      9) Restrict tunnel expression to netdev family.
      
      10) Fix crash when trying to bind again an already bound chain.
      
      11) Flowtable garbage collector might leave behind pending work to
          delete entries. This patch comes with a previous preparation patch
          as dependency.
      
      12) Allow net.netfilter.nf_conntrack_frag6_high_thresh to be lowered,
          from Eric Dumazet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
        netfilter: nf_defrag_ipv6: allow nf_conntrack_frag6_high_thresh increases
        netfilter: flowtable: fix stuck flows on cleanup due to pending work
        netfilter: flowtable: add function to invoke garbage collection immediately
        netfilter: nf_tables: disallow binding to already bound chain
        netfilter: nft_tunnel: restrict it to netdev family
        netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families
        netfilter: nf_tables: do not leave chain stats enabled on error
        netfilter: nft_payload: do not truncate csum_offset and csum_type
        netfilter: nft_payload: report ERANGE for too long offset and length
        netfilter: nf_tables: make table handle allocation per-netns friendly
        netfilter: nf_tables: disallow updates of implicit chain
        netfilter: nft_tproxy: restrict to prerouting hook
        netfilter: conntrack: work around exceeded receive window
        netfilter: ebtables: reject blobs that don't provide all entry points
      ====================
      
      Link: https://lore.kernel.org/r/20220824220330.64283-1-pablo@netfilter.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      24c7a64e
    • Lukas Bulwahn's avatar
      MAINTAINERS: rectify file entry in BONDING DRIVER · b09da012
      Lukas Bulwahn authored
      Commit c078290a ("selftests: include bonding tests into the kselftest
      infra") adds the bonding tests in the directory:
      
        tools/testing/selftests/drivers/net/bonding/
      
      The file entry in MAINTAINERS for the BONDING DRIVER however refers to:
      
        tools/testing/selftests/net/bonding/
      
      Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a
      broken file pattern.
      
      Repair this file entry in BONDING DRIVER.
      Signed-off-by: default avatarLukas Bulwahn <lukas.bulwahn@gmail.com>
      Acked-by: default avatarJonathan Toppins <jtoppins@redhat.com>
      Link: https://lore.kernel.org/r/20220824072945.28606-1-lukas.bulwahn@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      b09da012
  2. 24 Aug, 2022 27 commits