- 16 Jan, 2021 3 commits
-
-
Eric Dumazet authored
syzbot report reminded us that very big ewma_log were supported in the past, even if they made litle sense. tc qdisc replace dev xxx root est 1sec 131072sec ... While fixing the bug, also add boundary checks for ewma_log, in line with range supported by iproute2. UBSAN: shift-out-of-bounds in net/core/gen_estimator.c:83:38 shift exponent -1 is negative CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395 est_timer.cold+0xbb/0x12d net/core/gen_estimator.c:83 call_timer_fn+0x1a5/0x710 kernel/time/timer.c:1417 expire_timers kernel/time/timer.c:1462 [inline] __run_timers.part.0+0x692/0xa80 kernel/time/timer.c:1731 __run_timers kernel/time/timer.c:1712 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1744 __do_softirq+0x2bc/0xa77 kernel/softirq.c:343 asm_call_irq_on_stack+0xf/0x20 </IRQ> __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:226 [inline] __irq_exit_rcu+0x17f/0x200 kernel/softirq.c:420 irq_exit_rcu+0x5/0x20 kernel/softirq.c:432 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1096 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628 RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline] RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:79 [inline] RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:169 [inline] RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250 drivers/acpi/processor_idle.c:516 Fixes: 1c0d32fd ("net_sched: gen_estimator: complete rewrite of rate estimators") Signed-off-by:
Eric Dumazet <edumazet@google.com> Reported-by:
syzbot <syzkaller@googlegroups.com> Link: https://lore.kernel.org/r/20210114181929.1717985-1-eric.dumazet@gmail.comSigned-off-by:
Jakub Kicinski <kuba@kernel.org>
-
Eric Dumazet authored
iproute2 probably never goes beyond 8 for the cell exponent, but stick to the max shift exponent for signed 32bit. UBSAN reported: UBSAN: shift-out-of-bounds in net/sched/sch_api.c:389:22 shift exponent 130 is too large for 32-bit type 'int' CPU: 1 PID: 8450 Comm: syz-executor586 Not tainted 5.11.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x183/0x22e lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:148 [inline] __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395 __detect_linklayer+0x2a9/0x330 net/sched/sch_api.c:389 qdisc_get_rtab+0x2b5/0x410 net/sched/sch_api.c:435 cbq_init+0x28f/0x12c0 net/sched/sch_cbq.c:1180 qdisc_create+0x801/0x1470 net/sched/sch_api.c:1246 tc_modify_qdisc+0x9e3/0x1fc0 net/sched/sch_api.c:1662 rtnetlink_rcv_msg+0xb1d/0xe60 net/core/rtnetlink.c:5564 netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2494 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline] netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1330 netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg net/socket.c:672 [inline] ____sys_sendmsg+0x5a2/0x900 net/socket.c:2345 ___sys_sendmsg net/socket.c:2399 [inline] __sys_sendmsg+0x319/0x400 net/socket.c:2432 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 1da177e4 ("Linux-2.6.12-rc2") Signed-off-by:
Cong Wang <cong.wang@bytedance.com> Link: https://lore.kernel.org/r/20210114160637.1660597-1-eric.dumazet@gmail.comSigned-off-by:
-
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfJakub Kicinski authored
Daniel Borkmann says: ==================== pull-request: bpf 2021-01-16 1) Fix a double bpf_prog_put() for BPF_PROG_{TYPE_EXT,TYPE_TRACING} types in link creation's error path causing a refcount underflow, from Jiri Olsa. 2) Fix BTF validation errors for the case where kernel modules don't declare any new types and end up with an empty BTF, from Andrii Nakryiko. 3) Fix BPF local storage helpers to first check their {task,inode} owners for being NULL before access, from KP Singh. 4) Fix a memory leak in BPF setsockopt handling for the case where optlen is zero and thus temporary optval buffer should be freed, from Stanislav Fomichev. 5) Fix a syzbot memory allocation splat in BPF_PROG_TEST_RUN infra for raw_tracepoint caused by too big ctx_size_in, from Song Liu. 6) Fix LLVM code generation issues with verifier where PTR_TO_MEM{,_OR_NULL} registers were spilled to stack but not recognized, from Gilad Reti. * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: MAINTAINERS: Update my email address selftests/bpf: Add verifier test for PTR_TO_MEM spill bpf: Support PTR_TO_MEM{,_OR_NULL} register spilling bpf: Reject too big ctx_size_in for raw_tp test run libbpf: Allow loading empty BTFs bpf: Allow empty module BTFs bpf: Don't leak memory in bpf getsockopt when optlen == 0 bpf: Update local storage test to check handling of null ptrs bpf: Fix typo in bpf_inode_storage.c bpf: Local storage helpers should check nullness of owner ptr passed bpf: Prevent double bpf_prog_put call from bpf_tracing_prog_attach ==================== Link: https://lore.kernel.org/r/20210116002025.15706-1-daniel@iogearbox.netSigned-off-by:
-
- 15 Jan, 2021 3 commits
-
-
Cong Wang authored
fl_set_enc_opt() simply checks if there are still bytes left to parse, but this is not sufficent as syzbot seems to be able to generate malformatted netlink messages. nla_ok() is more strict so should be used to validate the next nlattr here. And nla_validate_nested_deprecated() has less strict check too, it is probably too late to switch to the strict version, but we can just call nla_ok() too after it. Reported-and-tested-by: syzbot+2624e3778b18fc497c92@syzkaller.appspotmail.com Fixes: 0a6e7778 ("net/sched: allow flower to match tunnel options") Fixes: 79b1011c ("net: sched: allow flower to match erspan options") Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Xin Long <lucien.xin@gmail.com> Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by:
-
Björn Töpel authored
My Intel email will stop working in a not too distant future. Move my MAINTAINERS entries to my kernel.org address. Signed-off-by:
Björn Töpel <bjorn@kernel.org> Signed-off-by:
Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20210115104337.7751-1-bjorn.topel@gmail.com
-
Yingjie Wang authored
In rvu_mbox_handler_cgx_mac_addr_get() and rvu_mbox_handler_cgx_mac_addr_set(), the msg is expected only from PFs that are mapped to CGX LMACs. It should be checked before mapping, so we add the is_cgx_config_permitted() in the functions. Fixes: 96be2e0d ("octeontx2-af: Support for MAC address filters in CGX") Signed-off-by:
Yingjie Wang <wangyingjie55@126.com> Reviewed-by: Geetha sowjanya<gakula@marvell.com> Link: https://lore.kernel.org/r/1610719804-35230-1-git-send-email-wangyingjie55@126.comSigned-off-by:
-
- 14 Jan, 2021 27 commits
-
-
Linus Torvalds authored
Merge tag 'linux-kselftest-fixes-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: "One single fix to skip BPF selftests by default. BPF selftests have a hard dependency on cutting edge versions of tools in the BPF ecosystem including LLVM. Skipping BPF allows by default will make it easier for users interested in running kselftest as a whole. Users can include BPF in Kselftest build by via SKIP_TARGETS variable" * tag 'linux-kselftest-fixes-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: Skip BPF seftests by default
-
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netLinus Torvalds authored
Pull networking fixes from Jakub Kicinski: "We have a few fixes for long standing issues, in particular Eric's fix to not underestimate the skb sizes, and my fix for brokenness of register_netdevice() error path. They may uncover other bugs so we will keep an eye on them. Also included are Willem's fixes for kmap(_atomic). Looking at the "current release" fixes, it seems we are about one rc behind a normal cycle. We've previously seen an uptick of "people had run their test suites" / "humans actually tried to use new features" fixes between rc2 and rc3. Summary: Current release - regressions: - fix feature enforcement to allow NETIF_F_HW_TLS_TX if IP_CSUM && IPV6_CSUM - dcb: accept RTM_GETDCB messages carrying set-like DCB commands if user is admin for backward-compatibility - selftests/tls: fix selftests build after adding ChaCha20-Poly1305 Current release - always broken: - ppp: fix refcount underflow on channel unbridge - bnxt_en: clear DEFRAG flag in firmware message when retry flashing - smc: fix out of bound access in the new netlink interface Previous releases - regressions: - fix use-after-free with UDP GRO by frags - mptcp: better msk-level shutdown - rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request - i40e: xsk: fix potential NULL pointer dereferencing Previous releases - always broken: - skb frag: kmap_atomic fixes - avoid 32 x truesize under-estimation for tiny skbs - fix issues around register_netdevice() failures - udp: prevent reuseport_select_sock from reading uninitialized socks - dsa: unbind all switches from tree when DSA master unbinds - dsa: clear devlink port type before unregistering slave netdevs - can: isotp: isotp_getname(): fix kernel information leak - mlxsw: core: Thermal control fixes - ipv6: validate GSO SKB against MTU before finish IPv6 processing - stmmac: use __napi_schedule() for PREEMPT_RT - net: mvpp2: remove Pause and Asym_Pause support Misc: - remove from MAINTAINERS folks who had been inactive for >5yrs" * tag 'net-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (58 commits) mptcp: fix locking in mptcp_disconnect() net: Allow NETIF_F_HW_TLS_TX if IP_CSUM && IPV6_CSUM MAINTAINERS: dccp: move Gerrit Renker to CREDITS MAINTAINERS: ipvs: move Wensong Zhang to CREDITS MAINTAINERS: tls: move Aviad to CREDITS MAINTAINERS: ena: remove Zorik Machulsky from reviewers MAINTAINERS: vrf: move Shrijeet to CREDITS MAINTAINERS: net: move Alexey Kuznetsov to CREDITS MAINTAINERS: altx: move Jay Cliburn to CREDITS net: avoid 32 x truesize under-estimation for tiny skbs nt: usb: USB_RTL8153_ECM should not default to y net: stmmac: fix taprio configuration when base_time is in the past net: stmmac: fix taprio schedule configuration net: tip: fix a couple kernel-doc markups net: sit: unregister_netdevice on newlink's error path net: stmmac: Fixed mtu channged by cache aligned cxgb4/chtls: Fix tid stuck due to wrong update of qid i40e: fix potential NULL pointer dereferencing net: stmmac: use __napi_schedule() for PREEMPT_RT can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check ... -
Paolo Abeni authored
tcp_disconnect() expects the caller acquires the sock lock, but mptcp_disconnect() is not doing that. Add the missing required lock. Reported-by:
Eric Dumazet <eric.dumazet@gmail.com> Fixes: 76e2a55d ("mptcp: better msk-level shutdown.") Signed-off-by:
Paolo Abeni <pabeni@redhat.com> Link: https://lore.kernel.org/r/f818e82b58a556feeb71dcccc8bf1c87aafc6175.1610638176.git.pabeni@redhat.comSigned-off-by:
-
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hidLinus Torvalds authored
Pull HID fixes from Jiri Kosina: - memory leak fix for Wacom driver (Ping Cheng) - various trivial small fixes, cleanups and device ID additions * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: logitech-hidpp: Add product ID for MX Ergo in Bluetooth mode HID: Ignore battery for Elan touchscreen on ASUS UX550 HID: logitech-dj: add the G602 receiver HID: wiimote: remove h from printk format specifier HID: uclogic: remove h from printk format specifier HID: sony: select CONFIG_CRC32 HID: sfh: fix address space confusion HID: multitouch: Enable multi-input for Synaptics pointstick/touchpad device HID: wacom: Fix memory leakage caused by kfifo_alloc
-
Tariq Toukan authored
Cited patch below blocked the TLS TX device offload unless HW_CSUM is set. This broke devices that use IP_CSUM && IP6_CSUM. Here we fix it. Note that the single HW_TLS_TX feature flag indicates support for both IPv4/6, hence it should still be disabled in case only one of (IP_CSUM | IPV6_CSUM) is set. Fixes: ae0b04b2 ("net: Disable NETIF_F_HW_TLS_TX when HW_CSUM is disabled") Signed-off-by:
Tariq Toukan <tariqt@nvidia.com> Reported-by:
Rohit Maheshwari <rohitm@chelsio.com> Reviewed-by:
Maxim Mikityanskiy <maximmi@mellanox.com> Link: https://lore.kernel.org/r/20210114151215.7061-1-tariqt@nvidia.comSigned-off-by:
-
Jakub Kicinski authored
To make maintainers' lives easier we're trying to nudge people towards CCing all the relevant folks on patches, in an attempt to improve review rate. We have a check in patchwork which validates the CC list against get_maintainers.pl. It's a little awkward, however, to force people to CC maintainers who we haven't seen on the mailing list for years. This series removes from maintainers folks who didn't provide any tag (incl. authoring a patch) in the last 5 years. To ensure reasonable signal to noise ratio we only considered MAINTAINERS entries which had more than 100 patches fall under them in that time period. All this is purely a process-greasing exercise, I hope nobody sees this series as an affront. Most folks are moved to CREDITS, a couple entries are simply removed. The following inactive maintainers are kept, because they indicated the intention to come back in the near future: - Veaceslav Falico (bonding) - Christian Benvenuti (Cisco drivers) - Felix Fietkau (mtk-eth) - Mirko Linder (skge/sky2) Patches in this series contain report from a script which did the analysis. Big thanks to Jonathan Corbet for help and writing the script (although I feel like I used it differently than Jon may have intended ;)). The output format is thus: Subsystem $name Changes $reviewed / $total ($percent%) // how many changes to the subsystem had at least one ack/review Last activity: $date_of_most_recent_patch $maintainer/reviewer1: Author $last_commit_authored_by_the_person $how_many_in_5yrs Committer $last_committed $how_many Tags $last_tag_like_review_signoff_etc $how_many $maintainer/reviewer2: Author $last_commit_authored_by_the_person $how_many_in_5yrs Committer $last_committed $how_many Tags $last_tag_like_review_signoff_etc $how_many Top reviewers: // Top 3 reviewers (who are not listed in MAINTAINERS) [$count_of_reviews_and_acks]: $email INACTIVE MAINTAINER $name // maintainer / reviewer who has done nothing in last 5yrs v2: - keep Felix and Mirko Link: https://lore.kernel.org/r/20210114014912.2519931-1-kuba@kernel.orgSigned-off-by: -
Jakub Kicinski authored
As far as I can tell we haven't heard from Gerrit for roughly 5 years now. DCCP patch would really benefit from some review. Gerrit was the last maintainer so mark this entry as orphaned. Subsystem DCCP PROTOCOL Changes 38 / 166 (22%) (No activity) Top reviewers: [6]: kstewart@linuxfoundation.org [6]: allison@lohutok.net [5]: edumazet@google.com INACTIVE MAINTAINER Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: -
Jakub Kicinski authored
Move Wensong Zhang to credits, we haven't heard from him in years. Subsystem IPVS Changes 83 / 226 (36%) Last activity: 2020-11-27 Wensong Zhang <wensong@linux-vs.org>: Simon Horman <horms@verge.net.au>: Committer c24b75e0 2019-10-24 00:00:00 33 Tags 7980d2ea 2020-10-12 00:00:00 76 Julian Anastasov <ja@ssi.bg>: Author 7980d2ea 2020-10-12 00:00:00 26 Tags 4bc3c8dc 2020-11-27 00:00:00 78 Top reviewers: [6]: horms+renesas@verge.net.au INACTIVE MAINTAINER Wensong Zhang <wensong@linux-vs.org> Signed-off-by: -
Jakub Kicinski authored
Aviad wrote parts of the initial TLS implementation but hasn't been contributing to TLS since. Subsystem NETWORKING [TLS] Changes 123 / 308 (39%) Last activity: 2020-12-01 Boris Pismenny <borisp@nvidia.com>: Tags 138559b9 2020-11-17 00:00:00 1 Aviad Yehezkel <aviadye@nvidia.com>: John Fastabend <john.fastabend@gmail.com>: Author e91de6af 2020-06-01 00:00:00 22 Tags e91de6af 2020-06-01 00:00:00 29 Daniel Borkmann <daniel@iogearbox.net>: Author c16ee04c 2018-10-20 00:00:00 7 Committer b8e202d1 2020-02-21 00:00:00 19 Tags b8e202d1 2020-02-21 00:00:00 28 Jakub Kicinski <kuba@kernel.org>: Author 5c39f26e 2020-11-27 00:00:00 89 Committer d31c0800 2020-12-01 00:00:00 15 Tags d31c0800 2020-12-01 00:00:00 117 Top reviewers: [50]: dirk.vandermerwe@netronome.com [26]: simon.horman@netronome.com [14]: john.hurley@netronome.com INACTIVE MAINTAINER Aviad Yehezkel <aviadye@nvidia.com> Signed-off-by: -
Jakub Kicinski authored
While ENA has 3 reviewers and 2 maintainers, we mostly see review tags and comments from the maintainers. While we very much appreciate Zorik's invovment in the community let's trim the reviewer list down to folks we've seen tags from. Subsystem AMAZON ETHERNET DRIVERS Changes 13 / 269 (4%) Last activity: 2020-11-24 Netanel Belgazal <netanel@amazon.com>: Author 24dee0c7 2019-12-10 00:00:00 43 Tags 0e3a3f6d 2020-07-21 00:00:00 47 Arthur Kiyanovski <akiyano@amazon.com>: Author 0e3a3f6d 2020-07-21 00:00:00 79 Tags 09323b3b 2020-11-24 00:00:00 104 Guy Tzalik <gtzalik@amazon.com>: Tags 713865da 2020-09-10 00:00:00 3 Saeed Bishara <saeedb@amazon.com>: Tags 470793a7 2020-02-11 00:00:00 2 Zorik Machulsky <zorik@amazon.com>: Top reviewers: [4]: sameehj@amazon.com [3]: snelson@pensando.io [3]: shayagr@amazon.com INACTIVE MAINTAINER Zorik Machulsky <zorik@amazon.com> Signed-off-by: -
Jakub Kicinski authored
Shrijeet has moved on from VRF-related work. Subsystem VRF Changes 30 / 120 (25%) Last activity: 2020-12-09 David Ahern <dsahern@kernel.org>: Author 1b6687e3 2020-07-23 00:00:00 1 Tags 9125abe7 2020-12-09 00:00:00 4 Shrijeet Mukherjee <shrijeet@gmail.com>: Top reviewers: [13]: dsahern@gmail.com [4]: dsa@cumulusnetworks.com INACTIVE MAINTAINER Shrijeet Mukherjee <shrijeet@gmail.com> Signed-off-by: -
Jakub Kicinski authored
Move Alexey to CREDITS. I am probably not giving him enough justice with the description line.. Subsystem NETWORKING [IPv4/IPv6] Changes 1535 / 5111 (30%) Last activity: 2020-12-10 "David S. Miller" <davem@davemloft.net>: Author b7e4ba9a 2020-12-09 00:00:00 407 Committer e0fecb28 2020-12-10 00:00:00 3992 Tags e0fecb28 2020-12-10 00:00:00 3978 Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>: Tags d5d8760b 2016-06-16 00:00:00 8 Top reviewers: [225]: edumazet@google.com [222]: dsahern@gmail.com [176]: ncardwell@google.com INACTIVE MAINTAINER Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Signed-off-by: -
Jakub Kicinski authored
Jay was not active in recent years and does not have plans to return to work on ATLX drivers. Subsystem ATLX ETHERNET DRIVERS Changes 20 / 116 (17%) Last activity: 2020-02-24 Jay Cliburn <jcliburn@gmail.com>: Chris Snook <chris.snook@gmail.com>: Tags ea973742 2020-02-24 00:00:00 1 Top reviewers: [4]: andrew@lunn.ch [2]: kuba@kernel.org [2]: o.rempel@pengutronix.de INACTIVE MAINTAINER Jay Cliburn <jcliburn@gmail.com> Acked-by:Chris Snook <chris.snook@gmail.com> Signed-off-by:
-
Eric Dumazet authored
Both virtio net and napi_get_frags() allocate skbs with a very small skb->head While using page fragments instead of a kmalloc backed skb->head might give a small performance improvement in some cases, there is a huge risk of under estimating memory usage. For both GOOD_COPY_LEN and GRO_MAX_HEAD, we can fit at least 32 allocations per page (order-3 page in x86), or even 64 on PowerPC We have been tracking OOM issues on GKE hosts hitting tcp_mem limits but consuming far more memory for TCP buffers than instructed in tcp_mem[2] Even if we force napi_alloc_skb() to only use order-0 pages, the issue would still be there on arches with PAGE_SIZE >= 32768 This patch makes sure that small skb head are kmalloc backed, so that other objects in the slab page can be reused instead of being held as long as skbs are sitting in socket queues. Note that we might in the future use the sk_buff napi cache, instead of going through a more expensive __alloc_skb() Another idea would be to use separate page sizes depending on the allocated length (to never have more than 4 frags per page) I would like to thank Greg Thelen for his precious help on this matter, analysing crash dumps is always a time consuming task. Fixes: fd11a83d ("net: Pull out core bits of __netdev_alloc_skb and add __napi_alloc_skb") Signed-off-by:
Alexander Duyck <alexanderduyck@fb.com> Acked-by:
Michael S. Tsirkin <mst@redhat.com> Link: https://lore.kernel.org/r/20210113161819.1155526-1-eric.dumazet@gmail.comSigned-off-by:
-
Geert Uytterhoeven authored
In general, device drivers should not be enabled by default. Fixes: 657bc1d1 ("r8153_ecm: avoid to be prior to r8152 driver") Signed-off-by:
Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20210113144309.1384615-1-geert+renesas@glider.beSigned-off-by:
-
Yannick Vignon authored
The Synopsys TSN MAC supports Qbv base times in the past, but only up to a certain limit. As a result, a taprio qdisc configuration with a small base time (for example when treating the base time as a simple phase offset) is not applied by the hardware and silently ignored. This was observed on an NXP i.MX8MPlus device, but likely affects all TSN-variants of the MAC. Fix the issue by making sure the base time is in the future, pushing it by an integer amount of cycle times if needed. (a similar check is already done in several other taprio implementations, see for example drivers/net/ethernet/intel/igc/igc_tsn.c#L116 or drivers/net/dsa/sja1105/sja1105_ptp.h#L39). Fixes: b60189e0 ("net: stmmac: Integrate EST with TAPRIO scheduler API") Signed-off-by:
Yannick Vignon <yannick.vignon@nxp.com> Link: https://lore.kernel.org/r/20210113131557.24651-2-yannick.vignon@oss.nxp.comSigned-off-by:
-
Yannick Vignon authored
When configuring a 802.1Qbv schedule through the tc taprio qdisc on an NXP i.MX8MPlus device, the effective cycle time differed from the requested one by N*96ns, with N number of entries in the Qbv Gate Control List. This is because the driver was adding a 96ns margin to each interval of the GCL, apparently to account for the IPG. The problem was observed on NXP i.MX8MPlus devices but likely affected all devices relying on the same configuration callback (dwmac 4.00, 4.10, 5.10 variants). Fix the issue by removing the margins, and simply setup the MAC with the provided cycle time value. This is the behavior expected by the user-space API, as altering the Qbv schedule timings would break standards conformance. This is also the behavior of several other Ethernet MAC implementations supporting taprio, including the dwxgmac variant of stmmac. Fixes: 504723af ("net: stmmac: Add basic EST support for GMAC5+") Signed-off-by:
-
Mauro Carvalho Chehab authored
A function has a different name between their prototype and its kernel-doc markup: ../net/tipc/link.c:2551: warning: expecting prototype for link_reset_stats(). Prototype was for tipc_link_reset_stats() instead ../net/tipc/node.c:1678: warning: expecting prototype for is the general link level function for message sending(). Prototype was for tipc_node_xmit() instead Signed-off-by:
Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Acked-by:
Jon Maloy <jmaloy@redhat.com> Signed-off-by:
-
Jakub Kicinski authored
We need to unregister the netdevice if config failed. .ndo_uninit takes care of most of the heavy lifting. This was uncovered by recent commit c269a24c ("net: make free_netdev() more lenient with unregistering devices"). Previously the partially-initialized device would be left in the system. Reported-and-tested-by: syzbot+2393580080a2da190f04@syzkaller.appspotmail.com Fixes: e2f1f072 ("sit: allow to configure 6rd tunnels via netlink") Acked-by:
Nicolas Dichtel <nicolas.dichtel@6wind.com> Link: https://lore.kernel.org/r/20210114012947.2515313-1-kuba@kernel.orgSigned-off-by:
-
Nicholas Miell authored
The Logitech MX Ergo trackball supports HID++ 4.5 over Bluetooth. Add its product ID to the table so we can get battery monitoring support. (The hid-logitech-hidpp driver already recognizes it when connected via a Unifying Receiver.) [jkosina@suse.cz: fix whitespace damage] Signed-off-by:
Nicholas Miell <nmiell@gmail.com> Reviewed-by:
Hans de Goede <hdegoede@redhat.com> Signed-off-by:
Jiri Kosina <jkosina@suse.cz>
-
David Wu authored
Since the original mtu is not used when the mtu is updated, the mtu is aligned with cache, this will get an incorrect. For example, if you want to configure the mtu to be 1500, but mtu 1536 is configured in fact. Fixed: eaf4fac4 ("net: stmmac: Do not accept invalid MTU values") Signed-off-by:
David Wu <david.wu@rock-chips.com> Link: https://lore.kernel.org/r/20210113034109.27865-1-david.wu@rock-chips.comSigned-off-by:
-
Gilad Reti authored
Add a test to check that the verifier is able to recognize spilling of PTR_TO_MEM registers, by reserving a ringbuf buffer, forcing the spill of a pointer holding the buffer address to the stack, filling it back in from the stack and writing to the memory area pointed by it. The patch was partially contributed by CyberArk Software, Inc. Signed-off-by:
Gilad Reti <gilad.reti@gmail.com> Signed-off-by:
Alexei Starovoitov <ast@kernel.org> Acked-by:
Yonghong Song <yhs@fb.com> Acked-by:
KP Singh <kpsingh@kernel.org> Link: https://lore.kernel.org/bpf/20210113053810.13518-2-gilad.reti@gmail.com
-
Gilad Reti authored
Add support for pointer to mem register spilling, to allow the verifier to track pointers to valid memory addresses. Such pointers are returned for example by a successful call of the bpf_ringbuf_reserve helper. The patch was partially contributed by CyberArk Software, Inc. Fixes: 457f4436 ("bpf: Implement BPF ring buffer and verifier support for it") Suggested-by:
-
Ayush Sawal authored
TID stuck is seen when there is a race in CPL_PASS_ACCEPT_RPL/CPL_ABORT_REQ and abort is arriving before the accept reply, which sets the queue number. In this case HW ends up sending CPL_ABORT_RPL_RSS to an incorrect ingress queue. V1->V2: - Removed the unused variable len in chtls_set_quiesce_ctrl(). V2->V3: - As kfree_skb() has a check for null skb, so removed this check before calling kfree_skb() in func chtls_send_reset(). Fixes: cc35c88a ("crypto : chtls - CPL handler definition") Signed-off-by:
Ayush Sawal <ayush.sawal@chelsio.com> Link: https://lore.kernel.org/r/20210112053600.24590-1-ayush.sawal@chelsio.comSigned-off-by:
-
Cristian Dumitrescu authored
Currently, the function i40e_construct_skb_zc only frees the input xdp buffer when the output skb is successfully built. On error, the function i40e_clean_rx_irq_zc does not commit anything for the current packet descriptor and simply exits the packet descriptor processing loop, with the plan to restart the processing of this descriptor on the next invocation. Therefore, on error the ring next-to-clean pointer should not advance, the xdp i.e. *bi buffer should not be freed and the current buffer info should not be invalidated by setting *bi to NULL. Therefore, the *bi should only be set to NULL when the function i40e_construct_skb_zc is successful, otherwise a NULL *bi will be dereferenced when the work for the current descriptor is eventually restarted. Fixes: 3b4f0b66 ("i40e, xsk: Migrate to new MEM_TYPE_XSK_BUFF_POOL") Signed-off-by:
Cristian Dumitrescu <cristian.dumitrescu@intel.com> Acked-by:
Björn Töpel <bjorn.topel@intel.com> Link: https://lore.kernel.org/r/20210111181138.49757-1-cristian.dumitrescu@intel.comSigned-off-by:
-
Song Liu authored
syzbot reported a WARNING for allocating too big memory: WARNING: CPU: 1 PID: 8484 at mm/page_alloc.c:4976 __alloc_pages_nodemask+0x5f8/0x730 mm/page_alloc.c:5011 Modules linked in: CPU: 1 PID: 8484 Comm: syz-executor862 Not tainted 5.11.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__alloc_pages_nodemask+0x5f8/0x730 mm/page_alloc.c:4976 Code: 00 00 0c 00 0f 85 a7 00 00 00 8b 3c 24 4c 89 f2 44 89 e6 c6 44 24 70 00 48 89 6c 24 58 e8 d0 d7 ff ff 49 89 c5 e9 ea fc ff ff <0f> 0b e9 b5 fd ff ff 89 74 24 14 4c 89 4c 24 08 4c 89 74 24 18 e8 RSP: 0018:ffffc900012efb10 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff9200025df66 RCX: 0000000000000000 RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000140dc0 RBP: 0000000000140dc0 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff81b1f7e1 R11: 0000000000000000 R12: 0000000000000014 R13: 0000000000000014 R14: 0000000000000000 R15: 0000000000000000 FS: 000000000190c880(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f08b7f316c0 CR3: 0000000012073000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: alloc_pages_current+0x18c/0x2a0 mm/mempolicy.c:2267 alloc_pages include/linux/gfp.h:547 [inline] kmalloc_order+0x2e/0xb0 mm/slab_common.c:837 kmalloc_order_trace+0x14/0x120 mm/slab_common.c:853 kmalloc include/linux/slab.h:557 [inline] kzalloc include/linux/slab.h:682 [inline] bpf_prog_test_run_raw_tp+0x4b5/0x670 net/bpf/test_run.c:282 bpf_prog_test_run kernel/bpf/syscall.c:3120 [inline] __do_sys_bpf+0x1ea9/0x4f10 kernel/bpf/syscall.c:4398 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x440499 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffe1f3bfb18 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440499 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401ca0 R13: 0000000000401d30 R14: 0000000000000000 R15: 0000000000000000 This is because we didn't filter out too big ctx_size_in. Fix it by rejecting ctx_size_in that are bigger than MAX_BPF_FUNC_ARGS (12) u64 numbers. Fixes: 1b4d60ec ("bpf: Enable BPF_PROG_TEST_RUN for raw_tracepoint") Reported-by: syzbot+4f98876664c7337a4ae6@syzkaller.appspotmail.com Signed-off-by:
Song Liu <songliubraving@fb.com> Signed-off-by:
-
Jakub Kicinski authored
Merge tag 'linux-can-fixes-for-5.11-20210113' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2021-01-13 The first patch is by Oliver Hartkopp for the CAn ISO-TP protocol and fixes a kernel information leak to userspace. The last patch is by Qinglang Miao for the mcp251xfd driver and fixes a NULL pointer check to work on the correct variable. * tag 'linux-can-fixes-for-5.11-20210113' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check can: isotp: isotp_getname(): fix kernel information leak ==================== Link: https://lore.kernel.org/r/20210113212158.925513-1-mkl@pengutronix.deSigned-off-by:
-
- 13 Jan, 2021 7 commits
-
-
Seb Laveze authored
Use of __napi_schedule_irqoff() is not safe with PREEMPT_RT in which hard interrupts are not disabled while running the threaded interrupt. Using __napi_schedule() works for both PREEMPT_RT and mainline Linux, just at the cost of an additional check if interrupts are disabled for mainline (since they are already disabled). Similar to the fix done for enetc commit 215602a8 ("enetc: use napi_schedule to be compatible with PREEMPT_RT") Signed-off-by:
Seb Laveze <sebastien.laveze@nxp.com> Link: https://lore.kernel.org/r/20210112140121.1487619-1-sebastien.laveze@oss.nxp.comSigned-off-by:
-
Qinglang Miao authored
If alloc_canfd_skb() returns NULL, 'cfg' is an uninitialized variable, so we should check 'skb' rather than 'cfd' after calling alloc_canfd_skb(priv->ndev, &cfd). Fixes: 55e5b97f ("can: mcp25xxfd: add driver for Microchip MCP25xxFD SPI CAN") Signed-off-by:
Qinglang Miao <miaoqinglang@huawei.com> Reviewed-by:
Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Link: https://lore.kernel.org/r/20210113073100.79552-1-miaoqinglang@huawei.comSigned-off-by:
Marc Kleine-Budde <mkl@pengutronix.de>
-
Oliver Hartkopp authored
Initialize the sockaddr_can structure to prevent a data leak to user space. Suggested-by:
Cong Wang <xiyou.wangcong@gmail.com> Reported-by: syzbot+057884e2f453e8afebc8@syzkaller.appspotmail.com Fixes: e057dd3f ("can: add ISO 15765-2:2016 transport protocol") Signed-off-by:
Oliver Hartkopp <socketcan@hartkopp.net> Link: https://lore.kernel.org/r/20210112091643.11789-1-socketcan@hartkopp.netSigned-off-by:
-
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/soundLinus Torvalds authored
Pull sound fixes from Takashi Iwai: "Here are some piled fixes, hopefully the last big one for 5.11. All changes are device-specific small fixes, and majority of commits are for ASoC while USB-audio got a bit large changes for addressing the regression for devices with quirks" * tag 'sound-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (31 commits) ALSA: hda/hdmi - enable runtime pm for CI AMD display audio ALSA: firewire-tascam: Fix integer overflow in midi_port_work() ALSA: fireface: Fix integer overflow in transmit_midi_msg() ALSA: hda/tegra: fix tegra-hda on tegra30 soc clk: tegra30: Add hda clock default rates to clock driver ALSA: doc: Fix reference to mixart.rst ALSA: usb-audio: Fix implicit feedback sync setup for Pioneer devices ALSA: usb-audio: Annotate the endpoint index in audioformat ALSA: usb-audio: Avoid unnecessary interface re-setup ALSA: usb-audio: Choose audioformat of a counter-part substream ALSA: usb-audio: Fix the missing endpoints creations for quirks ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines ASoC: AMD Renoir - add DMI entry for Lenovo ThinkPad X395 ASoC: amd: Replacing MSI with Legacy IRQ model ASoC: AMD Renoir - add DMI entry for Lenovo ThinkPad E14 Gen 2 ASoC: meson: axg-tdm-interface: fix loopback ASoC: meson: axg-tdmin: fix axg skew offset ASoC: max98373: don't access volatile registers in bias level off ASoC: rt711: mutex between calibration and power state changes ASoC: Intel: haswell: Add missing pm_ops ...
-
Baptiste Lepers authored
The call state may be changed at any time by the data-ready routine in response to received packets, so if the call state is to be read and acted upon several times in a function, READ_ONCE() must be used unless the call state lock is held. As it happens, we used READ_ONCE() to read the state a few lines above the unmarked read in rxrpc_input_data(), so use that value rather than re-reading it. Fixes: a158bdd3 ("rxrpc: Fix call timeouts") Signed-off-by:
Baptiste Lepers <baptiste.lepers@gmail.com> Signed-off-by:
David Howells <dhowells@redhat.com> Link: https://lore.kernel.org/r/161046715522.2450566.488819910256264150.stgit@warthog.procyon.org.ukSigned-off-by:
-
David Howells authored
Clang static analysis reports the following: net/rxrpc/key.c:657:11: warning: Assigned value is garbage or undefined toksize = toksizes[tok++]; ^ ~~~~~~~~~~~~~~~ rxrpc_read() contains two consecutive loops. The first loop calculates the token sizes and stores the results in toksizes[] and the second one uses the array. When there is an error in identifying the token in the first loop, the token is skipped, no change is made to the toksizes[] array. When the same error happens in the second loop, the token is not skipped. This will cause the toksizes[] array to be out of step and will overrun past the calculated sizes. Fix this by making both loops log a message and return an error in this case. This should only happen if a new token type is incompletely implemented, so it should normally be impossible to trigger this. Fixes: 9a059cd5 ("rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read()") Reported-by:Tom Rix <trix@redhat.com> Signed-off-by:
-
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nfJakub Kicinski authored
Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Pass conntrack -f to specify family in netfilter conntrack helper selftests, from Chen Yi. 2) Honor hashsize modparam from nf_conntrack_buckets sysctl, from Jesper D. Brouer. 3) Fix memleak in nf_nat_init() error path, from Dinghao Liu. * git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf: netfilter: nf_nat: Fix memleak in nf_nat_init netfilter: conntrack: fix reading nf_conntrack_buckets selftests: netfilter: Pass family parameter "-f" to conntrack tool ==================== Link: https://lore.kernel.org/r/20210112222033.9732-1-pablo@netfilter.orgSigned-off-by:
-
