1. 24 Apr, 2020 6 commits
  2. 23 Apr, 2020 25 commits
    • Doug Berger's avatar
      net: bcmgenet: correct per TX/RX ring statistics · a6d0b83f
      Doug Berger authored
      The change to track net_device_stats per ring to better support SMP
      missed updating the rx_dropped member.
      
      The ndo_get_stats method is also needed to combine the results for
      ethtool statistics (-S) before filling in the ethtool structure.
      
      Fixes: 37a30b43 ("net: bcmgenet: Track per TX/RX rings statistics")
      Signed-off-by: default avatarDoug Berger <opendmb@gmail.com>
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a6d0b83f
    • Jonathan Corbet's avatar
      net: meth: remove spurious copyright text · 9d3cdd44
      Jonathan Corbet authored
      Evidently, at some point in the pre-githistorious past,
      drivers/net/ethernet/sgi/meth.h somehow contained some code from the
      "snull" driver from the Linux Device Drivers book.  A comment crediting
      that source, asserting copyright ownership by the LDD authors, and imposing
      the LDD2 license terms was duly added to the file.
      
      Any code that may have been derived from snull is long gone, and the
      distribution terms are not GPL-compatible.  Since the copyright claim is
      not based in fact (if it ever was), simply remove it and the distribution
      terms as well.
      Reported-by: default avatarJan Kiszka <jan.kiszka@siemens.com>
      Acked-by: default avatarAlessandro Rubini <rubini@gnudd.com>
      CC: Ralf Baechle <ralf@linux-mips.org>
      CC: Kate Stewart <kstewart@linuxfoundation.org>
      CC: "Fendt, Oliver" <oliver.fendt@siemens.com>
      Signed-off-by: default avatarJonathan Corbet <corbet@lwn.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9d3cdd44
    • Russell King's avatar
      net: phy: bcm84881: clear settings on link down · 796a8fa2
      Russell King authored
      Clear the link partner advertisement, speed, duplex and pause when
      the link goes down, as other phylib drivers do.  This avoids the
      stale link partner, speed and duplex settings being reported via
      ethtool.
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      796a8fa2
    • Rohit Maheshwari's avatar
      chcr: Fix CPU hard lockup · d97793af
      Rohit Maheshwari authored
      Soft lock should be taken in place of hard lock.
      Signed-off-by: default avatarRohit Maheshwari <rohitm@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d97793af
    • Xiyu Yang's avatar
      net/x25: Fix x25_neigh refcnt leak when receiving frame · f35d1297
      Xiyu Yang authored
      x25_lapb_receive_frame() invokes x25_get_neigh(), which returns a
      reference of the specified x25_neigh object to "nb" with increased
      refcnt.
      
      When x25_lapb_receive_frame() returns, local variable "nb" becomes
      invalid, so the refcount should be decreased to keep refcount balanced.
      
      The reference counting issue happens in one path of
      x25_lapb_receive_frame(). When pskb_may_pull() returns false, the
      function forgets to decrease the refcnt increased by x25_get_neigh(),
      causing a refcnt leak.
      
      Fix this issue by calling x25_neigh_put() when pskb_may_pull() returns
      false.
      
      Fixes: cb101ed2 ("x25: Handle undersized/fragmented skbs")
      Signed-off-by: default avatarXiyu Yang <xiyuyang19@fudan.edu.cn>
      Signed-off-by: default avatarXin Tan <tanxin.ctf@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f35d1297
    • Bo YU's avatar
      mptcp/pm_netlink.c : add check for nla_put_in/6_addr · b4e0f9a9
      Bo YU authored
      Normal there should be checked for nla_put_in6_addr like other
      usage in net.
      
      Detected by CoverityScan, CID# 1461639
      
      Fixes: 01cacb00 ("mptcp: add netlink-based PM")
      Signed-off-by: default avatarBo YU <tsu.yubo@gmail.com>
      Acked-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b4e0f9a9
    • Tang Bin's avatar
      net: ethernet: ixp4xx: Add error handling in ixp4xx_eth_probe() · 6ed79cec
      Tang Bin authored
      The function ixp4xx_eth_probe() does not perform sufficient error
      checking after executing devm_ioremap_resource(), which can result
      in crashes if a critical error path is encountered.
      
      Fixes: f458ac47 ("ARM/net: ixp4xx: Pass ethernet physical base as resource")
      Signed-off-by: default avatarZhang Shengju <zhangshengju@cmss.chinamobile.com>
      Signed-off-by: default avatarTang Bin <tangbin@cmss.chinamobile.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6ed79cec
    • Vishal Kulkarni's avatar
      cxgb4: fix adapter crash due to wrong MC size · ce222748
      Vishal Kulkarni authored
      In the absence of MC1, the size calculation function
      cudbg_mem_region_size() was returing wrong MC size and
      resulted in adapter crash. This patch adds new argument
      to cudbg_mem_region_size() which will have actual size
      and returns error to caller in the absence of MC1.
      
      Fixes: a1c69520 ("cxgb4: collect MC memory dump")
      Signed-off-by: Vishal Kulkarni <vishal@chelsio.com>"
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ce222748
    • David S. Miller's avatar
      Merge branch 'vxlan-geneve-use-the-correct-nlattr-array-for-extack' · da0afd1f
      David S. Miller authored
      Sabrina Dubroca says:
      
      ====================
      net: vxlan/geneve: use the correct nlattr array for extack
      
      The ->validate callbacks for vxlan and geneve have a couple of typos
      in extack, where the nlattr array for IFLA_* attributes is used
      instead of the link-specific one.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      da0afd1f
    • Sabrina Dubroca's avatar
      geneve: use the correct nlattr array in NL_SET_ERR_MSG_ATTR · 9a7b5b50
      Sabrina Dubroca authored
      IFLA_GENEVE_* attributes are in the data array, which is correctly
      used when fetching the value, but not when setting the extended
      ack. Because IFLA_GENEVE_MAX < IFLA_MAX, we avoid out of bounds
      array accesses, but we don't provide a pointer to the invalid
      attribute to userspace.
      
      Fixes: a025fb5f ("geneve: Allow configuration of DF behaviour")
      Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9a7b5b50
    • Sabrina Dubroca's avatar
      vxlan: use the correct nlattr array in NL_SET_ERR_MSG_ATTR · cc8e7c69
      Sabrina Dubroca authored
      IFLA_VXLAN_* attributes are in the data array, which is correctly
      used when fetching the value, but not when setting the extended
      ack. Because IFLA_VXLAN_MAX < IFLA_MAX, we avoid out of bounds
      array accesses, but we don't provide a pointer to the invalid
      attribute to userspace.
      
      Fixes: 653ef6a3 ("vxlan: change vxlan_[config_]validate() to use netlink_ext_ack for error reporting")
      Fixes: b4d30697 ("vxlan: Allow configuration of DF behaviour")
      Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cc8e7c69
    • Dan Carpenter's avatar
      mlxsw: Fix some IS_ERR() vs NULL bugs · c391eb83
      Dan Carpenter authored
      The mlxsw_sp_acl_rulei_create() function is supposed to return an error
      pointer from mlxsw_afa_block_create().  The problem is that these
      functions both return NULL instead of error pointers.  Half the callers
      expect NULL and half expect error pointers so it could lead to a NULL
      dereference on failure.
      
      This patch changes both of them to return error pointers and changes all
      the callers which checked for NULL to check for IS_ERR() instead.
      
      Fixes: 4cda7d8d ("mlxsw: core: Introduce flexible actions support")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Reviewed-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c391eb83
    • Baruch Siach's avatar
      net: phy: marvell10g: limit soft reset to 88x3310 · 829e7573
      Baruch Siach authored
      The MV_V2_PORT_CTRL_SWRST bit in MV_V2_PORT_CTRL is reserved on 88E2110.
      Setting SWRST on 88E2110 breaks packets transfer after interface down/up
      cycle.
      
      Fixes: 8f48c2ac ("net: marvell10g: soft-reset the PHY when coming out of low power")
      Signed-off-by: default avatarBaruch Siach <baruch@tkos.co.il>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      829e7573
    • Wei Yongjun's avatar
      mac80211_hwsim: use GFP_ATOMIC under spin lock · 03798612
      Wei Yongjun authored
      A spin lock is taken here so we should use GFP_ATOMIC.
      
      Fixes: 5d44fe7c ("mac80211_hwsim: add frame transmission support over virtio")
      Signed-off-by: default avatarWei Yongjun <weiyongjun1@huawei.com>
      Link: https://lore.kernel.org/r/20200422020154.112088-1-weiyongjun1@huawei.comSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      03798612
    • David Ahern's avatar
      ipv4: Update fib_select_default to handle nexthop objects · 7c74b0be
      David Ahern authored
      A user reported [0] hitting the WARN_ON in fib_info_nh:
      
          [ 8633.839816] ------------[ cut here ]------------
          [ 8633.839819] WARNING: CPU: 0 PID: 1719 at include/net/nexthop.h:251 fib_select_path+0x303/0x381
          ...
          [ 8633.839846] RIP: 0010:fib_select_path+0x303/0x381
          ...
          [ 8633.839848] RSP: 0018:ffffb04d407f7d00 EFLAGS: 00010286
          [ 8633.839850] RAX: 0000000000000000 RBX: ffff9460b9897ee8 RCX: 00000000000000fe
          [ 8633.839851] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
          [ 8633.839852] RBP: ffff946076049850 R08: 0000000059263a83 R09: ffff9460840e4000
          [ 8633.839853] R10: 0000000000000014 R11: 0000000000000000 R12: ffffb04d407f7dc0
          [ 8633.839854] R13: ffffffffa4ce3240 R14: 0000000000000000 R15: ffff9460b7681f60
          [ 8633.839857] FS:  00007fcac2e02700(0000) GS:ffff9460bdc00000(0000) knlGS:0000000000000000
          [ 8633.839858] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
          [ 8633.839859] CR2: 00007f27beb77e28 CR3: 0000000077734000 CR4: 00000000000006f0
          [ 8633.839867] Call Trace:
          [ 8633.839871]  ip_route_output_key_hash_rcu+0x421/0x890
          [ 8633.839873]  ip_route_output_key_hash+0x5e/0x80
          [ 8633.839876]  ip_route_output_flow+0x1a/0x50
          [ 8633.839878]  __ip4_datagram_connect+0x154/0x310
          [ 8633.839880]  ip4_datagram_connect+0x28/0x40
          [ 8633.839882]  __sys_connect+0xd6/0x100
          ...
      
      The WARN_ON is triggered in fib_select_default which is invoked when
      there are multiple default routes. Update the function to use
      fib_info_nhc and convert the nexthop checks to use fib_nh_common.
      
      Add test case that covers the affected code path.
      
      [0] https://github.com/FRRouting/frr/issues/6089
      
      Fixes: 493ced1a ("ipv4: Allow routes to use nexthop objects")
      Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7c74b0be
    • Salvatore Bonaccorso's avatar
      netlabel: Kconfig: Update reference for NetLabel Tools project · c0259664
      Salvatore Bonaccorso authored
      The NetLabel Tools project has moved from http://netlabel.sf.net to a
      GitHub project. Update to directly refer to the new home for the tools.
      Signed-off-by: default avatarSalvatore Bonaccorso <carnil@debian.org>
      Acked-by: default avatarPaul Moore <paul@paul-moore.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c0259664
    • Ioana Ciornei's avatar
      MAINTAINERS: update dpaa2-eth maintainer list · 31fa51ad
      Ioana Ciornei authored
      Add myself as another maintainer of dpaa2-eth.
      Signed-off-by: default avatarIoana Ciornei <ioana.ciornei@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      31fa51ad
    • Paolo Abeni's avatar
      mptcp: fix data_fin handing in RX path · 9a19371b
      Paolo Abeni authored
      The data fin flag is set only via a DSS option, but
      mptcp_incoming_options() copies it unconditionally from the
      provided RX options.
      
      Since we do not clear all the mptcp sock RX options in a
      socket free/alloc cycle, we can end-up with a stray data_fin
      value while parsing e.g. MPC packets.
      
      That would lead to mapping data corruption and will trigger
      a few WARN_ON() in the RX path.
      
      Instead of adding a costly memset(), fetch the data_fin flag
      only for DSS packets - when we always explicitly initialize
      such bit at option parsing time.
      
      Fixes: 648ef4b8 ("mptcp: Implement MPTCP receive path")
      Reviewed-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9a19371b
    • David Ahern's avatar
      vrf: Fix IPv6 with qdisc and xfrm · a53c1028
      David Ahern authored
      When a qdisc is attached to the VRF device, the packet goes down the ndo
      xmit function which is setup to send the packet back to the VRF driver
      which does a lookup to send the packet out. The lookup in the VRF driver
      is not considering xfrm policies. Change it to use ip6_dst_lookup_flow
      rather than ip6_route_output.
      
      Fixes: 35402e31 ("net: Add IPv6 support to VRF device")
      Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a53c1028
    • Stephen Hemminger's avatar
      Documentation: add documentation of ping_group_range · 5cc4adbc
      Stephen Hemminger authored
      Support for non-root users to send ICMP ECHO requests was added
      back in Linux 3.0 kernel, but the documentation for the sysctl
      to enable it has been missing.
      Signed-off-by: default avatarStephen Hemminger <stephen@networkplumber.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5cc4adbc
    • David S. Miller's avatar
      Merge branch 'sctp-fixes' · 609120c5
      David S. Miller authored
      Jere Leppänen says:
      
      ====================
      sctp: Fix problems with peer restart when in SHUTDOWN-PENDING state and socket is closed
      
      These patches are related to the scenario described in commit
      bdf6fa52 ("sctp: handle association restarts when the socket is
      closed."). To recap, when our association is in SHUTDOWN-PENDING state
      and we've closed our one-to-one socket, while the peer crashes without
      being detected, restarts and reconnects using the same addresses and
      ports, we start association shutdown.
      
      In this case, Cumulative TSN Ack in the SHUTDOWN that we send has
      always been incorrect. Additionally, bundling of the SHUTDOWN with the
      COOKIE-ACK was broken by a later commit. This series fixes both of
      these issues.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      609120c5
    • Jere Leppänen's avatar
      sctp: Fix SHUTDOWN CTSN Ack in the peer restart case · 12dfd78e
      Jere Leppänen authored
      When starting shutdown in sctp_sf_do_dupcook_a(), get the value for
      SHUTDOWN Cumulative TSN Ack from the new association, which is
      reconstructed from the cookie, instead of the old association, which
      the peer doesn't have anymore.
      
      Otherwise the SHUTDOWN is either ignored or replied to with an ABORT
      by the peer because CTSN Ack doesn't match the peer's Initial TSN.
      
      Fixes: bdf6fa52 ("sctp: handle association restarts when the socket is closed.")
      Signed-off-by: default avatarJere Leppänen <jere.leppanen@nokia.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      12dfd78e
    • Jere Leppänen's avatar
      sctp: Fix bundling of SHUTDOWN with COOKIE-ACK · 145cb2f7
      Jere Leppänen authored
      When we start shutdown in sctp_sf_do_dupcook_a(), we want to bundle
      the SHUTDOWN with the COOKIE-ACK to ensure that the peer receives them
      at the same time and in the correct order. This bundling was broken by
      commit 4ff40b86 ("sctp: set chunk transport correctly when it's a
      new asoc"), which assigns a transport for the COOKIE-ACK, but not for
      the SHUTDOWN.
      
      Fix this by passing a reference to the COOKIE-ACK chunk as an argument
      to sctp_sf_do_9_2_start_shutdown() and onward to
      sctp_make_shutdown(). This way the SHUTDOWN chunk is assigned the same
      transport as the COOKIE-ACK chunk, which allows them to be bundled.
      
      In sctp_sf_do_9_2_start_shutdown(), the void *arg parameter was
      previously unused. Now that we're taking it into use, it must be a
      valid pointer to a chunk, or NULL. There is only one call site where
      it's not, in sctp_sf_autoclose_timer_expire(). Fix that too.
      
      Fixes: 4ff40b86 ("sctp: set chunk transport correctly when it's a new asoc")
      Signed-off-by: default avatarJere Leppänen <jere.leppanen@nokia.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      145cb2f7
    • Vladimir Oltean's avatar
      net: dsa: don't fail to probe if we couldn't set the MTU · 72579e14
      Vladimir Oltean authored
      There is no reason to fail the probing of the switch if the MTU couldn't
      be configured correctly (either the switch port itself, or the host
      port) for whatever reason. MTU-sized traffic probably won't work, sure,
      but we can still probably limp on and support some form of communication
      anyway, which the users would probably appreciate more.
      
      Fixes: bfcb8132 ("net: dsa: configure the MTU for switch ports")
      Reported-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      72579e14
    • Eric Dumazet's avatar
      sched: etf: do not assume all sockets are full blown · a1211bf9
      Eric Dumazet authored
      skb->sk does not always point to a full blown socket,
      we need to use sk_fullsock() before accessing fields which
      only make sense on full socket.
      
      BUG: KASAN: use-after-free in report_sock_error+0x286/0x300 net/sched/sch_etf.c:141
      Read of size 1 at addr ffff88805eb9b245 by task syz-executor.5/9630
      
      CPU: 1 PID: 9630 Comm: syz-executor.5 Not tainted 5.7.0-rc2-syzkaller #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       <IRQ>
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x188/0x20d lib/dump_stack.c:118
       print_address_description.constprop.0.cold+0xd3/0x315 mm/kasan/report.c:382
       __kasan_report.cold+0x35/0x4d mm/kasan/report.c:511
       kasan_report+0x33/0x50 mm/kasan/common.c:625
       report_sock_error+0x286/0x300 net/sched/sch_etf.c:141
       etf_enqueue_timesortedlist+0x389/0x740 net/sched/sch_etf.c:170
       __dev_xmit_skb net/core/dev.c:3710 [inline]
       __dev_queue_xmit+0x154a/0x30a0 net/core/dev.c:4021
       neigh_hh_output include/net/neighbour.h:499 [inline]
       neigh_output include/net/neighbour.h:508 [inline]
       ip6_finish_output2+0xfb5/0x25b0 net/ipv6/ip6_output.c:117
       __ip6_finish_output+0x442/0xab0 net/ipv6/ip6_output.c:143
       ip6_finish_output+0x34/0x1f0 net/ipv6/ip6_output.c:153
       NF_HOOK_COND include/linux/netfilter.h:296 [inline]
       ip6_output+0x239/0x810 net/ipv6/ip6_output.c:176
       dst_output include/net/dst.h:435 [inline]
       NF_HOOK include/linux/netfilter.h:307 [inline]
       NF_HOOK include/linux/netfilter.h:301 [inline]
       ip6_xmit+0xe1a/0x2090 net/ipv6/ip6_output.c:280
       tcp_v6_send_synack+0x4e7/0x960 net/ipv6/tcp_ipv6.c:521
       tcp_rtx_synack+0x10d/0x1a0 net/ipv4/tcp_output.c:3916
       inet_rtx_syn_ack net/ipv4/inet_connection_sock.c:669 [inline]
       reqsk_timer_handler+0x4c2/0xb40 net/ipv4/inet_connection_sock.c:763
       call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1405
       expire_timers kernel/time/timer.c:1450 [inline]
       __run_timers kernel/time/timer.c:1774 [inline]
       __run_timers kernel/time/timer.c:1741 [inline]
       run_timer_softirq+0x623/0x1600 kernel/time/timer.c:1787
       __do_softirq+0x26c/0x9f7 kernel/softirq.c:292
       invoke_softirq kernel/softirq.c:373 [inline]
       irq_exit+0x192/0x1d0 kernel/softirq.c:413
       exiting_irq arch/x86/include/asm/apic.h:546 [inline]
       smp_apic_timer_interrupt+0x19e/0x600 arch/x86/kernel/apic/apic.c:1140
       apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
       </IRQ>
      RIP: 0010:des_encrypt+0x157/0x9c0 lib/crypto/des.c:792
      Code: 85 22 06 00 00 41 31 dc 41 8b 4d 04 44 89 e2 41 83 e4 3f 4a 8d 3c a5 60 72 72 88 81 e2 3f 3f 3f 3f 48 89 f8 48 c1 e8 03 31 d9 <0f> b6 34 28 48 89 f8 c1 c9 04 83 e0 07 83 c0 03 40 38 f0 7c 09 40
      RSP: 0018:ffffc90003b5f6c0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
      RAX: 1ffffffff10e4e55 RBX: 00000000d2f846d0 RCX: 00000000d2f846d0
      RDX: 0000000012380612 RSI: ffffffff839863ca RDI: ffffffff887272a8
      RBP: dffffc0000000000 R08: ffff888091d0a380 R09: 0000000000800081
      R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000012
      R13: ffff8880a8ae8078 R14: 00000000c545c93e R15: 0000000000000006
       cipher_crypt_one crypto/cipher.c:75 [inline]
       crypto_cipher_encrypt_one+0x124/0x210 crypto/cipher.c:82
       crypto_cbcmac_digest_update+0x1b5/0x250 crypto/ccm.c:830
       crypto_shash_update+0xc4/0x120 crypto/shash.c:119
       shash_ahash_update+0xa3/0x110 crypto/shash.c:246
       crypto_ahash_update include/crypto/hash.h:547 [inline]
       hash_sendmsg+0x518/0xad0 crypto/algif_hash.c:102
       sock_sendmsg_nosec net/socket.c:652 [inline]
       sock_sendmsg+0xcf/0x120 net/socket.c:672
       ____sys_sendmsg+0x308/0x7e0 net/socket.c:2362
       ___sys_sendmsg+0x100/0x170 net/socket.c:2416
       __sys_sendmmsg+0x195/0x480 net/socket.c:2506
       __do_sys_sendmmsg net/socket.c:2535 [inline]
       __se_sys_sendmmsg net/socket.c:2532 [inline]
       __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2532
       do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
       entry_SYSCALL_64_after_hwframe+0x49/0xb3
      RIP: 0033:0x45c829
      Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
      RSP: 002b:00007f6d9528ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
      RAX: ffffffffffffffda RBX: 00000000004fc080 RCX: 000000000045c829
      RDX: 0000000000000001 RSI: 0000000020002640 RDI: 0000000000000004
      RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
      R13: 00000000000008d7 R14: 00000000004cb7aa R15: 00007f6d9528f6d4
      
      Fixes: 4b15c707 ("net/sched: Make etf report drops on error_queue")
      Fixes: 25db26a9 ("net/sched: Introduce the ETF Qdisc")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Cc: Vinicius Costa Gomes <vinicius.gomes@intel.com>
      Reviewed-by: default avatarVinicius Costa Gomes <vinicius.gomes@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a1211bf9
  3. 22 Apr, 2020 9 commits
    • David Ahern's avatar
      selftests: Fix suppress test in fib_tests.sh · 2c1dd4c1
      David Ahern authored
      fib_tests is spewing errors:
          ...
          Cannot open network namespace "ns1": No such file or directory
          Cannot open network namespace "ns1": No such file or directory
          Cannot open network namespace "ns1": No such file or directory
          Cannot open network namespace "ns1": No such file or directory
          ping: connect: Network is unreachable
          Cannot open network namespace "ns1": No such file or directory
          Cannot open network namespace "ns1": No such file or directory
          ...
      
      Each test entry in fib_tests is supposed to do its own setup and
      cleanup. Right now the $IP commands in fib_suppress_test are
      failing because there is no ns1. Add the setup/cleanup and logging
      expected for each test.
      
      Fixes: ca7a03c4 ("ipv6: do not free rt if FIB_LOOKUP_NOREF is set on suppress rule")
      Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
      Cc: Jason A. Donenfeld <Jason@zx2c4.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2c1dd4c1
    • David S. Miller's avatar
      Merge branch 'net-dsa-b53-Various-ARL-fixes' · d5812a86
      David S. Miller authored
      Florian Fainelli says:
      
      ====================
      net: dsa: b53: Various ARL fixes
      
      This patch series fixes a number of short comings in the existing b53
      driver ARL management logic in particular:
      
      - we were not looking up the {MAC,VID} tuples against their VID, despite
        having VLANs enabled
      
      - the MDB entries (multicast) would lose their validity as soon as a
        single port in the vector would leave the entry
      
      - the ARL was currently under utilized because we would always place new
        entries in bin index #1, instead of using all possible bins available,
        thus reducing the ARL effective size by 50% or 75% depending on the
        switch generation
      
      - it was possible to overwrite the ARL entries because no proper space
        verification was done
      
      This patch series addresses all of these issues.
      
      Changes in v2:
      - added a new patch to correctly flip invidual VLAN learning vs. shared
        VLAN learning depending on the global VLAN state
      
      - added Andrew's R-b tags for patches which did not change
      
      - corrected some verbosity and minor issues in patch #4 to match caller
        expectations, also avoid a variable length DECLARE_BITMAP() call
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d5812a86
    • Florian Fainelli's avatar
      net: dsa: b53: b53_arl_rw_op() needs to select IVL or SVL · 64fec949
      Florian Fainelli authored
      Flip the IVL_SVL_SELECT bit correctly based on the VLAN enable status,
      the default is to perform Shared VLAN learning instead of Individual
      learning.
      
      Fixes: 1da6df85 ("net: dsa: b53: Implement ARL add/del/dump operations")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      64fec949
    • Florian Fainelli's avatar
      net: dsa: b53: Rework ARL bin logic · 6344dbde
      Florian Fainelli authored
      When asking the ARL to read a MAC address, we will get a number of bins
      returned in a single read. Out of those bins, there can essentially be 3
      states:
      
      - all bins are full, we have no space left, and we can either replace an
        existing address or return that full condition
      
      - the MAC address was found, then we need to return its bin index and
        modify that one, and only that one
      
      - the MAC address was not found and we have a least one bin free, we use
        that bin index location then
      
      The code would unfortunately fail on all counts.
      
      Fixes: 1da6df85 ("net: dsa: b53: Implement ARL add/del/dump operations")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6344dbde
    • Florian Fainelli's avatar
      net: dsa: b53: Fix ARL register definitions · c2e77a18
      Florian Fainelli authored
      The ARL {MAC,VID} tuple and the forward entry were off by 0x10 bytes,
      which means that when we read/wrote from/to ARL bin index 0, we were
      actually accessing the ARLA_RWCTRL register.
      
      Fixes: 1da6df85 ("net: dsa: b53: Implement ARL add/del/dump operations")
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c2e77a18
    • Florian Fainelli's avatar
      net: dsa: b53: Fix valid setting for MDB entries · eab167f4
      Florian Fainelli authored
      When support for the MDB entries was added, the valid bit was correctly
      changed to be assigned depending on the remaining port bitmask, that is,
      if there were no more ports added to the entry's port bitmask, the entry
      now becomes invalid. There was another assignment a few lines below that
      would override this which would invalidate entries even when there were
      still multiple ports left in the MDB entry.
      
      Fixes: 5d65b64a ("net: dsa: b53: Add support for MDB")
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      eab167f4
    • Florian Fainelli's avatar
      net: dsa: b53: Lookup VID in ARL searches when VLAN is enabled · 2e97b0cd
      Florian Fainelli authored
      When VLAN is enabled, and an ARL search is issued, we also need to
      compare the full {MAC,VID} tuple before returning a successful search
      result.
      
      Fixes: 1da6df85 ("net: dsa: b53: Implement ARL add/del/dump operations")
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2e97b0cd
    • David S. Miller's avatar
      Merge branch 'vrf-looping' · 87f78f27
      David S. Miller authored
      David Ahern says:
      
      ====================
      net: Fix looping with vrf, xfrms and qdisc on VRF
      
      Trev reported that use of VRFs with xfrms is looping when a qdisc
      is added to the VRF device. The combination of xfrm + qdisc is not
      handled by the VRF driver which lost track that it has already
      seen the packet.
      
      The XFRM_TRANSFORMED flag is used by the netfilter code for a similar
      purpose, so re-use for VRF. Patch 1 drops the #ifdef around setting
      the flag in the xfrm output functions. Patch 2 adds a check to
      the VRF driver for flag; if set the packet has already passed through
      the VRF driver once and does not need to recirculated a second time.
      
      This is a day 1 bug with VRFs; stable wise, I would only take this
      back to 4.14. I have a set of test cases which I will submit to
      net-next.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      87f78f27
    • David Ahern's avatar
      vrf: Check skb for XFRM_TRANSFORMED flag · 16b9db1c
      David Ahern authored
      To avoid a loop with qdiscs and xfrms, check if the skb has already gone
      through the qdisc attached to the VRF device and then to the xfrm layer.
      If so, no need for a second redirect.
      
      Fixes: 193125db ("net: Introduce VRF device driver")
      Reported-by: default avatarTrev Larock <trev@larock.ca>
      Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      16b9db1c