1. 09 Sep, 2022 1 commit
  2. 08 Sep, 2022 8 commits
    • Linus Torvalds's avatar
      Merge tag 'spi-fix-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · 50635787
      Linus Torvalds authored
      Pull spi fixes from Mark Brown:
       "Several fixes that came in since the merge window, the major one being
        a fix for the spi-mux driver which was broken by the performance
        optimisations due to it peering inside the core's data structures more
        than it should"
      
      * tag 'spi-fix-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: spi: Fix queue hang if previous transfer failed
        spi: mux: Fix mux interaction with fast path optimisations
        spi: cadence-quadspi: Disable irqs during indirect reads
        spi: bitbang: Fix lsb-first Rx
      50635787
    • Linus Torvalds's avatar
      Merge tag 'regulator-fix-v6.0-rc4' of... · c5e68c4f
      Linus Torvalds authored
      Merge tag 'regulator-fix-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
      
      Pull regulator fixes from Mark Brown:
       "One core fix here improving the error handling on enable failure, plus
        smaller fixes for the pfuze100 drive and the SPMI DT bindings"
      
      * tag 'regulator-fix-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
        regulator: Fix qcom,spmi-regulator schema
        regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe()
        regulator: core: Clean up on enable failure
      c5e68c4f
    • Linus Torvalds's avatar
      Merge tag 'regmap-fix-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap · b1d27aa3
      Linus Torvalds authored
      Pull regmap fix from Mark Brown:
       "A fix for how we handle controller constraints on SPI message sizes,
        only impacting systems with SPI controllers with very low limits like
        the AMD controller used in the Steam Deck"
      
      * tag 'regmap-fix-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
        regmap: spi: Reserve space for register address/padding
      b1d27aa3
    • Linus Torvalds's avatar
      Merge tag 'net-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 26b12249
      Linus Torvalds authored
      Pull networking fixes from Paolo Abeni:
       "Including fixes from rxrpc, netfilter, wireless and bluetooth
        subtrees.
      
        Current release - regressions:
      
         - skb: export skb drop reaons to user by TRACE_DEFINE_ENUM
      
         - bluetooth: fix regression preventing ACL packet transmission
      
        Current release - new code bugs:
      
         - dsa: microchip: fix kernel oops on ksz8 switches
      
         - dsa: qca8k: fix NULL pointer dereference for
           of_device_get_match_data
      
        Previous releases - regressions:
      
         - netfilter: clean up hook list when offload flags check fails
      
         - wifi: mt76: fix crash in chip reset fail
      
         - rxrpc: fix ICMP/ICMP6 error handling
      
         - ice: fix DMA mappings leak
      
         - i40e: fix kernel crash during module removal
      
        Previous releases - always broken:
      
         - ipv6: sr: fix out-of-bounds read when setting HMAC data.
      
         - tcp: TX zerocopy should not sense pfmemalloc status
      
         - sch_sfb: don't assume the skb is still around after
           enqueueing to child
      
         - netfilter: drop dst references before setting
      
         - wifi: wilc1000: fix DMA on stack objects
      
         - rxrpc: fix an insufficiently large sglist in
           rxkad_verify_packet_2()
      
         - fec: use a spinlock to guard `fep->ptp_clk_on`
      
        Misc:
      
         - usb: qmi_wwan: add Quectel RM520N"
      
      * tag 'net-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (50 commits)
        sch_sfb: Also store skb len before calling child enqueue
        net: phy: lan87xx: change interrupt src of link_up to comm_ready
        net/smc: Fix possible access to freed memory in link clear
        net: ethernet: mtk_eth_soc: check max allowed hash in mtk_ppe_check_skb
        net: skb: export skb drop reaons to user by TRACE_DEFINE_ENUM
        net: ethernet: mtk_eth_soc: fix typo in __mtk_foe_entry_clear
        net: dsa: felix: access QSYS_TAG_CONFIG under tas_lock in vsc9959_sched_speed_set
        net: dsa: felix: disable cut-through forwarding for frames oversized for tc-taprio
        net: dsa: felix: tc-taprio intervals smaller than MTU should send at least one packet
        net: usb: qmi_wwan: add Quectel RM520N
        net: dsa: qca8k: fix NULL pointer dereference for of_device_get_match_data
        tcp: fix early ETIMEDOUT after spurious non-SACK RTO
        stmmac: intel: Simplify intel_eth_pci_remove()
        net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()
        ipv6: sr: fix out-of-bounds read when setting HMAC data.
        bonding: accept unsolicited NA message
        bonding: add all node mcast address when slave up
        bonding: use unspecified address if no available link local address
        wifi: use struct_group to copy addresses
        wifi: mac80211_hwsim: check length for virtio packets
        ...
      26b12249
    • Linus Torvalds's avatar
      fs: only do a memory barrier for the first set_buffer_uptodate() · 2f79cdfe
      Linus Torvalds authored
      Commit d4252071 ("add barriers to buffer_uptodate and
      set_buffer_uptodate") added proper memory barriers to the buffer head
      BH_Uptodate bit, so that anybody who tests a buffer for being up-to-date
      will be guaranteed to actually see initialized state.
      
      However, that commit didn't _just_ add the memory barrier, it also ended
      up dropping the "was it already set" logic that the BUFFER_FNS() macro
      had.
      
      That's conceptually the right thing for a generic "this is a memory
      barrier" operation, but in the case of the buffer contents, we really
      only care about the memory barrier for the _first_ time we set the bit,
      in that the only memory ordering protection we need is to avoid anybody
      seeing uninitialized memory contents.
      
      Any other access ordering wouldn't be about the BH_Uptodate bit anyway,
      and would require some other proper lock (typically BH_Lock or the folio
      lock).  A reader that races with somebody invalidating the buffer head
      isn't an issue wrt the memory ordering, it's a serialization issue.
      
      Now, you'd think that the buffer head operations don't matter in this
      day and age (and I certainly thought so), but apparently some loads
      still end up being heavy users of buffer heads.  In particular, the
      kernel test robot reported that not having this bit access optimization
      in place caused a noticeable direct IO performance regression on ext4:
      
        fxmark.ssd_ext4_no_jnl_DWTL_54_directio.works/sec -26.5% regression
      
      although you presumably need a fast disk and a lot of cores to actually
      notice.
      
      Link: https://lore.kernel.org/all/Yw8L7HTZ%2FdE2%2Fo9C@xsang-OptiPlex-9020/Reported-by: default avatarkernel test robot <oliver.sang@intel.com>
      Tested-by: default avatarFengwei Yin <fengwei.yin@intel.com>
      Cc: Mikulas Patocka <mpatocka@redhat.com>
      Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
      Cc: stable@kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2f79cdfe
    • Linus Torvalds's avatar
      Merge tag 'efi-urgent-for-v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi · f280b987
      Linus Torvalds authored
      Pull EFI fixes from Ard Biesheuvel:
       "A couple of low-priority EFI fixes:
      
         - prevent the randstruct plugin from re-ordering EFI protocol
           definitions
      
         - fix a use-after-free in the capsule loader
      
         - drop unused variable"
      
      * tag 'efi-urgent-for-v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:
        efi: capsule-loader: Fix use-after-free in efi_capsule_write
        efi/x86: libstub: remove unused variable
        efi: libstub: Disable struct randomization
      f280b987
    • Toke Høiland-Jørgensen's avatar
      sch_sfb: Also store skb len before calling child enqueue · 2f09707d
      Toke Høiland-Jørgensen authored
      Cong Wang noticed that the previous fix for sch_sfb accessing the queued
      skb after enqueueing it to a child qdisc was incomplete: the SFB enqueue
      function was also calling qdisc_qstats_backlog_inc() after enqueue, which
      reads the pkt len from the skb cb field. Fix this by also storing the skb
      len, and using the stored value to increment the backlog after enqueueing.
      
      Fixes: 9efd2329 ("sch_sfb: Don't assume the skb is still around after enqueueing to child")
      Signed-off-by: default avatarToke Høiland-Jørgensen <toke@toke.dk>
      Acked-by: default avatarCong Wang <cong.wang@bytedance.com>
      Link: https://lore.kernel.org/r/20220905192137.965549-1-toke@toke.dkSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      2f09707d
    • Arun Ramadoss's avatar
      net: phy: lan87xx: change interrupt src of link_up to comm_ready · 5382033a
      Arun Ramadoss authored
      Currently phy link up/down interrupt is enabled using the
      LAN87xx_INTERRUPT_MASK register. In the lan87xx_read_status function,
      phy link is determined using the T1_MODE_STAT_REG register comm_ready bit.
      comm_ready bit is set using the loc_rcvr_status & rem_rcvr_status.
      Whenever the phy link is up, LAN87xx_INTERRUPT_SOURCE link_up bit is set
      first but comm_ready bit takes some time to set based on local and
      remote receiver status.
      As per the current implementation, interrupt is triggered using link_up
      but the comm_ready bit is still cleared in the read_status function. So,
      link is always down.  Initially tested with the shared interrupt
      mechanism with switch and internal phy which is working, but after
      implementing interrupt controller it is not working.
      It can fixed either by updating the read_status function to read from
      LAN87XX_INTERRUPT_SOURCE register or enable the interrupt mask for
      comm_ready bit. But the validation team recommends the use of comm_ready
      for link detection.
      This patch fixes by enabling the comm_ready bit for link_up in the
      LAN87XX_INTERRUPT_MASK_2 register (MISC Bank) and link_down in
      LAN87xx_INTERRUPT_MASK register.
      
      Fixes: 8a1b415d ("net: phy: added ethtool master-slave configuration support")
      Signed-off-by: default avatarArun Ramadoss <arun.ramadoss@microchip.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Link: https://lore.kernel.org/r/20220905152750.5079-1-arun.ramadoss@microchip.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      5382033a
  3. 07 Sep, 2022 12 commits
    • Hyunwoo Kim's avatar
      efi: capsule-loader: Fix use-after-free in efi_capsule_write · 9cb636b5
      Hyunwoo Kim authored
      A race condition may occur if the user calls close() on another thread
      during a write() operation on the device node of the efi capsule.
      
      This is a race condition that occurs between the efi_capsule_write() and
      efi_capsule_flush() functions of efi_capsule_fops, which ultimately
      results in UAF.
      
      So, the page freeing process is modified to be done in
      efi_capsule_release() instead of efi_capsule_flush().
      
      Cc: <stable@vger.kernel.org> # v4.9+
      Signed-off-by: default avatarHyunwoo Kim <imv4bel@gmail.com>
      Link: https://lore.kernel.org/all/20220907102920.GA88602@ubuntu/Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
      9cb636b5
    • Yacan Liu's avatar
      net/smc: Fix possible access to freed memory in link clear · e9b1a4f8
      Yacan Liu authored
      After modifying the QP to the Error state, all RX WR would be completed
      with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not
      wait for it is done, but destroy the QP and free the link group directly.
      So there is a risk that accessing the freed memory in tasklet context.
      
      Here is a crash example:
      
       BUG: unable to handle page fault for address: ffffffff8f220860
       #PF: supervisor write access in kernel mode
       #PF: error_code(0x0002) - not-present page
       PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060
       Oops: 0002 [#1] SMP PTI
       CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S         OE     5.10.0-0607+ #23
       Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018
       RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0
       Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32
       RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086
       RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000
       RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00
       RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b
       R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010
       R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040
       FS:  0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0
       DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
       DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
       Call Trace:
        <IRQ>
        _raw_spin_lock_irqsave+0x30/0x40
        mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib]
        smc_wr_rx_tasklet_fn+0x56/0xa0 [smc]
        tasklet_action_common.isra.21+0x66/0x100
        __do_softirq+0xd5/0x29c
        asm_call_irq_on_stack+0x12/0x20
        </IRQ>
        do_softirq_own_stack+0x37/0x40
        irq_exit_rcu+0x9d/0xa0
        sysvec_call_function_single+0x34/0x80
        asm_sysvec_call_function_single+0x12/0x20
      
      Fixes: bd4ad577 ("smc: initialize IB transport incl. PD, MR, QP, CQ, event, WR")
      Signed-off-by: default avatarYacan Liu <liuyacan@corp.netease.com>
      Reviewed-by: default avatarTony Lu <tonylu@linux.alibaba.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e9b1a4f8
    • Lorenzo Bianconi's avatar
      net: ethernet: mtk_eth_soc: check max allowed hash in mtk_ppe_check_skb · f27b405e
      Lorenzo Bianconi authored
      Even if max hash configured in hw in mtk_ppe_hash_entry is
      MTK_PPE_ENTRIES - 1, check theoretical OOB accesses in
      mtk_ppe_check_skb routine
      
      Fixes: c4f033d9 ("net: ethernet: mtk_eth_soc: rework hardware flow table management")
      Signed-off-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f27b405e
    • Menglong Dong's avatar
      net: skb: export skb drop reaons to user by TRACE_DEFINE_ENUM · 9cb252c4
      Menglong Dong authored
      As Eric reported, the 'reason' field is not presented when trace the
      kfree_skb event by perf:
      
      $ perf record -e skb:kfree_skb -a sleep 10
      $ perf script
        ip_defrag 14605 [021]   221.614303:   skb:kfree_skb:
        skbaddr=0xffff9d2851242700 protocol=34525 location=0xffffffffa39346b1
        reason:
      
      The cause seems to be passing kernel address directly to TP_printk(),
      which is not right. As the enum 'skb_drop_reason' is not exported to
      user space through TRACE_DEFINE_ENUM(), perf can't get the drop reason
      string from the 'reason' field, which is a number.
      
      Therefore, we introduce the macro DEFINE_DROP_REASON(), which is used
      to define the trace enum by TRACE_DEFINE_ENUM(). With the help of
      DEFINE_DROP_REASON(), now we can remove the auto-generate that we
      introduced in the commit ec43908d
      ("net: skb: use auto-generation to convert skb drop reason to string"),
      and define the string array 'drop_reasons'.
      
      Hmmmm...now we come back to the situation that have to maintain drop
      reasons in both enum skb_drop_reason and DEFINE_DROP_REASON. But they
      are both in dropreason.h, which makes it easier.
      
      After this commit, now the format of kfree_skb is like this:
      
      $ cat /tracing/events/skb/kfree_skb/format
      name: kfree_skb
      ID: 1524
      format:
              field:unsigned short common_type;       offset:0;       size:2; signed:0;
              field:unsigned char common_flags;       offset:2;       size:1; signed:0;
              field:unsigned char common_preempt_count;       offset:3;       size:1; signed:0;
              field:int common_pid;   offset:4;       size:4; signed:1;
      
              field:void * skbaddr;   offset:8;       size:8; signed:0;
              field:void * location;  offset:16;      size:8; signed:0;
              field:unsigned short protocol;  offset:24;      size:2; signed:0;
              field:enum skb_drop_reason reason;      offset:28;      size:4; signed:0;
      
      print fmt: "skbaddr=%p protocol=%u location=%p reason: %s", REC->skbaddr, REC->protocol, REC->location, __print_symbolic(REC->reason, { 1, "NOT_SPECIFIED" }, { 2, "NO_SOCKET" } ......
      
      Fixes: ec43908d ("net: skb: use auto-generation to convert skb drop reason to string")
      Link: https://lore.kernel.org/netdev/CANn89i+bx0ybvE55iMYf5GJM48WwV1HNpdm9Q6t-HaEstqpCSA@mail.gmail.com/Reported-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarMenglong Dong <imagedong@tencent.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9cb252c4
    • Lorenzo Bianconi's avatar
      net: ethernet: mtk_eth_soc: fix typo in __mtk_foe_entry_clear · 0e80707d
      Lorenzo Bianconi authored
      Set ib1 state to MTK_FOE_STATE_UNBIND in __mtk_foe_entry_clear routine.
      
      Fixes: 33fc42de ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries")
      Signed-off-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0e80707d
    • David S. Miller's avatar
      Merge branch 'dsa-felix-fixes' · 0f51fa2a
      David S. Miller authored
      Vladimir Oltean says:
      
      ====================
      Fixes for Felix DSA driver calculation of tc-taprio guard bands
      
      This series fixes some bugs which are not quite new, but date from v5.13
      when static guard bands were enabled by Michael Walle to prevent
      tc-taprio overruns.
      
      The investigation started when Xiaoliang asked privately what is the
      expected max SDU for a traffic class when its minimum gate interval is
      10 us. The answer, as it turns out, is not an L1 size of 1250 octets,
      but 1245 octets, since otherwise, the switch will not consider frames
      for egress scheduling, because the static guard band is exactly as large
      as the time interval. The switch needs a minimum of 33 ns outside of the
      guard band to consider a frame for scheduling, and the reduction of the
      max SDU by 5 provides exactly for that.
      
      The fix for that (patch 1/3) is relatively small, but during testing, it
      became apparent that cut-through forwarding prevents oversized frame
      dropping from working properly. This is solved through the larger patch
      2/3. Finally, patch 3/3 fixes one more tc-taprio locking problem found
      through code inspection.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0f51fa2a
    • Vladimir Oltean's avatar
      net: dsa: felix: access QSYS_TAG_CONFIG under tas_lock in vsc9959_sched_speed_set · a4bb481a
      Vladimir Oltean authored
      The read-modify-write of QSYS_TAG_CONFIG from vsc9959_sched_speed_set()
      runs unlocked with respect to the other functions that access it, which
      are vsc9959_tas_guard_bands_update(), vsc9959_qos_port_tas_set() and
      vsc9959_tas_clock_adjust(). All the others are under ocelot->tas_lock,
      so move the vsc9959_sched_speed_set() access under that lock as well, to
      resolve the concurrency.
      
      Fixes: 55a515b1 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port")
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a4bb481a
    • Vladimir Oltean's avatar
      net: dsa: felix: disable cut-through forwarding for frames oversized for tc-taprio · 843794bb
      Vladimir Oltean authored
      Experimentally, it looks like when QSYS_QMAXSDU_CFG_7 is set to 605,
      frames even way larger than 601 octets are transmitted even though these
      should be considered as oversized, according to the documentation, and
      dropped.
      
      Since oversized frame dropping depends on frame size, which is only
      known at the EOF stage, and therefore not at SOF when cut-through
      forwarding begins, it means that the switch cannot take QSYS_QMAXSDU_CFG_*
      into consideration for traffic classes that are cut-through.
      
      Since cut-through forwarding has no UAPI to control it, and the driver
      enables it based on the mantra "if we can, then why not", the strategy
      is to alter vsc9959_cut_through_fwd() to take into consideration which
      tc's have oversize frame dropping enabled, and disable cut-through for
      them. Then, from vsc9959_tas_guard_bands_update(), we re-trigger the
      cut-through determination process.
      
      There are 2 strategies for vsc9959_cut_through_fwd() to determine
      whether a tc has oversized dropping enabled or not. One is to keep a bit
      mask of traffic classes per port, and the other is to read back from the
      hardware registers (a non-zero value of QSYS_QMAXSDU_CFG_* means the
      feature is enabled). We choose reading back from registers, because
      struct ocelot_port is shared with drivers (ocelot, seville) that don't
      support either cut-through nor tc-taprio, and we don't have a felix
      specific extension of struct ocelot_port. Furthermore, reading registers
      from the Felix hardware is quite cheap, since they are memory-mapped.
      
      Fixes: 55a515b1 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port")
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      843794bb
    • Vladimir Oltean's avatar
      net: dsa: felix: tc-taprio intervals smaller than MTU should send at least one packet · 11afdc65
      Vladimir Oltean authored
      The blamed commit broke tc-taprio schedules such as this one:
      
      tc qdisc replace dev $swp1 root taprio \
              num_tc 8 \
              map 0 1 2 3 4 5 6 7 \
              queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 \
              base-time 0 \
              sched-entry S 0x7f 990000 \
              sched-entry S 0x80  10000 \
              flags 0x2
      
      because the gate entry for TC 7 (S 0x80 10000 ns) now has a static guard
      band added earlier than its 'gate close' event, such that packet
      overruns won't occur in the worst case of the largest packet possible.
      
      Since guard bands are statically determined based on the per-tc
      QSYS_QMAXSDU_CFG_* with a fallback on the port-based QSYS_PORT_MAX_SDU,
      we need to discuss what happens with TC 7 depending on kernel version,
      since the driver, prior to commit 55a515b1 ("net: dsa: felix: drop
      oversized frames with tc-taprio instead of hanging the port"), did not
      touch QSYS_QMAXSDU_CFG_*, and therefore relied on QSYS_PORT_MAX_SDU.
      
      1 (before vsc9959_tas_guard_bands_update): QSYS_PORT_MAX_SDU defaults to
        1518, and at gigabit this introduces a static guard band (independent
        of packet sizes) of 12144 ns, plus QSYS::HSCH_MISC_CFG.FRM_ADJ (bit
        time of 20 octets => 160 ns). But this is larger than the time window
        itself, of 10000 ns. So, the queue system never considers a frame with
        TC 7 as eligible for transmission, since the gate practically never
        opens, and these frames are forever stuck in the TX queues and hang
        the port.
      
      2 (after vsc9959_tas_guard_bands_update): Under the sole goal of
        enabling oversized frame dropping, we make an effort to set
        QSYS_QMAXSDU_CFG_7 to 1230 bytes. But QSYS_QMAXSDU_CFG_7 plays
        one more role, which we did not take into account: per-tc static guard
        band, expressed in L2 byte time (auto-adjusted for FCS and L1 overhead).
        There is a discrepancy between what the driver thinks (that there is
        no guard band, and 100% of min_gate_len[tc] is available for egress
        scheduling) and what the hardware actually does (crops the equivalent
        of QSYS_QMAXSDU_CFG_7 ns out of min_gate_len[tc]). In practice, this
        means that the hardware thinks it has exactly 0 ns for scheduling tc 7.
      
      In both cases, even minimum sized Ethernet frames are stuck on egress
      rather than being considered for scheduling on TC 7, even if they would
      fit given a proper configuration. Considering the current situation,
      with vsc9959_tas_guard_bands_update(), frames between 60 octets and 1230
      octets in size are not eligible for oversized dropping (because they are
      smaller than QSYS_QMAXSDU_CFG_7), but won't be considered as eligible
      for scheduling either, because the min_gate_len[7] (10000 ns) minus the
      guard band determined by QSYS_QMAXSDU_CFG_7 (1230 octets * 8 ns per
      octet == 9840 ns) minus the guard band auto-added for L1 overhead by
      QSYS::HSCH_MISC_CFG.FRM_ADJ (20 octets * 8 ns per octet == 160 octets)
      leaves 0 ns for scheduling in the queue system proper.
      
      Investigating the hardware behavior, it becomes apparent that the queue
      system needs precisely 33 ns of 'gate open' time in order to consider a
      frame as eligible for scheduling to a tc. So the solution to this
      problem is to amend vsc9959_tas_guard_bands_update(), by giving the
      per-tc guard bands less space by exactly 33 ns, just enough for one
      frame to be scheduled in that interval. This allows the queue system to
      make forward progress for that port-tc, and prevents it from hanging.
      
      Fixes: 297c4de6 ("net: dsa: felix: re-enable TAS guard band mode")
      Reported-by: default avatarXiaoliang Yang <xiaoliang.yang_1@nxp.com>
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      11afdc65
    • chen zhang's avatar
      efi/x86: libstub: remove unused variable · 7a1ec84f
      chen zhang authored
      The variable "has_system_memory" is unused in function
      ‘adjust_memory_range_protection’, remove it.
      Signed-off-by: default avatarchen zhang <chenzhang@kylinos.cn>
      Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
      7a1ec84f
    • David Howells's avatar
      afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked · 0066f1b0
      David Howells authored
      When trying to get a file lock on an AFS file, the server may return
      UAEAGAIN to indicate that the lock is already held.  This is currently
      translated by the default path to -EREMOTEIO.
      
      Translate it instead to -EAGAIN so that we know we can retry it.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Reviewed-by: default avatarJeffrey E Altman <jaltman@auristor.com>
      cc: Marc Dionne <marc.dionne@auristor.com>
      cc: linux-afs@lists.infradead.org
      Link: https://lore.kernel.org/r/166075761334.3533338.2591992675160918098.stgit@warthog.procyon.org.uk/Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      0066f1b0
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm · 19f516ea
      Linus Torvalds authored
      Pull ARM fix from Russell King:
       "Just one fix for now for the AMBA bus code from Isaac Manjarres"
      
      * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm:
        ARM: 9229/1: amba: Fix use-after-free in amba_read_periphid()
      19f516ea
  4. 06 Sep, 2022 4 commits
    • Linus Torvalds's avatar
      Merge tag 'erofs-for-6.0-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs · d2ec799d
      Linus Torvalds authored
      Pull erofs fixes from Gao Xiang:
      
       - Fix return codes in erofs_fscache_{meta_,}read_folio error paths
      
       - Fix potential wrong pcluster sizes for later non-4K lclusters
      
       - Fix in-memory pcluster use-after-free on UP platforms
      
      * tag 'erofs-for-6.0-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
        erofs: fix pcluster use-after-free on UP platforms
        erofs: avoid the potentially wrong m_plen for big pcluster
        erofs: fix error return code in erofs_fscache_{meta_,}read_folio
      d2ec799d
    • jerry.meng's avatar
      net: usb: qmi_wwan: add Quectel RM520N · e1091e22
      jerry.meng authored
      add support for Quectel RM520N which is based on Qualcomm SDX62 chip.
      
      0x0801: DIAG + NMEA + AT + MODEM + RMNET
      
      T:  Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 10 Spd=480  MxCh= 0
      D:  Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
      P:  Vendor=2c7c ProdID=0801 Rev= 5.04
      S:  Manufacturer=Quectel
      S:  Product=RM520N-GL
      S:  SerialNumber=384af524
      C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
      I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
      E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
      E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
      E:  Ad=85(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
      E:  Ad=87(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
      E:  Ad=88(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
      E:  Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      Signed-off-by: default avatarjerry.meng <jerry-meng@foxmail.com>
      Acked-by: default avatarBjørn Mork <bjorn@mork.no>
      Link: https://lore.kernel.org/r/tencent_E50CA8A206904897C2D20DDAE90731183C05@qq.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      e1091e22
    • Christian Marangi's avatar
      net: dsa: qca8k: fix NULL pointer dereference for of_device_get_match_data · 42b998d4
      Christian Marangi authored
      of_device_get_match_data is called on priv->dev before priv->dev is
      actually set. Move of_device_get_match_data after priv->dev is correctly
      set to fix this kernel panic.
      
      Fixes: 3bb0844e ("net: dsa: qca8k: cache match data to speed up access")
      Signed-off-by: default avatarChristian Marangi <ansuelsmth@gmail.com>
      Reviewed-by: default avatarVladimir Oltean <olteanv@gmail.com>
      Link: https://lore.kernel.org/r/20220904215319.13070-1-ansuelsmth@gmail.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      42b998d4
    • Neal Cardwell's avatar
      tcp: fix early ETIMEDOUT after spurious non-SACK RTO · 686dc2db
      Neal Cardwell authored
      Fix a bug reported and analyzed by Nagaraj Arankal, where the handling
      of a spurious non-SACK RTO could cause a connection to fail to clear
      retrans_stamp, causing a later RTO to very prematurely time out the
      connection with ETIMEDOUT.
      
      Here is the buggy scenario, expanding upon Nagaraj Arankal's excellent
      report:
      
      (*1) Send one data packet on a non-SACK connection
      
      (*2) Because no ACK packet is received, the packet is retransmitted
           and we enter CA_Loss; but this retransmission is spurious.
      
      (*3) The ACK for the original data is received. The transmitted packet
           is acknowledged.  The TCP timestamp is before the retrans_stamp,
           so tcp_may_undo() returns true, and tcp_try_undo_loss() returns
           true without changing state to Open (because tcp_is_sack() is
           false), and tcp_process_loss() returns without calling
           tcp_try_undo_recovery().  Normally after undoing a CA_Loss
           episode, tcp_fastretrans_alert() would see that the connection
           has returned to CA_Open and fall through and call
           tcp_try_to_open(), which would set retrans_stamp to 0.  However,
           for non-SACK connections we hold the connection in CA_Loss, so do
           not fall through to call tcp_try_to_open() and do not set
           retrans_stamp to 0. So retrans_stamp is (erroneously) still
           non-zero.
      
           At this point the first "retransmission event" has passed and
           been recovered from. Any future retransmission is a completely
           new "event". However, retrans_stamp is erroneously still
           set. (And we are still in CA_Loss, which is correct.)
      
      (*4) After 16 minutes (to correspond with tcp_retries2=15), a new data
           packet is sent. Note: No data is transmitted between (*3) and
           (*4) and we disabled keep alives.
      
           The socket's timeout SHOULD be calculated from this point in
           time, but instead it's calculated from the prior "event" 16
           minutes ago (step (*2)).
      
      (*5) Because no ACK packet is received, the packet is retransmitted.
      
      (*6) At the time of the 2nd retransmission, the socket returns
           ETIMEDOUT, prematurely, because retrans_stamp is (erroneously)
           too far in the past (set at the time of (*2)).
      
      This commit fixes this bug by ensuring that we reuse in
      tcp_try_undo_loss() the same careful logic for non-SACK connections
      that we have in tcp_try_undo_recovery(). To avoid duplicating logic,
      we factor out that logic into a new
      tcp_is_non_sack_preventing_reopen() helper and call that helper from
      both undo functions.
      
      Fixes: da34ac76 ("tcp: only undo on partial ACKs in CA_Loss")
      Reported-by: default avatarNagaraj Arankal <nagaraj.p.arankal@hpe.com>
      Link: https://lore.kernel.org/all/SJ0PR84MB1847BE6C24D274C46A1B9B0EB27A9@SJ0PR84MB1847.NAMPRD84.PROD.OUTLOOK.COM/Signed-off-by: default avatarNeal Cardwell <ncardwell@google.com>
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Link: https://lore.kernel.org/r/20220903121023.866900-1-ncardwell.kernel@gmail.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      686dc2db
  5. 05 Sep, 2022 13 commits
    • Linus Torvalds's avatar
      Merge tag 'soc-fixes-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · 53e99dcf
      Linus Torvalds authored
      Pull ARM SoC fixes from Arnd Bergmann:
       "These are the expected fixes for the SoC tree. I have let the patches
        pile up a little too long, so this is bigger than I would have liked.
      
         - Minor build fixes for Broadcom STB and NXP i.MX8M SoCs as well\ as
           TEE firmware
      
         - Updates to the MAINTAINERS file for the PolarFire SoC
      
         - Minor DT fixes for Renesas White Hawk and Arm Versatile and Juno
           platforms
      
         - A fix for a missing dependnecy in the NXP DPIO driver
      
         - Broadcom BCA fixes to the newly added devicetree files
      
         - Multiple fixes for Microchip AT91 based SoCs, dealing with
           self-refresh timings and regulator settings in DT
      
         - Several DT fixes for NXP i.MX platforms, dealing with incorrect
           GPIO settings, extraneous nodes, and a wrong clock setting"
      
      * tag 'soc-fixes-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (45 commits)
        soc: fsl: select FSL_GUTS driver for DPIO
        ARM: dts: at91: sama5d2_icp: don't keep vdd_other enabled all the time
        ARM: dts: at91: sama5d27_wlsom1: don't keep ldo2 enabled all the time
        ARM: dts: at91: sama7g5ek: specify proper regulator output ranges
        ARM: dts: at91: sama5d2_icp: specify proper regulator output ranges
        ARM: dts: at91: sama5d27_wlsom1: specify proper regulator output ranges
        ARM: at91: pm: fix DDR recalibration when resuming from backup and self-refresh
        ARM: at91: pm: fix self-refresh for sama7g5
        soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs
        ARM: configs: at91: remove CONFIG_MICROCHIP_PIT64B
        ARM: ixp4xx: fix typos in comments
        arm64: dts: renesas: r8a779g0: Fix HSCIF0 interrupt number
        tee: fix compiler warning in tee_shm_register()
        arm64: dts: freescale: verdin-imx8mp: fix atmel_mxt_ts reset polarity
        arm64: dts: freescale: verdin-imx8mm: fix atmel_mxt_ts reset polarity
        arm64: dts: imx8mp: Fix I2C5 GPIO assignment on i.MX8M Plus DHCOM
        arm64: dts: imx8mm-venice-gw7901: fix port/phy validation
        arm64: dts: verdin-imx8mm: add otg2 pd to usbphy
        soc: imx: gpcv2: Assert reset before ungating clock
        arm64: dts: ls1028a-qds-65bb: don't use in-band autoneg for 2500base-x
        ...
      53e99dcf
    • Gao Xiang's avatar
      erofs: fix pcluster use-after-free on UP platforms · 2f44013e
      Gao Xiang authored
      During stress testing with CONFIG_SMP disabled, KASAN reports as below:
      
      ==================================================================
      BUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30
      Read of size 8 at addr ffff8881094223f8 by task stress/7789
      
      CPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3
      Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
      Call Trace:
       <TASK>
      ..
       __mutex_lock+0xe5/0xc30
      ..
       z_erofs_do_read_page+0x8ce/0x1560
      ..
       z_erofs_readahead+0x31c/0x580
      ..
      Freed by task 7787
       kasan_save_stack+0x1e/0x40
       kasan_set_track+0x20/0x30
       kasan_set_free_info+0x20/0x40
       __kasan_slab_free+0x10c/0x190
       kmem_cache_free+0xed/0x380
       rcu_core+0x3d5/0xc90
       __do_softirq+0x12d/0x389
      
      Last potentially related work creation:
       kasan_save_stack+0x1e/0x40
       __kasan_record_aux_stack+0x97/0xb0
       call_rcu+0x3d/0x3f0
       erofs_shrink_workstation+0x11f/0x210
       erofs_shrink_scan+0xdc/0x170
       shrink_slab.constprop.0+0x296/0x530
       drop_slab+0x1c/0x70
       drop_caches_sysctl_handler+0x70/0x80
       proc_sys_call_handler+0x20a/0x2f0
       vfs_write+0x555/0x6c0
       ksys_write+0xbe/0x160
       do_syscall_64+0x3b/0x90
      
      The root cause is that erofs_workgroup_unfreeze() doesn't reset to
      orig_val thus it causes a race that the pcluster reuses unexpectedly
      before freeing.
      
      Since UP platforms are quite rare now, such path becomes unnecessary.
      Let's drop such specific-designed path directly instead.
      
      Fixes: 73f5c66d ("staging: erofs: fix `erofs_workgroup_{try_to_freeze, unfreeze}'")
      Reviewed-by: default avatarYue Hu <huyue2@coolpad.com>
      Reviewed-by: default avatarChao Yu <chao@kernel.org>
      Link: https://lore.kernel.org/r/20220902045710.109530-1-hsiangkao@linux.alibaba.comSigned-off-by: default avatarGao Xiang <hsiangkao@linux.alibaba.com>
      2f44013e
    • Yue Hu's avatar
      erofs: avoid the potentially wrong m_plen for big pcluster · ea0b7b0d
      Yue Hu authored
      Actually, 'compressedlcs' stores compressed block count rather than
      lcluster count. Therefore, the number of bits for shifting the count
      should be 'LOG_BLOCK_SIZE' rather than 'lclusterbits' although current
      lcluster size is 4K.
      
      The value of 'm_plen' will be wrong once we enable the non 4K-sized
      lcluster.
      Signed-off-by: default avatarYue Hu <huyue2@coolpad.com>
      Reviewed-by: default avatarGao Xiang <hsiangkao@linux.alibaba.com>
      Reviewed-by: default avatarChao Yu <chao@kernel.org>
      Link: https://lore.kernel.org/r/20220812060150.8510-1-huyue2@coolpad.comSigned-off-by: default avatarGao Xiang <hsiangkao@linux.alibaba.com>
      ea0b7b0d
    • Sun Ke's avatar
      erofs: fix error return code in erofs_fscache_{meta_,}read_folio · 5bd9628b
      Sun Ke authored
      If erofs_fscache_alloc_request fail and then goto out, it will return 0.
      it should return a negative error code instead of 0.
      
      Fixes: d435d532 ("erofs: change to use asynchronous io for fscache readpage/readahead")
      Signed-off-by: default avatarSun Ke <sunke32@huawei.com>
      Reviewed-by: default avatarJingbo Xu <jefflexu@linux.alibaba.com>
      Reviewed-by: default avatarGao Xiang <hsiangkao@linux.alibaba.com>
      Reviewed-by: default avatarChao Yu <chao@kernel.org>
      Link: https://lore.kernel.org/r/20220815034829.3940803-1-sunke32@huawei.comSigned-off-by: default avatarGao Xiang <hsiangkao@linux.alibaba.com>
      5bd9628b
    • Sebastian Andrzej Siewior's avatar
      asm-generic: Conditionally enable do_softirq_own_stack() via Kconfig. · 8cbb2b50
      Sebastian Andrzej Siewior authored
      Remove the CONFIG_PREEMPT_RT symbol from the ifdef around
      do_softirq_own_stack() and move it to Kconfig instead.
      
      Enable softirq stacks based on SOFTIRQ_ON_OWN_STACK which depends on
      HAVE_SOFTIRQ_ON_OWN_STACK and its default value is set to !PREEMPT_RT.
      This ensures that softirq stacks are not used on PREEMPT_RT and avoids
      a 'select' statement on an option which has a 'depends' statement.
      
      Link: https://lore.kernel.org/YvN5E%2FPrHfUhggr7@linutronix.deSigned-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      8cbb2b50
    • David S. Miller's avatar
      Merge tag 'for-net-2022-09-02' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth · beb43252
      David S. Miller authored
      Luiz Augusto von Dentz says:
      
      ====================
      bluetooth pull request for net:
      
       - Fix regression preventing ACL packet transmission
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      beb43252
    • Christophe JAILLET's avatar
      stmmac: intel: Simplify intel_eth_pci_remove() · 1621e70f
      Christophe JAILLET authored
      There is no point to call pcim_iounmap_regions() in the remove function,
      this frees a managed resource that would be release by the framework
      anyway.
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Reviewed-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1621e70f
    • Greg Kroah-Hartman's avatar
      net: mvpp2: debugfs: fix memory leak when using debugfs_lookup() · fe2c9c61
      Greg Kroah-Hartman authored
      When calling debugfs_lookup() the result must have dput() called on it,
      otherwise the memory will leak over time.  Fix this up to be much
      simpler logic and only create the root debugfs directory once when the
      driver is first accessed.  That resolves the memory leak and makes
      things more obvious as to what the intent is.
      
      Cc: Marcin Wojtas <mw@semihalf.com>
      Cc: Russell King <linux@armlinux.org.uk>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: Paolo Abeni <pabeni@redhat.com>
      Cc: netdev@vger.kernel.org
      Cc: stable <stable@kernel.org>
      Fixes: 21da57a2 ("net: mvpp2: add a debugfs interface for the Header Parser")
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fe2c9c61
    • David Lebrun's avatar
      ipv6: sr: fix out-of-bounds read when setting HMAC data. · 84a53580
      David Lebrun authored
      The SRv6 layer allows defining HMAC data that can later be used to sign IPv6
      Segment Routing Headers. This configuration is realised via netlink through
      four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and
      SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual
      length of the SECRET attribute, it is possible to provide invalid combinations
      (e.g., secret = "", secretlen = 64). This case is not checked in the code and
      with an appropriately crafted netlink message, an out-of-bounds read of up
      to 64 bytes (max secret length) can occur past the skb end pointer and into
      skb_shared_info:
      
      Breakpoint 1, seg6_genl_sethmac (skb=<optimized out>, info=<optimized out>) at net/ipv6/seg6.c:208
      208		memcpy(hinfo->secret, secret, slen);
      (gdb) bt
       #0  seg6_genl_sethmac (skb=<optimized out>, info=<optimized out>) at net/ipv6/seg6.c:208
       #1  0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=skb@entry=0xffff88800b1f9f00, nlh=nlh@entry=0xffff88800b1b7600,
          extack=extack@entry=0xffffc90000ba7af0, ops=ops@entry=0xffffc90000ba7a80, hdrlen=4, net=0xffffffff84237580 <init_net>, family=<optimized out>,
          family=<optimized out>) at net/netlink/genetlink.c:731
       #2  0xffffffff81e01435 in genl_family_rcv_msg (extack=0xffffc90000ba7af0, nlh=0xffff88800b1b7600, skb=0xffff88800b1f9f00,
          family=0xffffffff82fef6c0 <seg6_genl_family>) at net/netlink/genetlink.c:775
       #3  genl_rcv_msg (skb=0xffff88800b1f9f00, nlh=0xffff88800b1b7600, extack=0xffffc90000ba7af0) at net/netlink/genetlink.c:792
       #4  0xffffffff81dfffc3 in netlink_rcv_skb (skb=skb@entry=0xffff88800b1f9f00, cb=cb@entry=0xffffffff81e01350 <genl_rcv_msg>)
          at net/netlink/af_netlink.c:2501
       #5  0xffffffff81e00919 in genl_rcv (skb=0xffff88800b1f9f00) at net/netlink/genetlink.c:803
       #6  0xffffffff81dff6ae in netlink_unicast_kernel (ssk=0xffff888010eec800, skb=0xffff88800b1f9f00, sk=0xffff888004aed000)
          at net/netlink/af_netlink.c:1319
       #7  netlink_unicast (ssk=ssk@entry=0xffff888010eec800, skb=skb@entry=0xffff88800b1f9f00, portid=portid@entry=0, nonblock=<optimized out>)
          at net/netlink/af_netlink.c:1345
       #8  0xffffffff81dff9a4 in netlink_sendmsg (sock=<optimized out>, msg=0xffffc90000ba7e48, len=<optimized out>) at net/netlink/af_netlink.c:1921
      ...
      (gdb) p/x ((struct sk_buff *)0xffff88800b1f9f00)->head + ((struct sk_buff *)0xffff88800b1f9f00)->end
      $1 = 0xffff88800b1b76c0
      (gdb) p/x secret
      $2 = 0xffff88800b1b76c0
      (gdb) p slen
      $3 = 64 '@'
      
      The OOB data can then be read back from userspace by dumping HMAC state. This
      commit fixes this by ensuring SECRETLEN cannot exceed the actual length of
      SECRET.
      Reported-by: default avatarLucas Leong <wmliang.tw@gmail.com>
      Tested: verified that EINVAL is correctly returned when secretlen > len(secret)
      Fixes: 4f4853dc ("ipv6: sr: implement API to control SR HMAC structure")
      Signed-off-by: default avatarDavid Lebrun <dlebrun@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      84a53580
    • David S. Miller's avatar
      Merge branch 'bonding-fixes' · 060ad609
      David S. Miller authored
      Hangbin Liu says:
      
      ====================
      bonding: fix lladdr finding and confirmation
      
      This patch set fixed 3 issues when setting lladdr as bonding IPv6 target.
      Please see each patch for the details.
      
      v2: separate the patch to 3 parts
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      060ad609
    • Hangbin Liu's avatar
      bonding: accept unsolicited NA message · 592335a4
      Hangbin Liu authored
      The unsolicited NA message with all-nodes multicast dest address should
      be valid, as this also means the link could reach the target.
      
      Also rename bond_validate_ns() to bond_validate_na().
      Reported-by: default avatarLiLiang <liali@redhat.com>
      Fixes: 5e1eeef6 ("bonding: NS target should accept link local address")
      Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      592335a4
    • Hangbin Liu's avatar
      bonding: add all node mcast address when slave up · fd16eb94
      Hangbin Liu authored
      When a link is enslave to bond, it need to set the interface down first.
      This makes the slave remove mac multicast address 33:33:00:00:00:01(The
      IPv6 multicast address ff02::1 is kept even when the interface down). When
      bond set the slave up, ipv6_mc_up() was not called due to commit c2edacf8
      ("bonding / ipv6: no addrconf for slaves separately from master").
      
      This is not an issue before we adding the lladdr target feature for bonding,
      as the mac multicast address will be added back when bond interface up and
      join group ff02::1.
      
      But after adding lladdr target feature for bonding. When user set a lladdr
      target, the unsolicited NA message with all-nodes multicast dest will be
      dropped as the slave interface never add 33:33:00:00:00:01 back.
      
      Fix this by calling ipv6_mc_up() to add 33:33:00:00:00:01 back when
      the slave interface up.
      Reported-by: default avatarLiLiang <liali@redhat.com>
      Fixes: 5e1eeef6 ("bonding: NS target should accept link local address")
      Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fd16eb94
    • Hangbin Liu's avatar
      bonding: use unspecified address if no available link local address · b7f14132
      Hangbin Liu authored
      When ns_ip6_target was set, the ipv6_dev_get_saddr() will be called to get
      available source address and send IPv6 neighbor solicit message.
      
      If the target is global address, ipv6_dev_get_saddr() will get any
      available src address. But if the target is link local address,
      ipv6_dev_get_saddr() will only get available address from our interface,
      i.e. the corresponding bond interface.
      
      But before bond interface up, all the address is tentative, while
      ipv6_dev_get_saddr() will ignore tentative address. This makes we can't
      find available link local src address, then bond_ns_send() will not be
      called and no NS message was sent. Finally bond interface will keep in
      down state.
      
      Fix this by sending NS with unspecified address if there is no available
      source address.
      Reported-by: default avatarLiLiang <liali@redhat.com>
      Fixes: 5e1eeef6 ("bonding: NS target should accept link local address")
      Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b7f14132
  6. 04 Sep, 2022 2 commits
    • Linus Torvalds's avatar
      Linux 6.0-rc4 · 7e18e42e
      Linus Torvalds authored
      7e18e42e
    • Linus Torvalds's avatar
      Merge tag 'powerpc-6.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 59954972
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
      
       - Fix handling of PCI domains in /proc on 32-bit systems using the
         recently added support for numbering buses from zero for each domain.
      
       - A fix and a revert for some changes to use READ/WRITE_ONCE() which
         caused problems with KASAN enabled due to sanitisation calls being
         introduced in low-level paths that can't cope with it.
      
       - Fix build errors on 32-bit caused by the syscall table being
         misaligned sometimes.
      
       - Two fixes to get IBM Cell native machines booting again, which had
         bit-rotted while my QS22 was temporarily out of action.
      
       - Fix the papr_scm driver to not assume the order of events returned by
         the hypervisor is stable, and a related compile fix.
      
      Thanks to Aneesh Kumar K.V, Christophe Leroy, Jordan Niethe, Kajol Jain,
      Masahiro Yamada, Nathan Chancellor, Pali Rohár, Vaibhav Jain, and Zhouyi
      Zhou.
      
      * tag 'powerpc-6.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/papr_scm: Ensure rc is always initialized in papr_scm_pmu_register()
        Revert "powerpc/irq: Don't open code irq_soft_mask helpers"
        powerpc: Fix hard_irq_disable() with sanitizer
        powerpc/rtas: Fix RTAS MSR[HV] handling for Cell
        Revert "powerpc: Remove unused FW_FEATURE_NATIVE references"
        powerpc: align syscall table for ppc32
        powerpc/pci: Enable PCI domains in /proc when PCI bus numbers are not unique
        powerpc/papr_scm: Fix nvdimm event mappings
      59954972