From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1842EC433F5 for ; Fri, 4 Feb 2022 09:24:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357520AbiBDJX7 (ORCPT ); Fri, 4 Feb 2022 04:23:59 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52016 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357809AbiBDJXG (ORCPT ); Fri, 4 Feb 2022 04:23:06 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D0174B836B9; Fri, 4 Feb 2022 09:23:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F1981C004E1; Fri, 4 Feb 2022 09:23:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966583; bh=4KnP9f2BG2N0gQWpClCCaBlbp1tyU3Pjw2Z1LPrgmQ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Nw3vkuh8LQpryVQJvapvB1VKd70Rlc/diKfHVozmJ3jXJteEAU0s5d3ZS3owm13aR nEbgrJgIT5H9cVnqydC5TOtIuSm3AdjS1yRlkLlTOXeIRE86TuSjNTU7a7iuCJF3DH 4clXFU43GN1TGYmBBCm42uV9yC38OvftHBiy03lk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joseph Bao , Lukas Wunner , Bjorn Helgaas , Stuart Hayes Subject: [PATCH 5.15 01/32] PCI: pciehp: Fix infinite loop in IRQ handler upon power fault Date: Fri, 4 Feb 2022 10:22:11 +0100 Message-Id: <20220204091915.298182626@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Wunner commit 23584c1ed3e15a6f4bfab8dc5a88d94ab929ee12 upstream. The Power Fault Detected bit in the Slot Status register differs from all other hotplug events in that it is sticky: It can only be cleared after turning off slot power. Per PCIe r5.0, sec. 6.7.1.8: If a power controller detects a main power fault on the hot-plug slot, it must automatically set its internal main power fault latch [...]. The main power fault latch is cleared when software turns off power to the hot-plug slot. The stickiness used to cause interrupt storms and infinite loops which were fixed in 2009 by commits 5651c48cfafe ("PCI pciehp: fix power fault interrupt storm problem") and 99f0169c17f3 ("PCI: pciehp: enable software notification on empty slots"). Unfortunately in 2020 the infinite loop issue was inadvertently reintroduced by commit 8edf5332c393 ("PCI: pciehp: Fix MSI interrupt race"): The hardirq handler pciehp_isr() clears the PFD bit until pciehp's power_fault_detected flag is set. That happens in the IRQ thread pciehp_ist(), which never learns of the event because the hardirq handler is stuck in an infinite loop. Fix by setting the power_fault_detected flag already in the hardirq handler. Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D214989 Link: https://lore.kernel.org/linux-pci/DM8PR11MB5702255A6A92F735D90A444686= 8B9@DM8PR11MB5702.namprd11.prod.outlook.com Fixes: 8edf5332c393 ("PCI: pciehp: Fix MSI interrupt race") Link: https://lore.kernel.org/r/66eaeef31d4997ceea357ad93259f290ededecfd.16= 37187226.git.lukas@wunner.de Reported-by: Joseph Bao Tested-by: Joseph Bao Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org # v4.19+ Cc: Stuart Hayes Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/pci/hotplug/pciehp_hpc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/drivers/pci/hotplug/pciehp_hpc.c +++ b/drivers/pci/hotplug/pciehp_hpc.c @@ -642,6 +642,8 @@ read_status: */ if (ctrl->power_fault_detected) status &=3D ~PCI_EXP_SLTSTA_PFD; + else if (status & PCI_EXP_SLTSTA_PFD) + ctrl->power_fault_detected =3D true; =20 events |=3D status; if (!events) { @@ -651,7 +653,7 @@ read_status: } =20 if (status) { - pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, events); + pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, status); =20 /* * In MSI mode, all event bits must be zero before the port @@ -725,8 +727,7 @@ static irqreturn_t pciehp_ist(int irq, v } =20 /* Check Power Fault Detected */ - if ((events & PCI_EXP_SLTSTA_PFD) && !ctrl->power_fault_detected) { - ctrl->power_fault_detected =3D 1; + if (events & PCI_EXP_SLTSTA_PFD) { ctrl_err(ctrl, "Slot(%s): Power fault\n", slot_name(ctrl)); pciehp_set_indicators(ctrl, PCI_EXP_SLTCTL_PWR_IND_OFF, PCI_EXP_SLTCTL_ATTN_IND_ON); From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 654EFC4332F for ; Fri, 4 Feb 2022 09:24:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357915AbiBDJYq (ORCPT ); Fri, 4 Feb 2022 04:24:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32920 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357531AbiBDJX7 (ORCPT ); Fri, 4 Feb 2022 04:23:59 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C4A52C061751; Fri, 4 Feb 2022 01:23:59 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 610E9B836EA; Fri, 4 Feb 2022 09:23:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 66789C004E1; Fri, 4 Feb 2022 09:23:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966619; bh=+oZvMD9AMkNurmINvNaniI2N5vd3IeWpBeB50CWq3EY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=b1547bn1I6R2D+PYsViTGrdb8/em5iCQSU15tF5lHEj2nKG8tGBbH37yzpiB6fuDm zR1WaAwUavb8BVBQYcveWZPjsKzJOSSfngPx1/GPid1Zz61LI1/bEfDrBZftRAjzBV L97C+E/3DSyQnw5iw810pIHIUTWTBEt+/s7ZR9Sg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paolo Abeni , Mat Martineau , Jakub Kicinski , Geliang Tang Subject: [PATCH 5.15 02/32] selftests: mptcp: fix ipv6 routing setup Date: Fri, 4 Feb 2022 10:22:12 +0100 Message-Id: <20220204091915.330086969@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Paolo Abeni commit 9846921dba4936d92f7608315b5d1e0a8ec3a538 upstream. MPJ ipv6 selftests currently lack per link route to the server net. Additionally, ipv6 subflows endpoints are created without any interface specified. The end-result is that in ipv6 self-tests subflows are created all on the same link, leading to expected delays and sporadic self-tests failures. Fix the issue by adding the missing setup bits. Fixes: 523514ed0a99 ("selftests: mptcp: add ADD_ADDR IPv6 test cases") Reported-and-tested-by: Geliang Tang Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- tools/testing/selftests/net/mptcp/mptcp_join.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -75,6 +75,7 @@ init() =20 # let $ns2 reach any $ns1 address from any interface ip -net "$ns2" route add default via 10.0.$i.1 dev ns2eth$i metric 10$i + ip -net "$ns2" route add default via dead:beef:$i::1 dev ns2eth$i metric= 10$i done } =20 @@ -1383,7 +1384,7 @@ ipv6_tests() reset ip netns exec $ns1 ./pm_nl_ctl limits 0 1 ip netns exec $ns2 ./pm_nl_ctl limits 0 1 - ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 flags subflow + ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 dev ns2eth3 flags subfl= ow run_tests $ns1 $ns2 dead:beef:1::1 0 0 0 slow chk_join_nr "single subflow IPv6" 1 1 1 =20 @@ -1418,7 +1419,7 @@ ipv6_tests() ip netns exec $ns1 ./pm_nl_ctl limits 0 2 ip netns exec $ns1 ./pm_nl_ctl add dead:beef:2::1 flags signal ip netns exec $ns2 ./pm_nl_ctl limits 1 2 - ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 flags subflow + ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 dev ns2eth3 flags subfl= ow run_tests $ns1 $ns2 dead:beef:1::1 0 -1 -1 slow chk_join_nr "remove subflow and signal IPv6" 2 2 2 chk_add_nr 1 1 From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 590EAC433FE for ; Fri, 4 Feb 2022 09:25:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235780AbiBDJZI (ORCPT ); Fri, 4 Feb 2022 04:25:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33138 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357636AbiBDJYB (ORCPT ); Fri, 4 Feb 2022 04:24:01 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 29B87C06175C; Fri, 4 Feb 2022 01:24:01 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2BD65B836F2; Fri, 4 Feb 2022 09:23:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 23BE2C004E1; Fri, 4 Feb 2022 09:23:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966625; bh=wDWmQp90kgCrwgiLNL+U3qc/fKgK7nB1VdZ628Ja/X0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FchSeYMUvqgKvtu6MRQ/QORm2/3Cjvm2DUNPtWpp0p07k5+aPHres0fBm63Lq29pA 2XgslXEbGWkeAH2QAGOgdAQt6z1eE9P+Xb9t25PQp7Bf6YF0GInKoxasvUWBNuSKNT z7MD7y2OJVvAs8+6aW0wG+JRtmPcMfDvMYUAUjrc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alex Elder , "David S. Miller" Subject: [PATCH 5.15 03/32] net: ipa: use a bitmap for endpoint replenish_enabled Date: Fri, 4 Feb 2022 10:22:13 +0100 Message-Id: <20220204091915.359696757@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alex Elder commit c1aaa01dbf4cef95af3e04a5a43986c290e06ea3 upstream. Define a new replenish_flags bitmap to contain Boolean flags associated with an endpoint's replenishing state. Replace the replenish_enabled field with a flag in that bitmap. This is to prepare for the next patch, which adds another flag. Signed-off-by: Alex Elder Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ipa/ipa_endpoint.c | 8 ++++---- drivers/net/ipa/ipa_endpoint.h | 15 +++++++++++++-- 2 files changed, 17 insertions(+), 6 deletions(-) --- a/drivers/net/ipa/ipa_endpoint.c +++ b/drivers/net/ipa/ipa_endpoint.c @@ -1069,7 +1069,7 @@ static void ipa_endpoint_replenish(struc u32 backlog; int delta; =20 - if (!endpoint->replenish_enabled) { + if (!test_bit(IPA_REPLENISH_ENABLED, endpoint->replenish_flags)) { if (add_one) atomic_inc(&endpoint->replenish_saved); return; @@ -1106,7 +1106,7 @@ static void ipa_endpoint_replenish_enabl u32 max_backlog; u32 saved; =20 - endpoint->replenish_enabled =3D true; + set_bit(IPA_REPLENISH_ENABLED, endpoint->replenish_flags); while ((saved =3D atomic_xchg(&endpoint->replenish_saved, 0))) atomic_add(saved, &endpoint->replenish_backlog); =20 @@ -1120,7 +1120,7 @@ static void ipa_endpoint_replenish_disab { u32 backlog; =20 - endpoint->replenish_enabled =3D false; + clear_bit(IPA_REPLENISH_ENABLED, endpoint->replenish_flags); while ((backlog =3D atomic_xchg(&endpoint->replenish_backlog, 0))) atomic_add(backlog, &endpoint->replenish_saved); } @@ -1665,7 +1665,7 @@ static void ipa_endpoint_setup_one(struc /* RX transactions require a single TRE, so the maximum * backlog is the same as the maximum outstanding TREs. */ - endpoint->replenish_enabled =3D false; + clear_bit(IPA_REPLENISH_ENABLED, endpoint->replenish_flags); atomic_set(&endpoint->replenish_saved, gsi_channel_tre_max(gsi, endpoint->channel_id)); atomic_set(&endpoint->replenish_backlog, 0); --- a/drivers/net/ipa/ipa_endpoint.h +++ b/drivers/net/ipa/ipa_endpoint.h @@ -41,6 +41,17 @@ enum ipa_endpoint_name { #define IPA_ENDPOINT_MAX 32 /* Max supported by driver */ =20 /** + * enum ipa_replenish_flag: RX buffer replenish flags + * + * @IPA_REPLENISH_ENABLED: Whether receive buffer replenishing is enabled + * @IPA_REPLENISH_COUNT: Number of defined replenish flags + */ +enum ipa_replenish_flag { + IPA_REPLENISH_ENABLED, + IPA_REPLENISH_COUNT, /* Number of flags (must be last) */ +}; + +/** * struct ipa_endpoint - IPA endpoint information * @ipa: IPA pointer * @ee_id: Execution environmnent endpoint is associated with @@ -51,7 +62,7 @@ enum ipa_endpoint_name { * @trans_tre_max: Maximum number of TRE descriptors per transaction * @evt_ring_id: GSI event ring used by the endpoint * @netdev: Network device pointer, if endpoint uses one - * @replenish_enabled: Whether receive buffer replenishing is enabled + * @replenish_flags: Replenishing state flags * @replenish_ready: Number of replenish transactions without doorbell * @replenish_saved: Replenish requests held while disabled * @replenish_backlog: Number of buffers needed to fill hardware queue @@ -72,7 +83,7 @@ struct ipa_endpoint { struct net_device *netdev; =20 /* Receive buffer replenishing for RX endpoints */ - bool replenish_enabled; + DECLARE_BITMAP(replenish_flags, IPA_REPLENISH_COUNT); u32 replenish_ready; atomic_t replenish_saved; atomic_t replenish_backlog; From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D3B99C433FE for ; Fri, 4 Feb 2022 09:24:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357737AbiBDJYs (ORCPT ); Fri, 4 Feb 2022 04:24:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60910 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357552AbiBDJYA (ORCPT ); Fri, 4 Feb 2022 04:24:00 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4E968C061756; Fri, 4 Feb 2022 01:24:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3576AB836E9; Fri, 4 Feb 2022 09:23:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4FCE7C340ED; Fri, 4 Feb 2022 09:23:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966629; bh=wsDPVvMJ3fihSgGDbISGT78IhKQRNro2j33j6ziBLu4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jrlYvKf8iVqxO/4Nv+xUycCoAQSst0biifWmVk8Kp+09sw06/1ljdR5jeg6+fDk0U S56/wXDVViBtmt5Mqvit4/bzD5K+T2av15yqcfPO03iIa5mKnN1+b1BxB9NyeBbrW8 qMaXJFEBbF45qjOTfbwmibOS47dkuFkA5ACIfzeA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alex Elder , "David S. Miller" Subject: [PATCH 5.15 04/32] net: ipa: prevent concurrent replenish Date: Fri, 4 Feb 2022 10:22:14 +0100 Message-Id: <20220204091915.389958277@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alex Elder commit 998c0bd2b3715244da7639cc4e6a2062cb79c3f4 upstream. We have seen cases where an endpoint RX completion interrupt arrives while replenishing for the endpoint is underway. This causes another instance of replenishing to begin as part of completing the receive transaction. If this occurs it can lead to transaction corruption. Use a new flag to ensure only one replenish instance for an endpoint executes at a time. Fixes: 84f9bd12d46db ("soc: qcom: ipa: IPA endpoints") Signed-off-by: Alex Elder Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ipa/ipa_endpoint.c | 13 +++++++++++++ drivers/net/ipa/ipa_endpoint.h | 2 ++ 2 files changed, 15 insertions(+) --- a/drivers/net/ipa/ipa_endpoint.c +++ b/drivers/net/ipa/ipa_endpoint.c @@ -1075,15 +1075,27 @@ static void ipa_endpoint_replenish(struc return; } =20 + /* If already active, just update the backlog */ + if (test_and_set_bit(IPA_REPLENISH_ACTIVE, endpoint->replenish_flags)) { + if (add_one) + atomic_inc(&endpoint->replenish_backlog); + return; + } + while (atomic_dec_not_zero(&endpoint->replenish_backlog)) if (ipa_endpoint_replenish_one(endpoint)) goto try_again_later; + + clear_bit(IPA_REPLENISH_ACTIVE, endpoint->replenish_flags); + if (add_one) atomic_inc(&endpoint->replenish_backlog); =20 return; =20 try_again_later: + clear_bit(IPA_REPLENISH_ACTIVE, endpoint->replenish_flags); + /* The last one didn't succeed, so fix the backlog */ delta =3D add_one ? 2 : 1; backlog =3D atomic_add_return(delta, &endpoint->replenish_backlog); @@ -1666,6 +1678,7 @@ static void ipa_endpoint_setup_one(struc * backlog is the same as the maximum outstanding TREs. */ clear_bit(IPA_REPLENISH_ENABLED, endpoint->replenish_flags); + clear_bit(IPA_REPLENISH_ACTIVE, endpoint->replenish_flags); atomic_set(&endpoint->replenish_saved, gsi_channel_tre_max(gsi, endpoint->channel_id)); atomic_set(&endpoint->replenish_backlog, 0); --- a/drivers/net/ipa/ipa_endpoint.h +++ b/drivers/net/ipa/ipa_endpoint.h @@ -44,10 +44,12 @@ enum ipa_endpoint_name { * enum ipa_replenish_flag: RX buffer replenish flags * * @IPA_REPLENISH_ENABLED: Whether receive buffer replenishing is enabled + * @IPA_REPLENISH_ACTIVE: Whether replenishing is underway * @IPA_REPLENISH_COUNT: Number of defined replenish flags */ enum ipa_replenish_flag { IPA_REPLENISH_ENABLED, + IPA_REPLENISH_ACTIVE, IPA_REPLENISH_COUNT, /* Number of flags (must be last) */ }; =20 From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1C9AC433EF for ; Fri, 4 Feb 2022 09:25:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232689AbiBDJZG (ORCPT ); Fri, 4 Feb 2022 04:25:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60912 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357632AbiBDJYB (ORCPT ); Fri, 4 Feb 2022 04:24:01 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7097FC06175B; Fri, 4 Feb 2022 01:24:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 47BFBB836F6; Fri, 4 Feb 2022 09:23:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 80AF6C004E1; Fri, 4 Feb 2022 09:23:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966632; bh=OxpOP/jUrCZimqEHq+PDepB4El50IioImZso2DkqQNM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=X527u0MpPCe/WStAqYkPIcrVOFgt/1A7GFensW9AJwdOTSvinj5w0/gzCS7hRZzCQ Kn4YAWebRcfBAwRq3VWsLc1527tLbhdinM4WZUtQAW644eaW3TN4GnzI4tYrboPrZb kG8gX5jOC9gkqtecUZS/IT+K/N5UpfoKOraG6pv4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Stapelberg , Maxime Ripard Subject: [PATCH 5.15 05/32] drm/vc4: hdmi: Make sure the device is powered with CEC Date: Fri, 4 Feb 2022 10:22:15 +0100 Message-Id: <20220204091915.421812582@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maxime Ripard Commit 20b0dfa86bef0e80b41b0e5ac38b92f23b6f27f9 upstream. The original commit depended on a rework commit (724fc856c09e ("drm/vc4: hdmi: Split the CEC disable / enable functions in two")) that (rightfully) didn't reach stable. However, probably because the context changed, when the patch was applied to stable the pm_runtime_put called got moved to the end of the vc4_hdmi_cec_adap_enable function (that would have become vc4_hdmi_cec_disable with the rework) to vc4_hdmi_cec_init. This means that at probe time, we now drop our reference to the clocks and power domains and thus end up with a CPU hang when the CPU tries to access registers. The call to pm_runtime_resume_and_get() is also problematic since the .adap_enable CEC hook is called both to enable and to disable the controller. That means that we'll now call pm_runtime_resume_and_get() at disable time as well, messing with the reference counting. The behaviour we should have though would be to have pm_runtime_resume_and_get() called when the CEC controller is enabled, and pm_runtime_put when it's disabled. We need to move things around a bit to behave that way, but it aligns stable with upstream. Cc: # 5.10.x Cc: # 5.15.x Cc: # 5.16.x Reported-by: Michael Stapelberg Signed-off-by: Maxime Ripard Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/gpu/drm/vc4/vc4_hdmi.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) --- a/drivers/gpu/drm/vc4/vc4_hdmi.c +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c @@ -1738,18 +1738,18 @@ static int vc4_hdmi_cec_adap_enable(stru u32 val; int ret; =20 - ret =3D pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev); - if (ret) - return ret; + if (enable) { + ret =3D pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev); + if (ret) + return ret; =20 - val =3D HDMI_READ(HDMI_CEC_CNTRL_5); - val &=3D ~(VC4_HDMI_CEC_TX_SW_RESET | VC4_HDMI_CEC_RX_SW_RESET | - VC4_HDMI_CEC_CNT_TO_4700_US_MASK | - VC4_HDMI_CEC_CNT_TO_4500_US_MASK); - val |=3D ((4700 / usecs) << VC4_HDMI_CEC_CNT_TO_4700_US_SHIFT) | - ((4500 / usecs) << VC4_HDMI_CEC_CNT_TO_4500_US_SHIFT); + val =3D HDMI_READ(HDMI_CEC_CNTRL_5); + val &=3D ~(VC4_HDMI_CEC_TX_SW_RESET | VC4_HDMI_CEC_RX_SW_RESET | + VC4_HDMI_CEC_CNT_TO_4700_US_MASK | + VC4_HDMI_CEC_CNT_TO_4500_US_MASK); + val |=3D ((4700 / usecs) << VC4_HDMI_CEC_CNT_TO_4700_US_SHIFT) | + ((4500 / usecs) << VC4_HDMI_CEC_CNT_TO_4500_US_SHIFT); =20 - if (enable) { HDMI_WRITE(HDMI_CEC_CNTRL_5, val | VC4_HDMI_CEC_TX_SW_RESET | VC4_HDMI_CEC_RX_SW_RESET); HDMI_WRITE(HDMI_CEC_CNTRL_5, val); @@ -1777,7 +1777,10 @@ static int vc4_hdmi_cec_adap_enable(stru HDMI_WRITE(HDMI_CEC_CPU_MASK_SET, VC4_HDMI_CPU_CEC); HDMI_WRITE(HDMI_CEC_CNTRL_5, val | VC4_HDMI_CEC_TX_SW_RESET | VC4_HDMI_CEC_RX_SW_RESET); + + pm_runtime_put(&vc4_hdmi->pdev->dev); } + return 0; } =20 @@ -1888,8 +1891,6 @@ static int vc4_hdmi_cec_init(struct vc4_ if (ret < 0) goto err_remove_handlers; =20 - pm_runtime_put(&vc4_hdmi->pdev->dev); - return 0; =20 err_remove_handlers: From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A72F5C433FE for ; Fri, 4 Feb 2022 09:25:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357673AbiBDJY7 (ORCPT ); Fri, 4 Feb 2022 04:24:59 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:43090 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357508AbiBDJX4 (ORCPT ); Fri, 4 Feb 2022 04:23:56 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 26BE0615C6; Fri, 4 Feb 2022 09:23:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3F74C004E1; Fri, 4 Feb 2022 09:23:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966635; bh=FK7HW77aApN49lJNDt5ACm2k24XuNaZJ0yWAgCuC1Ow=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zEU7IKZIkVq3g7OgtAbcm7NdMLU/Zle/b2p2CUIkyToQoaUXQvOUKiKJimqAiK3KD 5WoqHgja/A0t9E36iDx0zZZUc9NAOdUbJEpL8zjSO4U86BYSXkND7ucGqd2YnZn7ZQ F6Z4mnmfykrEG9RVu3ecximMDM/u+wZuZbm4mG5k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tabitha Sable , "Eric W. Biederman" , Tejun Heo Subject: [PATCH 5.15 06/32] cgroup-v1: Require capabilities to set release_agent Date: Fri, 4 Feb 2022 10:22:16 +0100 Message-Id: <20220204091915.456572247@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric W. Biederman commit 24f6008564183aa120d07c03d9289519c2fe02af upstream. The cgroup release_agent is called with call_usermodehelper. The function call_usermodehelper starts the release_agent with a full set fo capabilitie= s. Therefore require capabilities when setting the release_agaent. Reported-by: Tabitha Sable Tested-by: Tabitha Sable Fixes: 81a6a5cdd2c5 ("Task Control Groups: automatic userspace notification= of idle cgroups") Cc: stable@vger.kernel.org # v2.6.24+ Signed-off-by: "Eric W. Biederman" Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- kernel/cgroup/cgroup-v1.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -552,6 +552,14 @@ static ssize_t cgroup_release_agent_writ =20 BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX); =20 + /* + * Release agent gets called with all capabilities, + * require capabilities to set release agent. + */ + if ((of->file->f_cred->user_ns !=3D &init_user_ns) || + !capable(CAP_SYS_ADMIN)) + return -EPERM; + cgrp =3D cgroup_kn_lock_live(of->kn, false); if (!cgrp) return -ENODEV; @@ -963,6 +971,12 @@ int cgroup1_parse_param(struct fs_contex /* Specifying two release agents is forbidden */ if (ctx->release_agent) return invalfc(fc, "release_agent respecified"); + /* + * Release agent gets called with all capabilities, + * require capabilities to set release agent. + */ + if ((fc->user_ns !=3D &init_user_ns) || !capable(CAP_SYS_ADMIN)) + return invalfc(fc, "Setting release_agent not allowed"); ctx->release_agent =3D param->string; param->string =3D NULL; break; From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71175C433F5 for ; Fri, 4 Feb 2022 09:24:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357975AbiBDJYy (ORCPT ); Fri, 4 Feb 2022 04:24:54 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32918 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357535AbiBDJX7 (ORCPT ); Fri, 4 Feb 2022 04:23:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E3821C061753; Fri, 4 Feb 2022 01:23:59 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 54DEB61602; Fri, 4 Feb 2022 09:23:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CB70FC004E1; Fri, 4 Feb 2022 09:23:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966638; bh=LmrbcHvcX9oIGN9xKCE/bc6nuizkuV8gy2HnJpudulg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DJ7e0+cFDc1MG2tKCwkmO3YDSCdX9m5TlF13HtYCUAUAz4P18BPo0J2xFdiTyUGeh vb/mEFbHJfg16JdoZn1zHId0n8PrvPmoa8ReBKYxQFi6wjStvsVjxekOzoi4uVyDeq ZIiADyGNZXl4pWFoRzcpKOChi+A4Xlpt2XdJ5tog= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christoph Hellwig , Minchan Kim , Matthew Wilcox , Christian Borntraeger , Heiko Carstens , Vasily Gorbik , John Hubbard , Linus Torvalds , Will McVicker Subject: [PATCH 5.15 07/32] Revert "mm/gup: small refactoring: simplify try_grab_page()" Date: Fri, 4 Feb 2022 10:22:17 +0100 Message-Id: <20220204091915.496267001@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: John Hubbard commit c36c04c2e132fc39f6b658bf607aed4425427fd7 upstream. This reverts commit 54d516b1d62ff8f17cee2da06e5e4706a0d00b8a That commit did a refactoring that effectively combined fast and slow gup paths (again). And that was again incorrect, for two reasons: a) Fast gup and slow gup get reference counts on pages in different ways and with different goals: see Linus' writeup in commit cd1adf1b63a1 ("Revert "mm/gup: remove try_get_page(), call try_get_compound_head() directly""), and b) try_grab_compound_head() also has a specific check for "FOLL_LONGTERM && !is_pinned(page)", that assumes that the caller can fall back to slow gup. This resulted in new failures, as recently report by Will McVicker [1]. But (a) has problems too, even though they may not have been reported yet. So just revert this. Link: https://lore.kernel.org/r/20220131203504.3458775-1-willmcvicker@googl= e.com [1] Fixes: 54d516b1d62f ("mm/gup: small refactoring: simplify try_grab_page()") Reported-and-tested-by: Will McVicker Cc: Christoph Hellwig Cc: Minchan Kim Cc: Matthew Wilcox Cc: Christian Borntraeger Cc: Heiko Carstens Cc: Vasily Gorbik Cc: stable@vger.kernel.org # 5.15 Signed-off-by: John Hubbard Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- mm/gup.c | 35 ++++++++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-) --- a/mm/gup.c +++ b/mm/gup.c @@ -124,8 +124,8 @@ static inline struct page *try_get_compo * considered failure, and furthermore, a likely bug in the caller, so a w= arning * is also emitted. */ -struct page *try_grab_compound_head(struct page *page, - int refs, unsigned int flags) +__maybe_unused struct page *try_grab_compound_head(struct page *page, + int refs, unsigned int flags) { if (flags & FOLL_GET) return try_get_compound_head(page, refs); @@ -208,10 +208,35 @@ static void put_compound_head(struct pag */ bool __must_check try_grab_page(struct page *page, unsigned int flags) { - if (!(flags & (FOLL_GET | FOLL_PIN))) - return true; + WARN_ON_ONCE((flags & (FOLL_GET | FOLL_PIN)) =3D=3D (FOLL_GET | FOLL_PIN)= ); =20 - return try_grab_compound_head(page, 1, flags); + if (flags & FOLL_GET) + return try_get_page(page); + else if (flags & FOLL_PIN) { + int refs =3D 1; + + page =3D compound_head(page); + + if (WARN_ON_ONCE(page_ref_count(page) <=3D 0)) + return false; + + if (hpage_pincount_available(page)) + hpage_pincount_add(page, 1); + else + refs =3D GUP_PIN_COUNTING_BIAS; + + /* + * Similar to try_grab_compound_head(): even if using the + * hpage_pincount_add/_sub() routines, be sure to + * *also* increment the normal page refcount field at least + * once, so that the page really is pinned. + */ + page_ref_add(page, refs); + + mod_node_page_state(page_pgdat(page), NR_FOLL_PIN_ACQUIRED, 1); + } + + return true; } =20 /** From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A158C433F5 for ; Fri, 4 Feb 2022 09:25:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358059AbiBDJZN (ORCPT ); Fri, 4 Feb 2022 04:25:13 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52578 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357717AbiBDJYE (ORCPT ); Fri, 4 Feb 2022 04:24:04 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 30C47B836EA; Fri, 4 Feb 2022 09:24:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 35AC8C004E1; Fri, 4 Feb 2022 09:24:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966641; bh=uIOOkmegQVgIMxeGdS22TVAxE7p78mJf/iAIGcpiIjA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cxg1GZ+BMQkWiviVjnCso0RYp3QxB2B1lmppUghybB7uIDeCtcHCcxNl1Hfs0ZZPJ ez5QUQ2VnaWlz+PPWUAgZPVu1tU0kkQUdkHz+wJyF1IRKx1VmHZShIaU5wzBDzFIrc FmweimEfLBOYge0I+J91x8Wpa2l8zEq2xdars12I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christoph Fritz , Miklos Szeredi Subject: [PATCH 5.15 08/32] ovl: dont fail copy up if no fileattr support on upper Date: Fri, 4 Feb 2022 10:22:18 +0100 Message-Id: <20220204091915.535966495@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miklos Szeredi commit 94fd19752b28aa66c98e7991734af91dfc529f8f upstream. Christoph Fritz is reporting that failure to copy up fileattr when upper doesn't support fileattr or xattr results in a regression. Return success in these failure cases; this reverts overlayfs to the old behavior. Add a pr_warn_once() in these cases to still let the user know about the copy up failures. Reported-by: Christoph Fritz Fixes: 72db82115d2b ("ovl: copy up sync/noatime fileattr flags") Cc: # v5.15 Signed-off-by: Miklos Szeredi Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/overlayfs/copy_up.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) --- a/fs/overlayfs/copy_up.c +++ b/fs/overlayfs/copy_up.c @@ -157,7 +157,9 @@ static int ovl_copy_fileattr(struct inod */ if (oldfa.flags & OVL_PROT_FS_FLAGS_MASK) { err =3D ovl_set_protattr(inode, new->dentry, &oldfa); - if (err) + if (err =3D=3D -EPERM) + pr_warn_once("copying fileattr: no xattr on upper\n"); + else if (err) return err; } =20 @@ -167,6 +169,14 @@ static int ovl_copy_fileattr(struct inod =20 err =3D ovl_real_fileattr_get(new, &newfa); if (err) { + /* + * Returning an error if upper doesn't support fileattr will + * result in a regression, so revert to the old behavior. + */ + if (err =3D=3D -ENOTTY || err =3D=3D -EINVAL) { + pr_warn_once("copying fileattr: no support on upper\n"); + return 0; + } pr_warn("failed to retrieve upper fileattr (%pd2, err=3D%i)\n", new, err); return err; From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6AC92C433F5 for ; Fri, 4 Feb 2022 09:25:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358081AbiBDJZR (ORCPT ); Fri, 4 Feb 2022 04:25:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33170 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357739AbiBDJYG (ORCPT ); Fri, 4 Feb 2022 04:24:06 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3BEC8C061765; Fri, 4 Feb 2022 01:24:06 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A8F4E616A4; Fri, 4 Feb 2022 09:24:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58669C340F2; Fri, 4 Feb 2022 09:24:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966645; bh=b1aaZmEkpsr6AC1Fgfj2kfSj0T+Vlhtiyi8ifmsfxa4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JkPjMjphaouZ7UspvUnrxeEHO23gP8L5r9o+LXz5C2eU9DpIgA3NXMUb2XGG6zrk0 VKsdJkjhCNXhkRsTWYnVZiv7gYag1NrYgI5OILSJGDtVr9/d3aYqRz8ULrUsVDRtLW SOfDrpx3WYGMlj/h9cQg3cGA0plBXoGKgXGUOVt4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Woithe , "J. Bruce Fields" , Chuck Lever Subject: [PATCH 5.15 09/32] lockd: fix server crash on reboot of client holding lock Date: Fri, 4 Feb 2022 10:22:19 +0100 Message-Id: <20220204091915.567321545@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: J. Bruce Fields commit 6e7f90d163afa8fc2efd6ae318e7c20156a5621f upstream. I thought I was iterating over the array when actually the iteration is over the values contained in the array? Ugh, keep it simple. Symptoms were a null deference in vfs_lock_file() when an NFSv3 client that previously held a lock came back up and sent a notify. Reported-by: Jonathan Woithe Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") Signed-off-by: J. Bruce Fields Signed-off-by: Chuck Lever Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/lockd/svcsubs.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) --- a/fs/lockd/svcsubs.c +++ b/fs/lockd/svcsubs.c @@ -179,19 +179,20 @@ nlm_delete_file(struct nlm_file *file) static int nlm_unlock_files(struct nlm_file *file) { struct file_lock lock; - struct file *f; =20 lock.fl_type =3D F_UNLCK; lock.fl_start =3D 0; lock.fl_end =3D OFFSET_MAX; - for (f =3D file->f_file[0]; f <=3D file->f_file[1]; f++) { - if (f && vfs_lock_file(f, F_SETLK, &lock, NULL) < 0) { - pr_warn("lockd: unlock failure in %s:%d\n", - __FILE__, __LINE__); - return 1; - } - } + if (file->f_file[O_RDONLY] && + vfs_lock_file(file->f_file[O_RDONLY], F_SETLK, &lock, NULL)) + goto out_err; + if (file->f_file[O_WRONLY] && + vfs_lock_file(file->f_file[O_WRONLY], F_SETLK, &lock, NULL)) + goto out_err; return 0; +out_err: + pr_warn("lockd: unlock failure in %s:%d\n", __FILE__, __LINE__); + return 1; } =20 /* From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BFDEC4332F for ; Fri, 4 Feb 2022 09:24:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357645AbiBDJYB (ORCPT ); Fri, 4 Feb 2022 04:24:01 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42420 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357221AbiBDJXH (ORCPT ); Fri, 4 Feb 2022 04:23:07 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 33842615A5; Fri, 4 Feb 2022 09:23:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F43EC004E1; Fri, 4 Feb 2022 09:23:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966586; bh=tTUbBlWGxGlAA/M3iRfxvQhYj3pYTSvQpKE+09KRzqE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fs4EAAR8gpz7MmIWc698a2HyBQotPqXWgyk7oRBUL2yRxYSGyySut5pUPV9z0v3vA QOj3TPiBcDp7HrU54becujwlMfLYrJ4b2xQmEMxpO46LUGfjWAcUudhFqA3Nf8SMuc jPr2IF4onVzXQ714DuplOPRMrZUmPLdYCf6lwF4Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "J. Bruce Fields" , Chuck Lever Subject: [PATCH 5.15 10/32] lockd: fix failure to cleanup client locks Date: Fri, 4 Feb 2022 10:22:20 +0100 Message-Id: <20220204091915.606336966@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: J. Bruce Fields commit d19a7af73b5ecaac8168712d18be72b9db166768 upstream. In my testing, we're sometimes hitting the request->fl_flags & FL_EXISTS case in posix_lock_inode, presumably just by random luck since we're not actually initializing fl_flags here. This probably didn't matter before commit 7f024fcd5c97 ("Keep read and write fds with each nlm_file") since we wouldn't previously unlock unless we knew there were locks. But now it causes lockd to give up on removing more locks. We could just initialize fl_flags, but really it seems dubious to be calling vfs_lock_file with random values in some of the fields. Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") Signed-off-by: J. Bruce Fields [ cel: fixed checkpatch.pl nit ] Signed-off-by: Chuck Lever Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/lockd/svcsubs.c | 1 + 1 file changed, 1 insertion(+) --- a/fs/lockd/svcsubs.c +++ b/fs/lockd/svcsubs.c @@ -180,6 +180,7 @@ static int nlm_unlock_files(struct nlm_f { struct file_lock lock; =20 + locks_init_lock(&lock); lock.fl_type =3D F_UNLCK; lock.fl_start =3D 0; lock.fl_end =3D OFFSET_MAX; From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A1845C433F5 for ; Fri, 4 Feb 2022 09:24:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357732AbiBDJYF (ORCPT ); Fri, 4 Feb 2022 04:24:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60630 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357647AbiBDJXL (ORCPT ); Fri, 4 Feb 2022 04:23:11 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1AC05C061777; Fri, 4 Feb 2022 01:23:11 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8C4F6615DC; Fri, 4 Feb 2022 09:23:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53599C004E1; Fri, 4 Feb 2022 09:23:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966590; bh=Fek5eS//BUxZXWLl1ZZY4p+FXu9Z0HSyHuyF3HerRxM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yPr+EvM3OrIGSex8zWNNdkomNHO97F1CVPnyx68jWk9HP6i3z3PJBrLTcxJV04elp EjSEsAVgeTYJZbwzlj4DrkjWww5lWV0qS67Ymcc+v1TjSviMcPOKZYQ5KRW9fZb6Z8 Udf7zrX9NH3dUR46CellvVY7QoKnLCuBbC3TsDII= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Raed Salem , Maor Dickman , Saeed Mahameed Subject: [PATCH 5.15 11/32] net/mlx5e: IPsec: Fix tunnel mode crypto offload for non TCP/UDP traffic Date: Fri, 4 Feb 2022 10:22:21 +0100 Message-Id: <20220204091915.636423988@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Raed Salem commit de47db0cf7f4a9c555ad204e06baa70b50a70d08 upstream. IPsec Tunnel mode crypto offload software parser (SWP) setting in data path currently always set the inner L4 offset regardless of the encapsulated L4 header type and whether it exists in the first place, this breaks non TCP/UDP traffic as such. Set the SWP inner L4 offset only when the IPsec tunnel encapsulated L4 header protocol is TCP/UDP. While at it fix inner ip protocol read for setting MLX5_ETH_WQE_SWP_INNER_L= 4_UDP flag to address the case where the ip header protocol is IPv6. Fixes: f1267798c980 ("net/mlx5: Fix checksum issue of VXLAN and IPsec crypt= o offload") Signed-off-by: Raed Salem Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c | 13 +++++= +++-- 1 file changed, 11 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c @@ -157,11 +157,20 @@ static void mlx5e_ipsec_set_swp(struct s /* Tunnel mode */ if (mode =3D=3D XFRM_MODE_TUNNEL) { eseg->swp_inner_l3_offset =3D skb_inner_network_offset(skb) / 2; - eseg->swp_inner_l4_offset =3D skb_inner_transport_offset(skb) / 2; if (xo->proto =3D=3D IPPROTO_IPV6) eseg->swp_flags |=3D MLX5_ETH_WQE_SWP_INNER_L3_IPV6; - if (inner_ip_hdr(skb)->protocol =3D=3D IPPROTO_UDP) + + switch (xo->inner_ipproto) { + case IPPROTO_UDP: eseg->swp_flags |=3D MLX5_ETH_WQE_SWP_INNER_L4_UDP; + fallthrough; + case IPPROTO_TCP: + /* IP | ESP | IP | [TCP | UDP] */ + eseg->swp_inner_l4_offset =3D skb_inner_transport_offset(skb) / 2; + break; + default: + break; + } return; } =20 From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD3CBC4332F for ; Fri, 4 Feb 2022 09:24:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357671AbiBDJYN (ORCPT ); Fri, 4 Feb 2022 04:24:13 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52108 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357658AbiBDJXP (ORCPT ); Fri, 4 Feb 2022 04:23:15 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 56DDFB836BA; Fri, 4 Feb 2022 09:23:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4FA64C004E1; Fri, 4 Feb 2022 09:23:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966593; bh=KVLgj1pVHVHJjqdICEXZNOLtZ4RDheMZu0wqlDTKP2w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1NLDoPMbyN098GeqKn9QTS+pt2fjY/DvSD5L3SdhRgkv4ZkNxwChN+QltMBhPWqW6 POKN/ls3IVLoW6nhPlpSntT4h0NOE0ku3viqfVZkO0QzDx9Ng2W09zrSR+p5wHQ2VN x4HoKQg1jYDds9gqEnytIcNuFN4SMB23m71lNXJQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vlad Buslov , Roi Dayan , Saeed Mahameed Subject: [PATCH 5.15 12/32] net/mlx5: Bridge, take rtnl lock in init error handler Date: Fri, 4 Feb 2022 10:22:22 +0100 Message-Id: <20220204091915.668942966@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vlad Buslov commit 04f8c12f031fcd0ffa0c72822eb665ceb2c872e7 upstream. The mlx5_esw_bridge_cleanup() is expected to be called with rtnl lock taken, which is true for mlx5e_rep_bridge_cleanup() function but not for error handling code in mlx5e_rep_bridge_init(). Add missing rtnl lock/unlock calls and extend both mlx5_esw_bridge_cleanup() and its dual function mlx5_esw_bridge_init() with ASSERT_RTNL() to verify the invariant from now on. Fixes: 7cd6a54a8285 ("net/mlx5: Bridge, handle FDB events") Fixes: 19e9bfa044f3 ("net/mlx5: Bridge, add offload infrastructure") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c | 2 ++ drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c | 4 ++++ 2 files changed, 6 insertions(+) --- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c @@ -509,7 +509,9 @@ err_register_swdev_blk: err_register_swdev: destroy_workqueue(br_offloads->wq); err_alloc_wq: + rtnl_lock(); mlx5_esw_bridge_cleanup(esw); + rtnl_unlock(); } =20 void mlx5e_rep_bridge_cleanup(struct mlx5e_priv *priv) --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c @@ -1385,6 +1385,8 @@ struct mlx5_esw_bridge_offloads *mlx5_es { struct mlx5_esw_bridge_offloads *br_offloads; =20 + ASSERT_RTNL(); + br_offloads =3D kvzalloc(sizeof(*br_offloads), GFP_KERNEL); if (!br_offloads) return ERR_PTR(-ENOMEM); @@ -1401,6 +1403,8 @@ void mlx5_esw_bridge_cleanup(struct mlx5 { struct mlx5_esw_bridge_offloads *br_offloads =3D esw->br_offloads; =20 + ASSERT_RTNL(); + if (!br_offloads) return; =20 From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3636FC4332F for ; Fri, 4 Feb 2022 09:24:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357678AbiBDJYP (ORCPT ); Fri, 4 Feb 2022 04:24:15 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42556 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357559AbiBDJXQ (ORCPT ); Fri, 4 Feb 2022 04:23:16 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 99AB8615ED; Fri, 4 Feb 2022 09:23:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 745DEC004E1; Fri, 4 Feb 2022 09:23:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966596; bh=VXigYRW5rsIpfXUUUjWJOkU9kJ0Hj9Zg+9vR2xZfuw4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=a2g3iP4BuKP3yDYHzOXeWR2phR8FmXC9q5OcDi4DcaTMCa2r5UYFfM5EvmgnWjC6W vYxjnQLIsfduIbB1dsSbh4PbQNo3NBMmAv1j/vDHdZjbC8NcXcWQMiOA0lnlQJwco4 inT2brMdwIAcKWUFjsSm2B3ZaY2NihYTBLvQCIkM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Vlad Buslov , Roi Dayan , Saeed Mahameed Subject: [PATCH 5.15 13/32] net/mlx5: Bridge, ensure dev_name is null-terminated Date: Fri, 4 Feb 2022 10:22:23 +0100 Message-Id: <20220204091915.702289475@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vlad Buslov commit 350d9a823734b5a7e767cddc3bdde5f0bcbb7ff4 upstream. Even though net_device->name is guaranteed to be null-terminated string of size<=3DIFNAMSIZ, the test robot complains that return value of netdev_name= () can be larger: In file included from include/trace/define_trace.h:102, from drivers/net/ethernet/mellanox/mlx5/core/esw/diag/b= ridge_tracepoint.h:113, from drivers/net/ethernet/mellanox/mlx5/core/esw/bridge= .c:12: drivers/net/ethernet/mellanox/mlx5/core/esw/diag/bridge_tracepoint.h: In= function 'trace_event_raw_event_mlx5_esw_bridge_fdb_template': >> drivers/net/ethernet/mellanox/mlx5/core/esw/diag/bridge_tracepoint.h:24:= 29: warning: 'strncpy' output may be truncated copying 16 bytes from a stri= ng of length 20 [-Wstringop-truncation] 24 | strncpy(__entry->dev_name, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ 25 | netdev_name(fdb->dev), | ~~~~~~~~~~~~~~~~~~~~~~ 26 | IFNAMSIZ); | ~~~~~~~~~ This is caused by the fact that default value of IFNAMSIZ is 16, while placeholder value that is returned by netdev_name() for unnamed net devices is larger than that. The offending code is in a tracing function that is only called for mlx5 representors, so there is no straightforward way to reproduce the issue but let's fix it for correctness sake by replacing strncpy() with strscpy() to ensure that resulting string is always null-terminated. Fixes: 9724fd5d9c2a ("net/mlx5: Bridge, add tracepoints") Reported-by: kernel test robot Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/esw/diag/bridge_tracepoint.h | = 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/diag/bridge_tracepoint.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/diag/bridge_tracepoint.h @@ -21,7 +21,7 @@ DECLARE_EVENT_CLASS(mlx5_esw_bridge_fdb_ __field(unsigned int, used) ), TP_fast_assign( - strncpy(__entry->dev_name, + strscpy(__entry->dev_name, netdev_name(fdb->dev), IFNAMSIZ); memcpy(__entry->addr, fdb->key.addr, ETH_ALEN); From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76390C433F5 for ; Fri, 4 Feb 2022 09:24:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357454AbiBDJYc (ORCPT ); Fri, 4 Feb 2022 04:24:32 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52158 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357554AbiBDJXV (ORCPT ); Fri, 4 Feb 2022 04:23:21 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 58549B836ED; Fri, 4 Feb 2022 09:23:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8731FC004E1; Fri, 4 Feb 2022 09:23:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966599; bh=mXHryGW09fA1yrZtSbOXLAiQQeihs2gSPyR7qHrk/wI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FvSWJ+7dSCR79kkHT2uJIErrxH3jVVdnIdhGO4bjUn2hH8IpKfODOlaijJX5nj0j3 keyg2Sf5zt+wPGYXAOTGpg1wupM7zknlYUxbBCVptofBY9+tZ4g9KcJi0pJs4Jc/Xm tNEIDwrogIhyYUYTKZ/8gtW4Bxm/Ox8e22WOux4I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maor Dickman , Roi Dayan , Saeed Mahameed Subject: [PATCH 5.15 14/32] net/mlx5e: Fix handling of wrong devices during bond netevent Date: Fri, 4 Feb 2022 10:22:24 +0100 Message-Id: <20220204091915.732532366@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maor Dickman commit ec41332e02bd0acf1f24206867bb6a02f5877a62 upstream. Current implementation of bond netevent handler only check if the handled netdev is VF representor and it missing a check if the VF representor is on the same phys device of the bond handling the netevent. Fix by adding the missing check and optimizing the check if the netdev is VF representor so it will not access uninitialized private data and crashes. BUG: kernel NULL pointer dereference, address: 000000000000036c PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI Workqueue: eth3bond0 bond_mii_monitor [bonding] RIP: 0010:mlx5e_is_uplink_rep+0xc/0x50 [mlx5_core] RSP: 0018:ffff88812d69fd60 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8881cf800000 RCX: 0000000000000000 RDX: ffff88812d69fe10 RSI: 000000000000001b RDI: ffff8881cf800880 RBP: ffff8881cf800000 R08: 00000445cabccf2b R09: 0000000000000008 R10: 0000000000000004 R11: 0000000000000008 R12: ffff88812d69fe10 R13: 00000000fffffffe R14: ffff88820c0f9000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88846fb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000036c CR3: 0000000103d80006 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5e_eswitch_uplink_rep+0x31/0x40 [mlx5_core] mlx5e_rep_is_lag_netdev+0x94/0xc0 [mlx5_core] mlx5e_rep_esw_bond_netevent+0xeb/0x3d0 [mlx5_core] raw_notifier_call_chain+0x41/0x60 call_netdevice_notifiers_info+0x34/0x80 netdev_lower_state_changed+0x4e/0xa0 bond_mii_monitor+0x56b/0x640 [bonding] process_one_work+0x1b9/0x390 worker_thread+0x4d/0x3d0 ? rescuer_thread+0x350/0x350 kthread+0x124/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30 Fixes: 7e51891a237f ("net/mlx5e: Use netdev events to set/del egress acl fo= rward-to-vport rule") Signed-off-by: Maor Dickman Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c | 32 +++++++------= ----- 1 file changed, 14 insertions(+), 18 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c @@ -183,18 +183,7 @@ void mlx5e_rep_bond_unslave(struct mlx5_ =20 static bool mlx5e_rep_is_lag_netdev(struct net_device *netdev) { - struct mlx5e_rep_priv *rpriv; - struct mlx5e_priv *priv; - - /* A given netdev is not a representor or not a slave of LAG configuratio= n */ - if (!mlx5e_eswitch_rep(netdev) || !netif_is_lag_port(netdev)) - return false; - - priv =3D netdev_priv(netdev); - rpriv =3D priv->ppriv; - - /* Egress acl forward to vport is supported only non-uplink representor */ - return rpriv->rep->vport !=3D MLX5_VPORT_UPLINK; + return netif_is_lag_port(netdev) && mlx5e_eswitch_vf_rep(netdev); } =20 static void mlx5e_rep_changelowerstate_event(struct net_device *netdev, vo= id *ptr) @@ -210,9 +199,6 @@ static void mlx5e_rep_changelowerstate_e u16 fwd_vport_num; int err; =20 - if (!mlx5e_rep_is_lag_netdev(netdev)) - return; - info =3D ptr; lag_info =3D info->lower_state_info; /* This is not an event of a representor becoming active slave */ @@ -266,9 +252,6 @@ static void mlx5e_rep_changeupper_event( struct net_device *lag_dev; struct mlx5e_priv *priv; =20 - if (!mlx5e_rep_is_lag_netdev(netdev)) - return; - priv =3D netdev_priv(netdev); rpriv =3D priv->ppriv; lag_dev =3D info->upper_dev; @@ -293,6 +276,19 @@ static int mlx5e_rep_esw_bond_netevent(s unsigned long event, void *ptr) { struct net_device *netdev =3D netdev_notifier_info_to_dev(ptr); + struct mlx5e_rep_priv *rpriv; + struct mlx5e_rep_bond *bond; + struct mlx5e_priv *priv; + + if (!mlx5e_rep_is_lag_netdev(netdev)) + return NOTIFY_DONE; + + bond =3D container_of(nb, struct mlx5e_rep_bond, nb); + priv =3D netdev_priv(netdev); + rpriv =3D mlx5_eswitch_get_uplink_priv(priv->mdev->priv.eswitch, REP_ETH); + /* Verify VF representor is on the same device of the bond handling the n= etevent. */ + if (rpriv->uplink_priv.bond !=3D bond) + return NOTIFY_DONE; =20 switch (event) { case NETDEV_CHANGELOWERSTATE: From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E2C1C433FE for ; Fri, 4 Feb 2022 09:24:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357831AbiBDJY3 (ORCPT ); Fri, 4 Feb 2022 04:24:29 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42634 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357864AbiBDJXX (ORCPT ); Fri, 4 Feb 2022 04:23:23 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C23D7616B0; Fri, 4 Feb 2022 09:23:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9E95EC340ED; Fri, 4 Feb 2022 09:23:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966602; bh=FAjeDFHv7D9J2c8F4j6IzyeX2v7R5BW6Uj33dBF69mE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=x3w6WniikzNo705ZPZMZGGxVUBLObCw5gbXOtTF+MJdb75kSXQZQmrSTHr4jJh1ka p6/0Ej8c+Izmn51Wy8omQiYW8ZR3WrQ87A/XIxhPvUVcfV0Y1nJCgVyDEcaRIF86ZP ZsaLOw0u838D0Jrvw8s/XwmCCpJJv8KMHyoUixE8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maher Sanalla , Moshe Shemesh , Saeed Mahameed Subject: [PATCH 5.15 15/32] net/mlx5: Use del_timer_sync in fw reset flow of halting poll Date: Fri, 4 Feb 2022 10:22:25 +0100 Message-Id: <20220204091915.764312201@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maher Sanalla commit 3c5193a87b0fea090aa3f769d020337662d87b5e upstream. Substitute del_timer() with del_timer_sync() in fw reset polling deactivation flow, in order to prevent a race condition which occurs when del_timer() is called and timer is deactivated while another process is handling the timer interrupt. A situation that led to the following call trace: RIP: 0010:run_timer_softirq+0x137/0x420 recalibrate_cpu_khz+0x10/0x10 ktime_get+0x3e/0xa0 ? sched_clock_cpu+0xb/0xc0 __do_softirq+0xf5/0x2ea irq_exit_rcu+0xc1/0xf0 sysvec_apic_timer_interrupt+0x9e/0xc0 asm_sysvec_apic_timer_interrupt+0x12/0x20 Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event") Signed-off-by: Maher Sanalla Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c @@ -131,7 +131,7 @@ static void mlx5_stop_sync_reset_poll(st { struct mlx5_fw_reset *fw_reset =3D dev->priv.fw_reset; =20 - del_timer(&fw_reset->timer); + del_timer_sync(&fw_reset->timer); } =20 static void mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *de= v, bool poll_health) From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44313C433F5 for ; Fri, 4 Feb 2022 09:24:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357543AbiBDJYT (ORCPT ); Fri, 4 Feb 2022 04:24:19 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52230 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357884AbiBDJX1 (ORCPT ); Fri, 4 Feb 2022 04:23:27 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 81C05B836EE; Fri, 4 Feb 2022 09:23:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AAB08C340ED; Fri, 4 Feb 2022 09:23:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966605; bh=5t6xZ8N2V27Dp728hG9yGXYaE7Em90wkdi7HfCFR3sA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iV7NLIO8whAVczXOHjE6/SYPj0oL5O4yTZLqGucyAXpESWg4WMkrg5DTHWkRxQcsF +80HzV5iUKu49wNlKeGJAtDGAbW5TxG8YQduVqNIu+9ArY7c8paFmhXhNmRe43PBp8 UxuMA71CNjw/XxILdjNsibvZ4m2YQYrXEHnbNM0U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wang Yugui , Gal Pressman , Maxim Mikityanskiy , Saeed Mahameed Subject: [PATCH 5.15 16/32] net/mlx5e: Fix module EEPROM query Date: Fri, 4 Feb 2022 10:22:26 +0100 Message-Id: <20220204091915.794329234@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Gal Pressman commit 4a08a131351e375a2969b98e46df260ed04dcba7 upstream. When querying the module EEPROM, there was a misusage of the 'offset' variable vs the 'query.offset' field. Fix that by always using 'offset' and assigning its value to 'query.offset' right before the mcia register read call. While at it, the cross-pages read size adjustment was changed to be more intuitive. Fixes: e19b0a3474ab ("net/mlx5: Refactor module EEPROM query") Reported-by: Wang Yugui Signed-off-by: Gal Pressman Reviewed-by: Maxim Mikityanskiy Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/port.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/port.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c @@ -406,23 +406,24 @@ int mlx5_query_module_eeprom(struct mlx5 =20 switch (module_id) { case MLX5_MODULE_ID_SFP: - mlx5_sfp_eeprom_params_set(&query.i2c_address, &query.page, &query.offse= t); + mlx5_sfp_eeprom_params_set(&query.i2c_address, &query.page, &offset); break; case MLX5_MODULE_ID_QSFP: case MLX5_MODULE_ID_QSFP_PLUS: case MLX5_MODULE_ID_QSFP28: - mlx5_qsfp_eeprom_params_set(&query.i2c_address, &query.page, &query.offs= et); + mlx5_qsfp_eeprom_params_set(&query.i2c_address, &query.page, &offset); break; default: mlx5_core_err(dev, "Module ID not recognized: 0x%x\n", module_id); return -EINVAL; } =20 - if (query.offset + size > MLX5_EEPROM_PAGE_LENGTH) + if (offset + size > MLX5_EEPROM_PAGE_LENGTH) /* Cross pages read, read until offset 256 in low page */ - size -=3D offset + size - MLX5_EEPROM_PAGE_LENGTH; + size =3D MLX5_EEPROM_PAGE_LENGTH - offset; =20 query.size =3D size; + query.offset =3D offset; =20 return mlx5_query_mcia(dev, &query, data); } From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A771C433F5 for ; Fri, 4 Feb 2022 09:24:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357826AbiBDJYY (ORCPT ); Fri, 4 Feb 2022 04:24:24 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52278 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357684AbiBDJXb (ORCPT ); Fri, 4 Feb 2022 04:23:31 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F227BB836EF; Fri, 4 Feb 2022 09:23:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2B8AAC004E1; Fri, 4 Feb 2022 09:23:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966608; bh=4+7MceMecYWOvPMGIDx+1UxoxBhhhIlOqFjbf6KJEtc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Lt1Wugam6qHUw67mIDyFDpM5xePyogWQTmF6MbmtZCKCDksLj7sh1EH5IQ/3NBn2D 1myNETm8xDYxdQAG29WHuxUceWCxqWy8YJbYM6zjBlf2YRrYQUYUSe60kaL3yk9v+s 4J1C6l1TQ2BfbCo6kJMWc8oBwR+a/pAMXz0KMcmM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dima Chumak , Roi Dayan , Saeed Mahameed Subject: [PATCH 5.15 17/32] net/mlx5: Fix offloading with ESWITCH_IPV4_TTL_MODIFY_ENABLE Date: Fri, 4 Feb 2022 10:22:27 +0100 Message-Id: <20220204091915.826342216@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dima Chumak commit 55b2ca702cfa744a9eb108915996a2294da47e71 upstream. Only prio 1 is supported for nic mode when there is no ignore flow level support in firmware. But for switchdev mode, which supports fixed number of statically pre-allocated prios, this restriction is not relevant so it can be relaxed. Fixes: d671e109bd85 ("net/mlx5: Fix tc max supported prio for nic mode") Signed-off-by: Dima Chumak Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c @@ -121,12 +121,13 @@ u32 mlx5_chains_get_nf_ft_chain(struct m =20 u32 mlx5_chains_get_prio_range(struct mlx5_fs_chains *chains) { - if (!mlx5_chains_prios_supported(chains)) - return 1; - if (mlx5_chains_ignore_flow_level_supported(chains)) return UINT_MAX; =20 + if (!chains->dev->priv.eswitch || + chains->dev->priv.eswitch->mode !=3D MLX5_ESWITCH_OFFLOADS) + return 1; + /* We should get here only for eswitch case */ return FDB_TC_MAX_PRIO; } From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CBE1AC433F5 for ; Fri, 4 Feb 2022 09:24:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357597AbiBDJYf (ORCPT ); Fri, 4 Feb 2022 04:24:35 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33030 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357918AbiBDJXd (ORCPT ); Fri, 4 Feb 2022 04:23:33 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7AE2AC06177A; Fri, 4 Feb 2022 01:23:33 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1173A61601; Fri, 4 Feb 2022 09:23:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 56B91C004E1; Fri, 4 Feb 2022 09:23:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966612; bh=v3/d9LHg2Vq5nYFMt9OKfTdjLvmPryjTGQBrElOwQDA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=08eNBgPkXXa6Pyw1MU6qmBr1jD3dWcwbcR53UUfwMh0ZNA6535Li6JAS8LTJ3lgik 6rx99dYhf4cCsqil0BFAn+y+cDTcGka9dj4B6exrBhEvr7HSqGpKjnrLfQ7EXcSFy5 RULOgciL6v0ByvKEodVd77QgSWWaAsDlwX0jyBjk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maxim Mikityanskiy , Tariq Toukan , Saeed Mahameed Subject: [PATCH 5.15 18/32] net/mlx5e: Dont treat small ceil values as unlimited in HTB offload Date: Fri, 4 Feb 2022 10:22:28 +0100 Message-Id: <20220204091915.857237511@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maxim Mikityanskiy commit 736dfe4e68b868829a1e89dfef4a44c1580d4478 upstream. The hardware spec defines max_average_bw =3D=3D 0 as "unlimited bandwidth". max_average_bw is calculated as `ceil / BYTES_IN_MBIT`, which can become 0 when ceil is small, leading to an undesired effect of having no bandwidth limit. This commit fixes it by rounding up small values of ceil to 1 Mbit/s. Fixes: 214baf22870c ("net/mlx5e: Support HTB offload") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/en/qos.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c @@ -553,7 +553,8 @@ static int mlx5e_htb_convert_rate(struct =20 static void mlx5e_htb_convert_ceil(struct mlx5e_priv *priv, u64 ceil, u32 = *max_average_bw) { - *max_average_bw =3D div_u64(ceil, BYTES_IN_MBIT); + /* Hardware treats 0 as "unlimited", set at least 1. */ + *max_average_bw =3D max_t(u32, div_u64(ceil, BYTES_IN_MBIT), 1); =20 qos_dbg(priv->mdev, "Convert: ceil %llu -> max_average_bw %u\n", ceil, *max_average_bw); From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7F1BC433EF for ; Fri, 4 Feb 2022 09:24:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357870AbiBDJYh (ORCPT ); Fri, 4 Feb 2022 04:24:37 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42790 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357680AbiBDJXg (ORCPT ); Fri, 4 Feb 2022 04:23:36 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4179461601; Fri, 4 Feb 2022 09:23:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 22F37C004E1; Fri, 4 Feb 2022 09:23:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966615; bh=i1By24VIoY2lC/wDQNa/L9E+AUs3H7fv9iax0aywOIY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kxzNd352DGLyFAt5ui79/EHukOfVQLy4ZKj8KHSzKU/IEhUP9NPiSUKF00cUTA+LB Y58P7qU7ekiOPD8GPZs6isanxr4cC8LHwFCRPiqJ/ceZ63BNGpHXZUVLdWUP09Wr3E Yzx6nYCsoKAVGiTFpm5WvIUJOAQ+HUQFe3xVbH7Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Roi Dayan , Vlad Buslov , Saeed Mahameed Subject: [PATCH 5.15 19/32] net/mlx5: Bridge, Fix devlink deadlock on net namespace deletion Date: Fri, 4 Feb 2022 10:22:29 +0100 Message-Id: <20220204091915.888414403@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Roi Dayan commit 880b517691908fb753019b9b27cd082e7617debd upstream. When changing mode to switchdev, rep bridge init registered to netdevice notifier holds the devlink lock and then takes pernet_ops_rwsem. At that time deleting a netns holds pernet_ops_rwsem and then takes the devlink lock. Example sequence is: $ ip netns add foo $ devlink dev eswitch set pci/0000:00:08.0 mode switchdev & $ ip netns del foo deleting netns trace: [ 1185.365555] ? devlink_pernet_pre_exit+0x74/0x1c0 [ 1185.368331] ? mutex_lock_io_nested+0x13f0/0x13f0 [ 1185.370984] ? xt_find_table+0x40/0x100 [ 1185.373244] ? __mutex_lock+0x24a/0x15a0 [ 1185.375494] ? net_generic+0xa0/0x1c0 [ 1185.376844] ? wait_for_completion_io+0x280/0x280 [ 1185.377767] ? devlink_pernet_pre_exit+0x74/0x1c0 [ 1185.378686] devlink_pernet_pre_exit+0x74/0x1c0 [ 1185.379579] ? devlink_nl_cmd_get_dumpit+0x3a0/0x3a0 [ 1185.380557] ? xt_find_table+0xda/0x100 [ 1185.381367] cleanup_net+0x372/0x8e0 changing mode to switchdev trace: [ 1185.411267] down_write+0x13a/0x150 [ 1185.412029] ? down_write_killable+0x180/0x180 [ 1185.413005] register_netdevice_notifier+0x1e/0x210 [ 1185.414000] mlx5e_rep_bridge_init+0x181/0x360 [mlx5_core] [ 1185.415243] mlx5e_uplink_rep_enable+0x269/0x480 [mlx5_core] [ 1185.416464] ? mlx5e_uplink_rep_disable+0x210/0x210 [mlx5_core] [ 1185.417749] mlx5e_attach_netdev+0x232/0x400 [mlx5_core] [ 1185.418906] mlx5e_netdev_attach_profile+0x15b/0x1e0 [mlx5_core] [ 1185.420172] mlx5e_netdev_change_profile+0x15a/0x1d0 [mlx5_core] [ 1185.421459] mlx5e_vport_rep_load+0x557/0x780 [mlx5_core] [ 1185.422624] ? mlx5e_stats_grp_vport_rep_num_stats+0x10/0x10 [mlx5_core] [ 1185.424006] mlx5_esw_offloads_rep_load+0xdb/0x190 [mlx5_core] [ 1185.425277] esw_offloads_enable+0xd74/0x14a0 [mlx5_core] Fix this by registering rep bridges for per net netdev notifier instead of global one, which operats on the net namespace without holding the pernet_ops_rwsem. Fixes: 19e9bfa044f3 ("net/mlx5: Bridge, add offload infrastructure") Signed-off-by: Roi Dayan Reviewed-by: Vlad Buslov Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c @@ -491,7 +491,7 @@ void mlx5e_rep_bridge_init(struct mlx5e_ } =20 br_offloads->netdev_nb.notifier_call =3D mlx5_esw_bridge_switchdev_port_e= vent; - err =3D register_netdevice_notifier(&br_offloads->netdev_nb); + err =3D register_netdevice_notifier_net(&init_net, &br_offloads->netdev_n= b); if (err) { esw_warn(mdev, "Failed to register bridge offloads netdevice notifier (e= rr=3D%d)\n", err); @@ -526,7 +526,7 @@ void mlx5e_rep_bridge_cleanup(struct mlx return; =20 cancel_delayed_work_sync(&br_offloads->update_work); - unregister_netdevice_notifier(&br_offloads->netdev_nb); + unregister_netdevice_notifier_net(&init_net, &br_offloads->netdev_nb); unregister_switchdev_blocking_notifier(&br_offloads->nb_blk); unregister_switchdev_notifier(&br_offloads->nb); destroy_workqueue(br_offloads->wq); From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F1A4C433FE for ; Fri, 4 Feb 2022 09:24:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357764AbiBDJY5 (ORCPT ); Fri, 4 Feb 2022 04:24:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32916 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357534AbiBDJX7 (ORCPT ); Fri, 4 Feb 2022 04:23:59 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C35ACC061748; Fri, 4 Feb 2022 01:23:59 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E734CB836EB; Fri, 4 Feb 2022 09:23:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C2C97C004E1; Fri, 4 Feb 2022 09:23:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966622; bh=gAiEkRCmxoxeR1wsBoW65hMxfhjyd5QKm8WnZv5DEoY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OCCwDDEDzyQIgNwmZavMzkTXu5bra1ihlGlXijEUAQXhPq8nTsVD+UrzC91y8EXeH THx031zD5y6EniQBDu01A4qzsJk/K7uK566rWkNBbITjyPlCI3DxmyOSoo1xXNDI+3 gC9L5y0Y6VowCrPPDW9z2icz+BsTK3Rb05JNFrEU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maor Dickman , Roi Dayan , Saeed Mahameed Subject: [PATCH 5.15 20/32] net/mlx5: E-Switch, Fix uninitialized variable modact Date: Fri, 4 Feb 2022 10:22:30 +0100 Message-Id: <20220204091915.919230917@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maor Dickman commit d8e5883d694bb053b19c4142a2d1f43a34f6fe2c upstream. The variable modact is not initialized before used in command modify header allocation which can cause command to fail. Fix by initializing modact with zeros. Addresses-Coverity: ("Uninitialized scalar variable") Fixes: 8f1e0b97cc70 ("net/mlx5: E-Switch, Mark miss packets with new chain = id mapping") Signed-off-by: Maor Dickman Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c @@ -212,7 +212,7 @@ static int create_chain_restore(struct fs_chain *chain) { struct mlx5_eswitch *esw =3D chain->chains->dev->priv.eswitch; - char modact[MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto)]; + u8 modact[MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto)] =3D {}; struct mlx5_fs_chains *chains =3D chain->chains; enum mlx5e_tc_attr_to_reg chain_to_reg; struct mlx5_modify_hdr *mod_hdr; From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F006C433F5 for ; Fri, 4 Feb 2022 09:26:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357404AbiBDJ01 (ORCPT ); Fri, 4 Feb 2022 04:26:27 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53032 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357734AbiBDJYt (ORCPT ); Fri, 4 Feb 2022 04:24:49 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 89AF1B836ED; Fri, 4 Feb 2022 09:24:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 96763C340F0; Fri, 4 Feb 2022 09:24:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966687; bh=iaE1IqOh0EjTj9ysylMCuepe6iN/kPDrrbFWOLuRBw8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=V9JjXEs4uzuFweWk87hqdGaVflQfdGzAj2ml4MKVgBpeoXi8ElK59sjn7hWSJa76u 4eUExb0ZOTI0ZD8G8VSAH9b8douA2acUzps8rj0Yjd+pQHQ6mBgae8Uge1poEuci9j LUq0hHBiiuZLAXdDukbDnrZ0W40rW9plkmUzhC5s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Georgi Valkov , Jan Kiszka , Jakub Kicinski Subject: [PATCH 5.15 21/32] ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback Date: Fri, 4 Feb 2022 10:22:31 +0100 Message-Id: <20220204091915.950075882@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Georgi Valkov commit 63e4b45c82ed1bde979da7052229a4229ce9cabf upstream. When rx_buf is allocated we need to account for IPHETH_IP_ALIGN, which reduces the usable size by 2 bytes. Otherwise we have 1512 bytes usable instead of 1514, and if we receive more than 1512 bytes, ipheth_rcvbulk_callback is called with status -EOVERFLOW, after which the driver malfunctiones and all communication stops. Resolves ipheth 2-1:4.2: ipheth_rcvbulk_callback: urb status: -75 Fixes: f33d9e2b48a3 ("usbnet: ipheth: fix connectivity with iOS 14") Signed-off-by: Georgi Valkov Tested-by: Jan Kiszka Link: https://lore.kernel.org/all/B60B8A4B-92A0-49B3-805D-809A2433B46C@abv.= bg/ Link: https://lore.kernel.org/all/24851bd2769434a5fc24730dce8e8a984c5a4505.= 1643699778.git.jan.kiszka@siemens.com/ Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/usb/ipheth.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -121,7 +121,7 @@ static int ipheth_alloc_urbs(struct iphe if (tx_buf =3D=3D NULL) goto free_rx_urb; =20 - rx_buf =3D usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE, + rx_buf =3D usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_A= LIGN, GFP_KERNEL, &rx_urb->transfer_dma); if (rx_buf =3D=3D NULL) goto free_tx_buf; @@ -146,7 +146,7 @@ error_nomem: =20 static void ipheth_free_urbs(struct ipheth_device *iphone) { - usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf, + usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, iphone= ->rx_buf, iphone->rx_urb->transfer_dma); usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf, iphone->tx_urb->transfer_dma); @@ -317,7 +317,7 @@ static int ipheth_rx_submit(struct iphet =20 usb_fill_bulk_urb(dev->rx_urb, udev, usb_rcvbulkpipe(udev, dev->bulk_in), - dev->rx_buf, IPHETH_BUF_SIZE, + dev->rx_buf, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, ipheth_rcvbulk_callback, dev); dev->rx_urb->transfer_flags |=3D URB_NO_TRANSFER_DMA_MAP; From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9681C433EF for ; Fri, 4 Feb 2022 09:25:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358130AbiBDJZf (ORCPT ); Fri, 4 Feb 2022 04:25:35 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52684 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237246AbiBDJYN (ORCPT ); Fri, 4 Feb 2022 04:24:13 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7E469B836EB; Fri, 4 Feb 2022 09:24:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BF43DC004E1; Fri, 4 Feb 2022 09:24:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966651; bh=SyzHGSaCOZ3ivvI/sjcAeoQjKsYXInq4oIEakk1zE6M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=b+ZxyrjAN2mx2ekYPhsfy83k55Li8u9r+p8L6YATfA3cNmkZ7YVoHf46KWZpodrKd /igXyRNnBG9wq0wXjDVAc+5lQBZaSZaQPbU81Ka0hSN3+Va0MH4ZjGWc2TweDjk91h OIQkqVHm8C+1thHDOzFCcY8uWna3Xyw+YgsvKfTE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sylwester Dziedziuch , Jedrzej Jagielski , Alexander Lobakin , Imam Hassan Reza Biswas , Tony Nguyen Subject: [PATCH 5.15 22/32] i40e: Fix reset bw limit when DCB enabled with 1 TC Date: Fri, 4 Feb 2022 10:22:32 +0100 Message-Id: <20220204091915.981867578@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jedrzej Jagielski commit 3d2504663c41104b4359a15f35670cfa82de1bbf upstream. There was an AQ error I40E_AQ_RC_EINVAL when trying to reset bw limit as part of bw allocation setup. This was caused by trying to reset bw limit with DCB enabled. Bw limit should not be reset when DCB is enabled. The code was relying on the pf->flags to check if DCB is enabled but if only 1 TC is available this flag will not be set even though DCB is enabled. Add a check for number of TC and if it is 1 don't try to reset bw limit even if pf->flags shows DCB as disabled. Fixes: fa38e30ac73f ("i40e: Fix for Tx timeouts when interface is brought u= p if DCB is enabled") Suggested-by: Alexander Lobakin # Flatten the = condition Signed-off-by: Sylwester Dziedziuch Signed-off-by: Jedrzej Jagielski Reviewed-by: Alexander Lobakin Tested-by: Imam Hassan Reza Biswas Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/intel/i40e/i40e_main.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -5372,7 +5372,15 @@ static int i40e_vsi_configure_bw_alloc(s /* There is no need to reset BW when mqprio mode is on. */ if (pf->flags & I40E_FLAG_TC_MQPRIO) return 0; - if (!vsi->mqprio_qopt.qopt.hw && !(pf->flags & I40E_FLAG_DCB_ENABLED)) { + + if (!vsi->mqprio_qopt.qopt.hw) { + if (pf->flags & I40E_FLAG_DCB_ENABLED) + goto skip_reset; + + if (IS_ENABLED(CONFIG_I40E_DCB) && + i40e_dcb_hw_get_num_tc(&pf->hw) =3D=3D 1) + goto skip_reset; + ret =3D i40e_set_bw_limit(vsi, vsi->seid, 0); if (ret) dev_info(&pf->pdev->dev, @@ -5380,6 +5388,8 @@ static int i40e_vsi_configure_bw_alloc(s vsi->seid); return ret; } + +skip_reset: memset(&bw_data, 0, sizeof(bw_data)); bw_data.tc_valid_bits =3D enabled_tc; for (i =3D 0; i < I40E_MAX_TRAFFIC_CLASS; i++) From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EB55DC433EF for ; Fri, 4 Feb 2022 09:26:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358234AbiBDJ0I (ORCPT ); Fri, 4 Feb 2022 04:26:08 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:43464 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357810AbiBDJYW (ORCPT ); Fri, 4 Feb 2022 04:24:22 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CE9F1616B0; Fri, 4 Feb 2022 09:24:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AADDBC340ED; Fri, 4 Feb 2022 09:24:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966661; bh=r2AEvg0dJtsDUBsrPtvCkwyCzdKV51w5osYdpLkgFY0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=I9Db7MooKZBUtuYbRbOMBdq4DwkFC0OGLGcoe6kdS7UM92DnPL12CMcqUK7YKF8wn fC1j3MPMadyAItGAyx7TWzmX1r8pdNMe5WAAqQzFHgKWbrFOgIwuPiCc4cjphHt54X 7Z1JBea/aHiisvewgmB1igcsZvw8qSoJOEToM6v8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Slawomir Laba , Sylwester Dziedziuch , Karen Sornek , Gurucharan G , Tony Nguyen Subject: [PATCH 5.15 23/32] i40e: Fix reset path while removing the driver Date: Fri, 4 Feb 2022 10:22:33 +0100 Message-Id: <20220204091916.015219196@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Karen Sornek commit 6533e558c6505e94c3e0ed4281ed5e31ec985f4d upstream. Fix the crash in kernel while dereferencing the NULL pointer, when the driver is unloaded and simultaneously the VSI rings are being stopped. The hardware requires 50msec in order to finish RX queues disable. For this purpose the driver spins in mdelay function for the operation to be completed. For example changing number of queues which requires reset would fail in the following call stack: 1) i40e_prep_for_reset 2) i40e_pf_quiesce_all_vsi 3) i40e_quiesce_vsi 4) i40e_vsi_close 5) i40e_down 6) i40e_vsi_stop_rings 7) i40e_vsi_control_rx -> disable requires the delay of 50msecs 8) continue back in i40e_down function where i40e_clean_tx_ring(vsi->tx_rings[i]) is going to crash When the driver was spinning vsi_release called i40e_vsi_free_arrays where the vsi->tx_rings resources were freed and the pointer was set to NULL. Fixes: 5b6d4a7f20b0 ("i40e: Fix crash during removing i40e driver") Signed-off-by: Slawomir Laba Signed-off-by: Sylwester Dziedziuch Signed-off-by: Karen Sornek Tested-by: Gurucharan G Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 19 ++++++++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/intel/i40e/i40e.h +++ b/drivers/net/ethernet/intel/i40e/i40e.h @@ -144,6 +144,7 @@ enum i40e_state_t { __I40E_VIRTCHNL_OP_PENDING, __I40E_RECOVERY_MODE, __I40E_VF_RESETS_DISABLED, /* disable resets during i40e_remove */ + __I40E_IN_REMOVE, __I40E_VFS_RELEASING, /* This must be last as it determines the size of the BITMAP */ __I40E_STATE_SIZE__, --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -10863,6 +10863,9 @@ static void i40e_reset_and_rebuild(struc bool lock_acquired) { int ret; + + if (test_bit(__I40E_IN_REMOVE, pf->state)) + return; /* Now we wait for GRST to settle out. * We don't have to delete the VEBs or VSIs from the hw switch * because the reset will make them disappear. @@ -12222,6 +12225,8 @@ int i40e_reconfig_rss_queues(struct i40e =20 vsi->req_queue_pairs =3D queue_count; i40e_prep_for_reset(pf); + if (test_bit(__I40E_IN_REMOVE, pf->state)) + return pf->alloc_rss_size; =20 pf->alloc_rss_size =3D new_rss_size; =20 @@ -13048,6 +13053,10 @@ static int i40e_xdp_setup(struct i40e_vs if (need_reset) i40e_prep_for_reset(pf); =20 + /* VSI shall be deleted in a moment, just return EINVAL */ + if (test_bit(__I40E_IN_REMOVE, pf->state)) + return -EINVAL; + old_prog =3D xchg(&vsi->xdp_prog, prog); =20 if (need_reset) { @@ -15938,8 +15947,13 @@ static void i40e_remove(struct pci_dev * i40e_write_rx_ctl(hw, I40E_PFQF_HENA(0), 0); i40e_write_rx_ctl(hw, I40E_PFQF_HENA(1), 0); =20 - while (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state)) + /* Grab __I40E_RESET_RECOVERY_PENDING and set __I40E_IN_REMOVE + * flags, once they are set, i40e_rebuild should not be called as + * i40e_prep_for_reset always returns early. + */ + while (test_and_set_bit(__I40E_RESET_RECOVERY_PENDING, pf->state)) usleep_range(1000, 2000); + set_bit(__I40E_IN_REMOVE, pf->state); =20 if (pf->flags & I40E_FLAG_SRIOV_ENABLED) { set_bit(__I40E_VF_RESETS_DISABLED, pf->state); @@ -16138,6 +16152,9 @@ static void i40e_pci_error_reset_done(st { struct i40e_pf *pf =3D pci_get_drvdata(pdev); =20 + if (test_bit(__I40E_IN_REMOVE, pf->state)) + return; + i40e_reset_and_rebuild(pf, false, false); } =20 From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 201A5C433F5 for ; Fri, 4 Feb 2022 09:26:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357742AbiBDJZ7 (ORCPT ); Fri, 4 Feb 2022 04:25:59 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:43514 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357828AbiBDJYZ (ORCPT ); Fri, 4 Feb 2022 04:24:25 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 464B5615ED; Fri, 4 Feb 2022 09:24:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D4304C004E1; Fri, 4 Feb 2022 09:24:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966664; bh=QrZLry4insApv+gQ37l7e+SnTkVoC6w8ESMnHsJwm00=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=leWrqfyurPvLyz4wkpZD2YlBEsX9bdW7dtCAHhZuWz415VcOYfHDwsGv4bPXKnzig Pv+DsJL/O93ClNoyQ8PZMxq63ieLlEZSBuVvki1pGqwEuDSgy9S6+ctR9c52/gsQni xdCPqxzXUIhFQ2Zdfc8p/XsYbYYVg3igBCmF4Rak= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sudheesh Mavila , Raju Rangoju , Tom Lendacky , Jakub Kicinski Subject: [PATCH 5.15 24/32] net: amd-xgbe: ensure to reset the tx_timer_active flag Date: Fri, 4 Feb 2022 10:22:34 +0100 Message-Id: <20220204091916.058187207@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Raju Rangoju commit 7674b7b559b683478c3832527c59bceb169e701d upstream. Ensure to reset the tx_timer_active flag in xgbe_stop(), otherwise a port restart may result in tx timeout due to uncleared flag. Fixes: c635eaacbf77 ("amd-xgbe: Remove Tx coalescing") Co-developed-by: Sudheesh Mavila Signed-off-by: Sudheesh Mavila Signed-off-by: Raju Rangoju Acked-by: Tom Lendacky Link: https://lore.kernel.org/r/20220127060222.453371-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c @@ -721,7 +721,9 @@ static void xgbe_stop_timers(struct xgbe if (!channel->tx_ring) break; =20 + /* Deactivate the Tx timer */ del_timer_sync(&channel->tx_timer); + channel->tx_timer_active =3D 0; } } =20 From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D686EC433F5 for ; Fri, 4 Feb 2022 09:25:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357945AbiBDJZx (ORCPT ); Fri, 4 Feb 2022 04:25:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60994 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357595AbiBDJYa (ORCPT ); Fri, 4 Feb 2022 04:24:30 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BB1AFC06177A; Fri, 4 Feb 2022 01:24:30 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7D34AB836B9; Fri, 4 Feb 2022 09:24:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 59540C004E1; Fri, 4 Feb 2022 09:24:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966668; bh=fSmrUO2QO2mxwW/Q3DVpy091GpVKvail29v4IS7R+dU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oDS/m2KrhsYSLT6KbhBQGxzz8YyppL2bPL3sG6kHTnagRbfeKoBqHi/DarBbZJpcd gKtXOgmaIykGmkSx0a/CrWqt2R6p0npf6eo8Zr9F1LBZdQuPKt6Kf/DYBHEOssjX4V SsMdEXHGe4GxZBBvUYdxC3IsuyfDTK3pzO7CVqqU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Lendacky , Shyam Sundar S K , Jakub Kicinski Subject: [PATCH 5.15 25/32] net: amd-xgbe: Fix skb data length underflow Date: Fri, 4 Feb 2022 10:22:35 +0100 Message-Id: <20220204091916.090850152@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Shyam Sundar S K commit 5aac9108a180fc06e28d4e7fb00247ce603b72ee upstream. There will be BUG_ON() triggered in include/linux/skbuff.h leading to intermittent kernel panic, when the skb length underflow is detected. Fix this by dropping the packet if such length underflows are seen because of inconsistencies in the hardware descriptors. Fixes: 622c36f143fc ("amd-xgbe: Fix jumbo MTU processing on newer hardware") Suggested-by: Tom Lendacky Signed-off-by: Shyam Sundar S K Acked-by: Tom Lendacky Link: https://lore.kernel.org/r/20220127092003.2812745-1-Shyam-sundar.S-k@a= md.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c @@ -2557,6 +2557,14 @@ read_again: buf2_len =3D xgbe_rx_buf2_len(rdata, packet, len); len +=3D buf2_len; =20 + if (buf2_len > rdata->rx.buf.dma_len) { + /* Hardware inconsistency within the descriptors + * that has resulted in a length underflow. + */ + error =3D 1; + goto skip_data; + } + if (!skb) { skb =3D xgbe_create_skb(pdata, napi, rdata, buf1_len); @@ -2586,8 +2594,10 @@ skip_data: if (!last || context_next) goto read_again; =20 - if (!skb) + if (!skb || error) { + dev_kfree_skb(skb); goto next_packet; + } =20 /* Be sure we don't exceed the configured MTU */ max_len =3D netdev->mtu + ETH_HLEN; From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2AF8C433FE for ; Fri, 4 Feb 2022 09:25:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357887AbiBDJZv (ORCPT ); Fri, 4 Feb 2022 04:25:51 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:43630 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357554AbiBDJYc (ORCPT ); Fri, 4 Feb 2022 04:24:32 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 18809616DB; Fri, 4 Feb 2022 09:24:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D06A3C340EF; Fri, 4 Feb 2022 09:24:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966671; bh=ZzMj6G9e6/gWX7cJeYR8I7KvzFa61O0cT2/d4KYtnsM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LmIs9LcNmIDEgis9fGmzfKwy0n7j5DYhqFCFDz33xnobrg0dUqKiqNpKDbau/A1c5 SgbxKLocC9PPpGzH7IG9I2EYMsJRMypcr/L5lPDonE23P8ArBtv84OVf0D57S0WFwQ eXgxUAIKFGwIOVkrO/5SE5LIx2FX2yWl/EJnY84s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Mathias Krause , Jan Kara Subject: [PATCH 5.15 26/32] fanotify: Fix stale file descriptor in copy_event_to_user() Date: Fri, 4 Feb 2022 10:22:36 +0100 Message-Id: <20220204091916.121063674@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter commit ee12595147ac1fbfb5bcb23837e26dd58d94b15d upstream. This code calls fd_install() which gives the userspace access to the fd. Then if copy_info_records_to_user() fails it calls put_unused_fd(fd) but that will not release it and leads to a stale entry in the file descriptor table. Generally you can't trust the fd after a call to fd_install(). The fix is to delay the fd_install() until everything else has succeeded. Fortunately it requires CAP_SYS_ADMIN to reach this code so the security impact is less. Fixes: f644bc449b37 ("fanotify: fix copy_event_to_user() fid error clean up= ") Link: https://lore.kernel.org/r/20220128195656.GA26981@kili Signed-off-by: Dan Carpenter Reviewed-by: Mathias Krause Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/notify/fanotify/fanotify_user.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/fs/notify/fanotify/fanotify_user.c +++ b/fs/notify/fanotify/fanotify_user.c @@ -611,9 +611,6 @@ static ssize_t copy_event_to_user(struct if (fanotify_is_perm_event(event->mask)) FANOTIFY_PERM(event)->fd =3D fd; =20 - if (f) - fd_install(fd, f); - if (info_mode) { ret =3D copy_info_records_to_user(event, info, info_mode, pidfd, buf, count); @@ -621,6 +618,9 @@ static ssize_t copy_event_to_user(struct goto out_close_fd; } =20 + if (f) + fd_install(fd, f); + return metadata.event_len; =20 out_close_fd: From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3260DC433EF for ; Fri, 4 Feb 2022 09:26:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357630AbiBDJ0D (ORCPT ); Fri, 4 Feb 2022 04:26:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33314 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357473AbiBDJYf (ORCPT ); Fri, 4 Feb 2022 04:24:35 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9A271C061744; Fri, 4 Feb 2022 01:24:35 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 17C18616EB; Fri, 4 Feb 2022 09:24:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EFE23C340F1; Fri, 4 Feb 2022 09:24:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966674; bh=rr7FQwVrJ05nEWbpsJy537f2UNq7u1DL+MlzH6kVaxk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cS2FNWZ7r0MNIMt/2WtlQLe+C+TKvTCjAAu9bhxsziJ9zd7PJ0SJzYh0LAOEXluvK eVFxBDNERYifG4L2x6Et8R0sXql0StNFUpuEKjN9503wuRrfq8aBKy3v01OgFOBq+4 mmWAloSRaor4pVz5zu4VtCarKmHCQD900bOjTlQw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Vlad Buslov , Jiri Pirko , Cong Wang , syzbot , Jakub Kicinski Subject: [PATCH 5.15 27/32] net: sched: fix use-after-free in tc_new_tfilter() Date: Fri, 4 Feb 2022 10:22:37 +0100 Message-Id: <20220204091916.155015627@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 upstream. Whenever tc_new_tfilter() jumps back to replay: label, we need to make sure @q and @chain local variables are cleared again, or risk use-after-free as in [1] For consistency, apply the same fix in tc_ctl_chain() BUG: KASAN: use-after-free in mini_qdisc_pair_swap+0x1b9/0x1f0 net/sched/sc= h_generic.c:1581 Write of size 8 at addr ffff8880985c4b08 by task syz-executor.4/1945 CPU: 0 PID: 1945 Comm: syz-executor.4 Not tainted 5.17.0-rc1-syzkaller-0049= 5-gff58831fa02d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 mini_qdisc_pair_swap+0x1b9/0x1f0 net/sched/sch_generic.c:1581 tcf_chain_head_change_item net/sched/cls_api.c:372 [inline] tcf_chain0_head_change.isra.0+0xb9/0x120 net/sched/cls_api.c:386 tcf_chain_tp_insert net/sched/cls_api.c:1657 [inline] tcf_chain_tp_insert_unique net/sched/cls_api.c:1707 [inline] tc_new_tfilter+0x1e67/0x2350 net/sched/cls_api.c:2086 rtnetlink_rcv_msg+0x80d/0xb80 net/core/rtnetlink.c:5583 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x539/0x7e0 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:725 ____sys_sendmsg+0x331/0x810 net/socket.c:2413 ___sys_sendmsg+0xf3/0x170 net/socket.c:2467 __sys_sendmmsg+0x195/0x470 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline] __se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f2647172059 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2645aa5168 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f2647285100 RCX: 00007f2647172059 RDX: 040000000000009f RSI: 00000000200002c0 RDI: 0000000000000006 RBP: 00007f26471cc08d R08: 0000000000000000 R09: 0000000000000000 R10: 9e00000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffb3f7f02f R14: 00007f2645aa5300 R15: 0000000000022000 Allocated by task 1944: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524 kmalloc_node include/linux/slab.h:604 [inline] kzalloc_node include/linux/slab.h:726 [inline] qdisc_alloc+0xac/0xa10 net/sched/sch_generic.c:941 qdisc_create.constprop.0+0xce/0x10f0 net/sched/sch_api.c:1211 tc_modify_qdisc+0x4c5/0x1980 net/sched/sch_api.c:1660 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5592 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x539/0x7e0 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:725 ____sys_sendmsg+0x331/0x810 net/socket.c:2413 ___sys_sendmsg+0xf3/0x170 net/socket.c:2467 __sys_sendmmsg+0x195/0x470 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline] __se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 3609: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x130/0x160 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:236 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1754 slab_free mm/slub.c:3509 [inline] kfree+0xcb/0x280 mm/slub.c:4562 rcu_do_batch kernel/rcu/tree.c:2527 [inline] rcu_core+0x7b8/0x1540 kernel/rcu/tree.c:2778 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 Last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 __call_rcu kernel/rcu/tree.c:3026 [inline] call_rcu+0xb1/0x740 kernel/rcu/tree.c:3106 qdisc_put_unlocked+0x6f/0x90 net/sched/sch_generic.c:1109 tcf_block_release+0x86/0x90 net/sched/cls_api.c:1238 tc_new_tfilter+0xc0d/0x2350 net/sched/cls_api.c:2148 rtnetlink_rcv_msg+0x80d/0xb80 net/core/rtnetlink.c:5583 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x539/0x7e0 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:725 ____sys_sendmsg+0x331/0x810 net/socket.c:2413 ___sys_sendmsg+0xf3/0x170 net/socket.c:2467 __sys_sendmmsg+0x195/0x470 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline] __se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff8880985c4800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 776 bytes inside of 1024-byte region [ffff8880985c4800, ffff8880985c4c00) The buggy address belongs to the page: page:ffffea0002617000 refcount:1 mapcount:0 mapping:0000000000000000 index:= 0x0 pfn:0x985c0 head:ffffea0002617000 order:3 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=3D0|zone=3D1|lastcpupid=3D0x7ff) raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888010c41dc0 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(_= _GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__G= FP_HARDWALL), pid 1941, ts 1038999441284, free_ts 1033444432829 prep_new_page mm/page_alloc.c:2434 [inline] get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4165 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5389 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2271 alloc_slab_page mm/slub.c:1799 [inline] allocate_slab mm/slub.c:1944 [inline] new_slab+0x28a/0x3b0 mm/slub.c:2004 ___slab_alloc+0x87c/0xe90 mm/slub.c:3018 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3105 slab_alloc_node mm/slub.c:3196 [inline] slab_alloc mm/slub.c:3238 [inline] __kmalloc+0x2fb/0x340 mm/slub.c:4420 kmalloc include/linux/slab.h:586 [inline] kzalloc include/linux/slab.h:715 [inline] __register_sysctl_table+0x112/0x1090 fs/proc/proc_sysctl.c:1335 neigh_sysctl_register+0x2c8/0x5e0 net/core/neighbour.c:3787 devinet_sysctl_register+0xb1/0x230 net/ipv4/devinet.c:2618 inetdev_init+0x286/0x580 net/ipv4/devinet.c:278 inetdev_event+0xa8a/0x15d0 net/ipv4/devinet.c:1532 notifier_call_chain+0xb5/0x200 kernel/notifier.c:84 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1919 call_netdevice_notifiers_extack net/core/dev.c:1931 [inline] call_netdevice_notifiers net/core/dev.c:1945 [inline] register_netdevice+0x1073/0x1500 net/core/dev.c:9698 veth_newlink+0x59c/0xa90 drivers/net/veth.c:1722 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1352 [inline] free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1404 free_unref_page_prepare mm/page_alloc.c:3325 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3404 release_pages+0x748/0x1220 mm/swap.c:956 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline] tlb_flush_mmu_free mm/mmu_gather.c:243 [inline] tlb_flush_mmu+0xe9/0x6b0 mm/mmu_gather.c:250 zap_pte_range mm/memory.c:1441 [inline] zap_pmd_range mm/memory.c:1490 [inline] zap_pud_range mm/memory.c:1519 [inline] zap_p4d_range mm/memory.c:1540 [inline] unmap_page_range+0x1d1d/0x2a30 mm/memory.c:1561 unmap_single_vma+0x198/0x310 mm/memory.c:1606 unmap_vmas+0x16b/0x2f0 mm/memory.c:1638 exit_mmap+0x201/0x670 mm/mmap.c:3178 __mmput+0x122/0x4b0 kernel/fork.c:1114 mmput+0x56/0x60 kernel/fork.c:1135 exit_mm kernel/exit.c:507 [inline] do_exit+0xa3c/0x2a30 kernel/exit.c:793 do_group_exit+0xd2/0x2f0 kernel/exit.c:935 __do_sys_exit_group kernel/exit.c:946 [inline] __se_sys_exit_group kernel/exit.c:944 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:944 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Memory state around the buggy address: ffff8880985c4a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880985c4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880985c4b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880985c4b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880985c4c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc Fixes: 470502de5bdb ("net: sched: unlock rules update API") Signed-off-by: Eric Dumazet Cc: Vlad Buslov Cc: Jiri Pirko Cc: Cong Wang Reported-by: syzbot Link: https://lore.kernel.org/r/20220131172018.3704490-1-eric.dumazet@gmail= .com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/sched/cls_api.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -1945,9 +1945,9 @@ static int tc_new_tfilter(struct sk_buff bool prio_allocate; u32 parent; u32 chain_index; - struct Qdisc *q =3D NULL; + struct Qdisc *q; struct tcf_chain_info chain_info; - struct tcf_chain *chain =3D NULL; + struct tcf_chain *chain; struct tcf_block *block; struct tcf_proto *tp; unsigned long cl; @@ -1976,6 +1976,8 @@ replay: tp =3D NULL; cl =3D 0; block =3D NULL; + q =3D NULL; + chain =3D NULL; flags =3D 0; =20 if (prio =3D=3D 0) { @@ -2798,8 +2800,8 @@ static int tc_ctl_chain(struct sk_buff * struct tcmsg *t; u32 parent; u32 chain_index; - struct Qdisc *q =3D NULL; - struct tcf_chain *chain =3D NULL; + struct Qdisc *q; + struct tcf_chain *chain; struct tcf_block *block; unsigned long cl; int err; @@ -2809,6 +2811,7 @@ static int tc_ctl_chain(struct sk_buff * return -EPERM; =20 replay: + q =3D NULL; err =3D nlmsg_parse_deprecated(n, sizeof(*t), tca, TCA_MAX, rtm_tca_policy, extack); if (err < 0) From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D04FBC433F5 for ; Fri, 4 Feb 2022 09:26:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358248AbiBDJ0L (ORCPT ); Fri, 4 Feb 2022 04:26:11 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52944 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357873AbiBDJYj (ORCPT ); Fri, 4 Feb 2022 04:24:39 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 92607B836F0; Fri, 4 Feb 2022 09:24:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EBC9FC340ED; Fri, 4 Feb 2022 09:24:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966677; bh=Ai2pTBuMpi+ZpmwAJGWmVGypw5mKsno03Np5MzaPBcI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R4uDqLCZ/sPvqJj7xdMLidf8dhEAMrFkVqeNns5sMwCHDDudeZ3z+D0sXu8maS4SU j39kj2zTyJIWb+H+Il8Q6/aUyPbm8AdVu2g41OLkX/occRLUb0/guhL3Ym+GLqOBY0 O26rR7PIHg4XU/1Ge06eYadrE+xndWvRLpyVGrT4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Jiri Pirko , Jakub Kicinski Subject: [PATCH 5.15 28/32] rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() Date: Fri, 4 Feb 2022 10:22:38 +0100 Message-Id: <20220204091916.184324998@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit c6f6f2444bdbe0079e41914a35081530d0409963 upstream. While looking at one unrelated syzbot bug, I found the replay logic in __rtnl_newlink() to potentially trigger use-after-free. It is better to clear master_dev and m_ops inside the loop, in case we have to replay it. Fixes: ba7d49b1f0f8 ("rtnetlink: provide api for getting and setting slave = info") Signed-off-by: Eric Dumazet Cc: Jiri Pirko Link: https://lore.kernel.org/r/20220201012106.216495-1-eric.dumazet@gmail.= com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/core/rtnetlink.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -3254,8 +3254,8 @@ static int __rtnl_newlink(struct sk_buff struct nlattr *slave_attr[RTNL_SLAVE_MAX_TYPE + 1]; unsigned char name_assign_type =3D NET_NAME_USER; struct nlattr *linkinfo[IFLA_INFO_MAX + 1]; - const struct rtnl_link_ops *m_ops =3D NULL; - struct net_device *master_dev =3D NULL; + const struct rtnl_link_ops *m_ops; + struct net_device *master_dev; struct net *net =3D sock_net(skb->sk); const struct rtnl_link_ops *ops; struct nlattr *tb[IFLA_MAX + 1]; @@ -3293,6 +3293,8 @@ replay: else dev =3D NULL; =20 + master_dev =3D NULL; + m_ops =3D NULL; if (dev) { master_dev =3D netdev_master_upper_dev_get(dev); if (master_dev) From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6883C433EF for ; Fri, 4 Feb 2022 09:26:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358326AbiBDJ0a (ORCPT ); Fri, 4 Feb 2022 04:26:30 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52988 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357893AbiBDJYm (ORCPT ); Fri, 4 Feb 2022 04:24:42 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A9F64B836B9; Fri, 4 Feb 2022 09:24:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D1935C004E1; Fri, 4 Feb 2022 09:24:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966680; bh=T+sqZCVEkJgNnFO9Rhbjhdo7Xu1WOs9myTQYJ5/K0XY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MZgpZylJAQLUqmhaI1FDf9MUv+Toh7UOiRBdx/ctR6Ys5n3qBE6Hm+IjSDhPqTkZd MoSjiH99BATi0ARacYGDkhbYov9MDbTSBBt/efJpSuNUHJBKmLedDXyBW+pcbhV/rG vx/12BA3RdD4FWYDdJjTqfukRvXpCFJKtYxd8UhE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tianchen Ding , Waiman Long , Tejun Heo Subject: [PATCH 5.15 29/32] cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask() Date: Fri, 4 Feb 2022 10:22:39 +0100 Message-Id: <20220204091916.214992004@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tianchen Ding commit c80d401c52a2d1baf2a5afeb06f0ffe678e56d23 upstream. subparts_cpus should be limited as a subset of cpus_allowed, but it is updated wrongly by using cpumask_andnot(). Use cpumask_and() instead to fix it. Fixes: ee8dde0cd2ce ("cpuset: Add new v2 cpuset.sched.partition flag") Signed-off-by: Tianchen Ding Reviewed-by: Waiman Long Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- kernel/cgroup/cpuset.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -1597,8 +1597,7 @@ static int update_cpumask(struct cpuset * Make sure that subparts_cpus is a subset of cpus_allowed. */ if (cs->nr_subparts_cpus) { - cpumask_andnot(cs->subparts_cpus, cs->subparts_cpus, - cs->cpus_allowed); + cpumask_and(cs->subparts_cpus, cs->subparts_cpus, cs->cpus_allowed); cs->nr_subparts_cpus =3D cpumask_weight(cs->subparts_cpus); } spin_unlock_irq(&callback_lock); From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1DD0BC433F5 for ; Fri, 4 Feb 2022 09:26:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358269AbiBDJ0R (ORCPT ); Fri, 4 Feb 2022 04:26:17 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:43806 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357907AbiBDJYo (ORCPT ); Fri, 4 Feb 2022 04:24:44 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8DA1D612C8; Fri, 4 Feb 2022 09:24:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 20D12C004E1; Fri, 4 Feb 2022 09:24:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966684; bh=mPjX16zNpAn7LOPJg7nzi8nM1zws5ngvx/rWuXKPNwQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WB1e9oI/XO93yp067SmmVugLNYkJjrl+sm0Cllj2nr2gWdBg6oPJcVBVabdFDt6eH NGuQs39juKQD+S7EKm5Knxp/Eg/HgyP1ag1OMHB7iX0hcC7CxgJtPUVd0x8jKhtrrv v5lbuuEov+38BkCiWXqcGCnDl3C/1nnpImhcr+1k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sasha Neftin , Nechama Kraus , Tony Nguyen Subject: [PATCH 5.15 30/32] e1000e: Handshake with CSME starts from ADL platforms Date: Fri, 4 Feb 2022 10:22:40 +0100 Message-Id: <20220204091916.244764690@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sasha Neftin commit cad014b7b5a6897d8c4fad13e2888978bfb7a53f upstream. Handshake with CSME/AMT on none provisioned platforms during S0ix flow is not supported on TGL platform and can cause to HW unit hang. Update the handshake with CSME flow to start from the ADL platform. Fixes: 3e55d231716e ("e1000e: Add handshake with the CSME to support S0ix") Signed-off-by: Sasha Neftin Tested-by: Nechama Kraus Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/intel/e1000e/netdev.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/intel/e1000e/netdev.c +++ b/drivers/net/ethernet/intel/e1000e/netdev.c @@ -6346,7 +6346,8 @@ static void e1000e_s0ix_entry_flow(struc u32 mac_data; u16 phy_data; =20 - if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID) { + if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID && + hw->mac.type >=3D e1000_pch_adp) { /* Request ME configure the device for S0ix */ mac_data =3D er32(H2ME); mac_data |=3D E1000_H2ME_START_DPG; @@ -6495,7 +6496,8 @@ static void e1000e_s0ix_exit_flow(struct u16 phy_data; u32 i =3D 0; =20 - if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID) { + if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID && + hw->mac.type >=3D e1000_pch_adp) { /* Request ME unconfigure the device from S0ix */ mac_data =3D er32(H2ME); mac_data &=3D ~E1000_H2ME_START_DPG; From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BFD8DC433EF for ; Fri, 4 Feb 2022 09:25:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358165AbiBDJZp (ORCPT ); Fri, 4 Feb 2022 04:25:45 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33220 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357774AbiBDJYR (ORCPT ); Fri, 4 Feb 2022 04:24:17 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C2540C061401; Fri, 4 Feb 2022 01:24:16 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8DC27B836ED; Fri, 4 Feb 2022 09:24:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CF7B0C004E1; Fri, 4 Feb 2022 09:24:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966654; bh=XEwVp7VEo0iOdPynRzXc0mJQMdS0I2MsWE9XzwM+HSw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sWpDc8m52EVMbYiHe4q9U9rfV4qngBzv9MrhD3QqryQbdmfCwV176AZaR9TD4+Cuz g9QtUh+/TsnNQLRcZcxhRlLQufmTD0n+HC6uQUlepqZzk4Kbh3SIlpgMIn+2dAvCTK LRSoRhT8llMDBBMzq7KqAHGc/MGF/ktUJlQ/bm3I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Willem de Bruijn , syzbot , Jakub Kicinski Subject: [PATCH 5.15 31/32] af_packet: fix data-race in packet_setsockopt / packet_setsockopt Date: Fri, 4 Feb 2022 10:22:41 +0100 Message-Id: <20220204091916.274100420@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit e42e70ad6ae2ae511a6143d2e8da929366e58bd9 upstream. When packet_setsockopt( PACKET_FANOUT_DATA ) reads po->fanout, no lock is held, meaning that another thread can change po->fanout. Given that po->fanout can only be set once during the socket lifetime (it is only cleared from fanout_release()), we can use READ_ONCE()/WRITE_ONCE() to document the race. BUG: KCSAN: data-race in packet_setsockopt / packet_setsockopt write to 0xffff88813ae8e300 of 8 bytes by task 14653 on cpu 0: fanout_add net/packet/af_packet.c:1791 [inline] packet_setsockopt+0x22fe/0x24a0 net/packet/af_packet.c:3931 __sys_setsockopt+0x209/0x2a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0x62/0x70 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88813ae8e300 of 8 bytes by task 14654 on cpu 1: packet_setsockopt+0x691/0x24a0 net/packet/af_packet.c:3935 __sys_setsockopt+0x209/0x2a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0x62/0x70 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x0000000000000000 -> 0xffff888106f8c000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 14654 Comm: syz-executor.3 Not tainted 5.16.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Fixes: 47dceb8ecdc1 ("packet: add classic BPF fanout mode") Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Reported-by: syzbot Link: https://lore.kernel.org/r/20220201022358.330621-1-eric.dumazet@gmail.= com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/packet/af_packet.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -1753,7 +1753,10 @@ static int fanout_add(struct sock *sk, s err =3D -ENOSPC; if (refcount_read(&match->sk_ref) < match->max_num_members) { __dev_remove_pack(&po->prot_hook); - po->fanout =3D match; + + /* Paired with packet_setsockopt(PACKET_FANOUT_DATA) */ + WRITE_ONCE(po->fanout, match); + po->rollover =3D rollover; rollover =3D NULL; refcount_set(&match->sk_ref, refcount_read(&match->sk_ref) + 1); @@ -3906,7 +3909,8 @@ packet_setsockopt(struct socket *sock, i } case PACKET_FANOUT_DATA: { - if (!po->fanout) + /* Paired with the WRITE_ONCE() in fanout_add() */ + if (!READ_ONCE(po->fanout)) return -EINVAL; =20 return fanout_set_data(po, optval, optlen); From nobody Tue Jun 30 20:51:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E68E1C433F5 for ; Fri, 4 Feb 2022 09:25:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358134AbiBDJZs (ORCPT ); Fri, 4 Feb 2022 04:25:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33240 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357789AbiBDJYU (ORCPT ); Fri, 4 Feb 2022 04:24:20 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7096CC061749; Fri, 4 Feb 2022 01:24:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3FE7FB836EE; Fri, 4 Feb 2022 09:24:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 51222C004E1; Fri, 4 Feb 2022 09:24:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966658; bh=+8GHC0oN1KhrLZtjBLXKmFHGMZGOrjmKBntYExK0ddw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MRw0G0oICTKLlY8Mnxnr8kP4VNCXjrBSMkyX6wRqaGTmjKIC0l6TRuBf9pNrMpIVx tVYTj3ErHFfL5WSfNMoYk2ZzIgPFml+sv3KGhA/SEi83e+JdC5GzoWQ8voE8ep7uCg 0eWz0jHRwGMTml3zV7GKIU0jOLL/l2jawisEhY2E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Mat Martineau , Talal Ahmad , Arjun Roy , Willem de Bruijn , Soheil Hassas Yeganeh , Paolo Abeni , Jakub Kicinski Subject: [PATCH 5.15 32/32] tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data() Date: Fri, 4 Feb 2022 10:22:42 +0100 Message-Id: <20220204091916.308013723@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091915.247906930@linuxfoundation.org> References: <20220204091915.247906930@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit b67985be400969578d4d4b17299714c0e5d2c07b upstream. tcp_shift_skb_data() might collapse three packets into a larger one. P_A, P_B, P_C -> P_ABC Historically, it used a single tcp_skb_can_collapse_to(P_A) call, because it was enough. In commit 85712484110d ("tcp: coalesce/collapse must respect MPTCP extensio= ns"), this call was replaced by a call to tcp_skb_can_collapse(P_A, P_B) But the now needed test over P_C has been missed. This probably broke MPTCP. Then later, commit 9b65b17db723 ("net: avoid double accounting for pure zer= ocopy skbs") added an extra condition to tcp_skb_can_collapse(), but the missing call from tcp_shift_skb_data() is also breaking TCP zerocopy, because P_A and P_C might have different skb_zcopy_pure() status. Fixes: 85712484110d ("tcp: coalesce/collapse must respect MPTCP extensions") Fixes: 9b65b17db723 ("net: avoid double accounting for pure zerocopy skbs") Signed-off-by: Eric Dumazet Cc: Mat Martineau Cc: Talal Ahmad Cc: Arjun Roy Cc: Willem de Bruijn Acked-by: Soheil Hassas Yeganeh Acked-by: Paolo Abeni Link: https://lore.kernel.org/r/20220201184640.756716-1-eric.dumazet@gmail.= com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/ipv4/tcp_input.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -1652,6 +1652,8 @@ static struct sk_buff *tcp_shift_skb_dat (mss !=3D tcp_skb_seglen(skb))) goto out; =20 + if (!tcp_skb_can_collapse(prev, skb)) + goto out; len =3D skb->len; pcount =3D tcp_skb_pcount(skb); if (tcp_skb_shift(prev, skb, pcount, len))