From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3627FC433F5 for ; Fri, 4 Feb 2022 09:26:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358287AbiBDJ0V (ORCPT ); Fri, 4 Feb 2022 04:26:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33420 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357972AbiBDJYx (ORCPT ); Fri, 4 Feb 2022 04:24:53 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 360E8C06176E; Fri, 4 Feb 2022 01:24:53 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E7F8FB836EE; Fri, 4 Feb 2022 09:24:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F40E4C004E1; Fri, 4 Feb 2022 09:24:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966690; bh=4KnP9f2BG2N0gQWpClCCaBlbp1tyU3Pjw2Z1LPrgmQ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DZO8JA4tC9CreZvdM+j70RucL2HHbVyTrfJzNTiX81E2DjtQBCQ02tmh/U2JLntay zoRphcu3guu8Dk3eEqOqnt2b5Kr4gxGdoKm/+0iO9LUuJ9IEdpdPEpeYUqsfQn+d9t d/aR+es2lxA3zxK7Heoc3spB2QKgPT2H/2J5nEwI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joseph Bao , Lukas Wunner , Bjorn Helgaas , Stuart Hayes Subject: [PATCH 5.16 01/43] PCI: pciehp: Fix infinite loop in IRQ handler upon power fault Date: Fri, 4 Feb 2022 10:22:08 +0100 Message-Id: <20220204091917.216583469@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Wunner commit 23584c1ed3e15a6f4bfab8dc5a88d94ab929ee12 upstream. The Power Fault Detected bit in the Slot Status register differs from all other hotplug events in that it is sticky: It can only be cleared after turning off slot power. Per PCIe r5.0, sec. 6.7.1.8: If a power controller detects a main power fault on the hot-plug slot, it must automatically set its internal main power fault latch [...]. The main power fault latch is cleared when software turns off power to the hot-plug slot. The stickiness used to cause interrupt storms and infinite loops which were fixed in 2009 by commits 5651c48cfafe ("PCI pciehp: fix power fault interrupt storm problem") and 99f0169c17f3 ("PCI: pciehp: enable software notification on empty slots"). Unfortunately in 2020 the infinite loop issue was inadvertently reintroduced by commit 8edf5332c393 ("PCI: pciehp: Fix MSI interrupt race"): The hardirq handler pciehp_isr() clears the PFD bit until pciehp's power_fault_detected flag is set. That happens in the IRQ thread pciehp_ist(), which never learns of the event because the hardirq handler is stuck in an infinite loop. Fix by setting the power_fault_detected flag already in the hardirq handler. Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D214989 Link: https://lore.kernel.org/linux-pci/DM8PR11MB5702255A6A92F735D90A444686= 8B9@DM8PR11MB5702.namprd11.prod.outlook.com Fixes: 8edf5332c393 ("PCI: pciehp: Fix MSI interrupt race") Link: https://lore.kernel.org/r/66eaeef31d4997ceea357ad93259f290ededecfd.16= 37187226.git.lukas@wunner.de Reported-by: Joseph Bao Tested-by: Joseph Bao Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org # v4.19+ Cc: Stuart Hayes Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/pci/hotplug/pciehp_hpc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/drivers/pci/hotplug/pciehp_hpc.c +++ b/drivers/pci/hotplug/pciehp_hpc.c @@ -642,6 +642,8 @@ read_status: */ if (ctrl->power_fault_detected) status &=3D ~PCI_EXP_SLTSTA_PFD; + else if (status & PCI_EXP_SLTSTA_PFD) + ctrl->power_fault_detected =3D true; =20 events |=3D status; if (!events) { @@ -651,7 +653,7 @@ read_status: } =20 if (status) { - pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, events); + pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, status); =20 /* * In MSI mode, all event bits must be zero before the port @@ -725,8 +727,7 @@ static irqreturn_t pciehp_ist(int irq, v } =20 /* Check Power Fault Detected */ - if ((events & PCI_EXP_SLTSTA_PFD) && !ctrl->power_fault_detected) { - ctrl->power_fault_detected =3D 1; + if (events & PCI_EXP_SLTSTA_PFD) { ctrl_err(ctrl, "Slot(%s): Power fault\n", slot_name(ctrl)); pciehp_set_indicators(ctrl, PCI_EXP_SLTCTL_PWR_IND_OFF, PCI_EXP_SLTCTL_ATTN_IND_ON); From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2656FC433FE for ; Fri, 4 Feb 2022 09:27:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352436AbiBDJ1g (ORCPT ); Fri, 4 Feb 2022 04:27:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60910 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358184AbiBDJZu (ORCPT ); Fri, 4 Feb 2022 04:25:50 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A69A9C06177C; Fri, 4 Feb 2022 01:25:28 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 63F20B836F5; Fri, 4 Feb 2022 09:25:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7762AC004E1; Fri, 4 Feb 2022 09:25:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966726; bh=v8kwjDF6yTQarvxN50HM4f0CfMsheFvPdVt58nR4qJ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pbh3mfF0psUfphvI+lreGg+Txa4zPHOxlPUZIpVhQrZrFzgV53AysGCGPuJnQweqm iQXbGRenVIZaqhTAMHf0/iJoy9Sa5Md5AeRR9Rhbmn/AAfQ/YVlv4aIBFSVVHaRyp/ aWcuNgQrmP6gEYGWlqWBzVs/2+kjj2WpQqwWc+m0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paolo Abeni , Mat Martineau , Jakub Kicinski , Geliang Tang Subject: [PATCH 5.16 02/43] selftests: mptcp: fix ipv6 routing setup Date: Fri, 4 Feb 2022 10:22:09 +0100 Message-Id: <20220204091917.247977288@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Paolo Abeni commit 9846921dba4936d92f7608315b5d1e0a8ec3a538 upstream. MPJ ipv6 selftests currently lack per link route to the server net. Additionally, ipv6 subflows endpoints are created without any interface specified. The end-result is that in ipv6 self-tests subflows are created all on the same link, leading to expected delays and sporadic self-tests failures. Fix the issue by adding the missing setup bits. Fixes: 523514ed0a99 ("selftests: mptcp: add ADD_ADDR IPv6 test cases") Reported-and-tested-by: Geliang Tang Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- tools/testing/selftests/net/mptcp/mptcp_join.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -75,6 +75,7 @@ init() =20 # let $ns2 reach any $ns1 address from any interface ip -net "$ns2" route add default via 10.0.$i.1 dev ns2eth$i metric 10$i + ip -net "$ns2" route add default via dead:beef:$i::1 dev ns2eth$i metric= 10$i done } =20 @@ -1386,7 +1387,7 @@ ipv6_tests() reset ip netns exec $ns1 ./pm_nl_ctl limits 0 1 ip netns exec $ns2 ./pm_nl_ctl limits 0 1 - ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 flags subflow + ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 dev ns2eth3 flags subfl= ow run_tests $ns1 $ns2 dead:beef:1::1 0 0 0 slow chk_join_nr "single subflow IPv6" 1 1 1 =20 @@ -1421,7 +1422,7 @@ ipv6_tests() ip netns exec $ns1 ./pm_nl_ctl limits 0 2 ip netns exec $ns1 ./pm_nl_ctl add dead:beef:2::1 flags signal ip netns exec $ns2 ./pm_nl_ctl limits 1 2 - ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 flags subflow + ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 dev ns2eth3 flags subfl= ow run_tests $ns1 $ns2 dead:beef:1::1 0 -1 -1 slow chk_join_nr "remove subflow and signal IPv6" 2 2 2 chk_add_nr 1 1 From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54A7EC433F5 for ; Fri, 4 Feb 2022 09:28:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358270AbiBDJ16 (ORCPT ); Fri, 4 Feb 2022 04:27:58 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44842 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357970AbiBDJZz (ORCPT ); Fri, 4 Feb 2022 04:25:55 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3FDEF616CA; Fri, 4 Feb 2022 09:25:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 18729C004E1; Fri, 4 Feb 2022 09:25:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966754; bh=wDWmQp90kgCrwgiLNL+U3qc/fKgK7nB1VdZ628Ja/X0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oMx2divX1FbZST/Tw+nNN/g2csyFK/NVJyDVAmgm2c5+8sf2oe5PgCxWfVQV7Sp4t M5dFLFLN3gqTHcxnkm3+NkY9pa0E4NpayYWRTvdPaSLJvRYycNAfMo99ibCVvAC+gv ThMGA0Dy2zj94/LhKPT+N/dslvMNmVcJNzOxExhI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alex Elder , "David S. Miller" Subject: [PATCH 5.16 03/43] net: ipa: use a bitmap for endpoint replenish_enabled Date: Fri, 4 Feb 2022 10:22:10 +0100 Message-Id: <20220204091917.294616582@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alex Elder commit c1aaa01dbf4cef95af3e04a5a43986c290e06ea3 upstream. Define a new replenish_flags bitmap to contain Boolean flags associated with an endpoint's replenishing state. Replace the replenish_enabled field with a flag in that bitmap. This is to prepare for the next patch, which adds another flag. Signed-off-by: Alex Elder Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ipa/ipa_endpoint.c | 8 ++++---- drivers/net/ipa/ipa_endpoint.h | 15 +++++++++++++-- 2 files changed, 17 insertions(+), 6 deletions(-) --- a/drivers/net/ipa/ipa_endpoint.c +++ b/drivers/net/ipa/ipa_endpoint.c @@ -1069,7 +1069,7 @@ static void ipa_endpoint_replenish(struc u32 backlog; int delta; =20 - if (!endpoint->replenish_enabled) { + if (!test_bit(IPA_REPLENISH_ENABLED, endpoint->replenish_flags)) { if (add_one) atomic_inc(&endpoint->replenish_saved); return; @@ -1106,7 +1106,7 @@ static void ipa_endpoint_replenish_enabl u32 max_backlog; u32 saved; =20 - endpoint->replenish_enabled =3D true; + set_bit(IPA_REPLENISH_ENABLED, endpoint->replenish_flags); while ((saved =3D atomic_xchg(&endpoint->replenish_saved, 0))) atomic_add(saved, &endpoint->replenish_backlog); =20 @@ -1120,7 +1120,7 @@ static void ipa_endpoint_replenish_disab { u32 backlog; =20 - endpoint->replenish_enabled =3D false; + clear_bit(IPA_REPLENISH_ENABLED, endpoint->replenish_flags); while ((backlog =3D atomic_xchg(&endpoint->replenish_backlog, 0))) atomic_add(backlog, &endpoint->replenish_saved); } @@ -1665,7 +1665,7 @@ static void ipa_endpoint_setup_one(struc /* RX transactions require a single TRE, so the maximum * backlog is the same as the maximum outstanding TREs. */ - endpoint->replenish_enabled =3D false; + clear_bit(IPA_REPLENISH_ENABLED, endpoint->replenish_flags); atomic_set(&endpoint->replenish_saved, gsi_channel_tre_max(gsi, endpoint->channel_id)); atomic_set(&endpoint->replenish_backlog, 0); --- a/drivers/net/ipa/ipa_endpoint.h +++ b/drivers/net/ipa/ipa_endpoint.h @@ -41,6 +41,17 @@ enum ipa_endpoint_name { #define IPA_ENDPOINT_MAX 32 /* Max supported by driver */ =20 /** + * enum ipa_replenish_flag: RX buffer replenish flags + * + * @IPA_REPLENISH_ENABLED: Whether receive buffer replenishing is enabled + * @IPA_REPLENISH_COUNT: Number of defined replenish flags + */ +enum ipa_replenish_flag { + IPA_REPLENISH_ENABLED, + IPA_REPLENISH_COUNT, /* Number of flags (must be last) */ +}; + +/** * struct ipa_endpoint - IPA endpoint information * @ipa: IPA pointer * @ee_id: Execution environmnent endpoint is associated with @@ -51,7 +62,7 @@ enum ipa_endpoint_name { * @trans_tre_max: Maximum number of TRE descriptors per transaction * @evt_ring_id: GSI event ring used by the endpoint * @netdev: Network device pointer, if endpoint uses one - * @replenish_enabled: Whether receive buffer replenishing is enabled + * @replenish_flags: Replenishing state flags * @replenish_ready: Number of replenish transactions without doorbell * @replenish_saved: Replenish requests held while disabled * @replenish_backlog: Number of buffers needed to fill hardware queue @@ -72,7 +83,7 @@ struct ipa_endpoint { struct net_device *netdev; =20 /* Receive buffer replenishing for RX endpoints */ - bool replenish_enabled; + DECLARE_BITMAP(replenish_flags, IPA_REPLENISH_COUNT); u32 replenish_ready; atomic_t replenish_saved; atomic_t replenish_backlog; From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D04CBC433EF for ; Fri, 4 Feb 2022 09:28:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358346AbiBDJ2Q (ORCPT ); Fri, 4 Feb 2022 04:28:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33008 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358305AbiBDJ00 (ORCPT ); Fri, 4 Feb 2022 04:26:26 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5ACEDC06175F; Fri, 4 Feb 2022 01:26:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 23545B836F9; Fri, 4 Feb 2022 09:25:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3E09EC004E1; Fri, 4 Feb 2022 09:25:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966757; bh=wsDPVvMJ3fihSgGDbISGT78IhKQRNro2j33j6ziBLu4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gpBU6Bp5c5v9ungTrQTH5476TjZXJ5vG/EU0s1toXSuxFZK9UdDAInix0sGYq2YP5 n06c+1A/HgrhvCK2MrvTVDKTYhgdwwLKf/UDJmEmXqn/f9DhFxRyFLk9fbfWVsOy5n EGnuXpRDPylSaQVXCBFjfPLwHibaQ1VlNTCoMwgw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alex Elder , "David S. Miller" Subject: [PATCH 5.16 04/43] net: ipa: prevent concurrent replenish Date: Fri, 4 Feb 2022 10:22:11 +0100 Message-Id: <20220204091917.334430355@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alex Elder commit 998c0bd2b3715244da7639cc4e6a2062cb79c3f4 upstream. We have seen cases where an endpoint RX completion interrupt arrives while replenishing for the endpoint is underway. This causes another instance of replenishing to begin as part of completing the receive transaction. If this occurs it can lead to transaction corruption. Use a new flag to ensure only one replenish instance for an endpoint executes at a time. Fixes: 84f9bd12d46db ("soc: qcom: ipa: IPA endpoints") Signed-off-by: Alex Elder Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ipa/ipa_endpoint.c | 13 +++++++++++++ drivers/net/ipa/ipa_endpoint.h | 2 ++ 2 files changed, 15 insertions(+) --- a/drivers/net/ipa/ipa_endpoint.c +++ b/drivers/net/ipa/ipa_endpoint.c @@ -1075,15 +1075,27 @@ static void ipa_endpoint_replenish(struc return; } =20 + /* If already active, just update the backlog */ + if (test_and_set_bit(IPA_REPLENISH_ACTIVE, endpoint->replenish_flags)) { + if (add_one) + atomic_inc(&endpoint->replenish_backlog); + return; + } + while (atomic_dec_not_zero(&endpoint->replenish_backlog)) if (ipa_endpoint_replenish_one(endpoint)) goto try_again_later; + + clear_bit(IPA_REPLENISH_ACTIVE, endpoint->replenish_flags); + if (add_one) atomic_inc(&endpoint->replenish_backlog); =20 return; =20 try_again_later: + clear_bit(IPA_REPLENISH_ACTIVE, endpoint->replenish_flags); + /* The last one didn't succeed, so fix the backlog */ delta =3D add_one ? 2 : 1; backlog =3D atomic_add_return(delta, &endpoint->replenish_backlog); @@ -1666,6 +1678,7 @@ static void ipa_endpoint_setup_one(struc * backlog is the same as the maximum outstanding TREs. */ clear_bit(IPA_REPLENISH_ENABLED, endpoint->replenish_flags); + clear_bit(IPA_REPLENISH_ACTIVE, endpoint->replenish_flags); atomic_set(&endpoint->replenish_saved, gsi_channel_tre_max(gsi, endpoint->channel_id)); atomic_set(&endpoint->replenish_backlog, 0); --- a/drivers/net/ipa/ipa_endpoint.h +++ b/drivers/net/ipa/ipa_endpoint.h @@ -44,10 +44,12 @@ enum ipa_endpoint_name { * enum ipa_replenish_flag: RX buffer replenish flags * * @IPA_REPLENISH_ENABLED: Whether receive buffer replenishing is enabled + * @IPA_REPLENISH_ACTIVE: Whether replenishing is underway * @IPA_REPLENISH_COUNT: Number of defined replenish flags */ enum ipa_replenish_flag { IPA_REPLENISH_ENABLED, + IPA_REPLENISH_ACTIVE, IPA_REPLENISH_COUNT, /* Number of flags (must be last) */ }; =20 From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 73102C433EF for ; Fri, 4 Feb 2022 09:28:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358294AbiBDJ2D (ORCPT ); Fri, 4 Feb 2022 04:28:03 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53830 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357513AbiBDJ0D (ORCPT ); Fri, 4 Feb 2022 04:26:03 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7C471B836F7; Fri, 4 Feb 2022 09:26:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 87B39C004E1; Fri, 4 Feb 2022 09:26:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966761; bh=y7kUMDzkk7KxDwnhmT+pG870mIhhFOi4y36sO8vIdTI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fA6yhIOE4XU0GBiC3yO4/FVpcZsmIv5BthZ8/6UY/h2lFce210QtP/cXMy6LDF6tX WKB5TuIYPBdaWEdtKlodDzK3pus0a+BVw0fQDaCW1rdBBC6yLa0Jj2mzV+D8TSAI9J /vaOuZ7MG1Zgi49Segvcgg0BzkKaWs/1i3+Az6Q0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Stapelberg , Maxime Ripard Subject: [PATCH 5.16 05/43] drm/vc4: hdmi: Make sure the device is powered with CEC Date: Fri, 4 Feb 2022 10:22:12 +0100 Message-Id: <20220204091917.363327130@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maxime Ripard Commit 20b0dfa86bef0e80b41b0e5ac38b92f23b6f27f9 upstream. The original commit depended on a rework commit (724fc856c09e ("drm/vc4: hdmi: Split the CEC disable / enable functions in two")) that (rightfully) didn't reach stable. However, probably because the context changed, when the patch was applied to stable the pm_runtime_put called got moved to the end of the vc4_hdmi_cec_adap_enable function (that would have become vc4_hdmi_cec_disable with the rework) to vc4_hdmi_cec_init. This means that at probe time, we now drop our reference to the clocks and power domains and thus end up with a CPU hang when the CPU tries to access registers. The call to pm_runtime_resume_and_get() is also problematic since the .adap_enable CEC hook is called both to enable and to disable the controller. That means that we'll now call pm_runtime_resume_and_get() at disable time as well, messing with the reference counting. The behaviour we should have though would be to have pm_runtime_resume_and_get() called when the CEC controller is enabled, and pm_runtime_put when it's disabled. We need to move things around a bit to behave that way, but it aligns stable with upstream. Cc: # 5.10.x Cc: # 5.15.x Cc: # 5.16.x Reported-by: Michael Stapelberg Signed-off-by: Maxime Ripard Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/gpu/drm/vc4/vc4_hdmi.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) --- a/drivers/gpu/drm/vc4/vc4_hdmi.c +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c @@ -1739,18 +1739,18 @@ static int vc4_hdmi_cec_adap_enable(stru u32 val; int ret; =20 - ret =3D pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev); - if (ret) - return ret; + if (enable) { + ret =3D pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev); + if (ret) + return ret; =20 - val =3D HDMI_READ(HDMI_CEC_CNTRL_5); - val &=3D ~(VC4_HDMI_CEC_TX_SW_RESET | VC4_HDMI_CEC_RX_SW_RESET | - VC4_HDMI_CEC_CNT_TO_4700_US_MASK | - VC4_HDMI_CEC_CNT_TO_4500_US_MASK); - val |=3D ((4700 / usecs) << VC4_HDMI_CEC_CNT_TO_4700_US_SHIFT) | - ((4500 / usecs) << VC4_HDMI_CEC_CNT_TO_4500_US_SHIFT); + val =3D HDMI_READ(HDMI_CEC_CNTRL_5); + val &=3D ~(VC4_HDMI_CEC_TX_SW_RESET | VC4_HDMI_CEC_RX_SW_RESET | + VC4_HDMI_CEC_CNT_TO_4700_US_MASK | + VC4_HDMI_CEC_CNT_TO_4500_US_MASK); + val |=3D ((4700 / usecs) << VC4_HDMI_CEC_CNT_TO_4700_US_SHIFT) | + ((4500 / usecs) << VC4_HDMI_CEC_CNT_TO_4500_US_SHIFT); =20 - if (enable) { HDMI_WRITE(HDMI_CEC_CNTRL_5, val | VC4_HDMI_CEC_TX_SW_RESET | VC4_HDMI_CEC_RX_SW_RESET); HDMI_WRITE(HDMI_CEC_CNTRL_5, val); @@ -1778,7 +1778,10 @@ static int vc4_hdmi_cec_adap_enable(stru HDMI_WRITE(HDMI_CEC_CPU_MASK_SET, VC4_HDMI_CPU_CEC); HDMI_WRITE(HDMI_CEC_CNTRL_5, val | VC4_HDMI_CEC_TX_SW_RESET | VC4_HDMI_CEC_RX_SW_RESET); + + pm_runtime_put(&vc4_hdmi->pdev->dev); } + return 0; } =20 @@ -1889,8 +1892,6 @@ static int vc4_hdmi_cec_init(struct vc4_ if (ret < 0) goto err_remove_handlers; =20 - pm_runtime_put(&vc4_hdmi->pdev->dev); - return 0; =20 err_remove_handlers: From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8433DC433EF for ; Fri, 4 Feb 2022 09:28:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353142AbiBDJ2M (ORCPT ); Fri, 4 Feb 2022 04:28:12 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53094 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357659AbiBDJ0G (ORCPT ); Fri, 4 Feb 2022 04:26:06 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 96446B836F8; Fri, 4 Feb 2022 09:26:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CA43FC004E1; Fri, 4 Feb 2022 09:26:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966764; bh=aWaycIVeAhO1p4ZgtcI+rJ4obhF3IJc4kVHZVcCnsLU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pqI4KgdGHNaBBlrGyX9Me+BAeZ0HckijPy8Z2Kq9DLvfbJ1PPj0aZf5chzKubKzPk sPbjI3+9xr1myqwxoTXetaQbVTPr77IXii15OfwLpL2/7jGKMYXkmde7+O3qcgG9k0 4L0kiWvxTCmL1hVEmkKFoGRRUh7gzJgqSZwZ4OdI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tabitha Sable , "Eric W. Biederman" , Tejun Heo Subject: [PATCH 5.16 06/43] cgroup-v1: Require capabilities to set release_agent Date: Fri, 4 Feb 2022 10:22:13 +0100 Message-Id: <20220204091917.394618030@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric W. Biederman commit 24f6008564183aa120d07c03d9289519c2fe02af upstream. The cgroup release_agent is called with call_usermodehelper. The function call_usermodehelper starts the release_agent with a full set fo capabilitie= s. Therefore require capabilities when setting the release_agaent. Reported-by: Tabitha Sable Tested-by: Tabitha Sable Fixes: 81a6a5cdd2c5 ("Task Control Groups: automatic userspace notification= of idle cgroups") Cc: stable@vger.kernel.org # v2.6.24+ Signed-off-by: "Eric W. Biederman" Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- kernel/cgroup/cgroup-v1.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -549,6 +549,14 @@ static ssize_t cgroup_release_agent_writ =20 BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX); =20 + /* + * Release agent gets called with all capabilities, + * require capabilities to set release agent. + */ + if ((of->file->f_cred->user_ns !=3D &init_user_ns) || + !capable(CAP_SYS_ADMIN)) + return -EPERM; + cgrp =3D cgroup_kn_lock_live(of->kn, false); if (!cgrp) return -ENODEV; @@ -954,6 +962,12 @@ int cgroup1_parse_param(struct fs_contex /* Specifying two release agents is forbidden */ if (ctx->release_agent) return invalfc(fc, "release_agent respecified"); + /* + * Release agent gets called with all capabilities, + * require capabilities to set release agent. + */ + if ((fc->user_ns !=3D &init_user_ns) || !capable(CAP_SYS_ADMIN)) + return invalfc(fc, "Setting release_agent not allowed"); ctx->release_agent =3D param->string; param->string =3D NULL; break; From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93796C433FE for ; Fri, 4 Feb 2022 09:28:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358484AbiBDJ2H (ORCPT ); Fri, 4 Feb 2022 04:28:07 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53900 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358238AbiBDJ0K (ORCPT ); Fri, 4 Feb 2022 04:26:10 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 24376B836EB; Fri, 4 Feb 2022 09:26:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E05E8C004E1; Fri, 4 Feb 2022 09:26:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966767; bh=LmrbcHvcX9oIGN9xKCE/bc6nuizkuV8gy2HnJpudulg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=un7xrTQIsoTTwbz29bbDHaVGSMvGPuTaLhPUhcOAAMD4y05/4QxFOFFuETLthf+Cb jQ99247yl3RpbIq27MYa4elVdKUy/A9SZKJUMO8I0Y5VNEYJILVPJLUkPSv1tPE/iY Q+wwbCw2tUq8KQovaOx8R53SdGkMLAlSyJIIzJNA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christoph Hellwig , Minchan Kim , Matthew Wilcox , Christian Borntraeger , Heiko Carstens , Vasily Gorbik , John Hubbard , Linus Torvalds , Will McVicker Subject: [PATCH 5.16 07/43] Revert "mm/gup: small refactoring: simplify try_grab_page()" Date: Fri, 4 Feb 2022 10:22:14 +0100 Message-Id: <20220204091917.424405756@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: John Hubbard commit c36c04c2e132fc39f6b658bf607aed4425427fd7 upstream. This reverts commit 54d516b1d62ff8f17cee2da06e5e4706a0d00b8a That commit did a refactoring that effectively combined fast and slow gup paths (again). And that was again incorrect, for two reasons: a) Fast gup and slow gup get reference counts on pages in different ways and with different goals: see Linus' writeup in commit cd1adf1b63a1 ("Revert "mm/gup: remove try_get_page(), call try_get_compound_head() directly""), and b) try_grab_compound_head() also has a specific check for "FOLL_LONGTERM && !is_pinned(page)", that assumes that the caller can fall back to slow gup. This resulted in new failures, as recently report by Will McVicker [1]. But (a) has problems too, even though they may not have been reported yet. So just revert this. Link: https://lore.kernel.org/r/20220131203504.3458775-1-willmcvicker@googl= e.com [1] Fixes: 54d516b1d62f ("mm/gup: small refactoring: simplify try_grab_page()") Reported-and-tested-by: Will McVicker Cc: Christoph Hellwig Cc: Minchan Kim Cc: Matthew Wilcox Cc: Christian Borntraeger Cc: Heiko Carstens Cc: Vasily Gorbik Cc: stable@vger.kernel.org # 5.15 Signed-off-by: John Hubbard Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- mm/gup.c | 35 ++++++++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-) --- a/mm/gup.c +++ b/mm/gup.c @@ -124,8 +124,8 @@ static inline struct page *try_get_compo * considered failure, and furthermore, a likely bug in the caller, so a w= arning * is also emitted. */ -struct page *try_grab_compound_head(struct page *page, - int refs, unsigned int flags) +__maybe_unused struct page *try_grab_compound_head(struct page *page, + int refs, unsigned int flags) { if (flags & FOLL_GET) return try_get_compound_head(page, refs); @@ -208,10 +208,35 @@ static void put_compound_head(struct pag */ bool __must_check try_grab_page(struct page *page, unsigned int flags) { - if (!(flags & (FOLL_GET | FOLL_PIN))) - return true; + WARN_ON_ONCE((flags & (FOLL_GET | FOLL_PIN)) =3D=3D (FOLL_GET | FOLL_PIN)= ); =20 - return try_grab_compound_head(page, 1, flags); + if (flags & FOLL_GET) + return try_get_page(page); + else if (flags & FOLL_PIN) { + int refs =3D 1; + + page =3D compound_head(page); + + if (WARN_ON_ONCE(page_ref_count(page) <=3D 0)) + return false; + + if (hpage_pincount_available(page)) + hpage_pincount_add(page, 1); + else + refs =3D GUP_PIN_COUNTING_BIAS; + + /* + * Similar to try_grab_compound_head(): even if using the + * hpage_pincount_add/_sub() routines, be sure to + * *also* increment the normal page refcount field at least + * once, so that the page really is pinned. + */ + page_ref_add(page, refs); + + mod_node_page_state(page_pgdat(page), NR_FOLL_PIN_ACQUIRED, 1); + } + + return true; } =20 /** From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 834E1C433F5 for ; Fri, 4 Feb 2022 09:28:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358325AbiBDJ2L (ORCPT ); Fri, 4 Feb 2022 04:28:11 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53970 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358249AbiBDJ0N (ORCPT ); Fri, 4 Feb 2022 04:26:13 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5A89EB836BA; Fri, 4 Feb 2022 09:26:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8FA71C004E1; Fri, 4 Feb 2022 09:26:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966771; bh=VXbeeVkNkzOG24jf0vx5BOfcM06+BBpyEMjPdjTt5Ks=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WacFyFc0Vh4WEi/m0Yl6Mx01MfVscyDRuAXDLnEHHignW2Mk8qmDBOR2M/o0DT33J 4VjyaTtD7F/QqhnebnnpHMA7GCi9T4eBOidAycui3ImiEsTmzIkRQgoe9EanbcHqq1 cusEfLM3P7QqBk5KgOVhpqnle3biDgOMLHHsrsFQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan McDowell , "Russell King (Oracle)" , "David S. Miller" Subject: [PATCH 5.16 08/43] net: phy: Fix qca8081 with speeds lower than 2.5Gb/s Date: Fri, 4 Feb 2022 10:22:15 +0100 Message-Id: <20220204091917.455414849@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jonathan McDowell commit 881cc731df6af99a21622e9be25a23b81adcd10b upstream. A typo in qca808x_read_status means we try to set SMII mode on the port rather than SGMII when the link speed is not 2.5Gb/s. This results in no traffic due to the mismatch in configuration between the phy and the mac. v2: Only change interface mode when the link is up Fixes: 79c7bc0521545 ("net: phy: add qca8081 read_status") Cc: stable@vger.kernel.org Signed-off-by: Jonathan McDowell Reviewed-by: Russell King (Oracle) Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/phy/at803x.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) --- a/drivers/net/phy/at803x.c +++ b/drivers/net/phy/at803x.c @@ -1688,19 +1688,19 @@ static int qca808x_read_status(struct ph if (ret < 0) return ret; =20 - if (phydev->link && phydev->speed =3D=3D SPEED_2500) - phydev->interface =3D PHY_INTERFACE_MODE_2500BASEX; - else - phydev->interface =3D PHY_INTERFACE_MODE_SMII; - - /* generate seed as a lower random value to make PHY linked as SLAVE easi= ly, - * except for master/slave configuration fault detected. - * the reason for not putting this code into the function link_change_not= ify is - * the corner case where the link partner is also the qca8081 PHY and the= seed - * value is configured as the same value, the link can't be up and no lin= k change - * occurs. - */ - if (!phydev->link) { + if (phydev->link) { + if (phydev->speed =3D=3D SPEED_2500) + phydev->interface =3D PHY_INTERFACE_MODE_2500BASEX; + else + phydev->interface =3D PHY_INTERFACE_MODE_SGMII; + } else { + /* generate seed as a lower random value to make PHY linked as SLAVE eas= ily, + * except for master/slave configuration fault detected. + * the reason for not putting this code into the function link_change_no= tify is + * the corner case where the link partner is also the qca8081 PHY and th= e seed + * value is configured as the same value, the link can't be up and no li= nk change + * occurs. + */ if (phydev->master_slave_state =3D=3D MASTER_SLAVE_STATE_ERR) { qca808x_phy_ms_seed_enable(phydev, false); } else { From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4D6BC433EF for ; Fri, 4 Feb 2022 09:28:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358522AbiBDJ2b (ORCPT ); Fri, 4 Feb 2022 04:28:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33268 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357793AbiBDJ0u (ORCPT ); Fri, 4 Feb 2022 04:26:50 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4968CC0613F5; Fri, 4 Feb 2022 01:26:15 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DAF24612C8; Fri, 4 Feb 2022 09:26:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A0A91C004E1; Fri, 4 Feb 2022 09:26:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966774; bh=uIOOkmegQVgIMxeGdS22TVAxE7p78mJf/iAIGcpiIjA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QT7myqCGhsYbHyy1wX9z6CF5JZxNJJy442uQ+9vtCflHl+9AxtkgqymuD04QThO0c P2HovkhhBRvm2uzzmNaK+TOi4KEFDOFt2ca0Vw3KemDNNIaglauWuHb/gJLfX3VDMl PNR67c0bMKiof2SbkkS6LJuAYHJPHgDhckz4lZPI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christoph Fritz , Miklos Szeredi Subject: [PATCH 5.16 09/43] ovl: dont fail copy up if no fileattr support on upper Date: Fri, 4 Feb 2022 10:22:16 +0100 Message-Id: <20220204091917.486977077@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miklos Szeredi commit 94fd19752b28aa66c98e7991734af91dfc529f8f upstream. Christoph Fritz is reporting that failure to copy up fileattr when upper doesn't support fileattr or xattr results in a regression. Return success in these failure cases; this reverts overlayfs to the old behavior. Add a pr_warn_once() in these cases to still let the user know about the copy up failures. Reported-by: Christoph Fritz Fixes: 72db82115d2b ("ovl: copy up sync/noatime fileattr flags") Cc: # v5.15 Signed-off-by: Miklos Szeredi Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- fs/overlayfs/copy_up.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) --- a/fs/overlayfs/copy_up.c +++ b/fs/overlayfs/copy_up.c @@ -157,7 +157,9 @@ static int ovl_copy_fileattr(struct inod */ if (oldfa.flags & OVL_PROT_FS_FLAGS_MASK) { err =3D ovl_set_protattr(inode, new->dentry, &oldfa); - if (err) + if (err =3D=3D -EPERM) + pr_warn_once("copying fileattr: no xattr on upper\n"); + else if (err) return err; } =20 @@ -167,6 +169,14 @@ static int ovl_copy_fileattr(struct inod =20 err =3D ovl_real_fileattr_get(new, &newfa); if (err) { + /* + * Returning an error if upper doesn't support fileattr will + * result in a regression, so revert to the old behavior. + */ + if (err =3D=3D -ENOTTY || err =3D=3D -EINVAL) { + pr_warn_once("copying fileattr: no support on upper\n"); + return 0; + } pr_warn("failed to retrieve upper fileattr (%pd2, err=3D%i)\n", new, err); return err; From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65000C433F5 for ; Fri, 4 Feb 2022 09:26:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358341AbiBDJ0d (ORCPT ); Fri, 4 Feb 2022 04:26:33 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53094 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357444AbiBDJYz (ORCPT ); Fri, 4 Feb 2022 04:24:55 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DE7B2B836BA; Fri, 4 Feb 2022 09:24:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43018C340ED; Fri, 4 Feb 2022 09:24:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966693; bh=b1aaZmEkpsr6AC1Fgfj2kfSj0T+Vlhtiyi8ifmsfxa4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nQeq4bHp4hfBT7j5y1podpH1K9kCTBC07gBb2QMN4yPa74P+qgpFp0Ke1EdBk0EKo issUMJjs1YjRUuPJCuZW2QixJk4uvfWXrSQoHmM3rCgEIvXaxQpZCrde5YrTD5vc3r 5ZkTCZBKvap/4jy7mKhEM/jEI+3afghpltxpyPVg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Woithe , "J. Bruce Fields" , Chuck Lever Subject: [PATCH 5.16 10/43] lockd: fix server crash on reboot of client holding lock Date: Fri, 4 Feb 2022 10:22:17 +0100 Message-Id: <20220204091917.516571154@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: J. Bruce Fields commit 6e7f90d163afa8fc2efd6ae318e7c20156a5621f upstream. I thought I was iterating over the array when actually the iteration is over the values contained in the array? Ugh, keep it simple. Symptoms were a null deference in vfs_lock_file() when an NFSv3 client that previously held a lock came back up and sent a notify. Reported-by: Jonathan Woithe Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") Signed-off-by: J. Bruce Fields Signed-off-by: Chuck Lever Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- fs/lockd/svcsubs.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) --- a/fs/lockd/svcsubs.c +++ b/fs/lockd/svcsubs.c @@ -179,19 +179,20 @@ nlm_delete_file(struct nlm_file *file) static int nlm_unlock_files(struct nlm_file *file) { struct file_lock lock; - struct file *f; =20 lock.fl_type =3D F_UNLCK; lock.fl_start =3D 0; lock.fl_end =3D OFFSET_MAX; - for (f =3D file->f_file[0]; f <=3D file->f_file[1]; f++) { - if (f && vfs_lock_file(f, F_SETLK, &lock, NULL) < 0) { - pr_warn("lockd: unlock failure in %s:%d\n", - __FILE__, __LINE__); - return 1; - } - } + if (file->f_file[O_RDONLY] && + vfs_lock_file(file->f_file[O_RDONLY], F_SETLK, &lock, NULL)) + goto out_err; + if (file->f_file[O_WRONLY] && + vfs_lock_file(file->f_file[O_WRONLY], F_SETLK, &lock, NULL)) + goto out_err; return 0; +out_err: + pr_warn("lockd: unlock failure in %s:%d\n", __FILE__, __LINE__); + return 1; } =20 /* From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59E74C433FE for ; Fri, 4 Feb 2022 09:26:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357990AbiBDJ0h (ORCPT ); Fri, 4 Feb 2022 04:26:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33458 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357979AbiBDJY7 (ORCPT ); Fri, 4 Feb 2022 04:24:59 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5CA65C06173D; Fri, 4 Feb 2022 01:24:59 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 299C4B836F3; Fri, 4 Feb 2022 09:24:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 54167C004E1; Fri, 4 Feb 2022 09:24:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966697; bh=tTUbBlWGxGlAA/M3iRfxvQhYj3pYTSvQpKE+09KRzqE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KvnL2MEPwtFGcuvkPgqgW91Rx4YkzWvVyHv6DR2QjpH8a8+JDJBczYInsIWEXojvz nhWxu3kGLmSF06ugtRvtW4rsisTJI8qH1t8Bad1+LkduGDJYktMS40o7s9NIL8HI8Y Vy8e4DYHJFd1sjtlYdrpa4biVZVdtx8X08T9P2Go= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "J. Bruce Fields" , Chuck Lever Subject: [PATCH 5.16 11/43] lockd: fix failure to cleanup client locks Date: Fri, 4 Feb 2022 10:22:18 +0100 Message-Id: <20220204091917.547635687@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: J. Bruce Fields commit d19a7af73b5ecaac8168712d18be72b9db166768 upstream. In my testing, we're sometimes hitting the request->fl_flags & FL_EXISTS case in posix_lock_inode, presumably just by random luck since we're not actually initializing fl_flags here. This probably didn't matter before commit 7f024fcd5c97 ("Keep read and write fds with each nlm_file") since we wouldn't previously unlock unless we knew there were locks. But now it causes lockd to give up on removing more locks. We could just initialize fl_flags, but really it seems dubious to be calling vfs_lock_file with random values in some of the fields. Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") Signed-off-by: J. Bruce Fields [ cel: fixed checkpatch.pl nit ] Signed-off-by: Chuck Lever Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- fs/lockd/svcsubs.c | 1 + 1 file changed, 1 insertion(+) --- a/fs/lockd/svcsubs.c +++ b/fs/lockd/svcsubs.c @@ -180,6 +180,7 @@ static int nlm_unlock_files(struct nlm_f { struct file_lock lock; =20 + locks_init_lock(&lock); lock.fl_type =3D F_UNLCK; lock.fl_start =3D 0; lock.fl_end =3D OFFSET_MAX; From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 371EFC433F5 for ; Fri, 4 Feb 2022 09:26:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358367AbiBDJ0l (ORCPT ); Fri, 4 Feb 2022 04:26:41 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44088 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357988AbiBDJZB (ORCPT ); Fri, 4 Feb 2022 04:25:01 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EA6A9615C6; Fri, 4 Feb 2022 09:25:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B31F7C004E1; Fri, 4 Feb 2022 09:24:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966700; bh=DK7KqKjGWNf9gjmFefzafwrONuqBU3cBkmhqoOB/3bM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FJI3PPvYoc0BblEHXnwBY0jGzG2fumi+CK7JARehOoQn0l2JEeEUxoBzaTE07KpUU IyAtuSuYBte899YJ338lUzUUYgzzH80NAT7wo1H9z8DzuQwL/PG3GK9kHGTJTvVKxS iBzWEptCgOxhE+t+MOe+/qQ+36qgZTfQ1KTtul2g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Raed Salem , Maor Dickman , Saeed Mahameed Subject: [PATCH 5.16 12/43] net/mlx5e: IPsec: Fix crypto offload for non TCP/UDP encapsulated traffic Date: Fri, 4 Feb 2022 10:22:19 +0100 Message-Id: <20220204091917.581050256@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Raed Salem commit 5352859b3bfa0ca188b2f1d2c1436fddc781e3b6 upstream. IPsec crypto offload always set the ethernet segment checksum flags with the inner L4 header checksum flag enabled for encapsulated IPsec offloaded packet regardless of the encapsulated L4 header type, and even if it doesn't exists in the first place, this breaks non TCP/UDP traffic as such. Set the inner L4 checksum flag only when the encapsulated L4 header protocol is TCP/UDP using software parser swp_inner_l4_offset field as indication. Fixes: 5cfb540ef27b ("net/mlx5e: Set IPsec WAs only in IP's non checksum pa= rtial case.") Signed-off-by: Raed Salem Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h | 9 +++++= +--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h @@ -131,14 +131,17 @@ static inline bool mlx5e_ipsec_txwqe_build_eseg_csum(struct mlx5e_txqsq *sq, struct sk_buff *= skb, struct mlx5_wqe_eth_seg *eseg) { - struct xfrm_offload *xo =3D xfrm_offload(skb); + u8 inner_ipproto; =20 if (!mlx5e_ipsec_eseg_meta(eseg)) return false; =20 eseg->cs_flags =3D MLX5_ETH_WQE_L3_CSUM; - if (xo->inner_ipproto) { - eseg->cs_flags |=3D MLX5_ETH_WQE_L4_INNER_CSUM | MLX5_ETH_WQE_L3_INNER_C= SUM; + inner_ipproto =3D xfrm_offload(skb)->inner_ipproto; + if (inner_ipproto) { + eseg->cs_flags |=3D MLX5_ETH_WQE_L3_INNER_CSUM; + if (inner_ipproto =3D=3D IPPROTO_TCP || inner_ipproto =3D=3D IPPROTO_UDP) + eseg->cs_flags |=3D MLX5_ETH_WQE_L4_INNER_CSUM; } else if (likely(skb->ip_summed =3D=3D CHECKSUM_PARTIAL)) { eseg->cs_flags |=3D MLX5_ETH_WQE_L4_CSUM; sq->stats->csum_partial_inner++; From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63D06C433F5 for ; Fri, 4 Feb 2022 09:26:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358053AbiBDJ0s (ORCPT ); Fri, 4 Feb 2022 04:26:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33240 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358022AbiBDJZH (ORCPT ); Fri, 4 Feb 2022 04:25:07 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E17FCC061794; Fri, 4 Feb 2022 01:25:04 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5889B616AD; Fri, 4 Feb 2022 09:25:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 32D19C004E1; Fri, 4 Feb 2022 09:25:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966703; bh=Fek5eS//BUxZXWLl1ZZY4p+FXu9Z0HSyHuyF3HerRxM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NLrXYu1Qd/Qtn0wQ0+dDN94jwSdWnSEYSTOuOHvxKDSgKTRpIbQfrUAD3HWBFbmGS G+SHAsd0tV3kUv2g1KPA2u5MK7WwRXGNyQXe4zHHfMPcQ1+u51Wo5Ojzcb1gwR4K+m xgo7mXv+Zzgqc/tPQE9Wn5xjv9IlCNAk7k9Wa/UM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Raed Salem , Maor Dickman , Saeed Mahameed Subject: [PATCH 5.16 13/43] net/mlx5e: IPsec: Fix tunnel mode crypto offload for non TCP/UDP traffic Date: Fri, 4 Feb 2022 10:22:20 +0100 Message-Id: <20220204091917.611942479@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Raed Salem commit de47db0cf7f4a9c555ad204e06baa70b50a70d08 upstream. IPsec Tunnel mode crypto offload software parser (SWP) setting in data path currently always set the inner L4 offset regardless of the encapsulated L4 header type and whether it exists in the first place, this breaks non TCP/UDP traffic as such. Set the SWP inner L4 offset only when the IPsec tunnel encapsulated L4 header protocol is TCP/UDP. While at it fix inner ip protocol read for setting MLX5_ETH_WQE_SWP_INNER_L= 4_UDP flag to address the case where the ip header protocol is IPv6. Fixes: f1267798c980 ("net/mlx5: Fix checksum issue of VXLAN and IPsec crypt= o offload") Signed-off-by: Raed Salem Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c | 13 +++++= +++-- 1 file changed, 11 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c @@ -157,11 +157,20 @@ static void mlx5e_ipsec_set_swp(struct s /* Tunnel mode */ if (mode =3D=3D XFRM_MODE_TUNNEL) { eseg->swp_inner_l3_offset =3D skb_inner_network_offset(skb) / 2; - eseg->swp_inner_l4_offset =3D skb_inner_transport_offset(skb) / 2; if (xo->proto =3D=3D IPPROTO_IPV6) eseg->swp_flags |=3D MLX5_ETH_WQE_SWP_INNER_L3_IPV6; - if (inner_ip_hdr(skb)->protocol =3D=3D IPPROTO_UDP) + + switch (xo->inner_ipproto) { + case IPPROTO_UDP: eseg->swp_flags |=3D MLX5_ETH_WQE_SWP_INNER_L4_UDP; + fallthrough; + case IPPROTO_TCP: + /* IP | ESP | IP | [TCP | UDP] */ + eseg->swp_inner_l4_offset =3D skb_inner_transport_offset(skb) / 2; + break; + default: + break; + } return; } =20 From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4ADFEC433EF for ; Fri, 4 Feb 2022 09:26:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357817AbiBDJ0w (ORCPT ); Fri, 4 Feb 2022 04:26:52 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44172 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358018AbiBDJZH (ORCPT ); Fri, 4 Feb 2022 04:25:07 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 699CE61602; Fri, 4 Feb 2022 09:25:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3FCD1C004E1; Fri, 4 Feb 2022 09:25:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966706; bh=IjJK+yt4eIiTBKn6aNSapd1Q6Hm6qu7JqEQZHEp0YE4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mX+0bp28MhjmSqfvUbSDVzGMkx+17EKIQ/9zvPiWHsGemwxjBxneVEQ5CDFGr0f/A tQTU9a+UkTj3U9yTQurZziVHos2KhtOFdBBsg2kkHzZnYOruSn8TZ6XsLpC3pYDF81 CCtSbjbctSRScH/gvJNszpkH+pOxlrfNu1o0QLmA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Roi Dayan , Oz Shlomo , Maor Dickman , Saeed Mahameed Subject: [PATCH 5.16 14/43] net/mlx5e: TC, Reject rules with drop and modify hdr action Date: Fri, 4 Feb 2022 10:22:21 +0100 Message-Id: <20220204091917.640709686@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Roi Dayan commit a2446bc77a16cefd27de712d28af2396d6287593 upstream. This kind of action is not supported by firmware and generates a syndrome. kernel: mlx5_core 0000:08:00.0: mlx5_cmd_check:777:(pid 102063): SET_FLOW_T= ABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (= 0x8708c3) Fixes: d7e75a325cb2 ("net/mlx5e: Add offloading of E-Switch TC pedit (heade= r re-write) actions") Signed-off-by: Roi Dayan Reviewed-by: Oz Shlomo Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c @@ -3421,6 +3421,12 @@ actions_match_supported(struct mlx5e_pri } =20 if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR && + actions & MLX5_FLOW_CONTEXT_ACTION_DROP) { + NL_SET_ERR_MSG_MOD(extack, "Drop with modify header action is not suppor= ted"); + return false; + } + + if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR && !modify_header_match_supported(priv, &parse_attr->spec, flow_action, actions, ct_flow, ct_clear, extack)) return false; From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C53BC433F5 for ; Fri, 4 Feb 2022 09:26:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358050AbiBDJ04 (ORCPT ); Fri, 4 Feb 2022 04:26:56 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33272 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357814AbiBDJZQ (ORCPT ); Fri, 4 Feb 2022 04:25:16 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EE32AC06179A; Fri, 4 Feb 2022 01:25:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B510DB836EA; Fri, 4 Feb 2022 09:25:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D2DFDC340ED; Fri, 4 Feb 2022 09:25:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966710; bh=cfGFlp6WAh3LnMrlS0mOtd1wQC6TsEz1/aLmCXcU//8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YAqbNCMXXW8fEQK9MJyhJpc4R0fOXh+kTrfR5GLc560G3B6o6hVq6/4slTZaQkIE7 OO1d+4AXQdoyiwG+r/cBxuW+pnI88BDsi22uhO3kt0ZGDZsTbRJsOLOtbPNt7bt//X wQUzIsAYqUlZtGN3YR32RlhwxVXliaG8/Tbk4L3U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vlad Buslov , Roi Dayan , Saeed Mahameed Subject: [PATCH 5.16 15/43] net/mlx5: Bridge, take rtnl lock in init error handler Date: Fri, 4 Feb 2022 10:22:22 +0100 Message-Id: <20220204091917.676810417@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vlad Buslov commit 04f8c12f031fcd0ffa0c72822eb665ceb2c872e7 upstream. The mlx5_esw_bridge_cleanup() is expected to be called with rtnl lock taken, which is true for mlx5e_rep_bridge_cleanup() function but not for error handling code in mlx5e_rep_bridge_init(). Add missing rtnl lock/unlock calls and extend both mlx5_esw_bridge_cleanup() and its dual function mlx5_esw_bridge_init() with ASSERT_RTNL() to verify the invariant from now on. Fixes: 7cd6a54a8285 ("net/mlx5: Bridge, handle FDB events") Fixes: 19e9bfa044f3 ("net/mlx5: Bridge, add offload infrastructure") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c | 2 ++ drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c | 4 ++++ 2 files changed, 6 insertions(+) --- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c @@ -509,7 +509,9 @@ err_register_swdev_blk: err_register_swdev: destroy_workqueue(br_offloads->wq); err_alloc_wq: + rtnl_lock(); mlx5_esw_bridge_cleanup(esw); + rtnl_unlock(); } =20 void mlx5e_rep_bridge_cleanup(struct mlx5e_priv *priv) --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c @@ -1574,6 +1574,8 @@ struct mlx5_esw_bridge_offloads *mlx5_es { struct mlx5_esw_bridge_offloads *br_offloads; =20 + ASSERT_RTNL(); + br_offloads =3D kvzalloc(sizeof(*br_offloads), GFP_KERNEL); if (!br_offloads) return ERR_PTR(-ENOMEM); @@ -1590,6 +1592,8 @@ void mlx5_esw_bridge_cleanup(struct mlx5 { struct mlx5_esw_bridge_offloads *br_offloads =3D esw->br_offloads; =20 + ASSERT_RTNL(); + if (!br_offloads) return; =20 From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 12E4EC433EF for ; Fri, 4 Feb 2022 09:26:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358036AbiBDJ0y (ORCPT ); Fri, 4 Feb 2022 04:26:54 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44274 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358064AbiBDJZO (ORCPT ); Fri, 4 Feb 2022 04:25:14 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 127C2616AD; Fri, 4 Feb 2022 09:25:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CC4C7C340EF; Fri, 4 Feb 2022 09:25:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966713; bh=VXigYRW5rsIpfXUUUjWJOkU9kJ0Hj9Zg+9vR2xZfuw4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bkgEl2eBdIG4UQDyThh44QNFP3GQQwFI2QJC+McG567JHQdTbfApgtrvBsU0XAAud D25yX6e7ji6ZGbthPC7qBzSd8BLxLWme0v+B2RuyjI0xZAZY/xjA8yz4cxskADjrk5 MB7XuF33aPkCWG3k9qPihT2W64eUyrOcMgWTRUI8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Vlad Buslov , Roi Dayan , Saeed Mahameed Subject: [PATCH 5.16 16/43] net/mlx5: Bridge, ensure dev_name is null-terminated Date: Fri, 4 Feb 2022 10:22:23 +0100 Message-Id: <20220204091917.705724162@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vlad Buslov commit 350d9a823734b5a7e767cddc3bdde5f0bcbb7ff4 upstream. Even though net_device->name is guaranteed to be null-terminated string of size<=3DIFNAMSIZ, the test robot complains that return value of netdev_name= () can be larger: In file included from include/trace/define_trace.h:102, from drivers/net/ethernet/mellanox/mlx5/core/esw/diag/b= ridge_tracepoint.h:113, from drivers/net/ethernet/mellanox/mlx5/core/esw/bridge= .c:12: drivers/net/ethernet/mellanox/mlx5/core/esw/diag/bridge_tracepoint.h: In= function 'trace_event_raw_event_mlx5_esw_bridge_fdb_template': >> drivers/net/ethernet/mellanox/mlx5/core/esw/diag/bridge_tracepoint.h:24:= 29: warning: 'strncpy' output may be truncated copying 16 bytes from a stri= ng of length 20 [-Wstringop-truncation] 24 | strncpy(__entry->dev_name, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ 25 | netdev_name(fdb->dev), | ~~~~~~~~~~~~~~~~~~~~~~ 26 | IFNAMSIZ); | ~~~~~~~~~ This is caused by the fact that default value of IFNAMSIZ is 16, while placeholder value that is returned by netdev_name() for unnamed net devices is larger than that. The offending code is in a tracing function that is only called for mlx5 representors, so there is no straightforward way to reproduce the issue but let's fix it for correctness sake by replacing strncpy() with strscpy() to ensure that resulting string is always null-terminated. Fixes: 9724fd5d9c2a ("net/mlx5: Bridge, add tracepoints") Reported-by: kernel test robot Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/esw/diag/bridge_tracepoint.h | = 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/diag/bridge_tracepoint.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/diag/bridge_tracepoint.h @@ -21,7 +21,7 @@ DECLARE_EVENT_CLASS(mlx5_esw_bridge_fdb_ __field(unsigned int, used) ), TP_fast_assign( - strncpy(__entry->dev_name, + strscpy(__entry->dev_name, netdev_name(fdb->dev), IFNAMSIZ); memcpy(__entry->addr, fdb->key.addr, ETH_ALEN); From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B12A7C433FE for ; Fri, 4 Feb 2022 09:27:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357682AbiBDJ1E (ORCPT ); Fri, 4 Feb 2022 04:27:04 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53354 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358092AbiBDJZS (ORCPT ); Fri, 4 Feb 2022 04:25:18 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CE969B836E9; Fri, 4 Feb 2022 09:25:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 034ABC004E1; Fri, 4 Feb 2022 09:25:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966716; bh=mXHryGW09fA1yrZtSbOXLAiQQeihs2gSPyR7qHrk/wI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mBr9pvfFc9PXFcbbmrH5ZkFl7dWaHDU4mRqlK3XwvxUKes/3303TSsmWwOwEBJKww xuKLKr0jQKYpR8LA3XBeVnog6O6asitK3D2LvYd0XpQ5Dl/60C3rYm10ni0CP6eB+4 BFmEZNkXQTcIKFn+9bIFYMoadF01q91YcF8mImcM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maor Dickman , Roi Dayan , Saeed Mahameed Subject: [PATCH 5.16 17/43] net/mlx5e: Fix handling of wrong devices during bond netevent Date: Fri, 4 Feb 2022 10:22:24 +0100 Message-Id: <20220204091917.741575256@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maor Dickman commit ec41332e02bd0acf1f24206867bb6a02f5877a62 upstream. Current implementation of bond netevent handler only check if the handled netdev is VF representor and it missing a check if the VF representor is on the same phys device of the bond handling the netevent. Fix by adding the missing check and optimizing the check if the netdev is VF representor so it will not access uninitialized private data and crashes. BUG: kernel NULL pointer dereference, address: 000000000000036c PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI Workqueue: eth3bond0 bond_mii_monitor [bonding] RIP: 0010:mlx5e_is_uplink_rep+0xc/0x50 [mlx5_core] RSP: 0018:ffff88812d69fd60 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8881cf800000 RCX: 0000000000000000 RDX: ffff88812d69fe10 RSI: 000000000000001b RDI: ffff8881cf800880 RBP: ffff8881cf800000 R08: 00000445cabccf2b R09: 0000000000000008 R10: 0000000000000004 R11: 0000000000000008 R12: ffff88812d69fe10 R13: 00000000fffffffe R14: ffff88820c0f9000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88846fb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000036c CR3: 0000000103d80006 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5e_eswitch_uplink_rep+0x31/0x40 [mlx5_core] mlx5e_rep_is_lag_netdev+0x94/0xc0 [mlx5_core] mlx5e_rep_esw_bond_netevent+0xeb/0x3d0 [mlx5_core] raw_notifier_call_chain+0x41/0x60 call_netdevice_notifiers_info+0x34/0x80 netdev_lower_state_changed+0x4e/0xa0 bond_mii_monitor+0x56b/0x640 [bonding] process_one_work+0x1b9/0x390 worker_thread+0x4d/0x3d0 ? rescuer_thread+0x350/0x350 kthread+0x124/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30 Fixes: 7e51891a237f ("net/mlx5e: Use netdev events to set/del egress acl fo= rward-to-vport rule") Signed-off-by: Maor Dickman Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c | 32 +++++++------= ----- 1 file changed, 14 insertions(+), 18 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c @@ -183,18 +183,7 @@ void mlx5e_rep_bond_unslave(struct mlx5_ =20 static bool mlx5e_rep_is_lag_netdev(struct net_device *netdev) { - struct mlx5e_rep_priv *rpriv; - struct mlx5e_priv *priv; - - /* A given netdev is not a representor or not a slave of LAG configuratio= n */ - if (!mlx5e_eswitch_rep(netdev) || !netif_is_lag_port(netdev)) - return false; - - priv =3D netdev_priv(netdev); - rpriv =3D priv->ppriv; - - /* Egress acl forward to vport is supported only non-uplink representor */ - return rpriv->rep->vport !=3D MLX5_VPORT_UPLINK; + return netif_is_lag_port(netdev) && mlx5e_eswitch_vf_rep(netdev); } =20 static void mlx5e_rep_changelowerstate_event(struct net_device *netdev, vo= id *ptr) @@ -210,9 +199,6 @@ static void mlx5e_rep_changelowerstate_e u16 fwd_vport_num; int err; =20 - if (!mlx5e_rep_is_lag_netdev(netdev)) - return; - info =3D ptr; lag_info =3D info->lower_state_info; /* This is not an event of a representor becoming active slave */ @@ -266,9 +252,6 @@ static void mlx5e_rep_changeupper_event( struct net_device *lag_dev; struct mlx5e_priv *priv; =20 - if (!mlx5e_rep_is_lag_netdev(netdev)) - return; - priv =3D netdev_priv(netdev); rpriv =3D priv->ppriv; lag_dev =3D info->upper_dev; @@ -293,6 +276,19 @@ static int mlx5e_rep_esw_bond_netevent(s unsigned long event, void *ptr) { struct net_device *netdev =3D netdev_notifier_info_to_dev(ptr); + struct mlx5e_rep_priv *rpriv; + struct mlx5e_rep_bond *bond; + struct mlx5e_priv *priv; + + if (!mlx5e_rep_is_lag_netdev(netdev)) + return NOTIFY_DONE; + + bond =3D container_of(nb, struct mlx5e_rep_bond, nb); + priv =3D netdev_priv(netdev); + rpriv =3D mlx5_eswitch_get_uplink_priv(priv->mdev->priv.eswitch, REP_ETH); + /* Verify VF representor is on the same device of the bond handling the n= etevent. */ + if (rpriv->uplink_priv.bond !=3D bond) + return NOTIFY_DONE; =20 switch (event) { case NETDEV_CHANGELOWERSTATE: From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8CFA0C433F5 for ; Fri, 4 Feb 2022 09:27:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239329AbiBDJ1K (ORCPT ); Fri, 4 Feb 2022 04:27:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33326 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357612AbiBDJZk (ORCPT ); Fri, 4 Feb 2022 04:25:40 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4F3CDC061775; Fri, 4 Feb 2022 01:25:22 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1C16CB836EF; Fri, 4 Feb 2022 09:25:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5338EC004E1; Fri, 4 Feb 2022 09:25:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966719; bh=e34DISovHSTcPO6u9ZxmHUgM4W5YT1b+Uh6wVUOy/V8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jUR0/ksgSSMrq5gp1YihrRvHXFrCz8beTUfdDPmELGuZuIj5ASRvgSG9BK/2MhpM8 bX+Vxzny83ytjZPUbMFCLMVBjW+LXZhvTbE8nVE1gMiNdL6bbDA3yAWjOACACPW+oC 05mf6lbpq2QSXm+qXWQ88il47KivLd3eSJelW4E8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maher Sanalla , Moshe Shemesh , Saeed Mahameed Subject: [PATCH 5.16 18/43] net/mlx5: Use del_timer_sync in fw reset flow of halting poll Date: Fri, 4 Feb 2022 10:22:25 +0100 Message-Id: <20220204091917.771006504@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maher Sanalla commit 3c5193a87b0fea090aa3f769d020337662d87b5e upstream. Substitute del_timer() with del_timer_sync() in fw reset polling deactivation flow, in order to prevent a race condition which occurs when del_timer() is called and timer is deactivated while another process is handling the timer interrupt. A situation that led to the following call trace: RIP: 0010:run_timer_softirq+0x137/0x420 recalibrate_cpu_khz+0x10/0x10 ktime_get+0x3e/0xa0 ? sched_clock_cpu+0xb/0xc0 __do_softirq+0xf5/0x2ea irq_exit_rcu+0xc1/0xf0 sysvec_apic_timer_interrupt+0x9e/0xc0 asm_sysvec_apic_timer_interrupt+0x12/0x20 Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event") Signed-off-by: Maher Sanalla Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c @@ -132,7 +132,7 @@ static void mlx5_stop_sync_reset_poll(st { struct mlx5_fw_reset *fw_reset =3D dev->priv.fw_reset; =20 - del_timer(&fw_reset->timer); + del_timer_sync(&fw_reset->timer); } =20 static void mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *de= v, bool poll_health) From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B342DC433EF for ; Fri, 4 Feb 2022 09:27:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357908AbiBDJ1S (ORCPT ); Fri, 4 Feb 2022 04:27:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33336 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358151AbiBDJZl (ORCPT ); Fri, 4 Feb 2022 04:25:41 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 19532C061778; Fri, 4 Feb 2022 01:25:24 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8B7D8615ED; Fri, 4 Feb 2022 09:25:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6D1E2C004E1; Fri, 4 Feb 2022 09:25:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966723; bh=5t6xZ8N2V27Dp728hG9yGXYaE7Em90wkdi7HfCFR3sA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=elXYgB5kxFPxZcsQUWZJtmVpKzB9jExgeVR66g9J3W+cuuzzTWwT9z3Qn/WEzyUsd Vgp1ijekZ9wmo2AZ62O/GIilnp2HajvIPiB4sPcFmtylFaFRQ4YI29YtLQsx8wBnnO JeO5dGuTI8aJoyoD6qxf7f7Gr3fy+7xcZMA09QDA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wang Yugui , Gal Pressman , Maxim Mikityanskiy , Saeed Mahameed Subject: [PATCH 5.16 19/43] net/mlx5e: Fix module EEPROM query Date: Fri, 4 Feb 2022 10:22:26 +0100 Message-Id: <20220204091917.800131327@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Gal Pressman commit 4a08a131351e375a2969b98e46df260ed04dcba7 upstream. When querying the module EEPROM, there was a misusage of the 'offset' variable vs the 'query.offset' field. Fix that by always using 'offset' and assigning its value to 'query.offset' right before the mcia register read call. While at it, the cross-pages read size adjustment was changed to be more intuitive. Fixes: e19b0a3474ab ("net/mlx5: Refactor module EEPROM query") Reported-by: Wang Yugui Signed-off-by: Gal Pressman Reviewed-by: Maxim Mikityanskiy Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/port.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/port.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c @@ -406,23 +406,24 @@ int mlx5_query_module_eeprom(struct mlx5 =20 switch (module_id) { case MLX5_MODULE_ID_SFP: - mlx5_sfp_eeprom_params_set(&query.i2c_address, &query.page, &query.offse= t); + mlx5_sfp_eeprom_params_set(&query.i2c_address, &query.page, &offset); break; case MLX5_MODULE_ID_QSFP: case MLX5_MODULE_ID_QSFP_PLUS: case MLX5_MODULE_ID_QSFP28: - mlx5_qsfp_eeprom_params_set(&query.i2c_address, &query.page, &query.offs= et); + mlx5_qsfp_eeprom_params_set(&query.i2c_address, &query.page, &offset); break; default: mlx5_core_err(dev, "Module ID not recognized: 0x%x\n", module_id); return -EINVAL; } =20 - if (query.offset + size > MLX5_EEPROM_PAGE_LENGTH) + if (offset + size > MLX5_EEPROM_PAGE_LENGTH) /* Cross pages read, read until offset 256 in low page */ - size -=3D offset + size - MLX5_EEPROM_PAGE_LENGTH; + size =3D MLX5_EEPROM_PAGE_LENGTH - offset; =20 query.size =3D size; + query.offset =3D offset; =20 return mlx5_query_mcia(dev, &query, data); } From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 17143C433FE for ; Fri, 4 Feb 2022 09:27:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357953AbiBDJ1a (ORCPT ); Fri, 4 Feb 2022 04:27:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33350 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357875AbiBDJZu (ORCPT ); Fri, 4 Feb 2022 04:25:50 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6CF80C0617A7; Fri, 4 Feb 2022 01:25:30 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D3098616D9; Fri, 4 Feb 2022 09:25:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ADA11C340ED; Fri, 4 Feb 2022 09:25:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966729; bh=ajtamET1XAUTRvLWbWJUsVal1vAqIubTQv05s4lp/40=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fZdgWdJ8fvHMayUzu8LnHrmY3SU5kjRkfRXaPuEqR9yGeJuh3a9Wk6cgrC7feP2RS O7F2HeVJRYaz9BWYSZKrdbiX/Jca9k9jrW1mLBod1ns5dhhDF6FRYf5x6PY309HYyb D3U+Z2HfMmEgCpMkVnh4nn0dl5fD0bEy4B4hh4DQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Roi Dayan , Oz Shlomo , Saeed Mahameed Subject: [PATCH 5.16 20/43] net/mlx5e: TC, Reject rules with forward and drop actions Date: Fri, 4 Feb 2022 10:22:27 +0100 Message-Id: <20220204091917.835596255@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Roi Dayan commit 5623ef8a118838aae65363750dfafcba734dc8cb upstream. Such rules are redundant but allowed and passed to the driver. The driver does not support offloading such rules so return an error. Fixes: 03a9d11e6eeb ("net/mlx5e: Add TC drop and mirred/redirect action par= sing for SRIOV offloads") Signed-off-by: Roi Dayan Reviewed-by: Oz Shlomo Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c @@ -3420,6 +3420,12 @@ actions_match_supported(struct mlx5e_pri return false; } =20 + if (!(~actions & + (MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_DROP)= )) { + NL_SET_ERR_MSG_MOD(extack, "Rule cannot support forward+drop action"); + return false; + } + if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR && actions & MLX5_FLOW_CONTEXT_ACTION_DROP) { NL_SET_ERR_MSG_MOD(extack, "Drop with modify header action is not suppor= ted"); From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 31C78C433EF for ; Fri, 4 Feb 2022 09:27:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231847AbiBDJ1e (ORCPT ); Fri, 4 Feb 2022 04:27:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33354 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358189AbiBDJZu (ORCPT ); Fri, 4 Feb 2022 04:25:50 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ECE65C0617A9; Fri, 4 Feb 2022 01:25:34 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B7623B836EF; Fri, 4 Feb 2022 09:25:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CB473C004E1; Fri, 4 Feb 2022 09:25:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966732; bh=4+7MceMecYWOvPMGIDx+1UxoxBhhhIlOqFjbf6KJEtc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=M9j+oPCRsZ7n11ForRQq040+9HwaxkTbSjzOwzXBbIbvmVdbul1w9+7m+I+pItSMV IwLqcI3V1iMyJU968gJPNQihCDHkU5bfpRtF8Za7ZGD1rk1evwgU0E6cauu+FM/2qy lAvzxfVS1GxRxDBvnjaR/p3doh5BarUN1nX3+zbU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dima Chumak , Roi Dayan , Saeed Mahameed Subject: [PATCH 5.16 21/43] net/mlx5: Fix offloading with ESWITCH_IPV4_TTL_MODIFY_ENABLE Date: Fri, 4 Feb 2022 10:22:28 +0100 Message-Id: <20220204091917.867657197@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dima Chumak commit 55b2ca702cfa744a9eb108915996a2294da47e71 upstream. Only prio 1 is supported for nic mode when there is no ignore flow level support in firmware. But for switchdev mode, which supports fixed number of statically pre-allocated prios, this restriction is not relevant so it can be relaxed. Fixes: d671e109bd85 ("net/mlx5: Fix tc max supported prio for nic mode") Signed-off-by: Dima Chumak Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c @@ -121,12 +121,13 @@ u32 mlx5_chains_get_nf_ft_chain(struct m =20 u32 mlx5_chains_get_prio_range(struct mlx5_fs_chains *chains) { - if (!mlx5_chains_prios_supported(chains)) - return 1; - if (mlx5_chains_ignore_flow_level_supported(chains)) return UINT_MAX; =20 + if (!chains->dev->priv.eswitch || + chains->dev->priv.eswitch->mode !=3D MLX5_ESWITCH_OFFLOADS) + return 1; + /* We should get here only for eswitch case */ return FDB_TC_MAX_PRIO; } From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C87CDC433EF for ; Fri, 4 Feb 2022 09:27:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358452AbiBDJ10 (ORCPT ); Fri, 4 Feb 2022 04:27:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33360 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358193AbiBDJZu (ORCPT ); Fri, 4 Feb 2022 04:25:50 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7324BC0617AA; Fri, 4 Feb 2022 01:25:36 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E75CB615DC; Fri, 4 Feb 2022 09:25:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C6A73C004E1; Fri, 4 Feb 2022 09:25:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966735; bh=kwu8oyxPXneCOK+dXVuehjtiF0UAtSc5LbFz+5t6RLQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=n8UKN91zEb0BizFocDNLkHdRENzV4POoXe3DKBmeLJBPD7PjvoNEfjk2WSYSaR5lj 7TfjTqs9OZzMNSVZ3yNq5CAAQvadcZRPadxEpaAxX4dwvQYjwEKFJsPWS8Th/djzSA F7JR9nDoPzk4Un4Wl5Nn3Dlx74AOC7i0r1H4epok= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maxim Mikityanskiy , Tariq Toukan , Saeed Mahameed Subject: [PATCH 5.16 22/43] net/mlx5e: Dont treat small ceil values as unlimited in HTB offload Date: Fri, 4 Feb 2022 10:22:29 +0100 Message-Id: <20220204091917.898015347@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maxim Mikityanskiy commit 736dfe4e68b868829a1e89dfef4a44c1580d4478 upstream. The hardware spec defines max_average_bw =3D=3D 0 as "unlimited bandwidth". max_average_bw is calculated as `ceil / BYTES_IN_MBIT`, which can become 0 when ceil is small, leading to an undesired effect of having no bandwidth limit. This commit fixes it by rounding up small values of ceil to 1 Mbit/s. Fixes: 214baf22870c ("net/mlx5e: Support HTB offload") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/en/qos.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c @@ -569,7 +569,8 @@ static int mlx5e_htb_convert_rate(struct =20 static void mlx5e_htb_convert_ceil(struct mlx5e_priv *priv, u64 ceil, u32 = *max_average_bw) { - *max_average_bw =3D div_u64(ceil, BYTES_IN_MBIT); + /* Hardware treats 0 as "unlimited", set at least 1. */ + *max_average_bw =3D max_t(u32, div_u64(ceil, BYTES_IN_MBIT), 1); =20 qos_dbg(priv->mdev, "Convert: ceil %llu -> max_average_bw %u\n", ceil, *max_average_bw); From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 57681C4332F for ; Fri, 4 Feb 2022 09:27:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358436AbiBDJ1Q (ORCPT ); Fri, 4 Feb 2022 04:27:16 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53538 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357808AbiBDJZl (ORCPT ); Fri, 4 Feb 2022 04:25:41 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AB0E0B836EF; Fri, 4 Feb 2022 09:25:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C8442C340EF; Fri, 4 Feb 2022 09:25:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966738; bh=i1By24VIoY2lC/wDQNa/L9E+AUs3H7fv9iax0aywOIY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=X8jWDtJSssEH5+1KqnHgZ3MIpLrsdinnI6tNdAYI31dmcGJcdOzfqV4+qN/q20+fj 0rDZzslNjzL4cO/GhreqlTvglLpSQRwpx3QcwQPoUzBldShgpkxxwXGPmrenIzwToW xK0xM9plw2kEHqlXUvcrgeokNd4AULgEpFA9f3Fg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Roi Dayan , Vlad Buslov , Saeed Mahameed Subject: [PATCH 5.16 23/43] net/mlx5: Bridge, Fix devlink deadlock on net namespace deletion Date: Fri, 4 Feb 2022 10:22:30 +0100 Message-Id: <20220204091917.928693824@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Roi Dayan commit 880b517691908fb753019b9b27cd082e7617debd upstream. When changing mode to switchdev, rep bridge init registered to netdevice notifier holds the devlink lock and then takes pernet_ops_rwsem. At that time deleting a netns holds pernet_ops_rwsem and then takes the devlink lock. Example sequence is: $ ip netns add foo $ devlink dev eswitch set pci/0000:00:08.0 mode switchdev & $ ip netns del foo deleting netns trace: [ 1185.365555] ? devlink_pernet_pre_exit+0x74/0x1c0 [ 1185.368331] ? mutex_lock_io_nested+0x13f0/0x13f0 [ 1185.370984] ? xt_find_table+0x40/0x100 [ 1185.373244] ? __mutex_lock+0x24a/0x15a0 [ 1185.375494] ? net_generic+0xa0/0x1c0 [ 1185.376844] ? wait_for_completion_io+0x280/0x280 [ 1185.377767] ? devlink_pernet_pre_exit+0x74/0x1c0 [ 1185.378686] devlink_pernet_pre_exit+0x74/0x1c0 [ 1185.379579] ? devlink_nl_cmd_get_dumpit+0x3a0/0x3a0 [ 1185.380557] ? xt_find_table+0xda/0x100 [ 1185.381367] cleanup_net+0x372/0x8e0 changing mode to switchdev trace: [ 1185.411267] down_write+0x13a/0x150 [ 1185.412029] ? down_write_killable+0x180/0x180 [ 1185.413005] register_netdevice_notifier+0x1e/0x210 [ 1185.414000] mlx5e_rep_bridge_init+0x181/0x360 [mlx5_core] [ 1185.415243] mlx5e_uplink_rep_enable+0x269/0x480 [mlx5_core] [ 1185.416464] ? mlx5e_uplink_rep_disable+0x210/0x210 [mlx5_core] [ 1185.417749] mlx5e_attach_netdev+0x232/0x400 [mlx5_core] [ 1185.418906] mlx5e_netdev_attach_profile+0x15b/0x1e0 [mlx5_core] [ 1185.420172] mlx5e_netdev_change_profile+0x15a/0x1d0 [mlx5_core] [ 1185.421459] mlx5e_vport_rep_load+0x557/0x780 [mlx5_core] [ 1185.422624] ? mlx5e_stats_grp_vport_rep_num_stats+0x10/0x10 [mlx5_core] [ 1185.424006] mlx5_esw_offloads_rep_load+0xdb/0x190 [mlx5_core] [ 1185.425277] esw_offloads_enable+0xd74/0x14a0 [mlx5_core] Fix this by registering rep bridges for per net netdev notifier instead of global one, which operats on the net namespace without holding the pernet_ops_rwsem. Fixes: 19e9bfa044f3 ("net/mlx5: Bridge, add offload infrastructure") Signed-off-by: Roi Dayan Reviewed-by: Vlad Buslov Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c @@ -491,7 +491,7 @@ void mlx5e_rep_bridge_init(struct mlx5e_ } =20 br_offloads->netdev_nb.notifier_call =3D mlx5_esw_bridge_switchdev_port_e= vent; - err =3D register_netdevice_notifier(&br_offloads->netdev_nb); + err =3D register_netdevice_notifier_net(&init_net, &br_offloads->netdev_n= b); if (err) { esw_warn(mdev, "Failed to register bridge offloads netdevice notifier (e= rr=3D%d)\n", err); @@ -526,7 +526,7 @@ void mlx5e_rep_bridge_cleanup(struct mlx return; =20 cancel_delayed_work_sync(&br_offloads->update_work); - unregister_netdevice_notifier(&br_offloads->netdev_nb); + unregister_netdevice_notifier_net(&init_net, &br_offloads->netdev_nb); unregister_switchdev_blocking_notifier(&br_offloads->nb_blk); unregister_switchdev_notifier(&br_offloads->nb); destroy_workqueue(br_offloads->wq); From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E910DC433EF for ; Fri, 4 Feb 2022 09:27:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358250AbiBDJ1w (ORCPT ); Fri, 4 Feb 2022 04:27:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33162 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358194AbiBDJZv (ORCPT ); Fri, 4 Feb 2022 04:25:51 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F0C1FC0617AE; Fri, 4 Feb 2022 01:25:43 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BACEFB836EB; Fri, 4 Feb 2022 09:25:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 19F8AC340ED; Fri, 4 Feb 2022 09:25:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966741; bh=F09xohPniosmms5Yvx/zW1dXETIz/aFauXOjkMDVrOE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Woe8oApd1ZUoCeySGUspKp83mWbLhuYEH4f53yZ7NGFKsywhxmiVHoKWyKpJDQctt YoCbPgC9eGb67q8yLKOrLxrgH42yZ1c/RlsOizJLrBRWBTFXsaO7Ow7MTURmohAz/X FnmtTnU04r9x6dIHEuBGz+iAmrZ1buhNzVH8HRRA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kees Cook , Saeed Mahameed Subject: [PATCH 5.16 24/43] net/mlx5e: Avoid field-overflowing memcpy() Date: Fri, 4 Feb 2022 10:22:31 +0100 Message-Id: <20220204091917.960946034@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kees Cook commit ad5185735f7dab342fdd0dd41044da4c9ccfef67 upstream. In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. Use flexible arrays instead of zero-element arrays (which look like they are always overflowing) and split the cross-field memcpy() into two halves that can be appropriately bounds-checked by the compiler. We were doing: #define ETH_HLEN 14 #define VLAN_HLEN 4 ... #define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN) ... struct mlx5e_tx_wqe *wqe =3D mlx5_wq_cyc_get_wqe(wq, pi); ... struct mlx5_wqe_eth_seg *eseg =3D &wqe->eth; struct mlx5_wqe_data_seg *dseg =3D wqe->data; ... memcpy(eseg->inline_hdr.start, xdptxd->data, MLX5E_XDP_MIN_INLINE); target is wqe->eth.inline_hdr.start (which the compiler sees as being 2 bytes in size), but copying 18, intending to write across start (really vlan_tci, 2 bytes). The remaining 16 bytes get written into wqe->data[0], covering byte_count (4 bytes), lkey (4 bytes), and addr (8 bytes). struct mlx5e_tx_wqe { struct mlx5_wqe_ctrl_seg ctrl; /* 0 16 */ struct mlx5_wqe_eth_seg eth; /* 16 16 */ struct mlx5_wqe_data_seg data[]; /* 32 0 */ /* size: 32, cachelines: 1, members: 3 */ /* last cacheline: 32 bytes */ }; struct mlx5_wqe_eth_seg { u8 swp_outer_l4_offset; /* 0 1 */ u8 swp_outer_l3_offset; /* 1 1 */ u8 swp_inner_l4_offset; /* 2 1 */ u8 swp_inner_l3_offset; /* 3 1 */ u8 cs_flags; /* 4 1 */ u8 swp_flags; /* 5 1 */ __be16 mss; /* 6 2 */ __be32 flow_table_metadata; /* 8 4 */ union { struct { __be16 sz; /* 12 2 */ u8 start[2]; /* 14 2 */ } inline_hdr; /* 12 4 */ struct { __be16 type; /* 12 2 */ __be16 vlan_tci; /* 14 2 */ } insert; /* 12 4 */ __be32 trailer; /* 12 4 */ }; /* 12 4 */ /* size: 16, cachelines: 1, members: 9 */ /* last cacheline: 16 bytes */ }; struct mlx5_wqe_data_seg { __be32 byte_count; /* 0 4 */ __be32 lkey; /* 4 4 */ __be64 addr; /* 8 8 */ /* size: 16, cachelines: 1, members: 3 */ /* last cacheline: 16 bytes */ }; So, split the memcpy() so the compiler can reason about the buffer sizes. "pahole" shows no size nor member offset changes to struct mlx5e_tx_wqe nor struct mlx5e_umr_wqe. "objdump -d" shows no meaningful object code changes (i.e. only source line number induced differences and optimizations). Fixes: b5503b994ed5 ("net/mlx5e: XDP TX forwarding support") Signed-off-by: Kees Cook Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/en.h | 6 +++--- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 +++- 2 files changed, 6 insertions(+), 4 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h @@ -225,7 +225,7 @@ static inline int mlx5e_get_max_num_chan struct mlx5e_tx_wqe { struct mlx5_wqe_ctrl_seg ctrl; struct mlx5_wqe_eth_seg eth; - struct mlx5_wqe_data_seg data[0]; + struct mlx5_wqe_data_seg data[]; }; =20 struct mlx5e_rx_wqe_ll { @@ -242,8 +242,8 @@ struct mlx5e_umr_wqe { struct mlx5_wqe_umr_ctrl_seg uctrl; struct mlx5_mkey_seg mkc; union { - struct mlx5_mtt inline_mtts[0]; - struct mlx5_klm inline_klms[0]; + DECLARE_FLEX_ARRAY(struct mlx5_mtt, inline_mtts); + DECLARE_FLEX_ARRAY(struct mlx5_klm, inline_klms); }; }; =20 --- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c @@ -341,8 +341,10 @@ mlx5e_xmit_xdp_frame(struct mlx5e_xdpsq =20 /* copy the inline part if required */ if (sq->min_inline_mode !=3D MLX5_INLINE_MODE_NONE) { - memcpy(eseg->inline_hdr.start, xdptxd->data, MLX5E_XDP_MIN_INLINE); + memcpy(eseg->inline_hdr.start, xdptxd->data, sizeof(eseg->inline_hdr.sta= rt)); eseg->inline_hdr.sz =3D cpu_to_be16(MLX5E_XDP_MIN_INLINE); + memcpy(dseg, xdptxd->data + sizeof(eseg->inline_hdr.start), + MLX5E_XDP_MIN_INLINE - sizeof(eseg->inline_hdr.start)); dma_len -=3D MLX5E_XDP_MIN_INLINE; dma_addr +=3D MLX5E_XDP_MIN_INLINE; dseg++; From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1EFBAC433EF for ; Fri, 4 Feb 2022 09:27:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358146AbiBDJ1m (ORCPT ); Fri, 4 Feb 2022 04:27:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33170 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358197AbiBDJZw (ORCPT ); Fri, 4 Feb 2022 04:25:52 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 266D4C0617B9; Fri, 4 Feb 2022 01:25:47 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E2845B836EA; Fri, 4 Feb 2022 09:25:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 406F9C004E1; Fri, 4 Feb 2022 09:25:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966744; bh=5+zBic57DaFCDCTKf73rG2L2m1QDDJ4X68mahAZmo8Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fHD2MCYfwrf34Jdlf6rvHMmJTAIjKt3MZeG08J0VW9DKsipPke3P4J74H33hZ4RO8 0eW7Jl8hpAw4nLRmG8SPctNc2WVsNyH7xqqxykaaXKMELixfg/fHIEu0rkyczLJiGt YXkQN+TVN6J+Uy4IwxBioi+TGOyFDTVqq0jRGMWg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Khalid Manaa , Tariq Toukan , Saeed Mahameed Subject: [PATCH 5.16 25/43] net/mlx5e: Fix wrong calculation of header index in HW_GRO Date: Fri, 4 Feb 2022 10:22:32 +0100 Message-Id: <20220204091917.990963187@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Khalid Manaa commit b8d91145ed7cfa046cc07bcfb277465b9d45da73 upstream. The HW doesn't wrap the CQE.shampo.header_index field according to the headers buffer size, instead it always increases it until reaching overflow of u16 size. Thus the mlx5e_handle_rx_cqe_mpwrq_shampo handler should mask the CQE header_index field to find the actual header index in the headers buffe= r. Fixes: f97d5c2a453e ("net/mlx5e: Add handle SHAMPO cqe support") Signed-off-by: Khalid Manaa Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h | 5 +++++ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h @@ -167,6 +167,11 @@ static inline u16 mlx5e_txqsq_get_next_p return pi; } =20 +static inline u16 mlx5e_shampo_get_cqe_header_index(struct mlx5e_rq *rq, s= truct mlx5_cqe64 *cqe) +{ + return be16_to_cpu(cqe->shampo.header_entry_index) & (rq->mpwqe.shampo->h= d_per_wq - 1); +} + struct mlx5e_shampo_umr { u16 len; }; --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c @@ -1116,7 +1116,7 @@ static void mlx5e_shampo_update_ipv6_udp static void mlx5e_shampo_update_fin_psh_flags(struct mlx5e_rq *rq, struct = mlx5_cqe64 *cqe, struct tcphdr *skb_tcp_hd) { - u16 header_index =3D be16_to_cpu(cqe->shampo.header_entry_index); + u16 header_index =3D mlx5e_shampo_get_cqe_header_index(rq, cqe); struct tcphdr *last_tcp_hd; void *last_hd_addr; =20 @@ -1968,7 +1968,7 @@ mlx5e_free_rx_shampo_hd_entry(struct mlx static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct mlx5e_rq *rq, struct m= lx5_cqe64 *cqe) { u16 data_bcnt =3D mpwrq_get_cqe_byte_cnt(cqe) - cqe->shampo.header_size; - u16 header_index =3D be16_to_cpu(cqe->shampo.header_entry_index); + u16 header_index =3D mlx5e_shampo_get_cqe_header_index(rq, cqe); u32 wqe_offset =3D be32_to_cpu(cqe->shampo.data_offset); u16 cstrides =3D mpwrq_get_cqe_consumed_strides(cqe); u32 data_offset =3D wqe_offset & (PAGE_SIZE - 1); From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2CE66C433F5 for ; Fri, 4 Feb 2022 09:27:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357761AbiBDJ1j (ORCPT ); Fri, 4 Feb 2022 04:27:39 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44736 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358146AbiBDJZt (ORCPT ); Fri, 4 Feb 2022 04:25:49 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D85A0615ED; Fri, 4 Feb 2022 09:25:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6CB2FC004E1; Fri, 4 Feb 2022 09:25:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966748; bh=419SQMNUJTad//hSB8VlDwF9adSrpO28yi8oXMmav/c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GY1s2z/VYpebiOHdeYLuya6dQXoIHoNRfSacXEzdoaOj5t9ja7KX/wn0eK8Rr6zL1 5yviVTFZoLwsW4BAE5T8FwYSFSYLwHmmXNczwe9TIQ2tKaAbw+duGN5GiUPLO3pD7Q 7gQRN16NVPMw1BayYyTyR53ERj5meveSmyNu552Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Khalid Manaa , Tariq Toukan , Saeed Mahameed Subject: [PATCH 5.16 26/43] net/mlx5e: Fix broken SKB allocation in HW-GRO Date: Fri, 4 Feb 2022 10:22:33 +0100 Message-Id: <20220204091918.021305558@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Khalid Manaa commit 7957837b816f11eecb9146235bb0715478f4c81f upstream. In case the HW doesn't perform header-data split, it will write the whole packet into the data buffer in the WQ, in this case the SHAMPO CQE handler couldn't use the header entry to build the SKB, instead it should allocate a new memory to build the SKB using the function: mlx5e_skb_from_cqe_mpwrq_nonlinear. Fixes: f97d5c2a453e ("net/mlx5e: Add handle SHAMPO cqe support") Signed-off-by: Khalid Manaa Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 26 +++++++++++++++----= ----- 1 file changed, 17 insertions(+), 9 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c @@ -1866,7 +1866,7 @@ mlx5e_skb_from_cqe_mpwrq_linear(struct m return skb; } =20 -static void +static struct sk_buff * mlx5e_skb_from_cqe_shampo(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wi, struct mlx5_cqe64 *cqe, u16 header_index) { @@ -1890,7 +1890,7 @@ mlx5e_skb_from_cqe_shampo(struct mlx5e_r skb =3D mlx5e_build_linear_skb(rq, hdr, frag_size, rx_headroom, head_siz= e); =20 if (unlikely(!skb)) - return; + return NULL; =20 /* queue up for recycling/reuse */ page_ref_inc(head->page); @@ -1902,7 +1902,7 @@ mlx5e_skb_from_cqe_shampo(struct mlx5e_r ALIGN(head_size, sizeof(long))); if (unlikely(!skb)) { rq->stats->buff_alloc_err++; - return; + return NULL; } =20 prefetchw(skb->data); @@ -1913,9 +1913,7 @@ mlx5e_skb_from_cqe_shampo(struct mlx5e_r skb->tail +=3D head_size; skb->len +=3D head_size; } - rq->hw_gro_data->skb =3D skb; - NAPI_GRO_CB(skb)->count =3D 1; - skb_shinfo(skb)->gso_size =3D mpwrq_get_cqe_byte_cnt(cqe) - head_size; + return skb; } =20 static void @@ -1975,6 +1973,7 @@ static void mlx5e_handle_rx_cqe_mpwrq_sh u32 cqe_bcnt =3D mpwrq_get_cqe_byte_cnt(cqe); u16 wqe_id =3D be16_to_cpu(cqe->wqe_id); u32 page_idx =3D wqe_offset >> PAGE_SHIFT; + u16 head_size =3D cqe->shampo.header_size; struct sk_buff **skb =3D &rq->hw_gro_data->skb; bool flush =3D cqe->shampo.flush; bool match =3D cqe->shampo.match; @@ -2007,9 +2006,16 @@ static void mlx5e_handle_rx_cqe_mpwrq_sh } =20 if (!*skb) { - mlx5e_skb_from_cqe_shampo(rq, wi, cqe, header_index); + if (likely(head_size)) + *skb =3D mlx5e_skb_from_cqe_shampo(rq, wi, cqe, header_index); + else + *skb =3D mlx5e_skb_from_cqe_mpwrq_nonlinear(rq, wi, cqe_bcnt, data_offs= et, + page_idx); if (unlikely(!*skb)) goto free_hd_entry; + + NAPI_GRO_CB(*skb)->count =3D 1; + skb_shinfo(*skb)->gso_size =3D cqe_bcnt - head_size; } else { NAPI_GRO_CB(*skb)->count++; if (NAPI_GRO_CB(*skb)->count =3D=3D 2 && @@ -2023,8 +2029,10 @@ static void mlx5e_handle_rx_cqe_mpwrq_sh } } =20 - di =3D &wi->umr.dma_info[page_idx]; - mlx5e_fill_skb_data(*skb, rq, di, data_bcnt, data_offset); + if (likely(head_size)) { + di =3D &wi->umr.dma_info[page_idx]; + mlx5e_fill_skb_data(*skb, rq, di, data_bcnt, data_offset); + } =20 mlx5e_shampo_complete_rx_cqe(rq, cqe, cqe_bcnt, *skb); if (flush) From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65418C433F5 for ; Fri, 4 Feb 2022 09:27:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358239AbiBDJ1q (ORCPT ); Fri, 4 Feb 2022 04:27:46 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:43806 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358198AbiBDJZw (ORCPT ); Fri, 4 Feb 2022 04:25:52 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EEDA5617B5; Fri, 4 Feb 2022 09:25:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 08387C004E1; Fri, 4 Feb 2022 09:25:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966751; bh=gAiEkRCmxoxeR1wsBoW65hMxfhjyd5QKm8WnZv5DEoY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yP8bmKUzQIG4BY+lXge4xr4uCygXTTz1lzbq4uWM1d9GN366DRvC/jPLArhHgnEJO qwGL6weYLqYxKi9J3N807IWdAXcMBX0mBAm9fJYe6C1NGZ8lUOpkOdwrCzm1ogLlNd +mgFPqQ6h5+S6/rgeuIWkFHOAWnCFn1fpgwJfGyA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maor Dickman , Roi Dayan , Saeed Mahameed Subject: [PATCH 5.16 27/43] net/mlx5: E-Switch, Fix uninitialized variable modact Date: Fri, 4 Feb 2022 10:22:34 +0100 Message-Id: <20220204091918.050742976@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maor Dickman commit d8e5883d694bb053b19c4142a2d1f43a34f6fe2c upstream. The variable modact is not initialized before used in command modify header allocation which can cause command to fail. Fix by initializing modact with zeros. Addresses-Coverity: ("Uninitialized scalar variable") Fixes: 8f1e0b97cc70 ("net/mlx5: E-Switch, Mark miss packets with new chain = id mapping") Signed-off-by: Maor Dickman Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c @@ -212,7 +212,7 @@ static int create_chain_restore(struct fs_chain *chain) { struct mlx5_eswitch *esw =3D chain->chains->dev->priv.eswitch; - char modact[MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto)]; + u8 modact[MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto)] =3D {}; struct mlx5_fs_chains *chains =3D chain->chains; enum mlx5e_tc_attr_to_reg chain_to_reg; struct mlx5_modify_hdr *mod_hdr; From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9873FC433F5 for ; Fri, 4 Feb 2022 09:31:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357683AbiBDJa3 (ORCPT ); Fri, 4 Feb 2022 04:30:29 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33316 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357589AbiBDJ2j (ORCPT ); Fri, 4 Feb 2022 04:28:39 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D9E0DC061779; Fri, 4 Feb 2022 01:27:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4CEE6615ED; Fri, 4 Feb 2022 09:27:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1A503C340ED; Fri, 4 Feb 2022 09:27:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966831; bh=vWUsnLKaMLS0zuZYpr+LPWNeIvOfQMdUJ9pyGN6qUaM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OQMD9gJ44cIHn8S1BmoitWoxniQUoTQ686dFuQaLHb3L0QP7w+F/WUgBCRKDODEma akruJaW+XmpDp+xczL9inaYLfcBM4lPMC2mtpS4GsQTruyNJhINC6Y5OOT81J1jJQP uJibKPA+IXnL1EYgSdmURBiDYmcA7wSTTYkJnPDQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Roi Dayan , Ariel Levkovich , Saeed Mahameed Subject: [PATCH 5.16 28/43] net/mlx5e: Avoid implicit modify hdr for decap drop rule Date: Fri, 4 Feb 2022 10:22:35 +0100 Message-Id: <20220204091918.080295755@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Roi Dayan commit 5b209d1a22afabfb7d644abb10510c5713a3e569 upstream. Currently the driver adds implicit modify hdr action for decap rules on tunnel devices if the port is an ovs port. This is also done if the action is drop and makes the modify hdr redundant and also the FW doesn't support it and will generate a syndrome. kernel: mlx5_core 0000:08:00.0: mlx5_cmd_check:777:(pid 102063): SET_FLOW_T= ABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (= 0x8708c3) Fix it by adding the implicit modify hdr only for fwd actions. Fixes: b16eb3c81fe2 ("net/mlx5: Support internal port as decap route device= ") Fixes: 077cdda764c7 ("net/mlx5e: TC, Fix memory leak with rules with intern= al port") Signed-off-by: Roi Dayan Reviewed-by: Ariel Levkovich Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c @@ -1425,7 +1425,8 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv if (err) goto err_out; =20 - if (!attr->chain && esw_attr->int_port) { + if (!attr->chain && esw_attr->int_port && + attr->action & MLX5_FLOW_CONTEXT_ACTION_FWD_DEST) { /* If decap route device is internal port, change the * source vport value in reg_c0 back to uplink just in * case the rule performs goto chain > 0. If we have a miss From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 737D6C433F5 for ; Fri, 4 Feb 2022 09:29:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358570AbiBDJ26 (ORCPT ); Fri, 4 Feb 2022 04:28:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33338 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357591AbiBDJ1I (ORCPT ); Fri, 4 Feb 2022 04:27:08 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 96502C061394; Fri, 4 Feb 2022 01:26:23 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 570ECB836F0; Fri, 4 Feb 2022 09:26:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7ECADC340ED; Fri, 4 Feb 2022 09:26:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966781; bh=iaE1IqOh0EjTj9ysylMCuepe6iN/kPDrrbFWOLuRBw8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G+KEVi3R4ycgyEZEtZ8aCMBY20VHSaUPJGdh0a9srQgkWt+llCFoSvpD0M9e4H3Do wB7up5pDqkTdDUsHzehn8zqDSzdsHVOGA4olwToXHbYTMpqrWrpOceHxA6CX8SMDcG XiXpK847YucSFNDfULzvwmdMmrkZKRZmUQ38elOk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Georgi Valkov , Jan Kiszka , Jakub Kicinski Subject: [PATCH 5.16 29/43] ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback Date: Fri, 4 Feb 2022 10:22:36 +0100 Message-Id: <20220204091918.110218109@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Georgi Valkov commit 63e4b45c82ed1bde979da7052229a4229ce9cabf upstream. When rx_buf is allocated we need to account for IPHETH_IP_ALIGN, which reduces the usable size by 2 bytes. Otherwise we have 1512 bytes usable instead of 1514, and if we receive more than 1512 bytes, ipheth_rcvbulk_callback is called with status -EOVERFLOW, after which the driver malfunctiones and all communication stops. Resolves ipheth 2-1:4.2: ipheth_rcvbulk_callback: urb status: -75 Fixes: f33d9e2b48a3 ("usbnet: ipheth: fix connectivity with iOS 14") Signed-off-by: Georgi Valkov Tested-by: Jan Kiszka Link: https://lore.kernel.org/all/B60B8A4B-92A0-49B3-805D-809A2433B46C@abv.= bg/ Link: https://lore.kernel.org/all/24851bd2769434a5fc24730dce8e8a984c5a4505.= 1643699778.git.jan.kiszka@siemens.com/ Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/usb/ipheth.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -121,7 +121,7 @@ static int ipheth_alloc_urbs(struct iphe if (tx_buf =3D=3D NULL) goto free_rx_urb; =20 - rx_buf =3D usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE, + rx_buf =3D usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_A= LIGN, GFP_KERNEL, &rx_urb->transfer_dma); if (rx_buf =3D=3D NULL) goto free_tx_buf; @@ -146,7 +146,7 @@ error_nomem: =20 static void ipheth_free_urbs(struct ipheth_device *iphone) { - usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf, + usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, iphone= ->rx_buf, iphone->rx_urb->transfer_dma); usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf, iphone->tx_urb->transfer_dma); @@ -317,7 +317,7 @@ static int ipheth_rx_submit(struct iphet =20 usb_fill_bulk_urb(dev->rx_urb, udev, usb_rcvbulkpipe(udev, dev->bulk_in), - dev->rx_buf, IPHETH_BUF_SIZE, + dev->rx_buf, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, ipheth_rcvbulk_callback, dev); dev->rx_urb->transfer_flags |=3D URB_NO_TRANSFER_DMA_MAP; From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7113FC433EF for ; Fri, 4 Feb 2022 09:28:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358517AbiBDJ22 (ORCPT ); Fri, 4 Feb 2022 04:28:28 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44172 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358025AbiBDJ0p (ORCPT ); Fri, 4 Feb 2022 04:26:45 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 90A52612C8; Fri, 4 Feb 2022 09:26:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BC276C004E1; Fri, 4 Feb 2022 09:26:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966805; bh=SyzHGSaCOZ3ivvI/sjcAeoQjKsYXInq4oIEakk1zE6M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ghTcvp8nFLlsMBcDNYiWRPsJ88Vs6dKhZdv+P9i7PMM73TNMRAOl6dpQoTqng2Z9n WxtUgxBH/MzwArAoAq3U6QhAS7es7OLbv/xhBkLpMSFCbZsN3A0qFH4N6JBZNK3jhJ 0fRxawXYdOlENGAo8QAqlaNY994YlgO2i3coINQ0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sylwester Dziedziuch , Jedrzej Jagielski , Alexander Lobakin , Imam Hassan Reza Biswas , Tony Nguyen Subject: [PATCH 5.16 30/43] i40e: Fix reset bw limit when DCB enabled with 1 TC Date: Fri, 4 Feb 2022 10:22:37 +0100 Message-Id: <20220204091918.148878584@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jedrzej Jagielski commit 3d2504663c41104b4359a15f35670cfa82de1bbf upstream. There was an AQ error I40E_AQ_RC_EINVAL when trying to reset bw limit as part of bw allocation setup. This was caused by trying to reset bw limit with DCB enabled. Bw limit should not be reset when DCB is enabled. The code was relying on the pf->flags to check if DCB is enabled but if only 1 TC is available this flag will not be set even though DCB is enabled. Add a check for number of TC and if it is 1 don't try to reset bw limit even if pf->flags shows DCB as disabled. Fixes: fa38e30ac73f ("i40e: Fix for Tx timeouts when interface is brought u= p if DCB is enabled") Suggested-by: Alexander Lobakin # Flatten the = condition Signed-off-by: Sylwester Dziedziuch Signed-off-by: Jedrzej Jagielski Reviewed-by: Alexander Lobakin Tested-by: Imam Hassan Reza Biswas Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/intel/i40e/i40e_main.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -5372,7 +5372,15 @@ static int i40e_vsi_configure_bw_alloc(s /* There is no need to reset BW when mqprio mode is on. */ if (pf->flags & I40E_FLAG_TC_MQPRIO) return 0; - if (!vsi->mqprio_qopt.qopt.hw && !(pf->flags & I40E_FLAG_DCB_ENABLED)) { + + if (!vsi->mqprio_qopt.qopt.hw) { + if (pf->flags & I40E_FLAG_DCB_ENABLED) + goto skip_reset; + + if (IS_ENABLED(CONFIG_I40E_DCB) && + i40e_dcb_hw_get_num_tc(&pf->hw) =3D=3D 1) + goto skip_reset; + ret =3D i40e_set_bw_limit(vsi, vsi->seid, 0); if (ret) dev_info(&pf->pdev->dev, @@ -5380,6 +5388,8 @@ static int i40e_vsi_configure_bw_alloc(s vsi->seid); return ret; } + +skip_reset: memset(&bw_data, 0, sizeof(bw_data)); bw_data.tc_valid_bits =3D enabled_tc; for (i =3D 0; i < I40E_MAX_TRAFFIC_CLASS; i++) From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F278C433EF for ; Fri, 4 Feb 2022 09:29:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358201AbiBDJ3v (ORCPT ); Fri, 4 Feb 2022 04:29:51 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33458 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358297AbiBDJ2E (ORCPT ); Fri, 4 Feb 2022 04:28:04 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3398FC06174A; Fri, 4 Feb 2022 01:26:51 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id ED2DFB836EA; Fri, 4 Feb 2022 09:26:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9FAE7C340EF; Fri, 4 Feb 2022 09:26:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966808; bh=r2AEvg0dJtsDUBsrPtvCkwyCzdKV51w5osYdpLkgFY0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VmLpoH+FnhWMF8kRpLfrn300gWGhw+GbzX+L8ZRiJW+R+A+MoAQRrBEDZnxDvk6Fr xsMrTFxNKjWkUQRoYGOL2q0W+qWbDurPuxyryMtnGvWzFWOb8O/9VJt4Zmz0vb78UD FkssIZVQ+NucUNAJh9VGDrE2lW4bCTP/c6+ngAAU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Slawomir Laba , Sylwester Dziedziuch , Karen Sornek , Gurucharan G , Tony Nguyen Subject: [PATCH 5.16 31/43] i40e: Fix reset path while removing the driver Date: Fri, 4 Feb 2022 10:22:38 +0100 Message-Id: <20220204091918.186259322@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Karen Sornek commit 6533e558c6505e94c3e0ed4281ed5e31ec985f4d upstream. Fix the crash in kernel while dereferencing the NULL pointer, when the driver is unloaded and simultaneously the VSI rings are being stopped. The hardware requires 50msec in order to finish RX queues disable. For this purpose the driver spins in mdelay function for the operation to be completed. For example changing number of queues which requires reset would fail in the following call stack: 1) i40e_prep_for_reset 2) i40e_pf_quiesce_all_vsi 3) i40e_quiesce_vsi 4) i40e_vsi_close 5) i40e_down 6) i40e_vsi_stop_rings 7) i40e_vsi_control_rx -> disable requires the delay of 50msecs 8) continue back in i40e_down function where i40e_clean_tx_ring(vsi->tx_rings[i]) is going to crash When the driver was spinning vsi_release called i40e_vsi_free_arrays where the vsi->tx_rings resources were freed and the pointer was set to NULL. Fixes: 5b6d4a7f20b0 ("i40e: Fix crash during removing i40e driver") Signed-off-by: Slawomir Laba Signed-off-by: Sylwester Dziedziuch Signed-off-by: Karen Sornek Tested-by: Gurucharan G Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 19 ++++++++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/intel/i40e/i40e.h +++ b/drivers/net/ethernet/intel/i40e/i40e.h @@ -144,6 +144,7 @@ enum i40e_state_t { __I40E_VIRTCHNL_OP_PENDING, __I40E_RECOVERY_MODE, __I40E_VF_RESETS_DISABLED, /* disable resets during i40e_remove */ + __I40E_IN_REMOVE, __I40E_VFS_RELEASING, /* This must be last as it determines the size of the BITMAP */ __I40E_STATE_SIZE__, --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -10863,6 +10863,9 @@ static void i40e_reset_and_rebuild(struc bool lock_acquired) { int ret; + + if (test_bit(__I40E_IN_REMOVE, pf->state)) + return; /* Now we wait for GRST to settle out. * We don't have to delete the VEBs or VSIs from the hw switch * because the reset will make them disappear. @@ -12222,6 +12225,8 @@ int i40e_reconfig_rss_queues(struct i40e =20 vsi->req_queue_pairs =3D queue_count; i40e_prep_for_reset(pf); + if (test_bit(__I40E_IN_REMOVE, pf->state)) + return pf->alloc_rss_size; =20 pf->alloc_rss_size =3D new_rss_size; =20 @@ -13048,6 +13053,10 @@ static int i40e_xdp_setup(struct i40e_vs if (need_reset) i40e_prep_for_reset(pf); =20 + /* VSI shall be deleted in a moment, just return EINVAL */ + if (test_bit(__I40E_IN_REMOVE, pf->state)) + return -EINVAL; + old_prog =3D xchg(&vsi->xdp_prog, prog); =20 if (need_reset) { @@ -15938,8 +15947,13 @@ static void i40e_remove(struct pci_dev * i40e_write_rx_ctl(hw, I40E_PFQF_HENA(0), 0); i40e_write_rx_ctl(hw, I40E_PFQF_HENA(1), 0); =20 - while (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state)) + /* Grab __I40E_RESET_RECOVERY_PENDING and set __I40E_IN_REMOVE + * flags, once they are set, i40e_rebuild should not be called as + * i40e_prep_for_reset always returns early. + */ + while (test_and_set_bit(__I40E_RESET_RECOVERY_PENDING, pf->state)) usleep_range(1000, 2000); + set_bit(__I40E_IN_REMOVE, pf->state); =20 if (pf->flags & I40E_FLAG_SRIOV_ENABLED) { set_bit(__I40E_VF_RESETS_DISABLED, pf->state); @@ -16138,6 +16152,9 @@ static void i40e_pci_error_reset_done(st { struct i40e_pf *pf =3D pci_get_drvdata(pdev); =20 + if (test_bit(__I40E_IN_REMOVE, pf->state)) + return; + i40e_reset_and_rebuild(pf, false, false); } =20 From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B0FCC433F5 for ; Fri, 4 Feb 2022 09:29:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357937AbiBDJ3s (ORCPT ); Fri, 4 Feb 2022 04:29:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33460 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358298AbiBDJ2E (ORCPT ); Fri, 4 Feb 2022 04:28:04 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2242BC06176F; Fri, 4 Feb 2022 01:26:53 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8BBEF61747; Fri, 4 Feb 2022 09:26:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4D8B8C004E1; Fri, 4 Feb 2022 09:26:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966812; bh=QrZLry4insApv+gQ37l7e+SnTkVoC6w8ESMnHsJwm00=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fvbBr/re62sUpX1StsxuuOyv2Echx3Ht2+xoEPUkrlAER2+EGJ1eDbW7+Jg20BpRt m3l20ywmu3e7IulcUTlxH3fvgjSReXG6PdogT+IH3vgkJPOLROIazaN7limpWZuvJ1 Vu6T4pMASHXFwnEHeREZATl7icO5+FXbf3mWzQ2s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sudheesh Mavila , Raju Rangoju , Tom Lendacky , Jakub Kicinski Subject: [PATCH 5.16 32/43] net: amd-xgbe: ensure to reset the tx_timer_active flag Date: Fri, 4 Feb 2022 10:22:39 +0100 Message-Id: <20220204091918.217272476@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Raju Rangoju commit 7674b7b559b683478c3832527c59bceb169e701d upstream. Ensure to reset the tx_timer_active flag in xgbe_stop(), otherwise a port restart may result in tx timeout due to uncleared flag. Fixes: c635eaacbf77 ("amd-xgbe: Remove Tx coalescing") Co-developed-by: Sudheesh Mavila Signed-off-by: Sudheesh Mavila Signed-off-by: Raju Rangoju Acked-by: Tom Lendacky Link: https://lore.kernel.org/r/20220127060222.453371-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c @@ -721,7 +721,9 @@ static void xgbe_stop_timers(struct xgbe if (!channel->tx_ring) break; =20 + /* Deactivate the Tx timer */ del_timer_sync(&channel->tx_timer); + channel->tx_timer_active =3D 0; } } =20 From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70E07C433F5 for ; Fri, 4 Feb 2022 09:28:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357848AbiBDJ2k (ORCPT ); Fri, 4 Feb 2022 04:28:40 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:54436 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358074AbiBDJ05 (ORCPT ); Fri, 4 Feb 2022 04:26:57 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 96E3CB836EA; Fri, 4 Feb 2022 09:26:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 92DF8C340ED; Fri, 4 Feb 2022 09:26:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966815; bh=RvwOnjJX5/yL2LBe52BFHiUhmabHjJ/rk3lPSN3zUmw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mDvdSBi/laQwkV5POG2BZujR6OQwAkgidyE8qw2JZS2RQw624Bt5/dOzJokC79taD X65Yr+7tUVsmuOMi7XCTZODsI5OljdbjHevoCc+q1N0FHxivlirg8tu/X3QWzCEAef 1YMYzicKizNpFfe7qK6P4KthsETfPkqPe0DuzdyI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Lendacky , Shyam Sundar S K , Jakub Kicinski Subject: [PATCH 5.16 33/43] net: amd-xgbe: Fix skb data length underflow Date: Fri, 4 Feb 2022 10:22:40 +0100 Message-Id: <20220204091918.247372279@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Shyam Sundar S K commit 5aac9108a180fc06e28d4e7fb00247ce603b72ee upstream. There will be BUG_ON() triggered in include/linux/skbuff.h leading to intermittent kernel panic, when the skb length underflow is detected. Fix this by dropping the packet if such length underflows are seen because of inconsistencies in the hardware descriptors. Fixes: 622c36f143fc ("amd-xgbe: Fix jumbo MTU processing on newer hardware") Suggested-by: Tom Lendacky Signed-off-by: Shyam Sundar S K Acked-by: Tom Lendacky Link: https://lore.kernel.org/r/20220127092003.2812745-1-Shyam-sundar.S-k@a= md.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c @@ -2555,6 +2555,14 @@ read_again: buf2_len =3D xgbe_rx_buf2_len(rdata, packet, len); len +=3D buf2_len; =20 + if (buf2_len > rdata->rx.buf.dma_len) { + /* Hardware inconsistency within the descriptors + * that has resulted in a length underflow. + */ + error =3D 1; + goto skip_data; + } + if (!skb) { skb =3D xgbe_create_skb(pdata, napi, rdata, buf1_len); @@ -2584,8 +2592,10 @@ skip_data: if (!last || context_next) goto read_again; =20 - if (!skb) + if (!skb || error) { + dev_kfree_skb(skb); goto next_packet; + } =20 /* Be sure we don't exceed the configured MTU */ max_len =3D netdev->mtu + ETH_HLEN; From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 471C0C433EF for ; Fri, 4 Feb 2022 09:30:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357802AbiBDJaH (ORCPT ); Fri, 4 Feb 2022 04:30:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33258 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358034AbiBDJ2W (ORCPT ); Fri, 4 Feb 2022 04:28:22 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 149CBC061340; Fri, 4 Feb 2022 01:27:01 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CAB25B836EE; Fri, 4 Feb 2022 09:26:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F3991C004E1; Fri, 4 Feb 2022 09:26:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966818; bh=u95f1E3cPlDrVSm0z4hyvD5olgUXo83F6mv+pe0hmvY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q8ui5L3TEu2rsCurl2sOISdsVpwFEmnekwzAPGJEyteoJjBqdFVCyM5gT0G3XQd1K hlhhdsdl+/nc+47eKDmubnJs5U6vVxSaj6rR1+695j0IMCZ+ZrWl2h6ZB9IjRGFTCx 31Gp0gzjmWufSWrHL84FV/mZKn7UYZyKBL8IaKY4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Mathias Krause , Jan Kara Subject: [PATCH 5.16 34/43] fanotify: Fix stale file descriptor in copy_event_to_user() Date: Fri, 4 Feb 2022 10:22:41 +0100 Message-Id: <20220204091918.278563230@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter commit ee12595147ac1fbfb5bcb23837e26dd58d94b15d upstream. This code calls fd_install() which gives the userspace access to the fd. Then if copy_info_records_to_user() fails it calls put_unused_fd(fd) but that will not release it and leads to a stale entry in the file descriptor table. Generally you can't trust the fd after a call to fd_install(). The fix is to delay the fd_install() until everything else has succeeded. Fortunately it requires CAP_SYS_ADMIN to reach this code so the security impact is less. Fixes: f644bc449b37 ("fanotify: fix copy_event_to_user() fid error clean up= ") Link: https://lore.kernel.org/r/20220128195656.GA26981@kili Signed-off-by: Dan Carpenter Reviewed-by: Mathias Krause Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- fs/notify/fanotify/fanotify_user.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/fs/notify/fanotify/fanotify_user.c +++ b/fs/notify/fanotify/fanotify_user.c @@ -656,9 +656,6 @@ static ssize_t copy_event_to_user(struct if (fanotify_is_perm_event(event->mask)) FANOTIFY_PERM(event)->fd =3D fd; =20 - if (f) - fd_install(fd, f); - if (info_mode) { ret =3D copy_info_records_to_user(event, info, info_mode, pidfd, buf, count); @@ -666,6 +663,9 @@ static ssize_t copy_event_to_user(struct goto out_close_fd; } =20 + if (f) + fd_install(fd, f); + return metadata.event_len; =20 out_close_fd: From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69D14C433F5 for ; Fri, 4 Feb 2022 09:28:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358095AbiBDJ2q (ORCPT ); Fri, 4 Feb 2022 04:28:46 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53354 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357683AbiBDJ1E (ORCPT ); Fri, 4 Feb 2022 04:27:04 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5DE95B836F1; Fri, 4 Feb 2022 09:27:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 56D40C004E1; Fri, 4 Feb 2022 09:27:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966822; bh=rr7FQwVrJ05nEWbpsJy537f2UNq7u1DL+MlzH6kVaxk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fAqolOYAn2PIPAQDsPGtVgbebtKLp949F79iSpp1Ppm5RSxP1hRRqN2+kjseFbC2K q47YbGWZcAjNuLuDfjZlze/L+paNjoxPlsWNXVh5KPG5NYbFsCkO8EKAmtXVjqdoz7 9jRJ6/bNaH+/dMuv4FltdrP/mceVmfqS+1GaOXNc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Vlad Buslov , Jiri Pirko , Cong Wang , syzbot , Jakub Kicinski Subject: [PATCH 5.16 35/43] net: sched: fix use-after-free in tc_new_tfilter() Date: Fri, 4 Feb 2022 10:22:42 +0100 Message-Id: <20220204091918.310587033@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 upstream. Whenever tc_new_tfilter() jumps back to replay: label, we need to make sure @q and @chain local variables are cleared again, or risk use-after-free as in [1] For consistency, apply the same fix in tc_ctl_chain() BUG: KASAN: use-after-free in mini_qdisc_pair_swap+0x1b9/0x1f0 net/sched/sc= h_generic.c:1581 Write of size 8 at addr ffff8880985c4b08 by task syz-executor.4/1945 CPU: 0 PID: 1945 Comm: syz-executor.4 Not tainted 5.17.0-rc1-syzkaller-0049= 5-gff58831fa02d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 mini_qdisc_pair_swap+0x1b9/0x1f0 net/sched/sch_generic.c:1581 tcf_chain_head_change_item net/sched/cls_api.c:372 [inline] tcf_chain0_head_change.isra.0+0xb9/0x120 net/sched/cls_api.c:386 tcf_chain_tp_insert net/sched/cls_api.c:1657 [inline] tcf_chain_tp_insert_unique net/sched/cls_api.c:1707 [inline] tc_new_tfilter+0x1e67/0x2350 net/sched/cls_api.c:2086 rtnetlink_rcv_msg+0x80d/0xb80 net/core/rtnetlink.c:5583 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x539/0x7e0 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:725 ____sys_sendmsg+0x331/0x810 net/socket.c:2413 ___sys_sendmsg+0xf3/0x170 net/socket.c:2467 __sys_sendmmsg+0x195/0x470 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline] __se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f2647172059 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2645aa5168 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f2647285100 RCX: 00007f2647172059 RDX: 040000000000009f RSI: 00000000200002c0 RDI: 0000000000000006 RBP: 00007f26471cc08d R08: 0000000000000000 R09: 0000000000000000 R10: 9e00000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffb3f7f02f R14: 00007f2645aa5300 R15: 0000000000022000 Allocated by task 1944: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524 kmalloc_node include/linux/slab.h:604 [inline] kzalloc_node include/linux/slab.h:726 [inline] qdisc_alloc+0xac/0xa10 net/sched/sch_generic.c:941 qdisc_create.constprop.0+0xce/0x10f0 net/sched/sch_api.c:1211 tc_modify_qdisc+0x4c5/0x1980 net/sched/sch_api.c:1660 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5592 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x539/0x7e0 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:725 ____sys_sendmsg+0x331/0x810 net/socket.c:2413 ___sys_sendmsg+0xf3/0x170 net/socket.c:2467 __sys_sendmmsg+0x195/0x470 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline] __se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 3609: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x130/0x160 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:236 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1754 slab_free mm/slub.c:3509 [inline] kfree+0xcb/0x280 mm/slub.c:4562 rcu_do_batch kernel/rcu/tree.c:2527 [inline] rcu_core+0x7b8/0x1540 kernel/rcu/tree.c:2778 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 Last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 __call_rcu kernel/rcu/tree.c:3026 [inline] call_rcu+0xb1/0x740 kernel/rcu/tree.c:3106 qdisc_put_unlocked+0x6f/0x90 net/sched/sch_generic.c:1109 tcf_block_release+0x86/0x90 net/sched/cls_api.c:1238 tc_new_tfilter+0xc0d/0x2350 net/sched/cls_api.c:2148 rtnetlink_rcv_msg+0x80d/0xb80 net/core/rtnetlink.c:5583 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x539/0x7e0 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:725 ____sys_sendmsg+0x331/0x810 net/socket.c:2413 ___sys_sendmsg+0xf3/0x170 net/socket.c:2467 __sys_sendmmsg+0x195/0x470 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline] __se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff8880985c4800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 776 bytes inside of 1024-byte region [ffff8880985c4800, ffff8880985c4c00) The buggy address belongs to the page: page:ffffea0002617000 refcount:1 mapcount:0 mapping:0000000000000000 index:= 0x0 pfn:0x985c0 head:ffffea0002617000 order:3 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=3D0|zone=3D1|lastcpupid=3D0x7ff) raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888010c41dc0 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(_= _GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__G= FP_HARDWALL), pid 1941, ts 1038999441284, free_ts 1033444432829 prep_new_page mm/page_alloc.c:2434 [inline] get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4165 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5389 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2271 alloc_slab_page mm/slub.c:1799 [inline] allocate_slab mm/slub.c:1944 [inline] new_slab+0x28a/0x3b0 mm/slub.c:2004 ___slab_alloc+0x87c/0xe90 mm/slub.c:3018 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3105 slab_alloc_node mm/slub.c:3196 [inline] slab_alloc mm/slub.c:3238 [inline] __kmalloc+0x2fb/0x340 mm/slub.c:4420 kmalloc include/linux/slab.h:586 [inline] kzalloc include/linux/slab.h:715 [inline] __register_sysctl_table+0x112/0x1090 fs/proc/proc_sysctl.c:1335 neigh_sysctl_register+0x2c8/0x5e0 net/core/neighbour.c:3787 devinet_sysctl_register+0xb1/0x230 net/ipv4/devinet.c:2618 inetdev_init+0x286/0x580 net/ipv4/devinet.c:278 inetdev_event+0xa8a/0x15d0 net/ipv4/devinet.c:1532 notifier_call_chain+0xb5/0x200 kernel/notifier.c:84 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1919 call_netdevice_notifiers_extack net/core/dev.c:1931 [inline] call_netdevice_notifiers net/core/dev.c:1945 [inline] register_netdevice+0x1073/0x1500 net/core/dev.c:9698 veth_newlink+0x59c/0xa90 drivers/net/veth.c:1722 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1352 [inline] free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1404 free_unref_page_prepare mm/page_alloc.c:3325 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3404 release_pages+0x748/0x1220 mm/swap.c:956 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline] tlb_flush_mmu_free mm/mmu_gather.c:243 [inline] tlb_flush_mmu+0xe9/0x6b0 mm/mmu_gather.c:250 zap_pte_range mm/memory.c:1441 [inline] zap_pmd_range mm/memory.c:1490 [inline] zap_pud_range mm/memory.c:1519 [inline] zap_p4d_range mm/memory.c:1540 [inline] unmap_page_range+0x1d1d/0x2a30 mm/memory.c:1561 unmap_single_vma+0x198/0x310 mm/memory.c:1606 unmap_vmas+0x16b/0x2f0 mm/memory.c:1638 exit_mmap+0x201/0x670 mm/mmap.c:3178 __mmput+0x122/0x4b0 kernel/fork.c:1114 mmput+0x56/0x60 kernel/fork.c:1135 exit_mm kernel/exit.c:507 [inline] do_exit+0xa3c/0x2a30 kernel/exit.c:793 do_group_exit+0xd2/0x2f0 kernel/exit.c:935 __do_sys_exit_group kernel/exit.c:946 [inline] __se_sys_exit_group kernel/exit.c:944 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:944 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Memory state around the buggy address: ffff8880985c4a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880985c4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880985c4b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880985c4b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880985c4c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc Fixes: 470502de5bdb ("net: sched: unlock rules update API") Signed-off-by: Eric Dumazet Cc: Vlad Buslov Cc: Jiri Pirko Cc: Cong Wang Reported-by: syzbot Link: https://lore.kernel.org/r/20220131172018.3704490-1-eric.dumazet@gmail= .com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- net/sched/cls_api.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -1945,9 +1945,9 @@ static int tc_new_tfilter(struct sk_buff bool prio_allocate; u32 parent; u32 chain_index; - struct Qdisc *q =3D NULL; + struct Qdisc *q; struct tcf_chain_info chain_info; - struct tcf_chain *chain =3D NULL; + struct tcf_chain *chain; struct tcf_block *block; struct tcf_proto *tp; unsigned long cl; @@ -1976,6 +1976,8 @@ replay: tp =3D NULL; cl =3D 0; block =3D NULL; + q =3D NULL; + chain =3D NULL; flags =3D 0; =20 if (prio =3D=3D 0) { @@ -2798,8 +2800,8 @@ static int tc_ctl_chain(struct sk_buff * struct tcmsg *t; u32 parent; u32 chain_index; - struct Qdisc *q =3D NULL; - struct tcf_chain *chain =3D NULL; + struct Qdisc *q; + struct tcf_chain *chain; struct tcf_block *block; unsigned long cl; int err; @@ -2809,6 +2811,7 @@ static int tc_ctl_chain(struct sk_buff * return -EPERM; =20 replay: + q =3D NULL; err =3D nlmsg_parse_deprecated(n, sizeof(*t), tca, TCA_MAX, rtm_tca_policy, extack); if (err < 0) From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8828C433EF for ; Fri, 4 Feb 2022 09:30:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358356AbiBDJaR (ORCPT ); Fri, 4 Feb 2022 04:30:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33272 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357775AbiBDJ22 (ORCPT ); Fri, 4 Feb 2022 04:28:28 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B636DC061776; Fri, 4 Feb 2022 01:27:07 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 80E19B836EE; Fri, 4 Feb 2022 09:27:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A21D1C004E1; Fri, 4 Feb 2022 09:27:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966825; bh=Ai2pTBuMpi+ZpmwAJGWmVGypw5mKsno03Np5MzaPBcI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m43e5HtfpO5oEd68qu9XGW4B1r6BCor85Gtz5Ly+pSAYg98khbr8Ez97jQ0otfHnB UG8PQevj+q4e46MscLpDoH1nsL+UpKSRZrJ7MPFjx+vbcvAdmoTfzpL6nvWQ7VCNFH frZ6SmYQauchIYfXt3TfEMwZXJf1fQ12HOVkT4NI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Jiri Pirko , Jakub Kicinski Subject: [PATCH 5.16 36/43] rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() Date: Fri, 4 Feb 2022 10:22:43 +0100 Message-Id: <20220204091918.340196380@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit c6f6f2444bdbe0079e41914a35081530d0409963 upstream. While looking at one unrelated syzbot bug, I found the replay logic in __rtnl_newlink() to potentially trigger use-after-free. It is better to clear master_dev and m_ops inside the loop, in case we have to replay it. Fixes: ba7d49b1f0f8 ("rtnetlink: provide api for getting and setting slave = info") Signed-off-by: Eric Dumazet Cc: Jiri Pirko Link: https://lore.kernel.org/r/20220201012106.216495-1-eric.dumazet@gmail.= com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- net/core/rtnetlink.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -3254,8 +3254,8 @@ static int __rtnl_newlink(struct sk_buff struct nlattr *slave_attr[RTNL_SLAVE_MAX_TYPE + 1]; unsigned char name_assign_type =3D NET_NAME_USER; struct nlattr *linkinfo[IFLA_INFO_MAX + 1]; - const struct rtnl_link_ops *m_ops =3D NULL; - struct net_device *master_dev =3D NULL; + const struct rtnl_link_ops *m_ops; + struct net_device *master_dev; struct net *net =3D sock_net(skb->sk); const struct rtnl_link_ops *ops; struct nlattr *tb[IFLA_MAX + 1]; @@ -3293,6 +3293,8 @@ replay: else dev =3D NULL; =20 + master_dev =3D NULL; + m_ops =3D NULL; if (dev) { master_dev =3D netdev_master_upper_dev_get(dev); if (master_dev) From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1ED59C433FE for ; Fri, 4 Feb 2022 09:29:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358149AbiBDJ3G (ORCPT ); Fri, 4 Feb 2022 04:29:06 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:45824 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358109AbiBDJ1J (ORCPT ); Fri, 4 Feb 2022 04:27:09 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1652461602; Fri, 4 Feb 2022 09:27:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CA12DC004E1; Fri, 4 Feb 2022 09:27:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966828; bh=jhYVlAq+c39CVsH+sSlPV4y+433+nEv9z7fvwQl2K7U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HggUP5HNJAmcCiNPq6zdR3wDaYVAfgttSjRrFIJsd0sY4UNPtYwoQSvVhOslsOy3P TaoNo2G3ae0xWSQsaYH6YLfu/nNRemHLFqIhm3nwP6lwbzZoP4S9zPbsZ+SlKmOGHe ptFQxThqRK4cGAi8dFBfaApO1C9e7qPL7dm8Mmjk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alex Elder , Jakub Kicinski Subject: [PATCH 5.16 37/43] net: ipa: request IPA register values be retained Date: Fri, 4 Feb 2022 10:22:44 +0100 Message-Id: <20220204091918.370849377@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alex Elder commit 34a081761e4e3c35381cbfad609ebae2962fe2f8 upstream. In some cases, the IPA hardware needs to request the always-on subsystem (AOSS) to coordinate with the IPA microcontroller to retain IPA register values at power collapse. This is done by issuing a QMP request to the AOSS microcontroller. A similar request ondoes that request. We must get and hold the "QMP" handle early, because we might get back EPROBE_DEFER for that. But the actual request should be sent while we know the IPA clock is active, and when we know the microcontroller is operational. Fixes: 1aac309d3207 ("net: ipa: use autosuspend") Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ipa/ipa_power.c | 52 +++++++++++++++++++++++++++++++++++++++= +++++ drivers/net/ipa/ipa_power.h | 7 +++++ drivers/net/ipa/ipa_uc.c | 5 ++++ 3 files changed, 64 insertions(+) --- a/drivers/net/ipa/ipa_power.c +++ b/drivers/net/ipa/ipa_power.c @@ -11,6 +11,8 @@ #include #include =20 +#include "linux/soc/qcom/qcom_aoss.h" + #include "ipa.h" #include "ipa_power.h" #include "ipa_endpoint.h" @@ -64,6 +66,7 @@ enum ipa_power_flag { * struct ipa_power - IPA power management information * @dev: IPA device pointer * @core: IPA core clock + * @qmp: QMP handle for AOSS communication * @spinlock: Protects modem TX queue enable/disable * @flags: Boolean state flags * @interconnect_count: Number of elements in interconnect[] @@ -72,6 +75,7 @@ enum ipa_power_flag { struct ipa_power { struct device *dev; struct clk *core; + struct qmp *qmp; spinlock_t spinlock; /* used with STOPPED/STARTED power flags */ DECLARE_BITMAP(flags, IPA_POWER_FLAG_COUNT); u32 interconnect_count; @@ -382,6 +386,47 @@ void ipa_power_modem_queue_active(struct clear_bit(IPA_POWER_FLAG_STARTED, ipa->power->flags); } =20 +static int ipa_power_retention_init(struct ipa_power *power) +{ + struct qmp *qmp =3D qmp_get(power->dev); + + if (IS_ERR(qmp)) { + if (PTR_ERR(qmp) =3D=3D -EPROBE_DEFER) + return -EPROBE_DEFER; + + /* We assume any other error means it's not defined/needed */ + qmp =3D NULL; + } + power->qmp =3D qmp; + + return 0; +} + +static void ipa_power_retention_exit(struct ipa_power *power) +{ + qmp_put(power->qmp); + power->qmp =3D NULL; +} + +/* Control register retention on power collapse */ +void ipa_power_retention(struct ipa *ipa, bool enable) +{ + static const char fmt[] =3D "{ class: bcm, res: ipa_pc, val: %c }"; + struct ipa_power *power =3D ipa->power; + char buf[36]; /* Exactly enough for fmt[]; size a multiple of 4 */ + int ret; + + if (!power->qmp) + return; /* Not needed on this platform */ + + (void)snprintf(buf, sizeof(buf), fmt, enable ? '1' : '0'); + + ret =3D qmp_send(power->qmp, buf, sizeof(buf)); + if (ret) + dev_err(power->dev, "error %d sending QMP %sable request\n", + ret, enable ? "en" : "dis"); +} + int ipa_power_setup(struct ipa *ipa) { int ret; @@ -438,12 +483,18 @@ ipa_power_init(struct device *dev, const if (ret) goto err_kfree; =20 + ret =3D ipa_power_retention_init(power); + if (ret) + goto err_interconnect_exit; + pm_runtime_set_autosuspend_delay(dev, IPA_AUTOSUSPEND_DELAY); pm_runtime_use_autosuspend(dev); pm_runtime_enable(dev); =20 return power; =20 +err_interconnect_exit: + ipa_interconnect_exit(power); err_kfree: kfree(power); err_clk_put: @@ -460,6 +511,7 @@ void ipa_power_exit(struct ipa_power *po =20 pm_runtime_disable(dev); pm_runtime_dont_use_autosuspend(dev); + ipa_power_retention_exit(power); ipa_interconnect_exit(power); kfree(power); clk_put(clk); --- a/drivers/net/ipa/ipa_power.h +++ b/drivers/net/ipa/ipa_power.h @@ -41,6 +41,13 @@ void ipa_power_modem_queue_wake(struct i void ipa_power_modem_queue_active(struct ipa *ipa); =20 /** + * ipa_power_retention() - Control register retention on power collapse + * @ipa: IPA pointer + * @enable: Whether retention should be enabled or disabled + */ +void ipa_power_retention(struct ipa *ipa, bool enable); + +/** * ipa_power_setup() - Set up IPA power management * @ipa: IPA pointer * --- a/drivers/net/ipa/ipa_uc.c +++ b/drivers/net/ipa/ipa_uc.c @@ -11,6 +11,7 @@ =20 #include "ipa.h" #include "ipa_uc.h" +#include "ipa_power.h" =20 /** * DOC: The IPA embedded microcontroller @@ -154,6 +155,7 @@ static void ipa_uc_response_hdlr(struct case IPA_UC_RESPONSE_INIT_COMPLETED: if (ipa->uc_powered) { ipa->uc_loaded =3D true; + ipa_power_retention(ipa, true); pm_runtime_mark_last_busy(dev); (void)pm_runtime_put_autosuspend(dev); ipa->uc_powered =3D false; @@ -184,6 +186,9 @@ void ipa_uc_deconfig(struct ipa *ipa) =20 ipa_interrupt_remove(ipa->interrupt, IPA_IRQ_UC_1); ipa_interrupt_remove(ipa->interrupt, IPA_IRQ_UC_0); + if (ipa->uc_loaded) + ipa_power_retention(ipa, false); + if (!ipa->uc_powered) return; =20 From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 73413C433EF for ; Fri, 4 Feb 2022 09:29:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358622AbiBDJ3K (ORCPT ); Fri, 4 Feb 2022 04:29:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32826 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358126AbiBDJ1K (ORCPT ); Fri, 4 Feb 2022 04:27:10 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 02EE6C061396; Fri, 4 Feb 2022 01:26:26 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9EA2AB817E5; Fri, 4 Feb 2022 09:26:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C3EBEC004E1; Fri, 4 Feb 2022 09:26:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966784; bh=K9TQuAKmn9gn136ka9eVPS6oux3fxlfTkn6mn0Acqxc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dY+EqGkdKQNx2aF/ZJHwVwSdUdvEw/zFHMJLpmd7Xo1gl/QFgFJPUnFpef60r6Zlz gi6G2FTn0ij8vy0nV7REivn0gLs43tVHSmVPDOSz+2taknPcAkO1/bP7D3A/3Ly14f cWWqyYCMDcUW9ZywWPkwg13Kxc9HyVdHKUUssShg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, He Fengqing , John Fastabend , Alexei Starovoitov Subject: [PATCH 5.16 38/43] bpf: Fix possible race in inc_misses_counter Date: Fri, 4 Feb 2022 10:22:45 +0100 Message-Id: <20220204091918.402198487@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: He Fengqing commit 0e3135d3bfa5dfb658145238d2bc723a8e30c3a3 upstream. It seems inc_misses_counter() suffers from same issue fixed in the commit d979617aa84d ("bpf: Fixes possible race in update_prog_stats() for 32bit arches"): As it can run while interrupts are enabled, it could be re-entered and the u64_stats syncp could be mangled. Fixes: 9ed9e9ba2337 ("bpf: Count the number of times recursion was prevente= d") Signed-off-by: He Fengqing Acked-by: John Fastabend Link: https://lore.kernel.org/r/20220122102936.1219518-1-hefengqing@huawei.= com Signed-off-by: Alexei Starovoitov Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- kernel/bpf/trampoline.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/kernel/bpf/trampoline.c +++ b/kernel/bpf/trampoline.c @@ -542,11 +542,12 @@ static __always_inline u64 notrace bpf_p static void notrace inc_misses_counter(struct bpf_prog *prog) { struct bpf_prog_stats *stats; + unsigned int flags; =20 stats =3D this_cpu_ptr(prog->stats); - u64_stats_update_begin(&stats->syncp); + flags =3D u64_stats_update_begin_irqsave(&stats->syncp); u64_stats_inc(&stats->misses); - u64_stats_update_end(&stats->syncp); + u64_stats_update_end_irqrestore(&stats->syncp, flags); } =20 /* The logic is similar to bpf_prog_run(), but with an explicit From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22E4DC433F5 for ; Fri, 4 Feb 2022 09:29:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358428AbiBDJ3P (ORCPT ); Fri, 4 Feb 2022 04:29:15 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33350 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358166AbiBDJ1M (ORCPT ); Fri, 4 Feb 2022 04:27:12 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 49F54C061397; Fri, 4 Feb 2022 01:26:30 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0B7BFB836EE; Fri, 4 Feb 2022 09:26:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 12CFBC004E1; Fri, 4 Feb 2022 09:26:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966787; bh=Hs1XBgBwYzOagplRloPnUlsaIUvnsyTiuejMIw75644=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XYnfEmvlnExLFTfGR41w6+Gz04y2KBrRdeULNNygbq8H2jvZ2bFGfLjpYdioiLKUY FfDDL9ZN/q1DE0egjvnMia7AGeGIVgL8BpDssi2fPiWbCk16iVtbIKWJcXVe8aYEBB UC75ey4NeRhiCZ53+ogUvze1PFlg26e8lUV8/hSU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tianchen Ding , Waiman Long , Tejun Heo Subject: [PATCH 5.16 39/43] cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask() Date: Fri, 4 Feb 2022 10:22:46 +0100 Message-Id: <20220204091918.433886374@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tianchen Ding commit c80d401c52a2d1baf2a5afeb06f0ffe678e56d23 upstream. subparts_cpus should be limited as a subset of cpus_allowed, but it is updated wrongly by using cpumask_andnot(). Use cpumask_and() instead to fix it. Fixes: ee8dde0cd2ce ("cpuset: Add new v2 cpuset.sched.partition flag") Signed-off-by: Tianchen Ding Reviewed-by: Waiman Long Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- kernel/cgroup/cpuset.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -1615,8 +1615,7 @@ static int update_cpumask(struct cpuset * Make sure that subparts_cpus is a subset of cpus_allowed. */ if (cs->nr_subparts_cpus) { - cpumask_andnot(cs->subparts_cpus, cs->subparts_cpus, - cs->cpus_allowed); + cpumask_and(cs->subparts_cpus, cs->subparts_cpus, cs->cpus_allowed); cs->nr_subparts_cpus =3D cpumask_weight(cs->subparts_cpus); } spin_unlock_irq(&callback_lock); From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95CB1C433FE for ; Fri, 4 Feb 2022 09:29:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238375AbiBDJ3S (ORCPT ); Fri, 4 Feb 2022 04:29:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33368 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358183AbiBDJ1M (ORCPT ); Fri, 4 Feb 2022 04:27:12 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9A699C0613A0; Fri, 4 Feb 2022 01:26:33 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 65186B817E5; Fri, 4 Feb 2022 09:26:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A00BAC004E1; Fri, 4 Feb 2022 09:26:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966791; bh=YMYuQnPuONb4tfoxDPPHXVTTN65rWcYcJS4YmBhYkt4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z1OuLAwm00uXOyXnN4A9WjBh4BwwH/WSGsrejhTYMrNL/X22fpP0ytsLCzLPXu3nw VCyPk50GTT6QvHiMJkTCX57cTbETefyCvUEDNHvDJNsCGkBWFLXVrSMys4urVm5pPQ byOV7LT3rrbPZ4EsU2pRFF46Sqn4WQhM+JKkRKlE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sasha Neftin , Nechama Kraus , Tony Nguyen Subject: [PATCH 5.16 40/43] e1000e: Handshake with CSME starts from ADL platforms Date: Fri, 4 Feb 2022 10:22:47 +0100 Message-Id: <20220204091918.466644099@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sasha Neftin commit cad014b7b5a6897d8c4fad13e2888978bfb7a53f upstream. Handshake with CSME/AMT on none provisioned platforms during S0ix flow is not supported on TGL platform and can cause to HW unit hang. Update the handshake with CSME flow to start from the ADL platform. Fixes: 3e55d231716e ("e1000e: Add handshake with the CSME to support S0ix") Signed-off-by: Sasha Neftin Tested-by: Nechama Kraus Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- drivers/net/ethernet/intel/e1000e/netdev.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/intel/e1000e/netdev.c +++ b/drivers/net/ethernet/intel/e1000e/netdev.c @@ -6345,7 +6345,8 @@ static void e1000e_s0ix_entry_flow(struc u32 mac_data; u16 phy_data; =20 - if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID) { + if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID && + hw->mac.type >=3D e1000_pch_adp) { /* Request ME configure the device for S0ix */ mac_data =3D er32(H2ME); mac_data |=3D E1000_H2ME_START_DPG; @@ -6494,7 +6495,8 @@ static void e1000e_s0ix_exit_flow(struct u16 phy_data; u32 i =3D 0; =20 - if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID) { + if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID && + hw->mac.type >=3D e1000_pch_adp) { /* Request ME unconfigure the device from S0ix */ mac_data =3D er32(H2ME); mac_data &=3D ~E1000_H2ME_START_DPG; From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09765C433F5 for ; Fri, 4 Feb 2022 09:29:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358157AbiBDJ3Y (ORCPT ); Fri, 4 Feb 2022 04:29:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33352 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358426AbiBDJ1N (ORCPT ); Fri, 4 Feb 2022 04:27:13 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DFC92C0613A6; Fri, 4 Feb 2022 01:26:35 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 87F3CB836B9; Fri, 4 Feb 2022 09:26:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B2066C004E1; Fri, 4 Feb 2022 09:26:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966794; bh=scvV+3Xpz4HcfVsrw8J0YHGJhvIXGTnL6nKF3kBBbEs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zVLpw4xe2hOCHMpSefey3hvZAaa48WFp+1A5VIV2IYJ7qkaEWrMJlURtxP9gT28cP SRSkuCBIVQTXjKf/lrnNkcD8/MBrmzBfZZemhyu9agcn3ZoGH1BA2QhgJvWYemJJBt nGAuG+YUIpn2MN5GTt1D1lHlkQkblid3RkWMc5TI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Willem de Bruijn , syzbot , Jakub Kicinski Subject: [PATCH 5.16 41/43] af_packet: fix data-race in packet_setsockopt / packet_setsockopt Date: Fri, 4 Feb 2022 10:22:48 +0100 Message-Id: <20220204091918.496128137@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit e42e70ad6ae2ae511a6143d2e8da929366e58bd9 upstream. When packet_setsockopt( PACKET_FANOUT_DATA ) reads po->fanout, no lock is held, meaning that another thread can change po->fanout. Given that po->fanout can only be set once during the socket lifetime (it is only cleared from fanout_release()), we can use READ_ONCE()/WRITE_ONCE() to document the race. BUG: KCSAN: data-race in packet_setsockopt / packet_setsockopt write to 0xffff88813ae8e300 of 8 bytes by task 14653 on cpu 0: fanout_add net/packet/af_packet.c:1791 [inline] packet_setsockopt+0x22fe/0x24a0 net/packet/af_packet.c:3931 __sys_setsockopt+0x209/0x2a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0x62/0x70 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88813ae8e300 of 8 bytes by task 14654 on cpu 1: packet_setsockopt+0x691/0x24a0 net/packet/af_packet.c:3935 __sys_setsockopt+0x209/0x2a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0x62/0x70 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x0000000000000000 -> 0xffff888106f8c000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 14654 Comm: syz-executor.3 Not tainted 5.16.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Fixes: 47dceb8ecdc1 ("packet: add classic BPF fanout mode") Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Reported-by: syzbot Link: https://lore.kernel.org/r/20220201022358.330621-1-eric.dumazet@gmail.= com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- net/packet/af_packet.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -1788,7 +1788,10 @@ static int fanout_add(struct sock *sk, s err =3D -ENOSPC; if (refcount_read(&match->sk_ref) < match->max_num_members) { __dev_remove_pack(&po->prot_hook); - po->fanout =3D match; + + /* Paired with packet_setsockopt(PACKET_FANOUT_DATA) */ + WRITE_ONCE(po->fanout, match); + po->rollover =3D rollover; rollover =3D NULL; refcount_set(&match->sk_ref, refcount_read(&match->sk_ref) + 1); @@ -3941,7 +3944,8 @@ packet_setsockopt(struct socket *sock, i } case PACKET_FANOUT_DATA: { - if (!po->fanout) + /* Paired with the WRITE_ONCE() in fanout_add() */ + if (!READ_ONCE(po->fanout)) return -EINVAL; =20 return fanout_set_data(po, optval, optlen); From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6751AC433EF for ; Fri, 4 Feb 2022 09:29:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358458AbiBDJ3b (ORCPT ); Fri, 4 Feb 2022 04:29:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33162 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357892AbiBDJ1Q (ORCPT ); Fri, 4 Feb 2022 04:27:16 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B9864C0613AB; Fri, 4 Feb 2022 01:26:39 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 85B39B836EE; Fri, 4 Feb 2022 09:26:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C073BC004E1; Fri, 4 Feb 2022 09:26:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966797; bh=FfufDGP0vbrB1uqDzoCXWRh1tSI+gT7AO7hV+VpPMYk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uppvAPa3OfxNHXDdXhXk3hqLxadu661GiM1YghAJq/tPiC7RnL9UQnU9ZSCyNl7Nx uknYVcO47eIQO0vF4HmOQuS/c0jgpI44axg2r2J9DreqJvQ2LpGSTEhUk1lUAAOw6H MPCdjgb1jKzIdSC2XZ2xqZH8U2B6U+5RgCiaoH8s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Talal Ahmad , Arjun Roy , Willem de Bruijn , Soheil Hassas Yeganeh , Jakub Kicinski Subject: [PATCH 5.16 42/43] tcp: fix mem under-charging with zerocopy sendmsg() Date: Fri, 4 Feb 2022 10:22:49 +0100 Message-Id: <20220204091918.536012051@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 479f5547239d970d3833f15f54a6481fffdb91ec upstream. We got reports of following warning in inet_sock_destruct() WARN_ON(sk_forward_alloc_get(sk)); Whenever we add a non zero-copy fragment to a pure zerocopy skb, we have to anticipate that whole skb->truesize will be uncharged when skb is finally freed. skb->data_len is the payload length. But the memory truesize estimated by __zerocopy_sg_from_iter() is page aligned. Fixes: 9b65b17db723 ("net: avoid double accounting for pure zerocopy skbs") Signed-off-by: Eric Dumazet Cc: Talal Ahmad Cc: Arjun Roy Cc: Willem de Bruijn Acked-by: Soheil Hassas Yeganeh Link: https://lore.kernel.org/r/20220201065254.680532-1-eric.dumazet@gmail.= com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- net/ipv4/tcp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1321,10 +1321,13 @@ new_segment: =20 /* skb changing from pure zc to mixed, must charge zc */ if (unlikely(skb_zcopy_pure(skb))) { - if (!sk_wmem_schedule(sk, skb->data_len)) + u32 extra =3D skb->truesize - + SKB_TRUESIZE(skb_end_offset(skb)); + + if (!sk_wmem_schedule(sk, extra)) goto wait_for_space; =20 - sk_mem_charge(sk, skb->data_len); + sk_mem_charge(sk, extra); skb_shinfo(skb)->flags &=3D ~SKBFL_PURE_ZEROCOPY; } =20 From nobody Mon Jun 29 18:37:05 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97C55C433EF for ; Fri, 4 Feb 2022 09:29:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357635AbiBDJ3f (ORCPT ); Fri, 4 Feb 2022 04:29:35 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33172 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358201AbiBDJ1R (ORCPT ); Fri, 4 Feb 2022 04:27:17 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C43A9C0613B0; Fri, 4 Feb 2022 01:26:41 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3CE93617CB; Fri, 4 Feb 2022 09:26:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EE24FC004E1; Fri, 4 Feb 2022 09:26:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643966800; bh=IrH3Lq742IEwdP6JdFAIufJs3bG7n3Dw3Q/CAabNvN8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h/2udK2YXekoS+5iq2NB51aPywb6DCg1/bb1WRmzT7Jl7gluVaxrdYlE2bsucjeAC uwFP+fkZoJsX7+KvZbIJwxovGP7GIkeuaKYa1oSH68sD7zrQv0a0KjhLiFzkFAyTFv fGRlnIzzMdMp3V0BXgqHet9qNuKEZ4D/GUmibMOM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Mat Martineau , Talal Ahmad , Arjun Roy , Willem de Bruijn , Soheil Hassas Yeganeh , Paolo Abeni , Jakub Kicinski Subject: [PATCH 5.16 43/43] tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data() Date: Fri, 4 Feb 2022 10:22:50 +0100 Message-Id: <20220204091918.568507348@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220204091917.166033635@linuxfoundation.org> References: <20220204091917.166033635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit b67985be400969578d4d4b17299714c0e5d2c07b upstream. tcp_shift_skb_data() might collapse three packets into a larger one. P_A, P_B, P_C -> P_ABC Historically, it used a single tcp_skb_can_collapse_to(P_A) call, because it was enough. In commit 85712484110d ("tcp: coalesce/collapse must respect MPTCP extensio= ns"), this call was replaced by a call to tcp_skb_can_collapse(P_A, P_B) But the now needed test over P_C has been missed. This probably broke MPTCP. Then later, commit 9b65b17db723 ("net: avoid double accounting for pure zer= ocopy skbs") added an extra condition to tcp_skb_can_collapse(), but the missing call from tcp_shift_skb_data() is also breaking TCP zerocopy, because P_A and P_C might have different skb_zcopy_pure() status. Fixes: 85712484110d ("tcp: coalesce/collapse must respect MPTCP extensions") Fixes: 9b65b17db723 ("net: avoid double accounting for pure zerocopy skbs") Signed-off-by: Eric Dumazet Cc: Mat Martineau Cc: Talal Ahmad Cc: Arjun Roy Cc: Willem de Bruijn Acked-by: Soheil Hassas Yeganeh Acked-by: Paolo Abeni Link: https://lore.kernel.org/r/20220201184640.756716-1-eric.dumazet@gmail.= com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Rudi Heitbaum Tested-by: Scott Bruce Tested-by: Shuah Khan Tested-by: Slade Watkins --- net/ipv4/tcp_input.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -1660,6 +1660,8 @@ static struct sk_buff *tcp_shift_skb_dat (mss !=3D tcp_skb_seglen(skb))) goto out; =20 + if (!tcp_skb_can_collapse(prev, skb)) + goto out; len =3D skb->len; pcount =3D tcp_skb_pcount(skb); if (tcp_skb_shift(prev, skb, pcount, len))