From nobody Fri Dec 19 20:11:24 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66831C00144 for ; Mon, 1 Aug 2022 12:09:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233641AbiHAMJG (ORCPT ); Mon, 1 Aug 2022 08:09:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43066 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233620AbiHAMIS (ORCPT ); Mon, 1 Aug 2022 08:08:18 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6E20945F6B; Mon, 1 Aug 2022 04:55:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0DE06B80E8F; Mon, 1 Aug 2022 11:55:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 64268C433D6; Mon, 1 Aug 2022 11:55:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354950; bh=6HuTgiNfY4n1mFptF3vAN268xiOhkWFB+72RZlZBRQY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PCPxHu2G2uSnx4Sb+gOdXWam3/dwy0bhfDrooFpJBvY/lm/juibM8iY9V7RAoDCAY G7r+SUggjJY7v0eMdne7x1AbHELHp48bIhswvs+rSI2bV8UXyA/n+Bei39KGfvyRz/ n3p8VubS7GwHVVzf2OEeJT/etn/BxOwtt10z1S4g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Abhishek Pandit-Subedi , Luiz Augusto von Dentz Subject: [PATCH 5.18 01/88] Bluetooth: Always set event mask on suspend Date: Mon, 1 Aug 2022 13:46:15 +0200 Message-Id: <20220801114138.109716229@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Abhishek Pandit-Subedi commit ef61b6ea154464fefd8a6712d7a3b43b445c3d4a upstream. When suspending, always set the event mask once disconnects are successful. Otherwise, if wakeup is disallowed, the event mask is not set before suspend continues and can result in an early wakeup. Fixes: 182ee45da083 ("Bluetooth: hci_sync: Rework hci_suspend_notifier") Cc: stable@vger.kernel.org Signed-off-by: Abhishek Pandit-Subedi Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/bluetooth/hci_sync.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -4942,6 +4942,9 @@ int hci_suspend_sync(struct hci_dev *hde return err; } =20 + /* Update event mask so only the allowed event can wakeup the host */ + hci_set_event_mask_sync(hdev); + /* Only configure accept list if disconnect succeeded and wake * isn't being prevented. */ @@ -4953,9 +4956,6 @@ int hci_suspend_sync(struct hci_dev *hde /* Unpause to take care of updating scanning params */ hdev->scanning_paused =3D false; =20 - /* Update event mask so only the allowed event can wakeup the host */ - hci_set_event_mask_sync(hdev); - /* Enable event filter for paired devices */ hci_update_event_filter_sync(hdev); From nobody Fri Dec 19 20:11:24 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BD510C00144 for ; Mon, 1 Aug 2022 12:10:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233861AbiHAMK2 (ORCPT ); Mon, 1 Aug 2022 08:10:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56724 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233784AbiHAMJs (ORCPT ); Mon, 1 Aug 2022 08:09:48 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AF60346DBF; Mon, 1 Aug 2022 04:56:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C7A0D61357; Mon, 1 Aug 2022 11:56:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D62C0C433C1; Mon, 1 Aug 2022 11:56:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354981; bh=M7MNhV1C71FPmODSBOm/CaAzqICWf0s9TnpNOWz+t1g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QpHKvYtXPA96lhkQVgLGBCNUcG/RngAi4W0qWy3v6tvOtlxNMTsEpfIC66CU4kHfw ZtuzpUDaMP/6KuLXCAlvZPyESrMVrIeiRHWyqLEd2N3QuS8yQk8uEI5iQIrwphPAc8 DpCPySSeQAvQBExNLyH0Jrvs6pt+kS6Y/N/mLrdw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Lee Jones , Luiz Augusto von Dentz Subject: [PATCH 5.18 02/88] Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put Date: Mon, 1 Aug 2022 13:46:16 +0200 Message-Id: <20220801114138.149636422@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Luiz Augusto von Dentz commit d0be8347c623e0ac4202a1d4e0373882821f56b0 upstream. This fixes the following trace which is caused by hci_rx_work starting up *after* the final channel reference has been put() during sock_close() but *before* the references to the channel have been destroyed, so instead the code now rely on kref_get_unless_zero/l2cap_chan_hold_unless_zero to prevent referencing a channel that is about to be destroyed. refcount_t: increment on 0; use-after-free. BUG: KASAN: use-after-free in refcount_dec_and_test+0x20/0xd0 Read of size 4 at addr ffffffc114f5bf18 by task kworker/u17:14/705 CPU: 4 PID: 705 Comm: kworker/u17:14 Tainted: G S W 4.14.234-00003-g1fb6d0bd49a4-dirty #28 Hardware name: Qualcomm Technologies, Inc. SM8150 V2 PM8150 Google Inc. MSM sm8150 Flame DVT (DT) Workqueue: hci0 hci_rx_work Call trace: dump_backtrace+0x0/0x378 show_stack+0x20/0x2c dump_stack+0x124/0x148 print_address_description+0x80/0x2e8 __kasan_report+0x168/0x188 kasan_report+0x10/0x18 __asan_load4+0x84/0x8c refcount_dec_and_test+0x20/0xd0 l2cap_chan_put+0x48/0x12c l2cap_recv_frame+0x4770/0x6550 l2cap_recv_acldata+0x44c/0x7a4 hci_acldata_packet+0x100/0x188 hci_rx_work+0x178/0x23c process_one_work+0x35c/0x95c worker_thread+0x4cc/0x960 kthread+0x1a8/0x1c4 ret_from_fork+0x10/0x18 Cc: stable@kernel.org Reported-by: Lee Jones Signed-off-by: Luiz Augusto von Dentz Tested-by: Lee Jones Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- include/net/bluetooth/l2cap.h | 1=20 net/bluetooth/l2cap_core.c | 61 +++++++++++++++++++++++++++++++++----= ----- 2 files changed, 49 insertions(+), 13 deletions(-) --- a/include/net/bluetooth/l2cap.h +++ b/include/net/bluetooth/l2cap.h @@ -847,6 +847,7 @@ enum { }; =20 void l2cap_chan_hold(struct l2cap_chan *c); +struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c); void l2cap_chan_put(struct l2cap_chan *c); =20 static inline void l2cap_chan_lock(struct l2cap_chan *chan) --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -111,7 +111,8 @@ static struct l2cap_chan *__l2cap_get_ch } =20 /* Find channel with given SCID. - * Returns locked channel. */ + * Returns a reference locked channel. + */ static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid) { @@ -119,15 +120,19 @@ static struct l2cap_chan *l2cap_get_chan =20 mutex_lock(&conn->chan_lock); c =3D __l2cap_get_chan_by_scid(conn, cid); - if (c) - l2cap_chan_lock(c); + if (c) { + /* Only lock if chan reference is not 0 */ + c =3D l2cap_chan_hold_unless_zero(c); + if (c) + l2cap_chan_lock(c); + } mutex_unlock(&conn->chan_lock); =20 return c; } =20 /* Find channel with given DCID. - * Returns locked channel. + * Returns a reference locked channel. */ static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid) @@ -136,8 +141,12 @@ static struct l2cap_chan *l2cap_get_chan =20 mutex_lock(&conn->chan_lock); c =3D __l2cap_get_chan_by_dcid(conn, cid); - if (c) - l2cap_chan_lock(c); + if (c) { + /* Only lock if chan reference is not 0 */ + c =3D l2cap_chan_hold_unless_zero(c); + if (c) + l2cap_chan_lock(c); + } mutex_unlock(&conn->chan_lock); =20 return c; @@ -162,8 +171,12 @@ static struct l2cap_chan *l2cap_get_chan =20 mutex_lock(&conn->chan_lock); c =3D __l2cap_get_chan_by_ident(conn, ident); - if (c) - l2cap_chan_lock(c); + if (c) { + /* Only lock if chan reference is not 0 */ + c =3D l2cap_chan_hold_unless_zero(c); + if (c) + l2cap_chan_lock(c); + } mutex_unlock(&conn->chan_lock); =20 return c; @@ -497,6 +510,16 @@ void l2cap_chan_hold(struct l2cap_chan * kref_get(&c->kref); } =20 +struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c) +{ + BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); + + if (!kref_get_unless_zero(&c->kref)) + return NULL; + + return c; +} + void l2cap_chan_put(struct l2cap_chan *c) { BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); @@ -1968,7 +1991,10 @@ static struct l2cap_chan *l2cap_global_c src_match =3D !bacmp(&c->src, src); dst_match =3D !bacmp(&c->dst, dst); if (src_match && dst_match) { - l2cap_chan_hold(c); + c =3D l2cap_chan_hold_unless_zero(c); + if (!c) + continue; + read_unlock(&chan_list_lock); return c; } @@ -1983,7 +2009,7 @@ static struct l2cap_chan *l2cap_global_c } =20 if (c1) - l2cap_chan_hold(c1); + c1 =3D l2cap_chan_hold_unless_zero(c1); =20 read_unlock(&chan_list_lock); =20 @@ -4463,6 +4489,7 @@ static inline int l2cap_config_req(struc =20 unlock: l2cap_chan_unlock(chan); + l2cap_chan_put(chan); return err; } =20 @@ -4577,6 +4604,7 @@ static inline int l2cap_config_rsp(struc =20 done: l2cap_chan_unlock(chan); + l2cap_chan_put(chan); return err; } =20 @@ -5304,6 +5332,7 @@ send_move_response: l2cap_send_move_chan_rsp(chan, result); =20 l2cap_chan_unlock(chan); + l2cap_chan_put(chan); =20 return 0; } @@ -5396,6 +5425,7 @@ static void l2cap_move_continue(struct l } =20 l2cap_chan_unlock(chan); + l2cap_chan_put(chan); } =20 static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid, @@ -5425,6 +5455,7 @@ static void l2cap_move_fail(struct l2cap l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); =20 l2cap_chan_unlock(chan); + l2cap_chan_put(chan); } =20 static int l2cap_move_channel_rsp(struct l2cap_conn *conn, @@ -5488,6 +5519,7 @@ static int l2cap_move_channel_confirm(st l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid); =20 l2cap_chan_unlock(chan); + l2cap_chan_put(chan); =20 return 0; } @@ -5523,6 +5555,7 @@ static inline int l2cap_move_channel_con } =20 l2cap_chan_unlock(chan); + l2cap_chan_put(chan); =20 return 0; } @@ -5895,12 +5928,11 @@ static inline int l2cap_le_credits(struc if (credits > max_credits) { BT_ERR("LE credits overflow"); l2cap_send_disconn_req(chan, ECONNRESET); - l2cap_chan_unlock(chan); =20 /* Return 0 so that we don't trigger an unnecessary * command reject packet. */ - return 0; + goto unlock; } =20 chan->tx_credits +=3D credits; @@ -5911,7 +5943,9 @@ static inline int l2cap_le_credits(struc if (chan->tx_credits) chan->ops->resume(chan); =20 +unlock: l2cap_chan_unlock(chan); + l2cap_chan_put(chan); =20 return 0; } @@ -7597,6 +7631,7 @@ drop: =20 done: l2cap_chan_unlock(chan); + l2cap_chan_put(chan); } =20 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, @@ -8085,7 +8120,7 @@ static struct l2cap_chan *l2cap_global_f if (src_type !=3D c->src_type) continue; =20 - l2cap_chan_hold(c); + c =3D l2cap_chan_hold_unless_zero(c); read_unlock(&chan_list_lock); return c; } From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A644C00144 for ; Mon, 1 Aug 2022 12:13:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234121AbiHAMNU (ORCPT ); Mon, 1 Aug 2022 08:13:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57016 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234193AbiHAMKw (ORCPT ); Mon, 1 Aug 2022 08:10:52 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CE99D6AA1B; Mon, 1 Aug 2022 04:56:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 2A5F5CE13B9; Mon, 1 Aug 2022 11:56:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1C3C3C433D6; Mon, 1 Aug 2022 11:56:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355000; bh=oONK/2x2HZCKsDsB+GoDk34waBGsK8OQ/Klc1ODe+zU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wCpaoGXEBw3pl+pA5nqe1F/phWDjBSf/taSsKZj+A0I9FzcrHuOj8f3/omTy5+6NF 4NLo6JiOyxRU7TAS3w/cFZvzT1yrl5jJb0ldqswteB7yUU9E+NvozwtK8m+JJP04tH R3bmKSYKwat1+2Rv4HedXwILDD8EKBaVgE3OlQUg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Walle , Kavyasree Kotagiri , Claudiu Beznea Subject: [PATCH 5.18 03/88] ARM: dts: lan966x: fix sys_clk frequency Date: Mon, 1 Aug 2022 13:46:17 +0200 Message-Id: <20220801114138.189784913@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Walle commit ef0324b6415db6742bd632dc0dfbb8fbc111473b upstream. The sys_clk frequency is 165.625MHz. The register reference of the Generic Clock controller lists the CPU clock as 600MHz, the DDR clock as 300MHz and the SYS clock as 162.5MHz. This is wrong. It was first noticed during the fan driver development and it was measured and verified via the CLK_MON output of the SoC which can be configured to output sys_clk/64. The core PLL settings (which drives the SYS clock) seems to be as follows: DIVF =3D 52 DIVQ =3D 3 DIVR =3D 1 With a refernce clock of 25MHz, this means we have a post divider clock Fpfd =3D Fref / (DIVR + 1) =3D 25MHz / (1 + 1) =3D 12.5MHz The resulting VCO frequency is then Fvco =3D Fpfd * (DIVF + 1) * 2 =3D 12.5MHz * (52 + 1) * 2 =3D 1325MHz And the output frequency is Fout =3D Fvco / 2^DIVQ =3D 1325MHz / 2^3 =3D 165.625Mhz This all adds up to the constrains of the PLL: 10MHz <=3D Fpfd <=3D 200MHz 20MHz <=3D Fout <=3D 1000MHz 1000MHz <=3D Fvco <=3D 2000MHz Fixes: 290deaa10c50 ("ARM: dts: add DT for lan966 SoC and 2-port board pcb8= 291") Signed-off-by: Michael Walle Reviewed-by: Kavyasree Kotagiri Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220326194028.2945985-1-michael@walle.cc Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- arch/arm/boot/dts/lan966x.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/boot/dts/lan966x.dtsi b/arch/arm/boot/dts/lan966x.dtsi index 3cb02fffe716..38e90a31d2dd 100644 --- a/arch/arm/boot/dts/lan966x.dtsi +++ b/arch/arm/boot/dts/lan966x.dtsi @@ -38,7 +38,7 @@ clocks { sys_clk: sys_clk { compatible =3D "fixed-clock"; #clock-cells =3D <0>; - clock-frequency =3D <162500000>; + clock-frequency =3D <165625000>; }; =20 cpu_clk: cpu_clk { --=20 2.37.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD1D6C00144 for ; Mon, 1 Aug 2022 12:12:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234015AbiHAMMb (ORCPT ); Mon, 1 Aug 2022 08:12:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57500 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234222AbiHAMKy (ORCPT ); Mon, 1 Aug 2022 08:10:54 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 801846BC03; Mon, 1 Aug 2022 04:56:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5B547B80EAC; Mon, 1 Aug 2022 11:56:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C54F7C433C1; Mon, 1 Aug 2022 11:56:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355003; bh=UNsBv5enHLJ3J/h7oyP4hiTFaz+6uZq+D1FX11qoP+E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wARRNarHHyRnY2a9M1fqrKIHw/S+vzvBXVCV4bd9eSxY5D2ERhg+CwY0Gfui2rqwA 5EpUMJgvjjuATxLt1NRO3WscCWAFnW/EfYWjIOU6yU5PmL1ziwk8Y0YikXSb+glnZW 4PQeYaOBWaXdXbJdN66y+abfP5VlAbcY/KaOHu7E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Laurence de Bruxelles , Linus Walleij , Arnd Bergmann Subject: [PATCH 5.18 04/88] ARM: pxa2xx: Fix GPIO descriptor tables Date: Mon, 1 Aug 2022 13:46:18 +0200 Message-Id: <20220801114138.238581181@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Linus Walleij commit c5cdb9286913aa5a5ebb81bcca0c17df3b0e2c79 upstream. Laurence reports: "Kernel >5.18 on Zaurus has a bug where the power management code can't talk to devices, emitting the following errors: sharpsl-pm sharpsl-pm: Error: AC check failed: voltage -22. sharpsl-pm sharpsl-pm: Charging Error! sharpsl-pm sharpsl-pm: Warning: Cannot read main battery! Looking at the recent changes, I found that commit 31455bbda208 ("spi: pxa2xx_spi: Convert to use GPIO descriptors") replaced the deprecated SPI chip select platform device code with a gpiod lookup table. However, this didn't seem to work until I changed the `dev_id` member from the device name to the bus id. I'm not entirely sure why this is necessary, but I suspect it is related to the fact that in sysfs SPI devices are attached under /sys/devices/.../dev_name/spi_master/spiB/spiB.C, rather than directly to the device." After reviewing the change I conclude that the same fix is needed for all affected boards. Fixes: 31455bbda208 ("spi: pxa2xx_spi: Convert to use GPIO descriptors") Reported-by: Laurence de Bruxelles Signed-off-by: Linus Walleij Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220722114611.1517414-1-linus.walleij@lina= ro.org' Signed-off-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- arch/arm/mach-pxa/corgi.c | 2 +- arch/arm/mach-pxa/hx4700.c | 2 +- arch/arm/mach-pxa/icontrol.c | 4 ++-- arch/arm/mach-pxa/littleton.c | 2 +- arch/arm/mach-pxa/magician.c | 2 +- arch/arm/mach-pxa/spitz.c | 2 +- arch/arm/mach-pxa/z2.c | 4 ++-- 7 files changed, 9 insertions(+), 9 deletions(-) --- a/arch/arm/mach-pxa/corgi.c +++ b/arch/arm/mach-pxa/corgi.c @@ -531,7 +531,7 @@ static struct pxa2xx_spi_controller corg }; =20 static struct gpiod_lookup_table corgi_spi_gpio_table =3D { - .dev_id =3D "pxa2xx-spi.1", + .dev_id =3D "spi1", .table =3D { GPIO_LOOKUP_IDX("gpio-pxa", CORGI_GPIO_ADS7846_CS, "cs", 0, GPIO_ACTIVE_= LOW), GPIO_LOOKUP_IDX("gpio-pxa", CORGI_GPIO_LCDCON_CS, "cs", 1, GPIO_ACTIVE_L= OW), --- a/arch/arm/mach-pxa/hx4700.c +++ b/arch/arm/mach-pxa/hx4700.c @@ -635,7 +635,7 @@ static struct pxa2xx_spi_controller pxa_ }; =20 static struct gpiod_lookup_table pxa_ssp2_gpio_table =3D { - .dev_id =3D "pxa2xx-spi.2", + .dev_id =3D "spi2", .table =3D { GPIO_LOOKUP_IDX("gpio-pxa", GPIO88_HX4700_TSC2046_CS, "cs", 0, GPIO_ACTI= VE_LOW), { }, --- a/arch/arm/mach-pxa/icontrol.c +++ b/arch/arm/mach-pxa/icontrol.c @@ -140,7 +140,7 @@ struct platform_device pxa_spi_ssp4 =3D { }; =20 static struct gpiod_lookup_table pxa_ssp3_gpio_table =3D { - .dev_id =3D "pxa2xx-spi.3", + .dev_id =3D "spi3", .table =3D { GPIO_LOOKUP_IDX("gpio-pxa", ICONTROL_MCP251x_nCS1, "cs", 0, GPIO_ACTIVE_= LOW), GPIO_LOOKUP_IDX("gpio-pxa", ICONTROL_MCP251x_nCS2, "cs", 1, GPIO_ACTIVE_= LOW), @@ -149,7 +149,7 @@ static struct gpiod_lookup_table pxa_ssp }; =20 static struct gpiod_lookup_table pxa_ssp4_gpio_table =3D { - .dev_id =3D "pxa2xx-spi.4", + .dev_id =3D "spi4", .table =3D { GPIO_LOOKUP_IDX("gpio-pxa", ICONTROL_MCP251x_nCS3, "cs", 0, GPIO_ACTIVE_= LOW), GPIO_LOOKUP_IDX("gpio-pxa", ICONTROL_MCP251x_nCS4, "cs", 1, GPIO_ACTIVE_= LOW), --- a/arch/arm/mach-pxa/littleton.c +++ b/arch/arm/mach-pxa/littleton.c @@ -208,7 +208,7 @@ static struct spi_board_info littleton_s }; =20 static struct gpiod_lookup_table littleton_spi_gpio_table =3D { - .dev_id =3D "pxa2xx-spi.2", + .dev_id =3D "spi2", .table =3D { GPIO_LOOKUP_IDX("gpio-pxa", LITTLETON_GPIO_LCD_CS, "cs", 0, GPIO_ACTIVE_= LOW), { }, --- a/arch/arm/mach-pxa/magician.c +++ b/arch/arm/mach-pxa/magician.c @@ -946,7 +946,7 @@ static struct pxa2xx_spi_controller magi }; =20 static struct gpiod_lookup_table magician_spi_gpio_table =3D { - .dev_id =3D "pxa2xx-spi.2", + .dev_id =3D "spi2", .table =3D { /* NOTICE must be GPIO, incompatibility with hw PXA SPI framing */ GPIO_LOOKUP_IDX("gpio-pxa", GPIO14_MAGICIAN_TSC2046_CS, "cs", 0, GPIO_AC= TIVE_LOW), --- a/arch/arm/mach-pxa/spitz.c +++ b/arch/arm/mach-pxa/spitz.c @@ -578,7 +578,7 @@ static struct pxa2xx_spi_controller spit }; =20 static struct gpiod_lookup_table spitz_spi_gpio_table =3D { - .dev_id =3D "pxa2xx-spi.2", + .dev_id =3D "spi2", .table =3D { GPIO_LOOKUP_IDX("gpio-pxa", SPITZ_GPIO_ADS7846_CS, "cs", 0, GPIO_ACTIVE_= LOW), GPIO_LOOKUP_IDX("gpio-pxa", SPITZ_GPIO_LCDCON_CS, "cs", 1, GPIO_ACTIVE_L= OW), --- a/arch/arm/mach-pxa/z2.c +++ b/arch/arm/mach-pxa/z2.c @@ -623,7 +623,7 @@ static struct pxa2xx_spi_controller pxa_ }; =20 static struct gpiod_lookup_table pxa_ssp1_gpio_table =3D { - .dev_id =3D "pxa2xx-spi.1", + .dev_id =3D "spi1", .table =3D { GPIO_LOOKUP_IDX("gpio-pxa", GPIO24_ZIPITZ2_WIFI_CS, "cs", 0, GPIO_ACTIVE= _LOW), { }, @@ -631,7 +631,7 @@ static struct gpiod_lookup_table pxa_ssp }; =20 static struct gpiod_lookup_table pxa_ssp2_gpio_table =3D { - .dev_id =3D "pxa2xx-spi.2", + .dev_id =3D "spi2", .table =3D { GPIO_LOOKUP_IDX("gpio-pxa", GPIO88_ZIPITZ2_LCD_CS, "cs", 0, GPIO_ACTIVE_= LOW), { }, From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6566EC00144 for ; Mon, 1 Aug 2022 12:12:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233143AbiHAMMh (ORCPT ); Mon, 1 Aug 2022 08:12:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57550 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234243AbiHAMK5 (ORCPT ); Mon, 1 Aug 2022 08:10:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9811A6BC0D; Mon, 1 Aug 2022 04:56:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 782116010C; Mon, 1 Aug 2022 11:56:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53939C433C1; Mon, 1 Aug 2022 11:56:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355005; bh=6NF7vDSmopqfD1FN2vWLgUBEVHkIgrgT9Qr7AExNFYo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Wh1M/Kt1LpxZE2EbbppXvIrJ8yL6xXi89P3UZbky2lVoF5P/Ee8A/RrAeVKREwQcw qMtHDYl9z5qBaMyQCtgyyYr49zVLYqLEYvIwnutCyHJYXbgXtDd1+/qEO6l3O+Gk68 7loL7iPJl9c8VPhN8g3kQsMvYsXyKOWB/xTNorYo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Junxiao Bi , Joseph Qi , Mark Fasheh , Joel Becker , Changwei Ge , Gang He , Jun Piao , heming.zhao@suse.com, Andrew Morton Subject: [PATCH 5.18 05/88] Revert "ocfs2: mount shared volume without ha stack" Date: Mon, 1 Aug 2022 13:46:19 +0200 Message-Id: <20220801114138.287111701@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Junxiao Bi commit c80af0c250c8f8a3c978aa5aafbe9c39b336b813 upstream. This reverts commit 912f655d78c5d4ad05eac287f23a435924df7144. This commit introduced a regression that can cause mount hung. The changes in __ocfs2_find_empty_slot causes that any node with none-zero node number can grab the slot that was already taken by node 0, so node 1 will access the same journal with node 0, when it try to grab journal cluster lock, it will hung because it was already acquired by node 0. It's very easy to reproduce this, in one cluster, mount node 0 first, then node 1, you will see the following call trace from node 1. [13148.735424] INFO: task mount.ocfs2:53045 blocked for more than 122 secon= ds. [13148.739691] Not tainted 5.15.0-2148.0.4.el8uek.mountracev2.x86_64 = #2 [13148.742560] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables = this message. [13148.745846] task:mount.ocfs2 state:D stack: 0 pid:53045 ppid: 530= 44 flags:0x00004000 [13148.749354] Call Trace: [13148.750718] [13148.752019] ? usleep_range+0x90/0x89 [13148.753882] __schedule+0x210/0x567 [13148.755684] schedule+0x44/0xa8 [13148.757270] schedule_timeout+0x106/0x13c [13148.759273] ? __prepare_to_swait+0x53/0x78 [13148.761218] __wait_for_common+0xae/0x163 [13148.763144] __ocfs2_cluster_lock.constprop.0+0x1d6/0x870 [ocfs2] [13148.765780] ? ocfs2_inode_lock_full_nested+0x18d/0x398 [ocfs2] [13148.768312] ocfs2_inode_lock_full_nested+0x18d/0x398 [ocfs2] [13148.770968] ocfs2_journal_init+0x91/0x340 [ocfs2] [13148.773202] ocfs2_check_volume+0x39/0x461 [ocfs2] [13148.775401] ? iput+0x69/0xba [13148.777047] ocfs2_mount_volume.isra.0.cold+0x40/0x1f5 [ocfs2] [13148.779646] ocfs2_fill_super+0x54b/0x853 [ocfs2] [13148.781756] mount_bdev+0x190/0x1b7 [13148.783443] ? ocfs2_remount+0x440/0x440 [ocfs2] [13148.785634] legacy_get_tree+0x27/0x48 [13148.787466] vfs_get_tree+0x25/0xd0 [13148.789270] do_new_mount+0x18c/0x2d9 [13148.791046] __x64_sys_mount+0x10e/0x142 [13148.792911] do_syscall_64+0x3b/0x89 [13148.794667] entry_SYSCALL_64_after_hwframe+0x170/0x0 [13148.797051] RIP: 0033:0x7f2309f6e26e [13148.798784] RSP: 002b:00007ffdcee7d408 EFLAGS: 00000246 ORIG_RAX: 000000= 00000000a5 [13148.801974] RAX: ffffffffffffffda RBX: 00007ffdcee7d4a0 RCX: 00007f2309f= 6e26e [13148.804815] RDX: 0000559aa762a8ae RSI: 0000559aa939d340 RDI: 0000559aa93= a22b0 [13148.807719] RBP: 00007ffdcee7d5b0 R08: 0000559aa93a2290 R09: 00007f230a0= b4820 [13148.810659] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdcee= 7d420 [13148.813609] R13: 0000000000000000 R14: 0000559aa939f000 R15: 00000000000= 00000 [13148.816564] To fix it, we can just fix __ocfs2_find_empty_slot. But original commit introduced the feature to mount ocfs2 locally even it is cluster based, that is a very dangerous, it can easily cause serious data corruption, there is no way to stop other nodes mounting the fs and corrupting it. Setup ha or other cluster-aware stack is just the cost that we have to take for avoiding corruption, otherwise we have to do it in kernel. Link: https://lkml.kernel.org/r/20220603222801.42488-1-junxiao.bi@oracle.com Fixes: 912f655d78c5("ocfs2: mount shared volume without ha stack") Signed-off-by: Junxiao Bi Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- fs/ocfs2/ocfs2.h | 4 +--- fs/ocfs2/slot_map.c | 46 +++++++++++++++++++--------------------------- fs/ocfs2/super.c | 21 --------------------- 3 files changed, 20 insertions(+), 51 deletions(-) --- a/fs/ocfs2/ocfs2.h +++ b/fs/ocfs2/ocfs2.h @@ -277,7 +277,6 @@ enum ocfs2_mount_options OCFS2_MOUNT_JOURNAL_ASYNC_COMMIT =3D 1 << 15, /* Journal Async Commit */ OCFS2_MOUNT_ERRORS_CONT =3D 1 << 16, /* Return EIO to the calling process= on error */ OCFS2_MOUNT_ERRORS_ROFS =3D 1 << 17, /* Change filesystem to read-only on= error */ - OCFS2_MOUNT_NOCLUSTER =3D 1 << 18, /* No cluster aware filesystem mount */ }; =20 #define OCFS2_OSB_SOFT_RO 0x0001 @@ -673,8 +672,7 @@ static inline int ocfs2_cluster_o2cb_glo =20 static inline int ocfs2_mount_local(struct ocfs2_super *osb) { - return ((osb->s_feature_incompat & OCFS2_FEATURE_INCOMPAT_LOCAL_MOUNT) - || (osb->s_mount_opt & OCFS2_MOUNT_NOCLUSTER)); + return (osb->s_feature_incompat & OCFS2_FEATURE_INCOMPAT_LOCAL_MOUNT); } =20 static inline int ocfs2_uses_extended_slot_map(struct ocfs2_super *osb) --- a/fs/ocfs2/slot_map.c +++ b/fs/ocfs2/slot_map.c @@ -252,16 +252,14 @@ static int __ocfs2_find_empty_slot(struc int i, ret =3D -ENOSPC; =20 if ((preferred >=3D 0) && (preferred < si->si_num_slots)) { - if (!si->si_slots[preferred].sl_valid || - !si->si_slots[preferred].sl_node_num) { + if (!si->si_slots[preferred].sl_valid) { ret =3D preferred; goto out; } } =20 for(i =3D 0; i < si->si_num_slots; i++) { - if (!si->si_slots[i].sl_valid || - !si->si_slots[i].sl_node_num) { + if (!si->si_slots[i].sl_valid) { ret =3D i; break; } @@ -456,30 +454,24 @@ int ocfs2_find_slot(struct ocfs2_super * spin_lock(&osb->osb_lock); ocfs2_update_slot_info(si); =20 - if (ocfs2_mount_local(osb)) - /* use slot 0 directly in local mode */ - slot =3D 0; - else { - /* search for ourselves first and take the slot if it already - * exists. Perhaps we need to mark this in a variable for our - * own journal recovery? Possibly not, though we certainly - * need to warn to the user */ - slot =3D __ocfs2_node_num_to_slot(si, osb->node_num); + /* search for ourselves first and take the slot if it already + * exists. Perhaps we need to mark this in a variable for our + * own journal recovery? Possibly not, though we certainly + * need to warn to the user */ + slot =3D __ocfs2_node_num_to_slot(si, osb->node_num); + if (slot < 0) { + /* if no slot yet, then just take 1st available + * one. */ + slot =3D __ocfs2_find_empty_slot(si, osb->preferred_slot); if (slot < 0) { - /* if no slot yet, then just take 1st available - * one. */ - slot =3D __ocfs2_find_empty_slot(si, osb->preferred_slot); - if (slot < 0) { - spin_unlock(&osb->osb_lock); - mlog(ML_ERROR, "no free slots available!\n"); - status =3D -EINVAL; - goto bail; - } - } else - printk(KERN_INFO "ocfs2: Slot %d on device (%s) was " - "already allocated to this node!\n", - slot, osb->dev_str); - } + spin_unlock(&osb->osb_lock); + mlog(ML_ERROR, "no free slots available!\n"); + status =3D -EINVAL; + goto bail; + } + } else + printk(KERN_INFO "ocfs2: Slot %d on device (%s) was already " + "allocated to this node!\n", slot, osb->dev_str); =20 ocfs2_set_slot(si, slot, osb->node_num); osb->slot_num =3D slot; --- a/fs/ocfs2/super.c +++ b/fs/ocfs2/super.c @@ -172,7 +172,6 @@ enum { Opt_dir_resv_level, Opt_journal_async_commit, Opt_err_cont, - Opt_nocluster, Opt_err, }; =20 @@ -206,7 +205,6 @@ static const match_table_t tokens =3D { {Opt_dir_resv_level, "dir_resv_level=3D%u"}, {Opt_journal_async_commit, "journal_async_commit"}, {Opt_err_cont, "errors=3Dcontinue"}, - {Opt_nocluster, "nocluster"}, {Opt_err, NULL} }; =20 @@ -618,13 +616,6 @@ static int ocfs2_remount(struct super_bl goto out; } =20 - tmp =3D OCFS2_MOUNT_NOCLUSTER; - if ((osb->s_mount_opt & tmp) !=3D (parsed_options.mount_opt & tmp)) { - ret =3D -EINVAL; - mlog(ML_ERROR, "Cannot change nocluster option on remount\n"); - goto out; - } - tmp =3D OCFS2_MOUNT_HB_LOCAL | OCFS2_MOUNT_HB_GLOBAL | OCFS2_MOUNT_HB_NONE; if ((osb->s_mount_opt & tmp) !=3D (parsed_options.mount_opt & tmp)) { @@ -865,7 +856,6 @@ static int ocfs2_verify_userspace_stack( } =20 if (ocfs2_userspace_stack(osb) && - !(osb->s_mount_opt & OCFS2_MOUNT_NOCLUSTER) && strncmp(osb->osb_cluster_stack, mopt->cluster_stack, OCFS2_STACK_LABEL_LEN)) { mlog(ML_ERROR, @@ -1144,11 +1134,6 @@ static int ocfs2_fill_super(struct super osb->s_mount_opt & OCFS2_MOUNT_DATA_WRITEBACK ? "writeback" : "ordered"); =20 - if ((osb->s_mount_opt & OCFS2_MOUNT_NOCLUSTER) && - !(osb->s_feature_incompat & OCFS2_FEATURE_INCOMPAT_LOCAL_MOUNT)) - printk(KERN_NOTICE "ocfs2: The shared device (%s) is mounted " - "without cluster aware mode.\n", osb->dev_str); - atomic_set(&osb->vol_state, VOLUME_MOUNTED); wake_up(&osb->osb_mount_event); =20 @@ -1455,9 +1440,6 @@ static int ocfs2_parse_options(struct su case Opt_journal_async_commit: mopt->mount_opt |=3D OCFS2_MOUNT_JOURNAL_ASYNC_COMMIT; break; - case Opt_nocluster: - mopt->mount_opt |=3D OCFS2_MOUNT_NOCLUSTER; - break; default: mlog(ML_ERROR, "Unrecognized mount option \"%s\" " @@ -1569,9 +1551,6 @@ static int ocfs2_show_options(struct seq if (opts & OCFS2_MOUNT_JOURNAL_ASYNC_COMMIT) seq_printf(s, ",journal_async_commit"); =20 - if (opts & OCFS2_MOUNT_NOCLUSTER) - seq_printf(s, ",nocluster"); - return 0; } From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8993BC00144 for ; Mon, 1 Aug 2022 12:12:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233771AbiHAMMm (ORCPT ); Mon, 1 Aug 2022 08:12:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56204 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234283AbiHAMLA (ORCPT ); Mon, 1 Aug 2022 08:11:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 22F3F6BD45; Mon, 1 Aug 2022 04:56:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 19A8A60011; Mon, 1 Aug 2022 11:56:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 28E7DC433C1; Mon, 1 Aug 2022 11:56:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355008; bh=RvFHyvGJzY+uaEiB2xf4kqheVPtJGbgE+quiYvzgbgU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ty16jX3wFs59GYrmFwAEhrytwTXOvmu4wOiMd15Oc2/grNJY6NNXVjJvqIZ2KSlAX WR+LeKnV4dDedqW7mZL7vNC5DZk3jKnLjyvRovbnoQum/ueT1ocb9pY+SCbJ7sK2ri k/A1980JBZIGFduXBiZvEwsAosXUMZvYvPmM0mcY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nadav Amit , James Houghton , Mike Rapoport , Peter Xu , David Hildenbrand , Jan Kara , Andrea Arcangeli , Andrew Morton Subject: [PATCH 5.18 06/88] userfaultfd: provide properly masked address for huge-pages Date: Mon, 1 Aug 2022 13:46:20 +0200 Message-Id: <20220801114138.328635281@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nadav Amit commit d172b1a3bd065dd89234eac547fc62cf80681631 upstream. Commit 824ddc601adc ("userfaultfd: provide unmasked address on page-fault") was introduced to fix an old bug, in which the offset in the address of a page-fault was masked. Concerns were raised - although were never backed by actual code - that some userspace code might break because the bug has been around for quite a while. To address these concerns a new flag was introduced, and only when this flag is set by the user, userfaultfd provides the exact address of the page-fault. The commit however had a bug, and if the flag is unset, the offset was always masked based on a base-page granularity. Yet, for huge-pages, the behavior prior to the commit was that the address is masked to the huge-page granulrity. While there are no reports on real breakage, fix this issue. If the flag is unset, use the address with the masking that was done before. Link: https://lkml.kernel.org/r/20220711165906.2682-1-namit@vmware.com Fixes: 824ddc601adc ("userfaultfd: provide unmasked address on page-fault") Signed-off-by: Nadav Amit Reported-by: James Houghton Reviewed-by: Mike Rapoport Reviewed-by: Peter Xu Reviewed-by: James Houghton Cc: David Hildenbrand Cc: Jan Kara Cc: Andrea Arcangeli Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- fs/userfaultfd.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -191,17 +191,19 @@ static inline void msg_init(struct uffd_ } =20 static inline struct uffd_msg userfault_msg(unsigned long address, + unsigned long real_address, unsigned int flags, unsigned long reason, unsigned int features) { struct uffd_msg msg; + msg_init(&msg); msg.event =3D UFFD_EVENT_PAGEFAULT; =20 - if (!(features & UFFD_FEATURE_EXACT_ADDRESS)) - address &=3D PAGE_MASK; - msg.arg.pagefault.address =3D address; + msg.arg.pagefault.address =3D (features & UFFD_FEATURE_EXACT_ADDRESS) ? + real_address : address; + /* * These flags indicate why the userfault occurred: * - UFFD_PAGEFAULT_FLAG_WP indicates a write protect fault. @@ -485,8 +487,8 @@ vm_fault_t handle_userfault(struct vm_fa =20 init_waitqueue_func_entry(&uwq.wq, userfaultfd_wake_function); uwq.wq.private =3D current; - uwq.msg =3D userfault_msg(vmf->real_address, vmf->flags, reason, - ctx->features); + uwq.msg =3D userfault_msg(vmf->address, vmf->real_address, vmf->flags, + reason, ctx->features); uwq.ctx =3D ctx; uwq.waken =3D false; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3009FC00144 for ; Mon, 1 Aug 2022 12:12:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234059AbiHAMMq (ORCPT ); Mon, 1 Aug 2022 08:12:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55804 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234390AbiHAMLO (ORCPT ); Mon, 1 Aug 2022 08:11:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E7EC76D2D7; Mon, 1 Aug 2022 04:56:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8736BB8117B; Mon, 1 Aug 2022 11:56:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E7D66C433D6; Mon, 1 Aug 2022 11:56:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355011; bh=VBH1TpZZyZwT5mtyysWp68ObVLFEUBt+O5pRICLEnDY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vBjdHoLQgR6xbMUjpUNqIwUGN3PtC0ZaCX/fs1TdOIDzBiq2ZbfjKRrC169y/2IMc 2krz+fuqSyYrnqC8/Mpye/3jPQiYD1A8LhOCB1COTwo6Jocrtq2fbnr0hHqleWLopt Q0V2h/vkcxRcOKZ5ftu7iHbEJcW/36lF0krdHX4w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, ChenXiaoSong , Hawkins Jiawei , Anton Altaparmakov , Yongqiang Liu , Zhang Yi , Zhang Xiaoxu , Andrew Morton Subject: [PATCH 5.18 07/88] ntfs: fix use-after-free in ntfs_ucsncmp() Date: Mon, 1 Aug 2022 13:46:21 +0200 Message-Id: <20220801114138.378177152@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: ChenXiaoSong commit 38c9c22a85aeed28d0831f230136e9cf6fa2ed44 upstream. Syzkaller reported use-after-free bug as follows: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: use-after-free in ntfs_ucsncmp+0x123/0x130 Read of size 2 at addr ffff8880751acee8 by task a.out/879 CPU: 7 PID: 879 Comm: a.out Not tainted 5.19.0-rc4-next-20220630-00001-gcc5= 218c8bd2c-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd= 239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x1c0/0x2b0 print_address_description.constprop.0.cold+0xd4/0x484 print_report.cold+0x55/0x232 kasan_report+0xbf/0xf0 ntfs_ucsncmp+0x123/0x130 ntfs_are_names_equal.cold+0x2b/0x41 ntfs_attr_find+0x43b/0xb90 ntfs_attr_lookup+0x16d/0x1e0 ntfs_read_locked_attr_inode+0x4aa/0x2360 ntfs_attr_iget+0x1af/0x220 ntfs_read_locked_inode+0x246c/0x5120 ntfs_iget+0x132/0x180 load_system_files+0x1cc6/0x3480 ntfs_fill_super+0xa66/0x1cf0 mount_bdev+0x38d/0x460 legacy_get_tree+0x10d/0x220 vfs_get_tree+0x93/0x300 do_new_mount+0x2da/0x6d0 path_mount+0x496/0x19d0 __x64_sys_mount+0x284/0x300 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f3f2118d9ea Code: 48 8b 0d a9 f4 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 = 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 8b 0d 76 f4 0b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffc269deac8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3f2118d9ea RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc269dec00 RBP: 00007ffc269dec80 R08: 00007ffc269deb00 R09: 00007ffc269dec44 R10: 0000000000000000 R11: 0000000000000202 R12: 000055f81ab1d220 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 The buggy address belongs to the physical page: page:0000000085430378 refcount:1 mapcount:1 mapping:0000000000000000 index:= 0x555c6a81d pfn:0x751ac memcg:ffff888101f7e180 anon flags: 0xfffffc00a0014(uptodate|lru|mappedtodisk|swapbacked|node=3D0|z= one=3D1|lastcpupid=3D0x1fffff) raw: 000fffffc00a0014 ffffea0001bf2988 ffffea0001de2448 ffff88801712e201 raw: 0000000555c6a81d 0000000000000000 0000000100000000 ffff888101f7e180 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880751acd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880751ace00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880751ace80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff8880751acf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880751acf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The reason is that struct ATTR_RECORD->name_offset is 6485, end address of name string is out of bounds. Fix this by adding sanity check on end address of attribute name string. [akpm@linux-foundation.org: coding-style cleanups] [chenxiaosong2@huawei.com: cleanup suggested by Hawkins Jiawei] Link: https://lkml.kernel.org/r/20220709064511.3304299-1-chenxiaosong2@hu= awei.com Link: https://lkml.kernel.org/r/20220707105329.4020708-1-chenxiaosong2@huaw= ei.com Signed-off-by: ChenXiaoSong Signed-off-by: Hawkins Jiawei Cc: Anton Altaparmakov Cc: ChenXiaoSong Cc: Yongqiang Liu Cc: Zhang Yi Cc: Zhang Xiaoxu Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- fs/ntfs/attrib.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/fs/ntfs/attrib.c +++ b/fs/ntfs/attrib.c @@ -592,8 +592,12 @@ static int ntfs_attr_find(const ATTR_TYP a =3D (ATTR_RECORD*)((u8*)ctx->attr + le32_to_cpu(ctx->attr->length)); for (;; a =3D (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))) { - if ((u8*)a < (u8*)ctx->mrec || (u8*)a > (u8*)ctx->mrec + - le32_to_cpu(ctx->mrec->bytes_allocated)) + u8 *mrec_end =3D (u8 *)ctx->mrec + + le32_to_cpu(ctx->mrec->bytes_allocated); + u8 *name_end =3D (u8 *)a + le16_to_cpu(a->name_offset) + + a->name_length * sizeof(ntfschar); + if ((u8*)a < (u8*)ctx->mrec || (u8*)a > mrec_end || + name_end > mrec_end) break; ctx->attr =3D a; if (unlikely(le32_to_cpu(a->type) > le32_to_cpu(type) || From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9AE3C00144 for ; Mon, 1 Aug 2022 12:12:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234038AbiHAMMx (ORCPT ); Mon, 1 Aug 2022 08:12:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59472 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234452AbiHAMLT (ORCPT ); Mon, 1 Aug 2022 08:11:19 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5E4C86D575; Mon, 1 Aug 2022 04:57:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3CED1B80E8F; Mon, 1 Aug 2022 11:56:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A2494C433D6; Mon, 1 Aug 2022 11:56:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355014; bh=fBocT6bum1EtRI8WqnaZX72t0t2OdnKuGvPTbs2rxwY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Zg3JkKF6r6YQs6CJHcE1T1324xYhnfEQHXABi0S7M9X2Yyt8uv+yxbHCqnPR1bEHg JYb1pnIREDBwqNkCZeNFkLHGrsG769s19v0N9j5huGapP0P3wlZLwXwCOjAEGOpCey 5WD9srjLjj9WFuB38Nt3k9ot5DqQ7STdJ43j5aXI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrei Vagin , Al Viro , Andrew Morton Subject: [PATCH 5.18 08/88] fs: sendfile handles O_NONBLOCK of out_fd Date: Mon, 1 Aug 2022 13:46:22 +0200 Message-Id: <20220801114138.428187170@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andrei Vagin commit bdeb77bc2c405fa9f954c20269db175a0bd2793f upstream. sendfile has to return EAGAIN if out_fd is nonblocking and the write into it would block. Here is a small reproducer for the problem: #define _GNU_SOURCE /* See feature_test_macros(7) */ #include #include #include #include #include #include #include #define FILE_SIZE (1UL << 30) int main(int argc, char **argv) { int p[2], fd; if (pipe2(p, O_NONBLOCK)) return 1; fd =3D open(argv[1], O_RDWR | O_TMPFILE, 0666); if (fd < 0) return 1; ftruncate(fd, FILE_SIZE); if (sendfile(p[1], fd, 0, FILE_SIZE) =3D=3D -1) { fprintf(stderr, "FAIL\n"); } if (sendfile(p[1], fd, 0, FILE_SIZE) !=3D -1 || errno !=3D EAGAIN) { fprintf(stderr, "FAIL\n"); } return 0; } It worked before b964bf53e540, it is stuck after b964bf53e540, and it works again with this fix. This regression occurred because do_splice_direct() calls pipe_write that handles O_NONBLOCK. Here is a trace log from the reproducer: 1) | __x64_sys_sendfile64() { 1) | do_sendfile() { 1) | __fdget() 1) | rw_verify_area() 1) | __fdget() 1) | rw_verify_area() 1) | do_splice_direct() { 1) | rw_verify_area() 1) | splice_direct_to_actor() { 1) | do_splice_to() { 1) | rw_verify_area() 1) | generic_file_splice_read() 1) + 74.153 us | } 1) | direct_splice_actor() { 1) | iter_file_splice_write() { 1) | __kmalloc() 1) 0.148 us | pipe_lock(); 1) 0.153 us | splice_from_pipe_next.part.0(); 1) 0.162 us | page_cache_pipe_buf_confirm(); ... 16 times 1) 0.159 us | page_cache_pipe_buf_confirm(); 1) | vfs_iter_write() { 1) | do_iter_write() { 1) | rw_verify_area() 1) | do_iter_readv_writev() { 1) | pipe_write() { 1) | mutex_lock() 1) 0.153 us | mutex_unlock(); 1) 1.368 us | } 1) 1.686 us | } 1) 5.798 us | } 1) 6.084 us | } 1) 0.174 us | kfree(); 1) 0.152 us | pipe_unlock(); 1) + 14.461 us | } 1) + 14.783 us | } 1) 0.164 us | page_cache_pipe_buf_release(); ... 16 times 1) 0.161 us | page_cache_pipe_buf_release(); 1) | touch_atime() 1) + 95.854 us | } 1) + 99.784 us | } 1) ! 107.393 us | } 1) ! 107.699 us | } Link: https://lkml.kernel.org/r/20220415005015.525191-1-avagin@gmail.com Fixes: b964bf53e540 ("teach sendfile(2) to handle send-to-pipe directly") Signed-off-by: Andrei Vagin Cc: Al Viro Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- fs/read_write.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/read_write.c +++ b/fs/read_write.c @@ -1247,6 +1247,9 @@ static ssize_t do_sendfile(int out_fd, i count, fl); file_end_write(out.file); } else { + if (out.file->f_flags & O_NONBLOCK) + fl |=3D SPLICE_F_NONBLOCK; + retval =3D splice_file_to_pipe(in.file, opipe, &pos, count, fl); } From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF572C19F2A for ; Mon, 1 Aug 2022 12:12:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234079AbiHAMM6 (ORCPT ); Mon, 1 Aug 2022 08:12:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56404 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234546AbiHAMLc (ORCPT ); Mon, 1 Aug 2022 08:11:32 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 203E46D9DD; Mon, 1 Aug 2022 04:57:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 47B11CE1157; Mon, 1 Aug 2022 11:56:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3052FC433C1; Mon, 1 Aug 2022 11:56:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355016; bh=1xQzkJlJeh3JRwYMZ2gPgu1RdYcreTmV/vQFcY48FdU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OmyuEJxNCzF53FAPPFeB5T8GKo1CMpjMOFSxV0GCh5XPQv2TLEy/ryRzExS+M+SKb gz4QesRAqKB7eELfa+t3Y2mXWe+KqVinlPbtm5tSt1+1XGAysw3KkkehWJJmPGUNJi g8uhRYiVKMKXi8VgwKY5FiE9qpEnkRxYn03ZQkJA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+9bd2b7adbd34b30b87e4@syzkaller.appspotmail.com, Mike Rapoport , Eric Biggers , Axel Rasmussen , Jan Kara , Hillf Danton , Matthew Wilcox , Andrew Morton Subject: [PATCH 5.18 09/88] secretmem: fix unhandled fault in truncate Date: Mon, 1 Aug 2022 13:46:23 +0200 Message-Id: <20220801114138.478244647@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Rapoport commit 84ac013046ccc438af04b7acecd4d3ab84fe4bde upstream. syzkaller reports the following issue: BUG: unable to handle page fault for address: ffff888021f7e005 PGD 11401067 P4D 11401067 PUD 11402067 PMD 21f7d063 PTE 800fffffde081060 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 0 PID: 3761 Comm: syz-executor281 Not tainted 5.19.0-rc4-syzkaller-000= 14-g941e3e791269 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 RIP: 0010:memset_erms+0x9/0x10 arch/x86/lib/memset_64.S:64 Code: c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 = ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 aa 4c 89 c8 c= 3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01 RSP: 0018:ffffc9000329fa90 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000001000 RCX: 0000000000000ffb RDX: 0000000000000ffb RSI: 0000000000000000 RDI: ffff888021f7e005 RBP: ffffea000087df80 R08: 0000000000000001 R09: ffff888021f7e005 R10: ffffed10043efdff R11: 0000000000000000 R12: 0000000000000005 R13: 0000000000000000 R14: 0000000000001000 R15: 0000000000000ffb FS: 00007fb29d8b2700(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff888021f7e005 CR3: 0000000026e7b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: zero_user_segments include/linux/highmem.h:272 [inline] folio_zero_range include/linux/highmem.h:428 [inline] truncate_inode_partial_folio+0x76a/0xdf0 mm/truncate.c:237 truncate_inode_pages_range+0x83b/0x1530 mm/truncate.c:381 truncate_inode_pages mm/truncate.c:452 [inline] truncate_pagecache+0x63/0x90 mm/truncate.c:753 simple_setattr+0xed/0x110 fs/libfs.c:535 secretmem_setattr+0xae/0xf0 mm/secretmem.c:170 notify_change+0xb8c/0x12b0 fs/attr.c:424 do_truncate+0x13c/0x200 fs/open.c:65 do_sys_ftruncate+0x536/0x730 fs/open.c:193 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fb29d900899 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb29d8b2318 EFLAGS: 00000246 ORIG_RAX: 000000000000004d RAX: ffffffffffffffda RBX: 00007fb29d988408 RCX: 00007fb29d900899 RDX: 00007fb29d900899 RSI: 0000000000000005 RDI: 0000000000000003 RBP: 00007fb29d988400 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb29d98840c R13: 00007ffca01a23bf R14: 00007fb29d8b2400 R15: 0000000000022000 Modules linked in: CR2: ffff888021f7e005 Reported-by: syzbot+9bd2b7adbd34b30b87e4@syzkaller.appspotmail.com Reviewed-by: Axel Rasmussen Reviewed-by: Jan Kara Suggested-by: Eric Biggers Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz ---[ end trace 0000000000000000 ]--- Eric Biggers suggested that this happens when secretmem_setattr()->simple_setattr() races with secretmem_fault() so that a page that is faulted in by secretmem_fault() (and thus removed from the direct map) is zeroed by inode truncation right afterwards. Use mapping->invalidate_lock to make secretmem_fault() and secretmem_setattr() mutually exclusive. [rppt@linux.ibm.com: v3] Link: https://lkml.kernel.org/r/20220714091337.412297-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20220707165650.248088-1-rppt@kernel.org Reported-by: syzbot+9bd2b7adbd34b30b87e4@syzkaller.appspotmail.com Signed-off-by: Mike Rapoport Suggested-by: Eric Biggers Reviewed-by: Axel Rasmussen Reviewed-by: Jan Kara Cc: Eric Biggers Cc: Hillf Danton Cc: Matthew Wilcox Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- mm/secretmem.c | 33 ++++++++++++++++++++++++++------- 1 file changed, 26 insertions(+), 7 deletions(-) --- a/mm/secretmem.c +++ b/mm/secretmem.c @@ -55,22 +55,28 @@ static vm_fault_t secretmem_fault(struct gfp_t gfp =3D vmf->gfp_mask; unsigned long addr; struct page *page; + vm_fault_t ret; int err; =20 if (((loff_t)vmf->pgoff << PAGE_SHIFT) >=3D i_size_read(inode)) return vmf_error(-EINVAL); =20 + filemap_invalidate_lock_shared(mapping); + retry: page =3D find_lock_page(mapping, offset); if (!page) { page =3D alloc_page(gfp | __GFP_ZERO); - if (!page) - return VM_FAULT_OOM; + if (!page) { + ret =3D VM_FAULT_OOM; + goto out; + } =20 err =3D set_direct_map_invalid_noflush(page); if (err) { put_page(page); - return vmf_error(err); + ret =3D vmf_error(err); + goto out; } =20 __SetPageUptodate(page); @@ -86,7 +92,8 @@ retry: if (err =3D=3D -EEXIST) goto retry; =20 - return vmf_error(err); + ret =3D vmf_error(err); + goto out; } =20 addr =3D (unsigned long)page_address(page); @@ -94,7 +101,11 @@ retry: } =20 vmf->page =3D page; - return VM_FAULT_LOCKED; + ret =3D VM_FAULT_LOCKED; + +out: + filemap_invalidate_unlock_shared(mapping); + return ret; } =20 static const struct vm_operations_struct secretmem_vm_ops =3D { @@ -162,12 +173,20 @@ static int secretmem_setattr(struct user struct dentry *dentry, struct iattr *iattr) { struct inode *inode =3D d_inode(dentry); + struct address_space *mapping =3D inode->i_mapping; unsigned int ia_valid =3D iattr->ia_valid; + int ret; + + filemap_invalidate_lock(mapping); =20 if ((ia_valid & ATTR_SIZE) && inode->i_size) - return -EINVAL; + ret =3D -EINVAL; + else + ret =3D simple_setattr(mnt_userns, dentry, iattr); + + filemap_invalidate_unlock(mapping); =20 - return simple_setattr(mnt_userns, dentry, iattr); + return ret; } =20 static const struct inode_operations secretmem_iops =3D { From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1EF03C00144 for ; Mon, 1 Aug 2022 12:09:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232777AbiHAMJO (ORCPT ); Mon, 1 Aug 2022 08:09:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43186 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233744AbiHAMIa (ORCPT ); Mon, 1 Aug 2022 08:08:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 217C545F4A; Mon, 1 Aug 2022 04:55:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C8E40B80EAC; Mon, 1 Aug 2022 11:55:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 27D77C433C1; Mon, 1 Aug 2022 11:55:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354953; bh=6uHo3ZP7kvSw4oagX/VlqwE8fSt9Rspmj2PhTp3d8WU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xahs9axabjgREQ/imEmSmabi61C84h1OBoebizQLaHAqeXcgtFdpif6cxaNjlTFur z0C/YmJUJ+H+gHizCUZFutQmie/V3OAhtF59YR1g6qlleGo73DekpBO6TeabJOikn0 DLzuavGVLJ//oIi3wzy4w9t+27pzzjTblS7AmGJE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josef Bacik , Rik van Riel , Chris Mason , "Kirill A. Shutemov" , "Matthew Wilcox (Oracle)" , Andrew Morton Subject: [PATCH 5.18 10/88] mm: fix page leak with multiple threads mapping the same page Date: Mon, 1 Aug 2022 13:46:24 +0200 Message-Id: <20220801114138.522672752@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Josef Bacik commit 3fe2895cfecd03ac74977f32102b966b6589f481 upstream. We have an application with a lot of threads that use a shared mmap backed by tmpfs mounted with -o huge=3Dwithin_size. This application started leaking loads of huge pages when we upgraded to a recent kernel. Using the page ref tracepoints and a BPF program written by Tejun Heo we were able to determine that these pages would have multiple refcounts from the page fault path, but when it came to unmap time we wouldn't drop the number of refs we had added from the faults. I wrote a reproducer that mmap'ed a file backed by tmpfs with -o huge=3Dalways, and then spawned 20 threads all looping faulting random offsets in this map, while using madvise(MADV_DONTNEED) randomly for huge page aligned ranges. This very quickly reproduced the problem. The problem here is that we check for the case that we have multiple threads faulting in a range that was previously unmapped. One thread maps the PMD, the other thread loses the race and then returns 0. However at this point we already have the page, and we are no longer putting this page into the processes address space, and so we leak the page. We actually did the correct thing prior to f9ce0be71d1f, however it looks like Kirill copied what we do in the anonymous page case. In the anonymous page case we don't yet have a page, so we don't have to drop a reference on anything. Previously we did the correct thing for file based faults by returning VM_FAULT_NOPAGE so we correctly drop the reference on the page we faulted in. Fix this by returning VM_FAULT_NOPAGE in the pmd_devmap_trans_unstable() case, this makes us drop the ref on the page properly, and now my reproducer no longer leaks the huge pages. [josef@toxicpanda.com: v2] Link: https://lkml.kernel.org/r/e90c8f0dbae836632b669c2afc434006a00d4a67.= 1657721478.git.josef@toxicpanda.com Link: https://lkml.kernel.org/r/2b798acfd95c9ab9395fe85e8d5a835e2e10a920.16= 57051137.git.josef@toxicpanda.com Fixes: f9ce0be71d1f ("mm: Cleanup faultaround and finish_fault() codepaths") Signed-off-by: Josef Bacik Signed-off-by: Rik van Riel Signed-off-by: Chris Mason Acked-by: Kirill A. Shutemov Cc: Matthew Wilcox (Oracle) Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- mm/memory.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/mm/memory.c +++ b/mm/memory.c @@ -4108,9 +4108,12 @@ vm_fault_t finish_fault(struct vm_fault return VM_FAULT_OOM; } =20 - /* See comment in handle_pte_fault() */ + /* + * See comment in handle_pte_fault() for how this scenario happens, we + * need to return NOPAGE so that we drop this page. + */ if (pmd_devmap_trans_unstable(vmf->pmd)) - return 0; + return VM_FAULT_NOPAGE; =20 vmf->pte =3D pte_offset_map_lock(vma->vm_mm, vmf->pmd, vmf->address, &vmf->ptl); From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA780C19F2A for ; Mon, 1 Aug 2022 12:09:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233741AbiHAMJK (ORCPT ); Mon, 1 Aug 2022 08:09:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42762 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233735AbiHAMI3 (ORCPT ); Mon, 1 Aug 2022 08:08:29 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6258945F7E; Mon, 1 Aug 2022 04:55:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C76DD61227; Mon, 1 Aug 2022 11:55:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D34E2C433D7; Mon, 1 Aug 2022 11:55:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354956; bh=Jizby1RHFzU4Ah7+X4auJpnP6fL8l4UvXwDc5hix7e0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GK3f6Uf778ITwYLp3UNSdgE5mvcIiT3ff7wgyQnOMQGEo6Oqct29KflfJpNWTk2j8 M38kWOxecBUD8IwxMZHPe436y17Siu/ibNrXySMCU9OkD5AaR77I0cBBW1b3q8JtRB WsqfGTdNVAdGbGbDXoWQqQxipJlrEEo7jLZv+xq8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Muchun Song , Matthew Wilcox , Jason Gunthorpe , John Hubbard , William Kucharski , Dan Williams , Jan Kara , Andrew Morton Subject: [PATCH 5.18 11/88] mm: fix missing wake-up event for FSDAX pages Date: Mon, 1 Aug 2022 13:46:25 +0200 Message-Id: <20220801114138.573589322@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Muchun Song commit f4f451a16dd1f478fdb966bcbb612c1e4ce6b962 upstream. FSDAX page refcounts are 1-based, rather than 0-based: if refcount is 1, then the page is freed. The FSDAX pages can be pinned through GUP, then they will be unpinned via unpin_user_page() using a folio variant to put the page, however, folio variants did not consider this special case, the result will be to miss a wakeup event (like the user of __fuse_dax_break_layouts()). This results in a task being permanently stuck in TASK_INTERRUPTIBLE state. Since FSDAX pages are only possibly obtained by GUP users, so fix GUP instead of folio_put() to lower overhead. Link: https://lkml.kernel.org/r/20220705123532.283-1-songmuchun@bytedance.c= om Fixes: d8ddc099c6b3 ("mm/gup: Add gup_put_folio()") Signed-off-by: Muchun Song Suggested-by: Matthew Wilcox Cc: Jason Gunthorpe Cc: John Hubbard Cc: William Kucharski Cc: Dan Williams Cc: Jan Kara Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- include/linux/mm.h | 14 +++++++++----- mm/gup.c | 6 ++++-- mm/memremap.c | 6 +++--- 3 files changed, 16 insertions(+), 10 deletions(-) --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1130,23 +1130,27 @@ static inline bool is_zone_movable_page( #if defined(CONFIG_ZONE_DEVICE) && defined(CONFIG_FS_DAX) DECLARE_STATIC_KEY_FALSE(devmap_managed_key); =20 -bool __put_devmap_managed_page(struct page *page); -static inline bool put_devmap_managed_page(struct page *page) +bool __put_devmap_managed_page_refs(struct page *page, int refs); +static inline bool put_devmap_managed_page_refs(struct page *page, int ref= s) { if (!static_branch_unlikely(&devmap_managed_key)) return false; if (!is_zone_device_page(page)) return false; - return __put_devmap_managed_page(page); + return __put_devmap_managed_page_refs(page, refs); } - #else /* CONFIG_ZONE_DEVICE && CONFIG_FS_DAX */ -static inline bool put_devmap_managed_page(struct page *page) +static inline bool put_devmap_managed_page_refs(struct page *page, int ref= s) { return false; } #endif /* CONFIG_ZONE_DEVICE && CONFIG_FS_DAX */ =20 +static inline bool put_devmap_managed_page(struct page *page) +{ + return put_devmap_managed_page_refs(page, 1); +} + /* 127: arbitrary random number, small enough to assemble well */ #define folio_ref_zero_or_close_to_overflow(folio) \ ((unsigned int) folio_ref_count(folio) + 127u <=3D 127u) --- a/mm/gup.c +++ b/mm/gup.c @@ -54,7 +54,8 @@ retry: * belongs to this folio. */ if (unlikely(page_folio(page) !=3D folio)) { - folio_put_refs(folio, refs); + if (!put_devmap_managed_page_refs(&folio->page, refs)) + folio_put_refs(folio, refs); goto retry; } =20 @@ -143,7 +144,8 @@ static void gup_put_folio(struct folio * refs *=3D GUP_PIN_COUNTING_BIAS; } =20 - folio_put_refs(folio, refs); + if (!put_devmap_managed_page_refs(&folio->page, refs)) + folio_put_refs(folio, refs); } =20 /** --- a/mm/memremap.c +++ b/mm/memremap.c @@ -489,7 +489,7 @@ void free_zone_device_page(struct page * } =20 #ifdef CONFIG_FS_DAX -bool __put_devmap_managed_page(struct page *page) +bool __put_devmap_managed_page_refs(struct page *page, int refs) { if (page->pgmap->type !=3D MEMORY_DEVICE_FS_DAX) return false; @@ -499,9 +499,9 @@ bool __put_devmap_managed_page(struct pa * refcount is 1, then the page is free and the refcount is * stable because nobody holds a reference on the page. */ - if (page_ref_dec_return(page) =3D=3D 1) + if (page_ref_sub_return(page, refs) =3D=3D 1) wake_up_var(&page->_refcount); return true; } -EXPORT_SYMBOL(__put_devmap_managed_page); +EXPORT_SYMBOL(__put_devmap_managed_page_refs); #endif /* CONFIG_FS_DAX */ From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 169B9C00144 for ; Mon, 1 Aug 2022 12:09:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233882AbiHAMJT (ORCPT ); Mon, 1 Aug 2022 08:09:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42894 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233797AbiHAMIe (ORCPT ); Mon, 1 Aug 2022 08:08:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 44AE646D90; Mon, 1 Aug 2022 04:56:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 80F8561356; Mon, 1 Aug 2022 11:55:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8A1F0C43140; Mon, 1 Aug 2022 11:55:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354958; bh=gummr80YA9ygIDr3lIJCdVmUi0GAWxy6pwRvH1WisG0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GkyyOC0fyDQjVSdT96dkSWoyVNFGAV9J8/TkJjD8FvZKTj56DQTem5bQcoVigcMOH SHGZThzOVpSYhwRO1QYX4+66d7ehUpxY8DtHvVuAcFI0VT9y8Qx1XVNZJ4Kf4a6ZXq HBhz64WR3qn8+AE+S0ns8e6cgQDSD/xheCQpnNm8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaohe Lin , Muchun Song , Anshuman Khandual , Baolin Wang , Mike Kravetz , Andrew Morton Subject: [PATCH 5.18 12/88] hugetlb: fix memoryleak in hugetlb_mcopy_atomic_pte Date: Mon, 1 Aug 2022 13:46:26 +0200 Message-Id: <20220801114138.623301792@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaohe Lin commit da9a298f5fad0dc615079a340da42928bc5b138e upstream. When alloc_huge_page fails, *pagep is set to NULL without put_page first. So the hugepage indicated by *pagep is leaked. Link: https://lkml.kernel.org/r/20220709092629.54291-1-linmiaohe@huawei.com Fixes: 8cc5fcbb5be8 ("mm, hugetlb: fix racy resv_huge_pages underflow on UF= FDIO_COPY") Signed-off-by: Miaohe Lin Acked-by: Muchun Song Reviewed-by: Anshuman Khandual Reviewed-by: Baolin Wang Reviewed-by: Mike Kravetz Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- mm/hugetlb.c | 1 + 1 file changed, 1 insertion(+) --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5822,6 +5822,7 @@ int hugetlb_mcopy_atomic_pte(struct mm_s =20 page =3D alloc_huge_page(dst_vma, dst_addr, 0); if (IS_ERR(page)) { + put_page(*pagep); ret =3D -ENOMEM; *pagep =3D NULL; goto out; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86ACDC00144 for ; Mon, 1 Aug 2022 12:09:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233769AbiHAMJh (ORCPT ); Mon, 1 Aug 2022 08:09:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46742 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231628AbiHAMIx (ORCPT ); Mon, 1 Aug 2022 08:08:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6AF5E655A0; Mon, 1 Aug 2022 04:56:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F16C6B81163; Mon, 1 Aug 2022 11:56:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4D896C433C1; Mon, 1 Aug 2022 11:56:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354961; bh=QdhoJKHWHOYGae7EJTZdGq1HN/BPTPc3s5JJatJcrEw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HMjZn/SD2UVd1e7xv5faG373LHAXFkls1JOZ5oVc29VEYwyqDY1lHUM9tW02wKSRj fyIp62PyWGvFbs7816gN9rBpYvgf29XOhlYdwbHzZH2pGpPPntRPPWtNW6+jMKRna7 NJwJlBX/etI/K4qePVUUKgSO918Hiy5WaFU4K0vk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukas Bulwahn , Arnd Bergmann Subject: [PATCH 5.18 13/88] asm-generic: remove a broken and needless ifdef conditional Date: Mon, 1 Aug 2022 13:46:27 +0200 Message-Id: <20220801114138.662815688@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Bulwahn commit e2a619ca0b38f2114347b7078b8a67d72d457a3d upstream. Commit 527701eda5f1 ("lib: Add a generic version of devmem_is_allowed()") introduces the config symbol GENERIC_LIB_DEVMEM_IS_ALLOWED, but then falsely refers to CONFIG_GENERIC_DEVMEM_IS_ALLOWED (note the missing LIB in the reference) in ./include/asm-generic/io.h. Luckily, ./scripts/checkkconfigsymbols.py warns on non-existing configs: GENERIC_DEVMEM_IS_ALLOWED Referencing files: include/asm-generic/io.h The actual fix, though, is simply to not to make this function declaration dependent on any kernel config. For architectures that intend to use the generic version, the arch's 'select GENERIC_LIB_DEVMEM_IS_ALLOWED' will lead to picking the function definition, and for other architectures, this function is simply defined elsewhere. The wrong '#ifndef' on a non-existing config symbol also always had the same effect (although more by mistake than by intent). So, there is no functional change. Remove this broken and needless ifdef conditional. Fixes: 527701eda5f1 ("lib: Add a generic version of devmem_is_allowed()") Signed-off-by: Lukas Bulwahn Signed-off-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- include/asm-generic/io.h | 2 -- 1 file changed, 2 deletions(-) --- a/include/asm-generic/io.h +++ b/include/asm-generic/io.h @@ -1125,9 +1125,7 @@ static inline void memcpy_toio(volatile } #endif =20 -#ifndef CONFIG_GENERIC_DEVMEM_IS_ALLOWED extern int devmem_is_allowed(unsigned long pfn); -#endif =20 #endif /* __KERNEL__ */ From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C1285C00144 for ; Mon, 1 Aug 2022 12:09:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233913AbiHAMJm (ORCPT ); Mon, 1 Aug 2022 08:09:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42678 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233839AbiHAMJD (ORCPT ); Mon, 1 Aug 2022 08:09:03 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C927965652; Mon, 1 Aug 2022 04:56:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 169DA61227; Mon, 1 Aug 2022 11:56:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2263BC433D6; Mon, 1 Aug 2022 11:56:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354964; bh=0DOI+tH+obLM/ah1ir/rAmzRsoGfunCYQfDTahRUfW4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=n30zbhrLzwU0N3Z04RhFl6klxDyUfusTFBIM+upgzP/FbXbjvVtmrSus1rSQBoCVI mq7noZOUV/z9rUhrmkdKcsN72IKU7UYZT3Kw55G9gt/Tdh7Ux7NREkPVJzG5lWgyKN m4BxeL6ErPNI4wXVwA1q98wPRBQUpttD2QqWQz0A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Harald Freudenberger , "Jason A. Donenfeld" , Juergen Christ , Alexander Gordeev Subject: [PATCH 5.18 14/88] s390/archrandom: prevent CPACF trng invocations in interrupt context Date: Mon, 1 Aug 2022 13:46:28 +0200 Message-Id: <20220801114138.701851448@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Harald Freudenberger commit 918e75f77af7d2e049bb70469ec0a2c12782d96a upstream. This patch slightly reworks the s390 arch_get_random_seed_{int,long} implementation: Make sure the CPACF trng instruction is never called in any interrupt context. This is done by adding an additional condition in_task(). Justification: There are some constrains to satisfy for the invocation of the arch_get_random_seed_{int,long}() functions: - They should provide good random data during kernel initialization. - They should not be called in interrupt context as the TRNG instruction is relatively heavy weight and may for example make some network loads cause to timeout and buck. However, it was not clear what kind of interrupt context is exactly encountered during kernel init or network traffic eventually calling arch_get_random_seed_long(). After some days of investigations it is clear that the s390 start_kernel function is not running in any interrupt context and so the trng is called: Jul 11 18:33:39 t35lp54 kernel: [<00000001064e90ca>] arch_get_random_seed_= long.part.0+0x32/0x70 Jul 11 18:33:39 t35lp54 kernel: [<000000010715f246>] random_init+0xf6/0x238 Jul 11 18:33:39 t35lp54 kernel: [<000000010712545c>] start_kernel+0x4a4/0x= 628 Jul 11 18:33:39 t35lp54 kernel: [<000000010590402a>] startup_continue+0x2a= /0x40 The condition in_task() is true and the CPACF trng provides random data during kernel startup. The network traffic however, is more difficult. A typical call stack looks like this: Jul 06 17:37:07 t35lp54 kernel: [<000000008b5600fc>] extract_entropy.const= prop.0+0x23c/0x240 Jul 06 17:37:07 t35lp54 kernel: [<000000008b560136>] crng_reseed+0x36/0xd8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b5604b8>] crng_make_state+0x78/= 0x340 Jul 06 17:37:07 t35lp54 kernel: [<000000008b5607e0>] _get_random_bytes+0x6= 0/0xf8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b56108a>] get_random_u32+0xda/0= x248 Jul 06 17:37:07 t35lp54 kernel: [<000000008aefe7a8>] kfence_guarded_alloc+= 0x48/0x4b8 Jul 06 17:37:07 t35lp54 kernel: [<000000008aeff35e>] __kfence_alloc+0x18e/= 0x1b8 Jul 06 17:37:07 t35lp54 kernel: [<000000008aef7f10>] __kmalloc_node_track_= caller+0x368/0x4d8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b611eac>] kmalloc_reserve+0x44/= 0xa0 Jul 06 17:37:07 t35lp54 kernel: [<000000008b611f98>] __alloc_skb+0x90/0x178 Jul 06 17:37:07 t35lp54 kernel: [<000000008b6120dc>] __napi_alloc_skb+0x5c= /0x118 Jul 06 17:37:07 t35lp54 kernel: [<000000008b8f06b4>] qeth_extract_skb+0x13= c/0x680 Jul 06 17:37:07 t35lp54 kernel: [<000000008b8f6526>] qeth_poll+0x256/0x3f8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b63d76e>] __napi_poll.constprop= .0+0x46/0x2f8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b63dbec>] net_rx_action+0x1cc/0= x408 Jul 06 17:37:07 t35lp54 kernel: [<000000008b937302>] __do_softirq+0x132/0x= 6b0 Jul 06 17:37:07 t35lp54 kernel: [<000000008abf46ce>] __irq_exit_rcu+0x13e/= 0x170 Jul 06 17:37:07 t35lp54 kernel: [<000000008abf531a>] irq_exit_rcu+0x22/0x50 Jul 06 17:37:07 t35lp54 kernel: [<000000008b922506>] do_io_irq+0xe6/0x198 Jul 06 17:37:07 t35lp54 kernel: [<000000008b935826>] io_int_handler+0xd6/0= x110 Jul 06 17:37:07 t35lp54 kernel: [<000000008b9358a6>] psw_idle_exit+0x0/0xa Jul 06 17:37:07 t35lp54 kernel: ([<000000008ab9c59a>] arch_cpu_idle+0x52/0x= e0) Jul 06 17:37:07 t35lp54 kernel: [<000000008b933cfe>] default_idle_call+0x6= e/0xd0 Jul 06 17:37:07 t35lp54 kernel: [<000000008ac59f4e>] do_idle+0xf6/0x1b0 Jul 06 17:37:07 t35lp54 kernel: [<000000008ac5a28e>] cpu_startup_entry+0x3= 6/0x40 Jul 06 17:37:07 t35lp54 kernel: [<000000008abb0d90>] smp_start_secondary+0= x148/0x158 Jul 06 17:37:07 t35lp54 kernel: [<000000008b935b9e>] restart_int_handler+0= x6e/0x90 which confirms that the call is in softirq context. So in_task() covers exa= ctly the cases where we want to have CPACF trng called: not in nmi, not in hard = irq, not in soft irq but in normal task context and during kernel init. Signed-off-by: Harald Freudenberger Acked-by: Jason A. Donenfeld Reviewed-by: Juergen Christ Link: https://lore.kernel.org/r/20220713131721.257907-1-freude@linux.ibm.com Fixes: e4f74400308c ("s390/archrandom: simplify back to earlier design and = initialize earlier") [agordeev@linux.ibm.com changed desc, added Fixes and Link, removed -stable] Signed-off-by: Alexander Gordeev Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- arch/s390/include/asm/archrandom.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/arch/s390/include/asm/archrandom.h +++ b/arch/s390/include/asm/archrandom.h @@ -2,7 +2,7 @@ /* * Kernel interface for the s390 arch_random_* functions * - * Copyright IBM Corp. 2017, 2020 + * Copyright IBM Corp. 2017, 2022 * * Author: Harald Freudenberger * @@ -14,6 +14,7 @@ #ifdef CONFIG_ARCH_RANDOM =20 #include +#include #include #include =20 @@ -32,7 +33,8 @@ static inline bool __must_check arch_get =20 static inline bool __must_check arch_get_random_seed_long(unsigned long *v) { - if (static_branch_likely(&s390_arch_random_available)) { + if (static_branch_likely(&s390_arch_random_available) && + in_task()) { cpacf_trng(NULL, 0, (u8 *)v, sizeof(*v)); atomic64_add(sizeof(*v), &s390_arch_random_counter); return true; @@ -42,7 +44,8 @@ static inline bool __must_check arch_get =20 static inline bool __must_check arch_get_random_seed_int(unsigned int *v) { - if (static_branch_likely(&s390_arch_random_available)) { + if (static_branch_likely(&s390_arch_random_available) && + in_task()) { cpacf_trng(NULL, 0, (u8 *)v, sizeof(*v)); atomic64_add(sizeof(*v), &s390_arch_random_counter); return true; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C5ACC00144 for ; Mon, 1 Aug 2022 12:09:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233923AbiHAMJv (ORCPT ); Mon, 1 Aug 2022 08:09:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42780 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233739AbiHAMJI (ORCPT ); Mon, 1 Aug 2022 08:09:08 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0DEB3474D7; Mon, 1 Aug 2022 04:56:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 864ECB81163; Mon, 1 Aug 2022 11:56:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D871BC433D6; Mon, 1 Aug 2022 11:56:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354967; bh=iqE2JW/78bOCVNZntrMXW5Fn3YTkZZzUUxcreeokXRs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NN8il6tEtqmCiBkNnY6M9D/JOo33cqcHGIZ/UOKAoAOC3YelDmI+4JT2tIOJgfaSg duurPFqPCeKBuEC06QmMYYF7AcT8HnvpdAQDnaApfS3+FT53FLkBnqkJ1vRHlIiFHs Cb3u49Uum7KtTfOVrkx3ZQR3+4XdpuRn859ucojk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Waiman Long , "Rafael J. Wysocki" Subject: [PATCH 5.18 15/88] intel_idle: Fix false positive RCU splats due to incorrect hardirqs state Date: Mon, 1 Aug 2022 13:46:29 +0200 Message-Id: <20220801114138.753846490@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Waiman Long commit d295ad34f236c3518634fb6403d4c0160456e470 upstream. Commit 32d4fd5751ea ("cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE") uses raw_local_irq_enable/local_irq_disable() around call to __intel_idle() in intel_idle_irq(). With interrupt enabled, timer tick interrupt can happen and a subsequently call to __do_softirq() may change the lockdep hardirqs state of a debug kernel back to 'on'. This will result in a mismatch between the cpu hardirqs state (off) and the lockdep hardirqs state (on) causing a number of false positive "WARNING: suspicious RCU usage" splats. Fix that by using local_irq_disable() to disable interrupt in intel_idle_irq(). Fixes: 32d4fd5751ea ("cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE") Signed-off-by: Waiman Long Cc: 5.16+ # 5.16+ Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/idle/intel_idle.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c index f5c6802aa6c3..907700d1e78e 100644 --- a/drivers/idle/intel_idle.c +++ b/drivers/idle/intel_idle.c @@ -162,7 +162,13 @@ static __cpuidle int intel_idle_irq(struct cpuidle_dev= ice *dev, =20 raw_local_irq_enable(); ret =3D __intel_idle(dev, drv, index); - raw_local_irq_disable(); + + /* + * The lockdep hardirqs state may be changed to 'on' with timer + * tick interrupt followed by __do_softirq(). Use local_irq_disable() + * to keep the hardirqs state correct. + */ + local_irq_disable(); =20 return ret; } --=20 2.37.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E150C00144 for ; Mon, 1 Aug 2022 12:09:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233932AbiHAMJ4 (ORCPT ); Mon, 1 Aug 2022 08:09:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42856 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233876AbiHAMJM (ORCPT ); Mon, 1 Aug 2022 08:09:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 919AD474DD; Mon, 1 Aug 2022 04:56:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3C2D1B81163; Mon, 1 Aug 2022 11:56:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8B36DC433C1; Mon, 1 Aug 2022 11:56:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354969; bh=IsG/U4fQGUPODCf0APL5nFn0a24AgCa9PiGN+MZTaxI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aJF3C9bXFocTdWeNBCnzskm5NX4HvqlmysbYN94MJrSl2TMGzRc0EpygopNUClZXl 7oRsbxAyyXeOvgVvqSFY5M395Yg/cqkrMb/uwyEeD8faWenVml6L42/uv1kmN129pn vcmiurik9eTVaG54IZeDMkAp+5ihT9yKDwdQMN6Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alistair Popple , Ralph Campbell , Lyude Paul Subject: [PATCH 5.18 16/88] nouveau/svm: Fix to migrate all requested pages Date: Mon, 1 Aug 2022 13:46:30 +0200 Message-Id: <20220801114138.794214738@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alistair Popple commit 66cee9097e2b74ff3c8cc040ce5717c521a0c3fa upstream. Users may request that pages from an OpenCL SVM allocation be migrated to the GPU with clEnqueueSVMMigrateMem(). In Nouveau this will call into nouveau_dmem_migrate_vma() to do the migration. If the total range to be migrated exceeds SG_MAX_SINGLE_ALLOC the pages will be migrated in chunks of size SG_MAX_SINGLE_ALLOC. However a typo in updating the starting address means that only the first chunk will get migrated. Fix the calculation so that the entire range will get migrated if possible. Signed-off-by: Alistair Popple Fixes: e3d8b0890469 ("drm/nouveau/svm: map pages after migration") Reviewed-by: Ralph Campbell Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20220720062745.960701-1= -apopple@nvidia.com Cc: # v5.8+ Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/gpu/drm/nouveau/nouveau_dmem.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/nouveau/nouveau_dmem.c +++ b/drivers/gpu/drm/nouveau/nouveau_dmem.c @@ -680,7 +680,11 @@ nouveau_dmem_migrate_vma(struct nouveau_ goto out_free_dma; =20 for (i =3D 0; i < npages; i +=3D max) { - args.end =3D start + (max << PAGE_SHIFT); + if (args.start + (max << PAGE_SHIFT) > end) + args.end =3D end; + else + args.end =3D args.start + (max << PAGE_SHIFT); + ret =3D migrate_vma_setup(&args); if (ret) goto out_free_pfns; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F192CC19F2A for ; Mon, 1 Aug 2022 12:10:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233955AbiHAMKE (ORCPT ); Mon, 1 Aug 2022 08:10:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48208 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233753AbiHAMJ1 (ORCPT ); Mon, 1 Aug 2022 08:09:27 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AD17865670; Mon, 1 Aug 2022 04:56:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0C3C4B80EAC; Mon, 1 Aug 2022 11:56:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6ED20C433C1; Mon, 1 Aug 2022 11:56:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354972; bh=FZ7qdQqb6OKyqrt8HeDVkfqD76pNHrnbJRAJTK7zECE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kdmLWuMvwR+qZ4YOIGugvv0AkrSQgZ6I4D9eWL0PrmTvtGX5Jhqovs5P42AkOvIEi /H0gwfq8RAwOpGI2x2vY1kzRzhwuZlHRnd3mbO5v4Q4StG+UmXUY/IU1WDX8aVM1+/ M3aTiEF1z7sJkZ8hox+KzvAL7sYilT5JdlBAH6r8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Tomasz=20Pawe=C5=82=20Gajc?= , Nathan Chancellor , Thomas Zimmermann , Sami Tolvanen Subject: [PATCH 5.18 17/88] drm/simpledrm: Fix return type of simpledrm_simple_display_pipe_mode_valid() Date: Mon, 1 Aug 2022 13:46:31 +0200 Message-Id: <20220801114138.843533461@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Nathan Chancellor commit 0c09bc33aa8e9dc867300acaadc318c2f0d85a1e upstream. When booting a kernel compiled with clang's CFI protection (CONFIG_CFI_CLANG), there is a CFI failure in drm_simple_kms_crtc_mode_valid() when trying to call simpledrm_simple_display_pipe_mode_valid() through ->mode_valid(): [ 0.322802] CFI failure (target: simpledrm_simple_display_pipe_mode_vali= d+0x0/0x8): ... [ 0.324928] Call trace: [ 0.324969] __ubsan_handle_cfi_check_fail+0x58/0x60 [ 0.325053] __cfi_check_fail+0x3c/0x44 [ 0.325120] __cfi_slowpath_diag+0x178/0x200 [ 0.325192] drm_simple_kms_crtc_mode_valid+0x58/0x80 [ 0.325279] __drm_helper_update_and_validate+0x31c/0x464 ... The ->mode_valid() member in 'struct drm_simple_display_pipe_funcs' expects a return type of 'enum drm_mode_status', not 'int'. Correct it to fix the CFI failure. Cc: stable@vger.kernel.org Fixes: 11e8f5fd223b ("drm: Add simpledrm driver") Link: https://github.com/ClangBuiltLinux/linux/issues/1647 Reported-by: Tomasz Pawe=C5=82 Gajc Signed-off-by: Nathan Chancellor Signed-off-by: Thomas Zimmermann Reviewed-by: Sami Tolvanen Link: https://patchwork.freedesktop.org/patch/msgid/20220725233629.223223-1= -nathan@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/gpu/drm/tiny/simpledrm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/tiny/simpledrm.c +++ b/drivers/gpu/drm/tiny/simpledrm.c @@ -627,7 +627,7 @@ static const struct drm_connector_funcs .atomic_destroy_state =3D drm_atomic_helper_connector_destroy_state, }; =20 -static int +static enum drm_mode_status simpledrm_simple_display_pipe_mode_valid(struct drm_simple_display_pipe *p= ipe, const struct drm_display_mode *mode) { From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B990EC00144 for ; Mon, 1 Aug 2022 12:10:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233713AbiHAMKH (ORCPT ); Mon, 1 Aug 2022 08:10:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48256 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233417AbiHAMJd (ORCPT ); Mon, 1 Aug 2022 08:09:33 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 85D746566F; Mon, 1 Aug 2022 04:56:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 032B4B81170; Mon, 1 Aug 2022 11:56:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4E759C433D7; Mon, 1 Aug 2022 11:56:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354975; bh=L65EoCY1Wjh6qCUUyO68ActgUWoVIRRu6kgfGRc9XL4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vIjEwxf9U5MAq8HOJHk7BzmoIEg0CX6tHf1aLomir6RF2GpWrxMXjCXr7vBaQ0yET BCFVUAPpBOB2mJ06+aYgtqzj3O26EWFwVtXzsBqkwFd/2MeTjnjwUdTQziHT5JSH8q 3pRQ7sK4/qnaamzJUByYajFUwV3XbpTWhFZ9hD18= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Howells , Linus Torvalds Subject: [PATCH 5.18 18/88] watch_queue: Fix missing rcu annotation Date: Mon, 1 Aug 2022 13:46:32 +0200 Message-Id: <20220801114138.878778584@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Howells commit e0339f036ef4beb9b20f0b6532a1e0ece7f594c6 upstream. Since __post_watch_notification() walks wlist->watchers with only the RCU read lock held, we need to use RCU methods to add to the list (we already use RCU methods to remove from the list). Fix add_watch_to_object() to use hlist_add_head_rcu() instead of hlist_add_head() for that list. Fixes: c73be61cede5 ("pipe: Add general notification queue support") Signed-off-by: David Howells Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- kernel/watch_queue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/watch_queue.c +++ b/kernel/watch_queue.c @@ -494,7 +494,7 @@ int add_watch_to_object(struct watch *wa unlock_wqueue(wqueue); } =20 - hlist_add_head(&watch->list_node, &wlist->watchers); + hlist_add_head_rcu(&watch->list_node, &wlist->watchers); return 0; } EXPORT_SYMBOL(add_watch_to_object); From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4D89C19F29 for ; Mon, 1 Aug 2022 12:10:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233778AbiHAMKV (ORCPT ); Mon, 1 Aug 2022 08:10:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233631AbiHAMJh (ORCPT ); Mon, 1 Aug 2022 08:09:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5036F6610D; Mon, 1 Aug 2022 04:56:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BCE4CB81171; Mon, 1 Aug 2022 11:56:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2A5F2C433D6; Mon, 1 Aug 2022 11:56:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354978; bh=5hFJJ5gAtqb4rt193r1r4mkbDulYR0rJCVrXO3f4blY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dxRzUA/bXlIhHaw2cvz3oPTAPI/LYrdtybBh6rxFwbE6tL+/yvqngOWmBV7qZPCEu b2i2EXV4jNVmJHf54q2PiWD4jYtmGS9zOfq1QD8k6Z6OwB23NQXw6WiUSD45dzhjPv VY3PxljB4CChHMXBxkiyhgU27HXBhfr/U5lgaPjs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+03d7b43290037d1f87ca@syzkaller.appspotmail.com, David Howells , keyrings@vger.kernel.org, Linus Torvalds Subject: [PATCH 5.18 19/88] watch_queue: Fix missing locking in add_watch_to_object() Date: Mon, 1 Aug 2022 13:46:33 +0200 Message-Id: <20220801114138.914986548@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Linus Torvalds commit e64ab2dbd882933b65cd82ff6235d705ad65dbb6 upstream. If a watch is being added to a queue, it needs to guard against interference from addition of a new watch, manual removal of a watch and removal of a watch due to some other queue being destroyed. KEYCTL_WATCH_KEY guards against this for the same {key,queue} pair by holding the key->sem writelocked and by holding refs on both the key and the queue - but that doesn't prevent interaction from other {key,queue} pairs. While add_watch_to_object() does take the spinlock on the event queue, it doesn't take the lock on the source's watch list. The assumption was that the caller would prevent that (say by taking key->sem) - but that doesn't prevent interference from the destruction of another queue. Fix this by locking the watcher list in add_watch_to_object(). Fixes: c73be61cede5 ("pipe: Add general notification queue support") Reported-by: syzbot+03d7b43290037d1f87ca@syzkaller.appspotmail.com Signed-off-by: David Howells cc: keyrings@vger.kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- kernel/watch_queue.c | 58 +++++++++++++++++++++++++++++++---------------= ----- 1 file changed, 36 insertions(+), 22 deletions(-) --- a/kernel/watch_queue.c +++ b/kernel/watch_queue.c @@ -454,6 +454,33 @@ void init_watch(struct watch *watch, str rcu_assign_pointer(watch->queue, wqueue); } =20 +static int add_one_watch(struct watch *watch, struct watch_list *wlist, st= ruct watch_queue *wqueue) +{ + const struct cred *cred; + struct watch *w; + + hlist_for_each_entry(w, &wlist->watchers, list_node) { + struct watch_queue *wq =3D rcu_access_pointer(w->queue); + if (wqueue =3D=3D wq && watch->id =3D=3D w->id) + return -EBUSY; + } + + cred =3D current_cred(); + if (atomic_inc_return(&cred->user->nr_watches) > task_rlimit(current, RLI= MIT_NOFILE)) { + atomic_dec(&cred->user->nr_watches); + return -EAGAIN; + } + + watch->cred =3D get_cred(cred); + rcu_assign_pointer(watch->watch_list, wlist); + + kref_get(&wqueue->usage); + kref_get(&watch->usage); + hlist_add_head(&watch->queue_node, &wqueue->watches); + hlist_add_head_rcu(&watch->list_node, &wlist->watchers); + return 0; +} + /** * add_watch_to_object - Add a watch on an object to a watch list * @watch: The watch to add @@ -468,34 +495,21 @@ void init_watch(struct watch *watch, str */ int add_watch_to_object(struct watch *watch, struct watch_list *wlist) { - struct watch_queue *wqueue =3D rcu_access_pointer(watch->queue); - struct watch *w; + struct watch_queue *wqueue; + int ret =3D -ENOENT; =20 - hlist_for_each_entry(w, &wlist->watchers, list_node) { - struct watch_queue *wq =3D rcu_access_pointer(w->queue); - if (wqueue =3D=3D wq && watch->id =3D=3D w->id) - return -EBUSY; - } - - watch->cred =3D get_current_cred(); - rcu_assign_pointer(watch->watch_list, wlist); - - if (atomic_inc_return(&watch->cred->user->nr_watches) > - task_rlimit(current, RLIMIT_NOFILE)) { - atomic_dec(&watch->cred->user->nr_watches); - put_cred(watch->cred); - return -EAGAIN; - } + rcu_read_lock(); =20 + wqueue =3D rcu_access_pointer(watch->queue); if (lock_wqueue(wqueue)) { - kref_get(&wqueue->usage); - kref_get(&watch->usage); - hlist_add_head(&watch->queue_node, &wqueue->watches); + spin_lock(&wlist->lock); + ret =3D add_one_watch(watch, wlist, wqueue); + spin_unlock(&wlist->lock); unlock_wqueue(wqueue); } =20 - hlist_add_head_rcu(&watch->list_node, &wlist->watchers); - return 0; + rcu_read_unlock(); + return ret; } EXPORT_SYMBOL(add_watch_to_object); From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0D0EC00144 for ; Mon, 1 Aug 2022 12:12:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233620AbiHAMMD (ORCPT ); Mon, 1 Aug 2022 08:12:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56006 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233358AbiHAMKD (ORCPT ); Mon, 1 Aug 2022 08:10:03 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4303C66BA9; Mon, 1 Aug 2022 04:56:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 598ABB8117A; Mon, 1 Aug 2022 11:56:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A12FAC433C1; Mon, 1 Aug 2022 11:56:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354984; bh=YHudctfQmkhEKzhY+0PNz1y00jvWGU0MMaSvDV3vGFk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J91oGVuXPiGe4rsUhrhNWkrlvxtdGieyXyfV9Pgu8Lp8S9GnJJzOkpEzUE9WdXVA/ okTOGWWKPp9P+k94bqt4zzgMvazDeTHKOx2W7OjKByFSozdO0LO/etJ+f2Ug3wu/z2 6ErmKJR7sYFCXju/nUpN0eYlTvNj+i4bh8v3jT68= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" Subject: [PATCH 5.18 20/88] tcp: Fix data-races around sysctl_tcp_dsack. Date: Mon, 1 Aug 2022 13:46:34 +0200 Message-Id: <20220801114138.963047102@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima commit 58ebb1c8b35a8ef38cd6927431e0fa7b173a632d upstream. While reading sysctl_tcp_dsack, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_input.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -4426,7 +4426,7 @@ static void tcp_dsack_set(struct sock *s { struct tcp_sock *tp =3D tcp_sk(sk); =20 - if (tcp_is_sack(tp) && sock_net(sk)->ipv4.sysctl_tcp_dsack) { + if (tcp_is_sack(tp) && READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_dsack)) { int mib_idx; =20 if (before(seq, tp->rcv_nxt)) @@ -4473,7 +4473,7 @@ static void tcp_send_dupack(struct sock NET_INC_STATS(sock_net(sk), LINUX_MIB_DELAYEDACKLOST); tcp_enter_quickack_mode(sk, TCP_MAX_QUICKACKS); =20 - if (tcp_is_sack(tp) && sock_net(sk)->ipv4.sysctl_tcp_dsack) { + if (tcp_is_sack(tp) && READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_dsack)) { u32 end_seq =3D TCP_SKB_CB(skb)->end_seq; =20 tcp_rcv_spurious_retrans(sk, skb); From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA3FCC00144 for ; Mon, 1 Aug 2022 12:12:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233788AbiHAMMH (ORCPT ); Mon, 1 Aug 2022 08:12:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56114 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233956AbiHAMKF (ORCPT ); Mon, 1 Aug 2022 08:10:05 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9F73F67140; Mon, 1 Aug 2022 04:56:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 43D4661356; Mon, 1 Aug 2022 11:56:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 545C2C433D7; Mon, 1 Aug 2022 11:56:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354986; bh=8n/EyEPKuxTryT72m5JHpU1BoWBbah+puosE3lJB+Zs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZcF0evmRPA2iRWJvI821SsXcWWO7N4vY2Ev87OHaP3UQ7wfHh2UkAp6PI48wCt2BK xwvwkyex87Sxt3k6UWswdLkKqXMcSBHVAMXVgTf2TleJRucodIP2fmzGq60g+yCMC9 mEy4sWG8GOfKXmJXoDk5zPqXGXl270crYjgSoaMY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" Subject: [PATCH 5.18 21/88] tcp: Fix a data-race around sysctl_tcp_app_win. Date: Mon, 1 Aug 2022 13:46:35 +0200 Message-Id: <20220801114139.009374501@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima commit 02ca527ac5581cf56749db9fd03d854e842253dd upstream. While reading sysctl_tcp_app_win, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -534,7 +534,7 @@ static void tcp_grow_window(struct sock */ static void tcp_init_buffer_space(struct sock *sk) { - int tcp_app_win =3D sock_net(sk)->ipv4.sysctl_tcp_app_win; + int tcp_app_win =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_app_win); struct tcp_sock *tp =3D tcp_sk(sk); int maxwin; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6FDEBC19F2C for ; Mon, 1 Aug 2022 12:12:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233968AbiHAMMT (ORCPT ); Mon, 1 Aug 2022 08:12:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56858 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233916AbiHAMKe (ORCPT ); Mon, 1 Aug 2022 08:10:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6F611675AF; Mon, 1 Aug 2022 04:56:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 94255B80EAC; Mon, 1 Aug 2022 11:56:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 02DF6C433C1; Mon, 1 Aug 2022 11:56:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354989; bh=k54njftPV2tityWgc4LczKuZfe+dSKbeUpEH+2szED4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=P5azaBXuzmYjDj3JIuNTUXQvceohEziQbBc8Imjy/n6yK7K7z0mEvsTJSozV31unZ 0t7N4cXcecQ4Of/GpRkj1eUfVi+pDM1roXFkGocIBvrQKaEeDrdwpl3uci8chA5PGZ XZxBKLMZiOV8kbaTLY+qQ/cVPPly2i+4WPn8Swso= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" Subject: [PATCH 5.18 22/88] tcp: Fix a data-race around sysctl_tcp_adv_win_scale. Date: Mon, 1 Aug 2022 13:46:36 +0200 Message-Id: <20220801114139.048113204@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima commit 36eeee75ef0157e42fb6593dcc65daab289b559e upstream. While reading sysctl_tcp_adv_win_scale, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- include/net/tcp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1437,7 +1437,7 @@ void tcp_select_initial_window(const str =20 static inline int tcp_win_from_space(const struct sock *sk, int space) { - int tcp_adv_win_scale =3D sock_net(sk)->ipv4.sysctl_tcp_adv_win_scale; + int tcp_adv_win_scale =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_adv_win= _scale); =20 return tcp_adv_win_scale <=3D 0 ? (space>>(-tcp_adv_win_scale)) : From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C9C8C19F2C for ; Mon, 1 Aug 2022 12:12:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230320AbiHAMMP (ORCPT ); Mon, 1 Aug 2022 08:12:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56868 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233866AbiHAMKf (ORCPT ); Mon, 1 Aug 2022 08:10:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DD00566B9B; Mon, 1 Aug 2022 04:56:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9FDE86135A; Mon, 1 Aug 2022 11:56:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A90E5C433D7; Mon, 1 Aug 2022 11:56:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354992; bh=22RR9PcclhtH8tlv1wMS6xwztncUhQqVIRDFpJQcxws=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ojn7Ddj76BoqK5cFMSH3Gq7lz7xzIRDspt8mx97hUNjP/eRyFu0/Avd1uUGnFgfgv uoobTSD9zVXz3T7xXhwm7LZKCSwfuoT2XbXTwCtfn3m5iy5h9jal5S01um/vHC9mjl M+XmPhIsNO6KiGze0i0ByvKhSpjl/9Avjp7aLtM4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" Subject: [PATCH 5.18 23/88] tcp: Fix a data-race around sysctl_tcp_frto. Date: Mon, 1 Aug 2022 13:46:37 +0200 Message-Id: <20220801114139.098675667@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima commit 706c6202a3589f290e1ef9be0584a8f4a3cc0507 upstream. While reading sysctl_tcp_frto, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -2175,7 +2175,7 @@ void tcp_enter_loss(struct sock *sk) * loss recovery is underway except recurring timeout(s) on * the same SND.UNA (sec 3.2). Disable F-RTO on path MTU probing */ - tp->frto =3D net->ipv4.sysctl_tcp_frto && + tp->frto =3D READ_ONCE(net->ipv4.sysctl_tcp_frto) && (new_recovery || icsk->icsk_retransmits) && !inet_csk(sk)->icsk_mtup.probe_size; } From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 04131C00144 for ; Mon, 1 Aug 2022 12:12:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233055AbiHAMM1 (ORCPT ); Mon, 1 Aug 2022 08:12:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56260 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234107AbiHAMKo (ORCPT ); Mon, 1 Aug 2022 08:10:44 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0ACCB691E4; Mon, 1 Aug 2022 04:56:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4C661B81163; Mon, 1 Aug 2022 11:56:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8AEBDC433C1; Mon, 1 Aug 2022 11:56:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354994; bh=nWkaHB4aObE4+ORXQz/gbELbp69I+2ype2nxZe9a19U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MBql2zbhH+JB1XtgZ91eTmV/Eq76ZDixjYEy7OOa1hxLr6IUmtNjKNuJwe8tuI3qk EDrjUmie7sSjBXjpSliLXMPl9BZfYh8eBxRV3W6GlKKM5+F5KM6RTr/1mOegZwKbW7 eLymWbtxSS27YZMZRT0Yg+veAXE8QQQMBOFV0yMs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" Subject: [PATCH 5.18 24/88] tcp: Fix a data-race around sysctl_tcp_nometrics_save. Date: Mon, 1 Aug 2022 13:46:38 +0200 Message-Id: <20220801114139.148269148@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima commit 8499a2454d9e8a55ce616ede9f9580f36fd5b0f3 upstream. While reading sysctl_tcp_nometrics_save, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_metrics.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv4/tcp_metrics.c +++ b/net/ipv4/tcp_metrics.c @@ -329,7 +329,7 @@ void tcp_update_metrics(struct sock *sk) int m; =20 sk_dst_confirm(sk); - if (net->ipv4.sysctl_tcp_nometrics_save || !dst) + if (READ_ONCE(net->ipv4.sysctl_tcp_nometrics_save) || !dst) return; =20 rcu_read_lock(); From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76C3AC3F6B0 for ; Mon, 1 Aug 2022 12:12:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234036AbiHAMMY (ORCPT ); Mon, 1 Aug 2022 08:12:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54866 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234065AbiHAMKm (ORCPT ); Mon, 1 Aug 2022 08:10:42 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 351B46A491; Mon, 1 Aug 2022 04:56:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0649DB81177; Mon, 1 Aug 2022 11:56:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 60274C433D6; Mon, 1 Aug 2022 11:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659354997; bh=Pk5xfaZveeo4I7PJdyybX2fZfA1CFcunfBUWgqk6NJA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0261XgzS8j/1xGvrBImt+MMgSJdRuLeybP1biBLXg+ukzOtqoZ2ud+5SMWsh4Dj1E WsYIG8jARq7KCv658EmXtm/iNeGoxuKGPiHHQ3M3VjZhYNsAM/cbfjy1P5YczRV8aa AraYTSFspO0qOm09+r7T8xipcWaNUawKF3XfxzLA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" Subject: [PATCH 5.18 25/88] tcp: Fix data-races around sysctl_tcp_no_ssthresh_metrics_save. Date: Mon, 1 Aug 2022 13:46:39 +0200 Message-Id: <20220801114139.191743400@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima commit ab1ba21b523ab496b1a4a8e396333b24b0a18f9a upstream. While reading sysctl_tcp_no_ssthresh_metrics_save, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 65e6d90168f3 ("net-tcp: Disable TCP ssthresh metrics cache by defaul= t") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_metrics.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/net/ipv4/tcp_metrics.c +++ b/net/ipv4/tcp_metrics.c @@ -385,7 +385,7 @@ void tcp_update_metrics(struct sock *sk) =20 if (tcp_in_initial_slowstart(tp)) { /* Slow start still did not finish. */ - if (!net->ipv4.sysctl_tcp_no_ssthresh_metrics_save && + if (!READ_ONCE(net->ipv4.sysctl_tcp_no_ssthresh_metrics_save) && !tcp_metric_locked(tm, TCP_METRIC_SSTHRESH)) { val =3D tcp_metric_get(tm, TCP_METRIC_SSTHRESH); if (val && (tcp_snd_cwnd(tp) >> 1) > val) @@ -401,7 +401,7 @@ void tcp_update_metrics(struct sock *sk) } else if (!tcp_in_slow_start(tp) && icsk->icsk_ca_state =3D=3D TCP_CA_Open) { /* Cong. avoidance phase, cwnd is reliable. */ - if (!net->ipv4.sysctl_tcp_no_ssthresh_metrics_save && + if (!READ_ONCE(net->ipv4.sysctl_tcp_no_ssthresh_metrics_save) && !tcp_metric_locked(tm, TCP_METRIC_SSTHRESH)) tcp_metric_set(tm, TCP_METRIC_SSTHRESH, max(tcp_snd_cwnd(tp) >> 1, tp->snd_ssthresh)); @@ -418,7 +418,7 @@ void tcp_update_metrics(struct sock *sk) tcp_metric_set(tm, TCP_METRIC_CWND, (val + tp->snd_ssthresh) >> 1); } - if (!net->ipv4.sysctl_tcp_no_ssthresh_metrics_save && + if (!READ_ONCE(net->ipv4.sysctl_tcp_no_ssthresh_metrics_save) && !tcp_metric_locked(tm, TCP_METRIC_SSTHRESH)) { val =3D tcp_metric_get(tm, TCP_METRIC_SSTHRESH); if (val && tp->snd_ssthresh > val) @@ -463,7 +463,7 @@ void tcp_init_metrics(struct sock *sk) if (tcp_metric_locked(tm, TCP_METRIC_CWND)) tp->snd_cwnd_clamp =3D tcp_metric_get(tm, TCP_METRIC_CWND); =20 - val =3D net->ipv4.sysctl_tcp_no_ssthresh_metrics_save ? + val =3D READ_ONCE(net->ipv4.sysctl_tcp_no_ssthresh_metrics_save) ? 0 : tcp_metric_get(tm, TCP_METRIC_SSTHRESH); if (val) { tp->snd_ssthresh =3D val; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 169EBC00144 for ; Mon, 1 Aug 2022 12:17:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234125AbiHAMRF (ORCPT ); Mon, 1 Aug 2022 08:17:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234422AbiHAMPy (ORCPT ); Mon, 1 Aug 2022 08:15:54 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6814D7AC17; Mon, 1 Aug 2022 04:58:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EDA0AB81171; Mon, 1 Aug 2022 11:58:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 422B2C433C1; Mon, 1 Aug 2022 11:58:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355110; bh=eJKRV90rG1YYkyI0zQh3lPHiACffaEECIn1A0+30NFM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hFNowBi6OWKyMFe1Yc1XRpzRcfZrp1NJfFGyfb7b/24T2fCCstY139t3uKaxa6lbt oOp1/Cs165Z32tCYsOCmnWrzP+L6ssStveMn41QXpBWIJ8se9qx0E4Pu3+wtSpoGvD BdZY8z6wAE6c5hsYPb4IsBpmWQMdWVc3pt+N9Fps= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ido Schimmel , Benjamin Poirier , Nikolay Aleksandrov , Paolo Abeni Subject: [PATCH 5.18 26/88] bridge: Do not send empty IFLA_AF_SPEC attribute Date: Mon, 1 Aug 2022 13:46:40 +0200 Message-Id: <20220801114139.231282517@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Benjamin Poirier commit 9b134b1694ec8926926ba6b7b80884ea829245a0 upstream. After commit b6c02ef54913 ("bridge: Netlink interface fix."), br_fill_ifinfo() started to send an empty IFLA_AF_SPEC attribute when a bridge vlan dump is requested but an interface does not have any vlans configured. iproute2 ignores such an empty attribute since commit b262a9becbcb ("bridge: Fix output with empty vlan lists") but older iproute2 versions as well as other utilities have their output changed by the cited kernel commit, resulting in failed test cases. Regardless, emitting an empty attribute is pointless and inefficient. Avoid this change by canceling the attribute if no AF_SPEC data was added. Fixes: b6c02ef54913 ("bridge: Netlink interface fix.") Reviewed-by: Ido Schimmel Signed-off-by: Benjamin Poirier Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20220725001236.95062-1-bpoirier@nvidia.com Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/bridge/br_netlink.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/net/bridge/br_netlink.c +++ b/net/bridge/br_netlink.c @@ -589,9 +589,13 @@ static int br_fill_ifinfo(struct sk_buff } =20 done: + if (af) { + if (nlmsg_get_pos(skb) - (void *)af > nla_attr_size(0)) + nla_nest_end(skb, af); + else + nla_nest_cancel(skb, af); + } =20 - if (af) - nla_nest_end(skb, af); nlmsg_end(skb, nlh); return 0; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF3B3C00144 for ; Mon, 1 Aug 2022 12:13:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234084AbiHAMNH (ORCPT ); Mon, 1 Aug 2022 08:13:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56114 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234661AbiHAMLl (ORCPT ); Mon, 1 Aug 2022 08:11:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DD7576FA32; Mon, 1 Aug 2022 04:57:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 89E58B81170; Mon, 1 Aug 2022 11:57:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E590BC433D6; Mon, 1 Aug 2022 11:57:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355022; bh=KwPQhO7TU6/iLNAcx6NoF3WPVIN8mKMpEzoii8Yvj9U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RxCTwdbFK56CjkPJpEojQnjs7nEO8Zn66kbwGc/CJJR6jycjU1KPKxFcoSFkeBL/7 agHz4Qlg57j3aDemAZsmyME9kHJDyjPABJ+Al+VYIStrmNo/I7HW6qEaHv6BHYl4Gm IDV44cGl591tTmkXia2j4GpUnS1cdQa1Og4bX+Wo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Przemyslaw Patynowski , Mateusz Palczewski , Marek Szlosek , Tony Nguyen Subject: [PATCH 5.18 27/88] ice: Fix max VLANs available for VF Date: Mon, 1 Aug 2022 13:46:41 +0200 Message-Id: <20220801114139.265301380@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Przemyslaw Patynowski commit 1e308c6fb7127371f48a0fb9770ea0b30a6b5698 upstream. Legacy VLAN implementation allows for untrusted VF to have 8 VLAN filters, not counting VLAN 0 filters. Current VLAN_V2 implementation lowers available filters for VF, by counting in VLAN 0 filter for both TPIDs. Fix this by counting only non zero VLAN filters. Without this patch, untrusted VF would not be able to access 8 VLAN filters. Fixes: cc71de8fa133 ("ice: Add support for VIRTCHNL_VF_OFFLOAD_VLAN_V2") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Mateusz Palczewski Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c +++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c @@ -2966,7 +2966,8 @@ ice_vc_validate_add_vlan_filter_list(str struct virtchnl_vlan_filtering_caps *vfc, struct virtchnl_vlan_filter_list_v2 *vfl) { - u16 num_requested_filters =3D vsi->num_vlan + vfl->num_elements; + u16 num_requested_filters =3D ice_vsi_num_non_zero_vlans(vsi) + + vfl->num_elements; =20 if (num_requested_filters > vfc->max_filters) return false; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51AD7C00144 for ; Mon, 1 Aug 2022 12:14:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233270AbiHAMOT (ORCPT ); Mon, 1 Aug 2022 08:14:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56770 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233782AbiHAMNi (ORCPT ); Mon, 1 Aug 2022 08:13:38 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 40A6940BE3; Mon, 1 Aug 2022 04:57:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BDE5A601C0; Mon, 1 Aug 2022 11:57:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9768C433D6; Mon, 1 Aug 2022 11:57:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355053; bh=y6ETTkAbglq6SU4Bo2p1DDhR7aHNjAN+eDL61AvGvuw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Irjo7jRENnP8AlbTMlOodhlIpwYT9e4HY6khHsk4Jf7gArH59qZXJG0cs6YRltURH hrvkUABNlYnWdPjQNJ/bOYFDIVl7q6nPs6WYnJknhOszQwU42BagUWqdSWbMfH9D10 b5L1kznkV8g6EZ2oFsCPNZ9fDUTFEQPnrBIJzbhg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maciej Fijalkowski , George Kuruvinakunnel , Tony Nguyen Subject: [PATCH 5.18 28/88] ice: check (DD | EOF) bits on Rx descriptor rather than (EOP | RS) Date: Mon, 1 Aug 2022 13:46:42 +0200 Message-Id: <20220801114139.305607949@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maciej Fijalkowski commit 283d736ff7c7e96ac5b32c6c0de40372f8eb171e upstream. Tx side sets EOP and RS bits on descriptors to indicate that a particular descriptor is the last one and needs to generate an irq when it was sent. These bits should not be checked on completion path regardless whether it's the Tx or the Rx. DD bit serves this purpose and it indicates that a particular descriptor is either for Rx or was successfully Txed. EOF is also set as loopback test does not xmit fragmented frames. Look at (DD | EOF) bits setting in ice_lbtest_receive_frames() instead of EOP and RS pair. Fixes: 0e674aeb0b77 ("ice: Add handler for ethtool selftest") Signed-off-by: Maciej Fijalkowski Tested-by: George Kuruvinakunnel Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/intel/ice/ice_ethtool.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c @@ -660,7 +660,8 @@ static int ice_lbtest_receive_frames(str rx_desc =3D ICE_RX_DESC(rx_ring, i); =20 if (!(rx_desc->wb.status_error0 & - cpu_to_le16(ICE_TX_DESC_CMD_EOP | ICE_TX_DESC_CMD_RS))) + (cpu_to_le16(BIT(ICE_RX_FLEX_DESC_STATUS0_DD_S)) | + cpu_to_le16(BIT(ICE_RX_FLEX_DESC_STATUS0_EOF_S))))) continue; =20 rx_buf =3D &rx_ring->rx_buf[i]; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 474ACC19F2A for ; Mon, 1 Aug 2022 12:15:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232649AbiHAMPf (ORCPT ); Mon, 1 Aug 2022 08:15:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38844 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233228AbiHAMOu (ORCPT ); Mon, 1 Aug 2022 08:14:50 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B13AF7858C; Mon, 1 Aug 2022 04:58:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 671D3B80E8F; Mon, 1 Aug 2022 11:58:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D049CC433C1; Mon, 1 Aug 2022 11:58:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355083; bh=iv8aXyOYAKbnZ+8BSaqMJfr4nzdWoMVAHy3Es2WIAeU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TB7WjXDmV6PqsY1JhJAjkgdj8YLzBAJ+1KCzPXnLtFocuY7HVfkP3/601bQLx1XKI YWmJT8JE4pmp955svSi1tR1iWmkNMwh+3fkALlOga6jN3QjjTkOerz4OnVzXfaJ4/x f3B8wdtVjuqCd8l8vo3WtQkk24/TGwygE2BJo4aU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maciej Fijalkowski , George Kuruvinakunnel , Tony Nguyen Subject: [PATCH 5.18 29/88] ice: do not setup vlan for loopback VSI Date: Mon, 1 Aug 2022 13:46:43 +0200 Message-Id: <20220801114139.353024978@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maciej Fijalkowski commit cc019545a238518fa9da1e2a889f6e1bb1005a63 upstream. Currently loopback test is failiing due to the error returned from ice_vsi_vlan_setup(). Skip calling it when preparing loopback VSI. Fixes: 0e674aeb0b77 ("ice: Add handler for ethtool selftest") Signed-off-by: Maciej Fijalkowski Tested-by: George Kuruvinakunnel Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/intel/ice/ice_main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/drivers/net/ethernet/intel/ice/ice_main.c +++ b/drivers/net/ethernet/intel/ice/ice_main.c @@ -5994,10 +5994,12 @@ int ice_vsi_cfg(struct ice_vsi *vsi) if (vsi->netdev) { ice_set_rx_mode(vsi->netdev); =20 - err =3D ice_vsi_vlan_setup(vsi); + if (vsi->type !=3D ICE_VSI_LB) { + err =3D ice_vsi_vlan_setup(vsi); =20 - if (err) - return err; + if (err) + return err; + } } ice_vsi_cfg_dcb_rings(vsi); From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DAD89C19F29 for ; Mon, 1 Aug 2022 12:16:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234271AbiHAMQ3 (ORCPT ); Mon, 1 Aug 2022 08:16:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40212 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234212AbiHAMPN (ORCPT ); Mon, 1 Aug 2022 08:15:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2301978DD1; Mon, 1 Aug 2022 04:58:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AD5A4601BD; Mon, 1 Aug 2022 11:58:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BAF1CC433C1; Mon, 1 Aug 2022 11:58:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355094; bh=kylcY1j2D2eTbNQf+jHP542bF54FMmv/+lnUvabInZM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fImbhH9LZGCKCSmWF6zoGGYoFTkk16QLGZLo2wesqUVpcPgEvIrWmt8fEtUl2lqNu XUwro3y5hXkCwhLECqHrMqlNEovqz8DupNUyVUGSjFKTvWnZREOfUae9d/qw5406tq USmh51oX4YhrNxjp6M0b8D1j6V6ZHHPpg7aM3lQ8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Anirudh Venkataramanan , Sylwester Dziedziuch , Mateusz Palczewski , Jedrzej Jagielski , Marek Szlosek , Tony Nguyen Subject: [PATCH 5.18 30/88] ice: Fix VSIs unable to share unicast MAC Date: Mon, 1 Aug 2022 13:46:44 +0200 Message-Id: <20220801114139.402674669@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Anirudh Venkataramanan commit 5c8e3c7ff3e7bd7b938659be704f75cc746b697f upstream. The driver currently does not allow two VSIs in the same PF domain to have the same unicast MAC address. This is incorrect in the sense that a policy decision is being made in the driver when it must be left to the user. This approach was causing issues when rebooting the system with VFs spawned not being able to change their MAC addresses. Such errors were present in dmesg: [ 7921.068237] ice 0000:b6:00.2 ens2f2: Unicast MAC 6a:0d:e4:70:ca:d1 alrea= dy exists on this PF. Preventing setting VF 7 unicast MAC address to 6a:0d:e4:= 70:ca:d1 Fix that by removing this restriction. Doing this also allows us to remove some additional code that's checking if a unicast MAC filter already exists. Fixes: 47ebc7b02485 ("ice: Check if unicast MAC exists before setting VF MA= C") Signed-off-by: Anirudh Venkataramanan Signed-off-by: Sylwester Dziedziuch Signed-off-by: Mateusz Palczewski Signed-off-by: Jedrzej Jagielski Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/intel/ice/ice_main.c | 2 + drivers/net/ethernet/intel/ice/ice_sriov.c | 40 ------------------------= ----- 2 files changed, 2 insertions(+), 40 deletions(-) --- a/drivers/net/ethernet/intel/ice/ice_main.c +++ b/drivers/net/ethernet/intel/ice/ice_main.c @@ -4640,6 +4640,8 @@ ice_probe(struct pci_dev *pdev, const st ice_set_safe_mode_caps(hw); } =20 + hw->ucast_shared =3D true; + err =3D ice_init_pf(pf); if (err) { dev_err(dev, "ice_init_pf failed: %d\n", err); --- a/drivers/net/ethernet/intel/ice/ice_sriov.c +++ b/drivers/net/ethernet/intel/ice/ice_sriov.c @@ -1310,39 +1310,6 @@ out_put_vf: } =20 /** - * ice_unicast_mac_exists - check if the unicast MAC exists on the PF's sw= itch - * @pf: PF used to reference the switch's rules - * @umac: unicast MAC to compare against existing switch rules - * - * Return true on the first/any match, else return false - */ -static bool ice_unicast_mac_exists(struct ice_pf *pf, u8 *umac) -{ - struct ice_sw_recipe *mac_recipe_list =3D - &pf->hw.switch_info->recp_list[ICE_SW_LKUP_MAC]; - struct ice_fltr_mgmt_list_entry *list_itr; - struct list_head *rule_head; - struct mutex *rule_lock; /* protect MAC filter list access */ - - rule_head =3D &mac_recipe_list->filt_rules; - rule_lock =3D &mac_recipe_list->filt_rule_lock; - - mutex_lock(rule_lock); - list_for_each_entry(list_itr, rule_head, list_entry) { - u8 *existing_mac =3D &list_itr->fltr_info.l_data.mac.mac_addr[0]; - - if (ether_addr_equal(existing_mac, umac)) { - mutex_unlock(rule_lock); - return true; - } - } - - mutex_unlock(rule_lock); - - return false; -} - -/** * ice_set_vf_mac * @netdev: network interface device structure * @vf_id: VF identifier @@ -1376,13 +1343,6 @@ int ice_set_vf_mac(struct net_device *ne if (ret) goto out_put_vf; =20 - if (ice_unicast_mac_exists(pf, mac)) { - netdev_err(netdev, "Unicast MAC %pM already exists on this PF. Preventin= g setting VF %u unicast MAC address to %pM\n", - mac, vf_id, mac); - ret =3D -EINVAL; - goto out_put_vf; - } - mutex_lock(&vf->cfg_lock); =20 /* VF is notified of its new MAC via the PF's response to the From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4AF2CC00144 for ; Mon, 1 Aug 2022 12:16:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234319AbiHAMQf (ORCPT ); Mon, 1 Aug 2022 08:16:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40544 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234240AbiHAMPQ (ORCPT ); Mon, 1 Aug 2022 08:15:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D6EC048EA2; Mon, 1 Aug 2022 04:58:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 60FE2601BD; Mon, 1 Aug 2022 11:58:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 70C03C433D6; Mon, 1 Aug 2022 11:58:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355096; bh=A4HOruPbbaKVIxq1nerFl1jW8NyTpVY694MfOQPQpO8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zTvBvqB8D6jr7tqRT5ducGLX+Q0ekoZpOdLhl0rdZ+fManccM6bF88mVxBewfpZJx KIzch5JQm8aiCW9SMjb7lt4w1y7WyJV4oXHMBu8LiwFvArqbwp/JwEsRj7jy99Ywcn ptf3D/iuyBSlI0+56XR4Bp5qqPARO+4B6uq97ErM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bart Van Assche , Liang He , "Martin K. Petersen" Subject: [PATCH 5.18 31/88] scsi: ufs: host: Hold reference returned by of_parse_phandle() Date: Mon, 1 Aug 2022 13:46:45 +0200 Message-Id: <20220801114139.455220675@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He commit a3435afba87dc6cd83f5595e7607f3c40f93ef01 upstream. In ufshcd_populate_vreg(), we should hold the reference returned by of_parse_phandle() and then use it to call of_node_put() for refcount balance. Link: https://lore.kernel.org/r/20220719071529.1081166-1-windhl@126.com Fixes: aa4976130934 ("ufs: Add regulator enable support") Reviewed-by: Bart Van Assche Signed-off-by: Liang He Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/scsi/ufs/ufshcd-pltfrm.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) --- a/drivers/scsi/ufs/ufshcd-pltfrm.c +++ b/drivers/scsi/ufs/ufshcd-pltfrm.c @@ -107,9 +107,20 @@ out: return ret; } =20 +static bool phandle_exists(const struct device_node *np, + const char *phandle_name, int index) +{ + struct device_node *parse_np =3D of_parse_phandle(np, phandle_name, index= ); + + if (parse_np) + of_node_put(parse_np); + + return parse_np !=3D NULL; +} + #define MAX_PROP_SIZE 32 static int ufshcd_populate_vreg(struct device *dev, const char *name, - struct ufs_vreg **out_vreg) + struct ufs_vreg **out_vreg) { char prop_name[MAX_PROP_SIZE]; struct ufs_vreg *vreg =3D NULL; @@ -121,7 +132,7 @@ static int ufshcd_populate_vreg(struct d } =20 snprintf(prop_name, MAX_PROP_SIZE, "%s-supply", name); - if (!of_parse_phandle(np, prop_name, 0)) { + if (!phandle_exists(np, prop_name, 0)) { dev_info(dev, "%s: Unable to find %s regulator, assuming enabled\n", __func__, prop_name); goto out; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C530C00144 for ; Mon, 1 Aug 2022 12:16:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234385AbiHAMQi (ORCPT ); Mon, 1 Aug 2022 08:16:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59316 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233670AbiHAMP2 (ORCPT ); Mon, 1 Aug 2022 08:15:28 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A5F8979EC0; Mon, 1 Aug 2022 04:58:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0F9CF601C3; Mon, 1 Aug 2022 11:58:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 18FAFC433D6; Mon, 1 Aug 2022 11:58:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355099; bh=5N9uNsQ0SJ0Qf0HCAEwVojCgpDfmLRr/FMEiPYEn17Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cVVezDBNsdhi+6plUeMK75V25SxyxgrUuuCFiAHjNsKGwHUo5hNgvlGcjK0zocrP3 ir9PWoau/lIjYm6kEEcyEE2rC2FApPMYb2+TRqzQeOK8rV0bOV9XuMTO5P2O0CWHa+ OpEJ2MHfzHXe7ujKwwKyKM/hDbEsJo/T8S8IYvnw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, LemmyHuang , Neal Cardwell , Wei Wang , Eric Dumazet , Jakub Kicinski Subject: [PATCH 5.18 32/88] Revert "tcp: change pingpong threshold to 3" Date: Mon, 1 Aug 2022 13:46:46 +0200 Message-Id: <20220801114139.498415881@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wei Wang commit 4d8f24eeedc58d5f87b650ddda73c16e8ba56559 upstream. This reverts commit 4a41f453bedfd5e9cd040bad509d9da49feb3e2c. This to-be-reverted commit was meant to apply a stricter rule for the stack to enter pingpong mode. However, the condition used to check for interactive session "before(tp->lsndtime, icsk->icsk_ack.lrcvtime)" is jiffy based and might be too coarse, which delays the stack entering pingpong mode. We revert this patch so that we no longer use the above condition to determine interactive session, and also reduce pingpong threshold to 1. Fixes: 4a41f453bedf ("tcp: change pingpong threshold to 3") Reported-by: LemmyHuang Suggested-by: Neal Cardwell Signed-off-by: Wei Wang Acked-by: Neal Cardwell Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220721204404.388396-1-weiwan@google.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- include/net/inet_connection_sock.h | 10 +--------- net/ipv4/tcp_output.c | 15 ++++++--------- 2 files changed, 7 insertions(+), 18 deletions(-) --- a/include/net/inet_connection_sock.h +++ b/include/net/inet_connection_sock.h @@ -323,7 +323,7 @@ void inet_csk_update_fastreuse(struct in =20 struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu); =20 -#define TCP_PINGPONG_THRESH 3 +#define TCP_PINGPONG_THRESH 1 =20 static inline void inet_csk_enter_pingpong_mode(struct sock *sk) { @@ -340,14 +340,6 @@ static inline bool inet_csk_in_pingpong_ return inet_csk(sk)->icsk_ack.pingpong >=3D TCP_PINGPONG_THRESH; } =20 -static inline void inet_csk_inc_pingpong_cnt(struct sock *sk) -{ - struct inet_connection_sock *icsk =3D inet_csk(sk); - - if (icsk->icsk_ack.pingpong < U8_MAX) - icsk->icsk_ack.pingpong++; -} - static inline bool inet_csk_has_ulp(struct sock *sk) { return inet_sk(sk)->is_icsk && !!inet_csk(sk)->icsk_ulp_ops; --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -167,16 +167,13 @@ static void tcp_event_data_sent(struct t if (tcp_packets_in_flight(tp) =3D=3D 0) tcp_ca_event(sk, CA_EVENT_TX_START); =20 - /* If this is the first data packet sent in response to the - * previous received data, - * and it is a reply for ato after last received packet, - * increase pingpong count. - */ - if (before(tp->lsndtime, icsk->icsk_ack.lrcvtime) && - (u32)(now - icsk->icsk_ack.lrcvtime) < icsk->icsk_ack.ato) - inet_csk_inc_pingpong_cnt(sk); - tp->lsndtime =3D now; + + /* If it is a reply for ato after last received + * packet, enter pingpong mode. + */ + if ((u32)(now - icsk->icsk_ack.lrcvtime) < icsk->icsk_ack.ato) + inet_csk_enter_pingpong_mode(sk); } =20 /* Account for an ACK we sent. */ From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CFFDBC00144 for ; Mon, 1 Aug 2022 12:16:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234409AbiHAMQo (ORCPT ); Mon, 1 Aug 2022 08:16:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39006 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234320AbiHAMPc (ORCPT ); Mon, 1 Aug 2022 08:15:32 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F1D1441981; Mon, 1 Aug 2022 04:58:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9282BB80EAC; Mon, 1 Aug 2022 11:58:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E304AC433D7; Mon, 1 Aug 2022 11:58:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355102; bh=LARZAiDrC/yVd6yIGxBo8r5qc1cW9qVjsXp3JdlPGDk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NI1M9BddxTbnQ6Mlsp6AV+SrQUKZmPCQvIk2ygze5s+Nif3oGFCSn/97JwlS8o5GQ WaqFb8sf77CilotN/qQotAjUXCuwYePnXPhutGxVt8iejLA4E3pGCiczbs7z+JmSfD QfQt3IbkPae8Phs+0j6IGs4RFPz85cdwUWVcyppI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Subbaraya Sundeep , Sunil Goutham , Paolo Abeni Subject: [PATCH 5.18 33/88] octeontx2-pf: Fix UDP/TCP src and dst port tc filters Date: Mon, 1 Aug 2022 13:46:47 +0200 Message-Id: <20220801114139.546511574@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Subbaraya Sundeep commit 59e1be6f83b928a04189bbf3ab683a1fc6248db3 upstream. Check the mask for non-zero value before installing tc filters for L4 source and destination ports. Otherwise installing a filter for source port installs destination port too and vice-versa. Fixes: 1d4d9e42c240 ("octeontx2-pf: Add tc flower hardware offload on ingre= ss traffic") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 30 +++++++++++---= ----- 1 file changed, 18 insertions(+), 12 deletions(-) --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c @@ -614,21 +614,27 @@ static int otx2_tc_prepare_flow(struct o =20 flow_spec->dport =3D match.key->dst; flow_mask->dport =3D match.mask->dst; - if (ip_proto =3D=3D IPPROTO_UDP) - req->features |=3D BIT_ULL(NPC_DPORT_UDP); - else if (ip_proto =3D=3D IPPROTO_TCP) - req->features |=3D BIT_ULL(NPC_DPORT_TCP); - else if (ip_proto =3D=3D IPPROTO_SCTP) - req->features |=3D BIT_ULL(NPC_DPORT_SCTP); + + if (flow_mask->dport) { + if (ip_proto =3D=3D IPPROTO_UDP) + req->features |=3D BIT_ULL(NPC_DPORT_UDP); + else if (ip_proto =3D=3D IPPROTO_TCP) + req->features |=3D BIT_ULL(NPC_DPORT_TCP); + else if (ip_proto =3D=3D IPPROTO_SCTP) + req->features |=3D BIT_ULL(NPC_DPORT_SCTP); + } =20 flow_spec->sport =3D match.key->src; flow_mask->sport =3D match.mask->src; - if (ip_proto =3D=3D IPPROTO_UDP) - req->features |=3D BIT_ULL(NPC_SPORT_UDP); - else if (ip_proto =3D=3D IPPROTO_TCP) - req->features |=3D BIT_ULL(NPC_SPORT_TCP); - else if (ip_proto =3D=3D IPPROTO_SCTP) - req->features |=3D BIT_ULL(NPC_SPORT_SCTP); + + if (flow_mask->sport) { + if (ip_proto =3D=3D IPPROTO_UDP) + req->features |=3D BIT_ULL(NPC_SPORT_UDP); + else if (ip_proto =3D=3D IPPROTO_TCP) + req->features |=3D BIT_ULL(NPC_SPORT_TCP); + else if (ip_proto =3D=3D IPPROTO_SCTP) + req->features |=3D BIT_ULL(NPC_SPORT_SCTP); + } } =20 return otx2_tc_parse_actions(nic, &rule->action, req, f, node); From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6985EC00144 for ; Mon, 1 Aug 2022 12:16:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234415AbiHAMQs (ORCPT ); Mon, 1 Aug 2022 08:16:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39130 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233283AbiHAMPf (ORCPT ); Mon, 1 Aug 2022 08:15:35 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CE4FA7AB08; Mon, 1 Aug 2022 04:58:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 590B0B8117B; Mon, 1 Aug 2022 11:58:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BA11BC433D6; Mon, 1 Aug 2022 11:58:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355105; bh=FAVsQMKM+xWsrgh2OtFVs4D7ZSSDfn563TOdSHFaIPA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WjuWALTGNy7naGHN/kx8H1TlxzWyeXs2YG3cUX9LD3RCqOoVOLXEciogAeny2Y9cU /o4mIFnFZ/Uny7Comd23SaVYYCIQrn48EFkis556JqMHfaD0wjPzqx6172iD5fPMJ5 iHdvNUgD5l4ypyabs9K/1IeXewjpnEPF0DWD1+lk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brian Vazquez , Eric Dumazet , David Ahern , Dmitry Safonov , Leonard Crestez , Jakub Kicinski Subject: [PATCH 5.18 34/88] tcp: md5: fix IPv4-mapped support Date: Mon, 1 Aug 2022 13:46:48 +0200 Message-Id: <20220801114139.588702628@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit e62d2e110356093c034998e093675df83057e511 upstream. After the blamed commit, IPv4 SYN packets handled by a dual stack IPv6 socket are dropped, even if perfectly valid. $ nstat | grep MD5 TcpExtTCPMD5Failure 5 0.0 For a dual stack listener, an incoming IPv4 SYN packet would call tcp_inbound_md5_hash() with @family =3D=3D AF_INET, while tp->af_specific is pointing to tcp_sock_ipv6_specific. Only later when an IPv4-mapped child is created, tp->af_specific is changed to tcp_sock_ipv6_mapped_specific. Fixes: 7bbb765b7349 ("net/tcp: Merge TCP-MD5 inbound callbacks") Reported-by: Brian Vazquez Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Dmitry Safonov Tested-by: Leonard Crestez Link: https://lore.kernel.org/r/20220726115743.2759832-1-edumazet@google.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -4481,9 +4481,18 @@ tcp_inbound_md5_hash(const struct sock * return SKB_DROP_REASON_TCP_MD5UNEXPECTED; } =20 - /* check the signature */ - genhash =3D tp->af_specific->calc_md5_hash(newhash, hash_expected, - NULL, skb); + /* Check the signature. + * To support dual stack listeners, we need to handle + * IPv4-mapped case. + */ + if (family =3D=3D AF_INET) + genhash =3D tcp_v4_md5_hash_skb(newhash, + hash_expected, + NULL, skb); + else + genhash =3D tp->af_specific->calc_md5_hash(newhash, + hash_expected, + NULL, skb); =20 if (genhash || memcmp(hash_location, newhash, 16) !=3D 0) { NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE); From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34BDCC19F29 for ; Mon, 1 Aug 2022 12:16:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234325AbiHAMQz (ORCPT ); Mon, 1 Aug 2022 08:16:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39370 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234360AbiHAMPt (ORCPT ); Mon, 1 Aug 2022 08:15:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 301C17A519; Mon, 1 Aug 2022 04:58:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 76E7D601BD; Mon, 1 Aug 2022 11:58:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7DC71C433D6; Mon, 1 Aug 2022 11:58:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355107; bh=o8COW7HGUbdghPKHXH+743bq+xK9nKbl1dSwaMzfLyg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GKARKcSN+nb6WqmzQzB/OGywAuYhrlnbnR9XiUF6RfKu+SX68IdiTIrwHAT1vENau 8CELF4+P6WwRMdpuV54etP5ns4quZZk7XDthCwu8sU+XFAGL5ibxG8aI5seSPsZuZ5 dfLQm3o9b0QrHzxXPhEEWfFNvaj3LZtcL3GlHmWw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" Subject: [PATCH 5.18 35/88] tcp: Fix data-races around sysctl_tcp_moderate_rcvbuf. Date: Mon, 1 Aug 2022 13:46:49 +0200 Message-Id: <20220801114139.634683929@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima commit 780476488844e070580bfc9e3bc7832ec1cea883 upstream. While reading sysctl_tcp_moderate_rcvbuf, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_input.c | 2 +- net/mptcp/protocol.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -724,7 +724,7 @@ void tcp_rcv_space_adjust(struct sock *s * */ =20 - if (sock_net(sk)->ipv4.sysctl_tcp_moderate_rcvbuf && + if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_moderate_rcvbuf) && !(sk->sk_userlocks & SOCK_RCVBUF_LOCK)) { int rcvmem, rcvbuf; u64 rcvwin, grow; --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1882,7 +1882,7 @@ static void mptcp_rcv_space_adjust(struc if (msk->rcvq_space.copied <=3D msk->rcvq_space.space) goto new_measure; =20 - if (sock_net(sk)->ipv4.sysctl_tcp_moderate_rcvbuf && + if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_moderate_rcvbuf) && !(sk->sk_userlocks & SOCK_RCVBUF_LOCK)) { int rcvmem, rcvbuf; u64 rcvwin, grow; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70C55C00144 for ; Mon, 1 Aug 2022 12:13:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234146AbiHAMN0 (ORCPT ); Mon, 1 Aug 2022 08:13:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56404 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234730AbiHAMLp (ORCPT ); Mon, 1 Aug 2022 08:11:45 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF670481C9; Mon, 1 Aug 2022 04:57:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7001DB81171; Mon, 1 Aug 2022 11:57:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B2D3DC433D6; Mon, 1 Aug 2022 11:57:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355025; bh=duJXs/MwYWe9WFVVbbIUKq3oSqOCvs+9Q1cghxhSnzc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MGEuqoIzKbsX4DnFlVfU1T7QTQC9fnUmKIunM5GyKg27a/9AP3YCjF9okiF/Y2xC7 dv1AqM6vkE/oQg/Rs30PIpsjd+q+llqbG1NzqIGO8mwR0Xs0RRLbWddhFb11PP+KL1 Lh7F0iIfCpKcRft8xDJYzepQlyqwG9CRtjfM1nKI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" Subject: [PATCH 5.18 36/88] tcp: Fix a data-race around sysctl_tcp_limit_output_bytes. Date: Mon, 1 Aug 2022 13:46:50 +0200 Message-Id: <20220801114139.684478849@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima commit 9fb90193fbd66b4c5409ef729fd081861f8b6351 upstream. While reading sysctl_tcp_limit_output_bytes, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 46d3ceabd8d9 ("tcp: TCP Small Queues") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2502,7 +2502,7 @@ static bool tcp_small_queue_check(struct sk->sk_pacing_rate >> READ_ONCE(sk->sk_pacing_shift)); if (sk->sk_pacing_status =3D=3D SK_PACING_NONE) limit =3D min_t(unsigned long, limit, - sock_net(sk)->ipv4.sysctl_tcp_limit_output_bytes); + READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_limit_output_bytes)); limit <<=3D factor; =20 if (static_branch_unlikely(&tcp_tx_delay_enabled) && From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6371C00144 for ; Mon, 1 Aug 2022 12:13:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234075AbiHAMNM (ORCPT ); Mon, 1 Aug 2022 08:13:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59318 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234676AbiHAMLm (ORCPT ); Mon, 1 Aug 2022 08:11:42 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1871C70E6E; Mon, 1 Aug 2022 04:57:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2BB4EB8117B; Mon, 1 Aug 2022 11:57:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7955DC433D6; Mon, 1 Aug 2022 11:57:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355027; bh=31vVhFlSyCI77aCVxwprprqd0eO6nDDqivwqh5W4HTA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iFLoOfgOCPHivvNUf13iKkgs+GBgaRz5PF+bHubxIcNFtOFHKIlGUXZqDS6uIsK6+ a5OKzP3fLPKwHdPrOpK7MG8RDq4lgAJnYWtWtYrE4+oSBQrHo9JVGMY+zlKUztjoKk gxWhOXk+LTf3UpYXv2sWM5DVsMOGqoFYf6n4v8tA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" Subject: [PATCH 5.18 37/88] tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit. Date: Mon, 1 Aug 2022 13:46:51 +0200 Message-Id: <20220801114139.735213860@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima commit db3815a2fa691da145cfbe834584f31ad75df9ff upstream. While reading sysctl_tcp_challenge_ack_limit, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -3629,7 +3629,7 @@ static void tcp_send_challenge_ack(struc /* Then check host-wide RFC 5961 rate limit. */ now =3D jiffies / HZ; if (now !=3D challenge_timestamp) { - u32 ack_limit =3D net->ipv4.sysctl_tcp_challenge_ack_limit; + u32 ack_limit =3D READ_ONCE(net->ipv4.sysctl_tcp_challenge_ack_limit); u32 half =3D (ack_limit + 1) >> 1; =20 challenge_timestamp =3D now; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03B16C19F29 for ; Mon, 1 Aug 2022 12:13:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234159AbiHAMNa (ORCPT ); Mon, 1 Aug 2022 08:13:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56412 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234743AbiHAMLr (ORCPT ); Mon, 1 Aug 2022 08:11:47 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7F07671BD5; Mon, 1 Aug 2022 04:57:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2034660011; Mon, 1 Aug 2022 11:57:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D2EEC433D7; Mon, 1 Aug 2022 11:57:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355030; bh=aJiWP4ED4wvxmCGNNZYxNFqOxxTEHvjtMy5sHDg0GGw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2dYtxjEARher1qs6pm7A9HFSPPwwS18pSUTFDZIaw7I4F5ubLbPNDa32kkRQ1pibw WmfX8n7VeEqTLsuoDlnZ+Wx7OUatoU4L2xYfTvGO55tJCRFqTaNJbk3rT1vX4ZyOeg 1TLA3OuWs3Rmvr6HvHdTm5JHFzUr7lONdArP9yR0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+d44b35ecfb807e5af0b5@syzkaller.appspotmail.com, Christoph Hellwig , Bart Van Assche , Jason Yan , "Martin K. Petersen" Subject: [PATCH 5.18 38/88] scsi: core: Fix warning in scsi_alloc_sgtables() Date: Mon, 1 Aug 2022 13:46:52 +0200 Message-Id: <20220801114139.783672341@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jason Yan commit d9a434fa0c12ed5f7afe1e9dd30003ab5d059b85 upstream. As explained in SG_IO howto[1]: "If iovec_count is non-zero then 'dxfer_len' should be equal to the sum of iov_len lengths. If not, the minimum of the two is the transfer length." When iovec_count is non-zero and dxfer_len is zero, the sg_io() just genarated a null bio, and finally caused a warning below. To fix it, skip generating a bio for this request if dxfer_len is zero. [1] https://tldp.org/HOWTO/SCSI-Generic-HOWTO/x198.html WARNING: CPU: 2 PID: 3643 at drivers/scsi/scsi_lib.c:1032 scsi_alloc_sgtabl= es+0xc7d/0xf70 drivers/scsi/scsi_lib.c:1032 Modules linked in: CPU: 2 PID: 3643 Comm: syz-executor397 Not tainted 5.17.0-rc3-syzkaller-00316-gb81b1829e7e3 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-204/01/2014 RIP: 0010:scsi_alloc_sgtables+0xc7d/0xf70 drivers/scsi/scsi_lib.c:1032 Code: e7 fc 31 ff 44 89 f6 e8 c1 4e e7 fc 45 85 f6 0f 84 1a f5 ff ff e8 93 4c e7 fc 83 c5 01 0f b7 ed e9 0f f5 ff ff e8 83 4c e7 fc <0f> 0b 41 bc 0a 00 00 00 e9 2b fb ff ff 41 bc 09 00 00 00 e9 20 fb RSP: 0018:ffffc90000d07558 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88801bfc96a0 RCX: 0000000000000000 RDX: ffff88801c876000 RSI: ffffffff849060bd RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff849055b9 R11: 0000000000000000 R12: ffff888012b8c000 R13: ffff88801bfc9580 R14: 0000000000000000 R15: ffff88801432c000 FS: 00007effdec8e700(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007effdec6d718 CR3: 00000000206d6000 CR4: 0000000000150ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: scsi_setup_scsi_cmnd drivers/scsi/scsi_lib.c:1219 [inline] scsi_prepare_cmd drivers/scsi/scsi_lib.c:1614 [inline] scsi_queue_rq+0x283e/0x3630 drivers/scsi/scsi_lib.c:1730 blk_mq_dispatch_rq_list+0x6ea/0x22e0 block/blk-mq.c:1851 __blk_mq_sched_dispatch_requests+0x20b/0x410 block/blk-mq-sched.c:299 blk_mq_sched_dispatch_requests+0xfb/0x180 block/blk-mq-sched.c:332 __blk_mq_run_hw_queue+0xf9/0x350 block/blk-mq.c:1968 __blk_mq_delay_run_hw_queue+0x5b6/0x6c0 block/blk-mq.c:2045 blk_mq_run_hw_queue+0x30f/0x480 block/blk-mq.c:2096 blk_mq_sched_insert_request+0x340/0x440 block/blk-mq-sched.c:451 blk_execute_rq+0xcc/0x340 block/blk-mq.c:1231 sg_io+0x67c/0x1210 drivers/scsi/scsi_ioctl.c:485 scsi_ioctl_sg_io drivers/scsi/scsi_ioctl.c:866 [inline] scsi_ioctl+0xa66/0x1560 drivers/scsi/scsi_ioctl.c:921 sd_ioctl+0x199/0x2a0 drivers/scsi/sd.c:1576 blkdev_ioctl+0x37a/0x800 block/ioctl.c:588 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7effdecdc5d9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007effdec8e2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007effded664c0 RCX: 00007effdecdc5d9 RDX: 0000000020002300 RSI: 0000000000002285 RDI: 0000000000000004 RBP: 00007effded34034 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 00007effded34054 R14: 2f30656c69662f2e R15: 00007effded664c8 Link: https://lore.kernel.org/r/20220720025120.3226770-1-yanaijie@huawei.com Fixes: 25636e282fe9 ("block: fix SG_IO vector request data length handling") Reported-by: syzbot+d44b35ecfb807e5af0b5@syzkaller.appspotmail.com Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Signed-off-by: Jason Yan Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/scsi/scsi_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/scsi/scsi_ioctl.c +++ b/drivers/scsi/scsi_ioctl.c @@ -450,7 +450,7 @@ static int sg_io(struct scsi_device *sde goto out_put_request; =20 ret =3D 0; - if (hdr->iovec_count) { + if (hdr->iovec_count && hdr->dxfer_len) { struct iov_iter i; struct iovec *iov =3D NULL; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CDD23C19F2A for ; Mon, 1 Aug 2022 12:13:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233521AbiHAMNQ (ORCPT ); Mon, 1 Aug 2022 08:13:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56232 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234704AbiHAMLn (ORCPT ); Mon, 1 Aug 2022 08:11:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CFB0A7173D; Mon, 1 Aug 2022 04:57:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DE310601C0; Mon, 1 Aug 2022 11:57:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E79C7C433B5; Mon, 1 Aug 2022 11:57:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355033; bh=nD4Jw/AEkwftyi/ilIfxVsQWBaTUwluPwcx9dvaFgZo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zWkk8GzWt62CUUIq8PZn5xh6cHM0YrzoEcu45QG1E++5vC206Pq8Ki8vY/Ffr4ai7 /fqpx3J8LoC1bhESz1byyiEqAbz69PlS8Wf2YeoGwXZCaF8O0CVJ0mpAG0bnmtcD99 bCtV5Jdu5XLjNeo6W0Q83dOcJzFK3GKGcZdPbQ6U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Laurence Oberman , Sreekanth Reddy , David Jeffery , "Martin K. Petersen" Subject: [PATCH 5.18 39/88] scsi: mpt3sas: Stop fw fault watchdog work item during system shutdown Date: Mon, 1 Aug 2022 13:46:53 +0200 Message-Id: <20220801114139.822193246@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Jeffery commit 0fde22c5420ed258ee538a760291c2f3935f6a01 upstream. During system shutdown or reboot, mpt3sas will reset the firmware back to ready state. However, the driver leaves running a watchdog work item intended to keep the firmware in operational state. This causes a second, unneeded reset on shutdown and moves the firmware back to operational instead of in ready state as intended. And if the mpt3sas_fwfault_debug module parameter is set, this extra reset also panics the system. mpt3sas's scsih_shutdown needs to stop the watchdog before resetting the firmware back to ready state. Link: https://lore.kernel.org/r/20220722142448.6289-1-djeffery@redhat.com Fixes: fae21608c31c ("scsi: mpt3sas: Transition IOC to Ready state during s= hutdown") Tested-by: Laurence Oberman Acked-by: Sreekanth Reddy Signed-off-by: David Jeffery Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c @@ -11386,6 +11386,7 @@ scsih_shutdown(struct pci_dev *pdev) _scsih_ir_shutdown(ioc); _scsih_nvme_shutdown(ioc); mpt3sas_base_mask_interrupts(ioc); + mpt3sas_base_stop_watchdog(ioc); ioc->shost_recovery =3D 1; mpt3sas_base_make_ioc_ready(ioc, SOFT_RESET); ioc->shost_recovery =3D 0; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6889C19F2A for ; Mon, 1 Aug 2022 12:13:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233701AbiHAMNi (ORCPT ); Mon, 1 Aug 2022 08:13:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56210 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234879AbiHAML4 (ORCPT ); Mon, 1 Aug 2022 08:11:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DCBAD74367; Mon, 1 Aug 2022 04:57:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EBCFF601BF; Mon, 1 Aug 2022 11:57:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C531CC433C1; Mon, 1 Aug 2022 11:57:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355036; bh=OhfhvKc1nqIDSzYblobrHs06fcDNb0jZmJLLMzOVQZU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ta8YRB3W4lOxZvX/0lwMe2YWgdTNcJ2gtwXogA6jXQE/oVaJ17Zg4fqsrKKC3Gnlm /tlF22BYrl7i61MH78ZaGqNsek3CQPvgqlOMbdoeN6E0+ph72yg2FdKpEAoSSdfyCZ UsYeKv+TmsPDhIGEEkJzaWFrVZ6nr06FixSask/w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+a8430774139ec3ab7176@syzkaller.appspotmail.com, Ayushman Dutta , Kuniyuki Iwashima , David Ahern , Eric Dumazet , Jakub Kicinski Subject: [PATCH 5.18 40/88] net: ping6: Fix memleak in ipv6_renew_options(). Date: Mon, 1 Aug 2022 13:46:54 +0200 Message-Id: <20220801114139.874563134@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima commit e27326009a3d247b831eda38878c777f6f4eb3d1 upstream. When we close ping6 sockets, some resources are left unfreed because pingv6_prot is missing sk->sk_prot->destroy(). As reported by syzbot [0], just three syscalls leak 96 bytes and easily cause OOM. struct ipv6_sr_hdr *hdr; char data[24] =3D {0}; int fd; hdr =3D (struct ipv6_sr_hdr *)data; hdr->hdrlen =3D 2; hdr->type =3D IPV6_SRCRT_TYPE_4; fd =3D socket(AF_INET6, SOCK_DGRAM, NEXTHDR_ICMP); setsockopt(fd, IPPROTO_IPV6, IPV6_RTHDR, data, 24); close(fd); To fix memory leaks, let's add a destroy function. Note the socket() syscall checks if the GID is within the range of net.ipv4.ping_group_range. The default value is [1, 0] so that no GID meets the condition (1 <=3D GID <=3D 0). Thus, the local DoS does not succeed until we change the default value. However, at least Ubuntu/Fedora/RHEL loosen it. $ cat /usr/lib/sysctl.d/50-default.conf ... -net.ipv4.ping_group_range =3D 0 2147483647 Also, there could be another path reported with these options, and some of them require CAP_NET_RAW. setsockopt IPV6_ADDRFORM (inet6_sk(sk)->pktoptions) IPV6_RECVPATHMTU (inet6_sk(sk)->rxpmtu) IPV6_HOPOPTS (inet6_sk(sk)->opt) IPV6_RTHDRDSTOPTS (inet6_sk(sk)->opt) IPV6_RTHDR (inet6_sk(sk)->opt) IPV6_DSTOPTS (inet6_sk(sk)->opt) IPV6_2292PKTOPTIONS (inet6_sk(sk)->opt) getsockopt IPV6_FLOWLABEL_MGR (inet6_sk(sk)->ipv6_fl_list) For the record, I left a different splat with syzbot's one. unreferenced object 0xffff888006270c60 (size 96): comm "repro2", pid 231, jiffies 4294696626 (age 13.118s) hex dump (first 32 bytes): 01 00 00 00 44 00 00 00 00 00 00 00 00 00 00 00 ....D........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000f6bc7ea9>] sock_kmalloc (net/core/sock.c:2564 net/core/sock= .c:2554) [<000000006d699550>] do_ipv6_setsockopt.constprop.0 (net/ipv6/ipv6_so= ckglue.c:715) [<00000000c3c3b1f5>] ipv6_setsockopt (net/ipv6/ipv6_sockglue.c:1024) [<000000007096a025>] __sys_setsockopt (net/socket.c:2254) [<000000003a8ff47b>] __x64_sys_setsockopt (net/socket.c:2265 net/sock= et.c:2262 net/socket.c:2262) [<000000007c409dcb>] do_syscall_64 (arch/x86/entry/common.c:50 arch/x= 86/entry/common.c:80) [<00000000e939c4a9>] entry_SYSCALL_64_after_hwframe (arch/x86/entry/e= ntry_64.S:120) [0]: https://syzkaller.appspot.com/bug?extid=3Da8430774139ec3ab7176 Fixes: 6d0bfe226116 ("net: ipv6: Add IPv6 support to the ping socket.") Reported-by: syzbot+a8430774139ec3ab7176@syzkaller.appspotmail.com Reported-by: Ayushman Dutta Signed-off-by: Kuniyuki Iwashima Reviewed-by: David Ahern Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220728012220.46918-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv6/ping.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/net/ipv6/ping.c +++ b/net/ipv6/ping.c @@ -22,6 +22,11 @@ #include #include =20 +static void ping_v6_destroy(struct sock *sk) +{ + inet6_destroy_sock(sk); +} + /* Compatibility glue so we can support IPv6 when it's compiled as a modul= e */ static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int = len, int *addr_len) @@ -181,6 +186,7 @@ struct proto pingv6_prot =3D { .owner =3D THIS_MODULE, .init =3D ping_init_sock, .close =3D ping_close, + .destroy =3D ping_v6_destroy, .connect =3D ip6_datagram_connect_v6_only, .disconnect =3D __udp_disconnect, .setsockopt =3D ipv6_setsockopt, From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3AF6CC00144 for ; Mon, 1 Aug 2022 12:14:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234197AbiHAMN5 (ORCPT ); Mon, 1 Aug 2022 08:13:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57510 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234012AbiHAMMW (ORCPT ); Mon, 1 Aug 2022 08:12:22 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8F1A940BD5; Mon, 1 Aug 2022 04:57:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id D941FCE13BA; Mon, 1 Aug 2022 11:57:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EE70BC433C1; Mon, 1 Aug 2022 11:57:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355039; bh=5uesq9rIRXGZcge29XMMG/2+QB+X/pWuqao7Azxf3tk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RJVgbBSuObktD+2ryMc8zfX3t33BRnuj7WME8sKXNoC5O9vAgIfM/rQsMd88S3HM/ WZpYRweoxm/zGH8Y57n+VmPyvypWD/TVJaddMQ3WCF/djUjWs8GQ6iKnMNrmnxnHwm 426U1uPJfGgiCzoEcPuAyB2hwbth8jYopy39mUmY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ziyang Xuan , David Ahern , Jakub Kicinski Subject: [PATCH 5.18 41/88] ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr Date: Mon, 1 Aug 2022 13:46:55 +0200 Message-Id: <20220801114139.921794555@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ziyang Xuan commit 85f0173df35e5462d89947135a6a5599c6c3ef6f upstream. Change net device's MTU to smaller than IPV6_MIN_MTU or unregister device while matching route. That may trigger null-ptr-deref bug for ip6_ptr probability as following. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D BUG: KASAN: null-ptr-deref in find_match.part.0+0x70/0x134 Read of size 4 at addr 0000000000000308 by task ping6/263 CPU: 2 PID: 263 Comm: ping6 Not tainted 5.19.0-rc7+ #14 Call trace: dump_backtrace+0x1a8/0x230 show_stack+0x20/0x70 dump_stack_lvl+0x68/0x84 print_report+0xc4/0x120 kasan_report+0x84/0x120 __asan_load4+0x94/0xd0 find_match.part.0+0x70/0x134 __find_rr_leaf+0x408/0x470 fib6_table_lookup+0x264/0x540 ip6_pol_route+0xf4/0x260 ip6_pol_route_output+0x58/0x70 fib6_rule_lookup+0x1a8/0x330 ip6_route_output_flags_noref+0xd8/0x1a0 ip6_route_output_flags+0x58/0x160 ip6_dst_lookup_tail+0x5b4/0x85c ip6_dst_lookup_flow+0x98/0x120 rawv6_sendmsg+0x49c/0xc70 inet_sendmsg+0x68/0x94 Reproducer as following: Firstly, prepare conditions: $ip netns add ns1 $ip netns add ns2 $ip link add veth1 type veth peer name veth2 $ip link set veth1 netns ns1 $ip link set veth2 netns ns2 $ip netns exec ns1 ip -6 addr add 2001:0db8:0:f101::1/64 dev veth1 $ip netns exec ns2 ip -6 addr add 2001:0db8:0:f101::2/64 dev veth2 $ip netns exec ns1 ifconfig veth1 up $ip netns exec ns2 ifconfig veth2 up $ip netns exec ns1 ip -6 route add 2000::/64 dev veth1 metric 1 $ip netns exec ns2 ip -6 route add 2001::/64 dev veth2 metric 1 Secondly, execute the following two commands in two ssh windows respectively: $ip netns exec ns1 sh $while true; do ip -6 addr add 2001:0db8:0:f101::1/64 dev veth1; ip -6 rout= e add 2000::/64 dev veth1 metric 1; ping6 2000::2; done $ip netns exec ns1 sh $while true; do ip link set veth1 mtu 1000; ip link set veth1 mtu 1500; sle= ep 5; done It is because ip6_ptr has been assigned to NULL in addrconf_ifdown() firstl= y, then ip6_ignore_linkdown() accesses ip6_ptr directly without NULL check. cpu0 cpu1 fib6_table_lookup __find_rr_leaf addrconf_notify [ NETDEV_CHANGEMTU ] addrconf_ifdown RCU_INIT_POINTER(dev->ip6_ptr, NULL) find_match ip6_ignore_linkdown So we can add NULL check for ip6_ptr before using in ip6_ignore_linkdown() = to fix the null-ptr-deref bug. Fixes: dcd1f572954f ("net/ipv6: Remove fib6_idev") Signed-off-by: Ziyang Xuan Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20220728013307.656257-1-william.xuanziyang@= huawei.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- include/net/addrconf.h | 3 +++ 1 file changed, 3 insertions(+) --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -405,6 +405,9 @@ static inline bool ip6_ignore_linkdown(c { const struct inet6_dev *idev =3D __in6_dev_get(dev); =20 + if (unlikely(!idev)) + return true; + return !!idev->cnf.ignore_routes_with_linkdown; } From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9F7F4C00144 for ; Mon, 1 Aug 2022 12:13:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233917AbiHAMNm (ORCPT ); Mon, 1 Aug 2022 08:13:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56412 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233839AbiHAMMH (ORCPT ); Mon, 1 Aug 2022 08:12:07 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C1D39747A9; Mon, 1 Aug 2022 04:57:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BC54F6010C; Mon, 1 Aug 2022 11:57:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C7079C433C1; Mon, 1 Aug 2022 11:57:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355042; bh=RrVXgdvfQtwSt4RGJnS3IJQPKE/wnM+B5zyTBr4hOo8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BlbFaccMGSGElkk20bqO3GCi0d36fh7iIRA0LlwtWPH3qgpEJN2HDvsnTQsfpvhnJ GKouLfHYNAUyZqz7gepjb5aU7eiDMOSECuJ1bGoOZtIpMf5yOvEchhGQN1Nyk2J1I7 RQdTfG1qVUSLRbyshSxRZXPwVZstePyAr0ZROr8s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maxim Mikityanskiy , Tariq Toukan , "David S. Miller" Subject: [PATCH 5.18 42/88] net/tls: Remove the context from the list in tls_device_down Date: Mon, 1 Aug 2022 13:46:56 +0200 Message-Id: <20220801114139.964066737@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maxim Mikityanskiy commit f6336724a4d4220c89a4ec38bca84b03b178b1a3 upstream. tls_device_down takes a reference on all contexts it's going to move to the degraded state (software fallback). If sk_destruct runs afterwards, it can reduce the reference counter back to 1 and return early without destroying the context. Then tls_device_down will release the reference it took and call tls_device_free_ctx. However, the context will still stay in tls_device_down_list forever. The list will contain an item, memory for which is released, making a memory corruption possible. Fix the above bug by properly removing the context from all lists before any call to tls_device_free_ctx. Fixes: 3740651bf7e2 ("tls: Fix context leak on tls_device_down") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/tls/tls_device.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/net/tls/tls_device.c +++ b/net/tls/tls_device.c @@ -1351,8 +1351,13 @@ static int tls_device_down(struct net_de * by tls_device_free_ctx. rx_conf and tx_conf stay in TLS_HW. * Now release the ref taken above. */ - if (refcount_dec_and_test(&ctx->refcount)) + if (refcount_dec_and_test(&ctx->refcount)) { + /* sk_destruct ran after tls_device_down took a ref, and + * it returned early. Complete the destruction here. + */ + list_del(&ctx->list); tls_device_free_ctx(ctx); + } } =20 up_write(&device_offload_lock); From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1AE9FC19F29 for ; Mon, 1 Aug 2022 12:14:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234065AbiHAMOB (ORCPT ); Mon, 1 Aug 2022 08:14:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57540 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234029AbiHAMMX (ORCPT ); Mon, 1 Aug 2022 08:12:23 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2638274DE0; Mon, 1 Aug 2022 04:57:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 72BA2601CE; Mon, 1 Aug 2022 11:57:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83288C433C1; Mon, 1 Aug 2022 11:57:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355044; bh=ByQukd9uLY06XlywYZfodLC5/VmwGwQ2h7kHwKrbhpc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IkEfRLlteMBHtQqH3iZisT1nogsnU8kyT291zL1dpWrckfsQGQ+j+wvVofog1GNTP RVU6BarZbeL46Z23zq4w6h4YNzEwTcdPJbe33pLr25jP5RUN7ToOyDS363xAosNv4x 8PlCwXEROPe9ZIVOWMAY+vlHkSXBEy8tue+bYZig= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vladimir Oltean , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.18 43/88] net: pcs: xpcs: propagate xpcs_read error to xpcs_get_state_c37_sgmii Date: Mon, 1 Aug 2022 13:46:57 +0200 Message-Id: <20220801114140.014397322@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vladimir Oltean [ Upstream commit 27161db0904ee48e59140aa8d0835939a666c1f1 ] While phylink_pcs_ops :: pcs_get_state does return void, xpcs_get_state() does check for a non-zero return code from xpcs_get_state_c37_sgmii() and prints that as a message to the kernel log. However, a non-zero return code from xpcs_read() is translated into "return false" (i.e. zero as int) and the I/O error is therefore not printed. Fix that. Fixes: b97b5331b8ab ("net: pcs: add C37 SGMII AN support for intel mGbE con= troller") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220720112057.3504398-1-vladimir.oltean@nx= p.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/pcs/pcs-xpcs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/pcs/pcs-xpcs.c b/drivers/net/pcs/pcs-xpcs.c index 61418d4dc0cd..8768f6e34846 100644 --- a/drivers/net/pcs/pcs-xpcs.c +++ b/drivers/net/pcs/pcs-xpcs.c @@ -898,7 +898,7 @@ static int xpcs_get_state_c37_sgmii(struct dw_xpcs *xpc= s, */ ret =3D xpcs_read(xpcs, MDIO_MMD_VEND2, DW_VR_MII_AN_INTR_STS); if (ret < 0) - return false; + return ret; =20 if (ret & DW_VR_MII_C37_ANSGM_SP_LNKSTS) { int speed_value; --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F38B2C00144 for ; Mon, 1 Aug 2022 12:14:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234145AbiHAMOL (ORCPT ); Mon, 1 Aug 2022 08:14:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234125AbiHAMNV (ORCPT ); Mon, 1 Aug 2022 08:13:21 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4D35673927; Mon, 1 Aug 2022 04:57:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DCE1BB80E8F; Mon, 1 Aug 2022 11:57:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4CC34C433C1; Mon, 1 Aug 2022 11:57:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355047; bh=0hleLRWE8Q45RrhCoyizBtJ12n71tJoyut4fO0ZKcXE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OZtYQ1xQiiPp8+9ydf2v33ZC15iaVU4FDYy9sRCLIBlBoEpqC0TQ4rfTTM9gwOgmx g3Gwgctlkb8FZraJs4u5lwp+VA32J0FdMshmR1Hscy8iy/k7kNW0fKe03kZt9SsEXX uFjK9ILQKWnlSAeYH7j7ac6k8arIw8qOOqXOpMlY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.18 44/88] net: sungem_phy: Add of_node_put() for reference returned by of_get_parent() Date: Mon, 1 Aug 2022 13:46:58 +0200 Message-Id: <20220801114140.063065871@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit ebbbe23fdf6070e31509638df3321688358cc211 ] In bcm5421_init(), we should call of_node_put() for the reference returned by of_get_parent() which has increased the refcount. Fixes: 3c326fe9cb7a ("[PATCH] ppc64: Add new PHY to sungem") Signed-off-by: Liang He Link: https://lore.kernel.org/r/20220720131003.1287426-1-windhl@126.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/sungem_phy.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/sungem_phy.c b/drivers/net/sungem_phy.c index 4daac5fda073..0d40d265b688 100644 --- a/drivers/net/sungem_phy.c +++ b/drivers/net/sungem_phy.c @@ -454,6 +454,7 @@ static int bcm5421_init(struct mii_phy* phy) int can_low_power =3D 1; if (np =3D=3D NULL || of_get_property(np, "no-autolowpower", NULL)) can_low_power =3D 0; + of_node_put(np); if (can_low_power) { /* Enable automatic low-power */ sungem_phy_write(phy, 0x1c, 0x9002); --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F7CFC19F29 for ; Mon, 1 Aug 2022 12:14:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233794AbiHAMOQ (ORCPT ); Mon, 1 Aug 2022 08:14:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56258 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234140AbiHAMNZ (ORCPT ); Mon, 1 Aug 2022 08:13:25 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E9589753AD; Mon, 1 Aug 2022 04:57:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A05AAB81177; Mon, 1 Aug 2022 11:57:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0AAFC43470; Mon, 1 Aug 2022 11:57:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355050; bh=FyEep/jFRSTtylJI1Fb5kcB37dDN715UCJD70qJGHJE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lzdlSMpy0In8chgiOrBZx1yozdP81uRKxMMII4XrvIKoJm+OhhE/s9NryJAJ1oyhV pP6kJegIDcA1Cy0jgV3T3Qaq2oShwetdTWpop6WhOfCwYvmYiJhtu4tYqqOqCWieEZ njFvr7pMJ64+8DhFW+HABlFcJAkJLq6rGoPcWjOU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Rix , Ido Schimmel , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.18 45/88] mlxsw: spectrum_router: simplify list unwinding Date: Mon, 1 Aug 2022 13:46:59 +0200 Message-Id: <20220801114140.109582978@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tom Rix [ Upstream commit 6f2f36e5f932c58e370bff79aba7f05963ea1c2a ] The setting of i here err_nexthop6_group_get: i =3D nrt6; Is redundant, i is already nrt6. So remove this statement. The for loop for the unwinding err_rt6_create: for (i--; i >=3D 0; i--) { Is equivelent to for (; i > 0; i--) { Two consecutive labels can be reduced to one. Signed-off-by: Tom Rix Reviewed-by: Ido Schimmel Link: https://lore.kernel.org/r/20220402121516.2750284-1-trix@redhat.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- .../ethernet/mellanox/mlxsw/spectrum_router.c | 20 ++++++++----------- 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/driver= s/net/ethernet/mellanox/mlxsw/spectrum_router.c index c00d6c4ed37c..245d36696486 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c @@ -7022,7 +7022,7 @@ mlxsw_sp_fib6_entry_nexthop_add(struct mlxsw_sp *mlxs= w_sp, mlxsw_sp_rt6 =3D mlxsw_sp_rt6_create(rt_arr[i]); if (IS_ERR(mlxsw_sp_rt6)) { err =3D PTR_ERR(mlxsw_sp_rt6); - goto err_rt6_create; + goto err_rt6_unwind; } =20 list_add_tail(&mlxsw_sp_rt6->list, &fib6_entry->rt6_list); @@ -7031,14 +7031,12 @@ mlxsw_sp_fib6_entry_nexthop_add(struct mlxsw_sp *ml= xsw_sp, =20 err =3D mlxsw_sp_nexthop6_group_update(mlxsw_sp, op_ctx, fib6_entry); if (err) - goto err_nexthop6_group_update; + goto err_rt6_unwind; =20 return 0; =20 -err_nexthop6_group_update: - i =3D nrt6; -err_rt6_create: - for (i--; i >=3D 0; i--) { +err_rt6_unwind: + for (; i > 0; i--) { fib6_entry->nrt6--; mlxsw_sp_rt6 =3D list_last_entry(&fib6_entry->rt6_list, struct mlxsw_sp_rt6, list); @@ -7166,7 +7164,7 @@ mlxsw_sp_fib6_entry_create(struct mlxsw_sp *mlxsw_sp, mlxsw_sp_rt6 =3D mlxsw_sp_rt6_create(rt_arr[i]); if (IS_ERR(mlxsw_sp_rt6)) { err =3D PTR_ERR(mlxsw_sp_rt6); - goto err_rt6_create; + goto err_rt6_unwind; } list_add_tail(&mlxsw_sp_rt6->list, &fib6_entry->rt6_list); fib6_entry->nrt6++; @@ -7174,7 +7172,7 @@ mlxsw_sp_fib6_entry_create(struct mlxsw_sp *mlxsw_sp, =20 err =3D mlxsw_sp_nexthop6_group_get(mlxsw_sp, fib6_entry); if (err) - goto err_nexthop6_group_get; + goto err_rt6_unwind; =20 err =3D mlxsw_sp_nexthop_group_vr_link(fib_entry->nh_group, fib_node->fib); @@ -7193,10 +7191,8 @@ mlxsw_sp_fib6_entry_create(struct mlxsw_sp *mlxsw_sp, mlxsw_sp_nexthop_group_vr_unlink(fib_entry->nh_group, fib_node->fib); err_nexthop_group_vr_link: mlxsw_sp_nexthop6_group_put(mlxsw_sp, fib_entry); -err_nexthop6_group_get: - i =3D nrt6; -err_rt6_create: - for (i--; i >=3D 0; i--) { +err_rt6_unwind: + for (; i > 0; i--) { fib6_entry->nrt6--; mlxsw_sp_rt6 =3D list_last_entry(&fib6_entry->rt6_list, struct mlxsw_sp_rt6, list); --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B86BCC19F29 for ; Mon, 1 Aug 2022 12:14:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233973AbiHAMOf (ORCPT ); Mon, 1 Aug 2022 08:14:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56920 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233936AbiHAMNx (ORCPT ); Mon, 1 Aug 2022 08:13:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1E690481E9; Mon, 1 Aug 2022 04:57:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0E936B81171; Mon, 1 Aug 2022 11:57:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7D943C433C1; Mon, 1 Aug 2022 11:57:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355055; bh=ePWGX+bbxWDVQoSt3seWjrZ7mLoFd68cBPHxv+NdNG4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AI0NeQecpr59Vh8Q6icPUG5WYtNT9NYd5hszKXVFKSPTshjjfAq+QkgAgS8YybFHX imWxaL2CVbOc+kkE0HlJ6cG/11ar7B3nUc94u6jC1xZRql14WGzLweqOlRzuivUqtK CT6tZl87piky22vga/zQeqA12CElr1XxYwcIrJW4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 46/88] tcp: Fix a data-race around sysctl_tcp_min_tso_segs. Date: Mon, 1 Aug 2022 13:47:00 +0200 Message-Id: <20220801114140.147738956@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit e0bb4ab9dfddd872622239f49fb2bd403b70853b ] While reading sysctl_tcp_min_tso_segs, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 95bd09eb2750 ("tcp: TSO packets automatic sizing") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 6a3adb0222f4..08466421e7e0 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -1990,7 +1990,7 @@ static u32 tcp_tso_segs(struct sock *sk, unsigned int= mss_now) =20 min_tso =3D ca_ops->min_tso_segs ? ca_ops->min_tso_segs(sk) : - sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs; + READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs); =20 tso_segs =3D tcp_tso_autosize(sk, mss_now, min_tso); return min_t(u32, tso_segs, sk->sk_gso_max_segs); --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7FEFEC19F2A for ; Mon, 1 Aug 2022 12:14:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234229AbiHAMO0 (ORCPT ); Mon, 1 Aug 2022 08:14:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56896 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233921AbiHAMNw (ORCPT ); Mon, 1 Aug 2022 08:13:52 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0E34947BB7; Mon, 1 Aug 2022 04:57:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2A478601C5; Mon, 1 Aug 2022 11:57:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3280AC433C1; Mon, 1 Aug 2022 11:57:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355058; bh=bHumqSMh+NEFc3LDZg3MdzJZC6wjGvYc0zi13rK9kLs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sLEtU/0UWl86kM/d7HPCnbQv9pQtZhtm+O5rpWnAb3nh4+Ggu2Lvv2lXFAuz9kJGz xatRmi3ffITX7Rs/+7nzvx4QFW4iIifQFVga9VTq6ACAr8Cn4jQtfqn0yB3IxAemZ4 quBX1ujMbf6YKqFnKFpT0rl8tjtsSJMjQ5SUBvjI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 47/88] tcp: Fix a data-race around sysctl_tcp_tso_rtt_log. Date: Mon, 1 Aug 2022 13:47:01 +0200 Message-Id: <20220801114140.192782036@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 2455e61b85e9c99af38cd889a7101f1d48b33cb4 ] While reading sysctl_tcp_tso_rtt_log, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 65466904b015 ("tcp: adjust TSO packet sizes based on min_rtt") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 08466421e7e0..60c9f7f444e0 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -1971,7 +1971,7 @@ static u32 tcp_tso_autosize(const struct sock *sk, un= signed int mss_now, =20 bytes =3D sk->sk_pacing_rate >> READ_ONCE(sk->sk_pacing_shift); =20 - r =3D tcp_min_rtt(tcp_sk(sk)) >> sock_net(sk)->ipv4.sysctl_tcp_tso_rtt_lo= g; + r =3D tcp_min_rtt(tcp_sk(sk)) >> READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_= tso_rtt_log); if (r < BITS_PER_TYPE(sk->sk_gso_max_size)) bytes +=3D sk->sk_gso_max_size >> r; =20 --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8DDDC19F2C for ; Mon, 1 Aug 2022 12:14:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233911AbiHAMOi (ORCPT ); Mon, 1 Aug 2022 08:14:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55804 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233941AbiHAMNx (ORCPT ); Mon, 1 Aug 2022 08:13:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0331740BF0; Mon, 1 Aug 2022 04:57:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D8460601BD; Mon, 1 Aug 2022 11:57:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E6D26C433D6; Mon, 1 Aug 2022 11:57:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355061; bh=YbmgbmyACU5oWKp981nJxWl6QS1LxWlzYtM4WloYayk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XpDmIhyFO5yP6cfrzA5VV4FV1uOKfwXhNEdOoazzh5+ZVtmzOvveqBSNK0Pxfu3Vd tHQRSpQJ41iE6QdKaIGM1zuKEKjsfFN8dGgef5trV3dpOYTN1Qm9RMy7/GVT6KjKqg rMubanRpApUc0Wh5K61Vkt8NX9NBkwoJrjSoAWrM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 48/88] tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen. Date: Mon, 1 Aug 2022 13:47:02 +0200 Message-Id: <20220801114140.243597986@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 1330ffacd05fc9ac4159d19286ce119e22450ed2 ] While reading sysctl_tcp_min_rtt_wlen, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: f672258391b4 ("tcp: track min RTT using windowed min-filter") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 78e16891f12b..f3b658fa3e7b 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -3058,7 +3058,7 @@ static void tcp_fastretrans_alert(struct sock *sk, co= nst u32 prior_snd_una, =20 static void tcp_update_rtt_min(struct sock *sk, u32 rtt_us, const int flag) { - u32 wlen =3D sock_net(sk)->ipv4.sysctl_tcp_min_rtt_wlen * HZ; + u32 wlen =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_rtt_wlen) * HZ; struct tcp_sock *tp =3D tcp_sk(sk); =20 if ((flag & FLAG_ACK_MAYBE_DELAYED) && rtt_us > tcp_min_rtt(tp)) { --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A36B8C00144 for ; Mon, 1 Aug 2022 12:14:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234019AbiHAMOm (ORCPT ); Mon, 1 Aug 2022 08:14:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56006 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234014AbiHAMN4 (ORCPT ); Mon, 1 Aug 2022 08:13:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3A70C481E3; Mon, 1 Aug 2022 04:57:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C6E346010C; Mon, 1 Aug 2022 11:57:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CF81DC433C1; Mon, 1 Aug 2022 11:57:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355064; bh=PVWIwpwWsxXqfVFC5HBmdbDeAqcAbN3HY3A4y6tHyYc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jM4ZRkXE6DG0i0VwLpTTuMWjjpkp+DvNUc0Kw65dXPT2uQaMbA3+bTxRP1036FjBX ff83xHfPSi9EsrXvTMZUkqDO22H71qEtGmxwcED2V0zbNlhhmXOf/vY9RYBNHlhiyU IdIPMaYbpdPpf3j48+2W2T80FRQRk2bFlu/ClB5E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 49/88] tcp: Fix a data-race around sysctl_tcp_autocorking. Date: Mon, 1 Aug 2022 13:47:03 +0200 Message-Id: <20220801114140.280402426@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 85225e6f0a76e6745bc841c9f25169c509b573d8 ] While reading sysctl_tcp_autocorking, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: f54b311142a9 ("tcp: auto corking") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 97fed1217b7f..60b46f2a6896 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -686,7 +686,7 @@ static bool tcp_should_autocork(struct sock *sk, struct= sk_buff *skb, int size_goal) { return skb->len < size_goal && - sock_net(sk)->ipv4.sysctl_tcp_autocorking && + READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_autocorking) && !tcp_rtx_queue_empty(sk) && refcount_read(&sk->sk_wmem_alloc) > skb->truesize && tcp_skb_can_collapse_to(skb); --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1D3FFC19F2A for ; Mon, 1 Aug 2022 12:14:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234248AbiHAMOw (ORCPT ); Mon, 1 Aug 2022 08:14:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59320 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234209AbiHAMOD (ORCPT ); Mon, 1 Aug 2022 08:14:03 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B1ABE48C85; Mon, 1 Aug 2022 04:57:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 92A28601D6; Mon, 1 Aug 2022 11:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9E42FC433D6; Mon, 1 Aug 2022 11:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355067; bh=cx8D56rNiNXsnsuuLOMBVrtcCpYMBz/Wcr7tOvymxqw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fCSJ9wmGPhN5OuEQefC1CLgnTaFiA/q79GWB21NX0XvR1diklsD5F2qVhwilfXbGD YvyfE6uXoQVS7YpMkiiU+WSQK5kpKliqfV8OHFWNv1yBrj8cRI2b5HsFJdd39AFraM 1CRBCFoT5R3PD2TZ9sY7m9+MzWfxClomjzmBj70U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 50/88] tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit. Date: Mon, 1 Aug 2022 13:47:04 +0200 Message-Id: <20220801114140.319848003@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 2afdbe7b8de84c28e219073a6661080e1b3ded48 ] While reading sysctl_tcp_invalid_ratelimit, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 032ee4236954 ("tcp: helpers to mitigate ACK loops by rate-limiting o= ut-of-window dupacks") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_input.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index f3b658fa3e7b..db78197a44ff 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -3581,7 +3581,8 @@ static bool __tcp_oow_rate_limited(struct net *net, i= nt mib_idx, if (*last_oow_ack_time) { s32 elapsed =3D (s32)(tcp_jiffies32 - *last_oow_ack_time); =20 - if (0 <=3D elapsed && elapsed < net->ipv4.sysctl_tcp_invalid_ratelimit) { + if (0 <=3D elapsed && + elapsed < READ_ONCE(net->ipv4.sysctl_tcp_invalid_ratelimit)) { NET_INC_STATS(net, mib_idx); return true; /* rate-limited: don't send yet! */ } --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4BBD5C19F2A for ; Mon, 1 Aug 2022 12:15:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234260AbiHAMO6 (ORCPT ); Mon, 1 Aug 2022 08:14:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56246 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234086AbiHAMOJ (ORCPT ); Mon, 1 Aug 2022 08:14:09 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4AC57481DA; Mon, 1 Aug 2022 04:57:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 01B45B80EAC; Mon, 1 Aug 2022 11:57:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 50AD5C4314C; Mon, 1 Aug 2022 11:57:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355069; bh=/5CZygGq4BwDZcE4D5t5rnKAa8XQjuxhRvcakUpGfME=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=e3V2gLahlIb0C5gioBYOIWbPSpyGiFLe11W8pcZPv8wtNAT4YUvjaJgeawHKnsCRw 3Ts+wfP0mjcbPc3KJoOrzITnfBuFRmXvuFmfwstVOt7rPQFdnHaM0CHvn1bay8vnfI i72oZyluXs2LTNS1UnG9Qkz+AyuVqJrCwKiRLza8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xin Long , Marcelo Ricardo Leitner , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 51/88] Documentation: fix sctp_wmem in ip-sysctl.rst Date: Mon, 1 Aug 2022 13:47:05 +0200 Message-Id: <20220801114140.357178617@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xin Long [ Upstream commit aa709da0e032cee7c202047ecd75f437bb0126ed ] Since commit 1033990ac5b2 ("sctp: implement memory accounting on tx path"), SCTP has supported memory accounting on tx path where 'sctp_wmem' is used by sk_wmem_schedule(). So we should fix the description for this option in ip-sysctl.rst accordingly. v1->v2: - Improve the description as Marcelo suggested. Fixes: 1033990ac5b2 ("sctp: implement memory accounting on tx path") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- Documentation/networking/ip-sysctl.rst | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/network= ing/ip-sysctl.rst index 8899b474edbf..e29017d4d7a2 100644 --- a/Documentation/networking/ip-sysctl.rst +++ b/Documentation/networking/ip-sysctl.rst @@ -2848,7 +2848,14 @@ sctp_rmem - vector of 3 INTEGERs: min, default, max Default: 4K =20 sctp_wmem - vector of 3 INTEGERs: min, default, max - Currently this tunable has no effect. + Only the first value ("min") is used, "default" and "max" are + ignored. + + min: Minimum size of send buffer that can be used by SCTP sockets. + It is guaranteed to each SCTP socket (but not association) even + under moderate memory pressure. + + Default: 4K =20 addr_scope_policy - INTEGER Control IPv4 address scoping - draft-stewart-tsvwg-sctp-ipv4-00 --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7EFF0C00144 for ; Mon, 1 Aug 2022 12:15:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233899AbiHAMPB (ORCPT ); Mon, 1 Aug 2022 08:15:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56724 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234171AbiHAMOM (ORCPT ); Mon, 1 Aug 2022 08:14:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 53B9648CAD; Mon, 1 Aug 2022 04:57:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AE89DB81171; Mon, 1 Aug 2022 11:57:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 15405C433D6; Mon, 1 Aug 2022 11:57:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355072; bh=Pjt9arz70V3SkAfZi0jUYYdS/BqTVgwJMR24cK/ZAFQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ooQ7hbvh+3VeMbAT08BakWYozKOFLZA+ZzMAm7Vw0jrbZkMTJOpT81mtzrpufGDmo S7v6DK39+Rb7H5vdvRWSOUDl8LGs4/fOZHucpugOJ11P67CAP7EmMSe4CtfX+XQN2x FSi0Ov7ETXZkswysX3PdagCuBlIEWGbxfJyLGSyQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Frantisek Sumsal , Sabrina Dubroca , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 52/88] macsec: fix NULL deref in macsec_add_rxsa Date: Mon, 1 Aug 2022 13:47:06 +0200 Message-Id: <20220801114140.404494468@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sabrina Dubroca [ Upstream commit f46040eeaf2e523a4096199fd93a11e794818009 ] Commit 48ef50fa866a added a test on tb_sa[MACSEC_SA_ATTR_PN], but nothing guarantees that it's not NULL at this point. The same code was added to macsec_add_txsa, but there it's not a problem because validate_add_txsa checks that the MACSEC_SA_ATTR_PN attribute is present. Note: it's not possible to reproduce with iproute, because iproute doesn't allow creating an SA without specifying the PN. Fixes: 48ef50fa866a ("macsec: Netlink support of XPN cipher suites (IEEE 80= 2.1AEbw)") Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D208315 Reported-by: Frantisek Sumsal Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/macsec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c index 817577e713d7..769a1eca6bd8 100644 --- a/drivers/net/macsec.c +++ b/drivers/net/macsec.c @@ -1753,7 +1753,8 @@ static int macsec_add_rxsa(struct sk_buff *skb, struc= t genl_info *info) } =20 pn_len =3D secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN; - if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) !=3D pn_len) { + if (tb_sa[MACSEC_SA_ATTR_PN] && + nla_len(tb_sa[MACSEC_SA_ATTR_PN]) !=3D pn_len) { pr_notice("macsec: nl: add_rxsa: bad pn length: %d !=3D %d\n", nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len); rtnl_unlock(); --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0212BC00144 for ; Mon, 1 Aug 2022 12:15:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234288AbiHAMPO (ORCPT ); Mon, 1 Aug 2022 08:15:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56920 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234220AbiHAMOY (ORCPT ); Mon, 1 Aug 2022 08:14:24 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 316A077A48; Mon, 1 Aug 2022 04:57:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 67AA8B8117A; Mon, 1 Aug 2022 11:57:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C2F02C433D7; Mon, 1 Aug 2022 11:57:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355075; bh=Rw/7w+b4/HttnljXh90geiflsimlF4zzYeRoJGJY7zU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Cg9y0fGLb3svhvtFbqa7vnDgmg1WoMWR0r6xZqb2FyI7kIgeRGHLfJKqtt8fAj1vM ++5LiRiPqlGZjzFlemj4arZ3mTVmfsKz85g74aKR1jIG/oRRlBkeukzuVfbL3rsFhD 0YNrhnAVXtuNswQGUsj04QS6adRXediP9G77ctWs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sabrina Dubroca , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 53/88] macsec: fix error message in macsec_add_rxsa and _txsa Date: Mon, 1 Aug 2022 13:47:07 +0200 Message-Id: <20220801114140.452947608@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sabrina Dubroca [ Upstream commit 3240eac4ff20e51b87600dbd586ed814daf313db ] The expected length is MACSEC_SALT_LEN, not MACSEC_SA_ATTR_SALT. Fixes: 48ef50fa866a ("macsec: Netlink support of XPN cipher suites (IEEE 80= 2.1AEbw)") Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/macsec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c index 769a1eca6bd8..634452d3ecc5 100644 --- a/drivers/net/macsec.c +++ b/drivers/net/macsec.c @@ -1770,7 +1770,7 @@ static int macsec_add_rxsa(struct sk_buff *skb, struc= t genl_info *info) if (nla_len(tb_sa[MACSEC_SA_ATTR_SALT]) !=3D MACSEC_SALT_LEN) { pr_notice("macsec: nl: add_rxsa: bad salt length: %d !=3D %d\n", nla_len(tb_sa[MACSEC_SA_ATTR_SALT]), - MACSEC_SA_ATTR_SALT); + MACSEC_SALT_LEN); rtnl_unlock(); return -EINVAL; } @@ -2012,7 +2012,7 @@ static int macsec_add_txsa(struct sk_buff *skb, struc= t genl_info *info) if (nla_len(tb_sa[MACSEC_SA_ATTR_SALT]) !=3D MACSEC_SALT_LEN) { pr_notice("macsec: nl: add_txsa: bad salt length: %d !=3D %d\n", nla_len(tb_sa[MACSEC_SA_ATTR_SALT]), - MACSEC_SA_ATTR_SALT); + MACSEC_SALT_LEN); rtnl_unlock(); return -EINVAL; } --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97626C00144 for ; Mon, 1 Aug 2022 12:15:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233984AbiHAMPS (ORCPT ); Mon, 1 Aug 2022 08:15:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57384 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234237AbiHAMO3 (ORCPT ); Mon, 1 Aug 2022 08:14:29 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 357A376971; Mon, 1 Aug 2022 04:57:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5F6EB601C3; Mon, 1 Aug 2022 11:57:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6FF9FC433D6; Mon, 1 Aug 2022 11:57:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355077; bh=O0zr0PxF78Gk7AWY0nQA4LpehnbWArrEz/phO6/gcB8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dpZVFO6ulvTZU8GkVMUB7+8723w/WOB5uEv0k+mjvjkoLtHJwSHKx1KY+xJyJ623r AGpEj88grOOLJqnNs08e7P8/N0JW84tqlpF3P32hj18+Al8F+8fjn+aKSG3q4tkvM3 P6HsUXKamzLRUOEZoxG7KlT/BANHLryjppZRyRwU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sabrina Dubroca , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 54/88] macsec: limit replay window size with XPN Date: Mon, 1 Aug 2022 13:47:08 +0200 Message-Id: <20220801114140.503169544@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sabrina Dubroca [ Upstream commit b07a0e2044057f201d694ab474f5c42a02b6465b ] IEEE 802.1AEbw-2013 (section 10.7.8) specifies that the maximum value of the replay window is 2^30-1, to help with recovery of the upper bits of the PN. To avoid leaving the existing macsec device in an inconsistent state if this test fails during changelink, reuse the cleanup mechanism introduced for HW offload. This wasn't needed until now because macsec_changelink_common could not fail during changelink, as modifying the cipher suite was not allowed. Finally, this must happen after handling IFLA_MACSEC_CIPHER_SUITE so that secy->xpn is set. Fixes: 48ef50fa866a ("macsec: Netlink support of XPN cipher suites (IEEE 80= 2.1AEbw)") Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/macsec.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c index 634452d3ecc5..b3834e353c22 100644 --- a/drivers/net/macsec.c +++ b/drivers/net/macsec.c @@ -243,6 +243,7 @@ static struct macsec_cb *macsec_skb_cb(struct sk_buff *= skb) #define DEFAULT_SEND_SCI true #define DEFAULT_ENCRYPT false #define DEFAULT_ENCODING_SA 0 +#define MACSEC_XPN_MAX_REPLAY_WINDOW (((1 << 30) - 1)) =20 static bool send_sci(const struct macsec_secy *secy) { @@ -3746,9 +3747,6 @@ static int macsec_changelink_common(struct net_device= *dev, secy->operational =3D tx_sa && tx_sa->active; } =20 - if (data[IFLA_MACSEC_WINDOW]) - secy->replay_window =3D nla_get_u32(data[IFLA_MACSEC_WINDOW]); - if (data[IFLA_MACSEC_ENCRYPT]) tx_sc->encrypt =3D !!nla_get_u8(data[IFLA_MACSEC_ENCRYPT]); =20 @@ -3794,6 +3792,16 @@ static int macsec_changelink_common(struct net_devic= e *dev, } } =20 + if (data[IFLA_MACSEC_WINDOW]) { + secy->replay_window =3D nla_get_u32(data[IFLA_MACSEC_WINDOW]); + + /* IEEE 802.1AEbw-2013 10.7.8 - maximum replay window + * for XPN cipher suites */ + if (secy->xpn && + secy->replay_window > MACSEC_XPN_MAX_REPLAY_WINDOW) + return -EINVAL; + } + return 0; } =20 @@ -3823,7 +3831,7 @@ static int macsec_changelink(struct net_device *dev, = struct nlattr *tb[], =20 ret =3D macsec_changelink_common(dev, data); if (ret) - return ret; + goto cleanup; =20 /* If h/w offloading is available, propagate to the device */ if (macsec_is_offloaded(macsec)) { --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27BA2C00144 for ; Mon, 1 Aug 2022 12:15:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234307AbiHAMPW (ORCPT ); Mon, 1 Aug 2022 08:15:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59576 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234032AbiHAMOp (ORCPT ); Mon, 1 Aug 2022 08:14:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8529F78222; Mon, 1 Aug 2022 04:58:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 127F6601CD; Mon, 1 Aug 2022 11:58:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 21691C433C1; Mon, 1 Aug 2022 11:57:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355080; bh=CLVAxviFNkM+6MZHDWRFc5Wxzx2ONWeNJkWfDn1Ffvg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yecUOsqLXBZxWWJOCfeGryzO5wTYA4e4llFvJTrtwOxtP+2ABkW9072YjdjSKjTBe hStt3dYXiG4dHBIJk+gqruiBqfqzFvcJAFCVQ3ZcnwFyqk99mMjXolMsrWlCIUWsPz chAXJGN/BfvppCY7fIN4vYEOisBuDSp6QRXw6gCY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sabrina Dubroca , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 55/88] macsec: always read MACSEC_SA_ATTR_PN as a u64 Date: Mon, 1 Aug 2022 13:47:09 +0200 Message-Id: <20220801114140.554941467@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sabrina Dubroca [ Upstream commit c630d1fe6219769049c87d1a6a0e9a6de55328a1 ] Currently, MACSEC_SA_ATTR_PN is handled inconsistently, sometimes as a u32, sometimes forced into a u64 without checking the actual length of the attribute. Instead, we can use nla_get_u64 everywhere, which will read up to 64 bits into a u64, capped by the actual length of the attribute coming from userspace. This fixes several issues: - the check in validate_add_rxsa doesn't work with 32-bit attributes - the checks in validate_add_txsa and validate_upd_sa incorrectly reject X << 32 (with X !=3D 0) Fixes: 48ef50fa866a ("macsec: Netlink support of XPN cipher suites (IEEE 80= 2.1AEbw)") Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/macsec.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c index b3834e353c22..95578f04f212 100644 --- a/drivers/net/macsec.c +++ b/drivers/net/macsec.c @@ -1698,7 +1698,7 @@ static bool validate_add_rxsa(struct nlattr **attrs) return false; =20 if (attrs[MACSEC_SA_ATTR_PN] && - *(u64 *)nla_data(attrs[MACSEC_SA_ATTR_PN]) =3D=3D 0) + nla_get_u64(attrs[MACSEC_SA_ATTR_PN]) =3D=3D 0) return false; =20 if (attrs[MACSEC_SA_ATTR_ACTIVE]) { @@ -1941,7 +1941,7 @@ static bool validate_add_txsa(struct nlattr **attrs) if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >=3D MACSEC_NUM_AN) return false; =20 - if (nla_get_u32(attrs[MACSEC_SA_ATTR_PN]) =3D=3D 0) + if (nla_get_u64(attrs[MACSEC_SA_ATTR_PN]) =3D=3D 0) return false; =20 if (attrs[MACSEC_SA_ATTR_ACTIVE]) { @@ -2295,7 +2295,7 @@ static bool validate_upd_sa(struct nlattr **attrs) if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >=3D MACSEC_NUM_AN) return false; =20 - if (attrs[MACSEC_SA_ATTR_PN] && nla_get_u32(attrs[MACSEC_SA_ATTR_PN]) =3D= =3D 0) + if (attrs[MACSEC_SA_ATTR_PN] && nla_get_u64(attrs[MACSEC_SA_ATTR_PN]) =3D= =3D 0) return false; =20 if (attrs[MACSEC_SA_ATTR_ACTIVE]) { --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8C884C00144 for ; Mon, 1 Aug 2022 12:15:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234158AbiHAMPi (ORCPT ); Mon, 1 Aug 2022 08:15:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38894 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234247AbiHAMOv (ORCPT ); Mon, 1 Aug 2022 08:14:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0363A481EC; Mon, 1 Aug 2022 04:58:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 94DD9601C5; Mon, 1 Aug 2022 11:58:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C091C433C1; Mon, 1 Aug 2022 11:58:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355086; bh=zJ4Z8/RkB+FSPyYto9uDx3KooRWP8varH59P/whIp1M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zpQCWof719R20/ifENJ/R8bYotZb4jTmSbTOoM8AJmAaZaP7IpmhgU0kn6BWS0ZNW MMWRkGl0v6Y9N3U36xmmrciotciLAhj4ivgNBgXcCIV6F9LK+0ws9gYT6CGKReWdyP uXo+HQBi+KQP8+XiTD/zWlxGyeTFavIZADHOgLZU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jianglei Nie , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 56/88] net: macsec: fix potential resource leak in macsec_add_rxsa() and macsec_add_txsa() Date: Mon, 1 Aug 2022 13:47:10 +0200 Message-Id: <20220801114140.595300677@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jianglei Nie [ Upstream commit c7b205fbbf3cffa374721bb7623f7aa8c46074f1 ] init_rx_sa() allocates relevant resource for rx_sa->stats and rx_sa-> key.tfm with alloc_percpu() and macsec_alloc_tfm(). When some error occurs after init_rx_sa() is called in macsec_add_rxsa(), the function released rx_sa with kfree() without releasing rx_sa->stats and rx_sa-> key.tfm, which will lead to a resource leak. We should call macsec_rxsa_put() instead of kfree() to decrease the ref count of rx_sa and release the relevant resource if the refcount is 0. The same bug exists in macsec_add_txsa() for tx_sa as well. This patch fixes the above two bugs. Fixes: 3cf3227a21d1 ("net: macsec: hardware offloading infrastructure") Signed-off-by: Jianglei Nie Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/macsec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c index 95578f04f212..f354fad05714 100644 --- a/drivers/net/macsec.c +++ b/drivers/net/macsec.c @@ -1844,7 +1844,7 @@ static int macsec_add_rxsa(struct sk_buff *skb, struc= t genl_info *info) return 0; =20 cleanup: - kfree(rx_sa); + macsec_rxsa_put(rx_sa); rtnl_unlock(); return err; } @@ -2087,7 +2087,7 @@ static int macsec_add_txsa(struct sk_buff *skb, struc= t genl_info *info) =20 cleanup: secy->operational =3D was_operational; - kfree(tx_sa); + macsec_txsa_put(tx_sa); rtnl_unlock(); return err; } --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A3EAC25B07 for ; Mon, 1 Aug 2022 12:16:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232229AbiHAMQU (ORCPT ); Mon, 1 Aug 2022 08:16:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39362 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234213AbiHAMPA (ORCPT ); Mon, 1 Aug 2022 08:15:00 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C9A2D78587; Mon, 1 Aug 2022 04:58:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 42A0ACE13B9; Mon, 1 Aug 2022 11:58:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 577BEC4347C; Mon, 1 Aug 2022 11:58:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355088; bh=/7onE6s4mGX2NwJMW7RKS5TVN+YhEfVvY57cPQaN3Nc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R0G6nZQi7tsQWOe3eF9VbE0hadX5MgaOOnlyFxj9HcQIjgn8UVpebzUTBx7txwXjv LX3IoAy+abfdEdeFe7gLtSb7sbtmotWpnhHrIUPhTZliebd/Kd1LBV2+7+JsnkMNH0 R34sxqjOM1sGUGnaQqqLCGUTwiRqZ9+2OHvajv6Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hangbin Liu , Taehee Yoo , Eric Dumazet , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 57/88] net: mld: fix reference count leak in mld_{query | report}_work() Date: Mon, 1 Aug 2022 13:47:11 +0200 Message-Id: <20220801114140.645584322@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Taehee Yoo [ Upstream commit 3e7d18b9dca388940a19cae30bfc1f76dccd8c28 ] mld_{query | report}_work() processes queued events. If there are too many events in the queue, it re-queue a work. And then, it returns without in6_dev_put(). But if queuing is failed, it should call in6_dev_put(), but it doesn't. So, a reference count leak would occur. THREAD0 THREAD1 mld_report_work() spin_lock_bh() if (!mod_delayed_work()) in6_dev_hold(); spin_unlock_bh() spin_lock_bh() schedule_delayed_work() spin_unlock_bh() Script to reproduce(by Hangbin Liu): ip netns add ns1 ip netns add ns2 ip netns exec ns1 sysctl -w net.ipv6.conf.all.force_mld_version=3D1 ip netns exec ns2 sysctl -w net.ipv6.conf.all.force_mld_version=3D1 ip -n ns1 link add veth0 type veth peer name veth0 netns ns2 ip -n ns1 link set veth0 up ip -n ns2 link set veth0 up for i in `seq 50`; do for j in `seq 100`; do ip -n ns1 addr add 2021:${i}::${j}/64 dev veth0 ip -n ns2 addr add 2022:${i}::${j}/64 dev veth0 done done modprobe -r veth ip -a netns del splat looks like: unregister_netdevice: waiting for veth0 to become free. Usage count =3D 2 leaked reference. ipv6_add_dev+0x324/0xec0 addrconf_notify+0x481/0xd10 raw_notifier_call_chain+0xe3/0x120 call_netdevice_notifiers+0x106/0x160 register_netdevice+0x114c/0x16b0 veth_newlink+0x48b/0xa50 [veth] rtnl_newlink+0x11a2/0x1a40 rtnetlink_rcv_msg+0x63f/0xc00 netlink_rcv_skb+0x1df/0x3e0 netlink_unicast+0x5de/0x850 netlink_sendmsg+0x6c9/0xa90 ____sys_sendmsg+0x76a/0x780 __sys_sendmsg+0x27c/0x340 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Tested-by: Hangbin Liu Fixes: f185de28d9ae ("mld: add new workqueues for process mld events") Signed-off-by: Taehee Yoo Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv6/mcast.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 7f695c39d9a8..87c699d57b36 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1522,7 +1522,6 @@ static void mld_query_work(struct work_struct *work) =20 if (++cnt >=3D MLD_MAX_QUEUE) { rework =3D true; - schedule_delayed_work(&idev->mc_query_work, 0); break; } } @@ -1533,8 +1532,10 @@ static void mld_query_work(struct work_struct *work) __mld_query_work(skb); mutex_unlock(&idev->mc_lock); =20 - if (!rework) - in6_dev_put(idev); + if (rework && queue_delayed_work(mld_wq, &idev->mc_query_work, 0)) + return; + + in6_dev_put(idev); } =20 /* called with rcu_read_lock() */ @@ -1624,7 +1625,6 @@ static void mld_report_work(struct work_struct *work) =20 if (++cnt >=3D MLD_MAX_QUEUE) { rework =3D true; - schedule_delayed_work(&idev->mc_report_work, 0); break; } } @@ -1635,8 +1635,10 @@ static void mld_report_work(struct work_struct *work) __mld_report_work(skb); mutex_unlock(&idev->mc_lock); =20 - if (!rework) - in6_dev_put(idev); + if (rework && queue_delayed_work(mld_wq, &idev->mc_report_work, 0)) + return; + + in6_dev_put(idev); } =20 static bool is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type, --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34BD4C19F2A for ; Mon, 1 Aug 2022 12:16:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234098AbiHAMQ0 (ORCPT ); Mon, 1 Aug 2022 08:16:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40070 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234189AbiHAMPL (ORCPT ); Mon, 1 Aug 2022 08:15:11 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 06E0978DC4; Mon, 1 Aug 2022 04:58:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9BBC8B81170; Mon, 1 Aug 2022 11:58:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0DD47C433C1; Mon, 1 Aug 2022 11:58:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355091; bh=F7T5biOEcTaFfcc4pS0uPhSCEkkPqFXDcQ+ZcZUxk9g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kZEpXsjxjdOjyf3d+xDmQFNgXRuDcEz+EO9Hl8nlZr54RzXdAe515UvSVJ7U0PCPI kC84gmoocT4kVarDrSA14MpOjE1inYPHSGSCnnVHiSwx8W4w2qktoIfFNQVV3nZq5U aUKa9bVClb/d5SaHdXQjsZOCeKc2XQYecavkSPjE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 58/88] tcp: Fix data-races around sk_pacing_rate. Date: Mon, 1 Aug 2022 13:47:12 +0200 Message-Id: <20220801114140.696861219@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 59bf6c65a09fff74215517aecffbbdcd67df76e3 ] While reading sysctl_tcp_pacing_(ss|ca)_ratio, they can be changed concurrently. Thus, we need to add READ_ONCE() to their readers. Fixes: 43e122b014c9 ("tcp: refine pacing rate determination") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_input.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index db78197a44ff..de066fad7dfe 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -910,9 +910,9 @@ static void tcp_update_pacing_rate(struct sock *sk) * end of slow start and should slow down. */ if (tcp_snd_cwnd(tp) < tp->snd_ssthresh / 2) - rate *=3D sock_net(sk)->ipv4.sysctl_tcp_pacing_ss_ratio; + rate *=3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_pacing_ss_ratio); else - rate *=3D sock_net(sk)->ipv4.sysctl_tcp_pacing_ca_ratio; + rate *=3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_pacing_ca_ratio); =20 rate *=3D max(tcp_snd_cwnd(tp), tp->packets_out); =20 --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 64F0DC00144 for ; Mon, 1 Aug 2022 12:20:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234762AbiHAMUM (ORCPT ); Mon, 1 Aug 2022 08:20:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42760 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234381AbiHAMTI (ORCPT ); Mon, 1 Aug 2022 08:19:08 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B804F4AD5C; Mon, 1 Aug 2022 04:59:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 389A9B810A2; Mon, 1 Aug 2022 11:59:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 90F58C433D7; Mon, 1 Aug 2022 11:59:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355192; bh=IHr1aUmBLBq6hdDkxtYE0BDsldJN3WkLHNFC/2Bp760=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dEGCMvAw0KCI7OjnRQxliPUbcgHTVeyWYDlu5eew2dsnmlefSQ6q0OmpHBDP+zZ+B sXIdFcam7SrBVzJEJZY5NpEaZ244qIU/ZpbPlgG6IBjjXt8Ps4IF4PVX55seIVY0HG kX2nYOQbXMpXCH3c+PmoicPOQZ/jalSjLjU4yy3k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 59/88] net: Fix data-races around sysctl_[rw]mem(_offset)?. Date: Mon, 1 Aug 2022 13:47:13 +0200 Message-Id: <20220801114140.746927246@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 02739545951ad4c1215160db7fbf9b7a918d3c0b ] While reading these sysctl variables, they can be changed concurrently. Thus, we need to add READ_ONCE() to their readers. - .sysctl_rmem - .sysctl_rwmem - .sysctl_rmem_offset - .sysctl_wmem_offset - sysctl_tcp_rmem[1, 2] - sysctl_tcp_wmem[1, 2] - sysctl_decnet_rmem[1] - sysctl_decnet_wmem[1] - sysctl_tipc_rmem[1] Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- include/net/sock.h | 8 ++++---- net/decnet/af_decnet.c | 4 ++-- net/ipv4/tcp.c | 6 +++--- net/ipv4/tcp_input.c | 13 +++++++------ net/ipv4/tcp_output.c | 2 +- net/mptcp/protocol.c | 6 +++--- net/tipc/socket.c | 2 +- 7 files changed, 21 insertions(+), 20 deletions(-) diff --git a/include/net/sock.h b/include/net/sock.h index 6bef0ffb1e7b..9563a093fdfc 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -2834,18 +2834,18 @@ static inline int sk_get_wmem0(const struct sock *s= k, const struct proto *proto) { /* Does this proto have per netns sysctl_wmem ? */ if (proto->sysctl_wmem_offset) - return *(int *)((void *)sock_net(sk) + proto->sysctl_wmem_offset); + return READ_ONCE(*(int *)((void *)sock_net(sk) + proto->sysctl_wmem_offs= et)); =20 - return *proto->sysctl_wmem; + return READ_ONCE(*proto->sysctl_wmem); } =20 static inline int sk_get_rmem0(const struct sock *sk, const struct proto *= proto) { /* Does this proto have per netns sysctl_rmem ? */ if (proto->sysctl_rmem_offset) - return *(int *)((void *)sock_net(sk) + proto->sysctl_rmem_offset); + return READ_ONCE(*(int *)((void *)sock_net(sk) + proto->sysctl_rmem_offs= et)); =20 - return *proto->sysctl_rmem; + return READ_ONCE(*proto->sysctl_rmem); } =20 /* Default TCP Small queue budget is ~1 ms of data (1sec >> 10) diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c index dc92a67baea3..7d542eb46172 100644 --- a/net/decnet/af_decnet.c +++ b/net/decnet/af_decnet.c @@ -480,8 +480,8 @@ static struct sock *dn_alloc_sock(struct net *net, stru= ct socket *sock, gfp_t gf sk->sk_family =3D PF_DECnet; sk->sk_protocol =3D 0; sk->sk_allocation =3D gfp; - sk->sk_sndbuf =3D sysctl_decnet_wmem[1]; - sk->sk_rcvbuf =3D sysctl_decnet_rmem[1]; + sk->sk_sndbuf =3D READ_ONCE(sysctl_decnet_wmem[1]); + sk->sk_rcvbuf =3D READ_ONCE(sysctl_decnet_rmem[1]); =20 /* Initialization of DECnet Session Control Port */ scp =3D DN_SK(sk); diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 60b46f2a6896..91735d631a28 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -452,8 +452,8 @@ void tcp_init_sock(struct sock *sk) =20 icsk->icsk_sync_mss =3D tcp_sync_mss; =20 - WRITE_ONCE(sk->sk_sndbuf, sock_net(sk)->ipv4.sysctl_tcp_wmem[1]); - WRITE_ONCE(sk->sk_rcvbuf, sock_net(sk)->ipv4.sysctl_tcp_rmem[1]); + WRITE_ONCE(sk->sk_sndbuf, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_wmem[1]= )); + WRITE_ONCE(sk->sk_rcvbuf, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[1]= )); =20 sk_sockets_allocated_inc(sk); } @@ -1743,7 +1743,7 @@ int tcp_set_rcvlowat(struct sock *sk, int val) if (sk->sk_userlocks & SOCK_RCVBUF_LOCK) cap =3D sk->sk_rcvbuf >> 1; else - cap =3D sock_net(sk)->ipv4.sysctl_tcp_rmem[2] >> 1; + cap =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2]) >> 1; val =3D min(val, cap); WRITE_ONCE(sk->sk_rcvlowat, val ? : 1); =20 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index de066fad7dfe..f09b1321a960 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -426,7 +426,7 @@ static void tcp_sndbuf_expand(struct sock *sk) =20 if (sk->sk_sndbuf < sndmem) WRITE_ONCE(sk->sk_sndbuf, - min(sndmem, sock_net(sk)->ipv4.sysctl_tcp_wmem[2])); + min(sndmem, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_wmem[2]))); } =20 /* 2. Tuning advertised window (window_clamp, rcv_ssthresh) @@ -461,7 +461,7 @@ static int __tcp_grow_window(const struct sock *sk, con= st struct sk_buff *skb, struct tcp_sock *tp =3D tcp_sk(sk); /* Optimize this! */ int truesize =3D tcp_win_from_space(sk, skbtruesize) >> 1; - int window =3D tcp_win_from_space(sk, sock_net(sk)->ipv4.sysctl_tcp_rmem[= 2]) >> 1; + int window =3D tcp_win_from_space(sk, READ_ONCE(sock_net(sk)->ipv4.sysctl= _tcp_rmem[2])) >> 1; =20 while (tp->rcv_ssthresh <=3D window) { if (truesize <=3D skb->len) @@ -574,16 +574,17 @@ static void tcp_clamp_window(struct sock *sk) struct tcp_sock *tp =3D tcp_sk(sk); struct inet_connection_sock *icsk =3D inet_csk(sk); struct net *net =3D sock_net(sk); + int rmem2; =20 icsk->icsk_ack.quick =3D 0; + rmem2 =3D READ_ONCE(net->ipv4.sysctl_tcp_rmem[2]); =20 - if (sk->sk_rcvbuf < net->ipv4.sysctl_tcp_rmem[2] && + if (sk->sk_rcvbuf < rmem2 && !(sk->sk_userlocks & SOCK_RCVBUF_LOCK) && !tcp_under_memory_pressure(sk) && sk_memory_allocated(sk) < sk_prot_mem_limits(sk, 0)) { WRITE_ONCE(sk->sk_rcvbuf, - min(atomic_read(&sk->sk_rmem_alloc), - net->ipv4.sysctl_tcp_rmem[2])); + min(atomic_read(&sk->sk_rmem_alloc), rmem2)); } if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) tp->rcv_ssthresh =3D min(tp->window_clamp, 2U * tp->advmss); @@ -745,7 +746,7 @@ void tcp_rcv_space_adjust(struct sock *sk) =20 do_div(rcvwin, tp->advmss); rcvbuf =3D min_t(u64, rcvwin * rcvmem, - sock_net(sk)->ipv4.sysctl_tcp_rmem[2]); + READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2])); if (rcvbuf > sk->sk_rcvbuf) { WRITE_ONCE(sk->sk_rcvbuf, rcvbuf); =20 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 60c9f7f444e0..66836b8bd46f 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -238,7 +238,7 @@ void tcp_select_initial_window(const struct sock *sk, i= nt __space, __u32 mss, *rcv_wscale =3D 0; if (wscale_ok) { /* Set window scaling on max possible window */ - space =3D max_t(u32, space, sock_net(sk)->ipv4.sysctl_tcp_rmem[2]); + space =3D max_t(u32, space, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem= [2])); space =3D max_t(u32, space, sysctl_rmem_max); space =3D min_t(u32, space, *window_clamp); *rcv_wscale =3D clamp_t(int, ilog2(space) - 15, diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index e2790a6e90fb..07b5a2044cab 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1900,7 +1900,7 @@ static void mptcp_rcv_space_adjust(struct mptcp_sock = *msk, int copied) =20 do_div(rcvwin, advmss); rcvbuf =3D min_t(u64, rcvwin * rcvmem, - sock_net(sk)->ipv4.sysctl_tcp_rmem[2]); + READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2])); =20 if (rcvbuf > sk->sk_rcvbuf) { u32 window_clamp; @@ -2597,8 +2597,8 @@ static int mptcp_init_sock(struct sock *sk) mptcp_ca_reset(sk); =20 sk_sockets_allocated_inc(sk); - sk->sk_rcvbuf =3D sock_net(sk)->ipv4.sysctl_tcp_rmem[1]; - sk->sk_sndbuf =3D sock_net(sk)->ipv4.sysctl_tcp_wmem[1]; + sk->sk_rcvbuf =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[1]); + sk->sk_sndbuf =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_wmem[1]); =20 return 0; } diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 43509c7e90fc..f1c3b8eb4b3d 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -517,7 +517,7 @@ static int tipc_sk_create(struct net *net, struct socke= t *sock, timer_setup(&sk->sk_timer, tipc_sk_timeout, 0); sk->sk_shutdown =3D 0; sk->sk_backlog_rcv =3D tipc_sk_backlog_rcv; - sk->sk_rcvbuf =3D sysctl_tipc_rmem[1]; + sk->sk_rcvbuf =3D READ_ONCE(sysctl_tipc_rmem[1]); sk->sk_data_ready =3D tipc_data_ready; sk->sk_write_space =3D tipc_write_space; sk->sk_destruct =3D tipc_sock_destruct; --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7433C00144 for ; Mon, 1 Aug 2022 12:17:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234430AbiHAMRA (ORCPT ); Mon, 1 Aug 2022 08:17:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38608 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234432AbiHAMPz (ORCPT ); Mon, 1 Aug 2022 08:15:55 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4F39A48EAD; Mon, 1 Aug 2022 04:58:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DDD0B601BD; Mon, 1 Aug 2022 11:58:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E9A9EC433C1; Mon, 1 Aug 2022 11:58:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355113; bh=GvhLsL9sI+LkSkyCeIUMTRPmGOnwnbk37qSVBg/HNKM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1YZzY4J/dZk5T0tEWFL1OmdP0Sx3eXhHlWtVFyjgDvrqdmLrBOjFLzj7y26WiyERY lZwIjrVn8Ygv/QyG/l7X4aPdCLvTIlRREIlkGuoI/PyGCLWFp3lOagX2zFIMWzd8gm zeKo3DnCylKDQvVXCM3XT0wCTJUwTACPBR2jBuPc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 60/88] tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns. Date: Mon, 1 Aug 2022 13:47:14 +0200 Message-Id: <20220801114140.799477571@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 4866b2b0f7672b6d760c4b8ece6fb56f965dcc8a ] While reading sysctl_tcp_comp_sack_delay_ns, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 6d82aa242092 ("tcp: add tcp_comp_sack_delay_ns sysctl") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_input.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index f09b1321a960..3591a25a8631 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -5546,7 +5546,8 @@ static void __tcp_ack_snd_check(struct sock *sk, int = ofo_possible) if (tp->srtt_us && tp->srtt_us < rtt) rtt =3D tp->srtt_us; =20 - delay =3D min_t(unsigned long, sock_net(sk)->ipv4.sysctl_tcp_comp_sack_de= lay_ns, + delay =3D min_t(unsigned long, + READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_comp_sack_delay_ns), rtt * (NSEC_PER_USEC >> 3)/20); sock_hold(sk); hrtimer_start_range_ns(&tp->compressed_ack_timer, ns_to_ktime(delay), --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 53FBFC19F29 for ; Mon, 1 Aug 2022 12:18:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233897AbiHAMSQ (ORCPT ); Mon, 1 Aug 2022 08:18:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39024 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234266AbiHAMRh (ORCPT ); Mon, 1 Aug 2022 08:17:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A432491CA; Mon, 1 Aug 2022 04:59:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B6FEDB81163; Mon, 1 Aug 2022 11:59:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 26D2DC433C1; Mon, 1 Aug 2022 11:59:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355143; bh=qfBSJkoLITgNp5hMOPkftoMMMYczmKycikn8cT0fsnY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HQ8N1T2jZZBboCFgucn2wQsUbrXvx4R2uJhhmU2NaurydFmJumJzcE9CzTr/lzFr7 EOXF/V5yaN6VGRm9RY8jAZJT/aZulu4Zv2cyjWVuipSWOc4CAE1csxy7z9pH8b3fUB +VOtDOHkxJiayEIvZoBf3NIgzeGo0hRmJ6cD0frc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 61/88] tcp: Fix a data-race around sysctl_tcp_comp_sack_slack_ns. Date: Mon, 1 Aug 2022 13:47:15 +0200 Message-Id: <20220801114140.851159905@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 22396941a7f343d704738360f9ef0e6576489d43 ] While reading sysctl_tcp_comp_sack_slack_ns, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: a70437cc09a1 ("tcp: add hrtimer slack to sack compression") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 3591a25a8631..5de396075a27 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -5551,7 +5551,7 @@ static void __tcp_ack_snd_check(struct sock *sk, int = ofo_possible) rtt * (NSEC_PER_USEC >> 3)/20); sock_hold(sk); hrtimer_start_range_ns(&tp->compressed_ack_timer, ns_to_ktime(delay), - sock_net(sk)->ipv4.sysctl_tcp_comp_sack_slack_ns, + READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_comp_sack_slack_ns), HRTIMER_MODE_REL_PINNED_SOFT); } =20 --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1386CC3F6B0 for ; Mon, 1 Aug 2022 12:19:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234701AbiHAMTo (ORCPT ); Mon, 1 Aug 2022 08:19:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40212 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234214AbiHAMTA (ORCPT ); Mon, 1 Aug 2022 08:19:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B35834A831; Mon, 1 Aug 2022 04:59:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 47A2C601BF; Mon, 1 Aug 2022 11:59:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53039C433C1; Mon, 1 Aug 2022 11:59:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355173; bh=qrEcXrtPmbjb3Gl+n4dgF60SFPGbQZ0JD+BIa11mq0c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XcmY9NDxvYYGCgXvouPvg8hFFzxk8logGwtGhsFdg9Tq3FjAekstAr93GLjIy+loX bJFDoso/ID1RUCVUa5ZRwS+1N37rLaAPNeoX4LUVaH/83Z4kUZDlorn2DyF3jhcNna C6kv2TQFzK1K8E74e7uTNNGtttJkgFDk7YGowC4g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 62/88] tcp: Fix a data-race around sysctl_tcp_comp_sack_nr. Date: Mon, 1 Aug 2022 13:47:16 +0200 Message-Id: <20220801114140.898286327@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 79f55473bfc8ac51bd6572929a679eeb4da22251 ] While reading sysctl_tcp_comp_sack_nr, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 9c21d2fc41c0 ("tcp: add tcp_comp_sack_nr sysctl") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 5de396075a27..9221c8c7b9a9 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -5525,7 +5525,7 @@ static void __tcp_ack_snd_check(struct sock *sk, int = ofo_possible) } =20 if (!tcp_is_sack(tp) || - tp->compressed_ack >=3D sock_net(sk)->ipv4.sysctl_tcp_comp_sack_nr) + tp->compressed_ack >=3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_comp_= sack_nr)) goto send_now; =20 if (tp->compressed_ack_rcv_nxt !=3D tp->rcv_nxt) { --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75470C00144 for ; Mon, 1 Aug 2022 12:19:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234715AbiHAMTt (ORCPT ); Mon, 1 Aug 2022 08:19:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37884 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234244AbiHAMTB (ORCPT ); Mon, 1 Aug 2022 08:19:01 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E860C3F30A; Mon, 1 Aug 2022 04:59:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A3EF7B80E8F; Mon, 1 Aug 2022 11:59:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0A891C433D6; Mon, 1 Aug 2022 11:59:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355176; bh=8RHGLgjkKHYqDdMcrfdBSXF55Oh4lykvXOWSLicOJIY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gyfuoZ0p3IlGIH5XfSBESs3G29e7DQcJk8yTjLvHaLN7/pS9Vp5bLYQTrNhwDmQqO 5Mx+jPImKJ/tHmU9FqDNBJiQJ8r58M3iKR/U/Y++rGdGXol/RY2XnjOhXHXWHHAwKA y+UKjsVchXRcHTk2QRmuzkZBLCgICFwM84q/MOVo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , Wei Wang , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 63/88] tcp: Fix data-races around sysctl_tcp_reflect_tos. Date: Mon, 1 Aug 2022 13:47:17 +0200 Message-Id: <20220801114140.947814449@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 870e3a634b6a6cb1543b359007aca73fe6a03ac5 ] While reading sysctl_tcp_reflect_tos, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: ac8f1710c12b ("tcp: reflect tos value received in SYN to the socket") Signed-off-by: Kuniyuki Iwashima Acked-by: Wei Wang Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_ipv4.c | 4 ++-- net/ipv6/tcp_ipv6.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index a57f96b86874..1db9938163c4 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1007,7 +1007,7 @@ static int tcp_v4_send_synack(const struct sock *sk, = struct dst_entry *dst, if (skb) { __tcp_v4_send_check(skb, ireq->ir_loc_addr, ireq->ir_rmt_addr); =20 - tos =3D sock_net(sk)->ipv4.sysctl_tcp_reflect_tos ? + tos =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reflect_tos) ? (tcp_rsk(req)->syn_tos & ~INET_ECN_MASK) | (inet_sk(sk)->tos & INET_ECN_MASK) : inet_sk(sk)->tos; @@ -1527,7 +1527,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *= sk, struct sk_buff *skb, /* Set ToS of the new socket based upon the value of incoming SYN. * ECT bits are set later in tcp_init_transfer(). */ - if (sock_net(sk)->ipv4.sysctl_tcp_reflect_tos) + if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reflect_tos)) newinet->tos =3D tcp_rsk(req)->syn_tos & ~INET_ECN_MASK; =20 if (!dst) { diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 5185c11dc444..979e0d7b2119 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -546,7 +546,7 @@ static int tcp_v6_send_synack(const struct sock *sk, st= ruct dst_entry *dst, if (np->repflow && ireq->pktopts) fl6->flowlabel =3D ip6_flowlabel(ipv6_hdr(ireq->pktopts)); =20 - tclass =3D sock_net(sk)->ipv4.sysctl_tcp_reflect_tos ? + tclass =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reflect_tos) ? (tcp_rsk(req)->syn_tos & ~INET_ECN_MASK) | (np->tclass & INET_ECN_MASK) : np->tclass; @@ -1314,7 +1314,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct= sock *sk, struct sk_buff * /* Set ToS of the new socket based upon the value of incoming SYN. * ECT bits are set later in tcp_init_transfer(). */ - if (sock_net(sk)->ipv4.sysctl_tcp_reflect_tos) + if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reflect_tos)) newnp->tclass =3D tcp_rsk(req)->syn_tos & ~INET_ECN_MASK; =20 /* Clone native IPv6 options from listening socket (if any) --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20143C00144 for ; Mon, 1 Aug 2022 12:19:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234719AbiHAMTw (ORCPT ); Mon, 1 Aug 2022 08:19:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40478 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231250AbiHAMTC (ORCPT ); Mon, 1 Aug 2022 08:19:02 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C552341D24; Mon, 1 Aug 2022 04:59:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 62B68B80EAC; Mon, 1 Aug 2022 11:59:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B191DC433D6; Mon, 1 Aug 2022 11:59:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355179; bh=wGBP3vpY2EXQPUTz+LAQAA7C2ooTfZjpQU4fqeVse8o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RoeT/Y+Z9sQaM0lGqza0Gp+ws0T4mBuhyttcbjkuKKl9bcTTIDi3UNBqS2wv1OyW9 J14KTcSZXTFGr25uHjo7u6hzBv+AA2hvarK+TPWvE2Rtv3ATjgCwBMgBmpQ9JcwtwS 8wIDt9xEp1ssFpDB0q70Jqo2mtWmov7kwFV2l8vY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 64/88] ipv4: Fix data-races around sysctl_fib_notify_on_flag_change. Date: Mon, 1 Aug 2022 13:47:18 +0200 Message-Id: <20220801114140.980705341@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 96b9bd8c6d125490f9adfb57d387ef81a55a103e ] While reading sysctl_fib_notify_on_flag_change, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags = are changed") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/fib_trie.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c index 43a496272227..c1b53854047b 100644 --- a/net/ipv4/fib_trie.c +++ b/net/ipv4/fib_trie.c @@ -1042,6 +1042,7 @@ fib_find_matching_alias(struct net *net, const struct= fib_rt_info *fri) =20 void fib_alias_hw_flags_set(struct net *net, const struct fib_rt_info *fri) { + u8 fib_notify_on_flag_change; struct fib_alias *fa_match; struct sk_buff *skb; int err; @@ -1063,14 +1064,16 @@ void fib_alias_hw_flags_set(struct net *net, const = struct fib_rt_info *fri) WRITE_ONCE(fa_match->offload, fri->offload); WRITE_ONCE(fa_match->trap, fri->trap); =20 + fib_notify_on_flag_change =3D READ_ONCE(net->ipv4.sysctl_fib_notify_on_fl= ag_change); + /* 2 means send notifications only if offload_failed was changed. */ - if (net->ipv4.sysctl_fib_notify_on_flag_change =3D=3D 2 && + if (fib_notify_on_flag_change =3D=3D 2 && READ_ONCE(fa_match->offload_failed) =3D=3D fri->offload_failed) goto out; =20 WRITE_ONCE(fa_match->offload_failed, fri->offload_failed); =20 - if (!net->ipv4.sysctl_fib_notify_on_flag_change) + if (!fib_notify_on_flag_change) goto out; =20 skb =3D nlmsg_new(fib_nlmsg_size(fa_match->fa_info), GFP_ATOMIC); --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 05C8AC00144 for ; Mon, 1 Aug 2022 12:19:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234729AbiHAMT4 (ORCPT ); Mon, 1 Aug 2022 08:19:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42948 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231378AbiHAMTG (ORCPT ); Mon, 1 Aug 2022 08:19:06 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 652F24AD45; Mon, 1 Aug 2022 04:59:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 22487B80EAC; Mon, 1 Aug 2022 11:59:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7CFC5C433C1; Mon, 1 Aug 2022 11:59:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355181; bh=qJYfpNfc+4KP8CSpvZvaVKXZu6g86yS2Eu6wdrnHf2A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vLfAq8mXP9i5LNwM2sq2qLULEIRCEOVQAktdK2KYFJOGiFMVUvr+O7IYtFpxhVp9x VD00g6pAbNioeG1tASx7u1JFY13aOTS3Q5SzLhZ0fJACnv/Ge7jjwouPTH2D7FILaB gkqEGg0ydIULJCtNfSoGk1WBs80yX35UVd9y3xJE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dawid Lukwinski , Michal Maloszewski , Dave Switzer , Tony Nguyen , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.18 65/88] i40e: Fix interface init with MSI interrupts (no MSI-X) Date: Mon, 1 Aug 2022 13:47:19 +0200 Message-Id: <20220801114141.029897335@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michal Maloszewski [ Upstream commit 5fcbb711024aac6d4db385623e6f2fdf019f7782 ] Fix the inability to bring an interface up on a setup with only MSI interrupts enabled (no MSI-X). Solution is to add a default number of QPs =3D 1. This is enough, since without MSI-X support driver enables only a basic feature set. Fixes: bc6d33c8d93f ("i40e: Fix the number of queues available to be mapped= for use") Signed-off-by: Dawid Lukwinski Signed-off-by: Michal Maloszewski Tested-by: Dave Switzer Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20220722175401.112572-1-anthony.l.nguyen@in= tel.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethe= rnet/intel/i40e/i40e_main.c index 6f01bffd7e5c..9471f47089b2 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -1920,11 +1920,15 @@ static void i40e_vsi_setup_queue_map(struct i40e_vs= i *vsi, * non-zero req_queue_pairs says that user requested a new * queue count via ethtool's set_channels, so use this * value for queues distribution across traffic classes + * We need at least one queue pair for the interface + * to be usable as we see in else statement. */ if (vsi->req_queue_pairs > 0) vsi->num_queue_pairs =3D vsi->req_queue_pairs; else if (pf->flags & I40E_FLAG_MSIX_ENABLED) vsi->num_queue_pairs =3D pf->num_lan_msix; + else + vsi->num_queue_pairs =3D 1; } =20 /* Number of queues per enabled TC */ --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30F5CC00144 for ; Mon, 1 Aug 2022 12:20:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231193AbiHAMT7 (ORCPT ); Mon, 1 Aug 2022 08:19:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42968 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234277AbiHAMTG (ORCPT ); Mon, 1 Aug 2022 08:19:06 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1F60541D22; Mon, 1 Aug 2022 04:59:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D56B9B810A2; Mon, 1 Aug 2022 11:59:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 421B7C433C1; Mon, 1 Aug 2022 11:59:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355184; bh=kEWNh5s559gADhfV8Rv7aum1MxgKxuQ87EdsTHhgQLQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lkvuuynnDJ3A8W/WcB94/aGXi/0eazIW9CsVL9wd97pHHY4NNiR0luLd7ph99iV9z UTcfbgLUhzb7SA4HXir+aF7ot8bGUykX3X6HtjUkTBCuj3AszXcjLgWyjYrOcaKpNf /wVJFETRd0xzxehZJM2pCoE0TeOZM+cbXRy9yIw8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vladimir Oltean , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.18 66/88] net: dsa: fix reference counting for LAG FDBs Date: Mon, 1 Aug 2022 13:47:20 +0200 Message-Id: <20220801114141.068425530@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vladimir Oltean [ Upstream commit c7560d1203b7a1ea0b99a5c575547e95d564b2a8 ] Due to an invalid conflict resolution on my side while working on 2 different series (LAG FDBs and FDB isolation), dsa_switch_do_lag_fdb_add() does not store the database associated with a dsa_mac_addr structure. So after adding an FDB entry associated with a LAG, dsa_mac_addr_find() fails to find it while deleting it, because &a->db is zeroized memory for all stored FDB entries of lag->fdbs, and dsa_switch_do_lag_fdb_del() returns -ENOENT rather than deleting the entry. Fixes: c26933639b54 ("net: dsa: request drivers to perform FDB isolation") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220723012411.1125066-1-vladimir.oltean@nx= p.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/dsa/switch.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/dsa/switch.c b/net/dsa/switch.c index d8a80cf9742c..52f84ea349d2 100644 --- a/net/dsa/switch.c +++ b/net/dsa/switch.c @@ -363,6 +363,7 @@ static int dsa_switch_do_lag_fdb_add(struct dsa_switch = *ds, struct dsa_lag *lag, =20 ether_addr_copy(a->addr, addr); a->vid =3D vid; + a->db =3D db; refcount_set(&a->refcount, 1); list_add_tail(&a->list, &lag->fdbs); =20 --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F307C00144 for ; Mon, 1 Aug 2022 12:20:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234744AbiHAMUG (ORCPT ); Mon, 1 Aug 2022 08:20:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231389AbiHAMTH (ORCPT ); Mon, 1 Aug 2022 08:19:07 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B32764AD49; Mon, 1 Aug 2022 04:59:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 251ACCE13B9; Mon, 1 Aug 2022 11:59:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 13536C433C1; Mon, 1 Aug 2022 11:59:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355187; bh=eQkHLvuFiQC4fCGZQxZG6VEon3kkOfjQUOYlGs5oa7k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QRkyJMwBfmvFrq5r11+DkAe+4DKmMWFAPVgy+y5a2UIo1itfy4DaqNy91WSjytUy5 /lOR3BNBGSldu9OaGWThGrVPha1OV24P+e2N64K0twC8wg31YUuZ50J70wxj4mQMBh iqo6bEtyN9GeIuptI+O7ixfesIJUjxYQR8HRwyhc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Marcelo Ricardo Leitner , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.18 67/88] sctp: fix sleep in atomic context bug in timer handlers Date: Mon, 1 Aug 2022 13:47:21 +0200 Message-Id: <20220801114141.107321082@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou [ Upstream commit b89fc26f741d9f9efb51cba3e9b241cf1380ec5a ] There are sleep in atomic context bugs in timer handlers of sctp such as sctp_generate_t3_rtx_event(), sctp_generate_probe_event(), sctp_generate_t1_init_event(), sctp_generate_timeout_event(), sctp_generate_t3_rtx_event() and so on. The root cause is sctp_sched_prio_init_sid() with GFP_KERNEL parameter that may sleep could be called by different timer handlers which is in interrupt context. One of the call paths that could trigger bug is shown below: (interrupt context) sctp_generate_probe_event sctp_do_sm sctp_side_effects sctp_cmd_interpreter sctp_outq_teardown sctp_outq_init sctp_sched_set_sched n->init_sid(..,GFP_KERNEL) sctp_sched_prio_init_sid //may sleep This patch changes gfp_t parameter of init_sid in sctp_sched_set_sched() from GFP_KERNEL to GFP_ATOMIC in order to prevent sleep in atomic context bugs. Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") Signed-off-by: Duoming Zhou Acked-by: Marcelo Ricardo Leitner Link: https://lore.kernel.org/r/20220723015809.11553-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/sctp/stream_sched.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sctp/stream_sched.c b/net/sctp/stream_sched.c index 99e5f69fbb74..a2e1d34f52c5 100644 --- a/net/sctp/stream_sched.c +++ b/net/sctp/stream_sched.c @@ -163,7 +163,7 @@ int sctp_sched_set_sched(struct sctp_association *asoc, if (!SCTP_SO(&asoc->stream, i)->ext) continue; =20 - ret =3D n->init_sid(&asoc->stream, i, GFP_KERNEL); + ret =3D n->init_sid(&asoc->stream, i, GFP_ATOMIC); if (ret) goto err; } --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BE119C00144 for ; Mon, 1 Aug 2022 12:20:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234441AbiHAMUI (ORCPT ); Mon, 1 Aug 2022 08:20:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38182 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234612AbiHAMTH (ORCPT ); Mon, 1 Aug 2022 08:19:07 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D4C744AD52; Mon, 1 Aug 2022 04:59:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 82145B810A2; Mon, 1 Aug 2022 11:59:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D16BAC433D6; Mon, 1 Aug 2022 11:59:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355190; bh=yO3CaGRwBI7Rn5j6BPCcopt6ebHPTjp9F/DFuzNxKrw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G5gw2QkVJ6k22vQNsaomZ3GE1W3LpH4w5pmCTNv5yD6GkxH58Q9MRVlwhosOCZ5jC 506MPJJFVvW0mlUyUscMtzge80ka2FANJtP+4DMkVW5FwlcmqbrTbiHHasqKMc9mEd 78UlqOjKWiSJH6/tjoLBCtcFJLzlPiq69wC7dxpM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sunil Goutham , Subbaraya Sundeep , Paolo Abeni , Sasha Levin Subject: [PATCH 5.18 68/88] octeontx2-pf: cn10k: Fix egress ratelimit configuration Date: Mon, 1 Aug 2022 13:47:22 +0200 Message-Id: <20220801114141.152206983@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sunil Goutham [ Upstream commit b354eaeec8637d87003945439209251d76a2bb95 ] NIX_AF_TLXX_PIR/CIR register format has changed from OcteonTx2 to CN10K. CN10K supports larger burst size. Fix burst exponent and burst mantissa configuration for CN10K. Also fixed 'maxrate' from u32 to u64 since 'police.rate_bytes_ps' passed by stack is also u64. Fixes: e638a83f167e ("octeontx2-pf: TC_MATCHALL egress ratelimiting offload= ") Signed-off-by: Sunil Goutham Signed-off-by: Subbaraya Sundeep Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- .../ethernet/marvell/octeontx2/nic/otx2_tc.c | 76 ++++++++++++++----- 1 file changed, 55 insertions(+), 21 deletions(-) diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers= /net/ethernet/marvell/octeontx2/nic/otx2_tc.c index a3d720b1b32c..e64318c110fd 100644 --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c @@ -28,6 +28,9 @@ #define MAX_RATE_EXPONENT 0x0FULL #define MAX_RATE_MANTISSA 0xFFULL =20 +#define CN10K_MAX_BURST_MANTISSA 0x7FFFULL +#define CN10K_MAX_BURST_SIZE 8453888ULL + /* Bitfields in NIX_TLX_PIR register */ #define TLX_RATE_MANTISSA GENMASK_ULL(8, 1) #define TLX_RATE_EXPONENT GENMASK_ULL(12, 9) @@ -35,6 +38,9 @@ #define TLX_BURST_MANTISSA GENMASK_ULL(36, 29) #define TLX_BURST_EXPONENT GENMASK_ULL(40, 37) =20 +#define CN10K_TLX_BURST_MANTISSA GENMASK_ULL(43, 29) +#define CN10K_TLX_BURST_EXPONENT GENMASK_ULL(47, 44) + struct otx2_tc_flow_stats { u64 bytes; u64 pkts; @@ -77,33 +83,42 @@ int otx2_tc_alloc_ent_bitmap(struct otx2_nic *nic) } EXPORT_SYMBOL(otx2_tc_alloc_ent_bitmap); =20 -static void otx2_get_egress_burst_cfg(u32 burst, u32 *burst_exp, - u32 *burst_mantissa) +static void otx2_get_egress_burst_cfg(struct otx2_nic *nic, u32 burst, + u32 *burst_exp, u32 *burst_mantissa) { + int max_burst, max_mantissa; unsigned int tmp; =20 + if (is_dev_otx2(nic->pdev)) { + max_burst =3D MAX_BURST_SIZE; + max_mantissa =3D MAX_BURST_MANTISSA; + } else { + max_burst =3D CN10K_MAX_BURST_SIZE; + max_mantissa =3D CN10K_MAX_BURST_MANTISSA; + } + /* Burst is calculated as * ((256 + BURST_MANTISSA) << (1 + BURST_EXPONENT)) / 256 * Max supported burst size is 130,816 bytes. */ - burst =3D min_t(u32, burst, MAX_BURST_SIZE); + burst =3D min_t(u32, burst, max_burst); if (burst) { *burst_exp =3D ilog2(burst) ? ilog2(burst) - 1 : 0; tmp =3D burst - rounddown_pow_of_two(burst); - if (burst < MAX_BURST_MANTISSA) + if (burst < max_mantissa) *burst_mantissa =3D tmp * 2; else *burst_mantissa =3D tmp / (1ULL << (*burst_exp - 7)); } else { *burst_exp =3D MAX_BURST_EXPONENT; - *burst_mantissa =3D MAX_BURST_MANTISSA; + *burst_mantissa =3D max_mantissa; } } =20 -static void otx2_get_egress_rate_cfg(u32 maxrate, u32 *exp, +static void otx2_get_egress_rate_cfg(u64 maxrate, u32 *exp, u32 *mantissa, u32 *div_exp) { - unsigned int tmp; + u64 tmp; =20 /* Rate calculation by hardware * @@ -132,21 +147,44 @@ static void otx2_get_egress_rate_cfg(u32 maxrate, u32= *exp, } } =20 -static int otx2_set_matchall_egress_rate(struct otx2_nic *nic, u32 burst, = u32 maxrate) +static u64 otx2_get_txschq_rate_regval(struct otx2_nic *nic, + u64 maxrate, u32 burst) { - struct otx2_hw *hw =3D &nic->hw; - struct nix_txschq_config *req; u32 burst_exp, burst_mantissa; u32 exp, mantissa, div_exp; + u64 regval =3D 0; + + /* Get exponent and mantissa values from the desired rate */ + otx2_get_egress_burst_cfg(nic, burst, &burst_exp, &burst_mantissa); + otx2_get_egress_rate_cfg(maxrate, &exp, &mantissa, &div_exp); + + if (is_dev_otx2(nic->pdev)) { + regval =3D FIELD_PREP(TLX_BURST_EXPONENT, (u64)burst_exp) | + FIELD_PREP(TLX_BURST_MANTISSA, (u64)burst_mantissa) | + FIELD_PREP(TLX_RATE_DIVIDER_EXPONENT, div_exp) | + FIELD_PREP(TLX_RATE_EXPONENT, exp) | + FIELD_PREP(TLX_RATE_MANTISSA, mantissa) | BIT_ULL(0); + } else { + regval =3D FIELD_PREP(CN10K_TLX_BURST_EXPONENT, (u64)burst_exp) | + FIELD_PREP(CN10K_TLX_BURST_MANTISSA, (u64)burst_mantissa) | + FIELD_PREP(TLX_RATE_DIVIDER_EXPONENT, div_exp) | + FIELD_PREP(TLX_RATE_EXPONENT, exp) | + FIELD_PREP(TLX_RATE_MANTISSA, mantissa) | BIT_ULL(0); + } + + return regval; +} + +static int otx2_set_matchall_egress_rate(struct otx2_nic *nic, + u32 burst, u64 maxrate) +{ + struct otx2_hw *hw =3D &nic->hw; + struct nix_txschq_config *req; int txschq, err; =20 /* All SQs share the same TL4, so pick the first scheduler */ txschq =3D hw->txschq_list[NIX_TXSCH_LVL_TL4][0]; =20 - /* Get exponent and mantissa values from the desired rate */ - otx2_get_egress_burst_cfg(burst, &burst_exp, &burst_mantissa); - otx2_get_egress_rate_cfg(maxrate, &exp, &mantissa, &div_exp); - mutex_lock(&nic->mbox.lock); req =3D otx2_mbox_alloc_msg_nix_txschq_cfg(&nic->mbox); if (!req) { @@ -157,11 +195,7 @@ static int otx2_set_matchall_egress_rate(struct otx2_n= ic *nic, u32 burst, u32 ma req->lvl =3D NIX_TXSCH_LVL_TL4; req->num_regs =3D 1; req->reg[0] =3D NIX_AF_TL4X_PIR(txschq); - req->regval[0] =3D FIELD_PREP(TLX_BURST_EXPONENT, burst_exp) | - FIELD_PREP(TLX_BURST_MANTISSA, burst_mantissa) | - FIELD_PREP(TLX_RATE_DIVIDER_EXPONENT, div_exp) | - FIELD_PREP(TLX_RATE_EXPONENT, exp) | - FIELD_PREP(TLX_RATE_MANTISSA, mantissa) | BIT_ULL(0); + req->regval[0] =3D otx2_get_txschq_rate_regval(nic, maxrate, burst); =20 err =3D otx2_sync_mbox_msg(&nic->mbox); mutex_unlock(&nic->mbox.lock); @@ -230,7 +264,7 @@ static int otx2_tc_egress_matchall_install(struct otx2_= nic *nic, struct netlink_ext_ack *extack =3D cls->common.extack; struct flow_action *actions =3D &cls->rule->action; struct flow_action_entry *entry; - u32 rate; + u64 rate; int err; =20 err =3D otx2_tc_validate_flow(nic, actions, extack); @@ -256,7 +290,7 @@ static int otx2_tc_egress_matchall_install(struct otx2_= nic *nic, } /* Convert bytes per second to Mbps */ rate =3D entry->police.rate_bytes_ps * 8; - rate =3D max_t(u32, rate / 1000000, 1); + rate =3D max_t(u64, rate / 1000000, 1); err =3D otx2_set_matchall_egress_rate(nic, entry->police.burst, rate); if (err) return err; --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5BA58C00144 for ; Mon, 1 Aug 2022 12:17:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234445AbiHAMRK (ORCPT ); Mon, 1 Aug 2022 08:17:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38840 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234475AbiHAMP6 (ORCPT ); Mon, 1 Aug 2022 08:15:58 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 298873E77E; Mon, 1 Aug 2022 04:58:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A257C601BD; Mon, 1 Aug 2022 11:58:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AABDDC433C1; Mon, 1 Aug 2022 11:58:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355116; bh=BQthgXHp2KBr8hYl964q2/BtVKsb92ooOktuAdYPSsw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lcC2vh6FM95hZRTO6mrwpNp2T1g504ZR1VZUPWYlr6UHOZk5tVKtyB/sY3Fqy9TIz xsQaKUche6W1u9+ceoQxL/zj58ZEgSeQEQmHjfe6QqF/o78cj7A29iS6LTr47D5iGE 5GJN86ywk2vQvP4SapSEERrnkuiEzBq8pdKJZGuE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Domingo Dirutigliano , Florian Westphal , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 5.18 69/88] netfilter: nf_queue: do not allow packet truncation below transport header offset Date: Mon, 1 Aug 2022 13:47:23 +0200 Message-Id: <20220801114141.198676600@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Westphal [ Upstream commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164 ] Domingo Dirutigliano and Nicola Guerrera report kernel panic when sending nf_queue verdict with 1-byte nfta_payload attribute. The IP/IPv6 stack pulls the IP(v6) header from the packet after the input hook. If user truncates the packet below the header size, this skb_pull() will result in a malformed skb (skb->len < 0). Fixes: 7af4cc3fa158 ("[NETFILTER]: Add "nfnetlink_queue" netfilter queue ha= ndler over nfnetlink") Reported-by: Domingo Dirutigliano Signed-off-by: Florian Westphal Reviewed-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/netfilter/nfnetlink_queue.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queu= e.c index a364f8e5e698..87a9009d5234 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -843,11 +843,16 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, un= signed int queuenum) } =20 static int -nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e, int diff) +nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, = int diff) { struct sk_buff *nskb; =20 if (diff < 0) { + unsigned int min_len =3D skb_transport_offset(e->skb); + + if (data_len < min_len) + return -EINVAL; + if (pskb_trim(e->skb, data_len)) return -ENOMEM; } else if (diff > 0) { --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61AB4C00144 for ; Mon, 1 Aug 2022 12:17:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234465AbiHAMRQ (ORCPT ); Mon, 1 Aug 2022 08:17:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39826 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234564AbiHAMQG (ORCPT ); Mon, 1 Aug 2022 08:16:06 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D074A7B7B2; Mon, 1 Aug 2022 04:58:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 163EBB81177; Mon, 1 Aug 2022 11:58:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6D51EC433D6; Mon, 1 Aug 2022 11:58:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355118; bh=BCSZ5FcxKHLnLX9QYsEZYRemGsHyujug8mJ30WI0Syo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=U0rfW4RclhbNf+tvS4I3B1d3x042P1gRiaI8jRt3P2Y0A4QJPWlH13VpEuibFTvmr yp3/zWn77eS/pBU7KCDfYnfnB9wwZlSedOmr07/zOZonnqG9WNRp/WlXs2ycP3mdQU gOXnlX6GbnwAQJTUmjJ1U0CNgsoXVavtAA3/ImQ0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stanley Chu , Adrian Hunter , Bart Van Assche , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.18 70/88] scsi: ufs: Support clearing multiple commands at once Date: Mon, 1 Aug 2022 13:47:24 +0200 Message-Id: <20220801114141.237012467@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Bart Van Assche [ Upstream commit d1a7644648b7cdacaf8d1013a4285001911e9bc8 ] Modify ufshcd_clear_cmd() such that it supports clearing multiple commands at once instead of one command at a time. This change will be used in a later patch to reduce the time spent in the reset handler. Link: https://lore.kernel.org/r/20220613214442.212466-3-bvanassche@acm.org Reviewed-by: Stanley Chu Reviewed-by: Adrian Hunter Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/scsi/ufs/ufshcd.c | 42 ++++++++++++++++++++++++++------------- 1 file changed, 28 insertions(+), 14 deletions(-) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index 452ad0612067..a34c1fab0246 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -734,17 +734,28 @@ static enum utp_ocs ufshcd_get_tr_ocs(struct ufshcd_l= rb *lrbp) } =20 /** - * ufshcd_utrl_clear - Clear a bit in UTRLCLR register + * ufshcd_utrl_clear() - Clear requests from the controller request list. * @hba: per adapter instance - * @pos: position of the bit to be cleared + * @mask: mask with one bit set for each request to be cleared */ -static inline void ufshcd_utrl_clear(struct ufs_hba *hba, u32 pos) +static inline void ufshcd_utrl_clear(struct ufs_hba *hba, u32 mask) { if (hba->quirks & UFSHCI_QUIRK_BROKEN_REQ_LIST_CLR) - ufshcd_writel(hba, (1 << pos), REG_UTP_TRANSFER_REQ_LIST_CLEAR); - else - ufshcd_writel(hba, ~(1 << pos), - REG_UTP_TRANSFER_REQ_LIST_CLEAR); + mask =3D ~mask; + /* + * From the UFSHCI specification: "UTP Transfer Request List CLear + * Register (UTRLCLR): This field is bit significant. Each bit + * corresponds to a slot in the UTP Transfer Request List, where bit 0 + * corresponds to request slot 0. A bit in this field is set to =E2=80=98= 0=E2=80=99 + * by host software to indicate to the host controller that a transfer + * request slot is cleared. The host controller + * shall free up any resources associated to the request slot + * immediately, and shall set the associated bit in UTRLDBR to =E2=80=980= =E2=80=99. The + * host software indicates no change to request slots by setting the + * associated bits in this field to =E2=80=981=E2=80=99. Bits in this fie= ld shall only + * be set =E2=80=981=E2=80=99 or =E2=80=980=E2=80=99 by host software whe= n UTRLRSR is set to =E2=80=981=E2=80=99." + */ + ufshcd_writel(hba, ~mask, REG_UTP_TRANSFER_REQ_LIST_CLEAR); } =20 /** @@ -2853,16 +2864,19 @@ static int ufshcd_compose_dev_cmd(struct ufs_hba *h= ba, return ufshcd_compose_devman_upiu(hba, lrbp); } =20 -static int -ufshcd_clear_cmd(struct ufs_hba *hba, int tag) +/* + * Clear all the requests from the controller for which a bit has been set= in + * @mask and wait until the controller confirms that these requests have b= een + * cleared. + */ +static int ufshcd_clear_cmds(struct ufs_hba *hba, u32 mask) { int err =3D 0; unsigned long flags; - u32 mask =3D 1 << tag; =20 /* clear outstanding transaction before retry */ spin_lock_irqsave(hba->host->host_lock, flags); - ufshcd_utrl_clear(hba, tag); + ufshcd_utrl_clear(hba, mask); spin_unlock_irqrestore(hba->host->host_lock, flags); =20 /* @@ -2953,7 +2967,7 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hb= a, err =3D -ETIMEDOUT; dev_dbg(hba->dev, "%s: dev_cmd request timedout, tag %d\n", __func__, lrbp->task_tag); - if (!ufshcd_clear_cmd(hba, lrbp->task_tag)) + if (!ufshcd_clear_cmds(hba, 1U << lrbp->task_tag)) /* successfully cleared the command, retry if needed */ err =3D -EAGAIN; /* @@ -6988,7 +7002,7 @@ static int ufshcd_eh_device_reset_handler(struct scsi= _cmnd *cmd) /* clear the commands that were pending for corresponding LUN */ for_each_set_bit(pos, &hba->outstanding_reqs, hba->nutrs) { if (hba->lrb[pos].lun =3D=3D lun) { - err =3D ufshcd_clear_cmd(hba, pos); + err =3D ufshcd_clear_cmds(hba, 1U << pos); if (err) break; __ufshcd_transfer_req_compl(hba, 1U << pos); @@ -7090,7 +7104,7 @@ static int ufshcd_try_to_abort_task(struct ufs_hba *h= ba, int tag) goto out; } =20 - err =3D ufshcd_clear_cmd(hba, tag); + err =3D ufshcd_clear_cmds(hba, 1U << tag); if (err) dev_err(hba->dev, "%s: Failed clearing cmd at tag %d, err %d\n", __func__, tag, err); --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6F651C00144 for ; Mon, 1 Aug 2022 12:17:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234481AbiHAMRT (ORCPT ); Mon, 1 Aug 2022 08:17:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40478 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234600AbiHAMQJ (ORCPT ); Mon, 1 Aug 2022 08:16:09 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 380657CB4D; Mon, 1 Aug 2022 04:58:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D3CB3B80E8F; Mon, 1 Aug 2022 11:58:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 305C0C433D6; Mon, 1 Aug 2022 11:58:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355121; bh=t9K1ljGtuwOhs5uxy8grAgH4UHD7p6dHciwG8jNTmFI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BvMls7l8Yi7ZdhgeXDh1QLRESjxIqdGuvsW3M1oqv/D7450DkPfi5Z/sYhbJ48rfh qacb2/4yYZP87TJTGxYZEpELfutAjuLycAQVrhvA+ZPPMPt45N/wX39EGAXcngD1PK mCSUXPucDpF/IgLFtFT3TGRABZYBXbvF4RkJrl/M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Adrian Hunter , Avri Altman , Bean Huo , Stanley Chu , Bart Van Assche , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.18 71/88] scsi: ufs: core: Fix a race condition related to device management Date: Mon, 1 Aug 2022 13:47:25 +0200 Message-Id: <20220801114141.269290284@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bart Van Assche [ Upstream commit f5c2976e0cb0f6236013bfb479868531b04f61d4 ] If a device management command completion happens after wait_for_completion_timeout() times out and before ufshcd_clear_cmds() is called, then the completion code may crash on the complete() call in __ufshcd_transfer_req_compl(). Fix the following crash: Unable to handle kernel NULL pointer dereference at virtual address 00000= 00000000008 Call trace: complete+0x64/0x178 __ufshcd_transfer_req_compl+0x30c/0x9c0 ufshcd_poll+0xf0/0x208 ufshcd_sl_intr+0xb8/0xf0 ufshcd_intr+0x168/0x2f4 __handle_irq_event_percpu+0xa0/0x30c handle_irq_event+0x84/0x178 handle_fasteoi_irq+0x150/0x2e8 __handle_domain_irq+0x114/0x1e4 gic_handle_irq.31846+0x58/0x300 el1_irq+0xe4/0x1c0 efi_header_end+0x110/0x680 __irq_exit_rcu+0x108/0x124 __handle_domain_irq+0x118/0x1e4 gic_handle_irq.31846+0x58/0x300 el1_irq+0xe4/0x1c0 cpuidle_enter_state+0x3ac/0x8c4 do_idle+0x2fc/0x55c cpu_startup_entry+0x84/0x90 kernel_init+0x0/0x310 start_kernel+0x0/0x608 start_kernel+0x4ec/0x608 Link: https://lore.kernel.org/r/20220720170228.1598842-1-bvanassche@acm.org Fixes: 5a0b0cb9bee7 ("[SCSI] ufs: Add support for sending NOP OUT UPIU") Cc: Adrian Hunter Cc: Avri Altman Cc: Bean Huo Cc: Stanley Chu Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/scsi/ufs/ufshcd.c | 58 +++++++++++++++++++++++++++------------ 1 file changed, 40 insertions(+), 18 deletions(-) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index a34c1fab0246..874490f7f5e7 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -2947,37 +2947,59 @@ ufshcd_dev_cmd_completion(struct ufs_hba *hba, stru= ct ufshcd_lrb *lrbp) static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba, struct ufshcd_lrb *lrbp, int max_timeout) { - int err =3D 0; - unsigned long time_left; + unsigned long time_left =3D msecs_to_jiffies(max_timeout); unsigned long flags; + bool pending; + int err; =20 +retry: time_left =3D wait_for_completion_timeout(hba->dev_cmd.complete, - msecs_to_jiffies(max_timeout)); + time_left); =20 - spin_lock_irqsave(hba->host->host_lock, flags); - hba->dev_cmd.complete =3D NULL; if (likely(time_left)) { + /* + * The completion handler called complete() and the caller of + * this function still owns the @lrbp tag so the code below does + * not trigger any race conditions. + */ + hba->dev_cmd.complete =3D NULL; err =3D ufshcd_get_tr_ocs(lrbp); if (!err) err =3D ufshcd_dev_cmd_completion(hba, lrbp); - } - spin_unlock_irqrestore(hba->host->host_lock, flags); - - if (!time_left) { + } else { err =3D -ETIMEDOUT; dev_dbg(hba->dev, "%s: dev_cmd request timedout, tag %d\n", __func__, lrbp->task_tag); - if (!ufshcd_clear_cmds(hba, 1U << lrbp->task_tag)) + if (ufshcd_clear_cmds(hba, 1U << lrbp->task_tag) =3D=3D 0) { /* successfully cleared the command, retry if needed */ err =3D -EAGAIN; - /* - * in case of an error, after clearing the doorbell, - * we also need to clear the outstanding_request - * field in hba - */ - spin_lock_irqsave(&hba->outstanding_lock, flags); - __clear_bit(lrbp->task_tag, &hba->outstanding_reqs); - spin_unlock_irqrestore(&hba->outstanding_lock, flags); + /* + * Since clearing the command succeeded we also need to + * clear the task tag bit from the outstanding_reqs + * variable. + */ + spin_lock_irqsave(&hba->outstanding_lock, flags); + pending =3D test_bit(lrbp->task_tag, + &hba->outstanding_reqs); + if (pending) { + hba->dev_cmd.complete =3D NULL; + __clear_bit(lrbp->task_tag, + &hba->outstanding_reqs); + } + spin_unlock_irqrestore(&hba->outstanding_lock, flags); + + if (!pending) { + /* + * The completion handler ran while we tried to + * clear the command. + */ + time_left =3D 1; + goto retry; + } + } else { + dev_err(hba->dev, "%s: failed to clear tag %d\n", + __func__, lrbp->task_tag); + } } =20 return err; --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81BC9C00144 for ; Mon, 1 Aug 2022 12:17:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234509AbiHAMRY (ORCPT ); Mon, 1 Aug 2022 08:17:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234617AbiHAMQM (ORCPT ); Mon, 1 Aug 2022 08:16:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 94FFC7CB56; Mon, 1 Aug 2022 04:58:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 088AB6010C; Mon, 1 Aug 2022 11:58:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 10925C433C1; Mon, 1 Aug 2022 11:58:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355124; bh=DsYUMY9t7A0aU7eZB/mzzqS4nrfPLs6ALAid1gFFE6o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ONtp5v70uey4cjwLsPC0xZ5Y/HEbP9o2K5KFMlCuWCC48Igk1QmLeLrBmRD3Pjvz1 b3LsJXcf8ogeipJAxboMljgq+t24PSa1cIkYpuXvr7awwRZrGo83CbyL9sH9qcwblM A26glOHaJu5eLx/qP1oaHe3wyw7uJFiYcSmX51KY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Geliang Tang , Mat Martineau , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 72/88] mptcp: dont send RST for single subflow Date: Mon, 1 Aug 2022 13:47:26 +0200 Message-Id: <20220801114141.321741611@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Geliang Tang [ Upstream commit 1761fed2567807f26fbd53032ff622f55978c7a9 ] When a bad checksum is detected and a single subflow is in use, don't send RST + MP_FAIL, send data_ack + MP_FAIL instead. So invoke tcp_send_active_reset() only when mptcp_has_another_subflow() is true. Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/mptcp/subflow.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index 7919e259175d..ccae50eba664 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -1221,14 +1221,14 @@ static bool subflow_check_data_avail(struct sock *s= sk) /* RFC 8684 section 3.7. */ if (subflow->send_mp_fail) { if (mptcp_has_another_subflow(ssk)) { + ssk->sk_err =3D EBADMSG; + tcp_set_state(ssk, TCP_CLOSE); + subflow->reset_transient =3D 0; + subflow->reset_reason =3D MPTCP_RST_EMIDDLEBOX; + tcp_send_active_reset(ssk, GFP_ATOMIC); while ((skb =3D skb_peek(&ssk->sk_receive_queue))) sk_eat_skb(ssk, skb); } - ssk->sk_err =3D EBADMSG; - tcp_set_state(ssk, TCP_CLOSE); - subflow->reset_transient =3D 0; - subflow->reset_reason =3D MPTCP_RST_EMIDDLEBOX; - tcp_send_active_reset(ssk, GFP_ATOMIC); WRITE_ONCE(subflow->data_avail, MPTCP_SUBFLOW_NODATA); return true; } --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C1C77C00144 for ; Mon, 1 Aug 2022 12:17:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234525AbiHAMR2 (ORCPT ); Mon, 1 Aug 2022 08:17:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42990 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234665AbiHAMQO (ORCPT ); Mon, 1 Aug 2022 08:16:14 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6EEA63E779; Mon, 1 Aug 2022 04:58:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BA66E6023B; Mon, 1 Aug 2022 11:58:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CA128C433D6; Mon, 1 Aug 2022 11:58:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355127; bh=MSU+wIZy6YkLdrzUgPvd6S2garQUL9V0rYkYpyfa7mI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jbeiOraKXhU8YL/MPBJhzG/i5JgPStTRY+eM9quDMJ+GSzx4zMCFiL4C+1RXtOHVO wj+vw0QYWOpQQSdjYbMN/RSIYAqfmYFhNtTlhiKpzE6G6qJAY0nF5AR6Glq0Fe9h7C qVFBAgetTnUPGnE+rgzlT3zOljwQKbg1WQtpEbac= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jason Wang , "Michael S. Tsirkin" , Xuan Zhuo , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 73/88] virtio-net: fix the race between refill work and close Date: Mon, 1 Aug 2022 13:47:27 +0200 Message-Id: <20220801114141.369132581@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jason Wang [ Upstream commit 5a159128faff151b7fe5f4eb0f310b1e0a2d56bf ] We try using cancel_delayed_work_sync() to prevent the work from enabling NAPI. This is insufficient since we don't disable the source of the refill work scheduling. This means an NAPI poll callback after cancel_delayed_work_sync() can schedule the refill work then can re-enable the NAPI that leads to use-after-free [1]. Since the work can enable NAPI, we can't simply disable NAPI before calling cancel_delayed_work_sync(). So fix this by introducing a dedicated boolean to control whether or not the work could be scheduled from NAPI. [1] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: use-after-free in refill_work+0x43/0xd4 Read of size 2 at addr ffff88810562c92e by task kworker/2:1/42 CPU: 2 PID: 42 Comm: kworker/2:1 Not tainted 5.19.0-rc1+ #480 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239= 552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: events refill_work Call Trace: dump_stack_lvl+0x34/0x44 print_report.cold+0xbb/0x6ac ? _printk+0xad/0xde ? refill_work+0x43/0xd4 kasan_report+0xa8/0x130 ? refill_work+0x43/0xd4 refill_work+0x43/0xd4 process_one_work+0x43d/0x780 worker_thread+0x2a0/0x6f0 ? process_one_work+0x780/0x780 kthread+0x167/0x1a0 ? kthread_exit+0x50/0x50 ret_from_fork+0x22/0x30 ... Fixes: b2baed69e605c ("virtio_net: set/cancel work on ndo_open/ndo_stop") Signed-off-by: Jason Wang Acked-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/virtio_net.c | 37 ++++++++++++++++++++++++++++++++++--- 1 file changed, 34 insertions(+), 3 deletions(-) diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index c7804fce204c..206904e60784 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -242,9 +242,15 @@ struct virtnet_info { /* Packet virtio header size */ u8 hdr_len; =20 - /* Work struct for refilling if we run low on memory. */ + /* Work struct for delayed refilling if we run low on memory. */ struct delayed_work refill; =20 + /* Is delayed refill enabled? */ + bool refill_enabled; + + /* The lock to synchronize the access to refill_enabled */ + spinlock_t refill_lock; + /* Work struct for config space updates */ struct work_struct config_work; =20 @@ -348,6 +354,20 @@ static struct page *get_a_page(struct receive_queue *r= q, gfp_t gfp_mask) return p; } =20 +static void enable_delayed_refill(struct virtnet_info *vi) +{ + spin_lock_bh(&vi->refill_lock); + vi->refill_enabled =3D true; + spin_unlock_bh(&vi->refill_lock); +} + +static void disable_delayed_refill(struct virtnet_info *vi) +{ + spin_lock_bh(&vi->refill_lock); + vi->refill_enabled =3D false; + spin_unlock_bh(&vi->refill_lock); +} + static void virtqueue_napi_schedule(struct napi_struct *napi, struct virtqueue *vq) { @@ -1527,8 +1547,12 @@ static int virtnet_receive(struct receive_queue *rq,= int budget, } =20 if (rq->vq->num_free > min((unsigned int)budget, virtqueue_get_vring_size= (rq->vq)) / 2) { - if (!try_fill_recv(vi, rq, GFP_ATOMIC)) - schedule_delayed_work(&vi->refill, 0); + if (!try_fill_recv(vi, rq, GFP_ATOMIC)) { + spin_lock(&vi->refill_lock); + if (vi->refill_enabled) + schedule_delayed_work(&vi->refill, 0); + spin_unlock(&vi->refill_lock); + } } =20 u64_stats_update_begin(&rq->stats.syncp); @@ -1651,6 +1675,8 @@ static int virtnet_open(struct net_device *dev) struct virtnet_info *vi =3D netdev_priv(dev); int i, err; =20 + enable_delayed_refill(vi); + for (i =3D 0; i < vi->max_queue_pairs; i++) { if (i < vi->curr_queue_pairs) /* Make sure we have some buffers: if oom use wq. */ @@ -2033,6 +2059,8 @@ static int virtnet_close(struct net_device *dev) struct virtnet_info *vi =3D netdev_priv(dev); int i; =20 + /* Make sure NAPI doesn't schedule refill work */ + disable_delayed_refill(vi); /* Make sure refill_work doesn't re-enable napi! */ cancel_delayed_work_sync(&vi->refill); =20 @@ -2792,6 +2820,8 @@ static int virtnet_restore_up(struct virtio_device *v= dev) =20 virtio_device_ready(vdev); =20 + enable_delayed_refill(vi); + if (netif_running(vi->dev)) { err =3D virtnet_open(vi->dev); if (err) @@ -3534,6 +3564,7 @@ static int virtnet_probe(struct virtio_device *vdev) vdev->priv =3D vi; =20 INIT_WORK(&vi->config_work, virtnet_config_changed_work); + spin_lock_init(&vi->refill_lock); =20 /* If we can receive ANY GSO packets, we must allocate large ones. */ if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) || --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A125C19F29 for ; Mon, 1 Aug 2022 12:17:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234540AbiHAMRg (ORCPT ); Mon, 1 Aug 2022 08:17:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39018 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234086AbiHAMQT (ORCPT ); Mon, 1 Aug 2022 08:16:19 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D65A348EB4; Mon, 1 Aug 2022 04:58:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1EF6BB80E8F; Mon, 1 Aug 2022 11:58:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 55C9FC433C1; Mon, 1 Aug 2022 11:58:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355129; bh=6LDtu3xfLD3w2Kt9zGVdzUU8HzppBADqvcuwSBLmMK4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KK7nRXpzACsVzXfYbWd4WLRa6HRDvG+e9C5A8IiYA8dcgzqtb9jV9AQfD5KfK8z5F 7FOWE2IgufX+ixhBLQ+F9YfVti1XeE7YN2m/Kg9mzZjoYDa+km70HRG3RY+CbFZ8ki Ke7cqSLtFSxOqHV2oowzlXggsykjUBPn57g6G1V4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chang Rui , Fangrui Song , Leo Yan , Namhyung Kim , Alexander Shishkin , Ian Rogers , Ingo Molnar , Jiri Olsa , Mark Rutland , Peter Zijlstra , Arnaldo Carvalho de Melo , Sasha Levin Subject: [PATCH 5.18 74/88] perf symbol: Correct address for bss symbols Date: Mon, 1 Aug 2022 13:47:28 +0200 Message-Id: <20220801114141.409143282@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Leo Yan [ Upstream commit 2d86612aacb7805f72873691a2644d7279ed0630 ] When using 'perf mem' and 'perf c2c', an issue is observed that tool reports the wrong offset for global data symbols. This is a common issue on both x86 and Arm64 platforms. Let's see an example, for a test program, below is the disassembly for its .bss section which is dumped with objdump: ... Disassembly of section .bss: 0000000000004040 : ... 0000000000004080 : ... 00000000000040c0 : ... 0000000000004100 : ... First we used 'perf mem record' to run the test program and then used 'perf --debug verbose=3D4 mem report' to observe what's the symbol info for 'buf1' and 'buf2' structures. # ./perf mem record -e ldlat-loads,ldlat-stores -- false_sharing.exe 8 # ./perf --debug verbose=3D4 mem report ... dso__load_sym_internal: adjusting symbol: st_value: 0x40c0 sh_addr: 0x4= 040 sh_offset: 0x3028 symbol__new: buf2 0x30a8-0x30e8 ... dso__load_sym_internal: adjusting symbol: st_value: 0x4080 sh_addr: 0x4= 040 sh_offset: 0x3028 symbol__new: buf1 0x3068-0x30a8 ... The perf tool relies on libelf to parse symbols, in executable and shared object files, 'st_value' holds a virtual address; 'sh_addr' is the address at which section's first byte should reside in memory, and 'sh_offset' is the byte offset from the beginning of the file to the first byte in the section. The perf tool uses below formula to convert a symbol's memory address to a file address: file_address =3D st_value - sh_addr + sh_offset ^ ` Memory address We can see the final adjusted address ranges for buf1 and buf2 are [0x30a8-0x30e8) and [0x3068-0x30a8) respectively, apparently this is incorrect, in the code, the structure for 'buf1' and 'buf2' specifies compiler attribute with 64-byte alignment. The problem happens for 'sh_offset', libelf returns it as 0x3028 which is not 64-byte aligned, combining with disassembly, it's likely libelf doesn't respect the alignment for .bss section, therefore, it doesn't return the aligned value for 'sh_offset'. Suggested by Fangrui Song, ELF file contains program header which contains PT_LOAD segments, the fields p_vaddr and p_offset in PT_LOAD segments contain the execution info. A better choice for converting memory address to file address is using the formula: file_address =3D st_value - p_vaddr + p_offset This patch introduces elf_read_program_header() which returns the program header based on the passed 'st_value', then it uses the formula above to calculate the symbol file address; and the debugging log is updated respectively. After applying the change: # ./perf --debug verbose=3D4 mem report ... dso__load_sym_internal: adjusting symbol: st_value: 0x40c0 p_vaddr: 0x3= d28 p_offset: 0x2d28 symbol__new: buf2 0x30c0-0x3100 ... dso__load_sym_internal: adjusting symbol: st_value: 0x4080 p_vaddr: 0x3= d28 p_offset: 0x2d28 symbol__new: buf1 0x3080-0x30c0 ... Fixes: f17e04afaff84b5c ("perf report: Fix ELF symbol parsing") Reported-by: Chang Rui Suggested-by: Fangrui Song Signed-off-by: Leo Yan Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220724060013.171050-2-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- tools/perf/util/symbol-elf.c | 45 ++++++++++++++++++++++++++++++++---- 1 file changed, 41 insertions(+), 4 deletions(-) diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c index ecd377938eea..ef6ced5c5746 100644 --- a/tools/perf/util/symbol-elf.c +++ b/tools/perf/util/symbol-elf.c @@ -233,6 +233,33 @@ Elf_Scn *elf_section_by_name(Elf *elf, GElf_Ehdr *ep, return NULL; } =20 +static int elf_read_program_header(Elf *elf, u64 vaddr, GElf_Phdr *phdr) +{ + size_t i, phdrnum; + u64 sz; + + if (elf_getphdrnum(elf, &phdrnum)) + return -1; + + for (i =3D 0; i < phdrnum; i++) { + if (gelf_getphdr(elf, i, phdr) =3D=3D NULL) + return -1; + + if (phdr->p_type !=3D PT_LOAD) + continue; + + sz =3D max(phdr->p_memsz, phdr->p_filesz); + if (!sz) + continue; + + if (vaddr >=3D phdr->p_vaddr && (vaddr < phdr->p_vaddr + sz)) + return 0; + } + + /* Not found any valid program header */ + return -1; +} + static bool want_demangle(bool is_kernel_sym) { return is_kernel_sym ? symbol_conf.demangle_kernel : symbol_conf.demangle; @@ -1209,6 +1236,7 @@ dso__load_sym_internal(struct dso *dso, struct map *m= ap, struct symsrc *syms_ss, sym.st_value); used_opd =3D true; } + /* * When loading symbols in a data mapping, ABS symbols (which * has a value of SHN_ABS in its st_shndx) failed at @@ -1262,11 +1290,20 @@ dso__load_sym_internal(struct dso *dso, struct map = *map, struct symsrc *syms_ss, goto out_elf_end; } else if ((used_opd && runtime_ss->adjust_symbols) || (!used_opd && syms_ss->adjust_symbols)) { + GElf_Phdr phdr; + + if (elf_read_program_header(syms_ss->elf, + (u64)sym.st_value, &phdr)) { + pr_warning("%s: failed to find program header for " + "symbol: %s st_value: %#" PRIx64 "\n", + __func__, elf_name, (u64)sym.st_value); + continue; + } pr_debug4("%s: adjusting symbol: st_value: %#" PRIx64 " " - "sh_addr: %#" PRIx64 " sh_offset: %#" PRIx64 "\n", __func__, - (u64)sym.st_value, (u64)shdr.sh_addr, - (u64)shdr.sh_offset); - sym.st_value -=3D shdr.sh_addr - shdr.sh_offset; + "p_vaddr: %#" PRIx64 " p_offset: %#" PRIx64 "\n", + __func__, (u64)sym.st_value, (u64)phdr.p_vaddr, + (u64)phdr.p_offset); + sym.st_value -=3D phdr.p_vaddr - phdr.p_offset; } =20 demangled =3D demangle_sym(dso, kmodule, elf_name); --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18771C00144 for ; Mon, 1 Aug 2022 12:17:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234353AbiHAMRn (ORCPT ); Mon, 1 Aug 2022 08:17:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39024 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232764AbiHAMQU (ORCPT ); Mon, 1 Aug 2022 08:16:20 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9F8A048EBA; Mon, 1 Aug 2022 04:58:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3413C601BD; Mon, 1 Aug 2022 11:58:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4286FC433D6; Mon, 1 Aug 2022 11:58:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355132; bh=V9i1hf2LQpzY+KIjI62YaHiuBTwGLrzlI/aKwlWDq64=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RTDuqLwkdZ1QoU896LRWjp1xF2fsfHAS/Jv3TgWKfcTF5lddDZhNNbNhZsk0YJsTz 933EPb8n63/1K+Yv8XJvkhxTU2G5rRj+SyXrpVTpJfGZQV2vvCcibhi00LyC7zGnzf YeeViPF7BQ0tIKdNSuXJ+FyQ5zL9t/hQpFx5cROw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alejandro Lucero , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.18 75/88] sfc: disable softirqs for ptp TX Date: Mon, 1 Aug 2022 13:47:29 +0200 Message-Id: <20220801114141.456883459@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alejandro Lucero [ Upstream commit 67c3b611d92fc238c43734878bc3e232ab570c79 ] Sending a PTP packet can imply to use the normal TX driver datapath but invoked from the driver's ptp worker. The kernel generic TX code disables softirqs and preemption before calling specific driver TX code, but the ptp worker does not. Although current ptp driver functionality does not require it, there are several reasons for doing so: 1) The invoked code is always executed with softirqs disabled for non PTP packets. 2) Better if a ptp packet transmission is not interrupted by softirq handling which could lead to high latencies. 3) netdev_xmit_more used by the TX code requires preemption to be disabled. Indeed a solution for dealing with kernel preemption state based on static kernel configuration is not possible since the introduction of dynamic preemption level configuration at boot time using the static calls functionality. Fixes: f79c957a0b537 ("drivers: net: sfc: use netdev_xmit_more helper") Signed-off-by: Alejandro Lucero Link: https://lore.kernel.org/r/20220726064504.49613-1-alejandro.lucero-pal= au@amd.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/sfc/ptp.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c index 4625f85acab2..10ad0b93d283 100644 --- a/drivers/net/ethernet/sfc/ptp.c +++ b/drivers/net/ethernet/sfc/ptp.c @@ -1100,7 +1100,29 @@ static void efx_ptp_xmit_skb_queue(struct efx_nic *e= fx, struct sk_buff *skb) =20 tx_queue =3D efx_channel_get_tx_queue(ptp_data->channel, type); if (tx_queue && tx_queue->timestamping) { + /* This code invokes normal driver TX code which is always + * protected from softirqs when called from generic TX code, + * which in turn disables preemption. Look at __dev_queue_xmit + * which uses rcu_read_lock_bh disabling preemption for RCU + * plus disabling softirqs. We do not need RCU reader + * protection here. + * + * Although it is theoretically safe for current PTP TX/RX code + * running without disabling softirqs, there are three good + * reasond for doing so: + * + * 1) The code invoked is mainly implemented for non-PTP + * packets and it is always executed with softirqs + * disabled. + * 2) This being a single PTP packet, better to not + * interrupt its processing by softirqs which can lead + * to high latencies. + * 3) netdev_xmit_more checks preemption is disabled and + * triggers a BUG_ON if not. + */ + local_bh_disable(); efx_enqueue_skb(tx_queue, skb); + local_bh_enable(); } else { WARN_ONCE(1, "PTP channel has no timestamped tx queue\n"); dev_kfree_skb_any(skb); --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3042C00144 for ; Mon, 1 Aug 2022 12:17:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234361AbiHAMR4 (ORCPT ); Mon, 1 Aug 2022 08:17:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40174 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234318AbiHAMQe (ORCPT ); Mon, 1 Aug 2022 08:16:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ED5F93ED6A; Mon, 1 Aug 2022 04:58:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 89409B81163; Mon, 1 Aug 2022 11:58:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E0A3EC433D6; Mon, 1 Aug 2022 11:58:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355135; bh=TQns3hjRBLYuanL/YF6iu0M/uuZZf7+dlf8QceGSMv8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RjmU+5VfKdsWsaZ4CzwJOt4X6dby1s7wKjW3fLyvXjqj3pZnVXfXZnalZnqUw5D6D sePTRLD4dxB9MyDmYVxmIjuGQpO0tlJzKSO8Szi85yu+v8iR3056Qi75zDUvAZd2UX S6yuG4DpD9oCmPe6O6USuLzkoh0mefGYTJ/PPQEE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wei Chen , Xin Long , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.18 76/88] sctp: leave the err path free in sctp_stream_init to sctp_stream_free Date: Mon, 1 Aug 2022 13:47:30 +0200 Message-Id: <20220801114141.504347668@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xin Long [ Upstream commit 181d8d2066c000ba0a0e6940a7ad80f1a0e68e9d ] A NULL pointer dereference was reported by Wei Chen: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:__list_del_entry_valid+0x26/0x80 Call Trace: sctp_sched_dequeue_common+0x1c/0x90 sctp_sched_prio_dequeue+0x67/0x80 __sctp_outq_teardown+0x299/0x380 sctp_outq_free+0x15/0x20 sctp_association_free+0xc3/0x440 sctp_do_sm+0x1ca7/0x2210 sctp_assoc_bh_rcv+0x1f6/0x340 This happens when calling sctp_sendmsg without connecting to server first. In this case, a data chunk already queues up in send queue of client side when processing the INIT_ACK from server in sctp_process_init() where it calls sctp_stream_init() to alloc stream_in. If it fails to alloc stream_in all stream_out will be freed in sctp_stream_init's err path. Then in the asoc freeing it will crash when dequeuing this data chunk as stream_out is missing. As we can't free stream out before dequeuing all data from send queue, and this patch is to fix it by moving the err path stream_out/in freeing in sctp_stream_init() to sctp_stream_free() which is eventually called when freeing the asoc in sctp_association_free(). This fix also makes the code in sctp_process_init() more clear. Note that in sctp_association_init() when it fails in sctp_stream_init(), sctp_association_free() will not be called, and in that case it should go to 'stream_free' err path to free stream instead of 'fail_init'. Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") Reported-by: Wei Chen Signed-off-by: Xin Long Link: https://lore.kernel.org/r/831a3dc100c4908ff76e5bcc363be97f2778bc0b.16= 58787066.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/sctp/associola.c | 5 ++--- net/sctp/stream.c | 19 +++---------------- 2 files changed, 5 insertions(+), 19 deletions(-) diff --git a/net/sctp/associola.c b/net/sctp/associola.c index be29da09cc7a..3460abceba44 100644 --- a/net/sctp/associola.c +++ b/net/sctp/associola.c @@ -229,9 +229,8 @@ static struct sctp_association *sctp_association_init( if (!sctp_ulpq_init(&asoc->ulpq, asoc)) goto fail_init; =20 - if (sctp_stream_init(&asoc->stream, asoc->c.sinit_num_ostreams, - 0, gfp)) - goto fail_init; + if (sctp_stream_init(&asoc->stream, asoc->c.sinit_num_ostreams, 0, gfp)) + goto stream_free; =20 /* Initialize default path MTU. */ asoc->pathmtu =3D sp->pathmtu; diff --git a/net/sctp/stream.c b/net/sctp/stream.c index 6dc95dcc0ff4..ef9fceadef8d 100644 --- a/net/sctp/stream.c +++ b/net/sctp/stream.c @@ -137,7 +137,7 @@ int sctp_stream_init(struct sctp_stream *stream, __u16 = outcnt, __u16 incnt, =20 ret =3D sctp_stream_alloc_out(stream, outcnt, gfp); if (ret) - goto out_err; + return ret; =20 for (i =3D 0; i < stream->outcnt; i++) SCTP_SO(stream, i)->state =3D SCTP_STREAM_OPEN; @@ -145,22 +145,9 @@ int sctp_stream_init(struct sctp_stream *stream, __u16= outcnt, __u16 incnt, handle_in: sctp_stream_interleave_init(stream); if (!incnt) - goto out; - - ret =3D sctp_stream_alloc_in(stream, incnt, gfp); - if (ret) - goto in_err; - - goto out; + return 0; =20 -in_err: - sched->free(stream); - genradix_free(&stream->in); -out_err: - genradix_free(&stream->out); - stream->outcnt =3D 0; -out: - return ret; + return sctp_stream_alloc_in(stream, incnt, gfp); } =20 int sctp_stream_init_ext(struct sctp_stream *stream, __u16 sid) --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ABE08C19F2A for ; Mon, 1 Aug 2022 12:18:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234576AbiHAMSD (ORCPT ); Mon, 1 Aug 2022 08:18:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38644 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234332AbiHAMQk (ORCPT ); Mon, 1 Aug 2022 08:16:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 12F547E022; Mon, 1 Aug 2022 04:59:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2E0FAB80E8F; Mon, 1 Aug 2022 11:58:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 98ED3C433D6; Mon, 1 Aug 2022 11:58:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355138; bh=501OjYb5HYrJrfCdqJVm4WnrudaBA4TQcWrbApMwIqU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EXtt9CvBA+zBrkgEKMLjFbxo+2efwRy9Q1VPtcJ9apw5U3aRTDZF/xOYsBAhGQNmT D6CJ95CQb9BInoPdY2zTsbPhM/gtXO17s/aBWyOeg+XuC1pT3IjPs+0IFGw+XBzAkj poWqnTnVFIuSmrbMcM7F4mHvd/hjN7J87pc76z58= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dimitris Michailidis , Paolo Abeni , Sasha Levin Subject: [PATCH 5.18 77/88] net/funeth: Fix fun_xdp_tx() and XDP packet reclaim Date: Mon, 1 Aug 2022 13:47:31 +0200 Message-Id: <20220801114141.551590329@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dimitris Michailidis [ Upstream commit 51a83391d77bb0f7ff0aef06ca4c7f5aa9e80b4c ] The current implementation of fun_xdp_tx(), used for XPD_TX, is incorrect in that it takes an address/length pair and later releases it with page_frag_free(). It is OK for XDP_TX but the same code is used by ndo_xdp_xmit. In that case it loses the XDP memory type and releases the packet incorrectly for some of the types. Assorted breakage follows. Change fun_xdp_tx() to take xdp_frame and rely on xdp_return_frame() in reclaim. Fixes: db37bc177dae ("net/funeth: add the data path") Signed-off-by: Dimitris Michailidis Link: https://lore.kernel.org/r/20220726215923.7887-1-dmichail@fungible.com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- .../net/ethernet/fungible/funeth/funeth_rx.c | 5 ++++- .../net/ethernet/fungible/funeth/funeth_tx.c | 20 +++++++++---------- .../ethernet/fungible/funeth/funeth_txrx.h | 6 +++--- 3 files changed, 16 insertions(+), 15 deletions(-) diff --git a/drivers/net/ethernet/fungible/funeth/funeth_rx.c b/drivers/net= /ethernet/fungible/funeth/funeth_rx.c index 0f6a549b9f67..29a6c2ede43a 100644 --- a/drivers/net/ethernet/fungible/funeth/funeth_rx.c +++ b/drivers/net/ethernet/fungible/funeth/funeth_rx.c @@ -142,6 +142,7 @@ static void *fun_run_xdp(struct funeth_rxq *q, skb_frag= _t *frags, void *buf_va, int ref_ok, struct funeth_txq *xdp_q) { struct bpf_prog *xdp_prog; + struct xdp_frame *xdpf; struct xdp_buff xdp; u32 act; =20 @@ -163,7 +164,9 @@ static void *fun_run_xdp(struct funeth_rxq *q, skb_frag= _t *frags, void *buf_va, case XDP_TX: if (unlikely(!ref_ok)) goto pass; - if (!fun_xdp_tx(xdp_q, xdp.data, xdp.data_end - xdp.data)) + + xdpf =3D xdp_convert_buff_to_frame(&xdp); + if (!xdpf || !fun_xdp_tx(xdp_q, xdpf)) goto xdp_error; FUN_QSTAT_INC(q, xdp_tx); q->xdp_flush |=3D FUN_XDP_FLUSH_TX; diff --git a/drivers/net/ethernet/fungible/funeth/funeth_tx.c b/drivers/net= /ethernet/fungible/funeth/funeth_tx.c index ff6e29237253..2f6698b98b03 100644 --- a/drivers/net/ethernet/fungible/funeth/funeth_tx.c +++ b/drivers/net/ethernet/fungible/funeth/funeth_tx.c @@ -466,7 +466,7 @@ static unsigned int fun_xdpq_clean(struct funeth_txq *q= , unsigned int budget) =20 do { fun_xdp_unmap(q, reclaim_idx); - page_frag_free(q->info[reclaim_idx].vaddr); + xdp_return_frame(q->info[reclaim_idx].xdpf); =20 trace_funeth_tx_free(q, reclaim_idx, 1, head); =20 @@ -479,11 +479,11 @@ static unsigned int fun_xdpq_clean(struct funeth_txq = *q, unsigned int budget) return npkts; } =20 -bool fun_xdp_tx(struct funeth_txq *q, void *data, unsigned int len) +bool fun_xdp_tx(struct funeth_txq *q, struct xdp_frame *xdpf) { struct fun_eth_tx_req *req; struct fun_dataop_gl *gle; - unsigned int idx; + unsigned int idx, len; dma_addr_t dma; =20 if (fun_txq_avail(q) < FUN_XDP_CLEAN_THRES) @@ -494,7 +494,8 @@ bool fun_xdp_tx(struct funeth_txq *q, void *data, unsig= ned int len) return false; } =20 - dma =3D dma_map_single(q->dma_dev, data, len, DMA_TO_DEVICE); + len =3D xdpf->len; + dma =3D dma_map_single(q->dma_dev, xdpf->data, len, DMA_TO_DEVICE); if (unlikely(dma_mapping_error(q->dma_dev, dma))) { FUN_QSTAT_INC(q, tx_map_err); return false; @@ -514,7 +515,7 @@ bool fun_xdp_tx(struct funeth_txq *q, void *data, unsig= ned int len) gle =3D (struct fun_dataop_gl *)req->dataop.imm; fun_dataop_gl_init(gle, 0, 0, len, dma); =20 - q->info[idx].vaddr =3D data; + q->info[idx].xdpf =3D xdpf; =20 u64_stats_update_begin(&q->syncp); q->stats.tx_bytes +=3D len; @@ -545,12 +546,9 @@ int fun_xdp_xmit_frames(struct net_device *dev, int n, if (unlikely(q_idx >=3D fp->num_xdpqs)) return -ENXIO; =20 - for (q =3D xdpqs[q_idx], i =3D 0; i < n; i++) { - const struct xdp_frame *xdpf =3D frames[i]; - - if (!fun_xdp_tx(q, xdpf->data, xdpf->len)) + for (q =3D xdpqs[q_idx], i =3D 0; i < n; i++) + if (!fun_xdp_tx(q, frames[i])) break; - } =20 if (unlikely(flags & XDP_XMIT_FLUSH)) fun_txq_wr_db(q); @@ -577,7 +575,7 @@ static void fun_xdpq_purge(struct funeth_txq *q) unsigned int idx =3D q->cons_cnt & q->mask; =20 fun_xdp_unmap(q, idx); - page_frag_free(q->info[idx].vaddr); + xdp_return_frame(q->info[idx].xdpf); q->cons_cnt++; } } diff --git a/drivers/net/ethernet/fungible/funeth/funeth_txrx.h b/drivers/n= et/ethernet/fungible/funeth/funeth_txrx.h index 04c9f91b7489..8708e2895946 100644 --- a/drivers/net/ethernet/fungible/funeth/funeth_txrx.h +++ b/drivers/net/ethernet/fungible/funeth/funeth_txrx.h @@ -95,8 +95,8 @@ struct funeth_txq_stats { /* per Tx queue SW counters */ =20 struct funeth_tx_info { /* per Tx descriptor state */ union { - struct sk_buff *skb; /* associated packet */ - void *vaddr; /* start address for XDP */ + struct sk_buff *skb; /* associated packet (sk_buff path) */ + struct xdp_frame *xdpf; /* associated XDP frame (XDP path) */ }; }; =20 @@ -245,7 +245,7 @@ static inline int fun_irq_node(const struct fun_irq *p) int fun_rxq_napi_poll(struct napi_struct *napi, int budget); int fun_txq_napi_poll(struct napi_struct *napi, int budget); netdev_tx_t fun_start_xmit(struct sk_buff *skb, struct net_device *netdev); -bool fun_xdp_tx(struct funeth_txq *q, void *data, unsigned int len); +bool fun_xdp_tx(struct funeth_txq *q, struct xdp_frame *xdpf); int fun_xdp_xmit_frames(struct net_device *dev, int n, struct xdp_frame **frames, u32 flags); =20 --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 05D77C00144 for ; Mon, 1 Aug 2022 12:18:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234500AbiHAMSH (ORCPT ); Mon, 1 Aug 2022 08:18:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38840 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234450AbiHAMRK (ORCPT ); Mon, 1 Aug 2022 08:17:10 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DCC157E308; Mon, 1 Aug 2022 04:59:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F3C60B81170; Mon, 1 Aug 2022 11:59:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 63FC9C433C1; Mon, 1 Aug 2022 11:59:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355140; bh=MXZi7ngGCR1PaGjCZ9fo8g4JjUSp+/AUMi04FkgXCUg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sEn/FA7iiyurhxl3W0qV9L3s4Ou5GQAtxXPcxCj3MP6flUm5ZP9FjXEDkXVGSi6bf pTY7xaV76RoFWzp0yehAH/tzCJTRZZRqHZbiNFK7G5O2JS52hPR/OS37ZHED81U1T/ uLPOKcFhcMk+OZ66/+6z3n+I3A6CSs57n5twhTH4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.18 78/88] stmmac: dwmac-mediatek: fix resource leak in probe Date: Mon, 1 Aug 2022 13:47:32 +0200 Message-Id: <20220801114141.583663229@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit 4d3d3a1b244fd54629a6b7047f39a7bbc8d11910 ] If mediatek_dwmac_clks_config() fails, then call stmmac_remove_config_dt() before returning. Otherwise it is a resource leak. Fixes: fa4b3ca60e80 ("stmmac: dwmac-mediatek: fix clock issue") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YuJ4aZyMUlG6yGGa@kili Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c b/drivers= /net/ethernet/stmicro/stmmac/dwmac-mediatek.c index ca8ab290013c..d42e1afb6521 100644 --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c @@ -688,18 +688,19 @@ static int mediatek_dwmac_probe(struct platform_devic= e *pdev) =20 ret =3D mediatek_dwmac_clks_config(priv_plat, true); if (ret) - return ret; + goto err_remove_config_dt; =20 ret =3D stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); - if (ret) { - stmmac_remove_config_dt(pdev, plat_dat); + if (ret) goto err_drv_probe; - } =20 return 0; =20 err_drv_probe: mediatek_dwmac_clks_config(priv_plat, false); +err_remove_config_dt: + stmmac_remove_config_dt(pdev, plat_dat); + return ret; } =20 --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 080A8C19F2A for ; Mon, 1 Aug 2022 12:18:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231967AbiHAMST (ORCPT ); Mon, 1 Aug 2022 08:18:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39372 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234199AbiHAMRx (ORCPT ); Mon, 1 Aug 2022 08:17:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA255491E9; Mon, 1 Aug 2022 04:59:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 803D0B81177; Mon, 1 Aug 2022 11:59:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E6EBAC433C1; Mon, 1 Aug 2022 11:59:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355146; bh=c6jwXhG8ZaugPYMKXI6+L6tNkj+voJ6779qrSNNKXZo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oXN+vbrson9Yol4v8NP/0ObQ8kyto5q4ZSVBpUlEI1EKXvhRP9wYqhegSU/G/QZgz xlZcibfz9JI8ErHg/tqYxgDSDRGWLc+gUzq6c1bsMphKNO0KAdpzsXUqNtj4xzEsab HdXJAcOJU2QiLH/FYb1SemZs/SBzQ/2ZG2gBV42U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ralph Campbell , Felix Kuehling , Alistair Popple , Philip Yang , Jason Gunthorpe , Andrew Morton Subject: [PATCH 5.18 79/88] mm/hmm: fault non-owner device private entries Date: Mon, 1 Aug 2022 13:47:33 +0200 Message-Id: <20220801114141.616100115@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ralph Campbell commit 8a295dbbaf7292c582a40ce469c326f472d51f66 upstream. If hmm_range_fault() is called with the HMM_PFN_REQ_FAULT flag and a device private PTE is found, the hmm_range::dev_private_owner page is used to determine if the device private page should not be faulted in. However, if the device private page is not owned by the caller, hmm_range_fault() returns an error instead of calling migrate_to_ram() to fault in the page. For example, if a page is migrated to GPU private memory and a RDMA fault capable NIC tries to read the migrated page, without this patch it will get an error. With this patch, the page will be migrated back to system memory and the NIC will be able to read the data. Link: https://lkml.kernel.org/r/20220727000837.4128709-2-rcampbell@nvidia.c= om Link: https://lkml.kernel.org/r/20220725183615.4118795-2-rcampbell@nvidia.c= om Fixes: 08ddddda667b ("mm/hmm: check the device private page owner in hmm_ra= nge_fault()") Signed-off-by: Ralph Campbell Reported-by: Felix Kuehling Reviewed-by: Alistair Popple Cc: Philip Yang Cc: Jason Gunthorpe Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- mm/hmm.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) --- a/mm/hmm.c +++ b/mm/hmm.c @@ -212,14 +212,6 @@ int hmm_vma_handle_pmd(struct mm_walk *w unsigned long end, unsigned long hmm_pfns[], pmd_t pmd); #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ =20 -static inline bool hmm_is_device_private_entry(struct hmm_range *range, - swp_entry_t entry) -{ - return is_device_private_entry(entry) && - pfn_swap_entry_to_page(entry)->pgmap->owner =3D=3D - range->dev_private_owner; -} - static inline unsigned long pte_to_hmm_pfn_flags(struct hmm_range *range, pte_t pte) { @@ -252,10 +244,12 @@ static int hmm_vma_handle_pte(struct mm_ swp_entry_t entry =3D pte_to_swp_entry(pte); =20 /* - * Never fault in device private pages, but just report - * the PFN even if not present. + * Don't fault in device private pages owned by the caller, + * just report the PFN. */ - if (hmm_is_device_private_entry(range, entry)) { + if (is_device_private_entry(entry) && + pfn_swap_entry_to_page(entry)->pgmap->owner =3D=3D + range->dev_private_owner) { cpu_flags =3D HMM_PFN_VALID; if (is_writable_device_private_entry(entry)) cpu_flags |=3D HMM_PFN_WRITE; @@ -273,6 +267,9 @@ static int hmm_vma_handle_pte(struct mm_ if (!non_swap_entry(entry)) goto fault; =20 + if (is_device_private_entry(entry)) + goto fault; + if (is_device_exclusive_entry(entry)) goto fault; From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E01EDC00144 for ; Mon, 1 Aug 2022 12:18:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234620AbiHAMSY (ORCPT ); Mon, 1 Aug 2022 08:18:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37894 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234563AbiHAMRz (ORCPT ); Mon, 1 Aug 2022 08:17:55 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D056E785B1; Mon, 1 Aug 2022 04:59:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5E949B81163; Mon, 1 Aug 2022 11:59:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 82B42C433C1; Mon, 1 Aug 2022 11:59:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355149; bh=R8xRDyc8IDTC5wOZ0hqq+pKX1t9BRLJ7EvV+0yyX6Ec=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uZuE6Q1wasWUGZRcVG9ZnjQnehOBaU/zlrsfv7WdRINFkW4yN8o2Qtn9DTTSBxuny zanZQfE2UBBqA6k+pGfrfIJUMZK5bxK7Xa7jcErKTtjAmL5tNHA6sMzK5FSBxFNbvb DS1tYRy4q9cCGJgFNQ0dc8L/1vA2eSIh+RJwVNU8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jaewon Kim , GyeongHwan Hong , Mel Gorman , Minchan Kim , Baoquan He , Vlastimil Babka , Johannes Weiner , Michal Hocko , Yong-Taek Lee , stable@vger.kerenl.org, Andrew Morton Subject: [PATCH 5.18 80/88] page_alloc: fix invalid watermark check on a negative value Date: Mon, 1 Aug 2022 13:47:34 +0200 Message-Id: <20220801114141.657732633@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jaewon Kim commit 9282012fc0aa248b77a69f5eb802b67c5a16bb13 upstream. There was a report that a task is waiting at the throttle_direct_reclaim. The pgscan_direct_throttle in vmstat was increasing. This is a bug where zone_watermark_fast returns true even when the free is very low. The commit f27ce0e14088 ("page_alloc: consider highatomic reserve in watermark fast") changed the watermark fast to consider highatomic reserve. But it did not handle a negative value case which can be happened when reserved_highatomic pageblock is bigger than the actual free. If watermark is considered as ok for the negative value, allocating contexts for order-0 will consume all free pages without direct reclaim, and finally free page may become depleted except highatomic free. Then allocating contexts may fall into throttle_direct_reclaim. This symptom may easily happen in a system where wmark min is low and other reclaimers like kswapd does not make free pages quickly. Handle the negative case by using MIN. Link: https://lkml.kernel.org/r/20220725095212.25388-1-jaewon31.kim@samsung= .com Fixes: f27ce0e14088 ("page_alloc: consider highatomic reserve in watermark = fast") Signed-off-by: Jaewon Kim Reported-by: GyeongHwan Hong Acked-by: Mel Gorman Cc: Minchan Kim Cc: Baoquan He Cc: Vlastimil Babka Cc: Johannes Weiner Cc: Michal Hocko Cc: Yong-Taek Lee Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- mm/page_alloc.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -3953,11 +3953,15 @@ static inline bool zone_watermark_fast(s * need to be calculated. */ if (!order) { - long fast_free; + long usable_free; + long reserved; =20 - fast_free =3D free_pages; - fast_free -=3D __zone_watermark_unusable_free(z, 0, alloc_flags); - if (fast_free > mark + z->lowmem_reserve[highest_zoneidx]) + usable_free =3D free_pages; + reserved =3D __zone_watermark_unusable_free(z, 0, alloc_flags); + + /* reserved may over estimate high-atomic reserves. */ + usable_free -=3D min(usable_free, reserved); + if (usable_free > mark + z->lowmem_reserve[highest_zoneidx]) return true; } From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CBB10C00144 for ; Mon, 1 Aug 2022 12:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234629AbiHAMS3 (ORCPT ); Mon, 1 Aug 2022 08:18:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234351AbiHAMR5 (ORCPT ); Mon, 1 Aug 2022 08:17:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 297E97F51D; Mon, 1 Aug 2022 04:59:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 43A916010C; Mon, 1 Aug 2022 11:59:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 530D7C433C1; Mon, 1 Aug 2022 11:59:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355151; bh=o0GoZC8jqwAki4OA/myQhdnHoWr7JPzkZQ93pZ7RDjE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=llgvTUmeWUJdXjx6NUuikzZluxESnvVQDPwDuFKfnT8g/xx8OWxQLNH9kT2R0a5st pijhaeedT+cvaGJrF1GbtSp4DOgnEY2Ec+8n3XtjENfGDI3SshV0K2dK1aWBSJk3lC rBxM+xVcX0GhgbAPywYKCHlOnJezglXK5tk3Ri3g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 5.18 81/88] tcp: Fix data-races around sysctl_tcp_workaround_signed_windows. Date: Mon, 1 Aug 2022 13:47:35 +0200 Message-Id: <20220801114141.695725172@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 0f1e4d06591d0a7907c71f7b6d1c79f8a4de8098 ] While reading sysctl_tcp_workaround_signed_windows, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 15d99e02baba ("[TCP]: sysctl to allow TCP window > 32767 sans wscale= ") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/tcp_output.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 66836b8bd46f..a7f0a1f0c2a3 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -227,7 +227,7 @@ void tcp_select_initial_window(const struct sock *sk, i= nt __space, __u32 mss, * which we interpret as a sign the remote TCP is not * misinterpreting the window field as a signed quantity. */ - if (sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows) + if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows)) (*rcv_wnd) =3D min(space, MAX_TCP_WINDOW); else (*rcv_wnd) =3D min_t(u32, space, U16_MAX); @@ -282,7 +282,7 @@ static u16 tcp_select_window(struct sock *sk) * scaled window. */ if (!tp->rx_opt.rcv_wscale && - sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows) + READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows)) new_win =3D min(new_win, MAX_TCP_WINDOW); else new_win =3D min(new_win, (65535U << tp->rx_opt.rcv_wscale)); --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18444C00144 for ; Mon, 1 Aug 2022 12:18:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234649AbiHAMSr (ORCPT ); Mon, 1 Aug 2022 08:18:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38978 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234586AbiHAMSI (ORCPT ); Mon, 1 Aug 2022 08:18:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 25D8D49B5F; Mon, 1 Aug 2022 04:59:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DE1E7601C5; Mon, 1 Aug 2022 11:59:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ECAFAC433C1; Mon, 1 Aug 2022 11:59:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355154; bh=Kr1Yx27AWLh+1gvT8gaFpSOhnROqSVu0uXH2DRg+H2g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Do9arLBY+JWYTpX3rV3riVQc8B4YmT/P7Jcpd3qt2wYoGmbYLgJ0dz8PboAHEksJ3 ShVofVkMRczbF6iYm4U84Ox15cWQ238asHFo1FUNeC19EP2KVUg9TjGUEVBcSef0+4 7uN8SYxvP3rKv0AyD2zyZrEqifs+zo2i9cHJ/Jy4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Florian Fainelli , Linus Walleij , "Russell King (Oracle)" , Sasha Levin Subject: [PATCH 5.18 82/88] ARM: 9216/1: Fix MAX_DMA_ADDRESS overflow Date: Mon, 1 Aug 2022 13:47:36 +0200 Message-Id: <20220801114141.740058208@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Fainelli [ Upstream commit fb0fd3469ead5b937293c213daa1f589b4b7ce46 ] Commit 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis") added a check to determine whether arm_dma_zone_size is exceeding the amount of kernel virtual address space available between the upper 4GB virtual address limit and PAGE_OFFSET in order to provide a suitable definition of MAX_DMA_ADDRESS that should fit within the 32-bit virtual address space. The quantity used for comparison was off by a missing trailing 0, leading to MAX_DMA_ADDRESS to be overflowing a 32-bit quantity. This was caught thanks to CONFIG_DEBUG_VIRTUAL on the bcm2711 platform where we define a dma_zone_size of 1GB and we have a PAGE_OFFSET value of 0xc000_0000 (CONFIG_VMSPLIT_3G) leading to MAX_DMA_ADDRESS being 0x1_0000_0000 which overflows the unsigned long type used throughout __pa() and then __virt_addr_valid(). Because the virtual address passed to __virt_addr_valid() would now be 0, the function would loudly warn and flood the kernel log, thus making the platform unable to boot properly. Fixes: 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis") Signed-off-by: Florian Fainelli Reviewed-by: Linus Walleij Signed-off-by: Russell King (Oracle) Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- arch/arm/include/asm/dma.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/include/asm/dma.h b/arch/arm/include/asm/dma.h index a81dda65c576..45180a2cc47c 100644 --- a/arch/arm/include/asm/dma.h +++ b/arch/arm/include/asm/dma.h @@ -10,7 +10,7 @@ #else #define MAX_DMA_ADDRESS ({ \ extern phys_addr_t arm_dma_zone_size; \ - arm_dma_zone_size && arm_dma_zone_size < (0x10000000 - PAGE_OFFSET) ? \ + arm_dma_zone_size && arm_dma_zone_size < (0x100000000ULL - PAGE_OFFSET) ?= \ (PAGE_OFFSET + arm_dma_zone_size) : 0xffffffffUL; }) #endif =20 --=20 2.35.1 From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26CCDC19F2A for ; Mon, 1 Aug 2022 12:19:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233921AbiHAMTB (ORCPT ); Mon, 1 Aug 2022 08:19:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40070 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233603AbiHAMSM (ORCPT ); Mon, 1 Aug 2022 08:18:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3A74880481; Mon, 1 Aug 2022 04:59:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 56CABB81163; Mon, 1 Aug 2022 11:59:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A5D59C433D7; Mon, 1 Aug 2022 11:59:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355157; bh=VA2wohoCImHpJ67x4JVTxx0JPiyhyzHT+u6woSJvBRU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=M0/ifsvpurZvTQ4MKgHipIaEIR6k+WjSEGcWhyeMuli5cOBUfIcvuA2GCZK5lmsV6 XNuPd/fygcADVNUe2yvdt11XHGnNNo9MdF0iJPjlV5FHCvhjBl+Ibx0zOnthObA/x1 wGLIpMjl82aQ5cmFwxVsmsvKmEtVV/+X8eGwN/GA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert Richter , Toshi Kani , Borislav Petkov , Robert Elliott Subject: [PATCH 5.18 83/88] EDAC/ghes: Set the DIMM label unconditionally Date: Mon, 1 Aug 2022 13:47:37 +0200 Message-Id: <20220801114141.775276721@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Toshi Kani commit 5e2805d5379619c4a2e3ae4994e73b36439f4bad upstream. The commit cb51a371d08e ("EDAC/ghes: Setup DIMM label from DMI and use it in error r= eports") enforced that both the bank and device strings passed to dimm_setup_label() are not NULL. However, there are BIOSes, for example on a HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 03/15/2019 which don't populate both strings: Handle 0x0020, DMI type 17, 84 bytes Memory Device Array Handle: 0x0013 Error Information Handle: Not Provided Total Width: 72 bits Data Width: 64 bits Size: 32 GB Form Factor: DIMM Set: None Locator: PROC 1 DIMM 1 <=3D=3D=3D=3D=3D device Bank Locator: Not Specified <=3D=3D=3D=3D=3D bank This results in a buffer overflow because ghes_edac_register() calls strlen() on an uninitialized label, which had non-zero values left over from krealloc_array(): detected buffer overflow in __fortify_strlen ------------[ cut here ]------------ kernel BUG at lib/string_helpers.c:983! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 1 Comm: swapper/0 Tainted: G I 5.18.6-200.fc3= 6.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 0= 3/15/2019 RIP: 0010:fortify_panic ... Call Trace: ghes_edac_register.cold ghes_probe platform_probe really_probe __driver_probe_device driver_probe_device __driver_attach ? __device_attach_driver bus_for_each_dev bus_add_driver driver_register acpi_ghes_init acpi_init ? acpi_sleep_proc_init do_one_initcall The label contains garbage because the commit in Fixes reallocs the DIMMs array while scanning the system but doesn't clear the newly allocated memory. Change dimm_setup_label() to always initialize the label to fix the issue. Set it to the empty string in case BIOS does not provide both bank and device so that ghes_edac_register() can keep the default label given by edac_mc_alloc_dimms(). [ bp: Rewrite commit message. ] Fixes: b9cae27728d1f ("EDAC/ghes: Scan the system once on driver init") Co-developed-by: Robert Richter Signed-off-by: Robert Richter Signed-off-by: Toshi Kani Signed-off-by: Borislav Petkov Tested-by: Robert Elliott Cc: Link: https://lore.kernel.org/r/20220719220124.760359-1-toshi.kani@hpe.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/edac/ghes_edac.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/drivers/edac/ghes_edac.c +++ b/drivers/edac/ghes_edac.c @@ -101,9 +101,14 @@ static void dimm_setup_label(struct dimm =20 dmi_memdev_name(handle, &bank, &device); =20 - /* both strings must be non-zero */ - if (bank && *bank && device && *device) - snprintf(dimm->label, sizeof(dimm->label), "%s %s", bank, device); + /* + * Set to a NULL string when both bank and device are zero. In this case, + * the label assigned by default will be preserved. + */ + snprintf(dimm->label, sizeof(dimm->label), "%s%s%s", + (bank && *bank) ? bank : "", + (bank && *bank && device && *device) ? " " : "", + (device && *device) ? device : ""); } =20 static void assign_dmi_dimm_info(struct dimm_info *dimm, struct memdev_dmi= _entry *entry) From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A0E36C00144 for ; Mon, 1 Aug 2022 12:19:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231338AbiHAMTI (ORCPT ); Mon, 1 Aug 2022 08:19:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42948 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234565AbiHAMSR (ORCPT ); Mon, 1 Aug 2022 08:18:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 032D480502; Mon, 1 Aug 2022 04:59:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 198ADB810A2; Mon, 1 Aug 2022 11:59:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 65E03C433D6; Mon, 1 Aug 2022 11:59:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355159; bh=U7Gjw68LxF8KrPCKHrykEfbkZFh9sS2yKVRqOmdJIQE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JMQn8sA/RtUFTS5HKuogyj0HcbwuVRwlfXcq9qpyR+xFYNedvCu9P4tWrVhx0A6U5 onVinmldfn6ktoEt766u8caHvoQavcxbdZAlFdHbYLSmRxTsXyXdda+3Fq5xquhy9J JMcsSJ8cDJKdhsaFtq/HFm4sYJ5quJms/nk+YutY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sherry Sun , Borislav Petkov , Shubhrajyoti Datta , Michal Simek Subject: [PATCH 5.18 84/88] EDAC/synopsys: Use the correct register to disable the error interrupt on v3 hw Date: Mon, 1 Aug 2022 13:47:38 +0200 Message-Id: <20220801114141.823982430@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sherry Sun commit be76ceaf03bc04e74be5e28f608316b73c2b04ad upstream. v3.x Synopsys EDAC DDR doesn't have the QOS Interrupt register. Use the ECC Clear Register to disable the error interrupts instead. Fixes: f7824ded4149 ("EDAC/synopsys: Add support for version 3 of the Synop= sys EDAC DDR") Signed-off-by: Sherry Sun Signed-off-by: Borislav Petkov Reviewed-by: Shubhrajyoti Datta Acked-by: Michal Simek Cc: Link: https://lore.kernel.org/r/20220427015137.8406-2-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/edac/synopsys_edac.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/drivers/edac/synopsys_edac.c +++ b/drivers/edac/synopsys_edac.c @@ -865,8 +865,11 @@ static void enable_intr(struct synps_eda static void disable_intr(struct synps_edac_priv *priv) { /* Disable UE/CE Interrupts */ - writel(DDR_QOSUE_MASK | DDR_QOSCE_MASK, - priv->baseaddr + DDR_QOS_IRQ_DB_OFST); + if (priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR) + writel(0x0, priv->baseaddr + ECC_CLR_OFST); + else + writel(DDR_QOSUE_MASK | DDR_QOSCE_MASK, + priv->baseaddr + DDR_QOS_IRQ_DB_OFST); } =20 static int setup_irq(struct mem_ctl_info *mci, From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60236C00144 for ; Mon, 1 Aug 2022 12:19:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234389AbiHAMTN (ORCPT ); Mon, 1 Aug 2022 08:19:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38592 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234617AbiHAMSX (ORCPT ); Mon, 1 Aug 2022 08:18:23 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0C4ED80514; Mon, 1 Aug 2022 04:59:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 19000601BF; Mon, 1 Aug 2022 11:59:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2288DC433D6; Mon, 1 Aug 2022 11:59:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355162; bh=wxbH+q2Pobfj5UXnhBSG3TNyWcwBbthQ+A8yPvgXBGc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L2K1O2AMTyK1hV8GQCNL6AGqMmlswWHb8ip2x/VWPm/8uD0pK85JFf6vsgyUcEeVE 2CcXPOvJY75wH5fwnNFxQ37oSZDAe9V4SsDpov2CYG9F5nQWRGED4o3bapOicyuavT KbdcQOm0e5TBpsMdoL8+vj72kb6Z3LpaZlpskGfo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sherry Sun , Borislav Petkov , Shubhrajyoti Datta , Michal Simek Subject: [PATCH 5.18 85/88] EDAC/synopsys: Re-enable the error interrupts on v3 hw Date: Mon, 1 Aug 2022 13:47:39 +0200 Message-Id: <20220801114141.858015802@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sherry Sun commit 4bcffe941758ee17becb43af3b25487f848f6512 upstream. zynqmp_get_error_info() writes 0 to the ECC_CLR_OFST register after an interrupt for a {un-,}correctable error is raised, which disables the error interrupts. Then the interrupt handler will be called only once. Therefore, re-enable the error interrupt line at the end of intr_handler() for v3.x Synopsys EDAC DDR. Fixes: f7824ded4149 ("EDAC/synopsys: Add support for version 3 of the Synop= sys EDAC DDR") Signed-off-by: Sherry Sun Signed-off-by: Borislav Petkov Reviewed-by: Shubhrajyoti Datta Acked-by: Michal Simek Cc: Link: https://lore.kernel.org/r/20220427015137.8406-3-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/edac/synopsys_edac.c | 47 ++++++++++++++++++++++----------------= ----- 1 file changed, 25 insertions(+), 22 deletions(-) --- a/drivers/edac/synopsys_edac.c +++ b/drivers/edac/synopsys_edac.c @@ -527,6 +527,28 @@ static void handle_error(struct mem_ctl_ memset(p, 0, sizeof(*p)); } =20 +static void enable_intr(struct synps_edac_priv *priv) +{ + /* Enable UE/CE Interrupts */ + if (priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR) + writel(DDR_UE_MASK | DDR_CE_MASK, + priv->baseaddr + ECC_CLR_OFST); + else + writel(DDR_QOSUE_MASK | DDR_QOSCE_MASK, + priv->baseaddr + DDR_QOS_IRQ_EN_OFST); + +} + +static void disable_intr(struct synps_edac_priv *priv) +{ + /* Disable UE/CE Interrupts */ + if (priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR) + writel(0x0, priv->baseaddr + ECC_CLR_OFST); + else + writel(DDR_QOSUE_MASK | DDR_QOSCE_MASK, + priv->baseaddr + DDR_QOS_IRQ_DB_OFST); +} + /** * intr_handler - Interrupt Handler for ECC interrupts. * @irq: IRQ number. @@ -568,6 +590,9 @@ static irqreturn_t intr_handler(int irq, /* v3.0 of the controller does not have this register */ if (!(priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR)) writel(regval, priv->baseaddr + DDR_QOS_IRQ_STAT_OFST); + else + enable_intr(priv); + return IRQ_HANDLED; } =20 @@ -850,28 +875,6 @@ static void mc_init(struct mem_ctl_info init_csrows(mci); } =20 -static void enable_intr(struct synps_edac_priv *priv) -{ - /* Enable UE/CE Interrupts */ - if (priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR) - writel(DDR_UE_MASK | DDR_CE_MASK, - priv->baseaddr + ECC_CLR_OFST); - else - writel(DDR_QOSUE_MASK | DDR_QOSCE_MASK, - priv->baseaddr + DDR_QOS_IRQ_EN_OFST); - -} - -static void disable_intr(struct synps_edac_priv *priv) -{ - /* Disable UE/CE Interrupts */ - if (priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR) - writel(0x0, priv->baseaddr + ECC_CLR_OFST); - else - writel(DDR_QOSUE_MASK | DDR_QOSCE_MASK, - priv->baseaddr + DDR_QOS_IRQ_DB_OFST); -} - static int setup_irq(struct mem_ctl_info *mci, struct platform_device *pdev) { From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BAC21C00144 for ; Mon, 1 Aug 2022 12:19:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231263AbiHAMT2 (ORCPT ); Mon, 1 Aug 2022 08:19:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38984 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234585AbiHAMSp (ORCPT ); Mon, 1 Aug 2022 08:18:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 491CC80F49; Mon, 1 Aug 2022 04:59:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 04378601CD; Mon, 1 Aug 2022 11:59:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 07E96C433C1; Mon, 1 Aug 2022 11:59:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355165; bh=s6/Q8Al62DMo2y50v8o5Znuj8DH9PcBFebnUBPhX7EU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=taIk3IZk4U63SyPDoxROuRIJzY1QKIcIjty8Fl8yeeuS64YZwzXghr7U0e1AOtTJW GkXLzaPbdgnUchnjwN18f9LuSjI7LKT8y6Uu6kpgS8/GbmrWWOMvrobfN6Rf6p3ptS JUM0fOsjQKfLLSaNARXPHgsrKHK3xHl3GZGDlVK4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eiichi Tsukata , Borislav Petkov , corbet@lwn.net Subject: [PATCH 5.18 86/88] docs/kernel-parameters: Update descriptions for "mitigations=" param with retbleed Date: Mon, 1 Aug 2022 13:47:40 +0200 Message-Id: <20220801114141.904693588@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eiichi Tsukata commit ea304a8b89fd0d6cf94ee30cb139dc23d9f1a62f upstream. Updates descriptions for "mitigations=3Doff" and "mitigations=3Dauto,nosmt" with the respective retbleed=3D settings. Signed-off-by: Eiichi Tsukata Signed-off-by: Borislav Petkov Cc: corbet@lwn.net Link: https://lore.kernel.org/r/20220728043907.165688-1-eiichi.tsukata@nuta= nix.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- Documentation/admin-guide/kernel-parameters.txt | 2 ++ 1 file changed, 2 insertions(+) --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -3106,6 +3106,7 @@ no_entry_flush [PPC] no_uaccess_flush [PPC] mmio_stale_data=3Doff [X86] + retbleed=3Doff [X86] =20 Exceptions: This does not have any effect on @@ -3128,6 +3129,7 @@ mds=3Dfull,nosmt [X86] tsx_async_abort=3Dfull,nosmt [X86] mmio_stale_data=3Dfull,nosmt [X86] + retbleed=3Dauto,nosmt [X86] =20 mminit_loglevel=3D [KNL] When CONFIG_DEBUG_MEMORY_INIT is set, this From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4D38C3F6B0 for ; Mon, 1 Aug 2022 12:19:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231340AbiHAMTh (ORCPT ); Mon, 1 Aug 2022 08:19:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40220 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234555AbiHAMTA (ORCPT ); Mon, 1 Aug 2022 08:19:00 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E3DDB41D15; Mon, 1 Aug 2022 04:59:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id DE078CE13BB; Mon, 1 Aug 2022 11:59:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B723BC433C1; Mon, 1 Aug 2022 11:59:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355168; bh=XxqsD3U98yw1lQ/BwBmwPGQr8/vBQvrLbn9UdZ7K0EM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aDxKbnPfv4BOevoR+fLZOKD4tki4X15zWvSMsK4XMWwHCY97evuyFj36L0U75R6w1 toYazf0DmU7GhXO27DxvjLNaXEwXSb86WpJyR2wtBLITXjlxoK/EWBbukbjKEhUE6t Msd0MbnKKEO8ygJuISo9NFdLi+QdDPTglc1RFQUY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Waiman Long , "Peter Zijlstra (Intel)" , John Donnelly , Mel Gorman Subject: [PATCH 5.18 87/88] locking/rwsem: Allow slowpath writer to ignore handoff bit if not set by first waiter Date: Mon, 1 Aug 2022 13:47:41 +0200 Message-Id: <20220801114141.946225686@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Waiman Long commit 6eebd5fb20838f5971ba17df9f55cc4f84a31053 upstream. With commit d257cc8cb8d5 ("locking/rwsem: Make handoff bit handling more consistent"), the writer that sets the handoff bit can be interrupted out without clearing the bit if the wait queue isn't empty. This disables reader and writer optimistic lock spinning and stealing. Now if a non-first writer in the queue is somehow woken up or a new waiter enters the slowpath, it can't acquire the lock. This is not the case before commit d257cc8cb8d5 as the writer that set the handoff bit will clear it when exiting out via the out_nolock path. This is less efficient as the busy rwsem stays in an unlock state for a longer time. In some cases, this new behavior may cause lockups as shown in [1] and [2]. This patch allows a non-first writer to ignore the handoff bit if it is not originally set or initiated by the first waiter. This patch is shown to be effective in fixing the lockup problem reported in [1]. [1] https://lore.kernel.org/lkml/20220617134325.GC30825@techsingularity.net/ [2] https://lore.kernel.org/lkml/3f02975c-1a9d-be20-32cf-f1d8e3dfafcc@oracl= e.com/ Fixes: d257cc8cb8d5 ("locking/rwsem: Make handoff bit handling more consist= ent") Signed-off-by: Waiman Long Signed-off-by: Peter Zijlstra (Intel) Acked-by: John Donnelly Tested-by: Mel Gorman Link: https://lore.kernel.org/r/20220622200419.778799-1-longman@redhat.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- kernel/locking/rwsem.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) --- a/kernel/locking/rwsem.c +++ b/kernel/locking/rwsem.c @@ -334,8 +334,6 @@ struct rwsem_waiter { struct task_struct *task; enum rwsem_waiter_type type; unsigned long timeout; - - /* Writer only, not initialized in reader */ bool handoff_set; }; #define rwsem_first_waiter(sem) \ @@ -455,10 +453,12 @@ static void rwsem_mark_wake(struct rw_se * to give up the lock), request a HANDOFF to * force the issue. */ - if (!(oldcount & RWSEM_FLAG_HANDOFF) && - time_after(jiffies, waiter->timeout)) { - adjustment -=3D RWSEM_FLAG_HANDOFF; - lockevent_inc(rwsem_rlock_handoff); + if (time_after(jiffies, waiter->timeout)) { + if (!(oldcount & RWSEM_FLAG_HANDOFF)) { + adjustment -=3D RWSEM_FLAG_HANDOFF; + lockevent_inc(rwsem_rlock_handoff); + } + waiter->handoff_set =3D true; } =20 atomic_long_add(-adjustment, &sem->count); @@ -568,7 +568,7 @@ static void rwsem_mark_wake(struct rw_se static inline bool rwsem_try_write_lock(struct rw_semaphore *sem, struct rwsem_waiter *waiter) { - bool first =3D rwsem_first_waiter(sem) =3D=3D waiter; + struct rwsem_waiter *first =3D rwsem_first_waiter(sem); long count, new; =20 lockdep_assert_held(&sem->wait_lock); @@ -578,11 +578,20 @@ static inline bool rwsem_try_write_lock( bool has_handoff =3D !!(count & RWSEM_FLAG_HANDOFF); =20 if (has_handoff) { - if (!first) + /* + * Honor handoff bit and yield only when the first + * waiter is the one that set it. Otherwisee, we + * still try to acquire the rwsem. + */ + if (first->handoff_set && (waiter !=3D first)) return false; =20 - /* First waiter inherits a previously set handoff bit */ - waiter->handoff_set =3D true; + /* + * First waiter can inherit a previously set handoff + * bit and spin on rwsem if lock acquisition fails. + */ + if (waiter =3D=3D first) + waiter->handoff_set =3D true; } =20 new =3D count; @@ -972,6 +981,7 @@ queue: waiter.task =3D current; waiter.type =3D RWSEM_WAITING_FOR_READ; waiter.timeout =3D jiffies + RWSEM_WAIT_TIMEOUT; + waiter.handoff_set =3D false; =20 raw_spin_lock_irq(&sem->wait_lock); if (list_empty(&sem->wait_list)) { From nobody Fri Dec 19 20:11:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34187C19F2C for ; Mon, 1 Aug 2022 12:19:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234691AbiHAMTl (ORCPT ); Mon, 1 Aug 2022 08:19:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40144 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234604AbiHAMTA (ORCPT ); Mon, 1 Aug 2022 08:19:00 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A438B4A82C; Mon, 1 Aug 2022 04:59:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3DA70B810A2; Mon, 1 Aug 2022 11:59:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 930BDC433D6; Mon, 1 Aug 2022 11:59:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1659355171; bh=R4r38YJ5Dy31el24nkUxBsEoOBTpXjcjl5kVMXZYn0Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PWCzp5vFDeCGelMTAdmOVR4SV3OrmOD1YBqkFMVp791nZ2NshTjGEpCyoBs3r5H6f zznUlb2sGu1L2eT6gFGNgeGBjfEKXjjWoj+b3wVo0hBgoDMWfLgc7Ll3kiGt2Bbiqb Q0dvUMHiGSW+elG/9FiohZjH3+CSYkkqK/x0MrKw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dimitri John Ledkov , Thadeu Lima de Souza Cascardo , Borislav Petkov Subject: [PATCH 5.18 88/88] x86/bugs: Do not enable IBPB at firmware entry when IBPB is not available Date: Mon, 1 Aug 2022 13:47:42 +0200 Message-Id: <20220801114141.991746492@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220801114138.041018499@linuxfoundation.org> References: <20220801114138.041018499@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thadeu Lima de Souza Cascardo commit 571c30b1a88465a1c85a6f7762609939b9085a15 upstream. Some cloud hypervisors do not provide IBPB on very recent CPU processors, including AMD processors affected by Retbleed. Using IBPB before firmware calls on such systems would cause a GPF at boot like the one below. Do not enable such calls when IBPB support is not present. EFI Variables Facility v0.08 2004-May-17 general protection fault, maybe for address 0x1: 0000 [#1] PREEMPT SMP NO= PTI CPU: 0 PID: 24 Comm: kworker/u2:1 Not tainted 5.19.0-rc8+ #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2= 015 Workqueue: efi_rts_wq efi_call_rts RIP: 0010:efi_call_rts Code: e8 37 33 58 ff 41 bf 48 00 00 00 49 89 c0 44 89 f9 48 83 c8 01 4c 8= 9 c2 48 c1 ea 20 66 90 b9 49 00 00 00 b8 01 00 00 00 31 d2 <0f> 30 e8 7b 9f= 5d ff e8 f6 f8 ff ff 4c 89 f1 4c 89 ea 4c 89 e6 48 RSP: 0018:ffffb373800d7e38 EFLAGS: 00010246 RAX: 0000000000000001 RBX: 0000000000000006 RCX: 0000000000000049 RDX: 0000000000000000 RSI: ffff94fbc19d8fe0 RDI: ffff94fbc1b2b300 RBP: ffffb373800d7e70 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000000b R11: 000000000000000b R12: ffffb3738001fd78 R13: ffff94fbc2fcfc00 R14: ffffb3738001fd80 R15: 0000000000000048 FS: 0000000000000000(0000) GS:ffff94fc3da00000(0000) knlGS:0000000000000= 000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff94fc30201000 CR3: 000000006f610000 CR4: 00000000000406f0 Call Trace: ? __wake_up process_one_work worker_thread ? rescuer_thread kthread ? kthread_complete_and_exit ret_from_fork Modules linked in: Fixes: 28a99e95f55c ("x86/amd: Use IBPB for firmware calls") Reported-by: Dimitri John Ledkov Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Borislav Petkov Cc: Link: https://lore.kernel.org/r/20220728122602.2500509-1-cascardo@canonical= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Tested-by: Ron Economos Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- arch/x86/kernel/cpu/bugs.c | 1 + 1 file changed, 1 insertion(+) --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -1513,6 +1513,7 @@ static void __init spectre_v2_select_mit * enable IBRS around firmware calls. */ if (boot_cpu_has_bug(X86_BUG_RETBLEED) && + boot_cpu_has(X86_FEATURE_IBPB) && (boot_cpu_data.x86_vendor =3D=3D X86_VENDOR_AMD || boot_cpu_data.x86_vendor =3D=3D X86_VENDOR_HYGON)) {