* [PATCH 5.10 00/68] 5.10.191-rc1 review
@ 2023-08-13 21:19 Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 01/68] wireguard: allowedips: expand maximum node depth Greg Kroah-Hartman
` (76 more replies)
0 siblings, 77 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
This is the start of the stable review cycle for the 5.10.191 release.
There are 68 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.191-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 5.10.191-rc1
Eric Dumazet <edumazet@google.com>
sch_netem: fix issues in netem_change() vs get_dist_table()
Masahiro Yamada <masahiroy@kernel.org>
alpha: remove __init annotation from exported page_is_ram()
Nilesh Javali <njavali@marvell.com>
scsi: qedf: Fix firmware halt over suspend and resume
Nilesh Javali <njavali@marvell.com>
scsi: qedi: Fix firmware halt over suspend and resume
Zhu Wang <wangzhu9@huawei.com>
scsi: core: Fix possible memory leak if device_add() fails
Zhu Wang <wangzhu9@huawei.com>
scsi: snic: Fix possible memory leak if device_add() fails
Alexandra Diupina <adiupina@astralinux.ru>
scsi: 53c700: Check that command slot is not NULL
Michael Kelley <mikelley@microsoft.com>
scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
Tony Battersby <tonyb@cybernetics.com>
scsi: core: Fix legacy /proc parsing buffer overflow
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: report use refcount overflow
Ming Lei <ming.lei@redhat.com>
nvme-rdma: fix potential unbalanced freeze & unfreeze
Ming Lei <ming.lei@redhat.com>
nvme-tcp: fix potential unbalanced freeze & unfreeze
Josef Bacik <josef@toxicpanda.com>
btrfs: set cache_block_group_error if we find an error
Christoph Hellwig <hch@lst.de>
btrfs: don't stop integrity writeback too early
Nick Child <nnac123@linux.ibm.com>
ibmvnic: Handle DMA unmapping of login buffs in release functions
Nick Child <nnac123@linux.ibm.com>
ibmvnic: Unmap DMA login rsp buffer on send login fail
Nick Child <nnac123@linux.ibm.com>
ibmvnic: Enforce stronger sanity checks on login response
Daniel Jurgens <danielj@nvidia.com>
net/mlx5: Allow 0 for total host VFs
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
dmaengine: mcf-edma: Fix a potential un-allocated memory access
Jie Wang <wangjie125@huawei.com>
net: hns3: add wait until mac link down
Jie Wang <wangjie125@huawei.com>
net: hns3: refactor hclge_mac_link_status_wait for interface reuse
Li Yang <leoyang.li@nxp.com>
net: phy: at803x: remove set/get wol callbacks for AR8032
Felix Fietkau <nbd@nbd.name>
wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
Douglas Miller <doug.miller@cornelisnetworks.com>
IB/hfi1: Fix possible panic during hotplug remove
Andrew Kanner <andrew.kanner@gmail.com>
drivers: net: prevent tun_build_skb() to exceed the packet size limit
Eric Dumazet <edumazet@google.com>
dccp: fix data-race around dp->dccps_mss_cache
Ziyang Xuan <william.xuanziyang@huawei.com>
bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
Florian Westphal <fw@strlen.de>
tunnels: fix kasan splat when generating ipv4 pmtu error
Eric Dumazet <edumazet@google.com>
net/packet: annotate data-races around tp->status
Nathan Chancellor <nathan@kernel.org>
mISDN: Update parameter type of dsp_cmx_send()
Ido Schimmel <idosch@nvidia.com>
selftests: forwarding: tc_flower: Relax success criterion
Ido Schimmel <idosch@nvidia.com>
selftests: forwarding: Switch off timeout
Ido Schimmel <idosch@nvidia.com>
selftests: forwarding: Skip test when no interfaces are specified
Ido Schimmel <idosch@nvidia.com>
selftests: forwarding: ethtool_extended_state: Skip when using veth pairs
Ido Schimmel <idosch@nvidia.com>
selftests: forwarding: ethtool: Skip when using veth pairs
Ido Schimmel <idosch@nvidia.com>
selftests: forwarding: Add a helper to skip test when using veth pairs
Mark Brown <broonie@kernel.org>
selftests/rseq: Fix build with undefined __weak
Florian Westphal <fw@strlen.de>
netfilter: nf_tables: don't skip expired elements during walk
Karol Herbst <kherbst@redhat.com>
drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
Arnd Bergmann <arnd@arndb.de>
x86: Move gds_ucode_mitigated() declaration to header
Arnd Bergmann <arnd@arndb.de>
x86/speculation: Add cpu_show_gds() prototype
Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
Nick Desaulniers <ndesaulniers@google.com>
x86/srso: Fix build breakage with the LLVM linker
Prashanth K <quic_prashk@quicinc.com>
usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
Elson Roy Serrao <quic_eserrao@quicinc.com>
usb: dwc3: Properly handle processing of pending events
Alan Stern <stern@rowland.harvard.edu>
usb-storage: alauda: Fix uninit-value in alauda_check_media()
Qi Zheng <zhengqi.arch@bytedance.com>
binder: fix memory leak in binder_init()
Yiyuan Guo <yguoaz@gmail.com>
iio: cros_ec: Fix the allocation size for cros_ec_command
Aleksa Sarai <cyphar@cyphar.com>
io_uring: correct check for O_TMPFILE
Ryusuke Konishi <konishi.ryusuke@gmail.com>
nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
Thomas Gleixner <tglx@linutronix.de>
x86/pkeys: Revert a5eff7259790 ("x86/pkeys: Add PKRU value to init_fpstate")
Colin Ian King <colin.i.king@gmail.com>
radix tree test suite: fix incorrect allocation size for pthreads
Tao Ren <rentao.bupt@gmail.com>
hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100
Melissa Wen <mwen@igalia.com>
drm/amd/display: check attr flag before set cursor degamma on DCN3+
Boris Brezillon <boris.brezillon@collabora.com>
drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()
Karol Herbst <kherbst@redhat.com>
drm/nouveau/gr: enable memory loads on helper invocation on all channels
Andrea Parri <parri.andrea@gmail.com>
riscv,mmio: Fix readX()-to-delay() ordering
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
dmaengine: pl330: Return DMA_PAUSED when transaction is paused
Ilya Leoshkevich <iii@linux.ibm.com>
selftests/bpf: Fix sk_assign on s390x
Yonghong Song <yhs@fb.com>
selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code
Andrii Nakryiko <andrii@kernel.org>
selftests/bpf: make test_align selftest more robust
Andrii Nakryiko <andrii@kernel.org>
bpf: aggressively forget precise markings during state checkpointing
Andrii Nakryiko <andrii@kernel.org>
bpf: stop setting precise in current state
Andrii Nakryiko <andrii@kernel.org>
bpf: allow precision tracking for programs with subprogs
Maciej Żenczykowski <maze@google.com>
ipv6: adjust ndisc_is_useropt() to also return true for PIO
Sergei Antonov <saproj@gmail.com>
mmc: moxart: read scr register without changing byte order
Jason A. Donenfeld <Jason@zx2c4.com>
wireguard: allowedips: expand maximum node depth
-------------
Diffstat:
Makefile | 4 +-
arch/alpha/kernel/setup.c | 3 +-
arch/riscv/include/asm/mmio.h | 16 +-
arch/x86/entry/vdso/vma.c | 4 +-
arch/x86/include/asm/processor.h | 2 +
arch/x86/kernel/cpu/amd.c | 1 +
arch/x86/kernel/cpu/common.c | 5 -
arch/x86/kernel/vmlinux.lds.S | 12 +-
arch/x86/kvm/x86.c | 2 -
arch/x86/mm/pkeys.c | 6 -
drivers/android/binder.c | 1 +
drivers/android/binder_alloc.c | 6 +
drivers/android/binder_alloc.h | 1 +
drivers/dma/mcf-edma.c | 13 +-
drivers/dma/pl330.c | 18 ++-
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c | 7 +-
drivers/gpu/drm/drm_gem_shmem_helper.c | 6 +
drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h | 1 +
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c | 4 +-
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c | 10 ++
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c | 1 +
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c | 1 +
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c | 1 +
drivers/hwmon/pmbus/bel-pfe.c | 16 +-
.../common/cros_ec_sensors/cros_ec_sensors_core.c | 2 +-
drivers/infiniband/hw/hfi1/chip.c | 1 +
drivers/isdn/mISDN/dsp.h | 2 +-
drivers/isdn/mISDN/dsp_cmx.c | 2 +-
drivers/isdn/mISDN/dsp_core.c | 2 +-
drivers/mmc/host/moxart-mmc.c | 8 +-
drivers/net/bonding/bond_main.c | 4 +-
.../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 24 ++-
drivers/net/ethernet/ibm/ibmvnic.c | 38 ++++-
drivers/net/ethernet/mellanox/mlx5/core/sriov.c | 3 +-
drivers/net/phy/at803x.c | 2 -
drivers/net/tun.c | 2 +-
drivers/net/wireguard/allowedips.c | 8 +-
drivers/net/wireguard/selftest/allowedips.c | 16 +-
drivers/nvme/host/rdma.c | 3 +-
drivers/nvme/host/tcp.c | 3 +-
drivers/scsi/53c700.c | 2 +-
drivers/scsi/qedf/qedf_main.c | 18 +++
drivers/scsi/qedi/qedi_main.c | 18 +++
drivers/scsi/raid_class.c | 1 +
drivers/scsi/scsi_proc.c | 30 ++--
drivers/scsi/snic/snic_disc.c | 1 +
drivers/scsi/storvsc_drv.c | 4 -
drivers/usb/common/usb-conn-gpio.c | 6 +-
drivers/usb/dwc3/gadget.c | 9 +-
drivers/usb/storage/alauda.c | 12 +-
fs/btrfs/extent-tree.c | 5 +-
fs/btrfs/extent_io.c | 7 +-
fs/nilfs2/inode.c | 8 +
fs/nilfs2/segment.c | 2 +
fs/nilfs2/the_nilfs.h | 2 +
include/linux/cpu.h | 2 +
include/net/cfg80211.h | 3 +
include/net/netfilter/nf_tables.h | 31 +++-
io_uring/io_uring.c | 6 +-
kernel/bpf/verifier.c | 175 +++++++++++++++++++--
net/dccp/output.c | 2 +-
net/dccp/proto.c | 10 +-
net/ipv4/ip_tunnel_core.c | 2 +-
net/ipv6/ndisc.c | 3 +-
net/netfilter/nf_tables_api.c | 175 +++++++++++++--------
net/netfilter/nft_flow_offload.c | 6 +-
net/netfilter/nft_immediate.c | 8 +-
net/netfilter/nft_objref.c | 8 +-
net/netfilter/nft_set_hash.c | 2 -
net/netfilter/nft_set_pipapo.c | 18 ++-
net/netfilter/nft_set_rbtree.c | 2 -
net/packet/af_packet.c | 16 +-
net/sched/sch_netem.c | 59 +++----
tools/testing/radix-tree/regression1.c | 2 +-
tools/testing/selftests/bpf/prog_tests/align.c | 36 +++--
tools/testing/selftests/bpf/prog_tests/sk_assign.c | 25 ++-
tools/testing/selftests/bpf/progs/connect4_prog.c | 2 +-
tools/testing/selftests/bpf/progs/test_sk_assign.c | 11 ++
.../selftests/bpf/progs/test_sk_assign_libbpf.c | 3 +
tools/testing/selftests/net/forwarding/ethtool.sh | 2 +
.../net/forwarding/ethtool_extended_state.sh | 2 +
tools/testing/selftests/net/forwarding/lib.sh | 16 ++
tools/testing/selftests/net/forwarding/settings | 1 +
.../testing/selftests/net/forwarding/tc_flower.sh | 8 +-
tools/testing/selftests/rseq/Makefile | 4 +-
tools/testing/selftests/rseq/rseq.c | 2 +
87 files changed, 737 insertions(+), 293 deletions(-)
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 01/68] wireguard: allowedips: expand maximum node depth
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 02/68] mmc: moxart: read scr register without changing byte order Greg Kroah-Hartman
` (75 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jason A. Donenfeld, Jakub Kicinski
From: Jason A. Donenfeld <Jason@zx2c4.com>
commit 46622219aae2b67813fe31a7b8cb7da5baff5c8a upstream.
In the allowedips self-test, nodes are inserted into the tree, but it
generated an even amount of nodes, but for checking maximum node depth,
there is of course the root node, which makes the total number
necessarily odd. With two few nodes added, it never triggered the
maximum depth check like it should have. So, add 129 nodes instead of
128 nodes, and do so with a more straightforward scheme, starting with
all the bits set, and shifting over one each time. Then increase the
maximum depth to 129, and choose a better name for that variable to
make it clear that it represents depth as opposed to bits.
Cc: stable@vger.kernel.org
Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20230807132146.2191597-2-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireguard/allowedips.c | 8 ++++----
drivers/net/wireguard/selftest/allowedips.c | 16 ++++++++++------
2 files changed, 14 insertions(+), 10 deletions(-)
--- a/drivers/net/wireguard/allowedips.c
+++ b/drivers/net/wireguard/allowedips.c
@@ -6,7 +6,7 @@
#include "allowedips.h"
#include "peer.h"
-enum { MAX_ALLOWEDIPS_BITS = 128 };
+enum { MAX_ALLOWEDIPS_DEPTH = 129 };
static struct kmem_cache *node_cache;
@@ -42,7 +42,7 @@ static void push_rcu(struct allowedips_n
struct allowedips_node __rcu *p, unsigned int *len)
{
if (rcu_access_pointer(p)) {
- if (WARN_ON(IS_ENABLED(DEBUG) && *len >= MAX_ALLOWEDIPS_BITS))
+ if (WARN_ON(IS_ENABLED(DEBUG) && *len >= MAX_ALLOWEDIPS_DEPTH))
return;
stack[(*len)++] = rcu_dereference_raw(p);
}
@@ -55,7 +55,7 @@ static void node_free_rcu(struct rcu_hea
static void root_free_rcu(struct rcu_head *rcu)
{
- struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_BITS] = {
+ struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_DEPTH] = {
container_of(rcu, struct allowedips_node, rcu) };
unsigned int len = 1;
@@ -68,7 +68,7 @@ static void root_free_rcu(struct rcu_hea
static void root_remove_peer_lists(struct allowedips_node *root)
{
- struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_BITS] = { root };
+ struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_DEPTH] = { root };
unsigned int len = 1;
while (len > 0 && (node = stack[--len])) {
--- a/drivers/net/wireguard/selftest/allowedips.c
+++ b/drivers/net/wireguard/selftest/allowedips.c
@@ -593,16 +593,20 @@ bool __init wg_allowedips_selftest(void)
wg_allowedips_remove_by_peer(&t, a, &mutex);
test_negative(4, a, 192, 168, 0, 1);
- /* These will hit the WARN_ON(len >= MAX_ALLOWEDIPS_BITS) in free_node
+ /* These will hit the WARN_ON(len >= MAX_ALLOWEDIPS_DEPTH) in free_node
* if something goes wrong.
*/
- for (i = 0; i < MAX_ALLOWEDIPS_BITS; ++i) {
- part = cpu_to_be64(~(1LLU << (i % 64)));
- memset(&ip, 0xff, 16);
- memcpy((u8 *)&ip + (i < 64) * 8, &part, 8);
+ for (i = 0; i < 64; ++i) {
+ part = cpu_to_be64(~0LLU << i);
+ memset(&ip, 0xff, 8);
+ memcpy((u8 *)&ip + 8, &part, 8);
+ wg_allowedips_insert_v6(&t, &ip, 128, a, &mutex);
+ memcpy(&ip, &part, 8);
+ memset((u8 *)&ip + 8, 0, 8);
wg_allowedips_insert_v6(&t, &ip, 128, a, &mutex);
}
-
+ memset(&ip, 0, 16);
+ wg_allowedips_insert_v6(&t, &ip, 128, a, &mutex);
wg_allowedips_free(&t, &mutex);
wg_allowedips_init(&t);
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 02/68] mmc: moxart: read scr register without changing byte order
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 01/68] wireguard: allowedips: expand maximum node depth Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 03/68] ipv6: adjust ndisc_is_useropt() to also return true for PIO Greg Kroah-Hartman
` (74 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergei Antonov, Jonas Jensen, Ulf Hansson
From: Sergei Antonov <saproj@gmail.com>
commit d44263222134b5635932974c6177a5cba65a07e8 upstream.
Conversion from big-endian to native is done in a common function
mmc_app_send_scr(). Converting in moxart_transfer_pio() is extra.
Double conversion on a LE system returns an incorrect SCR value,
leads to errors:
mmc0: unrecognised SCR structure version 8
Fixes: 1b66e94e6b99 ("mmc: moxart: Add MOXA ART SD/MMC driver")
Signed-off-by: Sergei Antonov <saproj@gmail.com>
Cc: Jonas Jensen <jonas.jensen@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230627120549.2400325-1-saproj@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/moxart-mmc.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
--- a/drivers/mmc/host/moxart-mmc.c
+++ b/drivers/mmc/host/moxart-mmc.c
@@ -339,13 +339,7 @@ static void moxart_transfer_pio(struct m
return;
}
for (len = 0; len < remain && len < host->fifo_width;) {
- /* SCR data must be read in big endian. */
- if (data->mrq->cmd->opcode == SD_APP_SEND_SCR)
- *sgp = ioread32be(host->base +
- REG_DATA_WINDOW);
- else
- *sgp = ioread32(host->base +
- REG_DATA_WINDOW);
+ *sgp = ioread32(host->base + REG_DATA_WINDOW);
sgp++;
len += 4;
}
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 03/68] ipv6: adjust ndisc_is_useropt() to also return true for PIO
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 01/68] wireguard: allowedips: expand maximum node depth Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 02/68] mmc: moxart: read scr register without changing byte order Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 04/68] bpf: allow precision tracking for programs with subprogs Greg Kroah-Hartman
` (73 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jen Linkova, Lorenzo Colitti,
David Ahern, YOSHIFUJI Hideaki / 吉藤英明,
Maciej Żenczykowski, Jakub Kicinski
From: Maciej Żenczykowski <maze@google.com>
commit 048c796beb6eb4fa3a5a647ee1c81f5c6f0f6a2a upstream.
The upcoming (and nearly finalized):
https://datatracker.ietf.org/doc/draft-collink-6man-pio-pflag/
will update the IPv6 RA to include a new flag in the PIO field,
which will serve as a hint to perform DHCPv6-PD.
As we don't want DHCPv6 related logic inside the kernel, this piece of
information needs to be exposed to userspace. The simplest option is to
simply expose the entire PIO through the already existing mechanism.
Even without this new flag, the already existing PIO R (router address)
flag (from RFC6275) cannot AFAICT be handled entirely in kernel,
and provides useful information that should be exposed to userspace
(the router's global address, for use by Mobile IPv6).
Also cc'ing stable@ for inclusion in LTS, as while technically this is
not quite a bugfix, and instead more of a feature, it is absolutely
trivial and the alternative is manually cherrypicking into all Android
Common Kernel trees - and I know Greg will ask for it to be sent in via
LTS instead...
Cc: Jen Linkova <furry@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org>
Cc: stable@vger.kernel.org
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Link: https://lore.kernel.org/r/20230807102533.1147559-1-maze@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ndisc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -196,7 +196,8 @@ static struct nd_opt_hdr *ndisc_next_opt
static inline int ndisc_is_useropt(const struct net_device *dev,
struct nd_opt_hdr *opt)
{
- return opt->nd_opt_type == ND_OPT_RDNSS ||
+ return opt->nd_opt_type == ND_OPT_PREFIX_INFO ||
+ opt->nd_opt_type == ND_OPT_RDNSS ||
opt->nd_opt_type == ND_OPT_DNSSL ||
opt->nd_opt_type == ND_OPT_CAPTIVE_PORTAL ||
opt->nd_opt_type == ND_OPT_PREF64 ||
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 04/68] bpf: allow precision tracking for programs with subprogs
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 03/68] ipv6: adjust ndisc_is_useropt() to also return true for PIO Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 05/68] bpf: stop setting precise in current state Greg Kroah-Hartman
` (72 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrii Nakryiko, Alexei Starovoitov,
Pu Lehui, Luiz Capitulino
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit be2ef8161572ec1973124ebc50f56dafc2925e07 ]
Stop forcing precise=true for SCALAR registers when BPF program has any
subprograms. Current restriction means that any BPF program, as soon as
it uses subprograms, will end up not getting any of the precision
tracking benefits in reduction of number of verified states.
This patch keeps the fallback mark_all_scalars_precise() behavior if
precise marking has to cross function frames. E.g., if subprogram
requires R1 (first input arg) to be marked precise, ideally we'd need to
backtrack to the parent function and keep marking R1 and its
dependencies as precise. But right now we give up and force all the
SCALARs in any of the current and parent states to be forced to
precise=true. We can lift that restriction in the future.
But this patch fixes two issues identified when trying to enable
precision tracking for subprogs.
First, prevent "escaping" from top-most state in a global subprog. While
with entry-level BPF program we never end up requesting precision for
R1-R5 registers, because R2-R5 are not initialized (and so not readable
in correct BPF program), and R1 is PTR_TO_CTX, not SCALAR, and so is
implicitly precise. With global subprogs, though, it's different, as
global subprog a) can have up to 5 SCALAR input arguments, which might
get marked as precise=true and b) it is validated in isolation from its
main entry BPF program. b) means that we can end up exhausting parent
state chain and still not mark all registers in reg_mask as precise,
which would lead to verifier bug warning.
To handle that, we need to consider two cases. First, if the very first
state is not immediately "checkpointed" (i.e., stored in state lookup
hashtable), it will get correct first_insn_idx and last_insn_idx
instruction set during state checkpointing. As such, this case is
already handled and __mark_chain_precision() already handles that by
just doing nothing when we reach to the very first parent state.
st->parent will be NULL and we'll just stop. Perhaps some extra check
for reg_mask and stack_mask is due here, but this patch doesn't address
that issue.
More problematic second case is when global function's initial state is
immediately checkpointed before we manage to process the very first
instruction. This is happening because when there is a call to global
subprog from the main program the very first subprog's instruction is
marked as pruning point, so before we manage to process first
instruction we have to check and checkpoint state. This patch adds
a special handling for such "empty" state, which is identified by having
st->last_insn_idx set to -1. In such case, we check that we are indeed
validating global subprog, and with some sanity checking we mark input
args as precise if requested.
Note that we also initialize state->first_insn_idx with correct start
insn_idx offset. For main program zero is correct value, but for any
subprog it's quite confusing to not have first_insn_idx set. This
doesn't have any functional impact, but helps with debugging and state
printing. We also explicitly initialize state->last_insns_idx instead of
relying on is_state_visited() to do this with env->prev_insns_idx, which
will be -1 on the very first instruction. This concludes necessary
changes to handle specifically global subprog's precision tracking.
Second identified problem was missed handling of BPF helper functions
that call into subprogs (e.g., bpf_loop and few others). From precision
tracking and backtracking logic's standpoint those are effectively calls
into subprogs and should be called as BPF_PSEUDO_CALL calls.
This patch takes the least intrusive way and just checks against a short
list of current BPF helpers that do call subprogs, encapsulated in
is_callback_calling_function() function. But to prevent accidentally
forgetting to add new BPF helpers to this "list", we also do a sanity
check in __check_func_call, which has to be called for each such special
BPF helper, to validate that BPF helper is indeed recognized as
callback-calling one. This should catch any missed checks in the future.
Adding some special flags to be added in function proto definitions
seemed like an overkill in this case.
With the above changes, it's possible to remove forceful setting of
reg->precise to true in __mark_reg_unknown, which turns on precision
tracking both inside subprogs and entry progs that have subprogs. No
warnings or errors were detected across all the selftests, but also when
validating with veristat against internal Meta BPF objects and Cilium
objects. Further, in some BPF programs there are noticeable reduction in
number of states and instructions validated due to more effective
precision tracking, especially benefiting syncookie test.
$ ./veristat -C -e file,prog,insns,states ~/baseline-results.csv ~/subprog-precise-results.csv | grep -v '+0'
File Program Total insns (A) Total insns (B) Total insns (DIFF) Total states (A) Total states (B) Total states (DIFF)
---------------------------------------- -------------------------- --------------- --------------- ------------------ ---------------- ---------------- -------------------
pyperf600_bpf_loop.bpf.linked1.o on_event 3966 3678 -288 (-7.26%) 306 276 -30 (-9.80%)
pyperf_global.bpf.linked1.o on_event 7563 7530 -33 (-0.44%) 520 517 -3 (-0.58%)
pyperf_subprogs.bpf.linked1.o on_event 36358 36934 +576 (+1.58%) 2499 2531 +32 (+1.28%)
setget_sockopt.bpf.linked1.o skops_sockopt 3965 4038 +73 (+1.84%) 343 347 +4 (+1.17%)
test_cls_redirect_subprogs.bpf.linked1.o cls_redirect 64965 64901 -64 (-0.10%) 4619 4612 -7 (-0.15%)
test_misc_tcp_hdr_options.bpf.linked1.o misc_estab 1491 1307 -184 (-12.34%) 110 100 -10 (-9.09%)
test_pkt_access.bpf.linked1.o test_pkt_access 354 349 -5 (-1.41%) 25 24 -1 (-4.00%)
test_sock_fields.bpf.linked1.o egress_read_sock_fields 435 375 -60 (-13.79%) 22 20 -2 (-9.09%)
test_sysctl_loop2.bpf.linked1.o sysctl_tcp_mem 1508 1501 -7 (-0.46%) 29 28 -1 (-3.45%)
test_tc_dtime.bpf.linked1.o egress_fwdns_prio100 468 435 -33 (-7.05%) 45 41 -4 (-8.89%)
test_tc_dtime.bpf.linked1.o ingress_fwdns_prio100 398 408 +10 (+2.51%) 42 39 -3 (-7.14%)
test_tc_dtime.bpf.linked1.o ingress_fwdns_prio101 1096 842 -254 (-23.18%) 97 73 -24 (-24.74%)
test_tcp_hdr_options.bpf.linked1.o estab 2758 2408 -350 (-12.69%) 208 181 -27 (-12.98%)
test_urandom_usdt.bpf.linked1.o urand_read_with_sema 466 448 -18 (-3.86%) 31 28 -3 (-9.68%)
test_urandom_usdt.bpf.linked1.o urand_read_without_sema 466 448 -18 (-3.86%) 31 28 -3 (-9.68%)
test_urandom_usdt.bpf.linked1.o urandlib_read_with_sema 466 448 -18 (-3.86%) 31 28 -3 (-9.68%)
test_urandom_usdt.bpf.linked1.o urandlib_read_without_sema 466 448 -18 (-3.86%) 31 28 -3 (-9.68%)
test_xdp_noinline.bpf.linked1.o balancer_ingress_v6 4302 4294 -8 (-0.19%) 257 256 -1 (-0.39%)
xdp_synproxy_kern.bpf.linked1.o syncookie_tc 583722 405757 -177965 (-30.49%) 35846 25735 -10111 (-28.21%)
xdp_synproxy_kern.bpf.linked1.o syncookie_xdp 609123 479055 -130068 (-21.35%) 35452 29145 -6307 (-17.79%)
---------------------------------------- -------------------------- --------------- --------------- ------------------ ---------------- ---------------- -------------------
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20221104163649.121784-4-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Stable-dep-of: ecdf985d7615 ("bpf: track immediate values written to stack by BPF_ST instruction")
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Tested-by: Luiz Capitulino <luizcap@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/verifier.c | 35 ++++++++++++++++++++++++++++++++++-
1 file changed, 34 insertions(+), 1 deletion(-)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1359,7 +1359,7 @@ static void __mark_reg_unknown(const str
reg->type = SCALAR_VALUE;
reg->var_off = tnum_unknown;
reg->frameno = 0;
- reg->precise = env->subprog_cnt > 1 || !env->bpf_capable;
+ reg->precise = !env->bpf_capable;
__mark_reg_unbounded(reg);
}
@@ -2097,12 +2097,42 @@ static int __mark_chain_precision(struct
return 0;
if (!reg_mask && !stack_mask)
return 0;
+
for (;;) {
DECLARE_BITMAP(mask, 64);
u32 history = st->jmp_history_cnt;
if (env->log.level & BPF_LOG_LEVEL)
verbose(env, "last_idx %d first_idx %d\n", last_idx, first_idx);
+
+ if (last_idx < 0) {
+ /* we are at the entry into subprog, which
+ * is expected for global funcs, but only if
+ * requested precise registers are R1-R5
+ * (which are global func's input arguments)
+ */
+ if (st->curframe == 0 &&
+ st->frame[0]->subprogno > 0 &&
+ st->frame[0]->callsite == BPF_MAIN_FUNC &&
+ stack_mask == 0 && (reg_mask & ~0x3e) == 0) {
+ bitmap_from_u64(mask, reg_mask);
+ for_each_set_bit(i, mask, 32) {
+ reg = &st->frame[0]->regs[i];
+ if (reg->type != SCALAR_VALUE) {
+ reg_mask &= ~(1u << i);
+ continue;
+ }
+ reg->precise = true;
+ }
+ return 0;
+ }
+
+ verbose(env, "BUG backtracing func entry subprog %d reg_mask %x stack_mask %llx\n",
+ st->frame[0]->subprogno, reg_mask, stack_mask);
+ WARN_ONCE(1, "verifier backtracking bug");
+ return -EFAULT;
+ }
+
for (i = last_idx;;) {
if (skip_first) {
err = 0;
@@ -11846,6 +11876,9 @@ static int do_check_common(struct bpf_ve
0 /* frameno */,
subprog);
+ state->first_insn_idx = env->subprog_info[subprog].start;
+ state->last_insn_idx = -1;
+
regs = state->frame[state->curframe]->regs;
if (subprog || env->prog->type == BPF_PROG_TYPE_EXT) {
ret = btf_prepare_func_args(env, subprog, regs);
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 05/68] bpf: stop setting precise in current state
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 04/68] bpf: allow precision tracking for programs with subprogs Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 06/68] bpf: aggressively forget precise markings during state checkpointing Greg Kroah-Hartman
` (71 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrii Nakryiko, Alexei Starovoitov,
Pu Lehui, Luiz Capitulino
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit f63181b6ae79fd3b034cde641db774268c2c3acf ]
Setting reg->precise to true in current state is not necessary from
correctness standpoint, but it does pessimise the whole precision (or
rather "imprecision", because that's what we want to keep as much as
possible) tracking. Why is somewhat subtle and my best attempt to
explain this is recorded in an extensive comment for __mark_chain_precise()
function. Some more careful thinking and code reading is probably required
still to grok this completely, unfortunately. Whiteboarding and a bunch
of extra handwaiving in person would be even more helpful, but is deemed
impractical in Git commit.
Next patch pushes this imprecision property even further, building on top of
the insights described in this patch.
End results are pretty nice, we get reduction in number of total instructions
and states verified due to a better states reuse, as some of the states are now
more generic and permissive due to less unnecessary precise=true requirements.
SELFTESTS RESULTS
=================
$ ./veristat -C -e file,prog,insns,states ~/subprog-precise-results.csv ~/imprecise-early-results.csv | grep -v '+0'
File Program Total insns (A) Total insns (B) Total insns (DIFF) Total states (A) Total states (B) Total states (DIFF)
--------------------------------------- ---------------------- --------------- --------------- ------------------ ---------------- ---------------- -------------------
bpf_iter_ksym.bpf.linked1.o dump_ksym 347 285 -62 (-17.87%) 20 19 -1 (-5.00%)
pyperf600_bpf_loop.bpf.linked1.o on_event 3678 3736 +58 (+1.58%) 276 285 +9 (+3.26%)
setget_sockopt.bpf.linked1.o skops_sockopt 4038 3947 -91 (-2.25%) 347 343 -4 (-1.15%)
test_l4lb.bpf.linked1.o balancer_ingress 4559 2611 -1948 (-42.73%) 118 105 -13 (-11.02%)
test_l4lb_noinline.bpf.linked1.o balancer_ingress 6279 6268 -11 (-0.18%) 237 236 -1 (-0.42%)
test_misc_tcp_hdr_options.bpf.linked1.o misc_estab 1307 1303 -4 (-0.31%) 100 99 -1 (-1.00%)
test_sk_lookup.bpf.linked1.o ctx_narrow_access 456 447 -9 (-1.97%) 39 38 -1 (-2.56%)
test_sysctl_loop1.bpf.linked1.o sysctl_tcp_mem 1389 1384 -5 (-0.36%) 26 25 -1 (-3.85%)
test_tc_dtime.bpf.linked1.o egress_fwdns_prio101 518 485 -33 (-6.37%) 51 46 -5 (-9.80%)
test_tc_dtime.bpf.linked1.o egress_host 519 468 -51 (-9.83%) 50 44 -6 (-12.00%)
test_tc_dtime.bpf.linked1.o ingress_fwdns_prio101 842 1000 +158 (+18.76%) 73 88 +15 (+20.55%)
xdp_synproxy_kern.bpf.linked1.o syncookie_tc 405757 373173 -32584 (-8.03%) 25735 22882 -2853 (-11.09%)
xdp_synproxy_kern.bpf.linked1.o syncookie_xdp 479055 371590 -107465 (-22.43%) 29145 22207 -6938 (-23.81%)
--------------------------------------- ---------------------- --------------- --------------- ------------------ ---------------- ---------------- -------------------
Slight regression in test_tc_dtime.bpf.linked1.o/ingress_fwdns_prio101
is left for a follow up, there might be some more precision-related bugs
in existing BPF verifier logic.
CILIUM RESULTS
==============
$ ./veristat -C -e file,prog,insns,states ~/subprog-precise-results-cilium.csv ~/imprecise-early-results-cilium.csv | grep -v '+0'
File Program Total insns (A) Total insns (B) Total insns (DIFF) Total states (A) Total states (B) Total states (DIFF)
------------- ------------------------------ --------------- --------------- ------------------ ---------------- ---------------- -------------------
bpf_host.o cil_from_host 762 556 -206 (-27.03%) 43 37 -6 (-13.95%)
bpf_host.o tail_handle_nat_fwd_ipv4 23541 23426 -115 (-0.49%) 1538 1537 -1 (-0.07%)
bpf_host.o tail_nodeport_nat_egress_ipv4 33592 33566 -26 (-0.08%) 2163 2161 -2 (-0.09%)
bpf_lxc.o tail_handle_nat_fwd_ipv4 23541 23426 -115 (-0.49%) 1538 1537 -1 (-0.07%)
bpf_overlay.o tail_nodeport_nat_egress_ipv4 33581 33543 -38 (-0.11%) 2160 2157 -3 (-0.14%)
bpf_xdp.o tail_handle_nat_fwd_ipv4 21659 20920 -739 (-3.41%) 1440 1376 -64 (-4.44%)
bpf_xdp.o tail_handle_nat_fwd_ipv6 17084 17039 -45 (-0.26%) 907 905 -2 (-0.22%)
bpf_xdp.o tail_lb_ipv4 73442 73430 -12 (-0.02%) 4370 4369 -1 (-0.02%)
bpf_xdp.o tail_lb_ipv6 152114 151895 -219 (-0.14%) 6493 6479 -14 (-0.22%)
bpf_xdp.o tail_nodeport_nat_egress_ipv4 17377 17200 -177 (-1.02%) 1125 1111 -14 (-1.24%)
bpf_xdp.o tail_nodeport_nat_ingress_ipv6 6405 6397 -8 (-0.12%) 309 308 -1 (-0.32%)
bpf_xdp.o tail_rev_nodeport_lb4 7126 6934 -192 (-2.69%) 414 402 -12 (-2.90%)
bpf_xdp.o tail_rev_nodeport_lb6 18059 17905 -154 (-0.85%) 1105 1096 -9 (-0.81%)
------------- ------------------------------ --------------- --------------- ------------------ ---------------- ---------------- -------------------
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20221104163649.121784-5-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Stable-dep-of: ecdf985d7615 ("bpf: track immediate values written to stack by BPF_ST instruction")
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Tested-by: Luiz Capitulino <luizcap@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/verifier.c | 103 ++++++++++++++++++++++++++++++++++++++++++++------
1 file changed, 91 insertions(+), 12 deletions(-)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2023,8 +2023,11 @@ static void mark_all_scalars_precise(str
/* big hammer: mark all scalars precise in this path.
* pop_stack may still get !precise scalars.
+ * We also skip current state and go straight to first parent state,
+ * because precision markings in current non-checkpointed state are
+ * not needed. See why in the comment in __mark_chain_precision below.
*/
- for (; st; st = st->parent)
+ for (st = st->parent; st; st = st->parent) {
for (i = 0; i <= st->curframe; i++) {
func = st->frame[i];
for (j = 0; j < BPF_REG_FP; j++) {
@@ -2042,8 +2045,88 @@ static void mark_all_scalars_precise(str
reg->precise = true;
}
}
+ }
}
+/*
+ * __mark_chain_precision() backtracks BPF program instruction sequence and
+ * chain of verifier states making sure that register *regno* (if regno >= 0)
+ * and/or stack slot *spi* (if spi >= 0) are marked as precisely tracked
+ * SCALARS, as well as any other registers and slots that contribute to
+ * a tracked state of given registers/stack slots, depending on specific BPF
+ * assembly instructions (see backtrack_insns() for exact instruction handling
+ * logic). This backtracking relies on recorded jmp_history and is able to
+ * traverse entire chain of parent states. This process ends only when all the
+ * necessary registers/slots and their transitive dependencies are marked as
+ * precise.
+ *
+ * One important and subtle aspect is that precise marks *do not matter* in
+ * the currently verified state (current state). It is important to understand
+ * why this is the case.
+ *
+ * First, note that current state is the state that is not yet "checkpointed",
+ * i.e., it is not yet put into env->explored_states, and it has no children
+ * states as well. It's ephemeral, and can end up either a) being discarded if
+ * compatible explored state is found at some point or BPF_EXIT instruction is
+ * reached or b) checkpointed and put into env->explored_states, branching out
+ * into one or more children states.
+ *
+ * In the former case, precise markings in current state are completely
+ * ignored by state comparison code (see regsafe() for details). Only
+ * checkpointed ("old") state precise markings are important, and if old
+ * state's register/slot is precise, regsafe() assumes current state's
+ * register/slot as precise and checks value ranges exactly and precisely. If
+ * states turn out to be compatible, current state's necessary precise
+ * markings and any required parent states' precise markings are enforced
+ * after the fact with propagate_precision() logic, after the fact. But it's
+ * important to realize that in this case, even after marking current state
+ * registers/slots as precise, we immediately discard current state. So what
+ * actually matters is any of the precise markings propagated into current
+ * state's parent states, which are always checkpointed (due to b) case above).
+ * As such, for scenario a) it doesn't matter if current state has precise
+ * markings set or not.
+ *
+ * Now, for the scenario b), checkpointing and forking into child(ren)
+ * state(s). Note that before current state gets to checkpointing step, any
+ * processed instruction always assumes precise SCALAR register/slot
+ * knowledge: if precise value or range is useful to prune jump branch, BPF
+ * verifier takes this opportunity enthusiastically. Similarly, when
+ * register's value is used to calculate offset or memory address, exact
+ * knowledge of SCALAR range is assumed, checked, and enforced. So, similar to
+ * what we mentioned above about state comparison ignoring precise markings
+ * during state comparison, BPF verifier ignores and also assumes precise
+ * markings *at will* during instruction verification process. But as verifier
+ * assumes precision, it also propagates any precision dependencies across
+ * parent states, which are not yet finalized, so can be further restricted
+ * based on new knowledge gained from restrictions enforced by their children
+ * states. This is so that once those parent states are finalized, i.e., when
+ * they have no more active children state, state comparison logic in
+ * is_state_visited() would enforce strict and precise SCALAR ranges, if
+ * required for correctness.
+ *
+ * To build a bit more intuition, note also that once a state is checkpointed,
+ * the path we took to get to that state is not important. This is crucial
+ * property for state pruning. When state is checkpointed and finalized at
+ * some instruction index, it can be correctly and safely used to "short
+ * circuit" any *compatible* state that reaches exactly the same instruction
+ * index. I.e., if we jumped to that instruction from a completely different
+ * code path than original finalized state was derived from, it doesn't
+ * matter, current state can be discarded because from that instruction
+ * forward having a compatible state will ensure we will safely reach the
+ * exit. States describe preconditions for further exploration, but completely
+ * forget the history of how we got here.
+ *
+ * This also means that even if we needed precise SCALAR range to get to
+ * finalized state, but from that point forward *that same* SCALAR register is
+ * never used in a precise context (i.e., it's precise value is not needed for
+ * correctness), it's correct and safe to mark such register as "imprecise"
+ * (i.e., precise marking set to false). This is what we rely on when we do
+ * not set precise marking in current state. If no child state requires
+ * precision for any given SCALAR register, it's safe to dictate that it can
+ * be imprecise. If any child state does require this register to be precise,
+ * we'll mark it precise later retroactively during precise markings
+ * propagation from child state to parent states.
+ */
static int __mark_chain_precision(struct bpf_verifier_env *env, int frame, int regno,
int spi)
{
@@ -2061,6 +2144,10 @@ static int __mark_chain_precision(struct
if (!env->bpf_capable)
return 0;
+ /* Do sanity checks against current state of register and/or stack
+ * slot, but don't set precise flag in current state, as precision
+ * tracking in the current state is unnecessary.
+ */
func = st->frame[frame];
if (regno >= 0) {
reg = &func->regs[regno];
@@ -2068,11 +2155,7 @@ static int __mark_chain_precision(struct
WARN_ONCE(1, "backtracing misuse");
return -EFAULT;
}
- if (!reg->precise)
- new_marks = true;
- else
- reg_mask = 0;
- reg->precise = true;
+ new_marks = true;
}
while (spi >= 0) {
@@ -2085,11 +2168,7 @@ static int __mark_chain_precision(struct
stack_mask = 0;
break;
}
- if (!reg->precise)
- new_marks = true;
- else
- stack_mask = 0;
- reg->precise = true;
+ new_marks = true;
break;
}
@@ -9263,7 +9342,7 @@ static bool regsafe(struct bpf_verifier_
if (env->explore_alu_limits)
return false;
if (rcur->type == SCALAR_VALUE) {
- if (!rold->precise && !rcur->precise)
+ if (!rold->precise)
return true;
/* new val must satisfy old val knowledge */
return range_within(rold, rcur) &&
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 06/68] bpf: aggressively forget precise markings during state checkpointing
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 05/68] bpf: stop setting precise in current state Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 07/68] selftests/bpf: make test_align selftest more robust Greg Kroah-Hartman
` (70 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrii Nakryiko, Alexei Starovoitov,
Pu Lehui, Luiz Capitulino
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit 7a830b53c17bbadcf99f778f28aaaa4e6c41df5f ]
Exploit the property of about-to-be-checkpointed state to be able to
forget all precise markings up to that point even more aggressively. We
now clear all potentially inherited precise markings right before
checkpointing and branching off into child state. If any of children
states require precise knowledge of any SCALAR register, those will be
propagated backwards later on before this state is finalized, preserving
correctness.
There is a single selftests BPF program change, but tremendous one: 25x
reduction in number of verified instructions and states in
trace_virtqueue_add_sgs.
Cilium results are more modest, but happen across wider range of programs.
SELFTESTS RESULTS
=================
$ ./veristat -C -e file,prog,insns,states ~/imprecise-early-results.csv ~/imprecise-aggressive-results.csv | grep -v '+0'
File Program Total insns (A) Total insns (B) Total insns (DIFF) Total states (A) Total states (B) Total states (DIFF)
------------------- ----------------------- --------------- --------------- ------------------ ---------------- ---------------- -------------------
loop6.bpf.linked1.o trace_virtqueue_add_sgs 398057 15114 -382943 (-96.20%) 8717 336 -8381 (-96.15%)
------------------- ----------------------- --------------- --------------- ------------------ ---------------- ---------------- -------------------
CILIUM RESULTS
==============
$ ./veristat -C -e file,prog,insns,states ~/imprecise-early-results-cilium.csv ~/imprecise-aggressive-results-cilium.csv | grep -v '+0'
File Program Total insns (A) Total insns (B) Total insns (DIFF) Total states (A) Total states (B) Total states (DIFF)
------------- -------------------------------- --------------- --------------- ------------------ ---------------- ---------------- -------------------
bpf_host.o tail_handle_nat_fwd_ipv4 23426 23221 -205 (-0.88%) 1537 1515 -22 (-1.43%)
bpf_host.o tail_handle_nat_fwd_ipv6 13009 12904 -105 (-0.81%) 719 708 -11 (-1.53%)
bpf_host.o tail_nodeport_nat_ingress_ipv6 5261 5196 -65 (-1.24%) 247 243 -4 (-1.62%)
bpf_host.o tail_nodeport_nat_ipv6_egress 3446 3406 -40 (-1.16%) 203 198 -5 (-2.46%)
bpf_lxc.o tail_handle_nat_fwd_ipv4 23426 23221 -205 (-0.88%) 1537 1515 -22 (-1.43%)
bpf_lxc.o tail_handle_nat_fwd_ipv6 13009 12904 -105 (-0.81%) 719 708 -11 (-1.53%)
bpf_lxc.o tail_ipv4_ct_egress 5074 4897 -177 (-3.49%) 255 248 -7 (-2.75%)
bpf_lxc.o tail_ipv4_ct_ingress 5100 4923 -177 (-3.47%) 255 248 -7 (-2.75%)
bpf_lxc.o tail_ipv4_ct_ingress_policy_only 5100 4923 -177 (-3.47%) 255 248 -7 (-2.75%)
bpf_lxc.o tail_ipv6_ct_egress 4558 4536 -22 (-0.48%) 188 187 -1 (-0.53%)
bpf_lxc.o tail_ipv6_ct_ingress 4578 4556 -22 (-0.48%) 188 187 -1 (-0.53%)
bpf_lxc.o tail_ipv6_ct_ingress_policy_only 4578 4556 -22 (-0.48%) 188 187 -1 (-0.53%)
bpf_lxc.o tail_nodeport_nat_ingress_ipv6 5261 5196 -65 (-1.24%) 247 243 -4 (-1.62%)
bpf_overlay.o tail_nodeport_nat_ingress_ipv6 5261 5196 -65 (-1.24%) 247 243 -4 (-1.62%)
bpf_overlay.o tail_nodeport_nat_ipv6_egress 3482 3442 -40 (-1.15%) 204 201 -3 (-1.47%)
bpf_xdp.o tail_nodeport_nat_egress_ipv4 17200 15619 -1581 (-9.19%) 1111 1010 -101 (-9.09%)
------------- -------------------------------- --------------- --------------- ------------------ ---------------- ---------------- -------------------
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20221104163649.121784-6-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Stable-dep-of: ecdf985d7615 ("bpf: track immediate values written to stack by BPF_ST instruction")
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Tested-by: Luiz Capitulino <luizcap@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/verifier.c | 37 +++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2048,6 +2048,31 @@ static void mark_all_scalars_precise(str
}
}
+static void mark_all_scalars_imprecise(struct bpf_verifier_env *env, struct bpf_verifier_state *st)
+{
+ struct bpf_func_state *func;
+ struct bpf_reg_state *reg;
+ int i, j;
+
+ for (i = 0; i <= st->curframe; i++) {
+ func = st->frame[i];
+ for (j = 0; j < BPF_REG_FP; j++) {
+ reg = &func->regs[j];
+ if (reg->type != SCALAR_VALUE)
+ continue;
+ reg->precise = false;
+ }
+ for (j = 0; j < func->allocated_stack / BPF_REG_SIZE; j++) {
+ if (!is_spilled_reg(&func->stack[j]))
+ continue;
+ reg = &func->stack[j].spilled_ptr;
+ if (reg->type != SCALAR_VALUE)
+ continue;
+ reg->precise = false;
+ }
+ }
+}
+
/*
* __mark_chain_precision() backtracks BPF program instruction sequence and
* chain of verifier states making sure that register *regno* (if regno >= 0)
@@ -2126,6 +2151,14 @@ static void mark_all_scalars_precise(str
* be imprecise. If any child state does require this register to be precise,
* we'll mark it precise later retroactively during precise markings
* propagation from child state to parent states.
+ *
+ * Skipping precise marking setting in current state is a mild version of
+ * relying on the above observation. But we can utilize this property even
+ * more aggressively by proactively forgetting any precise marking in the
+ * current state (which we inherited from the parent state), right before we
+ * checkpoint it and branch off into new child state. This is done by
+ * mark_all_scalars_imprecise() to hopefully get more permissive and generic
+ * finalized states which help in short circuiting more future states.
*/
static int __mark_chain_precision(struct bpf_verifier_env *env, int frame, int regno,
int spi)
@@ -9875,6 +9908,10 @@ next:
env->prev_jmps_processed = env->jmps_processed;
env->prev_insn_processed = env->insn_processed;
+ /* forget precise markings we inherited, see __mark_chain_precision */
+ if (env->bpf_capable)
+ mark_all_scalars_imprecise(env, cur);
+
/* add new state to the head of linked list */
new = &new_sl->state;
err = copy_verifier_state(new, cur);
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 07/68] selftests/bpf: make test_align selftest more robust
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 06/68] bpf: aggressively forget precise markings during state checkpointing Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 08/68] selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code Greg Kroah-Hartman
` (69 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrii Nakryiko, Alexei Starovoitov,
Pu Lehui, Luiz Capitulino
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit 4f999b767769b76378c3616c624afd6f4bb0d99f ]
test_align selftest relies on BPF verifier log emitting register states
for specific instructions in expected format. Unfortunately, BPF
verifier precision backtracking log interferes with such expectations.
And instruction on which precision propagation happens sometimes don't
output full expected register states. This does indeed look like
something to be improved in BPF verifier, but is beyond the scope of
this patch set.
So to make test_align a bit more robust, inject few dummy R4 = R5
instructions which capture desired state of R5 and won't have precision
tracking logs on them. This fixes tests until we can improve BPF
verifier output in the presence of precision tracking.
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20221104163649.121784-7-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Stable-dep-of: ecdf985d7615 ("bpf: track immediate values written to stack by BPF_ST instruction")
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Tested-by: Luiz Capitulino <luizcap@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/bpf/prog_tests/align.c | 36 +++++++++++++++----------
1 file changed, 23 insertions(+), 13 deletions(-)
--- a/tools/testing/selftests/bpf/prog_tests/align.c
+++ b/tools/testing/selftests/bpf/prog_tests/align.c
@@ -2,7 +2,7 @@
#include <test_progs.h>
#define MAX_INSNS 512
-#define MAX_MATCHES 16
+#define MAX_MATCHES 24
struct bpf_reg_match {
unsigned int line;
@@ -267,6 +267,7 @@ static struct bpf_align_test tests[] = {
*/
BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
BPF_ALU64_REG(BPF_ADD, BPF_REG_5, BPF_REG_6),
+ BPF_MOV64_REG(BPF_REG_4, BPF_REG_5),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
BPF_MOV64_REG(BPF_REG_4, BPF_REG_5),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
@@ -280,6 +281,7 @@ static struct bpf_align_test tests[] = {
BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
BPF_ALU64_REG(BPF_ADD, BPF_REG_5, BPF_REG_6),
+ BPF_MOV64_REG(BPF_REG_4, BPF_REG_5),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 4),
BPF_ALU64_REG(BPF_ADD, BPF_REG_5, BPF_REG_6),
BPF_MOV64_REG(BPF_REG_4, BPF_REG_5),
@@ -311,44 +313,52 @@ static struct bpf_align_test tests[] = {
{15, "R4=pkt(id=1,off=18,r=18,umax_value=1020,var_off=(0x0; 0x3fc))"},
{15, "R5=pkt(id=1,off=14,r=18,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* Variable offset is added to R5 packet pointer,
- * resulting in auxiliary alignment of 4.
+ * resulting in auxiliary alignment of 4. To avoid BPF
+ * verifier's precision backtracking logging
+ * interfering we also have a no-op R4 = R5
+ * instruction to validate R5 state. We also check
+ * that R4 is what it should be in such case.
*/
- {18, "R5_w=pkt(id=2,off=0,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
+ {19, "R4_w=pkt(id=2,off=0,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
+ {19, "R5_w=pkt(id=2,off=0,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* Constant offset is added to R5, resulting in
* reg->off of 14.
*/
- {19, "R5_w=pkt(id=2,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
+ {20, "R5_w=pkt(id=2,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* At the time the word size load is performed from R5,
* its total fixed offset is NET_IP_ALIGN + reg->off
* (14) which is 16. Then the variable offset is 4-byte
* aligned, so the total offset is 4-byte aligned and
* meets the load's requirements.
*/
- {23, "R4=pkt(id=2,off=18,r=18,umax_value=1020,var_off=(0x0; 0x3fc))"},
- {23, "R5=pkt(id=2,off=14,r=18,umax_value=1020,var_off=(0x0; 0x3fc))"},
+ {24, "R4=pkt(id=2,off=18,r=18,umax_value=1020,var_off=(0x0; 0x3fc))"},
+ {24, "R5=pkt(id=2,off=14,r=18,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* Constant offset is added to R5 packet pointer,
* resulting in reg->off value of 14.
*/
- {26, "R5_w=pkt(id=0,off=14,r=8"},
+ {27, "R5_w=pkt(id=0,off=14,r=8"},
/* Variable offset is added to R5, resulting in a
- * variable offset of (4n).
+ * variable offset of (4n). See comment for insn #19
+ * for R4 = R5 trick.
*/
- {27, "R5_w=pkt(id=3,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
+ {29, "R4_w=pkt(id=3,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
+ {29, "R5_w=pkt(id=3,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* Constant is added to R5 again, setting reg->off to 18. */
- {28, "R5_w=pkt(id=3,off=18,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
+ {30, "R5_w=pkt(id=3,off=18,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* And once more we add a variable; resulting var_off
* is still (4n), fixed offset is not changed.
* Also, we create a new reg->id.
*/
- {29, "R5_w=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc)"},
+ {32, "R4_w=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc)"},
+ {32, "R5_w=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc)"},
/* At the time the word size load is performed from R5,
* its total fixed offset is NET_IP_ALIGN + reg->off (18)
* which is 20. Then the variable offset is (4n), so
* the total offset is 4-byte aligned and meets the
* load's requirements.
*/
- {33, "R4=pkt(id=4,off=22,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"},
- {33, "R5=pkt(id=4,off=18,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"},
+ {35, "R4=pkt(id=4,off=22,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"},
+ {35, "R5=pkt(id=4,off=18,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"},
},
},
{
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 08/68] selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 07/68] selftests/bpf: make test_align selftest more robust Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 09/68] selftests/bpf: Fix sk_assign on s390x Greg Kroah-Hartman
` (68 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrii Nakryiko, Yonghong Song,
Pu Lehui, Luiz Capitulino
From: Yonghong Song <yhs@fb.com>
[ Upstream commit 63d78b7e8ca2d0eb8c687a355fa19d01b6fcc723 ]
With latest llvm17, selftest fexit_bpf2bpf/func_replace_return_code
has the following verification failure:
0: R1=ctx(off=0,imm=0) R10=fp0
; int connect_v4_prog(struct bpf_sock_addr *ctx)
0: (bf) r7 = r1 ; R1=ctx(off=0,imm=0) R7_w=ctx(off=0,imm=0)
1: (b4) w6 = 0 ; R6_w=0
; memset(&tuple.ipv4.saddr, 0, sizeof(tuple.ipv4.saddr));
...
; return do_bind(ctx) ? 1 : 0;
179: (bf) r1 = r7 ; R1=ctx(off=0,imm=0) R7=ctx(off=0,imm=0)
180: (85) call pc+147
Func#3 is global and valid. Skipping.
181: R0_w=scalar()
181: (bc) w6 = w0 ; R0_w=scalar() R6_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff))
182: (05) goto pc-129
; }
54: (bc) w0 = w6 ; R0_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) R6_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff))
55: (95) exit
At program exit the register R0 has value (0x0; 0xffffffff) should have been in (0x0; 0x1)
processed 281 insns (limit 1000000) max_states_per_insn 1 total_states 26 peak_states 26 mark_read 13
-- END PROG LOAD LOG --
libbpf: prog 'connect_v4_prog': failed to load: -22
The corresponding source code:
__attribute__ ((noinline))
int do_bind(struct bpf_sock_addr *ctx)
{
struct sockaddr_in sa = {};
sa.sin_family = AF_INET;
sa.sin_port = bpf_htons(0);
sa.sin_addr.s_addr = bpf_htonl(SRC_REWRITE_IP4);
if (bpf_bind(ctx, (struct sockaddr *)&sa, sizeof(sa)) != 0)
return 0;
return 1;
}
...
SEC("cgroup/connect4")
int connect_v4_prog(struct bpf_sock_addr *ctx)
{
...
return do_bind(ctx) ? 1 : 0;
}
Insn 180 is a call to 'do_bind'. The call's return value is also the return value
for the program. Since do_bind() returns 0/1, so it is legitimate for compiler to
optimize 'return do_bind(ctx) ? 1 : 0' to 'return do_bind(ctx)'. However, such
optimization breaks verifier as the return value of 'do_bind()' is marked as any
scalar which violates the requirement of prog return value 0/1.
There are two ways to fix this problem, (1) changing 'return 1' in do_bind() to
e.g. 'return 10' so the compiler has to do 'do_bind(ctx) ? 1 :0', or (2)
suggested by Andrii, marking do_bind() with __weak attribute so the compiler
cannot make any assumption on do_bind() return value.
This patch adopted adding __weak approach which is simpler and more resistant
to potential compiler optimizations.
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20230310012410.2920570-1-yhs@fb.com
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Tested-by: Luiz Capitulino <luizcap@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/bpf/progs/connect4_prog.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/bpf/progs/connect4_prog.c
+++ b/tools/testing/selftests/bpf/progs/connect4_prog.c
@@ -33,7 +33,7 @@
int _version SEC("version") = 1;
-__attribute__ ((noinline))
+__attribute__ ((noinline)) __weak
int do_bind(struct bpf_sock_addr *ctx)
{
struct sockaddr_in sa = {};
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 09/68] selftests/bpf: Fix sk_assign on s390x
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 08/68] selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 10/68] dmaengine: pl330: Return DMA_PAUSED when transaction is paused Greg Kroah-Hartman
` (67 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilya Leoshkevich,
Alexei Starovoitov, Pu Lehui, Luiz Capitulino
From: Ilya Leoshkevich <iii@linux.ibm.com>
[ Upstream commit 7ce878ca81bca7811e669db4c394b86780e0dbe4 ]
sk_assign is failing on an s390x machine running Debian "bookworm" for
2 reasons: legacy server_map definition and uninitialized addrlen in
recvfrom() call.
Fix by adding a new-style server_map definition and dropping addrlen
(recvfrom() allows NULL values for src_addr and addrlen).
Since the test should support tc built without libbpf, build the prog
twice: with the old-style definition and with the new-style definition,
then select the right one at runtime. This could be done at compile
time too, but this would not be cross-compilation friendly.
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Link: https://lore.kernel.org/r/20230129190501.1624747-2-iii@linux.ibm.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Tested-by: Luiz Capitulino <luizcap@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/bpf/prog_tests/sk_assign.c | 25 ++++++++++----
tools/testing/selftests/bpf/progs/test_sk_assign.c | 11 ++++++
tools/testing/selftests/bpf/progs/test_sk_assign_libbpf.c | 3 +
3 files changed, 33 insertions(+), 6 deletions(-)
create mode 100644 tools/testing/selftests/bpf/progs/test_sk_assign_libbpf.c
--- a/tools/testing/selftests/bpf/prog_tests/sk_assign.c
+++ b/tools/testing/selftests/bpf/prog_tests/sk_assign.c
@@ -29,7 +29,23 @@ static int stop, duration;
static bool
configure_stack(void)
{
+ char tc_version[128];
char tc_cmd[BUFSIZ];
+ char *prog;
+ FILE *tc;
+
+ /* Check whether tc is built with libbpf. */
+ tc = popen("tc -V", "r");
+ if (CHECK_FAIL(!tc))
+ return false;
+ if (CHECK_FAIL(!fgets(tc_version, sizeof(tc_version), tc)))
+ return false;
+ if (strstr(tc_version, ", libbpf "))
+ prog = "test_sk_assign_libbpf.o";
+ else
+ prog = "test_sk_assign.o";
+ if (CHECK_FAIL(pclose(tc)))
+ return false;
/* Move to a new networking namespace */
if (CHECK_FAIL(unshare(CLONE_NEWNET)))
@@ -46,8 +62,8 @@ configure_stack(void)
/* Load qdisc, BPF program */
if (CHECK_FAIL(system("tc qdisc add dev lo clsact")))
return false;
- sprintf(tc_cmd, "%s %s %s %s", "tc filter add dev lo ingress bpf",
- "direct-action object-file ./test_sk_assign.o",
+ sprintf(tc_cmd, "%s %s %s %s %s", "tc filter add dev lo ingress bpf",
+ "direct-action object-file", prog,
"section classifier/sk_assign_test",
(env.verbosity < VERBOSE_VERY) ? " 2>/dev/null" : "verbose");
if (CHECK(system(tc_cmd), "BPF load failed;",
@@ -129,15 +145,12 @@ get_port(int fd)
static ssize_t
rcv_msg(int srv_client, int type)
{
- struct sockaddr_storage ss;
char buf[BUFSIZ];
- socklen_t slen;
if (type == SOCK_STREAM)
return read(srv_client, &buf, sizeof(buf));
else
- return recvfrom(srv_client, &buf, sizeof(buf), 0,
- (struct sockaddr *)&ss, &slen);
+ return recvfrom(srv_client, &buf, sizeof(buf), 0, NULL, NULL);
}
static int
--- a/tools/testing/selftests/bpf/progs/test_sk_assign.c
+++ b/tools/testing/selftests/bpf/progs/test_sk_assign.c
@@ -16,6 +16,16 @@
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>
+#if defined(IPROUTE2_HAVE_LIBBPF)
+/* Use a new-style map definition. */
+struct {
+ __uint(type, BPF_MAP_TYPE_SOCKMAP);
+ __type(key, int);
+ __type(value, __u64);
+ __uint(pinning, LIBBPF_PIN_BY_NAME);
+ __uint(max_entries, 1);
+} server_map SEC(".maps");
+#else
/* Pin map under /sys/fs/bpf/tc/globals/<map name> */
#define PIN_GLOBAL_NS 2
@@ -35,6 +45,7 @@ struct {
.max_elem = 1,
.pinning = PIN_GLOBAL_NS,
};
+#endif
int _version SEC("version") = 1;
char _license[] SEC("license") = "GPL";
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_sk_assign_libbpf.c
@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: GPL-2.0
+#define IPROUTE2_HAVE_LIBBPF
+#include "test_sk_assign.c"
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 10/68] dmaengine: pl330: Return DMA_PAUSED when transaction is paused
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 09/68] selftests/bpf: Fix sk_assign on s390x Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 11/68] riscv,mmio: Fix readX()-to-delay() ordering Greg Kroah-Hartman
` (66 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Tresidder,
Ilpo Järvinen, Vinod Koul
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
commit 8cda3ececf07d374774f6a13e5a94bc2dc04c26c upstream.
pl330_pause() does not set anything to indicate paused condition which
causes pl330_tx_status() to return DMA_IN_PROGRESS. This breaks 8250
DMA flush after the fix in commit 57e9af7831dc ("serial: 8250_dma: Fix
DMA Rx rearm race"). The function comment for pl330_pause() claims
pause is supported but resume is not which is enough for 8250 DMA flush
to work as long as DMA status reports DMA_PAUSED when appropriate.
Add PAUSED state for descriptor and mark BUSY descriptors with PAUSED
in pl330_pause(). Return DMA_PAUSED from pl330_tx_status() when the
descriptor is PAUSED.
Reported-by: Richard Tresidder <rtresidd@electromag.com.au>
Tested-by: Richard Tresidder <rtresidd@electromag.com.au>
Fixes: 88987d2c7534 ("dmaengine: pl330: add DMA_PAUSE feature")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-serial/f8a86ecd-64b1-573f-c2fa-59f541083f1a@electromag.com.au/
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://lore.kernel.org/r/20230526105434.14959-1-ilpo.jarvinen@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/pl330.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -404,6 +404,12 @@ enum desc_status {
*/
BUSY,
/*
+ * Pause was called while descriptor was BUSY. Due to hardware
+ * limitations, only termination is possible for descriptors
+ * that have been paused.
+ */
+ PAUSED,
+ /*
* Sitting on the channel work_list but xfer done
* by PL330 core
*/
@@ -2043,7 +2049,7 @@ static inline void fill_queue(struct dma
list_for_each_entry(desc, &pch->work_list, node) {
/* If already submitted */
- if (desc->status == BUSY)
+ if (desc->status == BUSY || desc->status == PAUSED)
continue;
ret = pl330_submit_req(pch->thread, desc);
@@ -2328,6 +2334,7 @@ static int pl330_pause(struct dma_chan *
{
struct dma_pl330_chan *pch = to_pchan(chan);
struct pl330_dmac *pl330 = pch->dmac;
+ struct dma_pl330_desc *desc;
unsigned long flags;
pm_runtime_get_sync(pl330->ddma.dev);
@@ -2337,6 +2344,10 @@ static int pl330_pause(struct dma_chan *
_stop(pch->thread);
spin_unlock(&pl330->lock);
+ list_for_each_entry(desc, &pch->work_list, node) {
+ if (desc->status == BUSY)
+ desc->status = PAUSED;
+ }
spin_unlock_irqrestore(&pch->lock, flags);
pm_runtime_mark_last_busy(pl330->ddma.dev);
pm_runtime_put_autosuspend(pl330->ddma.dev);
@@ -2427,7 +2438,7 @@ pl330_tx_status(struct dma_chan *chan, d
else if (running && desc == running)
transferred =
pl330_get_current_xferred_count(pch, desc);
- else if (desc->status == BUSY)
+ else if (desc->status == BUSY || desc->status == PAUSED)
/*
* Busy but not running means either just enqueued,
* or finished and not yet marked done
@@ -2444,6 +2455,9 @@ pl330_tx_status(struct dma_chan *chan, d
case DONE:
ret = DMA_COMPLETE;
break;
+ case PAUSED:
+ ret = DMA_PAUSED;
+ break;
case PREP:
case BUSY:
ret = DMA_IN_PROGRESS;
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 11/68] riscv,mmio: Fix readX()-to-delay() ordering
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 10/68] dmaengine: pl330: Return DMA_PAUSED when transaction is paused Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [Nouveau] " Greg Kroah-Hartman
` (65 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andrea Parri, Palmer Dabbelt
From: Andrea Parri <parri.andrea@gmail.com>
commit 4eb2eb1b4c0eb07793c240744843498564a67b83 upstream.
Section 2.1 of the Platform Specification [1] states:
Unless otherwise specified by a given I/O device, I/O devices are on
ordering channel 0 (i.e., they are point-to-point strongly ordered).
which is not sufficient to guarantee that a readX() by a hart completes
before a subsequent delay() on the same hart (cf. memory-barriers.txt,
"Kernel I/O barrier effects").
Set the I(nput) bit in __io_ar() to restore the ordering, align inline
comments.
[1] https://github.com/riscv/riscv-platform-specs
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Link: https://lore.kernel.org/r/20230803042738.5937-1-parri.andrea@gmail.com
Fixes: fab957c11efe ("RISC-V: Atomic and Locking Code")
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/include/asm/mmio.h | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/arch/riscv/include/asm/mmio.h
+++ b/arch/riscv/include/asm/mmio.h
@@ -101,9 +101,9 @@ static inline u64 __raw_readq(const vola
* Relaxed I/O memory access primitives. These follow the Device memory
* ordering rules but do not guarantee any ordering relative to Normal memory
* accesses. These are defined to order the indicated access (either a read or
- * write) with all other I/O memory accesses. Since the platform specification
- * defines that all I/O regions are strongly ordered on channel 2, no explicit
- * fences are required to enforce this ordering.
+ * write) with all other I/O memory accesses to the same peripheral. Since the
+ * platform specification defines that all I/O regions are strongly ordered on
+ * channel 0, no explicit fences are required to enforce this ordering.
*/
/* FIXME: These are now the same as asm-generic */
#define __io_rbr() do {} while (0)
@@ -125,14 +125,14 @@ static inline u64 __raw_readq(const vola
#endif
/*
- * I/O memory access primitives. Reads are ordered relative to any
- * following Normal memory access. Writes are ordered relative to any prior
- * Normal memory access. The memory barriers here are necessary as RISC-V
+ * I/O memory access primitives. Reads are ordered relative to any following
+ * Normal memory read and delay() loop. Writes are ordered relative to any
+ * prior Normal memory write. The memory barriers here are necessary as RISC-V
* doesn't define any ordering between the memory space and the I/O space.
*/
#define __io_br() do {} while (0)
-#define __io_ar(v) __asm__ __volatile__ ("fence i,r" : : : "memory")
-#define __io_bw() __asm__ __volatile__ ("fence w,o" : : : "memory")
+#define __io_ar(v) ({ __asm__ __volatile__ ("fence i,ir" : : : "memory"); })
+#define __io_bw() ({ __asm__ __volatile__ ("fence w,o" : : : "memory"); })
#define __io_aw() mmiowb_set_pending()
#define readb(c) ({ u8 __v; __io_br(); __v = readb_cpu(c); __io_ar(__v); __v; })
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 12/68] drm/nouveau/gr: enable memory loads on helper invocation on all channels
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 02/68] mmc: moxart: read scr register without changing byte order Greg Kroah-Hartman
` (75 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ben Skeggs, David Airlie, nouveau,
Karol Herbst, Dave Airlie
From: Karol Herbst <kherbst@redhat.com>
commit 1cb9e2ef66d53b020842b18762e30d0eb4384de8 upstream.
We have a lurking bug where Fragment Shader Helper Invocations can't load
from memory. But this is actually required in OpenGL and is causing random
hangs or failures in random shaders.
It is unknown how widespread this issue is, but shaders hitting this can
end up with infinite loops.
We enable those only on all Kepler and newer GPUs where we use our own
Firmware.
Nvidia's firmware provides a way to set a kernelspace controlled list of
mmio registers in the gr space from push buffers via MME macros.
v2: drop code for gm200 and newer.
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: David Airlie <airlied@gmail.com>
Cc: nouveau@lists.freedesktop.org
Cc: stable@vger.kernel.org # 4.19+
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230622152017.2512101-1-kherbst@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h | 1 +
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c | 4 +++-
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c | 10 ++++++++++
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c | 1 +
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c | 1 +
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c | 1 +
6 files changed, 17 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h
@@ -123,6 +123,7 @@ void gk104_grctx_generate_r418800(struct
extern const struct gf100_grctx_func gk110_grctx;
void gk110_grctx_generate_r419eb0(struct gf100_gr *);
+void gk110_grctx_generate_r419f78(struct gf100_gr *);
extern const struct gf100_grctx_func gk110b_grctx;
extern const struct gf100_grctx_func gk208_grctx;
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
@@ -916,7 +916,9 @@ static void
gk104_grctx_generate_r419f78(struct gf100_gr *gr)
{
struct nvkm_device *device = gr->base.engine.subdev.device;
- nvkm_mask(device, 0x419f78, 0x00000001, 0x00000000);
+
+ /* bit 3 set disables loads in fp helper invocations, we need it enabled */
+ nvkm_mask(device, 0x419f78, 0x00000009, 0x00000000);
}
void
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c
@@ -820,6 +820,15 @@ gk110_grctx_generate_r419eb0(struct gf10
nvkm_mask(device, 0x419eb0, 0x00001000, 0x00001000);
}
+void
+gk110_grctx_generate_r419f78(struct gf100_gr *gr)
+{
+ struct nvkm_device *device = gr->base.engine.subdev.device;
+
+ /* bit 3 set disables loads in fp helper invocations, we need it enabled */
+ nvkm_mask(device, 0x419f78, 0x00000008, 0x00000000);
+}
+
const struct gf100_grctx_func
gk110_grctx = {
.main = gf100_grctx_generate_main,
@@ -852,4 +861,5 @@ gk110_grctx = {
.gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr,
.r418800 = gk104_grctx_generate_r418800,
.r419eb0 = gk110_grctx_generate_r419eb0,
+ .r419f78 = gk110_grctx_generate_r419f78,
};
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c
@@ -101,4 +101,5 @@ gk110b_grctx = {
.gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr,
.r418800 = gk104_grctx_generate_r418800,
.r419eb0 = gk110_grctx_generate_r419eb0,
+ .r419f78 = gk110_grctx_generate_r419f78,
};
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c
@@ -566,4 +566,5 @@ gk208_grctx = {
.dist_skip_table = gf117_grctx_generate_dist_skip_table,
.gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr,
.r418800 = gk104_grctx_generate_r418800,
+ .r419f78 = gk110_grctx_generate_r419f78,
};
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
@@ -991,4 +991,5 @@ gm107_grctx = {
.r406500 = gm107_grctx_generate_r406500,
.gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr,
.r419e00 = gm107_grctx_generate_r419e00,
+ .r419f78 = gk110_grctx_generate_r419f78,
};
^ permalink raw reply [flat|nested] 79+ messages in thread
* [Nouveau] [PATCH 5.10 12/68] drm/nouveau/gr: enable memory loads on helper invocation on all channels
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
0 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: nouveau, patches, Ben Skeggs, Greg Kroah-Hartman, Dave Airlie
From: Karol Herbst <kherbst@redhat.com>
commit 1cb9e2ef66d53b020842b18762e30d0eb4384de8 upstream.
We have a lurking bug where Fragment Shader Helper Invocations can't load
from memory. But this is actually required in OpenGL and is causing random
hangs or failures in random shaders.
It is unknown how widespread this issue is, but shaders hitting this can
end up with infinite loops.
We enable those only on all Kepler and newer GPUs where we use our own
Firmware.
Nvidia's firmware provides a way to set a kernelspace controlled list of
mmio registers in the gr space from push buffers via MME macros.
v2: drop code for gm200 and newer.
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: David Airlie <airlied@gmail.com>
Cc: nouveau@lists.freedesktop.org
Cc: stable@vger.kernel.org # 4.19+
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230622152017.2512101-1-kherbst@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h | 1 +
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c | 4 +++-
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c | 10 ++++++++++
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c | 1 +
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c | 1 +
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c | 1 +
6 files changed, 17 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h
@@ -123,6 +123,7 @@ void gk104_grctx_generate_r418800(struct
extern const struct gf100_grctx_func gk110_grctx;
void gk110_grctx_generate_r419eb0(struct gf100_gr *);
+void gk110_grctx_generate_r419f78(struct gf100_gr *);
extern const struct gf100_grctx_func gk110b_grctx;
extern const struct gf100_grctx_func gk208_grctx;
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
@@ -916,7 +916,9 @@ static void
gk104_grctx_generate_r419f78(struct gf100_gr *gr)
{
struct nvkm_device *device = gr->base.engine.subdev.device;
- nvkm_mask(device, 0x419f78, 0x00000001, 0x00000000);
+
+ /* bit 3 set disables loads in fp helper invocations, we need it enabled */
+ nvkm_mask(device, 0x419f78, 0x00000009, 0x00000000);
}
void
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c
@@ -820,6 +820,15 @@ gk110_grctx_generate_r419eb0(struct gf10
nvkm_mask(device, 0x419eb0, 0x00001000, 0x00001000);
}
+void
+gk110_grctx_generate_r419f78(struct gf100_gr *gr)
+{
+ struct nvkm_device *device = gr->base.engine.subdev.device;
+
+ /* bit 3 set disables loads in fp helper invocations, we need it enabled */
+ nvkm_mask(device, 0x419f78, 0x00000008, 0x00000000);
+}
+
const struct gf100_grctx_func
gk110_grctx = {
.main = gf100_grctx_generate_main,
@@ -852,4 +861,5 @@ gk110_grctx = {
.gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr,
.r418800 = gk104_grctx_generate_r418800,
.r419eb0 = gk110_grctx_generate_r419eb0,
+ .r419f78 = gk110_grctx_generate_r419f78,
};
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c
@@ -101,4 +101,5 @@ gk110b_grctx = {
.gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr,
.r418800 = gk104_grctx_generate_r418800,
.r419eb0 = gk110_grctx_generate_r419eb0,
+ .r419f78 = gk110_grctx_generate_r419f78,
};
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c
@@ -566,4 +566,5 @@ gk208_grctx = {
.dist_skip_table = gf117_grctx_generate_dist_skip_table,
.gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr,
.r418800 = gk104_grctx_generate_r418800,
+ .r419f78 = gk110_grctx_generate_r419f78,
};
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
@@ -991,4 +991,5 @@ gm107_grctx = {
.r406500 = gm107_grctx_generate_r406500,
.gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr,
.r419e00 = gm107_grctx_generate_r419e00,
+ .r419f78 = gk110_grctx_generate_r419f78,
};
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 13/68] drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2023-08-13 21:19 ` [Nouveau] " Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 14/68] drm/amd/display: check attr flag before set cursor degamma on DCN3+ Greg Kroah-Hartman
` (63 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Vetter, Roman Stratiienko,
Boris Brezillon, Thomas Zimmermann
From: Boris Brezillon <boris.brezillon@collabora.com>
commit 07dd476f6116966cb2006e25fdcf48f0715115ff upstream.
The dma-buf backend is supposed to provide its own vm_ops, but some
implementation just have nothing special to do and leave vm_ops
untouched, probably expecting this field to be zero initialized (this
is the case with the system_heap implementation for instance).
Let's reset vma->vm_ops to NULL to keep things working with these
implementations.
Fixes: 26d3ac3cb04d ("drm/shmem-helpers: Redirect mmap for imported dma-buf")
Cc: <stable@vger.kernel.org>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Reported-by: Roman Stratiienko <r.stratiienko@gmail.com>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Tested-by: Roman Stratiienko <r.stratiienko@gmail.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230724112610.60974-1-boris.brezillon@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_gem_shmem_helper.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
+++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
@@ -614,7 +614,13 @@ int drm_gem_shmem_mmap(struct drm_gem_ob
int ret;
if (obj->import_attach) {
+ /* Reset both vm_ops and vm_private_data, so we don't end up with
+ * vm_ops pointing to our implementation if the dma-buf backend
+ * doesn't set those fields.
+ */
vma->vm_private_data = NULL;
+ vma->vm_ops = NULL;
+
ret = dma_buf_mmap(obj->dma_buf, vma, 0);
/* Drop the reference drm_gem_mmap_obj() acquired.*/
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 14/68] drm/amd/display: check attr flag before set cursor degamma on DCN3+
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 13/68] drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap() Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 15/68] hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100 Greg Kroah-Hartman
` (62 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Melissa Wen, Harry Wentland,
Alex Hung, Alex Deucher
From: Melissa Wen <mwen@igalia.com>
commit 96b020e2163fb2197266b2f71b1007495206e6bb upstream.
Don't set predefined degamma curve to cursor plane if the cursor
attribute flag is not set. Applying a degamma curve to the cursor by
default breaks userspace expectation. Checking the flag before
performing any color transformation prevents too dark cursor gamma in
DCN3+ on many Linux desktop environment (KDE Plasma, GNOME,
wlroots-based, etc.) as reported at:
- https://gitlab.freedesktop.org/drm/amd/-/issues/1513
This is the same approach followed by DCN2 drivers where the issue is
not present.
Fixes: 03f54d7d3448 ("drm/amd/display: Add DCN3 DPP")
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/1513
Signed-off-by: Melissa Wen <mwen@igalia.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Tested-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c
@@ -354,8 +354,11 @@ void dpp3_set_cursor_attributes(
int cur_rom_en = 0;
if (color_format == CURSOR_MODE_COLOR_PRE_MULTIPLIED_ALPHA ||
- color_format == CURSOR_MODE_COLOR_UN_PRE_MULTIPLIED_ALPHA)
- cur_rom_en = 1;
+ color_format == CURSOR_MODE_COLOR_UN_PRE_MULTIPLIED_ALPHA) {
+ if (cursor_attributes->attribute_flags.bits.ENABLE_CURSOR_DEGAMMA) {
+ cur_rom_en = 1;
+ }
+ }
REG_UPDATE_3(CURSOR0_CONTROL,
CUR0_MODE, color_format,
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 15/68] hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 14/68] drm/amd/display: check attr flag before set cursor degamma on DCN3+ Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 16/68] radix tree test suite: fix incorrect allocation size for pthreads Greg Kroah-Hartman
` (61 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tao Ren, Guenter Roeck
From: Tao Ren <rentao.bupt@gmail.com>
commit f38963b9cd0645a336cf30c5da2e89e34e34fec3 upstream.
Skip status check for both pfe1100 and pfe3000 because the communication
error is also observed on pfe1100 devices.
Signed-off-by: Tao Ren <rentao.bupt@gmail.com>
Fixes: 626bb2f3fb3c hwmon: (pmbus) add driver for BEL PFE1100 and PFE3000
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230804221403.28931-1-rentao.bupt@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/pmbus/bel-pfe.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/hwmon/pmbus/bel-pfe.c
+++ b/drivers/hwmon/pmbus/bel-pfe.c
@@ -17,12 +17,13 @@
enum chips {pfe1100, pfe3000};
/*
- * Disable status check for pfe3000 devices, because some devices report
- * communication error (invalid command) for VOUT_MODE command (0x20)
- * although correct VOUT_MODE (0x16) is returned: it leads to incorrect
- * exponent in linear mode.
+ * Disable status check because some devices report communication error
+ * (invalid command) for VOUT_MODE command (0x20) although the correct
+ * VOUT_MODE (0x16) is returned: it leads to incorrect exponent in linear
+ * mode.
+ * This affects both pfe3000 and pfe1100.
*/
-static struct pmbus_platform_data pfe3000_plat_data = {
+static struct pmbus_platform_data pfe_plat_data = {
.flags = PMBUS_SKIP_STATUS_CHECK,
};
@@ -94,16 +95,15 @@ static int pfe_pmbus_probe(struct i2c_cl
int model;
model = (int)i2c_match_id(pfe_device_id, client)->driver_data;
+ client->dev.platform_data = &pfe_plat_data;
/*
* PFE3000-12-069RA devices may not stay in page 0 during device
* probe which leads to probe failure (read status word failed).
* So let's set the device to page 0 at the beginning.
*/
- if (model == pfe3000) {
- client->dev.platform_data = &pfe3000_plat_data;
+ if (model == pfe3000)
i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
- }
return pmbus_do_probe(client, &pfe_driver_info[model]);
}
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 16/68] radix tree test suite: fix incorrect allocation size for pthreads
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 15/68] hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100 Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 17/68] x86/pkeys: Revert a5eff7259790 ("x86/pkeys: Add PKRU value to init_fpstate") Greg Kroah-Hartman
` (60 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Colin Ian King,
Konstantin Khlebnikov, Matthew Wilcox (Oracle),
Andrew Morton
From: Colin Ian King <colin.i.king@gmail.com>
commit cac7ea57a06016e4914848b707477fb07ee4ae1c upstream.
Currently the pthread allocation for each array item is based on the size
of a pthread_t pointer and should be the size of the pthread_t structure,
so the allocation is under-allocating the correct size. Fix this by using
the size of each element in the pthreads array.
Static analysis cppcheck reported:
tools/testing/radix-tree/regression1.c:180:2: warning: Size of pointer
'threads' used instead of size of its data. [pointerSize]
Link: https://lkml.kernel.org/r/20230727160930.632674-1-colin.i.king@gmail.com
Fixes: 1366c37ed84b ("radix tree test harness")
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/radix-tree/regression1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/radix-tree/regression1.c
+++ b/tools/testing/radix-tree/regression1.c
@@ -177,7 +177,7 @@ void regression1_test(void)
nr_threads = 2;
pthread_barrier_init(&worker_barrier, NULL, nr_threads);
- threads = malloc(nr_threads * sizeof(pthread_t *));
+ threads = malloc(nr_threads * sizeof(*threads));
for (i = 0; i < nr_threads; i++) {
arg = i;
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 17/68] x86/pkeys: Revert a5eff7259790 ("x86/pkeys: Add PKRU value to init_fpstate")
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 16/68] radix tree test suite: fix incorrect allocation size for pthreads Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 18/68] nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput Greg Kroah-Hartman
` (59 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Gleixner, Borislav Petkov,
Thadeu Lima de Souza Cascardo
From: Thomas Gleixner <tglx@linutronix.de>
commit b3607269ff57fd3c9690cb25962c5e4b91a0fd3b upstream.
This cannot work and it's unclear how that ever made a difference.
init_fpstate.xsave.header.xfeatures is always 0 so get_xsave_addr() will
always return a NULL pointer, which will prevent storing the default PKRU
value in init_fpstate.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20210623121451.451391598@linutronix.de
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/common.c | 5 -----
arch/x86/mm/pkeys.c | 6 ------
2 files changed, 11 deletions(-)
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -472,8 +472,6 @@ static bool pku_disabled;
static __always_inline void setup_pku(struct cpuinfo_x86 *c)
{
- struct pkru_state *pk;
-
/* check the boot processor, plus compile options for PKU: */
if (!cpu_feature_enabled(X86_FEATURE_PKU))
return;
@@ -484,9 +482,6 @@ static __always_inline void setup_pku(st
return;
cr4_set_bits(X86_CR4_PKE);
- pk = get_xsave_addr(&init_fpstate.xsave, XFEATURE_PKRU);
- if (pk)
- pk->pkru = init_pkru_value;
/*
* Seting X86_CR4_PKE will cause the X86_FEATURE_OSPKE
* cpuid bit to be set. We need to ensure that we
--- a/arch/x86/mm/pkeys.c
+++ b/arch/x86/mm/pkeys.c
@@ -10,7 +10,6 @@
#include <asm/cpufeature.h> /* boot_cpu_has, ... */
#include <asm/mmu_context.h> /* vma_pkey() */
-#include <asm/fpu/internal.h> /* init_fpstate */
int __execute_only_pkey(struct mm_struct *mm)
{
@@ -154,7 +153,6 @@ static ssize_t init_pkru_read_file(struc
static ssize_t init_pkru_write_file(struct file *file,
const char __user *user_buf, size_t count, loff_t *ppos)
{
- struct pkru_state *pk;
char buf[32];
ssize_t len;
u32 new_init_pkru;
@@ -177,10 +175,6 @@ static ssize_t init_pkru_write_file(stru
return -EINVAL;
WRITE_ONCE(init_pkru_value, new_init_pkru);
- pk = get_xsave_addr(&init_fpstate.xsave, XFEATURE_PKRU);
- if (!pk)
- return -EINVAL;
- pk->pkru = new_init_pkru;
return count;
}
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 18/68] nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 17/68] x86/pkeys: Revert a5eff7259790 ("x86/pkeys: Add PKRU value to init_fpstate") Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 19/68] io_uring: correct check for O_TMPFILE Greg Kroah-Hartman
` (58 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryusuke Konishi,
syzbot+74db8b3087f293d3a13a, Andrew Morton
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
commit f8654743a0e6909dc634cbfad6db6816f10f3399 upstream.
During unmount process of nilfs2, nothing holds nilfs_root structure after
nilfs2 detaches its writer in nilfs_detach_log_writer(). Previously,
nilfs_evict_inode() could cause use-after-free read for nilfs_root if
inodes are left in "garbage_list" and released by nilfs_dispose_list at
the end of nilfs_detach_log_writer(), and this bug was fixed by commit
9b5a04ac3ad9 ("nilfs2: fix use-after-free bug of nilfs_root in
nilfs_evict_inode()").
However, it turned out that there is another possibility of UAF in the
call path where mark_inode_dirty_sync() is called from iput():
nilfs_detach_log_writer()
nilfs_dispose_list()
iput()
mark_inode_dirty_sync()
__mark_inode_dirty()
nilfs_dirty_inode()
__nilfs_mark_inode_dirty()
nilfs_load_inode_block() --> causes UAF of nilfs_root struct
This can happen after commit 0ae45f63d4ef ("vfs: add support for a
lazytime mount option"), which changed iput() to call
mark_inode_dirty_sync() on its final reference if i_state has I_DIRTY_TIME
flag and i_nlink is non-zero.
This issue appears after commit 28a65b49eb53 ("nilfs2: do not write dirty
data after degenerating to read-only") when using the syzbot reproducer,
but the issue has potentially existed before.
Fix this issue by adding a "purging flag" to the nilfs structure, setting
that flag while disposing the "garbage_list" and checking it in
__nilfs_mark_inode_dirty().
Unlike commit 9b5a04ac3ad9 ("nilfs2: fix use-after-free bug of nilfs_root
in nilfs_evict_inode()"), this patch does not rely on ns_writer to
determine whether to skip operations, so as not to break recovery on
mount. The nilfs_salvage_orphan_logs routine dirties the buffer of
salvaged data before attaching the log writer, so changing
__nilfs_mark_inode_dirty() to skip the operation when ns_writer is NULL
will cause recovery write to fail. The purpose of using the cleanup-only
flag is to allow for narrowing of such conditions.
Link: https://lkml.kernel.org/r/20230728191318.33047-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+74db8b3087f293d3a13a@syzkaller.appspotmail.com
Closes: https://lkml.kernel.org/r/000000000000b4e906060113fd63@google.com
Fixes: 0ae45f63d4ef ("vfs: add support for a lazytime mount option")
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org> # 4.0+
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/inode.c | 8 ++++++++
fs/nilfs2/segment.c | 2 ++
fs/nilfs2/the_nilfs.h | 2 ++
3 files changed, 12 insertions(+)
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -1103,9 +1103,17 @@ int nilfs_set_file_dirty(struct inode *i
int __nilfs_mark_inode_dirty(struct inode *inode, int flags)
{
+ struct the_nilfs *nilfs = inode->i_sb->s_fs_info;
struct buffer_head *ibh;
int err;
+ /*
+ * Do not dirty inodes after the log writer has been detached
+ * and its nilfs_root struct has been freed.
+ */
+ if (unlikely(nilfs_purging(nilfs)))
+ return 0;
+
err = nilfs_load_inode_block(inode, &ibh);
if (unlikely(err)) {
nilfs_warn(inode->i_sb,
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2850,6 +2850,7 @@ void nilfs_detach_log_writer(struct supe
nilfs_segctor_destroy(nilfs->ns_writer);
nilfs->ns_writer = NULL;
}
+ set_nilfs_purging(nilfs);
/* Force to free the list of dirty files */
spin_lock(&nilfs->ns_inode_lock);
@@ -2862,4 +2863,5 @@ void nilfs_detach_log_writer(struct supe
up_write(&nilfs->ns_segctor_sem);
nilfs_dispose_list(nilfs, &garbage_list, 1);
+ clear_nilfs_purging(nilfs);
}
--- a/fs/nilfs2/the_nilfs.h
+++ b/fs/nilfs2/the_nilfs.h
@@ -29,6 +29,7 @@ enum {
THE_NILFS_DISCONTINUED, /* 'next' pointer chain has broken */
THE_NILFS_GC_RUNNING, /* gc process is running */
THE_NILFS_SB_DIRTY, /* super block is dirty */
+ THE_NILFS_PURGING, /* disposing dirty files for cleanup */
};
/**
@@ -208,6 +209,7 @@ THE_NILFS_FNS(INIT, init)
THE_NILFS_FNS(DISCONTINUED, discontinued)
THE_NILFS_FNS(GC_RUNNING, gc_running)
THE_NILFS_FNS(SB_DIRTY, sb_dirty)
+THE_NILFS_FNS(PURGING, purging)
/*
* Mount option operations
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 19/68] io_uring: correct check for O_TMPFILE
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 18/68] nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 20/68] iio: cros_ec: Fix the allocation size for cros_ec_command Greg Kroah-Hartman
` (57 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aleksa Sarai, Jens Axboe
From: Aleksa Sarai <cyphar@cyphar.com>
Commit 72dbde0f2afbe4af8e8595a89c650ae6b9d9c36f upstream.
O_TMPFILE is actually __O_TMPFILE|O_DIRECTORY. This means that the old
check for whether RESOLVE_CACHED can be used would incorrectly think
that O_DIRECTORY could not be used with RESOLVE_CACHED.
Cc: stable@vger.kernel.org # v5.12+
Fixes: 3a81fd02045c ("io_uring: enable LOOKUP_CACHED path resolution for filename lookups")
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Link: https://lore.kernel.org/r/20230807-resolve_cached-o_tmpfile-v3-1-e49323e1ef6f@cyphar.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -4229,9 +4229,11 @@ static int io_openat2(struct io_kiocb *r
if (issue_flags & IO_URING_F_NONBLOCK) {
/*
* Don't bother trying for O_TRUNC, O_CREAT, or O_TMPFILE open,
- * it'll always -EAGAIN
+ * it'll always -EAGAIN. Note that we test for __O_TMPFILE
+ * because O_TMPFILE includes O_DIRECTORY, which isn't a flag
+ * we need to force async for.
*/
- if (req->open.how.flags & (O_TRUNC | O_CREAT | O_TMPFILE))
+ if (req->open.how.flags & (O_TRUNC | O_CREAT | __O_TMPFILE))
return -EAGAIN;
op.lookup_flags |= LOOKUP_CACHED;
op.open_flag |= O_NONBLOCK;
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 20/68] iio: cros_ec: Fix the allocation size for cros_ec_command
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 19/68] io_uring: correct check for O_TMPFILE Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 21/68] binder: fix memory leak in binder_init() Greg Kroah-Hartman
` (56 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tzung-Bi Shih, Yiyuan Guo, Stable,
Jonathan Cameron
From: Yiyuan Guo <yguoaz@gmail.com>
commit 8a4629055ef55177b5b63dab1ecce676bd8cccdd upstream.
The struct cros_ec_command contains several integer fields and a
trailing array. An allocation size neglecting the integer fields can
lead to buffer overrun.
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Yiyuan Guo <yguoaz@gmail.com>
Fixes: 974e6f02e27e ("iio: cros_ec_sensors_core: Add common functions for the ChromeOS EC Sensor Hub.")
Link: https://lore.kernel.org/r/20230630143719.1513906-1-yguoaz@gmail.com
Cc: <Stable@vger.kerenl.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
+++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
@@ -263,7 +263,7 @@ int cros_ec_sensors_core_init(struct pla
platform_set_drvdata(pdev, indio_dev);
state->ec = ec->ec_dev;
- state->msg = devm_kzalloc(&pdev->dev,
+ state->msg = devm_kzalloc(&pdev->dev, sizeof(*state->msg) +
max((u16)sizeof(struct ec_params_motion_sense),
state->ec->max_response), GFP_KERNEL);
if (!state->msg)
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 21/68] binder: fix memory leak in binder_init()
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 20/68] iio: cros_ec: Fix the allocation size for cros_ec_command Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 22/68] usb-storage: alauda: Fix uninit-value in alauda_check_media() Greg Kroah-Hartman
` (55 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qi Zheng, Carlos Llamas, stable
From: Qi Zheng <zhengqi.arch@bytedance.com>
commit adb9743d6a08778b78d62d16b4230346d3508986 upstream.
In binder_init(), the destruction of binder_alloc_shrinker_init() is not
performed in the wrong path, which will cause memory leaks. So this commit
introduces binder_alloc_shrinker_exit() and calls it in the wrong path to
fix that.
Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com>
Acked-by: Carlos Llamas <cmllamas@google.com>
Fixes: f2517eb76f1f ("android: binder: Add global lru shrinker to binder")
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20230625154937.64316-1-qi.zheng@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 1 +
drivers/android/binder_alloc.c | 6 ++++++
drivers/android/binder_alloc.h | 1 +
3 files changed, 8 insertions(+)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -6541,6 +6541,7 @@ err_init_binder_device_failed:
err_alloc_device_names_failed:
debugfs_remove_recursive(binder_debugfs_dir_entry_root);
+ binder_alloc_shrinker_exit();
return ret;
}
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -1086,6 +1086,12 @@ int binder_alloc_shrinker_init(void)
return ret;
}
+void binder_alloc_shrinker_exit(void)
+{
+ unregister_shrinker(&binder_shrinker);
+ list_lru_destroy(&binder_alloc_lru);
+}
+
/**
* check_buffer() - verify that buffer/offset is safe to access
* @alloc: binder_alloc for this proc
--- a/drivers/android/binder_alloc.h
+++ b/drivers/android/binder_alloc.h
@@ -125,6 +125,7 @@ extern struct binder_buffer *binder_allo
int pid);
extern void binder_alloc_init(struct binder_alloc *alloc);
extern int binder_alloc_shrinker_init(void);
+extern void binder_alloc_shrinker_exit(void);
extern void binder_alloc_vma_close(struct binder_alloc *alloc);
extern struct binder_buffer *
binder_alloc_prepare_to_free(struct binder_alloc *alloc,
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 22/68] usb-storage: alauda: Fix uninit-value in alauda_check_media()
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 21/68] binder: fix memory leak in binder_init() Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 23/68] usb: dwc3: Properly handle processing of pending events Greg Kroah-Hartman
` (54 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Alan Stern,
syzbot+e7d46eb426883fb97efd
From: Alan Stern <stern@rowland.harvard.edu>
commit a6ff6e7a9dd69364547751db0f626a10a6d628d2 upstream.
Syzbot got KMSAN to complain about access to an uninitialized value in
the alauda subdriver of usb-storage:
BUG: KMSAN: uninit-value in alauda_transport+0x462/0x57f0
drivers/usb/storage/alauda.c:1137
CPU: 0 PID: 12279 Comm: usb-storage Not tainted 5.3.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x191/0x1f0 lib/dump_stack.c:113
kmsan_report+0x13a/0x2b0 mm/kmsan/kmsan_report.c:108
__msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:250
alauda_check_media+0x344/0x3310 drivers/usb/storage/alauda.c:460
The problem is that alauda_check_media() doesn't verify that its USB
transfer succeeded before trying to use the received data. What
should happen if the transfer fails isn't entirely clear, but a
reasonably conservative approach is to pretend that no media is
present.
A similar problem exists in a usb_stor_dbg() call in
alauda_get_media_status(). In this case, when an error occurs the
call is redundant, because usb_stor_ctrl_transfer() already will print
a debugging message.
Finally, unrelated to the uninitialized memory access, is the fact
that alauda_check_media() performs DMA to a buffer on the stack.
Fortunately usb-storage provides a general purpose DMA-able buffer for
uses like this. We'll use it instead.
Reported-and-tested-by: syzbot+e7d46eb426883fb97efd@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/0000000000007d25ff059457342d@google.com/T/
Suggested-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: e80b0fade09e ("[PATCH] USB Storage: add alauda support")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/693d5d5e-f09b-42d0-8ed9-1f96cd30bcce@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/alauda.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/drivers/usb/storage/alauda.c
+++ b/drivers/usb/storage/alauda.c
@@ -318,7 +318,8 @@ static int alauda_get_media_status(struc
rc = usb_stor_ctrl_transfer(us, us->recv_ctrl_pipe,
command, 0xc0, 0, 1, data, 2);
- usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
+ if (rc == USB_STOR_XFER_GOOD)
+ usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
return rc;
}
@@ -454,9 +455,14 @@ static int alauda_init_media(struct us_d
static int alauda_check_media(struct us_data *us)
{
struct alauda_info *info = (struct alauda_info *) us->extra;
- unsigned char status[2];
+ unsigned char *status = us->iobuf;
+ int rc;
- alauda_get_media_status(us, status);
+ rc = alauda_get_media_status(us, status);
+ if (rc != USB_STOR_XFER_GOOD) {
+ status[0] = 0xF0; /* Pretend there's no media */
+ status[1] = 0;
+ }
/* Check for no media or door open */
if ((status[0] & 0x80) || ((status[0] & 0x1F) == 0x10)
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 23/68] usb: dwc3: Properly handle processing of pending events
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 22/68] usb-storage: alauda: Fix uninit-value in alauda_check_media() Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 24/68] usb: common: usb-conn-gpio: Prevent bailing out if initial role is none Greg Kroah-Hartman
` (53 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Elson Roy Serrao, Thinh Nguyen,
Roger Quadros
From: Elson Roy Serrao <quic_eserrao@quicinc.com>
commit 3ddaa6a274578e23745b7466346fc2650df8f959 upstream.
If dwc3 is runtime suspended we defer processing the event buffer
until resume, by setting the pending_events flag. Set this flag before
triggering resume to avoid race with the runtime resume callback.
While handling the pending events, in addition to checking the event
buffer we also need to process it. Handle this by explicitly calling
dwc3_thread_interrupt(). Also balance the runtime pm get() operation
that triggered this processing.
Cc: stable@vger.kernel.org
Fixes: fc8bb91bc83e ("usb: dwc3: implement runtime PM")
Signed-off-by: Elson Roy Serrao <quic_eserrao@quicinc.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Reviewed-by: Roger Quadros <rogerq@kernel.org>
Link: https://lore.kernel.org/r/20230801192658.19275-1-quic_eserrao@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/gadget.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -3830,9 +3830,14 @@ static irqreturn_t dwc3_check_event_buf(
u32 reg;
if (pm_runtime_suspended(dwc->dev)) {
+ dwc->pending_events = true;
+ /*
+ * Trigger runtime resume. The get() function will be balanced
+ * after processing the pending events in dwc3_process_pending
+ * events().
+ */
pm_runtime_get(dwc->dev);
disable_irq_nosync(dwc->irq_gadget);
- dwc->pending_events = true;
return IRQ_HANDLED;
}
@@ -4091,6 +4096,8 @@ void dwc3_gadget_process_pending_events(
{
if (dwc->pending_events) {
dwc3_interrupt(dwc->irq_gadget, dwc->ev_buf);
+ dwc3_thread_interrupt(dwc->irq_gadget, dwc->ev_buf);
+ pm_runtime_put(dwc->dev);
dwc->pending_events = false;
enable_irq(dwc->irq_gadget);
}
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 24/68] usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 23/68] usb: dwc3: Properly handle processing of pending events Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 25/68] x86/srso: Fix build breakage with the LLVM linker Greg Kroah-Hartman
` (52 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prashanth K,
AngeloGioacchino Del Regno, Heikki Krogerus
From: Prashanth K <quic_prashk@quicinc.com>
commit 8e21a620c7e6e00347ade1a6ed4967b359eada5a upstream.
Currently if we bootup a device without cable connected, then
usb-conn-gpio won't call set_role() because last_role is same
as current role. This happens since last_role gets initialised
to zero during the probe.
To avoid this, add a new flag initial_detection into struct
usb_conn_info, which prevents bailing out during initial
detection.
Cc: <stable@vger.kernel.org> # 5.4
Fixes: 4602f3bff266 ("usb: common: add USB GPIO based connection detection driver")
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Tested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/1690880632-12588-1-git-send-email-quic_prashk@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/common/usb-conn-gpio.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/usb/common/usb-conn-gpio.c
+++ b/drivers/usb/common/usb-conn-gpio.c
@@ -42,6 +42,7 @@ struct usb_conn_info {
struct power_supply_desc desc;
struct power_supply *charger;
+ bool initial_detection;
};
/*
@@ -86,11 +87,13 @@ static void usb_conn_detect_cable(struct
dev_dbg(info->dev, "role %d/%d, gpios: id %d, vbus %d\n",
info->last_role, role, id, vbus);
- if (info->last_role == role) {
+ if (!info->initial_detection && info->last_role == role) {
dev_warn(info->dev, "repeated role: %d\n", role);
return;
}
+ info->initial_detection = false;
+
if (info->last_role == USB_ROLE_HOST && info->vbus)
regulator_disable(info->vbus);
@@ -277,6 +280,7 @@ static int usb_conn_probe(struct platfor
platform_set_drvdata(pdev, info);
/* Perform initial detection */
+ info->initial_detection = true;
usb_conn_queue_dwork(info, 0);
return 0;
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 25/68] x86/srso: Fix build breakage with the LLVM linker
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 24/68] usb: common: usb-conn-gpio: Prevent bailing out if initial role is none Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 26/68] x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 Greg Kroah-Hartman
` (51 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Daniel Kolesa,
Naresh Kamboju, Sven Volkinsfeld, Nick Desaulniers,
Borislav Petkov (AMD)
From: Nick Desaulniers <ndesaulniers@google.com>
commit cbe8ded48b939b9d55d2c5589ab56caa7b530709 upstream.
The assertion added to verify the difference in bits set of the
addresses of srso_untrain_ret_alias() and srso_safe_ret_alias() would fail
to link in LLVM's ld.lld linker with the following error:
ld.lld: error: ./arch/x86/kernel/vmlinux.lds:210: at least one side of
the expression must be absolute
ld.lld: error: ./arch/x86/kernel/vmlinux.lds:211: at least one side of
the expression must be absolute
Use ABSOLUTE to evaluate the expression referring to at least one of the
symbols so that LLD can evaluate the linker script.
Also, add linker version info to the comment about XOR being unsupported
in either ld.bfd or ld.lld until somewhat recently.
Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
Closes: https://lore.kernel.org/llvm/CA+G9fYsdUeNu-gwbs0+T6XHi4hYYk=Y9725-wFhZ7gJMspLDRA@mail.gmail.com/
Reported-by: Nathan Chancellor <nathan@kernel.org>
Reported-by: Daniel Kolesa <daniel@octaforge.org>
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Suggested-by: Sven Volkinsfeld <thyrc@gmx.net>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://github.com/ClangBuiltLinux/linux/issues/1907
Link: https://lore.kernel.org/r/20230809-gds-v1-1-eaac90b0cbcc@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/vmlinux.lds.S | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -524,11 +524,17 @@ INIT_PER_CPU(irq_stack_backing_store);
#ifdef CONFIG_CPU_SRSO
/*
- * GNU ld cannot do XOR so do: (A | B) - (A & B) in order to compute the XOR
+ * GNU ld cannot do XOR until 2.41.
+ * https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=f6f78318fca803c4907fb8d7f6ded8295f1947b1
+ *
+ * LLVM lld cannot do XOR until lld-17.
+ * https://github.com/llvm/llvm-project/commit/fae96104d4378166cbe5c875ef8ed808a356f3fb
+ *
+ * Instead do: (A | B) - (A & B) in order to compute the XOR
* of the two function addresses:
*/
-. = ASSERT(((srso_untrain_ret_alias | srso_safe_ret_alias) -
- (srso_untrain_ret_alias & srso_safe_ret_alias)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)),
+. = ASSERT(((ABSOLUTE(srso_untrain_ret_alias) | srso_safe_ret_alias) -
+ (ABSOLUTE(srso_untrain_ret_alias) & srso_safe_ret_alias)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)),
"SRSO function pair won't alias");
#endif
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 26/68] x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 25/68] x86/srso: Fix build breakage with the LLVM linker Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 27/68] x86/mm: Fix VDSO and VVAR placement on 5-level paging machines Greg Kroah-Hartman
` (50 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Ciocaltea, Borislav Petkov (AMD)
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
commit 6dbef74aeb090d6bee7d64ef3fa82ae6fa53f271 upstream.
Commit
522b1d69219d ("x86/cpu/amd: Add a Zenbleed fix")
provided a fix for the Zen2 VZEROUPPER data corruption bug affecting
a range of CPU models, but the AMD Custom APU 0405 found on SteamDeck
was not listed, although it is clearly affected by the vulnerability.
Add this CPU variant to the Zenbleed erratum list, in order to
unconditionally enable the fallback fix until a proper microcode update
is available.
Fixes: 522b1d69219d ("x86/cpu/amd: Add a Zenbleed fix")
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230811203705.1699914-1-cristian.ciocaltea@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/amd.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -74,6 +74,7 @@ static const int amd_erratum_1054[] =
static const int amd_zenbleed[] =
AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0x30, 0x0, 0x4f, 0xf),
AMD_MODEL_RANGE(0x17, 0x60, 0x0, 0x7f, 0xf),
+ AMD_MODEL_RANGE(0x17, 0x90, 0x0, 0x91, 0xf),
AMD_MODEL_RANGE(0x17, 0xa0, 0x0, 0xaf, 0xf));
static const int amd_div0[] =
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 27/68] x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 26/68] x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 28/68] x86/speculation: Add cpu_show_gds() prototype Greg Kroah-Hartman
` (49 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yingcong Wu, Kirill A. Shutemov,
Dave Hansen
From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
commit 1b8b1aa90c9c0e825b181b98b8d9e249dc395470 upstream.
Yingcong has noticed that on the 5-level paging machine, VDSO and VVAR
VMAs are placed above the 47-bit border:
8000001a9000-8000001ad000 r--p 00000000 00:00 0 [vvar]
8000001ad000-8000001af000 r-xp 00000000 00:00 0 [vdso]
This might confuse users who are not aware of 5-level paging and expect
all userspace addresses to be under the 47-bit border.
So far problem has only been triggered with ASLR disabled, although it
may also occur with ASLR enabled if the layout is randomized in a just
right way.
The problem happens due to custom placement for the VMAs in the VDSO
code: vdso_addr() tries to place them above the stack and checks the
result against TASK_SIZE_MAX, which is wrong. TASK_SIZE_MAX is set to
the 56-bit border on 5-level paging machines. Use DEFAULT_MAP_WINDOW
instead.
Fixes: b569bab78d8d ("x86/mm: Prepare to expose larger address space to userspace")
Reported-by: Yingcong Wu <yingcong.wu@intel.com>
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20230803151609.22141-1-kirill.shutemov%40linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/entry/vdso/vma.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/entry/vdso/vma.c
+++ b/arch/x86/entry/vdso/vma.c
@@ -339,8 +339,8 @@ static unsigned long vdso_addr(unsigned
/* Round the lowest possible end address up to a PMD boundary. */
end = (start + len + PMD_SIZE - 1) & PMD_MASK;
- if (end >= TASK_SIZE_MAX)
- end = TASK_SIZE_MAX;
+ if (end >= DEFAULT_MAP_WINDOW)
+ end = DEFAULT_MAP_WINDOW;
end -= len;
if (end > start) {
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 28/68] x86/speculation: Add cpu_show_gds() prototype
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 27/68] x86/mm: Fix VDSO and VVAR placement on 5-level paging machines Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 29/68] x86: Move gds_ucode_mitigated() declaration to header Greg Kroah-Hartman
` (48 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Dave Hansen,
Daniel Sneddon, stable
From: Arnd Bergmann <arnd@arndb.de>
commit a57c27c7ad85c420b7de44c6ee56692d51709dda upstream.
The newly added function has two definitions but no prototypes:
drivers/base/cpu.c:605:16: error: no previous prototype for 'cpu_show_gds' [-Werror=missing-prototypes]
Add a declaration next to the other ones for this file to avoid the
warning.
Fixes: 8974eb588283b ("x86/speculation: Add Gather Data Sampling mitigation")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Tested-by: Daniel Sneddon <daniel.sneddon@linux.intel.com>
Cc: stable@kernel.org
Link: https://lore.kernel.org/all/20230809130530.1913368-1-arnd%40kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/cpu.h | 2 ++
1 file changed, 2 insertions(+)
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -72,6 +72,8 @@ extern ssize_t cpu_show_retbleed(struct
struct device_attribute *attr, char *buf);
extern ssize_t cpu_show_spec_rstack_overflow(struct device *dev,
struct device_attribute *attr, char *buf);
+extern ssize_t cpu_show_gds(struct device *dev,
+ struct device_attribute *attr, char *buf);
extern __printf(4, 5)
struct device *cpu_device_create(struct device *parent, void *drvdata,
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 29/68] x86: Move gds_ucode_mitigated() declaration to header
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 28/68] x86/speculation: Add cpu_show_gds() prototype Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 30/68] drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes Greg Kroah-Hartman
` (47 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Dave Hansen,
Daniel Sneddon, stable
From: Arnd Bergmann <arnd@arndb.de>
commit eb3515dc99c7c85f4170b50838136b2a193f8012 upstream.
The declaration got placed in the .c file of the caller, but that
causes a warning for the definition:
arch/x86/kernel/cpu/bugs.c:682:6: error: no previous prototype for 'gds_ucode_mitigated' [-Werror=missing-prototypes]
Move it to a header where both sides can observe it instead.
Fixes: 81ac7e5d74174 ("KVM: Add GDS_NO support to KVM")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Tested-by: Daniel Sneddon <daniel.sneddon@linux.intel.com>
Cc: stable@kernel.org
Link: https://lore.kernel.org/all/20230809130530.1913368-2-arnd%40kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/processor.h | 2 ++
arch/x86/kvm/x86.c | 2 --
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -864,4 +864,6 @@ enum mds_mitigations {
MDS_MITIGATION_VMWERV,
};
+extern bool gds_ucode_mitigated(void);
+
#endif /* _ASM_X86_PROCESSOR_H */
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -255,8 +255,6 @@ static struct kmem_cache *x86_fpu_cache;
static struct kmem_cache *x86_emulator_cache;
-extern bool gds_ucode_mitigated(void);
-
/*
* When called, it means the previous get/set msr reached an invalid msr.
* Return true if we want to ignore/silent this failed msr access.
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 30/68] drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 29/68] x86: Move gds_ucode_mitigated() declaration to header Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 31/68] netfilter: nf_tables: dont skip expired elements during walk Greg Kroah-Hartman
` (46 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Olaf Skibbe, Lyude Paul, Karol Herbst
From: Karol Herbst <kherbst@redhat.com>
commit d5712cd22b9cf109fded1b7f178f4c1888c8b84b upstream.
The original commit adding that check tried to protect the kenrel against
a potential invalid NULL pointer access.
However we call nouveau_connector_detect_depth once without a native_mode
set on purpose for non LVDS connectors and this broke DP support in a few
cases.
Cc: Olaf Skibbe <news@kravcenko.com>
Cc: Lyude Paul <lyude@redhat.com>
Closes: https://gitlab.freedesktop.org/drm/nouveau/-/issues/238
Closes: https://gitlab.freedesktop.org/drm/nouveau/-/issues/245
Fixes: 20a2ce87fbaf8 ("drm/nouveau/dp: check for NULL nv_connector->native_mode")
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230805101813.2603989-1-kherbst@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -947,7 +947,7 @@ nouveau_connector_get_modes(struct drm_c
/* Determine display colour depth for everything except LVDS now,
* DP requires this before mode_valid() is called.
*/
- if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS && nv_connector->native_mode)
+ if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS)
nouveau_connector_detect_depth(connector);
/* Find the native mode if this is a digital panel, if we didn't
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 31/68] netfilter: nf_tables: dont skip expired elements during walk
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 30/68] drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 32/68] selftests/rseq: Fix build with undefined __weak Greg Kroah-Hartman
` (45 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso
From: Florian Westphal <fw@strlen.de>
commit 24138933b97b055d486e8064b4a1721702442a9b upstream.
There is an asymmetry between commit/abort and preparation phase if the
following conditions are met:
1. set is a verdict map ("1.2.3.4 : jump foo")
2. timeouts are enabled
In this case, following sequence is problematic:
1. element E in set S refers to chain C
2. userspace requests removal of set S
3. kernel does a set walk to decrement chain->use count for all elements
from preparation phase
4. kernel does another set walk to remove elements from the commit phase
(or another walk to do a chain->use increment for all elements from
abort phase)
If E has already expired in 1), it will be ignored during list walk, so its use count
won't have been changed.
Then, when set is culled, ->destroy callback will zap the element via
nf_tables_set_elem_destroy(), but this function is only safe for
elements that have been deactivated earlier from the preparation phase:
lack of earlier deactivate removes the element but leaks the chain use
count, which results in a WARN splat when the chain gets removed later,
plus a leak of the nft_chain structure.
Update pipapo_get() not to skip expired elements, otherwise flush
command reports bogus ENOENT errors.
Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Fixes: 8d8540c4f5e0 ("netfilter: nft_set_rbtree: add timeout support")
Fixes: 9d0982927e79 ("netfilter: nft_hash: add support for timeouts")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_tables_api.c | 4 ++++
net/netfilter/nft_set_hash.c | 2 --
net/netfilter/nft_set_pipapo.c | 18 ++++++++++++------
net/netfilter/nft_set_rbtree.c | 2 --
4 files changed, 16 insertions(+), 10 deletions(-)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4911,8 +4911,12 @@ static int nf_tables_dump_setelem(const
const struct nft_set_iter *iter,
struct nft_set_elem *elem)
{
+ const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
struct nft_set_dump_args *args;
+ if (nft_set_elem_expired(ext))
+ return 0;
+
args = container_of(iter, struct nft_set_dump_args, iter);
return nf_tables_fill_setelem(args->skb, set, elem);
}
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -277,8 +277,6 @@ static void nft_rhash_walk(const struct
if (iter->count < iter->skip)
goto cont;
- if (nft_set_elem_expired(&he->ext))
- goto cont;
if (!nft_set_elem_active(&he->ext, iter->genmask))
goto cont;
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -566,8 +566,7 @@ next_match:
goto out;
if (last) {
- if (nft_set_elem_expired(&f->mt[b].e->ext) ||
- (genmask &&
+ if ((genmask &&
!nft_set_elem_active(&f->mt[b].e->ext, genmask)))
goto next_match;
@@ -601,8 +600,17 @@ out:
static void *nft_pipapo_get(const struct net *net, const struct nft_set *set,
const struct nft_set_elem *elem, unsigned int flags)
{
- return pipapo_get(net, set, (const u8 *)elem->key.val.data,
- nft_genmask_cur(net));
+ struct nft_pipapo_elem *ret;
+
+ ret = pipapo_get(net, set, (const u8 *)elem->key.val.data,
+ nft_genmask_cur(net));
+ if (IS_ERR(ret))
+ return ret;
+
+ if (nft_set_elem_expired(&ret->ext))
+ return ERR_PTR(-ENOENT);
+
+ return ret;
}
/**
@@ -1981,8 +1989,6 @@ static void nft_pipapo_walk(const struct
goto cont;
e = f->mt[r].e;
- if (nft_set_elem_expired(&e->ext))
- goto cont;
elem.priv = e;
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -551,8 +551,6 @@ static void nft_rbtree_walk(const struct
if (iter->count < iter->skip)
goto cont;
- if (nft_set_elem_expired(&rbe->ext))
- goto cont;
if (!nft_set_elem_active(&rbe->ext, iter->genmask))
goto cont;
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 32/68] selftests/rseq: Fix build with undefined __weak
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 31/68] netfilter: nf_tables: dont skip expired elements during walk Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 33/68] selftests: forwarding: Add a helper to skip test when using veth pairs Greg Kroah-Hartman
` (44 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mark Brown, Paolo Bonzini
From: Mark Brown <broonie@kernel.org>
commit d5ad9aae13dcced333c1a7816ff0a4fbbb052466 upstream.
Commit 3bcbc20942db ("selftests/rseq: Play nice with binaries statically
linked against glibc 2.35+") which is now in Linus' tree introduced uses
of __weak but did nothing to ensure that a definition is provided for it
resulting in build failures for the rseq tests:
rseq.c:41:1: error: unknown type name '__weak'
__weak ptrdiff_t __rseq_offset;
^
rseq.c:41:17: error: expected ';' after top level declarator
__weak ptrdiff_t __rseq_offset;
^
;
rseq.c:42:1: error: unknown type name '__weak'
__weak unsigned int __rseq_size;
^
rseq.c:43:1: error: unknown type name '__weak'
__weak unsigned int __rseq_flags;
Fix this by using the definition from tools/include compiler.h.
Fixes: 3bcbc20942db ("selftests/rseq: Play nice with binaries statically linked against glibc 2.35+")
Signed-off-by: Mark Brown <broonie@kernel.org>
Message-Id: <20230804-kselftest-rseq-build-v1-1-015830b66aa9@kernel.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/rseq/Makefile | 4 +++-
tools/testing/selftests/rseq/rseq.c | 2 ++
2 files changed, 5 insertions(+), 1 deletion(-)
--- a/tools/testing/selftests/rseq/Makefile
+++ b/tools/testing/selftests/rseq/Makefile
@@ -4,8 +4,10 @@ ifneq ($(shell $(CC) --version 2>&1 | he
CLANG_FLAGS += -no-integrated-as
endif
+top_srcdir = ../../../..
+
CFLAGS += -O2 -Wall -g -I./ -I../../../../usr/include/ -L$(OUTPUT) -Wl,-rpath=./ \
- $(CLANG_FLAGS)
+ $(CLANG_FLAGS) -I$(top_srcdir)/tools/include
LDLIBS += -lpthread -ldl
# Own dependencies because we only want to build against 1st prerequisite, but
--- a/tools/testing/selftests/rseq/rseq.c
+++ b/tools/testing/selftests/rseq/rseq.c
@@ -29,6 +29,8 @@
#include <dlfcn.h>
#include <stddef.h>
+#include <linux/compiler.h>
+
#include "../kselftest.h"
#include "rseq.h"
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 33/68] selftests: forwarding: Add a helper to skip test when using veth pairs
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 32/68] selftests/rseq: Fix build with undefined __weak Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 34/68] selftests: forwarding: ethtool: Skip " Greg Kroah-Hartman
` (43 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Petr Machata,
Mirsad Todorovac, Hangbin Liu, Nikolay Aleksandrov,
Jakub Kicinski
From: Ido Schimmel <idosch@nvidia.com>
commit 66e131861ab7bf754b50813216f5c6885cd32d63 upstream.
A handful of tests require physical loopbacks to be used instead of veth
pairs. Add a helper that these tests will invoke in order to be skipped
when executed with veth pairs.
Fixes: 64916b57c0b1 ("selftests: forwarding: Add speed and auto-negotiation test")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Tested-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://lore.kernel.org/r/20230808141503.4060661-7-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/forwarding/lib.sh | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/tools/testing/selftests/net/forwarding/lib.sh
+++ b/tools/testing/selftests/net/forwarding/lib.sh
@@ -69,6 +69,17 @@ check_tc_action_hw_stats_support()
fi
}
+skip_on_veth()
+{
+ local kind=$(ip -j -d link show dev ${NETIFS[p1]} |
+ jq -r '.[].linkinfo.info_kind')
+
+ if [[ $kind == veth ]]; then
+ echo "SKIP: Test cannot be run with veth pairs"
+ exit $ksft_skip
+ fi
+}
+
if [[ "$(id -u)" -ne 0 ]]; then
echo "SKIP: need root privileges"
exit 0
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 34/68] selftests: forwarding: ethtool: Skip when using veth pairs
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 33/68] selftests: forwarding: Add a helper to skip test when using veth pairs Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 35/68] selftests: forwarding: ethtool_extended_state: " Greg Kroah-Hartman
` (42 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mirsad Todorovac, Ido Schimmel,
Petr Machata, Hangbin Liu, Nikolay Aleksandrov, Jakub Kicinski
From: Ido Schimmel <idosch@nvidia.com>
commit 60a36e21915c31c0375d9427be9406aa8ce2ec34 upstream.
Auto-negotiation cannot be tested with veth pairs, resulting in
failures:
# ./ethtool.sh
TEST: force of same speed autoneg off [FAIL]
error in configuration. swp1 speed Not autoneg off
[...]
Fix by skipping the test when used with veth pairs.
Fixes: 64916b57c0b1 ("selftests: forwarding: Add speed and auto-negotiation test")
Reported-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Tested-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://lore.kernel.org/r/20230808141503.4060661-8-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/forwarding/ethtool.sh | 2 ++
1 file changed, 2 insertions(+)
--- a/tools/testing/selftests/net/forwarding/ethtool.sh
+++ b/tools/testing/selftests/net/forwarding/ethtool.sh
@@ -286,6 +286,8 @@ different_speeds_autoneg_on()
ethtool -s $h1 autoneg on
}
+skip_on_veth
+
trap cleanup EXIT
setup_prepare
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 35/68] selftests: forwarding: ethtool_extended_state: Skip when using veth pairs
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 34/68] selftests: forwarding: ethtool: Skip " Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 36/68] selftests: forwarding: Skip test when no interfaces are specified Greg Kroah-Hartman
` (41 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mirsad Todorovac, Ido Schimmel,
Petr Machata, Hangbin Liu, Nikolay Aleksandrov, Jakub Kicinski
From: Ido Schimmel <idosch@nvidia.com>
commit b3d9305e60d121dac20a77b6847c4cf14a4c0001 upstream.
Ethtool extended state cannot be tested with veth pairs, resulting in
failures:
# ./ethtool_extended_state.sh
TEST: Autoneg, No partner detected [FAIL]
Expected "Autoneg", got "Link detected: no"
[...]
Fix by skipping the test when used with veth pairs.
Fixes: 7d10bcce98cd ("selftests: forwarding: Add tests for ethtool extended state")
Reported-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Tested-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://lore.kernel.org/r/20230808141503.4060661-9-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/forwarding/ethtool_extended_state.sh | 2 ++
1 file changed, 2 insertions(+)
--- a/tools/testing/selftests/net/forwarding/ethtool_extended_state.sh
+++ b/tools/testing/selftests/net/forwarding/ethtool_extended_state.sh
@@ -95,6 +95,8 @@ no_cable()
ip link set dev $swp3 down
}
+skip_on_veth
+
setup_prepare
tests_run
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 36/68] selftests: forwarding: Skip test when no interfaces are specified
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 35/68] selftests: forwarding: ethtool_extended_state: " Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 37/68] selftests: forwarding: Switch off timeout Greg Kroah-Hartman
` (40 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mirsad Todorovac, Ido Schimmel,
Petr Machata, Hangbin Liu, Nikolay Aleksandrov, Jakub Kicinski
From: Ido Schimmel <idosch@nvidia.com>
commit d72c83b1e4b4a36a38269c77a85ff52f95eb0d08 upstream.
As explained in [1], the forwarding selftests are meant to be run with
either physical loopbacks or veth pairs. The interfaces are expected to
be specified in a user-provided forwarding.config file or as command
line arguments. By default, this file is not present and the tests fail:
# make -C tools/testing/selftests TARGETS=net/forwarding run_tests
[...]
TAP version 13
1..102
# timeout set to 45
# selftests: net/forwarding: bridge_igmp.sh
# Command line is not complete. Try option "help"
# Failed to create netif
not ok 1 selftests: net/forwarding: bridge_igmp.sh # exit=1
[...]
Fix by skipping a test if interfaces are not provided either via the
configuration file or command line arguments.
# make -C tools/testing/selftests TARGETS=net/forwarding run_tests
[...]
TAP version 13
1..102
# timeout set to 45
# selftests: net/forwarding: bridge_igmp.sh
# SKIP: Cannot create interface. Name not specified
ok 1 selftests: net/forwarding: bridge_igmp.sh # SKIP
[1] tools/testing/selftests/net/forwarding/README
Fixes: 81573b18f26d ("selftests/net/forwarding: add Makefile to install tests")
Reported-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Closes: https://lore.kernel.org/netdev/856d454e-f83c-20cf-e166-6dc06cbc1543@alu.unizg.hr/
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Tested-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://lore.kernel.org/r/20230808141503.4060661-2-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/forwarding/lib.sh | 5 +++++
1 file changed, 5 insertions(+)
--- a/tools/testing/selftests/net/forwarding/lib.sh
+++ b/tools/testing/selftests/net/forwarding/lib.sh
@@ -132,6 +132,11 @@ create_netif_veth()
for ((i = 1; i <= NUM_NETIFS; ++i)); do
local j=$((i+1))
+ if [ -z ${NETIFS[p$i]} ]; then
+ echo "SKIP: Cannot create interface. Name not specified"
+ exit $ksft_skip
+ fi
+
ip link show dev ${NETIFS[p$i]} &> /dev/null
if [[ $? -ne 0 ]]; then
ip link add ${NETIFS[p$i]} type veth \
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 37/68] selftests: forwarding: Switch off timeout
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 36/68] selftests: forwarding: Skip test when no interfaces are specified Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 38/68] selftests: forwarding: tc_flower: Relax success criterion Greg Kroah-Hartman
` (39 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mirsad Todorovac, Ido Schimmel,
Petr Machata, Hangbin Liu, Nikolay Aleksandrov, Jakub Kicinski
From: Ido Schimmel <idosch@nvidia.com>
commit 0529883ad102f6c04e19fb7018f31e1bda575bbe upstream.
The default timeout for selftests is 45 seconds, but it is not enough
for forwarding selftests which can takes minutes to finish depending on
the number of tests cases:
# make -C tools/testing/selftests TARGETS=net/forwarding run_tests
TAP version 13
1..102
# timeout set to 45
# selftests: net/forwarding: bridge_igmp.sh
# TEST: IGMPv2 report 239.10.10.10 [ OK ]
# TEST: IGMPv2 leave 239.10.10.10 [ OK ]
# TEST: IGMPv3 report 239.10.10.10 is_include [ OK ]
# TEST: IGMPv3 report 239.10.10.10 include -> allow [ OK ]
#
not ok 1 selftests: net/forwarding: bridge_igmp.sh # TIMEOUT 45 seconds
Fix by switching off the timeout and setting it to 0. A similar change
was done for BPF selftests in commit 6fc5916cc256 ("selftests: bpf:
Switch off timeout").
Fixes: 81573b18f26d ("selftests/net/forwarding: add Makefile to install tests")
Reported-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Closes: https://lore.kernel.org/netdev/8d149f8c-818e-d141-a0ce-a6bae606bc22@alu.unizg.hr/
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Tested-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://lore.kernel.org/r/20230808141503.4060661-3-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/forwarding/settings | 1 +
1 file changed, 1 insertion(+)
create mode 100644 tools/testing/selftests/net/forwarding/settings
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/settings
@@ -0,0 +1 @@
+timeout=0
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 38/68] selftests: forwarding: tc_flower: Relax success criterion
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 37/68] selftests: forwarding: Switch off timeout Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 39/68] mISDN: Update parameter type of dsp_cmx_send() Greg Kroah-Hartman
` (38 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mirsad Todorovac, Ido Schimmel,
Petr Machata, Hangbin Liu, Nikolay Aleksandrov, Jakub Kicinski
From: Ido Schimmel <idosch@nvidia.com>
commit 9ee37e53e7687654b487fc94e82569377272a7a8 upstream.
The test checks that filters that match on source or destination MAC
were only hit once. A host can send more than one packet with a given
source or destination MAC, resulting in failures.
Fix by relaxing the success criterion and instead check that the filters
were not hit zero times. Using tc_check_at_least_x_packets() is also an
option, but it is not available in older kernels.
Fixes: 07e5c75184a1 ("selftests: forwarding: Introduce tc flower matching tests")
Reported-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Tested-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://lore.kernel.org/r/20230808141503.4060661-13-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/forwarding/tc_flower.sh | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/tools/testing/selftests/net/forwarding/tc_flower.sh
+++ b/tools/testing/selftests/net/forwarding/tc_flower.sh
@@ -49,8 +49,8 @@ match_dst_mac_test()
tc_check_packets "dev $h2 ingress" 101 1
check_fail $? "Matched on a wrong filter"
- tc_check_packets "dev $h2 ingress" 102 1
- check_err $? "Did not match on correct filter"
+ tc_check_packets "dev $h2 ingress" 102 0
+ check_fail $? "Did not match on correct filter"
tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
@@ -75,8 +75,8 @@ match_src_mac_test()
tc_check_packets "dev $h2 ingress" 101 1
check_fail $? "Matched on a wrong filter"
- tc_check_packets "dev $h2 ingress" 102 1
- check_err $? "Did not match on correct filter"
+ tc_check_packets "dev $h2 ingress" 102 0
+ check_fail $? "Did not match on correct filter"
tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 39/68] mISDN: Update parameter type of dsp_cmx_send()
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 38/68] selftests: forwarding: tc_flower: Relax success criterion Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 40/68] net/packet: annotate data-races around tp->status Greg Kroah-Hartman
` (37 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot,
Nathan Chancellor, Sami Tolvanen, Kees Cook, Jakub Kicinski
From: Nathan Chancellor <nathan@kernel.org>
commit 1696ec8654016dad3b1baf6c024303e584400453 upstream.
When booting a kernel with CONFIG_MISDN_DSP=y and CONFIG_CFI_CLANG=y,
there is a failure when dsp_cmx_send() is called indirectly from
call_timer_fn():
[ 0.371412] CFI failure at call_timer_fn+0x2f/0x150 (target: dsp_cmx_send+0x0/0x530; expected type: 0x92ada1e9)
The function pointer prototype that call_timer_fn() expects is
void (*fn)(struct timer_list *)
whereas dsp_cmx_send() has a parameter type of 'void *', which causes
the control flow integrity checks to fail because the parameter types do
not match.
Change dsp_cmx_send()'s parameter type to be 'struct timer_list' to
match the expected prototype. The argument is unused anyways, so this
has no functional change, aside from avoiding the CFI failure.
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202308020936.58787e6c-oliver.sang@intel.com
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Fixes: e313ac12eb13 ("mISDN: Convert timers to use timer_setup()")
Link: https://lore.kernel.org/r/20230802-fix-dsp_cmx_send-cfi-failure-v1-1-2f2e79b0178d@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/isdn/mISDN/dsp.h | 2 +-
drivers/isdn/mISDN/dsp_cmx.c | 2 +-
drivers/isdn/mISDN/dsp_core.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/isdn/mISDN/dsp.h
+++ b/drivers/isdn/mISDN/dsp.h
@@ -247,7 +247,7 @@ extern void dsp_cmx_hardware(struct dsp_
extern int dsp_cmx_conf(struct dsp *dsp, u32 conf_id);
extern void dsp_cmx_receive(struct dsp *dsp, struct sk_buff *skb);
extern void dsp_cmx_hdlc(struct dsp *dsp, struct sk_buff *skb);
-extern void dsp_cmx_send(void *arg);
+extern void dsp_cmx_send(struct timer_list *arg);
extern void dsp_cmx_transmit(struct dsp *dsp, struct sk_buff *skb);
extern int dsp_cmx_del_conf_member(struct dsp *dsp);
extern int dsp_cmx_del_conf(struct dsp_conf *conf);
--- a/drivers/isdn/mISDN/dsp_cmx.c
+++ b/drivers/isdn/mISDN/dsp_cmx.c
@@ -1625,7 +1625,7 @@ static u16 dsp_count; /* last sample cou
static int dsp_count_valid; /* if we have last sample count */
void
-dsp_cmx_send(void *arg)
+dsp_cmx_send(struct timer_list *arg)
{
struct dsp_conf *conf;
struct dsp_conf_member *member;
--- a/drivers/isdn/mISDN/dsp_core.c
+++ b/drivers/isdn/mISDN/dsp_core.c
@@ -1200,7 +1200,7 @@ static int __init dsp_init(void)
}
/* set sample timer */
- timer_setup(&dsp_spl_tl, (void *)dsp_cmx_send, 0);
+ timer_setup(&dsp_spl_tl, dsp_cmx_send, 0);
dsp_spl_tl.expires = jiffies + dsp_tics;
dsp_spl_jiffies = dsp_spl_tl.expires;
add_timer(&dsp_spl_tl);
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 40/68] net/packet: annotate data-races around tp->status
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 39/68] mISDN: Update parameter type of dsp_cmx_send() Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 41/68] tunnels: fix kasan splat when generating ipv4 pmtu error Greg Kroah-Hartman
` (36 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet,
Willem de Bruijn, Jakub Kicinski
From: Eric Dumazet <edumazet@google.com>
commit 8a9896177784063d01068293caea3f74f6830ff6 upstream.
Another syzbot report [1] is about tp->status lockless reads
from __packet_get_status()
[1]
BUG: KCSAN: data-race in __packet_rcv_has_room / __packet_set_status
write to 0xffff888117d7c080 of 8 bytes by interrupt on cpu 0:
__packet_set_status+0x78/0xa0 net/packet/af_packet.c:407
tpacket_rcv+0x18bb/0x1a60 net/packet/af_packet.c:2483
deliver_skb net/core/dev.c:2173 [inline]
__netif_receive_skb_core+0x408/0x1e80 net/core/dev.c:5337
__netif_receive_skb_one_core net/core/dev.c:5491 [inline]
__netif_receive_skb+0x57/0x1b0 net/core/dev.c:5607
process_backlog+0x21f/0x380 net/core/dev.c:5935
__napi_poll+0x60/0x3b0 net/core/dev.c:6498
napi_poll net/core/dev.c:6565 [inline]
net_rx_action+0x32b/0x750 net/core/dev.c:6698
__do_softirq+0xc1/0x265 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x57/0xa0 kernel/softirq.c:650
sysvec_apic_timer_interrupt+0x6d/0x80 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
smpboot_thread_fn+0x33c/0x4a0 kernel/smpboot.c:112
kthread+0x1d7/0x210 kernel/kthread.c:379
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
read to 0xffff888117d7c080 of 8 bytes by interrupt on cpu 1:
__packet_get_status net/packet/af_packet.c:436 [inline]
packet_lookup_frame net/packet/af_packet.c:524 [inline]
__tpacket_has_room net/packet/af_packet.c:1255 [inline]
__packet_rcv_has_room+0x3f9/0x450 net/packet/af_packet.c:1298
tpacket_rcv+0x275/0x1a60 net/packet/af_packet.c:2285
deliver_skb net/core/dev.c:2173 [inline]
dev_queue_xmit_nit+0x38a/0x5e0 net/core/dev.c:2243
xmit_one net/core/dev.c:3574 [inline]
dev_hard_start_xmit+0xcf/0x3f0 net/core/dev.c:3594
__dev_queue_xmit+0xefb/0x1d10 net/core/dev.c:4244
dev_queue_xmit include/linux/netdevice.h:3088 [inline]
can_send+0x4eb/0x5d0 net/can/af_can.c:276
bcm_can_tx+0x314/0x410 net/can/bcm.c:302
bcm_tx_timeout_handler+0xdb/0x260
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x217/0x700 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0xd6/0x120 kernel/time/hrtimer.c:1766
__do_softirq+0xc1/0x265 kernel/softirq.c:571
run_ksoftirqd+0x17/0x20 kernel/softirq.c:939
smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164
kthread+0x1d7/0x210 kernel/kthread.c:379
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
value changed: 0x0000000000000000 -> 0x0000000020000081
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 6.4.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Fixes: 69e3c75f4d54 ("net: TX_RING and packet mmap")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20230803145600.2937518-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/packet/af_packet.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -366,18 +366,20 @@ static void __packet_set_status(struct p
{
union tpacket_uhdr h;
+ /* WRITE_ONCE() are paired with READ_ONCE() in __packet_get_status */
+
h.raw = frame;
switch (po->tp_version) {
case TPACKET_V1:
- h.h1->tp_status = status;
+ WRITE_ONCE(h.h1->tp_status, status);
flush_dcache_page(pgv_to_page(&h.h1->tp_status));
break;
case TPACKET_V2:
- h.h2->tp_status = status;
+ WRITE_ONCE(h.h2->tp_status, status);
flush_dcache_page(pgv_to_page(&h.h2->tp_status));
break;
case TPACKET_V3:
- h.h3->tp_status = status;
+ WRITE_ONCE(h.h3->tp_status, status);
flush_dcache_page(pgv_to_page(&h.h3->tp_status));
break;
default:
@@ -394,17 +396,19 @@ static int __packet_get_status(const str
smp_rmb();
+ /* READ_ONCE() are paired with WRITE_ONCE() in __packet_set_status */
+
h.raw = frame;
switch (po->tp_version) {
case TPACKET_V1:
flush_dcache_page(pgv_to_page(&h.h1->tp_status));
- return h.h1->tp_status;
+ return READ_ONCE(h.h1->tp_status);
case TPACKET_V2:
flush_dcache_page(pgv_to_page(&h.h2->tp_status));
- return h.h2->tp_status;
+ return READ_ONCE(h.h2->tp_status);
case TPACKET_V3:
flush_dcache_page(pgv_to_page(&h.h3->tp_status));
- return h.h3->tp_status;
+ return READ_ONCE(h.h3->tp_status);
default:
WARN(1, "TPACKET version not supported.\n");
BUG();
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 41/68] tunnels: fix kasan splat when generating ipv4 pmtu error
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 40/68] net/packet: annotate data-races around tp->status Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 42/68] bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves Greg Kroah-Hartman
` (35 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Westphal, Jakub Kicinski
From: Florian Westphal <fw@strlen.de>
commit 6a7ac3d20593865209dceb554d8b3f094c6bd940 upstream.
If we try to emit an icmp error in response to a nonliner skb, we get
BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220
Read of size 4 at addr ffff88811c50db00 by task iperf3/1691
CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309
[..]
kasan_report+0x105/0x140
ip_compute_csum+0x134/0x220
iptunnel_pmtud_build_icmp+0x554/0x1020
skb_tunnel_check_pmtu+0x513/0xb80
vxlan_xmit_one+0x139e/0x2ef0
vxlan_xmit+0x1867/0x2760
dev_hard_start_xmit+0x1ee/0x4f0
br_dev_queue_push_xmit+0x4d1/0x660
[..]
ip_compute_csum() cannot deal with nonlinear skbs, so avoid it.
After this change, splat is gone and iperf3 is no longer stuck.
Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets")
Signed-off-by: Florian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20230803152653.29535-2-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ip_tunnel_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -224,7 +224,7 @@ static int iptunnel_pmtud_build_icmp(str
.un.frag.__unused = 0,
.un.frag.mtu = ntohs(mtu),
};
- icmph->checksum = ip_compute_csum(icmph, len);
+ icmph->checksum = csum_fold(skb_checksum(skb, 0, len, 0));
skb_reset_transport_header(skb);
niph = skb_push(skb, sizeof(*niph));
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 42/68] bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 41/68] tunnels: fix kasan splat when generating ipv4 pmtu error Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 43/68] dccp: fix data-race around dp->dccps_mss_cache Greg Kroah-Hartman
` (34 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Ziyang Xuan,
Ido Schimmel, Jakub Kicinski
From: Ziyang Xuan <william.xuanziyang@huawei.com>
commit 01f4fd27087078c90a0e22860d1dfa2cd0510791 upstream.
BUG_ON(!vlan_info) is triggered in unregister_vlan_dev() with
following testcase:
# ip netns add ns1
# ip netns exec ns1 ip link add bond0 type bond mode 0
# ip netns exec ns1 ip link add bond_slave_1 type veth peer veth2
# ip netns exec ns1 ip link set bond_slave_1 master bond0
# ip netns exec ns1 ip link add link bond_slave_1 name vlan10 type vlan id 10 protocol 802.1ad
# ip netns exec ns1 ip link add link bond0 name bond0_vlan10 type vlan id 10 protocol 802.1ad
# ip netns exec ns1 ip link set bond_slave_1 nomaster
# ip netns del ns1
The logical analysis of the problem is as follows:
1. create ETH_P_8021AD protocol vlan10 for bond_slave_1:
register_vlan_dev()
vlan_vid_add()
vlan_info_alloc()
__vlan_vid_add() // add [ETH_P_8021AD, 10] vid to bond_slave_1
2. create ETH_P_8021AD protocol bond0_vlan10 for bond0:
register_vlan_dev()
vlan_vid_add()
__vlan_vid_add()
vlan_add_rx_filter_info()
if (!vlan_hw_filter_capable(dev, proto)) // condition established because bond0 without NETIF_F_HW_VLAN_STAG_FILTER
return 0;
if (netif_device_present(dev))
return dev->netdev_ops->ndo_vlan_rx_add_vid(dev, proto, vid); // will be never called
// The slaves of bond0 will not refer to the [ETH_P_8021AD, 10] vid.
3. detach bond_slave_1 from bond0:
__bond_release_one()
vlan_vids_del_by_dev()
list_for_each_entry(vid_info, &vlan_info->vid_list, list)
vlan_vid_del(dev, vid_info->proto, vid_info->vid);
// bond_slave_1 [ETH_P_8021AD, 10] vid will be deleted.
// bond_slave_1->vlan_info will be assigned NULL.
4. delete vlan10 during delete ns1:
default_device_exit_batch()
dev->rtnl_link_ops->dellink() // unregister_vlan_dev() for vlan10
vlan_info = rtnl_dereference(real_dev->vlan_info); // real_dev of vlan10 is bond_slave_1
BUG_ON(!vlan_info); // bond_slave_1->vlan_info is NULL now, bug is triggered!!!
Add S-VLAN tag related features support to bond driver. So the bond driver
will always propagate the VLAN info to its slaves.
Fixes: 8ad227ff89a7 ("net: vlan: add 802.1ad support")
Suggested-by: Ido Schimmel <idosch@idosch.org>
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://lore.kernel.org/r/20230802114320.4156068-1-william.xuanziyang@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/bonding/bond_main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4920,7 +4920,9 @@ void bond_setup(struct net_device *bond_
bond_dev->hw_features = BOND_VLAN_FEATURES |
NETIF_F_HW_VLAN_CTAG_RX |
- NETIF_F_HW_VLAN_CTAG_FILTER;
+ NETIF_F_HW_VLAN_CTAG_FILTER |
+ NETIF_F_HW_VLAN_STAG_RX |
+ NETIF_F_HW_VLAN_STAG_FILTER;
bond_dev->hw_features |= NETIF_F_GSO_ENCAP_ALL | NETIF_F_GSO_UDP_L4;
#ifdef CONFIG_XFRM_OFFLOAD
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 43/68] dccp: fix data-race around dp->dccps_mss_cache
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 42/68] bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 44/68] drivers: net: prevent tun_build_skb() to exceed the packet size limit Greg Kroah-Hartman
` (33 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet, Jakub Kicinski
From: Eric Dumazet <edumazet@google.com>
commit a47e598fbd8617967e49d85c49c22f9fc642704c upstream.
dccp_sendmsg() reads dp->dccps_mss_cache before locking the socket.
Same thing in do_dccp_getsockopt().
Add READ_ONCE()/WRITE_ONCE() annotations,
and change dccp_sendmsg() to check again dccps_mss_cache
after socket is locked.
Fixes: 7c657876b63c ("[DCCP]: Initial implementation")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20230803163021.2958262-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dccp/output.c | 2 +-
net/dccp/proto.c | 10 ++++++++--
2 files changed, 9 insertions(+), 3 deletions(-)
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -185,7 +185,7 @@ unsigned int dccp_sync_mss(struct sock *
/* And store cached results */
icsk->icsk_pmtu_cookie = pmtu;
- dp->dccps_mss_cache = cur_mps;
+ WRITE_ONCE(dp->dccps_mss_cache, cur_mps);
return cur_mps;
}
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -639,7 +639,7 @@ static int do_dccp_getsockopt(struct soc
return dccp_getsockopt_service(sk, len,
(__be32 __user *)optval, optlen);
case DCCP_SOCKOPT_GET_CUR_MPS:
- val = dp->dccps_mss_cache;
+ val = READ_ONCE(dp->dccps_mss_cache);
break;
case DCCP_SOCKOPT_AVAILABLE_CCIDS:
return ccid_getsockopt_builtin_ccids(sk, len, optval, optlen);
@@ -748,7 +748,7 @@ int dccp_sendmsg(struct sock *sk, struct
trace_dccp_probe(sk, len);
- if (len > dp->dccps_mss_cache)
+ if (len > READ_ONCE(dp->dccps_mss_cache))
return -EMSGSIZE;
lock_sock(sk);
@@ -781,6 +781,12 @@ int dccp_sendmsg(struct sock *sk, struct
goto out_discard;
}
+ /* We need to check dccps_mss_cache after socket is locked. */
+ if (len > dp->dccps_mss_cache) {
+ rc = -EMSGSIZE;
+ goto out_discard;
+ }
+
skb_reserve(skb, sk->sk_prot->max_header);
rc = memcpy_from_msg(skb_put(skb, len), msg, len);
if (rc != 0)
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 44/68] drivers: net: prevent tun_build_skb() to exceed the packet size limit
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 43/68] dccp: fix data-race around dp->dccps_mss_cache Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 45/68] IB/hfi1: Fix possible panic during hotplug remove Greg Kroah-Hartman
` (32 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andrew Kanner, Jakub Kicinski
From: Andrew Kanner <andrew.kanner@gmail.com>
commit 59eeb232940515590de513b997539ef495faca9a upstream.
Using the syzkaller repro with reduced packet size it was discovered
that XDP_PACKET_HEADROOM is not checked in tun_can_build_skb(),
although pad may be incremented in tun_build_skb(). This may end up
with exceeding the PAGE_SIZE limit in tun_build_skb().
Jason Wang <jasowang@redhat.com> proposed to count XDP_PACKET_HEADROOM
always (e.g. without rcu_access_pointer(tun->xdp_prog)) in
tun_can_build_skb() since there's a window during which XDP program
might be attached between tun_can_build_skb() and tun_build_skb().
Fixes: 7df13219d757 ("tun: reserve extra headroom only when XDP is set")
Link: https://syzkaller.appspot.com/bug?extid=f817490f5bd20541b90a
Signed-off-by: Andrew Kanner <andrew.kanner@gmail.com>
Link: https://lore.kernel.org/r/20230803185947.2379988-1-andrew.kanner@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/tun.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1604,7 +1604,7 @@ static bool tun_can_build_skb(struct tun
if (zerocopy)
return false;
- if (SKB_DATA_ALIGN(len + TUN_RX_PAD) +
+ if (SKB_DATA_ALIGN(len + TUN_RX_PAD + XDP_PACKET_HEADROOM) +
SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) > PAGE_SIZE)
return false;
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 45/68] IB/hfi1: Fix possible panic during hotplug remove
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 44/68] drivers: net: prevent tun_build_skb() to exceed the packet size limit Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 46/68] wifi: cfg80211: fix sband iftype data lookup for AP_VLAN Greg Kroah-Hartman
` (31 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Douglas Miller, Dennis Dalessandro,
Leon Romanovsky
From: Douglas Miller <doug.miller@cornelisnetworks.com>
commit 4fdfaef71fced490835145631a795497646f4555 upstream.
During hotplug remove it is possible that the update counters work
might be pending, and may run after memory has been freed.
Cancel the update counters work before freeing memory.
Fixes: 7724105686e7 ("IB/hfi1: add driver files")
Signed-off-by: Douglas Miller <doug.miller@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Link: https://lore.kernel.org/r/169099756100.3927190.15284930454106475280.stgit@awfm-02.cornelisnetworks.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/hfi1/chip.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -12348,6 +12348,7 @@ static void free_cntrs(struct hfi1_devda
if (dd->synth_stats_timer.function)
del_timer_sync(&dd->synth_stats_timer);
+ cancel_work_sync(&dd->update_cntr_work);
ppd = (struct hfi1_pportdata *)(dd + 1);
for (i = 0; i < dd->num_pports; i++, ppd++) {
kfree(ppd->cntrs);
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 46/68] wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 45/68] IB/hfi1: Fix possible panic during hotplug remove Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 47/68] net: phy: at803x: remove set/get wol callbacks for AR8032 Greg Kroah-Hartman
` (30 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Johannes Berg
From: Felix Fietkau <nbd@nbd.name>
commit 5fb9a9fb71a33be61d7d8e8ba4597bfb18d604d0 upstream.
AP_VLAN interfaces are virtual, so doesn't really exist as a type for
capabilities. When passed in as a type, AP is the one that's really intended.
Fixes: c4cbaf7973a7 ("cfg80211: Add support for HE")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20230622165919.46841-1-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/cfg80211.h | 3 +++
1 file changed, 3 insertions(+)
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -513,6 +513,9 @@ ieee80211_get_sband_iftype_data(const st
if (WARN_ON(iftype >= NL80211_IFTYPE_MAX))
return NULL;
+ if (iftype == NL80211_IFTYPE_AP_VLAN)
+ iftype = NL80211_IFTYPE_AP;
+
for (i = 0; i < sband->n_iftype_data; i++) {
const struct ieee80211_sband_iftype_data *data =
&sband->iftype_data[i];
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 47/68] net: phy: at803x: remove set/get wol callbacks for AR8032
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 46/68] wifi: cfg80211: fix sband iftype data lookup for AP_VLAN Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 48/68] net: hns3: refactor hclge_mac_link_status_wait for interface reuse Greg Kroah-Hartman
` (29 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Yang, David Bauer, David S. Miller
From: Li Yang <leoyang.li@nxp.com>
commit d7791cec2304aea22eb2ada944e4d467302f5bfe upstream.
Since the AR8032 part does not support wol, remove related callbacks
from it.
Fixes: 5800091a2061 ("net: phy: at803x: add support for AR8032 PHY")
Signed-off-by: Li Yang <leoyang.li@nxp.com>
Cc: David Bauer <mail@david-bauer.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/phy/at803x.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -1115,8 +1115,6 @@ static struct phy_driver at803x_driver[]
.flags = PHY_POLL_CABLE_TEST,
.config_init = at803x_config_init,
.link_change_notify = at803x_link_change_notify,
- .set_wol = at803x_set_wol,
- .get_wol = at803x_get_wol,
.suspend = at803x_suspend,
.resume = at803x_resume,
/* PHY_BASIC_FEATURES */
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 48/68] net: hns3: refactor hclge_mac_link_status_wait for interface reuse
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 47/68] net: phy: at803x: remove set/get wol callbacks for AR8032 Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 49/68] net: hns3: add wait until mac link down Greg Kroah-Hartman
` (28 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jie Wang, Jijie Shao,
Leon Romanovsky, Jakub Kicinski
From: Jie Wang <wangjie125@huawei.com>
commit 08469dacfad25428b66549716811807203744f4f upstream.
Some nic configurations could only be performed after link is down. So this
patch refactor this API for reuse.
Signed-off-by: Jie Wang <wangjie125@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Link: https://lore.kernel.org/r/20230807113452.474224-3-shaojijie@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -71,6 +71,8 @@ static int hclge_set_default_loopback(st
static void hclge_sync_mac_table(struct hclge_dev *hdev);
static void hclge_restore_hw_table(struct hclge_dev *hdev);
static void hclge_sync_promisc_mode(struct hclge_dev *hdev);
+static int hclge_mac_link_status_wait(struct hclge_dev *hdev, int link_ret,
+ int wait_cnt);
static struct hnae3_ae_algo ae_algo;
@@ -6647,10 +6649,9 @@ static void hclge_phy_link_status_wait(s
} while (++i < HCLGE_PHY_LINK_STATUS_NUM);
}
-static int hclge_mac_link_status_wait(struct hclge_dev *hdev, int link_ret)
+static int hclge_mac_link_status_wait(struct hclge_dev *hdev, int link_ret,
+ int wait_cnt)
{
-#define HCLGE_MAC_LINK_STATUS_NUM 100
-
int link_status;
int i = 0;
int ret;
@@ -6663,13 +6664,15 @@ static int hclge_mac_link_status_wait(st
return 0;
msleep(HCLGE_LINK_STATUS_MS);
- } while (++i < HCLGE_MAC_LINK_STATUS_NUM);
+ } while (++i < wait_cnt);
return -EBUSY;
}
static int hclge_mac_phy_link_status_wait(struct hclge_dev *hdev, bool en,
bool is_phy)
{
+#define HCLGE_MAC_LINK_STATUS_NUM 100
+
int link_ret;
link_ret = en ? HCLGE_LINK_STATUS_UP : HCLGE_LINK_STATUS_DOWN;
@@ -6677,7 +6680,8 @@ static int hclge_mac_phy_link_status_wai
if (is_phy)
hclge_phy_link_status_wait(hdev, link_ret);
- return hclge_mac_link_status_wait(hdev, link_ret);
+ return hclge_mac_link_status_wait(hdev, link_ret,
+ HCLGE_MAC_LINK_STATUS_NUM);
}
static int hclge_set_app_loopback(struct hclge_dev *hdev, bool en)
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 49/68] net: hns3: add wait until mac link down
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 48/68] net: hns3: refactor hclge_mac_link_status_wait for interface reuse Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 50/68] dmaengine: mcf-edma: Fix a potential un-allocated memory access Greg Kroah-Hartman
` (27 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jie Wang, Jijie Shao,
Leon Romanovsky, Jakub Kicinski
From: Jie Wang <wangjie125@huawei.com>
commit 6265e242f7b95f2c1195b42ec912b84ad161470e upstream.
In some configure flow of hns3 driver, for example, change mtu, it will
disable MAC through firmware before configuration. But firmware disables
MAC asynchronously. The rx traffic may be not stopped in this case.
So fixes it by waiting until mac link is down.
Fixes: a9775bb64aa7 ("net: hns3: fix set and get link ksettings issue")
Signed-off-by: Jie Wang <wangjie125@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Link: https://lore.kernel.org/r/20230807113452.474224-4-shaojijie@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -6560,6 +6560,8 @@ static void hclge_enable_fd(struct hnae3
static void hclge_cfg_mac_mode(struct hclge_dev *hdev, bool enable)
{
+#define HCLGE_LINK_STATUS_WAIT_CNT 3
+
struct hclge_desc desc;
struct hclge_config_mac_mode_cmd *req =
(struct hclge_config_mac_mode_cmd *)desc.data;
@@ -6584,9 +6586,15 @@ static void hclge_cfg_mac_mode(struct hc
req->txrx_pad_fcs_loop_en = cpu_to_le32(loop_en);
ret = hclge_cmd_send(&hdev->hw, &desc, 1);
- if (ret)
+ if (ret) {
dev_err(&hdev->pdev->dev,
"mac enable fail, ret =%d.\n", ret);
+ return;
+ }
+
+ if (!enable)
+ hclge_mac_link_status_wait(hdev, HCLGE_LINK_STATUS_DOWN,
+ HCLGE_LINK_STATUS_WAIT_CNT);
}
static int hclge_config_switch_param(struct hclge_dev *hdev, int vfid,
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 50/68] dmaengine: mcf-edma: Fix a potential un-allocated memory access
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 49/68] net: hns3: add wait until mac link down Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 51/68] net/mlx5: Allow 0 for total host VFs Greg Kroah-Hartman
` (26 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Vinod Koul
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
commit 0a46781c89dece85386885a407244ca26e5c1c44 upstream.
When 'mcf_edma' is allocated, some space is allocated for a
flexible array at the end of the struct. 'chans' item are allocated, that is
to say 'pdata->dma_channels'.
Then, this number of item is stored in 'mcf_edma->n_chans'.
A few lines later, if 'mcf_edma->n_chans' is 0, then a default value of 64
is set.
This ends to no space allocated by devm_kzalloc() because chans was 0, but
64 items are read and/or written in some not allocated memory.
Change the logic to define a default value before allocating the memory.
Fixes: e7a3ff92eaf1 ("dmaengine: fsl-edma: add ColdFire mcf5441x edma support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/f55d914407c900828f6fad3ea5fa791a5f17b9a4.1685172449.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/mcf-edma.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/drivers/dma/mcf-edma.c
+++ b/drivers/dma/mcf-edma.c
@@ -191,7 +191,13 @@ static int mcf_edma_probe(struct platfor
return -EINVAL;
}
- chans = pdata->dma_channels;
+ if (!pdata->dma_channels) {
+ dev_info(&pdev->dev, "setting default channel number to 64");
+ chans = 64;
+ } else {
+ chans = pdata->dma_channels;
+ }
+
len = sizeof(*mcf_edma) + sizeof(*mcf_chan) * chans;
mcf_edma = devm_kzalloc(&pdev->dev, len, GFP_KERNEL);
if (!mcf_edma)
@@ -203,11 +209,6 @@ static int mcf_edma_probe(struct platfor
mcf_edma->drvdata = &mcf_data;
mcf_edma->big_endian = 1;
- if (!mcf_edma->n_chans) {
- dev_info(&pdev->dev, "setting default channel number to 64");
- mcf_edma->n_chans = 64;
- }
-
mutex_init(&mcf_edma->fsl_edma_mutex);
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 51/68] net/mlx5: Allow 0 for total host VFs
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 50/68] dmaengine: mcf-edma: Fix a potential un-allocated memory access Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 52/68] ibmvnic: Enforce stronger sanity checks on login response Greg Kroah-Hartman
` (25 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daniel Jurgens, Saeed Mahameed
From: Daniel Jurgens <danielj@nvidia.com>
commit 2dc2b3922d3c0f52d3a792d15dcacfbc4cc76b8f upstream.
When querying eswitch functions 0 is a valid number of host VFs. After
introducing ARM SRIOV falling through to getting the max value from PCI
results in using the total VFs allowed on the ARM for the host.
Fixes: 86eec50beaf3 ("net/mlx5: Support querying max VFs from device");
Signed-off-by: Daniel Jurgens <danielj@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/sriov.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
@@ -211,8 +211,7 @@ static u16 mlx5_get_max_vfs(struct mlx5_
host_total_vfs = MLX5_GET(query_esw_functions_out, out,
host_params_context.host_total_vfs);
kvfree(out);
- if (host_total_vfs)
- return host_total_vfs;
+ return host_total_vfs;
}
done:
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 52/68] ibmvnic: Enforce stronger sanity checks on login response
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 51/68] net/mlx5: Allow 0 for total host VFs Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 53/68] ibmvnic: Unmap DMA login rsp buffer on send login fail Greg Kroah-Hartman
` (24 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nick Child, Simon Horman, Jakub Kicinski
From: Nick Child <nnac123@linux.ibm.com>
commit db17ba719bceb52f0ae4ebca0e4c17d9a3bebf05 upstream.
Ensure that all offsets in a login response buffer are within the size
of the allocated response buffer. Any offsets or lengths that surpass
the allocation are likely the result of an incomplete response buffer.
In these cases, a full reset is necessary.
When attempting to login, the ibmvnic device will allocate a response
buffer and pass a reference to the VIOS. The VIOS will then send the
ibmvnic device a LOGIN_RSP CRQ to signal that the buffer has been filled
with data. If the ibmvnic device does not get a response in 20 seconds,
the old buffer is freed and a new login request is sent. With 2
outstanding requests, any LOGIN_RSP CRQ's could be for the older
login request. If this is the case then the login response buffer (which
is for the newer login request) could be incomplete and contain invalid
data. Therefore, we must enforce strict sanity checks on the response
buffer values.
Testing has shown that the `off_rxadd_buff_size` value is filled in last
by the VIOS and will be the smoking gun for these circumstances.
Until VIOS can implement a mechanism for tracking outstanding response
buffers and a method for mapping a LOGIN_RSP CRQ to a particular login
response buffer, the best ibmvnic can do in this situation is perform a
full reset.
Fixes: dff515a3e71d ("ibmvnic: Harden device login requests")
Signed-off-by: Nick Child <nnac123@linux.ibm.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20230809221038.51296-1-nnac123@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/ibm/ibmvnic.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -4430,6 +4430,7 @@ static int handle_login_rsp(union ibmvni
int num_tx_pools;
int num_rx_pools;
u64 *size_array;
+ u32 rsp_len;
int i;
/* CHECK: Test/set of login_pending does not need to be atomic
@@ -4481,6 +4482,23 @@ static int handle_login_rsp(union ibmvni
ibmvnic_reset(adapter, VNIC_RESET_FATAL);
return -EIO;
}
+
+ rsp_len = be32_to_cpu(login_rsp->len);
+ if (be32_to_cpu(login->login_rsp_len) < rsp_len ||
+ rsp_len <= be32_to_cpu(login_rsp->off_txsubm_subcrqs) ||
+ rsp_len <= be32_to_cpu(login_rsp->off_rxadd_subcrqs) ||
+ rsp_len <= be32_to_cpu(login_rsp->off_rxadd_buff_size) ||
+ rsp_len <= be32_to_cpu(login_rsp->off_supp_tx_desc)) {
+ /* This can happen if a login request times out and there are
+ * 2 outstanding login requests sent, the LOGIN_RSP crq
+ * could have been for the older login request. So we are
+ * parsing the newer response buffer which may be incomplete
+ */
+ dev_err(dev, "FATAL: Login rsp offsets/lengths invalid\n");
+ ibmvnic_reset(adapter, VNIC_RESET_FATAL);
+ return -EIO;
+ }
+
size_array = (u64 *)((u8 *)(adapter->login_rsp_buf) +
be32_to_cpu(adapter->login_rsp_buf->off_rxadd_buff_size));
/* variable buffer sizes are not supported, so just read the
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 53/68] ibmvnic: Unmap DMA login rsp buffer on send login fail
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 52/68] ibmvnic: Enforce stronger sanity checks on login response Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 54/68] ibmvnic: Handle DMA unmapping of login buffs in release functions Greg Kroah-Hartman
` (23 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nick Child, Simon Horman, Jakub Kicinski
From: Nick Child <nnac123@linux.ibm.com>
commit 411c565b4bc63e9584a8493882bd566e35a90588 upstream.
If the LOGIN CRQ fails to send then we must DMA unmap the response
buffer. Previously, if the CRQ failed then the memory was freed without
DMA unmapping.
Fixes: c98d9cc4170d ("ibmvnic: send_login should check for crq errors")
Signed-off-by: Nick Child <nnac123@linux.ibm.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20230809221038.51296-2-nnac123@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/ibm/ibmvnic.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -3861,11 +3861,14 @@ static int send_login(struct ibmvnic_ada
if (rc) {
adapter->login_pending = false;
netdev_err(adapter->netdev, "Failed to send login, rc=%d\n", rc);
- goto buf_rsp_map_failed;
+ goto buf_send_failed;
}
return 0;
+buf_send_failed:
+ dma_unmap_single(dev, rsp_buffer_token, rsp_buffer_size,
+ DMA_FROM_DEVICE);
buf_rsp_map_failed:
kfree(login_rsp_buffer);
adapter->login_rsp_buf = NULL;
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 54/68] ibmvnic: Handle DMA unmapping of login buffs in release functions
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 53/68] ibmvnic: Unmap DMA login rsp buffer on send login fail Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 55/68] btrfs: dont stop integrity writeback too early Greg Kroah-Hartman
` (22 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nick Child, Simon Horman, Jakub Kicinski
From: Nick Child <nnac123@linux.ibm.com>
commit d78a671eb8996af19d6311ecdee9790d2fa479f0 upstream.
Rather than leaving the DMA unmapping of the login buffers to the
login response handler, move this work into the login release functions.
Previously, these functions were only used for freeing the allocated
buffers. This could lead to issues if there are more than one
outstanding login buffer requests, which is possible if a login request
times out.
If a login request times out, then there is another call to send login.
The send login function makes a call to the login buffer release
function. In the past, this freed the buffers but did not DMA unmap.
Therefore, the VIOS could still write to the old login (now freed)
buffer. It is for this reason that it is a good idea to leave the DMA
unmap call to the login buffers release function.
Since the login buffer release functions now handle DMA unmapping,
remove the duplicate DMA unmapping in handle_login_rsp().
Fixes: dff515a3e71d ("ibmvnic: Harden device login requests")
Signed-off-by: Nick Child <nnac123@linux.ibm.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20230809221038.51296-3-nnac123@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/ibm/ibmvnic.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -929,12 +929,22 @@ static int ibmvnic_login(struct net_devi
static void release_login_buffer(struct ibmvnic_adapter *adapter)
{
+ if (!adapter->login_buf)
+ return;
+
+ dma_unmap_single(&adapter->vdev->dev, adapter->login_buf_token,
+ adapter->login_buf_sz, DMA_TO_DEVICE);
kfree(adapter->login_buf);
adapter->login_buf = NULL;
}
static void release_login_rsp_buffer(struct ibmvnic_adapter *adapter)
{
+ if (!adapter->login_rsp_buf)
+ return;
+
+ dma_unmap_single(&adapter->vdev->dev, adapter->login_rsp_buf_token,
+ adapter->login_rsp_buf_sz, DMA_FROM_DEVICE);
kfree(adapter->login_rsp_buf);
adapter->login_rsp_buf = NULL;
}
@@ -4445,11 +4455,6 @@ static int handle_login_rsp(union ibmvni
}
adapter->login_pending = false;
- dma_unmap_single(dev, adapter->login_buf_token, adapter->login_buf_sz,
- DMA_TO_DEVICE);
- dma_unmap_single(dev, adapter->login_rsp_buf_token,
- adapter->login_rsp_buf_sz, DMA_FROM_DEVICE);
-
/* If the number of queues requested can't be allocated by the
* server, the login response will return with code 1. We will need
* to resend the login buffer with fewer queues requested.
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 55/68] btrfs: dont stop integrity writeback too early
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 54/68] ibmvnic: Handle DMA unmapping of login buffs in release functions Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 56/68] btrfs: set cache_block_group_error if we find an error Greg Kroah-Hartman
` (21 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Christoph Hellwig,
David Sterba
From: Christoph Hellwig <hch@lst.de>
commit effa24f689ce0948f68c754991a445a8d697d3a8 upstream.
extent_write_cache_pages stops writing pages as soon as nr_to_write hits
zero. That is the right thing for opportunistic writeback, but incorrect
for data integrity writeback, which needs to ensure that no dirty pages
are left in the range. Thus only stop the writeback for WB_SYNC_NONE
if nr_to_write hits 0.
This is a port of write_cache_pages changes in commit 05fe478dd04e
("mm: write_cache_pages integrity fix").
Note that I've only trigger the problem with other changes to the btrfs
writeback code, but this condition seems worthwhile fixing anyway.
CC: stable@vger.kernel.org # 4.14+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: David Sterba <dsterba@suse.com>
[ updated comment ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/extent_io.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4034,11 +4034,12 @@ retry:
free_extent_buffer(eb);
/*
- * the filesystem may choose to bump up nr_to_write.
+ * The filesystem may choose to bump up nr_to_write.
* We have to make sure to honor the new nr_to_write
- * at any time
+ * at any time.
*/
- nr_to_write_done = wbc->nr_to_write <= 0;
+ nr_to_write_done = (wbc->sync_mode == WB_SYNC_NONE &&
+ wbc->nr_to_write <= 0);
}
pagevec_release(&pvec);
cond_resched();
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 56/68] btrfs: set cache_block_group_error if we find an error
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 55/68] btrfs: dont stop integrity writeback too early Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 57/68] nvme-tcp: fix potential unbalanced freeze & unfreeze Greg Kroah-Hartman
` (20 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, David Sterba
From: Josef Bacik <josef@toxicpanda.com>
commit 92fb94b69c6accf1e49fff699640fa0ce03dc910 upstream.
We set cache_block_group_error if btrfs_cache_block_group() returns an
error, this is because we could end up not finding space to allocate and
mistakenly return -ENOSPC, and which could then abort the transaction
with the incorrect errno, and in the case of ENOSPC result in a
WARN_ON() that will trip up tests like generic/475.
However there's the case where multiple threads can be racing, one
thread gets the proper error, and the other thread doesn't actually call
btrfs_cache_block_group(), it instead sees ->cached ==
BTRFS_CACHE_ERROR. Again the result is the same, we fail to allocate
our space and return -ENOSPC. Instead we need to set
cache_block_group_error to -EIO in this case to make sure that if we do
not make our allocation we get the appropriate error returned back to
the caller.
CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/extent-tree.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4138,8 +4138,11 @@ have_block_group:
ret = 0;
}
- if (unlikely(block_group->cached == BTRFS_CACHE_ERROR))
+ if (unlikely(block_group->cached == BTRFS_CACHE_ERROR)) {
+ if (!cache_block_group_error)
+ cache_block_group_error = -EIO;
goto loop;
+ }
bg_ret = NULL;
ret = do_allocation(block_group, &ffe_ctl, &bg_ret);
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 57/68] nvme-tcp: fix potential unbalanced freeze & unfreeze
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 56/68] btrfs: set cache_block_group_error if we find an error Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 58/68] nvme-rdma: " Greg Kroah-Hartman
` (19 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ming Lei, Yi Zhang, Sagi Grimberg,
Keith Busch
From: Ming Lei <ming.lei@redhat.com>
commit 99dc264014d5aed66ee37ddf136a38b5a2b1b529 upstream.
Move start_freeze into nvme_tcp_configure_io_queues(), and there is
at least two benefits:
1) fix unbalanced freeze and unfreeze, since re-connection work may
fail or be broken by removal
2) IO during error recovery can be failfast quickly because nvme fabrics
unquiesces queues after teardown.
One side-effect is that !mpath request may timeout during connecting
because of queue topo change, but that looks not one big deal:
1) same problem exists with current code base
2) compared with !mpath, mpath use case is dominant
Fixes: 2875b0aecabe ("nvme-tcp: fix controller reset hang during traffic")
Cc: stable@vger.kernel.org
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Tested-by: Yi Zhang <yi.zhang@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/tcp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1859,6 +1859,7 @@ static int nvme_tcp_configure_io_queues(
goto out_cleanup_connect_q;
if (!new) {
+ nvme_start_freeze(ctrl);
nvme_start_queues(ctrl);
if (!nvme_wait_freeze_timeout(ctrl, NVME_IO_TIMEOUT)) {
/*
@@ -1867,6 +1868,7 @@ static int nvme_tcp_configure_io_queues(
* to be safe.
*/
ret = -ENODEV;
+ nvme_unfreeze(ctrl);
goto out_wait_freeze_timed_out;
}
blk_mq_update_nr_hw_queues(ctrl->tagset,
@@ -1989,7 +1991,6 @@ static void nvme_tcp_teardown_io_queues(
if (ctrl->queue_count <= 1)
return;
blk_mq_quiesce_queue(ctrl->admin_q);
- nvme_start_freeze(ctrl);
nvme_stop_queues(ctrl);
nvme_sync_io_queues(ctrl);
nvme_tcp_stop_io_queues(ctrl);
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 58/68] nvme-rdma: fix potential unbalanced freeze & unfreeze
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 57/68] nvme-tcp: fix potential unbalanced freeze & unfreeze Greg Kroah-Hartman
@ 2023-08-13 21:19 ` Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 59/68] netfilter: nf_tables: report use refcount overflow Greg Kroah-Hartman
` (18 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ming Lei, Yi Zhang, Sagi Grimberg,
Keith Busch
From: Ming Lei <ming.lei@redhat.com>
commit 29b434d1e49252b3ad56ad3197e47fafff5356a1 upstream.
Move start_freeze into nvme_rdma_configure_io_queues(), and there is
at least two benefits:
1) fix unbalanced freeze and unfreeze, since re-connection work may
fail or be broken by removal
2) IO during error recovery can be failfast quickly because nvme fabrics
unquiesces queues after teardown.
One side-effect is that !mpath request may timeout during connecting
because of queue topo change, but that looks not one big deal:
1) same problem exists with current code base
2) compared with !mpath, mpath use case is dominant
Fixes: 9f98772ba307 ("nvme-rdma: fix controller reset hang during traffic")
Cc: stable@vger.kernel.org
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Tested-by: Yi Zhang <yi.zhang@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/rdma.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -989,6 +989,7 @@ static int nvme_rdma_configure_io_queues
goto out_cleanup_connect_q;
if (!new) {
+ nvme_start_freeze(&ctrl->ctrl);
nvme_start_queues(&ctrl->ctrl);
if (!nvme_wait_freeze_timeout(&ctrl->ctrl, NVME_IO_TIMEOUT)) {
/*
@@ -997,6 +998,7 @@ static int nvme_rdma_configure_io_queues
* to be safe.
*/
ret = -ENODEV;
+ nvme_unfreeze(&ctrl->ctrl);
goto out_wait_freeze_timed_out;
}
blk_mq_update_nr_hw_queues(ctrl->ctrl.tagset,
@@ -1042,7 +1044,6 @@ static void nvme_rdma_teardown_io_queues
bool remove)
{
if (ctrl->ctrl.queue_count > 1) {
- nvme_start_freeze(&ctrl->ctrl);
nvme_stop_queues(&ctrl->ctrl);
nvme_sync_io_queues(&ctrl->ctrl);
nvme_rdma_stop_io_queues(ctrl);
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 59/68] netfilter: nf_tables: report use refcount overflow
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2023-08-13 21:19 ` [PATCH 5.10 58/68] nvme-rdma: " Greg Kroah-Hartman
@ 2023-08-13 21:20 ` Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 60/68] scsi: core: Fix legacy /proc parsing buffer overflow Greg Kroah-Hartman
` (17 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:20 UTC (permalink / raw)
To: stable, netfilter-devel; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit 1689f25924ada8fe14a4a82c38925d04994c7142 upstream.
Overflow use refcount checks are not complete.
Add helper function to deal with object reference counter tracking.
Report -EMFILE in case UINT_MAX is reached.
nft_use_dec() splats in case that reference counter underflows,
which should not ever happen.
Add nft_use_inc_restore() and nft_use_dec_restore() which are used
to restore reference counter from error and abort paths.
Use u32 in nft_flowtable and nft_object since helper functions cannot
work on bitfields.
Remove the few early incomplete checks now that the helper functions
are in place and used to check for refcount overflow.
Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/netfilter/nf_tables.h | 31 ++++++
net/netfilter/nf_tables_api.c | 171 +++++++++++++++++++++++---------------
net/netfilter/nft_flow_offload.c | 6 -
net/netfilter/nft_immediate.c | 8 -
net/netfilter/nft_objref.c | 8 +
5 files changed, 145 insertions(+), 79 deletions(-)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1073,6 +1073,29 @@ int __nft_release_basechain(struct nft_c
unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);
+static inline bool nft_use_inc(u32 *use)
+{
+ if (*use == UINT_MAX)
+ return false;
+
+ (*use)++;
+
+ return true;
+}
+
+static inline void nft_use_dec(u32 *use)
+{
+ WARN_ON_ONCE((*use)-- == 0);
+}
+
+/* For error and abort path: restore use counter to previous state. */
+static inline void nft_use_inc_restore(u32 *use)
+{
+ WARN_ON_ONCE(!nft_use_inc(use));
+}
+
+#define nft_use_dec_restore nft_use_dec
+
/**
* struct nft_table - nf_tables table
*
@@ -1150,8 +1173,8 @@ struct nft_object {
struct list_head list;
struct rhlist_head rhlhead;
struct nft_object_hash_key key;
- u32 genmask:2,
- use:30;
+ u32 genmask:2;
+ u32 use;
u64 handle;
u16 udlen;
u8 *udata;
@@ -1253,8 +1276,8 @@ struct nft_flowtable {
char *name;
int hooknum;
int ops_len;
- u32 genmask:2,
- use:30;
+ u32 genmask:2;
+ u32 use;
u64 handle;
/* runtime data below here */
struct list_head hook_list ____cacheline_aligned;
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -257,8 +257,10 @@ int nf_tables_bind_chain(const struct nf
if (chain->bound)
return -EBUSY;
+ if (!nft_use_inc(&chain->use))
+ return -EMFILE;
+
chain->bound = true;
- chain->use++;
nft_chain_trans_bind(ctx, chain);
return 0;
@@ -427,7 +429,7 @@ static int nft_delchain(struct nft_ctx *
if (IS_ERR(trans))
return PTR_ERR(trans);
- ctx->table->use--;
+ nft_use_dec(&ctx->table->use);
nft_deactivate_next(ctx->net, ctx->chain);
return 0;
@@ -466,7 +468,7 @@ nf_tables_delrule_deactivate(struct nft_
/* You cannot delete the same rule twice */
if (nft_is_active_next(ctx->net, rule)) {
nft_deactivate_next(ctx->net, rule);
- ctx->chain->use--;
+ nft_use_dec(&ctx->chain->use);
return 0;
}
return -ENOENT;
@@ -594,7 +596,7 @@ static int nft_delset(const struct nft_c
nft_map_deactivate(ctx, set);
nft_deactivate_next(ctx->net, set);
- ctx->table->use--;
+ nft_use_dec(&ctx->table->use);
return err;
}
@@ -626,7 +628,7 @@ static int nft_delobj(struct nft_ctx *ct
return err;
nft_deactivate_next(ctx->net, obj);
- ctx->table->use--;
+ nft_use_dec(&ctx->table->use);
return err;
}
@@ -661,7 +663,7 @@ static int nft_delflowtable(struct nft_c
return err;
nft_deactivate_next(ctx->net, flowtable);
- ctx->table->use--;
+ nft_use_dec(&ctx->table->use);
return err;
}
@@ -2158,9 +2160,6 @@ static int nf_tables_addchain(struct nft
struct nft_rule **rules;
int err;
- if (table->use == UINT_MAX)
- return -EOVERFLOW;
-
if (nla[NFTA_CHAIN_HOOK]) {
struct nft_stats __percpu *stats = NULL;
struct nft_chain_hook hook;
@@ -2256,6 +2255,11 @@ static int nf_tables_addchain(struct nft
if (err < 0)
goto err_destroy_chain;
+ if (!nft_use_inc(&table->use)) {
+ err = -EMFILE;
+ goto err_use;
+ }
+
trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
if (IS_ERR(trans)) {
err = PTR_ERR(trans);
@@ -2272,10 +2276,11 @@ static int nf_tables_addchain(struct nft
goto err_unregister_hook;
}
- table->use++;
-
return 0;
+
err_unregister_hook:
+ nft_use_dec_restore(&table->use);
+err_use:
nf_tables_unregister_hook(net, table, chain);
err_destroy_chain:
nf_tables_chain_destroy(ctx);
@@ -3387,9 +3392,6 @@ static int nf_tables_newrule(struct net
return -EINVAL;
handle = nf_tables_alloc_handle(table);
- if (chain->use == UINT_MAX)
- return -EOVERFLOW;
-
if (nla[NFTA_RULE_POSITION]) {
pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
old_rule = __nft_rule_lookup(chain, pos_handle);
@@ -3475,16 +3477,21 @@ static int nf_tables_newrule(struct net
expr = nft_expr_next(expr);
}
+ if (!nft_use_inc(&chain->use)) {
+ err = -EMFILE;
+ goto err2;
+ }
+
if (nlh->nlmsg_flags & NLM_F_REPLACE) {
trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
if (trans == NULL) {
err = -ENOMEM;
- goto err2;
+ goto err_destroy_flow_rule;
}
err = nft_delrule(&ctx, old_rule);
if (err < 0) {
nft_trans_destroy(trans);
- goto err2;
+ goto err_destroy_flow_rule;
}
list_add_tail_rcu(&rule->list, &old_rule->list);
@@ -3492,7 +3499,7 @@ static int nf_tables_newrule(struct net
trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
if (!trans) {
err = -ENOMEM;
- goto err2;
+ goto err_destroy_flow_rule;
}
if (nlh->nlmsg_flags & NLM_F_APPEND) {
@@ -3508,7 +3515,6 @@ static int nf_tables_newrule(struct net
}
}
kvfree(info);
- chain->use++;
if (nft_net->validate_state == NFT_VALIDATE_DO)
return nft_table_validate(net, table);
@@ -3522,6 +3528,9 @@ static int nf_tables_newrule(struct net
}
return 0;
+
+err_destroy_flow_rule:
+ nft_use_dec_restore(&chain->use);
err2:
nft_rule_expr_deactivate(&ctx, rule, NFT_TRANS_PREPARE_ERROR);
nf_tables_rule_destroy(&ctx, rule);
@@ -4437,9 +4446,15 @@ static int nf_tables_newset(struct net *
alloc_size = sizeof(*set) + size + udlen;
if (alloc_size < size || alloc_size > INT_MAX)
return -ENOMEM;
+
+ if (!nft_use_inc(&table->use))
+ return -EMFILE;
+
set = kvzalloc(alloc_size, GFP_KERNEL);
- if (!set)
- return -ENOMEM;
+ if (!set) {
+ err = -ENOMEM;
+ goto err_alloc;
+ }
name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
if (!name) {
@@ -4500,7 +4515,7 @@ static int nf_tables_newset(struct net *
goto err_set_expr_alloc;
list_add_tail_rcu(&set->list, &table->sets);
- table->use++;
+
return 0;
err_set_expr_alloc:
@@ -4512,6 +4527,9 @@ err_set_init:
kfree(set->name);
err_set_name:
kvfree(set);
+err_alloc:
+ nft_use_dec_restore(&table->use);
+
return err;
}
@@ -4605,9 +4623,6 @@ int nf_tables_bind_set(const struct nft_
struct nft_set_binding *i;
struct nft_set_iter iter;
- if (set->use == UINT_MAX)
- return -EOVERFLOW;
-
if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
return -EBUSY;
@@ -4632,10 +4647,12 @@ int nf_tables_bind_set(const struct nft_
return iter.err;
}
bind:
+ if (!nft_use_inc(&set->use))
+ return -EMFILE;
+
binding->chain = ctx->chain;
list_add_tail_rcu(&binding->list, &set->bindings);
nft_set_trans_bind(ctx, set);
- set->use++;
return 0;
}
@@ -4688,7 +4705,7 @@ void nf_tables_activate_set(const struct
nft_clear(ctx->net, set);
}
- set->use++;
+ nft_use_inc_restore(&set->use);
}
EXPORT_SYMBOL_GPL(nf_tables_activate_set);
@@ -4704,7 +4721,7 @@ void nf_tables_deactivate_set(const stru
else
list_del_rcu(&binding->list);
- set->use--;
+ nft_use_dec(&set->use);
break;
case NFT_TRANS_PREPARE:
if (nft_set_is_anonymous(set)) {
@@ -4713,7 +4730,7 @@ void nf_tables_deactivate_set(const stru
nft_deactivate_next(ctx->net, set);
}
- set->use--;
+ nft_use_dec(&set->use);
return;
case NFT_TRANS_ABORT:
case NFT_TRANS_RELEASE:
@@ -4721,7 +4738,7 @@ void nf_tables_deactivate_set(const stru
set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
nft_map_deactivate(ctx, set);
- set->use--;
+ nft_use_dec(&set->use);
fallthrough;
default:
nf_tables_unbind_set(ctx, set, binding,
@@ -5348,7 +5365,7 @@ void nft_set_elem_destroy(const struct n
nft_set_elem_expr_destroy(&ctx, nft_set_ext_expr(ext));
if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
- (*nft_set_ext_obj(ext))->use--;
+ nft_use_dec(&(*nft_set_ext_obj(ext))->use);
kfree(elem);
}
EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
@@ -5522,8 +5539,16 @@ static int nft_add_set_elem(struct nft_c
set->objtype, genmask);
if (IS_ERR(obj)) {
err = PTR_ERR(obj);
+ obj = NULL;
+ goto err_parse_key_end;
+ }
+
+ if (!nft_use_inc(&obj->use)) {
+ err = -EMFILE;
+ obj = NULL;
goto err_parse_key_end;
}
+
nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
}
@@ -5588,10 +5613,8 @@ static int nft_add_set_elem(struct nft_c
udata->len = ulen - 1;
nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
}
- if (obj) {
+ if (obj)
*nft_set_ext_obj(ext) = obj;
- obj->use++;
- }
err = nft_set_elem_expr_setup(ctx, ext, expr);
if (err < 0)
@@ -5647,14 +5670,14 @@ err_set_full:
err_element_clash:
kfree(trans);
err_elem_expr:
- if (obj)
- obj->use--;
-
nf_tables_set_elem_destroy(ctx, set, elem.priv);
err_parse_data:
if (nla[NFTA_SET_ELEM_DATA] != NULL)
nft_data_release(&elem.data.val, desc.type);
err_parse_key_end:
+ if (obj)
+ nft_use_dec_restore(&obj->use);
+
nft_data_release(&elem.key_end.val, NFT_DATA_VALUE);
err_parse_key:
nft_data_release(&elem.key.val, NFT_DATA_VALUE);
@@ -5726,7 +5749,7 @@ void nft_data_hold(const struct nft_data
case NFT_JUMP:
case NFT_GOTO:
chain = data->verdict.chain;
- chain->use++;
+ nft_use_inc_restore(&chain->use);
break;
}
}
@@ -5741,7 +5764,7 @@ static void nft_setelem_data_activate(co
if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
nft_data_hold(nft_set_ext_data(ext), set->dtype);
if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
- (*nft_set_ext_obj(ext))->use++;
+ nft_use_inc_restore(&(*nft_set_ext_obj(ext))->use);
}
static void nft_setelem_data_deactivate(const struct net *net,
@@ -5753,7 +5776,7 @@ static void nft_setelem_data_deactivate(
if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
nft_data_release(nft_set_ext_data(ext), set->dtype);
if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
- (*nft_set_ext_obj(ext))->use--;
+ nft_use_dec(&(*nft_set_ext_obj(ext))->use);
}
static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
@@ -6220,9 +6243,14 @@ static int nf_tables_newobj(struct net *
nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
+ if (!nft_use_inc(&table->use))
+ return -EMFILE;
+
type = nft_obj_type_get(net, objtype);
- if (IS_ERR(type))
- return PTR_ERR(type);
+ if (IS_ERR(type)) {
+ err = PTR_ERR(type);
+ goto err_type;
+ }
obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
if (IS_ERR(obj)) {
@@ -6256,7 +6284,7 @@ static int nf_tables_newobj(struct net *
goto err_obj_ht;
list_add_tail_rcu(&obj->list, &table->objects);
- table->use++;
+
return 0;
err_obj_ht:
/* queued in transaction log */
@@ -6272,6 +6300,9 @@ err_strdup:
kfree(obj);
err_init:
module_put(type->owner);
+err_type:
+ nft_use_dec_restore(&table->use);
+
return err;
}
@@ -6662,7 +6693,7 @@ void nf_tables_deactivate_flowtable(cons
case NFT_TRANS_PREPARE:
case NFT_TRANS_ABORT:
case NFT_TRANS_RELEASE:
- flowtable->use--;
+ nft_use_dec(&flowtable->use);
fallthrough;
default:
return;
@@ -6999,9 +7030,14 @@ static int nf_tables_newflowtable(struct
nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
+ if (!nft_use_inc(&table->use))
+ return -EMFILE;
+
flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
- if (!flowtable)
- return -ENOMEM;
+ if (!flowtable) {
+ err = -ENOMEM;
+ goto flowtable_alloc;
+ }
flowtable->table = table;
flowtable->handle = nf_tables_alloc_handle(table);
@@ -7056,7 +7092,6 @@ static int nf_tables_newflowtable(struct
goto err5;
list_add_tail_rcu(&flowtable->list, &table->flowtables);
- table->use++;
return 0;
err5:
@@ -7073,6 +7108,9 @@ err2:
kfree(flowtable->name);
err1:
kfree(flowtable);
+flowtable_alloc:
+ nft_use_dec_restore(&table->use);
+
return err;
}
@@ -8258,7 +8296,7 @@ static int nf_tables_commit(struct net *
*/
if (nft_set_is_anonymous(nft_trans_set(trans)) &&
!list_empty(&nft_trans_set(trans)->bindings))
- trans->ctx.table->use--;
+ nft_use_dec(&trans->ctx.table->use);
nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
NFT_MSG_NEWSET, GFP_KERNEL);
@@ -8442,7 +8480,7 @@ static int __nf_tables_abort(struct net
nft_trans_destroy(trans);
break;
}
- trans->ctx.table->use--;
+ nft_use_dec_restore(&trans->ctx.table->use);
nft_chain_del(trans->ctx.chain);
nf_tables_unregister_hook(trans->ctx.net,
trans->ctx.table,
@@ -8450,7 +8488,7 @@ static int __nf_tables_abort(struct net
}
break;
case NFT_MSG_DELCHAIN:
- trans->ctx.table->use++;
+ nft_use_inc_restore(&trans->ctx.table->use);
nft_clear(trans->ctx.net, trans->ctx.chain);
nft_trans_destroy(trans);
break;
@@ -8459,20 +8497,20 @@ static int __nf_tables_abort(struct net
nft_trans_destroy(trans);
break;
}
- trans->ctx.chain->use--;
+ nft_use_dec_restore(&trans->ctx.chain->use);
list_del_rcu(&nft_trans_rule(trans)->list);
nft_rule_expr_deactivate(&trans->ctx,
nft_trans_rule(trans),
NFT_TRANS_ABORT);
break;
case NFT_MSG_DELRULE:
- trans->ctx.chain->use++;
+ nft_use_inc_restore(&trans->ctx.chain->use);
nft_clear(trans->ctx.net, nft_trans_rule(trans));
nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
nft_trans_destroy(trans);
break;
case NFT_MSG_NEWSET:
- trans->ctx.table->use--;
+ nft_use_dec_restore(&trans->ctx.table->use);
if (nft_trans_set_bound(trans)) {
nft_trans_destroy(trans);
break;
@@ -8480,7 +8518,7 @@ static int __nf_tables_abort(struct net
list_del_rcu(&nft_trans_set(trans)->list);
break;
case NFT_MSG_DELSET:
- trans->ctx.table->use++;
+ nft_use_inc_restore(&trans->ctx.table->use);
nft_clear(trans->ctx.net, nft_trans_set(trans));
if (nft_trans_set(trans)->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
nft_map_activate(&trans->ctx, nft_trans_set(trans));
@@ -8510,12 +8548,12 @@ static int __nf_tables_abort(struct net
nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans));
nft_trans_destroy(trans);
} else {
- trans->ctx.table->use--;
+ nft_use_dec_restore(&trans->ctx.table->use);
nft_obj_del(nft_trans_obj(trans));
}
break;
case NFT_MSG_DELOBJ:
- trans->ctx.table->use++;
+ nft_use_inc_restore(&trans->ctx.table->use);
nft_clear(trans->ctx.net, nft_trans_obj(trans));
nft_trans_destroy(trans);
break;
@@ -8524,7 +8562,7 @@ static int __nf_tables_abort(struct net
nft_unregister_flowtable_net_hooks(net,
&nft_trans_flowtable_hooks(trans));
} else {
- trans->ctx.table->use--;
+ nft_use_dec_restore(&trans->ctx.table->use);
list_del_rcu(&nft_trans_flowtable(trans)->list);
nft_unregister_flowtable_net_hooks(net,
&nft_trans_flowtable(trans)->hook_list);
@@ -8535,7 +8573,7 @@ static int __nf_tables_abort(struct net
list_splice(&nft_trans_flowtable_hooks(trans),
&nft_trans_flowtable(trans)->hook_list);
} else {
- trans->ctx.table->use++;
+ nft_use_inc_restore(&trans->ctx.table->use);
nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
}
nft_trans_destroy(trans);
@@ -8973,8 +9011,9 @@ static int nft_verdict_init(const struct
if (desc->flags & NFT_DATA_DESC_SETELEM &&
chain->flags & NFT_CHAIN_BINDING)
return -EINVAL;
+ if (!nft_use_inc(&chain->use))
+ return -EMFILE;
- chain->use++;
data->verdict.chain = chain;
break;
}
@@ -8992,7 +9031,7 @@ static void nft_verdict_uninit(const str
case NFT_JUMP:
case NFT_GOTO:
chain = data->verdict.chain;
- chain->use--;
+ nft_use_dec(&chain->use);
break;
}
}
@@ -9161,11 +9200,11 @@ int __nft_release_basechain(struct nft_c
nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
list_del(&rule->list);
- ctx->chain->use--;
+ nft_use_dec(&ctx->chain->use);
nf_tables_rule_release(ctx, rule);
}
nft_chain_del(ctx->chain);
- ctx->table->use--;
+ nft_use_dec(&ctx->table->use);
nf_tables_chain_destroy(ctx);
return 0;
@@ -9205,18 +9244,18 @@ static void __nft_release_table(struct n
ctx.chain = chain;
list_for_each_entry_safe(rule, nr, &chain->rules, list) {
list_del(&rule->list);
- chain->use--;
+ nft_use_dec(&chain->use);
nf_tables_rule_release(&ctx, rule);
}
}
list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
list_del(&flowtable->list);
- table->use--;
+ nft_use_dec(&table->use);
nf_tables_flowtable_destroy(flowtable);
}
list_for_each_entry_safe(set, ns, &table->sets, list) {
list_del(&set->list);
- table->use--;
+ nft_use_dec(&table->use);
if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
nft_map_deactivate(&ctx, set);
@@ -9224,13 +9263,13 @@ static void __nft_release_table(struct n
}
list_for_each_entry_safe(obj, ne, &table->objects, list) {
nft_obj_del(obj);
- table->use--;
+ nft_use_dec(&table->use);
nft_obj_destroy(&ctx, obj);
}
list_for_each_entry_safe(chain, nc, &table->chains, list) {
ctx.chain = chain;
nft_chain_del(chain);
- table->use--;
+ nft_use_dec(&table->use);
nf_tables_chain_destroy(&ctx);
}
list_del(&table->list);
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -174,8 +174,10 @@ static int nft_flow_offload_init(const s
if (IS_ERR(flowtable))
return PTR_ERR(flowtable);
+ if (!nft_use_inc(&flowtable->use))
+ return -EMFILE;
+
priv->flowtable = flowtable;
- flowtable->use++;
return nf_ct_netns_get(ctx->net, ctx->family);
}
@@ -194,7 +196,7 @@ static void nft_flow_offload_activate(co
{
struct nft_flow_offload *priv = nft_expr_priv(expr);
- priv->flowtable->use++;
+ nft_use_inc_restore(&priv->flowtable->use);
}
static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -168,7 +168,7 @@ static void nft_immediate_deactivate(con
nft_immediate_chain_deactivate(ctx, chain, phase);
nft_chain_del(chain);
chain->bound = false;
- chain->table->use--;
+ nft_use_dec(&chain->table->use);
break;
}
break;
@@ -207,7 +207,7 @@ static void nft_immediate_destroy(const
* let the transaction records release this chain and its rules.
*/
if (chain->bound) {
- chain->use--;
+ nft_use_dec(&chain->use);
break;
}
@@ -215,9 +215,9 @@ static void nft_immediate_destroy(const
chain_ctx = *ctx;
chain_ctx.chain = chain;
- chain->use--;
+ nft_use_dec(&chain->use);
list_for_each_entry_safe(rule, n, &chain->rules, list) {
- chain->use--;
+ nft_use_dec(&chain->use);
list_del(&rule->list);
nf_tables_rule_destroy(&chain_ctx, rule);
}
--- a/net/netfilter/nft_objref.c
+++ b/net/netfilter/nft_objref.c
@@ -41,8 +41,10 @@ static int nft_objref_init(const struct
if (IS_ERR(obj))
return -ENOENT;
+ if (!nft_use_inc(&obj->use))
+ return -EMFILE;
+
nft_objref_priv(expr) = obj;
- obj->use++;
return 0;
}
@@ -71,7 +73,7 @@ static void nft_objref_deactivate(const
if (phase == NFT_TRANS_COMMIT)
return;
- obj->use--;
+ nft_use_dec(&obj->use);
}
static void nft_objref_activate(const struct nft_ctx *ctx,
@@ -79,7 +81,7 @@ static void nft_objref_activate(const st
{
struct nft_object *obj = nft_objref_priv(expr);
- obj->use++;
+ nft_use_inc_restore(&obj->use);
}
static struct nft_expr_type nft_objref_type;
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 60/68] scsi: core: Fix legacy /proc parsing buffer overflow
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2023-08-13 21:20 ` [PATCH 5.10 59/68] netfilter: nf_tables: report use refcount overflow Greg Kroah-Hartman
@ 2023-08-13 21:20 ` Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 61/68] scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Greg Kroah-Hartman
` (16 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Torvalds, Martin K Petersen,
James Bottomley, Willy Tarreau, stable, Tony Battersby
From: Tony Battersby <tonyb@cybernetics.com>
commit 9426d3cef5000824e5f24f80ed5f42fb935f2488 upstream.
(lightly modified commit message mostly by Linus Torvalds)
The parsing code for /proc/scsi/scsi is disgusting and broken. We should
have just used 'sscanf()' or something simple like that, but the logic may
actually predate our kernel sscanf library routine for all I know. It
certainly predates both git and BK histories.
And we can't change it to be something sane like that now, because the
string matching at the start is done case-insensitively, and the separator
parsing between numbers isn't done at all, so *any* separator will work,
including a possible terminating NUL character.
This interface is root-only, and entirely for legacy use, so there is
absolutely no point in trying to tighten up the parsing. Because any
separator has traditionally worked, it's entirely possible that people have
used random characters rather than the suggested space.
So don't bother to try to pretty it up, and let's just make a minimal patch
that can be back-ported and we can forget about this whole sorry thing for
another two decades.
Just make it at least not read past the end of the supplied data.
Link: https://lore.kernel.org/linux-scsi/b570f5fe-cb7c-863a-6ed9-f6774c219b88@cybernetics.com/
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Martin K Petersen <martin.petersen@oracle.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: stable@kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
Signed-off-by: Martin K Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_proc.c | 30 +++++++++++++++++-------------
1 file changed, 17 insertions(+), 13 deletions(-)
--- a/drivers/scsi/scsi_proc.c
+++ b/drivers/scsi/scsi_proc.c
@@ -311,7 +311,7 @@ static ssize_t proc_scsi_write(struct fi
size_t length, loff_t *ppos)
{
int host, channel, id, lun;
- char *buffer, *p;
+ char *buffer, *end, *p;
int err;
if (!buf || length > PAGE_SIZE)
@@ -326,10 +326,14 @@ static ssize_t proc_scsi_write(struct fi
goto out;
err = -EINVAL;
- if (length < PAGE_SIZE)
- buffer[length] = '\0';
- else if (buffer[PAGE_SIZE-1])
- goto out;
+ if (length < PAGE_SIZE) {
+ end = buffer + length;
+ *end = '\0';
+ } else {
+ end = buffer + PAGE_SIZE - 1;
+ if (*end)
+ goto out;
+ }
/*
* Usage: echo "scsi add-single-device 0 1 2 3" >/proc/scsi/scsi
@@ -338,10 +342,10 @@ static ssize_t proc_scsi_write(struct fi
if (!strncmp("scsi add-single-device", buffer, 22)) {
p = buffer + 23;
- host = simple_strtoul(p, &p, 0);
- channel = simple_strtoul(p + 1, &p, 0);
- id = simple_strtoul(p + 1, &p, 0);
- lun = simple_strtoul(p + 1, &p, 0);
+ host = (p < end) ? simple_strtoul(p, &p, 0) : 0;
+ channel = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
+ id = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
+ lun = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
err = scsi_add_single_device(host, channel, id, lun);
@@ -352,10 +356,10 @@ static ssize_t proc_scsi_write(struct fi
} else if (!strncmp("scsi remove-single-device", buffer, 25)) {
p = buffer + 26;
- host = simple_strtoul(p, &p, 0);
- channel = simple_strtoul(p + 1, &p, 0);
- id = simple_strtoul(p + 1, &p, 0);
- lun = simple_strtoul(p + 1, &p, 0);
+ host = (p < end) ? simple_strtoul(p, &p, 0) : 0;
+ channel = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
+ id = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
+ lun = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
err = scsi_remove_single_device(host, channel, id, lun);
}
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 61/68] scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2023-08-13 21:20 ` [PATCH 5.10 60/68] scsi: core: Fix legacy /proc parsing buffer overflow Greg Kroah-Hartman
@ 2023-08-13 21:20 ` Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 62/68] scsi: 53c700: Check that command slot is not NULL Greg Kroah-Hartman
` (15 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Kelley, Martin K. Petersen
From: Michael Kelley <mikelley@microsoft.com>
commit 175544ad48cbf56affeef2a679c6a4d4fb1e2881 upstream.
Hyper-V provides the ability to connect Fibre Channel LUNs to the host
system and present them in a guest VM as a SCSI device. I/O to the vFC
device is handled by the storvsc driver. The storvsc driver includes a
partial integration with the FC transport implemented in the generic
portion of the Linux SCSI subsystem so that FC attributes can be displayed
in /sys. However, the partial integration means that some aspects of vFC
don't work properly. Unfortunately, a full and correct integration isn't
practical because of limitations in what Hyper-V provides to the guest.
In particular, in the context of Hyper-V storvsc, the FC transport timeout
function fc_eh_timed_out() causes a kernel panic because it can't find the
rport and dereferences a NULL pointer. The original patch that added the
call from storvsc_eh_timed_out() to fc_eh_timed_out() is faulty in this
regard.
In many cases a timeout is due to a transient condition, so the situation
can be improved by just continuing to wait like with other I/O requests
issued by storvsc, and avoiding the guaranteed panic. For a permanent
failure, continuing to wait may result in a hung thread instead of a panic,
which again may be better.
So fix the panic by removing the storvsc call to fc_eh_timed_out(). This
allows storvsc to keep waiting for a response. The change has been tested
by users who experienced a panic in fc_eh_timed_out() due to transient
timeouts, and it solves their problem.
In the future we may want to deprecate the vFC functionality in storvsc
since it can't be fully fixed. But it has current users for whom it is
working well enough, so it should probably stay for a while longer.
Fixes: 3930d7309807 ("scsi: storvsc: use default I/O timeout handler for FC devices")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/1690606764-79669-1-git-send-email-mikelley@microsoft.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/storvsc_drv.c | 4 ----
1 file changed, 4 deletions(-)
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1641,10 +1641,6 @@ static int storvsc_host_reset_handler(st
*/
static enum blk_eh_timer_return storvsc_eh_timed_out(struct scsi_cmnd *scmnd)
{
-#if IS_ENABLED(CONFIG_SCSI_FC_ATTRS)
- if (scmnd->device->host->transportt == fc_transport_template)
- return fc_eh_timed_out(scmnd);
-#endif
return BLK_EH_RESET_TIMER;
}
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 62/68] scsi: 53c700: Check that command slot is not NULL
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2023-08-13 21:20 ` [PATCH 5.10 61/68] scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Greg Kroah-Hartman
@ 2023-08-13 21:20 ` Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 63/68] scsi: snic: Fix possible memory leak if device_add() fails Greg Kroah-Hartman
` (14 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Telezhnikov,
Alexandra Diupina, Martin K. Petersen
From: Alexandra Diupina <adiupina@astralinux.ru>
commit 8366d1f1249a0d0bba41d0bd1298d63e5d34c7f7 upstream.
Add a check for the command slot value to avoid dereferencing a NULL
pointer.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Co-developed-by: Vladimir Telezhnikov <vtelezhnikov@astralinux.ru>
Signed-off-by: Vladimir Telezhnikov <vtelezhnikov@astralinux.ru>
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
Link: https://lore.kernel.org/r/20230728123521.18293-1-adiupina@astralinux.ru
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/53c700.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/53c700.c
+++ b/drivers/scsi/53c700.c
@@ -1600,7 +1600,7 @@ NCR_700_intr(int irq, void *dev_id)
printk("scsi%d (%d:%d) PHASE MISMATCH IN SEND MESSAGE %d remain, return %p[%04x], phase %s\n", host->host_no, pun, lun, count, (void *)temp, temp - hostdata->pScript, sbcl_to_string(NCR_700_readb(host, SBCL_REG)));
#endif
resume_offset = hostdata->pScript + Ent_SendMessagePhaseMismatch;
- } else if(dsp >= to32bit(&slot->pSG[0].ins) &&
+ } else if (slot && dsp >= to32bit(&slot->pSG[0].ins) &&
dsp <= to32bit(&slot->pSG[NCR_700_SG_SEGMENTS].ins)) {
int data_transfer = NCR_700_readl(host, DBC_REG) & 0xffffff;
int SGcount = (dsp - to32bit(&slot->pSG[0].ins))/sizeof(struct NCR_700_SG_List);
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 63/68] scsi: snic: Fix possible memory leak if device_add() fails
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2023-08-13 21:20 ` [PATCH 5.10 62/68] scsi: 53c700: Check that command slot is not NULL Greg Kroah-Hartman
@ 2023-08-13 21:20 ` Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 64/68] scsi: core: " Greg Kroah-Hartman
` (13 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhu Wang, Narsimhulu Musini,
Martin K. Petersen
From: Zhu Wang <wangzhu9@huawei.com>
commit 41320b18a0e0dfb236dba4edb9be12dba1878156 upstream.
If device_add() returns error, the name allocated by dev_set_name() needs
be freed. As the comment of device_add() says, put_device() should be used
to give up the reference in the error path. So fix this by calling
put_device(), then the name can be freed in kobject_cleanp().
Fixes: c8806b6c9e82 ("snic: driver for Cisco SCSI HBA")
Signed-off-by: Zhu Wang <wangzhu9@huawei.com>
Acked-by: Narsimhulu Musini <nmusini@cisco.com>
Link: https://lore.kernel.org/r/20230801111421.63651-1-wangzhu9@huawei.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/snic/snic_disc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/scsi/snic/snic_disc.c
+++ b/drivers/scsi/snic/snic_disc.c
@@ -317,6 +317,7 @@ snic_tgt_create(struct snic *snic, struc
"Snic Tgt: device_add, with err = %d\n",
ret);
+ put_device(&tgt->dev);
put_device(&snic->shost->shost_gendev);
spin_lock_irqsave(snic->shost->host_lock, flags);
list_del(&tgt->list);
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 64/68] scsi: core: Fix possible memory leak if device_add() fails
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2023-08-13 21:20 ` [PATCH 5.10 63/68] scsi: snic: Fix possible memory leak if device_add() fails Greg Kroah-Hartman
@ 2023-08-13 21:20 ` Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 65/68] scsi: qedi: Fix firmware halt over suspend and resume Greg Kroah-Hartman
` (12 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhu Wang, Bart Van Assche,
Martin K. Petersen
From: Zhu Wang <wangzhu9@huawei.com>
commit 04b5b5cb0136ce970333a9c6cec7e46adba1ea3a upstream.
If device_add() returns error, the name allocated by dev_set_name() needs
be freed. As the comment of device_add() says, put_device() should be used
to decrease the reference count in the error path. So fix this by calling
put_device(), then the name can be freed in kobject_cleanp().
Fixes: ee959b00c335 ("SCSI: convert struct class_device to struct device")
Signed-off-by: Zhu Wang <wangzhu9@huawei.com>
Link: https://lore.kernel.org/r/20230803020230.226903-1-wangzhu9@huawei.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/raid_class.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/scsi/raid_class.c
+++ b/drivers/scsi/raid_class.c
@@ -248,6 +248,7 @@ int raid_component_add(struct raid_templ
return 0;
err_out:
+ put_device(&rc->dev);
list_del(&rc->node);
rd->component_count--;
put_device(component_dev);
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 65/68] scsi: qedi: Fix firmware halt over suspend and resume
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2023-08-13 21:20 ` [PATCH 5.10 64/68] scsi: core: " Greg Kroah-Hartman
@ 2023-08-13 21:20 ` Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 66/68] scsi: qedf: " Greg Kroah-Hartman
` (11 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nilesh Javali, Martin K. Petersen
From: Nilesh Javali <njavali@marvell.com>
commit 1516ee035df32115197cd93ae3619dba7b020986 upstream.
While performing certain power-off sequences, PCI drivers are called to
suspend and resume their underlying devices through PCI PM (power
management) interface. However the hardware does not support PCI PM
suspend/resume operations so system wide suspend/resume leads to bad MFW
(management firmware) state which causes various follow-up errors in driver
when communicating with the device/firmware.
To fix this driver implements PCI PM suspend handler to indicate
unsupported operation to the PCI subsystem explicitly, thus avoiding system
to go into suspended/standby mode.
Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.")
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20230807093725.46829-2-njavali@marvell.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qedi/qedi_main.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -69,6 +69,7 @@ static struct nvm_iscsi_block *qedi_get_
static void qedi_recovery_handler(struct work_struct *work);
static void qedi_schedule_hw_err_handler(void *dev,
enum qed_hw_err_type err_type);
+static int qedi_suspend(struct pci_dev *pdev, pm_message_t state);
static int qedi_iscsi_event_cb(void *context, u8 fw_event_code, void *fw_handle)
{
@@ -2517,6 +2518,22 @@ static void qedi_shutdown(struct pci_dev
__qedi_remove(pdev, QEDI_MODE_SHUTDOWN);
}
+static int qedi_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+ struct qedi_ctx *qedi;
+
+ if (!pdev) {
+ QEDI_ERR(NULL, "pdev is NULL.\n");
+ return -ENODEV;
+ }
+
+ qedi = pci_get_drvdata(pdev);
+
+ QEDI_ERR(&qedi->dbg_ctx, "%s: Device does not support suspend operation\n", __func__);
+
+ return -EPERM;
+}
+
static int __qedi_probe(struct pci_dev *pdev, int mode)
{
struct qedi_ctx *qedi;
@@ -2875,6 +2892,7 @@ static struct pci_driver qedi_pci_driver
.remove = qedi_remove,
.shutdown = qedi_shutdown,
.err_handler = &qedi_err_handler,
+ .suspend = qedi_suspend,
};
static int __init qedi_init(void)
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 66/68] scsi: qedf: Fix firmware halt over suspend and resume
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2023-08-13 21:20 ` [PATCH 5.10 65/68] scsi: qedi: Fix firmware halt over suspend and resume Greg Kroah-Hartman
@ 2023-08-13 21:20 ` Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 67/68] alpha: remove __init annotation from exported page_is_ram() Greg Kroah-Hartman
` (10 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Saurav Kashyap, Nilesh Javali,
Martin K. Petersen
From: Nilesh Javali <njavali@marvell.com>
commit ef222f551e7c4e2008fc442ffc9edcd1a7fd8f63 upstream.
While performing certain power-off sequences, PCI drivers are called to
suspend and resume their underlying devices through PCI PM (power
management) interface. However the hardware does not support PCI PM
suspend/resume operations so system wide suspend/resume leads to bad MFW
(management firmware) state which causes various follow-up errors in driver
when communicating with the device/firmware.
To fix this driver implements PCI PM suspend handler to indicate
unsupported operation to the PCI subsystem explicitly, thus avoiding system
to go into suspended/standby mode.
Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20230807093725.46829-1-njavali@marvell.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qedf/qedf_main.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -31,6 +31,7 @@ static void qedf_remove(struct pci_dev *
static void qedf_shutdown(struct pci_dev *pdev);
static void qedf_schedule_recovery_handler(void *dev);
static void qedf_recovery_handler(struct work_struct *work);
+static int qedf_suspend(struct pci_dev *pdev, pm_message_t state);
/*
* Driver module parameters.
@@ -3272,6 +3273,7 @@ static struct pci_driver qedf_pci_driver
.probe = qedf_probe,
.remove = qedf_remove,
.shutdown = qedf_shutdown,
+ .suspend = qedf_suspend,
};
static int __qedf_probe(struct pci_dev *pdev, int mode)
@@ -3986,6 +3988,22 @@ static void qedf_shutdown(struct pci_dev
__qedf_remove(pdev, QEDF_MODE_NORMAL);
}
+static int qedf_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+ struct qedf_ctx *qedf;
+
+ if (!pdev) {
+ QEDF_ERR(NULL, "pdev is NULL.\n");
+ return -ENODEV;
+ }
+
+ qedf = pci_get_drvdata(pdev);
+
+ QEDF_ERR(&qedf->dbg_ctx, "%s: Device does not support suspend operation\n", __func__);
+
+ return -EPERM;
+}
+
/*
* Recovery handler code
*/
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 67/68] alpha: remove __init annotation from exported page_is_ram()
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2023-08-13 21:20 ` [PATCH 5.10 66/68] scsi: qedf: " Greg Kroah-Hartman
@ 2023-08-13 21:20 ` Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 68/68] sch_netem: fix issues in netem_change() vs get_dist_table() Greg Kroah-Hartman
` (9 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Masahiro Yamada, Randy Dunlap
From: Masahiro Yamada <masahiroy@kernel.org>
commit 6ccbd7fd474674654019a20177c943359469103a upstream.
EXPORT_SYMBOL and __init is a bad combination because the .init.text
section is freed up after the initialization.
Commit c5a130325f13 ("ACPI/APEI: Add parameter check before error
injection") exported page_is_ram(), hence the __init annotation should
be removed.
This fixes the modpost warning in ARCH=alpha builds:
WARNING: modpost: vmlinux: page_is_ram: EXPORT_SYMBOL used for init symbol. Remove __init or EXPORT_SYMBOL.
Fixes: c5a130325f13 ("ACPI/APEI: Add parameter check before error injection")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/kernel/setup.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/alpha/kernel/setup.c
+++ b/arch/alpha/kernel/setup.c
@@ -394,8 +394,7 @@ setup_memory(void *kernel_end)
extern void setup_memory(void *);
#endif /* !CONFIG_DISCONTIGMEM */
-int __init
-page_is_ram(unsigned long pfn)
+int page_is_ram(unsigned long pfn)
{
struct memclust_struct * cluster;
struct memdesc_struct * memdesc;
^ permalink raw reply [flat|nested] 79+ messages in thread
* [PATCH 5.10 68/68] sch_netem: fix issues in netem_change() vs get_dist_table()
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2023-08-13 21:20 ` [PATCH 5.10 67/68] alpha: remove __init annotation from exported page_is_ram() Greg Kroah-Hartman
@ 2023-08-13 21:20 ` Greg Kroah-Hartman
2023-08-14 14:53 ` [PATCH 5.10 00/68] 5.10.191-rc1 review Thierry Reding
` (8 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-13 21:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet,
Stephen Hemminger, Jamal Hadi Salim, Simon Horman,
Jakub Kicinski, Fedor Pchelkin
From: Eric Dumazet <edumazet@google.com>
commit 11b73313c12403f617b47752db0ab3deef201af7 upstream.
In blamed commit, I missed that get_dist_table() was allocating
memory using GFP_KERNEL, and acquiring qdisc lock to perform
the swap of newly allocated table with current one.
In this patch, get_dist_table() is allocating memory and
copy user data before we acquire the qdisc lock.
Then we perform swap operations while being protected by the lock.
Note that after this patch netem_change() no longer can do partial changes.
If an error is returned, qdisc conf is left unchanged.
Fixes: 2174a08db80d ("sch_netem: acquire qdisc lock in netem_change()")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230622181503.2327695-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_netem.c | 59 +++++++++++++++++++++-----------------------------
1 file changed, 25 insertions(+), 34 deletions(-)
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -773,12 +773,10 @@ static void dist_free(struct disttable *
* signed 16 bit values.
*/
-static int get_dist_table(struct Qdisc *sch, struct disttable **tbl,
- const struct nlattr *attr)
+static int get_dist_table(struct disttable **tbl, const struct nlattr *attr)
{
size_t n = nla_len(attr)/sizeof(__s16);
const __s16 *data = nla_data(attr);
- spinlock_t *root_lock;
struct disttable *d;
int i;
@@ -793,13 +791,7 @@ static int get_dist_table(struct Qdisc *
for (i = 0; i < n; i++)
d->table[i] = data[i];
- root_lock = qdisc_root_sleeping_lock(sch);
-
- spin_lock_bh(root_lock);
- swap(*tbl, d);
- spin_unlock_bh(root_lock);
-
- dist_free(d);
+ *tbl = d;
return 0;
}
@@ -956,6 +948,8 @@ static int netem_change(struct Qdisc *sc
{
struct netem_sched_data *q = qdisc_priv(sch);
struct nlattr *tb[TCA_NETEM_MAX + 1];
+ struct disttable *delay_dist = NULL;
+ struct disttable *slot_dist = NULL;
struct tc_netem_qopt *qopt;
struct clgstate old_clg;
int old_loss_model = CLG_RANDOM;
@@ -969,6 +963,18 @@ static int netem_change(struct Qdisc *sc
if (ret < 0)
return ret;
+ if (tb[TCA_NETEM_DELAY_DIST]) {
+ ret = get_dist_table(&delay_dist, tb[TCA_NETEM_DELAY_DIST]);
+ if (ret)
+ goto table_free;
+ }
+
+ if (tb[TCA_NETEM_SLOT_DIST]) {
+ ret = get_dist_table(&slot_dist, tb[TCA_NETEM_SLOT_DIST]);
+ if (ret)
+ goto table_free;
+ }
+
sch_tree_lock(sch);
/* backup q->clg and q->loss_model */
old_clg = q->clg;
@@ -978,26 +984,17 @@ static int netem_change(struct Qdisc *sc
ret = get_loss_clg(q, tb[TCA_NETEM_LOSS]);
if (ret) {
q->loss_model = old_loss_model;
+ q->clg = old_clg;
goto unlock;
}
} else {
q->loss_model = CLG_RANDOM;
}
- if (tb[TCA_NETEM_DELAY_DIST]) {
- ret = get_dist_table(sch, &q->delay_dist,
- tb[TCA_NETEM_DELAY_DIST]);
- if (ret)
- goto get_table_failure;
- }
-
- if (tb[TCA_NETEM_SLOT_DIST]) {
- ret = get_dist_table(sch, &q->slot_dist,
- tb[TCA_NETEM_SLOT_DIST]);
- if (ret)
- goto get_table_failure;
- }
-
+ if (delay_dist)
+ swap(q->delay_dist, delay_dist);
+ if (slot_dist)
+ swap(q->slot_dist, slot_dist);
sch->limit = qopt->limit;
q->latency = PSCHED_TICKS2NS(qopt->latency);
@@ -1047,17 +1044,11 @@ static int netem_change(struct Qdisc *sc
unlock:
sch_tree_unlock(sch);
- return ret;
-get_table_failure:
- /* recover clg and loss_model, in case of
- * q->clg and q->loss_model were modified
- * in get_loss_clg()
- */
- q->clg = old_clg;
- q->loss_model = old_loss_model;
-
- goto unlock;
+table_free:
+ dist_free(delay_dist);
+ dist_free(slot_dist);
+ return ret;
}
static int netem_init(struct Qdisc *sch, struct nlattr *opt,
^ permalink raw reply [flat|nested] 79+ messages in thread
* Re: [PATCH 5.10 00/68] 5.10.191-rc1 review
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2023-08-13 21:20 ` [PATCH 5.10 68/68] sch_netem: fix issues in netem_change() vs get_dist_table() Greg Kroah-Hartman
@ 2023-08-14 14:53 ` Thierry Reding
2023-08-14 14:54 ` Thierry Reding
` (7 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Thierry Reding @ 2023-08-14 14:53 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, linux-tegra
On Sun, 13 Aug 2023 23:19:01 +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.191 release.
> There are 68 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.191-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
All tests passing for Tegra ...
Test results for stable-v5.10:
11 builds: 11 pass, 0 fail
28 boots: 28 pass, 0 fail
75 tests: 75 pass, 0 fail
Linux version: 5.10.191-rc1-ge3154e1b14b6
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04
Tested-by: Thierry Reding <treding@nvidia.com>
^ permalink raw reply [flat|nested] 79+ messages in thread
* Re: [PATCH 5.10 00/68] 5.10.191-rc1 review
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2023-08-14 14:53 ` [PATCH 5.10 00/68] 5.10.191-rc1 review Thierry Reding
@ 2023-08-14 14:54 ` Thierry Reding
2023-08-14 18:24 ` Guenter Roeck
` (6 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Thierry Reding @ 2023-08-14 14:54 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, linux-tegra
On Sun, 13 Aug 2023 23:19:01 +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.191 release.
> There are 68 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.191-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
All tests passing for Tegra ...
Test results for stable-v5.10:
11 builds: 11 pass, 0 fail
28 boots: 28 pass, 0 fail
75 tests: 75 pass, 0 fail
Linux version: 5.10.191-rc1-g5b1776cc14bf
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04
Tested-by: Thierry Reding <treding@nvidia.com>
^ permalink raw reply [flat|nested] 79+ messages in thread
* Re: [PATCH 5.10 00/68] 5.10.191-rc1 review
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2023-08-14 14:54 ` Thierry Reding
@ 2023-08-14 18:24 ` Guenter Roeck
2023-08-15 0:52 ` Shuah Khan
` (5 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Guenter Roeck @ 2023-08-14 18:24 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
On Sun, Aug 13, 2023 at 11:19:01PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.191 release.
> There are 68 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000.
> Anything received after that time might be too late.
>
Build results:
total: 159 pass: 159 fail: 0
Qemu test results:
total: 487 pass: 487 fail: 0
Tested-by: Guenter Roeck <linux@roeck-us.net>
Guenter
^ permalink raw reply [flat|nested] 79+ messages in thread
* Re: [PATCH 5.10 00/68] 5.10.191-rc1 review
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2023-08-14 18:24 ` Guenter Roeck
@ 2023-08-15 0:52 ` Shuah Khan
2023-08-15 3:23 ` Florian Fainelli
` (4 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Shuah Khan @ 2023-08-15 0:52 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, Shuah Khan
On 8/13/23 15:19, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.191 release.
> There are 68 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.191-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 79+ messages in thread
* Re: [PATCH 5.10 00/68] 5.10.191-rc1 review
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2023-08-15 0:52 ` Shuah Khan
@ 2023-08-15 3:23 ` Florian Fainelli
2023-08-15 5:32 ` Daniel Díaz
` (3 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Florian Fainelli @ 2023-08-15 3:23 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, srw, rwarsow,
conor
On 8/13/23 14:19, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.191 release.
> There are 68 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.191-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 79+ messages in thread
* Re: [PATCH 5.10 00/68] 5.10.191-rc1 review
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2023-08-15 3:23 ` Florian Fainelli
@ 2023-08-15 5:32 ` Daniel Díaz
2023-08-15 17:10 ` Allen Pais
` (2 subsequent siblings)
76 siblings, 0 replies; 79+ messages in thread
From: Daniel Díaz @ 2023-08-15 5:32 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
Hello!
On 13/08/23 15:19, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.191 release.
> There are 68 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.191-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
This branch exhibits the same problem with regards to x86 and Clang as reported on 6.4 [1], 6.1 [2] and 5.15 [3].
Other than that, rest looks good:
## Build
* kernel: 5.10.191-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.10.y
* git commit: 5b1776cc14bf85186ed45a8d68d33206f73c727e
* git describe: v5.10.190-69-g5b1776cc14bf
* test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.190-69-g5b1776cc14bf
## Test regressions (compared to v5.10.190)
* x86, log-parser-boot
- check-kernel-warning
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
## No metric regressions (compared to v5.10.190)
## No test fixes (compared to v5.10.190)
## No metric fixes (compared to v5.10.190)
## Test result summary
total: 124569, pass: 99567, fail: 3522, skip: 21366, xfail: 114
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 117 total, 116 passed, 1 failed
* arm64: 45 total, 45 passed, 0 failed
* i386: 35 total, 35 passed, 0 failed
* mips: 27 total, 26 passed, 1 failed
* parisc: 4 total, 0 passed, 4 failed
* powerpc: 26 total, 25 passed, 1 failed
* riscv: 12 total, 11 passed, 1 failed
* s390: 12 total, 12 passed, 0 failed
* sh: 14 total, 12 passed, 2 failed
* sparc: 8 total, 8 passed, 0 failed
* x86_64: 38 total, 38 passed, 0 failed
## Test suites summary
* boot
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timens
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-watchdog
* kselftest-x86
* kunit
* kvm-unit-tests
* libgpiod
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* perf
* rcutorture
* v4l2-compliance
Greetings!
Daniel Díaz
daniel.diaz@linaro.org
[1] https://lore.kernel.org/stable/b2145971-5417-e1b1-40b4-f971e247e1ea@linaro.org/
[2] https://lore.kernel.org/stable/239281dd-3cb8-23de-9ea1-27e9c224cfbd@linaro.org/
[3] https://lore.kernel.org/stable/5a3f5686-b303-8c30-a637-787be94f6623@linaro.org/
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 79+ messages in thread
* Re: [PATCH 5.10 00/68] 5.10.191-rc1 review
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2023-08-15 5:32 ` Daniel Díaz
@ 2023-08-15 17:10 ` Allen Pais
2023-08-16 22:29 ` Joel Fernandes
2023-08-21 2:34 ` luomeng
76 siblings, 0 replies; 79+ messages in thread
From: Allen Pais @ 2023-08-15 17:10 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
> This is the start of the stable review cycle for the 5.10.191 release.
> There are 68 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.191-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my x86_64 and ARM64 test systems. No errors or
regressions.
Tested-by: Allen Pais <apais@linux.microsoft.com>
Thanks.
^ permalink raw reply [flat|nested] 79+ messages in thread
* Re: [PATCH 5.10 00/68] 5.10.191-rc1 review
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2023-08-15 17:10 ` Allen Pais
@ 2023-08-16 22:29 ` Joel Fernandes
2023-08-21 2:34 ` luomeng
76 siblings, 0 replies; 79+ messages in thread
From: Joel Fernandes @ 2023-08-16 22:29 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
Hi Greg,
On Sun, Aug 13, 2023 at 11:19:01PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.191 release.
> There are 68 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.191-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
I had sent these with the SHA:
https://lore.kernel.org/stable/20230814033934.1165010-1-joel@joelfernandes.org/#t
Can it be applied for next release or should I resend?
thanks,
- Joel
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 5.10.191-rc1
>
> Eric Dumazet <edumazet@google.com>
> sch_netem: fix issues in netem_change() vs get_dist_table()
>
> Masahiro Yamada <masahiroy@kernel.org>
> alpha: remove __init annotation from exported page_is_ram()
>
> Nilesh Javali <njavali@marvell.com>
> scsi: qedf: Fix firmware halt over suspend and resume
>
> Nilesh Javali <njavali@marvell.com>
> scsi: qedi: Fix firmware halt over suspend and resume
>
> Zhu Wang <wangzhu9@huawei.com>
> scsi: core: Fix possible memory leak if device_add() fails
>
> Zhu Wang <wangzhu9@huawei.com>
> scsi: snic: Fix possible memory leak if device_add() fails
>
> Alexandra Diupina <adiupina@astralinux.ru>
> scsi: 53c700: Check that command slot is not NULL
>
> Michael Kelley <mikelley@microsoft.com>
> scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
>
> Tony Battersby <tonyb@cybernetics.com>
> scsi: core: Fix legacy /proc parsing buffer overflow
>
> Pablo Neira Ayuso <pablo@netfilter.org>
> netfilter: nf_tables: report use refcount overflow
>
> Ming Lei <ming.lei@redhat.com>
> nvme-rdma: fix potential unbalanced freeze & unfreeze
>
> Ming Lei <ming.lei@redhat.com>
> nvme-tcp: fix potential unbalanced freeze & unfreeze
>
> Josef Bacik <josef@toxicpanda.com>
> btrfs: set cache_block_group_error if we find an error
>
> Christoph Hellwig <hch@lst.de>
> btrfs: don't stop integrity writeback too early
>
> Nick Child <nnac123@linux.ibm.com>
> ibmvnic: Handle DMA unmapping of login buffs in release functions
>
> Nick Child <nnac123@linux.ibm.com>
> ibmvnic: Unmap DMA login rsp buffer on send login fail
>
> Nick Child <nnac123@linux.ibm.com>
> ibmvnic: Enforce stronger sanity checks on login response
>
> Daniel Jurgens <danielj@nvidia.com>
> net/mlx5: Allow 0 for total host VFs
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> dmaengine: mcf-edma: Fix a potential un-allocated memory access
>
> Jie Wang <wangjie125@huawei.com>
> net: hns3: add wait until mac link down
>
> Jie Wang <wangjie125@huawei.com>
> net: hns3: refactor hclge_mac_link_status_wait for interface reuse
>
> Li Yang <leoyang.li@nxp.com>
> net: phy: at803x: remove set/get wol callbacks for AR8032
>
> Felix Fietkau <nbd@nbd.name>
> wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
>
> Douglas Miller <doug.miller@cornelisnetworks.com>
> IB/hfi1: Fix possible panic during hotplug remove
>
> Andrew Kanner <andrew.kanner@gmail.com>
> drivers: net: prevent tun_build_skb() to exceed the packet size limit
>
> Eric Dumazet <edumazet@google.com>
> dccp: fix data-race around dp->dccps_mss_cache
>
> Ziyang Xuan <william.xuanziyang@huawei.com>
> bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
>
> Florian Westphal <fw@strlen.de>
> tunnels: fix kasan splat when generating ipv4 pmtu error
>
> Eric Dumazet <edumazet@google.com>
> net/packet: annotate data-races around tp->status
>
> Nathan Chancellor <nathan@kernel.org>
> mISDN: Update parameter type of dsp_cmx_send()
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: forwarding: tc_flower: Relax success criterion
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: forwarding: Switch off timeout
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: forwarding: Skip test when no interfaces are specified
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: forwarding: ethtool_extended_state: Skip when using veth pairs
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: forwarding: ethtool: Skip when using veth pairs
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: forwarding: Add a helper to skip test when using veth pairs
>
> Mark Brown <broonie@kernel.org>
> selftests/rseq: Fix build with undefined __weak
>
> Florian Westphal <fw@strlen.de>
> netfilter: nf_tables: don't skip expired elements during walk
>
> Karol Herbst <kherbst@redhat.com>
> drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
>
> Arnd Bergmann <arnd@arndb.de>
> x86: Move gds_ucode_mitigated() declaration to header
>
> Arnd Bergmann <arnd@arndb.de>
> x86/speculation: Add cpu_show_gds() prototype
>
> Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
>
> Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
> x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
>
> Nick Desaulniers <ndesaulniers@google.com>
> x86/srso: Fix build breakage with the LLVM linker
>
> Prashanth K <quic_prashk@quicinc.com>
> usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
>
> Elson Roy Serrao <quic_eserrao@quicinc.com>
> usb: dwc3: Properly handle processing of pending events
>
> Alan Stern <stern@rowland.harvard.edu>
> usb-storage: alauda: Fix uninit-value in alauda_check_media()
>
> Qi Zheng <zhengqi.arch@bytedance.com>
> binder: fix memory leak in binder_init()
>
> Yiyuan Guo <yguoaz@gmail.com>
> iio: cros_ec: Fix the allocation size for cros_ec_command
>
> Aleksa Sarai <cyphar@cyphar.com>
> io_uring: correct check for O_TMPFILE
>
> Ryusuke Konishi <konishi.ryusuke@gmail.com>
> nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/pkeys: Revert a5eff7259790 ("x86/pkeys: Add PKRU value to init_fpstate")
>
> Colin Ian King <colin.i.king@gmail.com>
> radix tree test suite: fix incorrect allocation size for pthreads
>
> Tao Ren <rentao.bupt@gmail.com>
> hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100
>
> Melissa Wen <mwen@igalia.com>
> drm/amd/display: check attr flag before set cursor degamma on DCN3+
>
> Boris Brezillon <boris.brezillon@collabora.com>
> drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()
>
> Karol Herbst <kherbst@redhat.com>
> drm/nouveau/gr: enable memory loads on helper invocation on all channels
>
> Andrea Parri <parri.andrea@gmail.com>
> riscv,mmio: Fix readX()-to-delay() ordering
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> dmaengine: pl330: Return DMA_PAUSED when transaction is paused
>
> Ilya Leoshkevich <iii@linux.ibm.com>
> selftests/bpf: Fix sk_assign on s390x
>
> Yonghong Song <yhs@fb.com>
> selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code
>
> Andrii Nakryiko <andrii@kernel.org>
> selftests/bpf: make test_align selftest more robust
>
> Andrii Nakryiko <andrii@kernel.org>
> bpf: aggressively forget precise markings during state checkpointing
>
> Andrii Nakryiko <andrii@kernel.org>
> bpf: stop setting precise in current state
>
> Andrii Nakryiko <andrii@kernel.org>
> bpf: allow precision tracking for programs with subprogs
>
> Maciej Żenczykowski <maze@google.com>
> ipv6: adjust ndisc_is_useropt() to also return true for PIO
>
> Sergei Antonov <saproj@gmail.com>
> mmc: moxart: read scr register without changing byte order
>
> Jason A. Donenfeld <Jason@zx2c4.com>
> wireguard: allowedips: expand maximum node depth
>
>
> -------------
>
> Diffstat:
>
> Makefile | 4 +-
> arch/alpha/kernel/setup.c | 3 +-
> arch/riscv/include/asm/mmio.h | 16 +-
> arch/x86/entry/vdso/vma.c | 4 +-
> arch/x86/include/asm/processor.h | 2 +
> arch/x86/kernel/cpu/amd.c | 1 +
> arch/x86/kernel/cpu/common.c | 5 -
> arch/x86/kernel/vmlinux.lds.S | 12 +-
> arch/x86/kvm/x86.c | 2 -
> arch/x86/mm/pkeys.c | 6 -
> drivers/android/binder.c | 1 +
> drivers/android/binder_alloc.c | 6 +
> drivers/android/binder_alloc.h | 1 +
> drivers/dma/mcf-edma.c | 13 +-
> drivers/dma/pl330.c | 18 ++-
> drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c | 7 +-
> drivers/gpu/drm/drm_gem_shmem_helper.c | 6 +
> drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +-
> drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h | 1 +
> drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c | 4 +-
> drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c | 10 ++
> drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c | 1 +
> drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c | 1 +
> drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c | 1 +
> drivers/hwmon/pmbus/bel-pfe.c | 16 +-
> .../common/cros_ec_sensors/cros_ec_sensors_core.c | 2 +-
> drivers/infiniband/hw/hfi1/chip.c | 1 +
> drivers/isdn/mISDN/dsp.h | 2 +-
> drivers/isdn/mISDN/dsp_cmx.c | 2 +-
> drivers/isdn/mISDN/dsp_core.c | 2 +-
> drivers/mmc/host/moxart-mmc.c | 8 +-
> drivers/net/bonding/bond_main.c | 4 +-
> .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 24 ++-
> drivers/net/ethernet/ibm/ibmvnic.c | 38 ++++-
> drivers/net/ethernet/mellanox/mlx5/core/sriov.c | 3 +-
> drivers/net/phy/at803x.c | 2 -
> drivers/net/tun.c | 2 +-
> drivers/net/wireguard/allowedips.c | 8 +-
> drivers/net/wireguard/selftest/allowedips.c | 16 +-
> drivers/nvme/host/rdma.c | 3 +-
> drivers/nvme/host/tcp.c | 3 +-
> drivers/scsi/53c700.c | 2 +-
> drivers/scsi/qedf/qedf_main.c | 18 +++
> drivers/scsi/qedi/qedi_main.c | 18 +++
> drivers/scsi/raid_class.c | 1 +
> drivers/scsi/scsi_proc.c | 30 ++--
> drivers/scsi/snic/snic_disc.c | 1 +
> drivers/scsi/storvsc_drv.c | 4 -
> drivers/usb/common/usb-conn-gpio.c | 6 +-
> drivers/usb/dwc3/gadget.c | 9 +-
> drivers/usb/storage/alauda.c | 12 +-
> fs/btrfs/extent-tree.c | 5 +-
> fs/btrfs/extent_io.c | 7 +-
> fs/nilfs2/inode.c | 8 +
> fs/nilfs2/segment.c | 2 +
> fs/nilfs2/the_nilfs.h | 2 +
> include/linux/cpu.h | 2 +
> include/net/cfg80211.h | 3 +
> include/net/netfilter/nf_tables.h | 31 +++-
> io_uring/io_uring.c | 6 +-
> kernel/bpf/verifier.c | 175 +++++++++++++++++++--
> net/dccp/output.c | 2 +-
> net/dccp/proto.c | 10 +-
> net/ipv4/ip_tunnel_core.c | 2 +-
> net/ipv6/ndisc.c | 3 +-
> net/netfilter/nf_tables_api.c | 175 +++++++++++++--------
> net/netfilter/nft_flow_offload.c | 6 +-
> net/netfilter/nft_immediate.c | 8 +-
> net/netfilter/nft_objref.c | 8 +-
> net/netfilter/nft_set_hash.c | 2 -
> net/netfilter/nft_set_pipapo.c | 18 ++-
> net/netfilter/nft_set_rbtree.c | 2 -
> net/packet/af_packet.c | 16 +-
> net/sched/sch_netem.c | 59 +++----
> tools/testing/radix-tree/regression1.c | 2 +-
> tools/testing/selftests/bpf/prog_tests/align.c | 36 +++--
> tools/testing/selftests/bpf/prog_tests/sk_assign.c | 25 ++-
> tools/testing/selftests/bpf/progs/connect4_prog.c | 2 +-
> tools/testing/selftests/bpf/progs/test_sk_assign.c | 11 ++
> .../selftests/bpf/progs/test_sk_assign_libbpf.c | 3 +
> tools/testing/selftests/net/forwarding/ethtool.sh | 2 +
> .../net/forwarding/ethtool_extended_state.sh | 2 +
> tools/testing/selftests/net/forwarding/lib.sh | 16 ++
> tools/testing/selftests/net/forwarding/settings | 1 +
> .../testing/selftests/net/forwarding/tc_flower.sh | 8 +-
> tools/testing/selftests/rseq/Makefile | 4 +-
> tools/testing/selftests/rseq/rseq.c | 2 +
> 87 files changed, 737 insertions(+), 293 deletions(-)
>
>
^ permalink raw reply [flat|nested] 79+ messages in thread
* Re: [PATCH 5.10 00/68] 5.10.191-rc1 review
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2023-08-16 22:29 ` Joel Fernandes
@ 2023-08-21 2:34 ` luomeng
76 siblings, 0 replies; 79+ messages in thread
From: luomeng @ 2023-08-21 2:34 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
Tested on arm64 and x86 for 5.10.191-rc1,
Kernel
repo:https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-5.10.y
Version: 5.10.191-rc1
Commit: da742ebfa00c3add4a358dd79ec92161c07e1435
Compiler: gcc version 7.3.0 (GCC)
arm64:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8978
passed: 8978
failed: 0
timeout: 0
--------------------------------------------------------------------
x86:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8978
passed: 8978
failed: 0
timeout: 0
--------------------------------------------------------------------
Tested-by: Hulk Robot <hulkrobot@huawei.com>
在 2023/8/14 5:19, Greg Kroah-Hartman 写道:
> This is the start of the stable review cycle for the 5.10.191 release.
> There are 68 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.191-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 5.10.191-rc1
>
> Eric Dumazet <edumazet@google.com>
> sch_netem: fix issues in netem_change() vs get_dist_table()
>
> Masahiro Yamada <masahiroy@kernel.org>
> alpha: remove __init annotation from exported page_is_ram()
>
> Nilesh Javali <njavali@marvell.com>
> scsi: qedf: Fix firmware halt over suspend and resume
>
> Nilesh Javali <njavali@marvell.com>
> scsi: qedi: Fix firmware halt over suspend and resume
>
> Zhu Wang <wangzhu9@huawei.com>
> scsi: core: Fix possible memory leak if device_add() fails
>
> Zhu Wang <wangzhu9@huawei.com>
> scsi: snic: Fix possible memory leak if device_add() fails
>
> Alexandra Diupina <adiupina@astralinux.ru>
> scsi: 53c700: Check that command slot is not NULL
>
> Michael Kelley <mikelley@microsoft.com>
> scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
>
> Tony Battersby <tonyb@cybernetics.com>
> scsi: core: Fix legacy /proc parsing buffer overflow
>
> Pablo Neira Ayuso <pablo@netfilter.org>
> netfilter: nf_tables: report use refcount overflow
>
> Ming Lei <ming.lei@redhat.com>
> nvme-rdma: fix potential unbalanced freeze & unfreeze
>
> Ming Lei <ming.lei@redhat.com>
> nvme-tcp: fix potential unbalanced freeze & unfreeze
>
> Josef Bacik <josef@toxicpanda.com>
> btrfs: set cache_block_group_error if we find an error
>
> Christoph Hellwig <hch@lst.de>
> btrfs: don't stop integrity writeback too early
>
> Nick Child <nnac123@linux.ibm.com>
> ibmvnic: Handle DMA unmapping of login buffs in release functions
>
> Nick Child <nnac123@linux.ibm.com>
> ibmvnic: Unmap DMA login rsp buffer on send login fail
>
> Nick Child <nnac123@linux.ibm.com>
> ibmvnic: Enforce stronger sanity checks on login response
>
> Daniel Jurgens <danielj@nvidia.com>
> net/mlx5: Allow 0 for total host VFs
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> dmaengine: mcf-edma: Fix a potential un-allocated memory access
>
> Jie Wang <wangjie125@huawei.com>
> net: hns3: add wait until mac link down
>
> Jie Wang <wangjie125@huawei.com>
> net: hns3: refactor hclge_mac_link_status_wait for interface reuse
>
> Li Yang <leoyang.li@nxp.com>
> net: phy: at803x: remove set/get wol callbacks for AR8032
>
> Felix Fietkau <nbd@nbd.name>
> wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
>
> Douglas Miller <doug.miller@cornelisnetworks.com>
> IB/hfi1: Fix possible panic during hotplug remove
>
> Andrew Kanner <andrew.kanner@gmail.com>
> drivers: net: prevent tun_build_skb() to exceed the packet size limit
>
> Eric Dumazet <edumazet@google.com>
> dccp: fix data-race around dp->dccps_mss_cache
>
> Ziyang Xuan <william.xuanziyang@huawei.com>
> bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
>
> Florian Westphal <fw@strlen.de>
> tunnels: fix kasan splat when generating ipv4 pmtu error
>
> Eric Dumazet <edumazet@google.com>
> net/packet: annotate data-races around tp->status
>
> Nathan Chancellor <nathan@kernel.org>
> mISDN: Update parameter type of dsp_cmx_send()
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: forwarding: tc_flower: Relax success criterion
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: forwarding: Switch off timeout
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: forwarding: Skip test when no interfaces are specified
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: forwarding: ethtool_extended_state: Skip when using veth pairs
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: forwarding: ethtool: Skip when using veth pairs
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: forwarding: Add a helper to skip test when using veth pairs
>
> Mark Brown <broonie@kernel.org>
> selftests/rseq: Fix build with undefined __weak
>
> Florian Westphal <fw@strlen.de>
> netfilter: nf_tables: don't skip expired elements during walk
>
> Karol Herbst <kherbst@redhat.com>
> drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
>
> Arnd Bergmann <arnd@arndb.de>
> x86: Move gds_ucode_mitigated() declaration to header
>
> Arnd Bergmann <arnd@arndb.de>
> x86/speculation: Add cpu_show_gds() prototype
>
> Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
>
> Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
> x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
>
> Nick Desaulniers <ndesaulniers@google.com>
> x86/srso: Fix build breakage with the LLVM linker
>
> Prashanth K <quic_prashk@quicinc.com>
> usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
>
> Elson Roy Serrao <quic_eserrao@quicinc.com>
> usb: dwc3: Properly handle processing of pending events
>
> Alan Stern <stern@rowland.harvard.edu>
> usb-storage: alauda: Fix uninit-value in alauda_check_media()
>
> Qi Zheng <zhengqi.arch@bytedance.com>
> binder: fix memory leak in binder_init()
>
> Yiyuan Guo <yguoaz@gmail.com>
> iio: cros_ec: Fix the allocation size for cros_ec_command
>
> Aleksa Sarai <cyphar@cyphar.com>
> io_uring: correct check for O_TMPFILE
>
> Ryusuke Konishi <konishi.ryusuke@gmail.com>
> nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/pkeys: Revert a5eff7259790 ("x86/pkeys: Add PKRU value to init_fpstate")
>
> Colin Ian King <colin.i.king@gmail.com>
> radix tree test suite: fix incorrect allocation size for pthreads
>
> Tao Ren <rentao.bupt@gmail.com>
> hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100
>
> Melissa Wen <mwen@igalia.com>
> drm/amd/display: check attr flag before set cursor degamma on DCN3+
>
> Boris Brezillon <boris.brezillon@collabora.com>
> drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()
>
> Karol Herbst <kherbst@redhat.com>
> drm/nouveau/gr: enable memory loads on helper invocation on all channels
>
> Andrea Parri <parri.andrea@gmail.com>
> riscv,mmio: Fix readX()-to-delay() ordering
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> dmaengine: pl330: Return DMA_PAUSED when transaction is paused
>
> Ilya Leoshkevich <iii@linux.ibm.com>
> selftests/bpf: Fix sk_assign on s390x
>
> Yonghong Song <yhs@fb.com>
> selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code
>
> Andrii Nakryiko <andrii@kernel.org>
> selftests/bpf: make test_align selftest more robust
>
> Andrii Nakryiko <andrii@kernel.org>
> bpf: aggressively forget precise markings during state checkpointing
>
> Andrii Nakryiko <andrii@kernel.org>
> bpf: stop setting precise in current state
>
> Andrii Nakryiko <andrii@kernel.org>
> bpf: allow precision tracking for programs with subprogs
>
> Maciej Żenczykowski <maze@google.com>
> ipv6: adjust ndisc_is_useropt() to also return true for PIO
>
> Sergei Antonov <saproj@gmail.com>
> mmc: moxart: read scr register without changing byte order
>
> Jason A. Donenfeld <Jason@zx2c4.com>
> wireguard: allowedips: expand maximum node depth
>
>
> -------------
>
> Diffstat:
>
> Makefile | 4 +-
> arch/alpha/kernel/setup.c | 3 +-
> arch/riscv/include/asm/mmio.h | 16 +-
> arch/x86/entry/vdso/vma.c | 4 +-
> arch/x86/include/asm/processor.h | 2 +
> arch/x86/kernel/cpu/amd.c | 1 +
> arch/x86/kernel/cpu/common.c | 5 -
> arch/x86/kernel/vmlinux.lds.S | 12 +-
> arch/x86/kvm/x86.c | 2 -
> arch/x86/mm/pkeys.c | 6 -
> drivers/android/binder.c | 1 +
> drivers/android/binder_alloc.c | 6 +
> drivers/android/binder_alloc.h | 1 +
> drivers/dma/mcf-edma.c | 13 +-
> drivers/dma/pl330.c | 18 ++-
> drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c | 7 +-
> drivers/gpu/drm/drm_gem_shmem_helper.c | 6 +
> drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +-
> drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h | 1 +
> drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c | 4 +-
> drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c | 10 ++
> drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c | 1 +
> drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c | 1 +
> drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c | 1 +
> drivers/hwmon/pmbus/bel-pfe.c | 16 +-
> .../common/cros_ec_sensors/cros_ec_sensors_core.c | 2 +-
> drivers/infiniband/hw/hfi1/chip.c | 1 +
> drivers/isdn/mISDN/dsp.h | 2 +-
> drivers/isdn/mISDN/dsp_cmx.c | 2 +-
> drivers/isdn/mISDN/dsp_core.c | 2 +-
> drivers/mmc/host/moxart-mmc.c | 8 +-
> drivers/net/bonding/bond_main.c | 4 +-
> .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 24 ++-
> drivers/net/ethernet/ibm/ibmvnic.c | 38 ++++-
> drivers/net/ethernet/mellanox/mlx5/core/sriov.c | 3 +-
> drivers/net/phy/at803x.c | 2 -
> drivers/net/tun.c | 2 +-
> drivers/net/wireguard/allowedips.c | 8 +-
> drivers/net/wireguard/selftest/allowedips.c | 16 +-
> drivers/nvme/host/rdma.c | 3 +-
> drivers/nvme/host/tcp.c | 3 +-
> drivers/scsi/53c700.c | 2 +-
> drivers/scsi/qedf/qedf_main.c | 18 +++
> drivers/scsi/qedi/qedi_main.c | 18 +++
> drivers/scsi/raid_class.c | 1 +
> drivers/scsi/scsi_proc.c | 30 ++--
> drivers/scsi/snic/snic_disc.c | 1 +
> drivers/scsi/storvsc_drv.c | 4 -
> drivers/usb/common/usb-conn-gpio.c | 6 +-
> drivers/usb/dwc3/gadget.c | 9 +-
> drivers/usb/storage/alauda.c | 12 +-
> fs/btrfs/extent-tree.c | 5 +-
> fs/btrfs/extent_io.c | 7 +-
> fs/nilfs2/inode.c | 8 +
> fs/nilfs2/segment.c | 2 +
> fs/nilfs2/the_nilfs.h | 2 +
> include/linux/cpu.h | 2 +
> include/net/cfg80211.h | 3 +
> include/net/netfilter/nf_tables.h | 31 +++-
> io_uring/io_uring.c | 6 +-
> kernel/bpf/verifier.c | 175 +++++++++++++++++++--
> net/dccp/output.c | 2 +-
> net/dccp/proto.c | 10 +-
> net/ipv4/ip_tunnel_core.c | 2 +-
> net/ipv6/ndisc.c | 3 +-
> net/netfilter/nf_tables_api.c | 175 +++++++++++++--------
> net/netfilter/nft_flow_offload.c | 6 +-
> net/netfilter/nft_immediate.c | 8 +-
> net/netfilter/nft_objref.c | 8 +-
> net/netfilter/nft_set_hash.c | 2 -
> net/netfilter/nft_set_pipapo.c | 18 ++-
> net/netfilter/nft_set_rbtree.c | 2 -
> net/packet/af_packet.c | 16 +-
> net/sched/sch_netem.c | 59 +++----
> tools/testing/radix-tree/regression1.c | 2 +-
> tools/testing/selftests/bpf/prog_tests/align.c | 36 +++--
> tools/testing/selftests/bpf/prog_tests/sk_assign.c | 25 ++-
> tools/testing/selftests/bpf/progs/connect4_prog.c | 2 +-
> tools/testing/selftests/bpf/progs/test_sk_assign.c | 11 ++
> .../selftests/bpf/progs/test_sk_assign_libbpf.c | 3 +
> tools/testing/selftests/net/forwarding/ethtool.sh | 2 +
> .../net/forwarding/ethtool_extended_state.sh | 2 +
> tools/testing/selftests/net/forwarding/lib.sh | 16 ++
> tools/testing/selftests/net/forwarding/settings | 1 +
> .../testing/selftests/net/forwarding/tc_flower.sh | 8 +-
> tools/testing/selftests/rseq/Makefile | 4 +-
> tools/testing/selftests/rseq/rseq.c | 2 +
> 87 files changed, 737 insertions(+), 293 deletions(-)
>
>
> .
>
^ permalink raw reply [flat|nested] 79+ messages in thread
end of thread, other threads:[~2023-08-21 2:35 UTC | newest]
Thread overview: 79+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-13 21:19 [PATCH 5.10 00/68] 5.10.191-rc1 review Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 01/68] wireguard: allowedips: expand maximum node depth Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 02/68] mmc: moxart: read scr register without changing byte order Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 03/68] ipv6: adjust ndisc_is_useropt() to also return true for PIO Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 04/68] bpf: allow precision tracking for programs with subprogs Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 05/68] bpf: stop setting precise in current state Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 06/68] bpf: aggressively forget precise markings during state checkpointing Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 07/68] selftests/bpf: make test_align selftest more robust Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 08/68] selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 09/68] selftests/bpf: Fix sk_assign on s390x Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 10/68] dmaengine: pl330: Return DMA_PAUSED when transaction is paused Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 11/68] riscv,mmio: Fix readX()-to-delay() ordering Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 12/68] drm/nouveau/gr: enable memory loads on helper invocation on all channels Greg Kroah-Hartman
2023-08-13 21:19 ` [Nouveau] " Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 13/68] drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap() Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 14/68] drm/amd/display: check attr flag before set cursor degamma on DCN3+ Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 15/68] hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100 Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 16/68] radix tree test suite: fix incorrect allocation size for pthreads Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 17/68] x86/pkeys: Revert a5eff7259790 ("x86/pkeys: Add PKRU value to init_fpstate") Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 18/68] nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 19/68] io_uring: correct check for O_TMPFILE Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 20/68] iio: cros_ec: Fix the allocation size for cros_ec_command Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 21/68] binder: fix memory leak in binder_init() Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 22/68] usb-storage: alauda: Fix uninit-value in alauda_check_media() Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 23/68] usb: dwc3: Properly handle processing of pending events Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 24/68] usb: common: usb-conn-gpio: Prevent bailing out if initial role is none Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 25/68] x86/srso: Fix build breakage with the LLVM linker Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 26/68] x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 27/68] x86/mm: Fix VDSO and VVAR placement on 5-level paging machines Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 28/68] x86/speculation: Add cpu_show_gds() prototype Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 29/68] x86: Move gds_ucode_mitigated() declaration to header Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 30/68] drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 31/68] netfilter: nf_tables: dont skip expired elements during walk Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 32/68] selftests/rseq: Fix build with undefined __weak Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 33/68] selftests: forwarding: Add a helper to skip test when using veth pairs Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 34/68] selftests: forwarding: ethtool: Skip " Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 35/68] selftests: forwarding: ethtool_extended_state: " Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 36/68] selftests: forwarding: Skip test when no interfaces are specified Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 37/68] selftests: forwarding: Switch off timeout Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 38/68] selftests: forwarding: tc_flower: Relax success criterion Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 39/68] mISDN: Update parameter type of dsp_cmx_send() Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 40/68] net/packet: annotate data-races around tp->status Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 41/68] tunnels: fix kasan splat when generating ipv4 pmtu error Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 42/68] bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 43/68] dccp: fix data-race around dp->dccps_mss_cache Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 44/68] drivers: net: prevent tun_build_skb() to exceed the packet size limit Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 45/68] IB/hfi1: Fix possible panic during hotplug remove Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 46/68] wifi: cfg80211: fix sband iftype data lookup for AP_VLAN Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 47/68] net: phy: at803x: remove set/get wol callbacks for AR8032 Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 48/68] net: hns3: refactor hclge_mac_link_status_wait for interface reuse Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 49/68] net: hns3: add wait until mac link down Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 50/68] dmaengine: mcf-edma: Fix a potential un-allocated memory access Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 51/68] net/mlx5: Allow 0 for total host VFs Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 52/68] ibmvnic: Enforce stronger sanity checks on login response Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 53/68] ibmvnic: Unmap DMA login rsp buffer on send login fail Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 54/68] ibmvnic: Handle DMA unmapping of login buffs in release functions Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 55/68] btrfs: dont stop integrity writeback too early Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 56/68] btrfs: set cache_block_group_error if we find an error Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 57/68] nvme-tcp: fix potential unbalanced freeze & unfreeze Greg Kroah-Hartman
2023-08-13 21:19 ` [PATCH 5.10 58/68] nvme-rdma: " Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 59/68] netfilter: nf_tables: report use refcount overflow Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 60/68] scsi: core: Fix legacy /proc parsing buffer overflow Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 61/68] scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 62/68] scsi: 53c700: Check that command slot is not NULL Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 63/68] scsi: snic: Fix possible memory leak if device_add() fails Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 64/68] scsi: core: " Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 65/68] scsi: qedi: Fix firmware halt over suspend and resume Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 66/68] scsi: qedf: " Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 67/68] alpha: remove __init annotation from exported page_is_ram() Greg Kroah-Hartman
2023-08-13 21:20 ` [PATCH 5.10 68/68] sch_netem: fix issues in netem_change() vs get_dist_table() Greg Kroah-Hartman
2023-08-14 14:53 ` [PATCH 5.10 00/68] 5.10.191-rc1 review Thierry Reding
2023-08-14 14:54 ` Thierry Reding
2023-08-14 18:24 ` Guenter Roeck
2023-08-15 0:52 ` Shuah Khan
2023-08-15 3:23 ` Florian Fainelli
2023-08-15 5:32 ` Daniel Díaz
2023-08-15 17:10 ` Allen Pais
2023-08-16 22:29 ` Joel Fernandes
2023-08-21 2:34 ` luomeng
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.