aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2020-10-15Merge branch 'net-smc-fixes-2020-10-14'Jakub Kicinski2-10/+8
Karsten Graul says: ==================== net/smc: fixes 2020-10-14 The first patch fixes a possible use-after-free of delayed llc events. Patch 2 corrects the number of DMB buffer sizes. And patch 3 ensures a correctly formatted return code when smc_ism_register_dmb() fails to create a new DMB. ==================== Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
2020-10-15net/smc: fix invalid return code in smcd_new_buf_create()Karsten Graul1-1/+2
smc_ism_register_dmb() returns error codes set by the ISM driver which are not guaranteed to be negative or in the errno range. Such values would not be handled by ERR_PTR() and finally the return code will be used as a memory address. Fix that by using a valid negative errno value with ERR_PTR(). Fixes: 72b7f6c48708 ("net/smc: unique reason code for exceeded max dmb count") Signed-off-by: Karsten Graul <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-10-15net/smc: fix valid DMBE buffer sizesKarsten Graul1-1/+1
The SMCD_DMBE_SIZES should include all valid DMBE buffer sizes, so the correct value is 6 which means 1MB. With 7 the registration of an ISM buffer would always fail because of the invalid size requested. Fix that and set the value to 6. Fixes: c6ba7c9ba43d ("net/smc: add base infrastructure for SMC-D and ISM") Signed-off-by: Karsten Graul <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-10-15net/smc: fix use-after-free of delayed eventsKarsten Graul1-8/+5
When a delayed event is enqueued then the event worker will send this event the next time it is running and no other flow is currently active. The event handler is called for the delayed event, and the pointer to the event keeps set in lgr->delayed_event. This pointer is cleared later in the processing by smc_llc_flow_start(). This can lead to a use-after-free condition when the processing does not reach smc_llc_flow_start(), but frees the event because of an error situation. Then the delayed_event pointer is still set but the event is freed. Fix this by always clearing the delayed event pointer when the event is provided to the event handler for processing, and remove the code to clear it in smc_llc_flow_start(). Fixes: 555da9af827d ("net/smc: add event-based llc_flow framework") Signed-off-by: Karsten Graul <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-10-15Merge tag 'usb-5.10-rc1' of ↵Linus Torvalds260-2874/+12933
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/PHY/Thunderbolt driver updates from Greg KH: "Here is the big set of USB, PHY, and Thunderbolt driver updates for 5.10-rc1. Lots of tiny different things for these subsystems are in here, including: - phy driver updates - thunderbolt / USB 4 updates and additions - USB gadget driver updates - xhci fixes and updates - typec driver additions and updates - api conversions to various drivers for core kernel api changes - new USB control message functions to make it harder to get wrong, as found by syzbot (took 2 tries to get it right) - lots of tiny USB driver fixes and updates all over the place All of these have been in linux-next for a while, with the exception of the last "obviously correct" patch that updated a FALLTHROUGH comment that got merged last weekend" * tag 'usb-5.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (374 commits) usb: musb: gadget: Use fallthrough pseudo-keyword usb: typec: Add QCOM PMIC typec detection driver USB: serial: option: add Cellient MPL200 card usb: typec: tcpci_maxim: Add support for Sink FRS usb: typec: tcpci: Implement callbacks for FRS usb: typec: tcpm: Add support for Sink Fast Role SWAP(FRS) usb: typec: tcpci_maxim: Chip level TCPC driver usb: typec: tcpci: Add set_vbus tcpci callback usb: typec: tcpci: Add a getter method to retrieve tcpm_port reference usbip: vhci_hcd: fix calling usb_hcd_giveback_urb() with irqs enabled usb: cdc-acm: add quirk to blacklist ETAS ES58X devices USB: serial: ftdi_sio: use cur_altsetting for consistency USB: serial: option: Add Telit FT980-KS composition USB: core: remove polling for /sys/kernel/debug/usb/devices usb: typec: add support for STUSB160x Type-C controller family usb: typec: add typec_find_pwr_opmode usb: typec: hd3ss3220: Use OF graph API to get the connector fwnode dt-bindings: usb: renesas,usb3-peri: Document HS and SS data bus dt-bindings: usb: convert ti,hd3ss3220 bindings to json-schema usb: dwc2: Fix INTR OUT transfers in DDMA mode. ...
2020-10-15Merge tag 'staging-5.10-rc1' of ↵Linus Torvalds436-7211/+11422
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging / IIO driver updates from Greg KH: "Here is the large set of staging and IIO driver updates for 5.10-rc1. Included in here are: - new IIO drivers - new IIO driver frameworks - various IIO driver fixes and updates - IIO device tree conversions to yaml - so many minor staging driver coding style cleanups - most cdev driver moved out of staging - no staging drivers added or removed Full details are in the shortlog. All of these have been in linux-next for a while with no reported issues" * tag 'staging-5.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (476 commits) staging: comedi: check validity of wMaxPacketSize of usb endpoints found staging: wfx: improve robustness of wfx_get_hw_rate() staging: wfx: drop unicode characters from strings staging: wfx: gpiod_get_value() can return an error staging: wfx: increase robustness of hif_generic_confirm() staging: wfx: wfx_init_common() returns NULL on error staging: wfx: standardize the error when vif does not exist staging: wfx: check memory allocation staging: wfx: improve error handling of hif_join() staging: dpaa2-switch: add a dpaa2_switch prefix to all functions in ethsw.c staging: dpaa2-switch: add a dpaa2_switch_ prefix to all functions in ethsw-ethtool.c staging: rtl8188eu: Fix long lines dt-bindings: staging: wfx: silabs,wfx yaml conversion staging: wfx: update copyrights dates staging: wfx: fix QoS priority for slow buses staging: wfx: fix BA sessions for older firmwares staging: wfx: remove remaining code of 'secure link' feature staging: wfx: fix handling of MMIC error staging: vchiq: Fix list_for_each exit tests staging: greybus: use __force when assigning __u8 value to snd_ctl_elem_type_t ...
2020-10-15bpfilter: Fix build error with CONFIG_BPFILTER_UMHYueHaibing1-1/+1
IF CONFIG_BPFILTER_UMH is set, building fails: In file included from /usr/include/sys/socket.h:33:0, from net/bpfilter/main.c:6: /usr/include/bits/socket.h:390:10: fatal error: asm/socket.h: No such file or directory #include <asm/socket.h> ^~~~~~~~~~~~~~ compilation terminated. scripts/Makefile.userprogs:43: recipe for target 'net/bpfilter/main.o' failed make[2]: *** [net/bpfilter/main.o] Error 1 Add missing include path to fix this. Signed-off-by: YueHaibing <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-10-15cxgb4/ch_ipsec: Replace the module name to ch_ipsec from chcrAyush Sawal2-69/+68
This patch changes the module name to "ch_ipsec" and prepends "ch_ipsec" string instead of "chcr" in all debug messages and function names. V1->V2: -Removed inline keyword from functions. -Removed CH_IPSEC prefix from pr_debug. -Used proper indentation for the continuation line of the function arguments. V2->V3: Fix the checkpatch.pl warnings. Fixes: 1b77be463929 ("crypto/chcr: Moving chelsio's inline ipsec functionality to /drivers/net") Signed-off-by: Ayush Sawal <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-10-15net: sched: Fix suspicious RCU usage while accessing tcf_tunnel_infoLeon Romanovsky1-1/+4
The access of tcf_tunnel_info() produces the following splat, so fix it by dereferencing the tcf_tunnel_key_params pointer with marker that internal tcfa_liock is held. ============================= WARNING: suspicious RCU usage 5.9.0+ #1 Not tainted ----------------------------- include/net/tc_act/tc_tunnel_key.h:59 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by tc/34839: #0: ffff88828572c2a0 (&p->tcfa_lock){+...}-{2:2}, at: tc_setup_flow_action+0xb3/0x48b5 stack backtrace: CPU: 1 PID: 34839 Comm: tc Not tainted 5.9.0+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack+0x9a/0xd0 tc_setup_flow_action+0x14cb/0x48b5 fl_hw_replace_filter+0x347/0x690 [cls_flower] fl_change+0x2bad/0x4875 [cls_flower] tc_new_tfilter+0xf6f/0x1ba0 rtnetlink_rcv_msg+0x5f2/0x870 netlink_rcv_skb+0x124/0x350 netlink_unicast+0x433/0x700 netlink_sendmsg+0x6f1/0xbd0 sock_sendmsg+0xb0/0xe0 ____sys_sendmsg+0x4fa/0x6d0 ___sys_sendmsg+0x12e/0x1b0 __sys_sendmsg+0xa4/0x120 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f1f8cd4fe57 Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 RSP: 002b:00007ffdc1e193b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1f8cd4fe57 RDX: 0000000000000000 RSI: 00007ffdc1e19420 RDI: 0000000000000003 RBP: 000000005f85aafa R08: 0000000000000001 R09: 00007ffdc1e1936c R10: 000000000040522d R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000000 R14: 00007ffdc1e1d6f0 R15: 0000000000482420 Fixes: 3ebaf6da0716 ("net: sched: Do not assume RTNL is held in tunnel key action helpers") Fixes: 7a47281439ba ("net: sched: lock action when translating it to flow_action infra") Signed-off-by: Leon Romanovsky <[email protected]> Acked-by: Cong Wang <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-10-15tracing: support "bool" type in synthetic trace eventsAxel Rasmussen1-0/+4
It's common [1] to define tracepoint fields as "bool" when they contain a true / false value. Currently, defining a synthetic event with a "bool" field yields EINVAL. It's possible to work around this by using e.g. u8 (assuming sizeof(bool) is 1, and bool is unsigned; if either of these properties don't match, you get EINVAL [2]). Supporting "bool" explicitly makes hooking this up easier and more portable for userspace. [1]: grep -r "bool" include/trace/events/ [2]: check_synth_field() in kernel/trace/trace_events_hist.c Link: https://lkml.kernel.org/r/[email protected] Acked-by: Michel Lespinasse <[email protected]> Acked-by: David Rientjes <[email protected]> Signed-off-by: Axel Rasmussen <[email protected]> Signed-off-by: Steven Rostedt (VMware) <[email protected]>
2020-10-15selftests/ftrace: Add test case for synthetic event syntax errorsTom Zanussi1-0/+19
Add a selftest that verifies that the syntax error messages and caret positions are correct for most of the possible synthetic event syntax error cases. Link: https://lkml.kernel.org/r/af611928ce79f86eaf0af8654f1d7802d5cc21ff.1602598160.git.zanussi@kernel.org Tested-by: Masami Hiramatsu <[email protected]> Signed-off-by: Tom Zanussi <[email protected]> Signed-off-by: Steven Rostedt (VMware) <[email protected]>
2020-10-15tracing: Handle synthetic event array field type checking correctlyTom Zanussi1-3/+9
Since synthetic event array types are derived from the field name, there may be a semicolon at the end of the type which should be stripped off. If there are more characters following that, normal type string checking will result in an invalid type. Without this patch, you can end up with an invalid field type string that gets displayed in both the synthetic event description and the event format: Before: # echo 'myevent char str[16]; int v' >> synthetic_events # cat synthetic_events myevent char[16]; str; int v name: myevent ID: 1936 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:char str[16];; offset:8; size:16; signed:1; field:int v; offset:40; size:4; signed:1; print fmt: "str=%s, v=%d", REC->str, REC->v After: # echo 'myevent char str[16]; int v' >> synthetic_events # cat synthetic_events myevent char[16] str; int v # cat events/synthetic/myevent/format name: myevent ID: 1936 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:char str[16]; offset:8; size:16; signed:1; field:int v; offset:40; size:4; signed:1; print fmt: "str=%s, v=%d", REC->str, REC->v Link: https://lkml.kernel.org/r/6587663b56c2d45ab9d8c8472a2110713cdec97d.1602598160.git.zanussi@kernel.org [ <[email protected]>: wrote parse_synth_field() snippet. ] Fixes: 4b147936fa50 (tracing: Add support for 'synthetic' events) Reported-by: Masami Hiramatsu <[email protected]> Tested-by: Masami Hiramatsu <[email protected]> Signed-off-by: Tom Zanussi <[email protected]> Signed-off-by: Steven Rostedt (VMware) <[email protected]>
2020-10-15selftests/ftrace: Change synthetic event name for inter-event-combined testTom Zanussi1-4/+4
This test uses waking+wakeup_latency as an event name, which doesn't make sense since it includes an operator. Illegal names are now detected by the synthetic event command parsing, which causes this test to fail. Change the name to 'waking_plus_wakeup_latency' to prevent this. Link: https://lkml.kernel.org/r/a1ee2f76ff28ef7166fb788ca8be968887808920.1602598160.git.zanussi@kernel.org Fixes: f06eec4d0f2c (selftests: ftrace: Add inter-event hist triggers testcases) Acked-by: Masami Hiramatsu <[email protected]> Tested-by: Masami Hiramatsu <[email protected]> Signed-off-by: Tom Zanussi <[email protected]> Signed-off-by: Steven Rostedt (VMware) <[email protected]>
2020-10-15tracing: Add synthetic event error loggingTom Zanussi1-2/+90
Add support for synthetic event error logging, which entails adding a logging function for it, a way to save the synthetic event command, and a set of specific synthetic event parse error strings and handling. Link: https://lkml.kernel.org/r/ed099c66df13b40cfc633aaeb17f66c37a923066.1602598160.git.zanussi@kernel.org [ <[email protected]>: wrote save_cmdstr() seq_buf implementation. ] Tested-by: Masami Hiramatsu <[email protected]> Signed-off-by: Tom Zanussi <[email protected]> Signed-off-by: Steven Rostedt (VMware) <[email protected]>
2020-10-15tracing: Check that the synthetic event and field names are legalTom Zanussi1-0/+9
Call the is_good_name() function used by probe events to make sure synthetic event and field names don't contain illegal characters and cause unexpected parsing of synthetic event commands. Link: https://lkml.kernel.org/r/c4d4bb59d3ac39bcbd70fba0cf837d6b1cedb015.1602598160.git.zanussi@kernel.org Fixes: 4b147936fa50 (tracing: Add support for 'synthetic' events) Reported-by: Masami Hiramatsu <[email protected]> Reviewed-by: Masami Hiramatsu <[email protected]> Tested-by: Masami Hiramatsu <[email protected]> Signed-off-by: Tom Zanussi <[email protected]> Signed-off-by: Steven Rostedt (VMware) <[email protected]>
2020-10-15tracing: Move is_good_name() from trace_probe.h to trace.hTom Zanussi2-13/+13
is_good_name() is useful for other trace infrastructure, such as synthetic events, so make it available via trace.h. Link: https://lkml.kernel.org/r/cc6d6a2d7da6957fcbe1e2922e76d18d2bb459b4.1602598160.git.zanussi@kernel.org Acked-by: Masami Hiramatsu <[email protected]> Tested-by: Masami Hiramatsu <[email protected]> Signed-off-by: Tom Zanussi <[email protected]> Signed-off-by: Steven Rostedt (VMware) <[email protected]>
2020-10-15tracing: Don't show dynamic string internals in synthetic event descriptionTom Zanussi1-1/+9
For synthetic event dynamic fields, the type contains "__data_loc", which is basically an internal part of the type which is only meant to be displayed in the format, not in the event description itself, which is confusing to users since they can't use __data_loc on the command-line to define an event field, which printing it would lead them to believe. So filter it out from the description, while leaving it in the type. Link: https://lkml.kernel.org/r/b3b7baf7813298a5ede4ff02e2e837b91c05a724.1602598160.git.zanussi@kernel.org Reported-by: Masami Hiramatsu <[email protected]> Tested-by: Masami Hiramatsu <[email protected]> Signed-off-by: Tom Zanussi <[email protected]> Signed-off-by: Steven Rostedt (VMware) <[email protected]>
2020-10-15tracing: Fix some typos in commentsQiujun Huang2-6/+6
s/wihin/within/ s/retrieven/retrieved/ s/suppport/support/ s/wil/will/ s/accidently/accidentally/ s/if the if the/if the/ Link: https://lkml.kernel.org/r/[email protected] Signed-off-by: Qiujun Huang <[email protected]> Signed-off-by: Steven Rostedt (VMware) <[email protected]>
2020-10-15tracing/boot: Add ftrace.instance.*.alloc_snapshot optionMasami Hiramatsu1-0/+6
Add ftrace.instance.*.alloc_snapshot option. This option has been described in Documentation/trace/boottime-trace.rst but not implemented yet. ftrace.[instance.INSTANCE.]alloc_snapshot Allocate snapshot buffer. The difference from kernel.alloc_snapshot is that the kernel.alloc_snapshot will allocate the buffer only for the main instance, but this can allocate buffer for any new instances. Link: https://lkml.kernel.org/r/160234368948.400560.15313384470765915015.stgit@devnote2 Signed-off-by: Masami Hiramatsu <[email protected]> Signed-off-by: Steven Rostedt (VMware) <[email protected]>
2020-10-15tracing: Fix race in trace_open and buffer resize callGaurav Kohli1-0/+10
Below race can come, if trace_open and resize of cpu buffer is running parallely on different cpus CPUX CPUY ring_buffer_resize atomic_read(&buffer->resize_disabled) tracing_open tracing_reset_online_cpus ring_buffer_reset_cpu rb_reset_cpu rb_update_pages remove/insert pages resetting pointer This race can cause data abort or some times infinte loop in rb_remove_pages and rb_insert_pages while checking pages for sanity. Take buffer lock to fix this. Link: https://lkml.kernel.org/r/[email protected] Cc: [email protected] Fixes: b23d7a5f4a07a ("ring-buffer: speed up buffer resets by avoiding synchronize_rcu for each CPU") Signed-off-by: Gaurav Kohli <[email protected]> Signed-off-by: Steven Rostedt (VMware) <[email protected]>
2020-10-15tracing: Check return value of __create_val_fields() before using its resultSteven Rostedt (VMware)1-1/+1
After having a typo for writing a histogram trigger. Wrote: echo 'hist:key=pid:ts=common_timestamp.usec' > events/sched/sched_waking/trigger Instead of: echo 'hist:key=pid:ts=common_timestamp.usecs' > events/sched/sched_waking/trigger and the following crash happened: BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 4 PID: 1641 Comm: sh Not tainted 5.9.0-rc5-test+ #549 Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v03.03 07/14/2016 RIP: 0010:event_hist_trigger_func+0x70b/0x1ee0 Code: 24 08 89 d5 49 89 cc e9 8c 00 00 00 4c 89 f2 41 b9 00 10 00 00 4c 89 e1 44 89 ee 4c 89 ff e8 dc d3 ff ff 45 89 ea 4b 8b 14 d7 <f6> 42 08 04 74 17 41 8b 8f c0 00 00 00 8d 71 01 41 89 b7 c0 00 00 RSP: 0018:ffff959213d53db0 EFLAGS: 00010202 RAX: ffffffffffffffea RBX: 0000000000000000 RCX: 0000000000084c04 RDX: 0000000000000000 RSI: df7326aefebd174c RDI: 0000000000031080 RBP: 0000000000000002 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000046 R12: ffff959211dcf690 R13: 0000000000000001 R14: ffff95925a36e370 R15: ffff959251c89800 FS: 00007fb9ea934740(0000) GS:ffff95925ab00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 00000000c976c005 CR4: 00000000001706e0 Call Trace: ? trigger_process_regex+0x78/0x110 trigger_process_regex+0xc5/0x110 event_trigger_write+0x71/0xd0 vfs_write+0xca/0x210 ksys_write+0x70/0xf0 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fb9eaa29487 Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 This was caused by accessing the hlist_data fields after the call to __create_val_fields() without checking if the creation succeed. Link: https://lkml.kernel.org/r/[email protected] Fixes: 63a1e5de3006 ("tracing: Save normal string variables") Reviewed-by: Masami Hiramatsu <[email protected]> Reviewed-by: Tom Zanussi <[email protected]> Signed-off-by: Steven Rostedt (VMware) <[email protected]>
2020-10-15bpf: Fix register equivalence tracking.Alexei Starovoitov2-13/+51
The 64-bit JEQ/JNE handling in reg_set_min_max() was clearing reg->id in either true or false branch. In the case 'if (reg->id)' check was done on the other branch the counter part register would have reg->id == 0 when called into find_equal_scalars(). In such case the helper would incorrectly identify other registers with id == 0 as equivalent and propagate the state incorrectly. Fix it by preserving ID across reg_set_min_max(). In other words any kind of comparison operator on the scalar register should preserve its ID to recognize: r1 = r2 if (r1 == 20) { #1 here both r1 and r2 == 20 } else if (r2 < 20) { #2 here both r1 and r2 < 20 } The patch is addressing #1 case. The #2 was working correctly already. Fixes: 75748837b7e5 ("bpf: Propagate scalar ranges through register assignments.") Signed-off-by: Alexei Starovoitov <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> Acked-by: Andrii Nakryiko <[email protected]> Acked-by: John Fastabend <[email protected]> Tested-by: Yonghong Song <[email protected]> Link: https://lore.kernel.org/bpf/[email protected]
2020-10-15rxrpc: Fix loss of final ack on shutdownDavid Howells3-3/+7
Fix the loss of transmission of a call's final ack when a socket gets shut down. This means that the server will retransmit the last data packet or send a ping ack and then get an ICMP indicating the port got closed. The server will then view this as a failure. Fixes: 3136ef49a14c ("rxrpc: Delay terminal ACK transmission on a client call") Signed-off-by: David Howells <[email protected]>
2020-10-15rxrpc: Fix bundle counting for exclusive connectionsDavid Howells1-2/+3
Fix rxrpc_unbundle_conn() to not drop the bundle usage count when cleaning up an exclusive connection. Based on the suggested fix from Hillf Danton. Fixes: 245500d853e9 ("rxrpc: Rewrite the client connection manager") Reported-by: [email protected] Signed-off-by: David Howells <[email protected]> cc: Hillf Danton <[email protected]>
2020-10-15printk: ringbuffer: Wrong data pointer when appending small stringPetr Mladek1-1/+4
data_realloc() returns wrong data pointer when the block is wrapped and the size is not increased. It might happen when pr_cont() wants to add only few characters and there is already a space for them because of alignment. It might cause writing outsite the buffer. It has been detected by LTP tests with KASAN enabled: [ 221.921944] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=c,mems_allowed=0,oom_memcg=/0,task_memcg=in [ 221.922108] ================================================================== [ 221.922111] BUG: KASAN: global-out-of-bounds in vprintk_store+0x362/0x3d0 [ 221.922112] Write of size 2 at addr ffffffffba51dbcd by task memcg_test_1/11282 [ 221.922113] [ 221.922114] CPU: 1 PID: 11282 Comm: memcg_test_1 Not tainted 5.9.0-next-20201013 #1 [ 221.922116] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.0b 07/27/2017 [ 221.922116] Call Trace: [ 221.922117] dump_stack+0xa4/0xd9 [ 221.922118] print_address_description.constprop.0+0x21/0x210 [ 221.922119] ? _raw_write_lock_bh+0xe0/0xe0 [ 221.922120] ? vprintk_store+0x362/0x3d0 [ 221.922121] kasan_report.cold+0x37/0x7c [ 221.922122] ? vprintk_store+0x362/0x3d0 [ 221.922123] check_memory_region+0x18c/0x1f0 [ 221.922124] memcpy+0x3c/0x60 [ 221.922125] vprintk_store+0x362/0x3d0 [ 221.922125] ? __ia32_sys_syslog+0x50/0x50 [ 221.922126] ? _raw_spin_lock_irqsave+0x9b/0x100 [ 221.922127] ? _raw_spin_lock_irq+0xf0/0xf0 [ 221.922128] ? __kasan_check_write+0x14/0x20 [ 221.922129] vprintk_emit+0x8d/0x1f0 [ 221.922130] vprintk_default+0x1d/0x20 [ 221.922131] vprintk_func+0x5a/0x100 [ 221.922132] printk+0xb2/0xe3 [ 221.922133] ? swsusp_write.cold+0x189/0x189 [ 221.922134] ? kernfs_vfs_xattr_set+0x60/0x60 [ 221.922134] ? _raw_write_lock_bh+0xe0/0xe0 [ 221.922135] ? trace_hardirqs_on+0x38/0x100 [ 221.922136] pr_cont_kernfs_path.cold+0x49/0x4b [ 221.922137] mem_cgroup_print_oom_context.cold+0x74/0xc3 [ 221.922138] dump_header+0x340/0x3bf [ 221.922139] oom_kill_process.cold+0xb/0x10 [ 221.922140] out_of_memory+0x1e9/0x860 [ 221.922141] ? oom_killer_disable+0x210/0x210 [ 221.922142] mem_cgroup_out_of_memory+0x198/0x1c0 [ 221.922143] ? mem_cgroup_count_precharge_pte_range+0x250/0x250 [ 221.922144] try_charge+0xa9b/0xc50 [ 221.922145] ? arch_stack_walk+0x9e/0xf0 [ 221.922146] ? memory_high_write+0x230/0x230 [ 221.922146] ? avc_has_extended_perms+0x830/0x830 [ 221.922147] ? stack_trace_save+0x94/0xc0 [ 221.922148] ? stack_trace_consume_entry+0x90/0x90 [ 221.922149] __memcg_kmem_charge+0x73/0x120 [ 221.922150] ? cred_has_capability+0x10f/0x200 [ 221.922151] ? mem_cgroup_can_attach+0x260/0x260 [ 221.922152] ? selinux_sb_eat_lsm_opts+0x2f0/0x2f0 [ 221.922153] ? obj_cgroup_charge+0x16b/0x220 [ 221.922154] ? kmem_cache_alloc+0x78/0x4c0 [ 221.922155] obj_cgroup_charge+0x122/0x220 [ 221.922156] ? vm_area_alloc+0x20/0x90 [ 221.922156] kmem_cache_alloc+0x78/0x4c0 [ 221.922157] vm_area_alloc+0x20/0x90 [ 221.922158] mmap_region+0x3ed/0x9a0 [ 221.922159] ? cap_mmap_addr+0x1d/0x80 [ 221.922160] do_mmap+0x3ee/0x720 [ 221.922161] vm_mmap_pgoff+0x16a/0x1c0 [ 221.922162] ? randomize_stack_top+0x90/0x90 [ 221.922163] ? copy_page_range+0x1980/0x1980 [ 221.922163] ksys_mmap_pgoff+0xab/0x350 [ 221.922164] ? find_mergeable_anon_vma+0x110/0x110 [ 221.922165] ? __audit_syscall_entry+0x1a6/0x1e0 [ 221.922166] __x64_sys_mmap+0x8d/0xb0 [ 221.922167] do_syscall_64+0x38/0x50 [ 221.922168] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 221.922169] RIP: 0033:0x7fe8f5e75103 [ 221.922172] Code: 54 41 89 d4 55 48 89 fd 53 4c 89 cb 48 85 ff 74 56 49 89 d9 45 89 f8 45 89 f2 44 89 e2 4c 89 ee 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7d 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f [ 221.922173] RSP: 002b:00007ffd38c90198 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 221.922175] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe8f5e75103 [ 221.922176] RDX: 0000000000000003 RSI: 0000000000001000 RDI: 0000000000000000 [ 221.922178] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 221.922179] R10: 0000000000002022 R11: 0000000000000246 R12: 0000000000000003 [ 221.922180] R13: 0000000000001000 R14: 0000000000002022 R15: 0000000000000000 [ 221.922181] [ 213O[ 221.922182] The buggy address belongs to the variable: [ 221.922183] clear_seq+0x2d/0x40 [ 221.922183] [ 221.922184] Memory state around the buggy address: [ 221.922185] ffffffffba51da80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 221.922187] ffffffffba51db00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 221.922188] >ffffffffba51db80: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 [ 221.922189] ^ [ 221.922190] ffffffffba51dc00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 [ 221.922191] ffffffffba51dc80: f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 [ 221.922193] ================================================================== [ 221.922194] Disabling lock debugging due to kernel taint [ 221.922196] ,task=memcg_test_1,pid=11280,uid=0 [ 221.922205] Memory cgroup out of memory: Killed process 11280 Link: https://lore.kernel.org/r/CA+G9fYt46oC7-BKryNDaaXPJ9GztvS2cs_7GjYRjanRi4+ryCQ@mail.gmail.com Fixes: 4cfc7258f876a7feba673ac ("printk: ringbuffer: add finalization/extension support") Reported-by: Naresh Kamboju <[email protected]> Reviewed-by: John Ogness <[email protected]> Acked-by: Sergey Senozhatsky <[email protected]> Signed-off-by: Petr Mladek <[email protected]> Link: https://lore.kernel.org/r/20201014175051.GC13775@alley
2020-10-15parisc/sticon: Add user font supportHelge Deller4-268/+326
This is a major rework of the sticon (parisc text console) driver in order to support user font support. Usually one want to use the stifb (parisc framebuffer driver) which is based on fbcon and does support fonts and colors, but some old machines (e.g. HP 730 workstations) don't provide a supported stifb graphic card, and for those user fonts are preferred. This patch drops unused code for software cursor and scrollback, enhances the debug output and adds better documentation. The code was tested on various machines with byte-mode and word-mode graphic cards on GSC- and PCI-busses. Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc/sticon: Always register sticon console driverHelge Deller1-8/+7
If the ROM provides functional STI routines, always register the sticon driver, even if the serial console was choosen as boot device. Additionally, in that case, do not make the sticon driver the default output console device. Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Add MAP_UNINITIALIZED defineHelge Deller2-1/+1
We will not allow unitialized anon mmaps, but we need this define to prevent build errors, e.g. the debian foot package. Suggested-by: John David Anglin <[email protected]> Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Improve spinlock handlingJohn David Anglin1-10/+13
Use READ_ONCE() to check if spinlock is locked. The other changes are cleanups. Signed-off-by: John David Anglin <[email protected]> Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Install vmlinuz instead of zImage fileHelge Deller1-1/+1
Tested-by: John David Anglin <[email protected]> Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Rewrite tlb flush threshold calculationJohn David Anglin1-10/+8
Signed-off-by: John David Anglin <[email protected]> Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Switch to more fine grained lws locksJohn David Anglin2-7/+7
Increase the number of lws locks to 256 entries (instead of 16) and choose lock entry based on bits 3-11 (instead of 4-7) of the relevant address. With this change we archieve more fine-grained locking in futex syscalls and thus reduce the number of possible stalls. Signed-off-by: John David Anglin <[email protected]> Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Mark pointers volatile in __xchg8(), __xchg32() and __xchg64()John David Anglin2-10/+10
Let the complier treat the pointers volatile to ensure that they get accessed atomicly. Signed-off-by: John David Anglin <[email protected]> Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Fix comments and enable interrupts laterJohn David Anglin1-7/+7
Correct the comments: The jump is forwards, not backwards. Enable the interrupts after %r29 (reference param area) was loaded. Signed-off-by: John David Anglin <[email protected]> Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Add alternative patching to synchronize_caches defineJohn David Anglin1-1/+5
This change allows the sync barrier instruction to be patched to a nop. Signed-off-by: John David Anglin <[email protected]> Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Add ioread64_hi_lo() and iowrite64_hi_lo()Helge Deller1-0/+18
The kernel test robot reports missing functions. Add them. hppa-linux-ld: drivers/firmware/arm_scmi/perf.o: in function `scmi_perf_fc_ring_db': (.text+0x610): undefined reference to `ioread64_hi_lo' (.text+0x63c): undefined reference to `iowrite64_hi_lo' Reported-by: kernel test robot <[email protected]> Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: disable CONFIG_IDE in defconfigsChristoph Hellwig2-9/+3
Enable libata support for the Nat Semi NS87415 controller, and disable the soon to be removed legacy ide driver entirely. Signed-off-by: Christoph Hellwig <[email protected]> Acked-by: Helge Deller <[email protected]> Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Drop useless comments in uapi/asm/signal.hHelge Deller1-2/+2
Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Define O_NONBLOCK to become 000200000Helge Deller2-3/+3
HPUX has separate NDELAY & NONBLOCK values. In the past we wanted to be able to run HP-UX binaries natively on parisc Linux which is why we defined O_NONBLOCK to 000200004 to distinguish NDELAY & NONBLOCK bits. But with 2 bits set in this bitmask we often ran into compatibility issues with other Linux applications which often only test one bit (or even compare the values). To avoid such issues in the future, this patch changes O_NONBLOCK to become 000200000. That way old programs will still be functional, and for new programs we now have only one bit set. Update the comment about SOCK_NONBLOCK too. Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Drop HP-UX specific fcntl and signal flagsHelge Deller2-5/+1
Those flags are nowhere used in the Linux kernel and were added when we still wanted to support HP-UX in a compat mode. Since we never will support HP-UX, drop those flags. Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Avoid external interrupts when IPI finishesHelge Deller1-3/+6
No need to allow external interrupts when the IPI loop is going to finish now. Signed-off-by: Helge Deller <[email protected]>
2020-10-15parisc: Add qemu fw_cfg interfaceHelge Deller2-0/+31
When running on qemu, SeaBIOS-hppa stores the iomem address for the emulated fw_cfg port in PAGE0_>pad0[2/3]. Let the Linux driver auto-configure the fw_cfg interface with it, so that the fw_cfg info shows up in /sys/firmware/qemu_fw_cfg. Signed-off-by: Helge Deller <[email protected]>
2020-10-15fw_cfg: Add support for parisc architectureHelge Deller2-1/+4
Signed-off-by: Helge Deller <[email protected]>
2020-10-14netfilter: restore NF_INET_NUMHOOKSPablo Neira Ayuso3-4/+6
This definition is used by the iptables legacy UAPI, restore it. Fixes: d3519cb89f6d ("netfilter: nf_tables: add inet ingress support") Reported-by: Jason A. Donenfeld <[email protected]> Tested-by: Jason A. Donenfeld <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-10-14Merge branch 'ibmveth-gso-fix'Jakub Kicinski1-4/+15
David Wilder says: ==================== ibmveth gso fix The ibmveth driver is a virtual Ethernet driver used on IBM pSeries systems. Gso packets can be sent between LPARS (virtual hosts) without segmentation, by flagging gso packets using one of two methods depending on the firmware version. Some gso packet were not correctly identified by the receiver. This patch-set corrects this issue. V2: - Added fix tags. - Byteswap the constant at compilation time. - Updated the commit message to clarify what frame validation is performed by the hypervisor. ==================== Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
2020-10-14ibmveth: Identify ingress large send packets.David Wilder1-1/+12
Ingress large send packets are identified by either: The IBMVETH_RXQ_LRG_PKT flag in the receive buffer or with a -1 placed in the ip header checksum. The method used depends on firmware version. Frame geometry and sufficient header validation is performed by the hypervisor eliminating the need for further header checks here. Fixes: 7b5967389f5a ("ibmveth: set correct gso_size and gso_type") Signed-off-by: David Wilder <[email protected]> Reviewed-by: Thomas Falcon <[email protected]> Reviewed-by: Cristobal Forno <[email protected]> Reviewed-by: Pradeep Satyanarayana <[email protected]> Acked-by: Willem de Bruijn <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-10-14ibmveth: Switch order of ibmveth_helper calls.David Wilder1-5/+5
ibmveth_rx_csum_helper() must be called after ibmveth_rx_mss_helper() as ibmveth_rx_csum_helper() may alter ip and tcp checksum values. Fixes: 66aa0678efc2 ("ibmveth: Support to enable LSO/CSO for Trunk VEA.") Signed-off-by: David Wilder <[email protected]> Reviewed-by: Thomas Falcon <[email protected]> Reviewed-by: Cristobal Forno <[email protected]> Reviewed-by: Pradeep Satyanarayana <[email protected]> Acked-by: Willem de Bruijn <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-10-15Revert "powerpc/pci: unmap legacy INTx interrupts when a PHB is removed"Qian Cai2-120/+0
This reverts commit 3a3181e16fbde752007759f8759d25e0ff1fc425 which causes memory corruptions on POWER9 powernv. eg: pci_bus 0035:08: busn_res: [bus 08-0c] is released ============================================================================= BUG kmalloc-16 (Tainted: G W O ): Object already free ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Allocated in pcibios_scan_phb+0x104/0x3e0 age=1960714 cpu=4 pid=1 __slab_alloc+0xa4/0xf0 __kmalloc+0x294/0x330 pcibios_scan_phb+0x104/0x3e0 pcibios_init+0x84/0x124 do_one_initcall+0xac/0x528 kernel_init_freeable+0x35c/0x3fc kernel_init+0x24/0x148 ret_from_kernel_thread+0x5c/0x80 INFO: Freed in pcibios_remove_bus+0x70/0x90 age=0 cpu=16 pid=1717146 kfree+0x49c/0x510 pcibios_remove_bus+0x70/0x90 pci_remove_bus+0xe4/0x110 pci_remove_bus_device+0x74/0x170 pci_remove_bus_device+0x4c/0x170 pci_stop_and_remove_bus_device_locked+0x34/0x50 remove_store+0xc0/0xe0 dev_attr_store+0x30/0x50 sysfs_kf_write+0x68/0xb0 kernfs_fop_write+0x114/0x260 vfs_write+0xe4/0x260 ksys_write+0x74/0x130 system_call_exception+0xf8/0x1d0 system_call_common+0xe8/0x218 INFO: Slab 0x0000000099caaf22 objects=178 used=174 fp=0x00000000006a64b0 flags=0x7fff8000000201 INFO: Object 0x00000000f360132d @offset=30192 fp=0x0000000000000000 Signed-off-by: Qian Cai <[email protected]> Acked-by: Oliver O'Halloran <[email protected]> Signed-off-by: Michael Ellerman <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2020-10-14cxgb4: handle 4-tuple PEDIT to NAT mode translationHerat Ramani2-13/+177
The 4-tuple NAT offload via PEDIT always overwrites all the 4-tuple fields even if they had not been explicitly enabled. If any fields in the 4-tuple are not enabled, then the hardware overwrites the disabled fields with zeros, instead of ignoring them. So, add a parser that can translate the enabled 4-tuple PEDIT fields to one of the NAT mode combinations supported by the hardware and hence avoid overwriting disabled fields to 0. Any rule with unsupported NAT mode combination is rejected. Signed-off-by: Herat Ramani <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-10-14Merge branch 'l3mdev-icmp-error-route-lookup-fixes'Jakub Kicinski5-6/+653
Mathieu Desnoyers says: ==================== l3mdev icmp error route lookup fixes Here is a series of fixes for ipv4 and ipv6 which ensure the route lookup is performed on the right routing table in VRF configurations when sending TTL expired icmp errors (useful for traceroute). It includes tests for both ipv4 and ipv6. These fixes address specifically address the code paths involved in sending TTL expired icmp errors. As detailed in the individual commit messages, those fixes do not address similar icmp errors related to network namespaces and unreachable / fragmentation needed messages, which appear to use different code paths. ==================== Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.