1. 02 Dec, 2023 6 commits
  2. 01 Dec, 2023 15 commits
  3. 30 Nov, 2023 19 commits
    • Linus Torvalds's avatar
      Merge tag 'net-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 6172a518
      Linus Torvalds authored
      Pull networking fixes from Paolo Abeni:
       "Including fixes from bpf and wifi.
      
        Current release - regressions:
      
         - neighbour: fix __randomize_layout crash in struct neighbour
      
         - r8169: fix deadlock on RTL8125 in jumbo mtu mode
      
        Previous releases - regressions:
      
         - wifi:
             - mac80211: fix warning at station removal time
             - cfg80211: fix CQM for non-range use
      
         - tools: ynl-gen: fix unexpected response handling
      
         - octeontx2-af: fix possible buffer overflow
      
         - dpaa2: recycle the RX buffer only after all processing done
      
         - rswitch: fix missing dev_kfree_skb_any() in error path
      
        Previous releases - always broken:
      
         - ipv4: fix uaf issue when receiving igmp query packet
      
         - wifi: mac80211: fix debugfs deadlock at device removal time
      
         - bpf:
             - sockmap: af_unix stream sockets need to hold ref for pair sock
             - netdevsim: don't accept device bound programs
      
         - selftests: fix a char signedness issue
      
         - dsa: mv88e6xxx: fix marvell 6350 probe crash
      
         - octeontx2-pf: restore TC ingress police rules when interface is up
      
         - wangxun: fix memory leak on msix entry
      
         - ravb: keep reverse order of operations in ravb_remove()"
      
      * tag 'net-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (51 commits)
        net: ravb: Keep reverse order of operations in ravb_remove()
        net: ravb: Stop DMA in case of failures on ravb_open()
        net: ravb: Start TX queues after HW initialization succeeded
        net: ravb: Make write access to CXR35 first before accessing other EMAC registers
        net: ravb: Use pm_runtime_resume_and_get()
        net: ravb: Check return value of reset_control_deassert()
        net: libwx: fix memory leak on msix entry
        ice: Fix VF Reset paths when interface in a failed over aggregate
        bpf, sockmap: Add af_unix test with both sockets in map
        bpf, sockmap: af_unix stream sockets need to hold ref for pair sock
        tools: ynl-gen: always construct struct ynl_req_state
        ethtool: don't propagate EOPNOTSUPP from dumps
        ravb: Fix races between ravb_tx_timeout_work() and net related ops
        r8169: prevent potential deadlock in rtl8169_close
        r8169: fix deadlock on RTL8125 in jumbo mtu mode
        neighbour: Fix __randomize_layout crash in struct neighbour
        octeontx2-pf: Restore TC ingress police rules when interface is up
        octeontx2-pf: Fix adding mbox work queue entry when num_vfs > 64
        net: stmmac: xgmac: Disable FPE MMC interrupts
        octeontx2-af: Fix possible buffer overflow
        ...
      6172a518
    • Linus Torvalds's avatar
      Merge tag 'pmdomain-v6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm · e8f60209
      Linus Torvalds authored
      Pull pmdomain fix from Ulf Hansson:
      
       - Avoid polling for the scmi_perf_domain on arm
      
      * tag 'pmdomain-v6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:
        pmdomain: arm: Avoid polling for scmi_perf_domain
      e8f60209
    • Linus Torvalds's avatar
      Merge tag 'mmc-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · 09443a14
      Linus Torvalds authored
      Pull MMC fixes from Ulf Hansson:
       "MMC core:
         - Fix CQE error recovery path
      
        MMC host:
         - cqhci: Fix CQE error recovery path
         - sdhci-pci-gli: Fix initialization of LPM
         - sdhci-sprd: Fix enabling/disabling of the vqmmc regulator"
      
      * tag 'mmc-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled
        mmc: sdhci-pci-gli: Disable LPM during initialization
        mmc: cqhci: Fix task clearing in CQE error recovery
        mmc: cqhci: Warn of halt or task clear failure
        mmc: block: Retry commands in CQE error recovery
        mmc: block: Be sure to wait while busy in CQE error recovery
        mmc: cqhci: Increase recovery halt timeout
        mmc: block: Do not lose cache flush during CQE error recovery
      09443a14
    • Linus Torvalds's avatar
      Merge tag 'leds-fixes-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds · 16864755
      Linus Torvalds authored
      Pull LED fix from Lee Jones:
      
       - Remove duplicate sysfs entry 'color' from LEDs class
      
      * tag 'leds-fixes-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds:
        leds: class: Don't expose color sysfs entry
      16864755
    • Linus Torvalds's avatar
      Merge tag 'efi-urgent-for-v6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi · 9d3eac3c
      Linus Torvalds authored
      Pull EFI fix from Ard Biesheuvel:
      
       - Fix for EFI unaccepted memory handling
      
      * tag 'efi-urgent-for-v6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:
        efi/unaccepted: Fix off-by-one when checking for overlapping ranges
      9d3eac3c
    • Eric Dumazet's avatar
      net: page_pool: fix general protection fault in page_pool_unlist · f9893fda
      Eric Dumazet authored
      syzbot was able to trigger a crash [1] in page_pool_unlist()
      
      page_pool_list() only inserts a page pool into a netdev page pool list
      if a netdev was set in params.
      
      Even if the kzalloc() call in page_pool_create happens to initialize
      pool->user.list, I chose to be more explicit in page_pool_list()
      adding one INIT_HLIST_NODE().
      
      We could test in page_pool_unlist() if netdev was set,
      but since netdev can be changed to lo, it seems more robust to
      check if pool->user.list is hashed  before calling hlist_del().
      
      [1]
      
      Illegal XDP return value 4294946546 on prog  (id 2) dev N/A, expect packet loss!
      general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
      KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
      CPU: 0 PID: 5064 Comm: syz-executor391 Not tainted 6.7.0-rc2-syzkaller-00533-ga3799729 #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
      RIP: 0010:__hlist_del include/linux/list.h:988 [inline]
      RIP: 0010:hlist_del include/linux/list.h:1002 [inline]
      RIP: 0010:page_pool_unlist+0xd1/0x170 net/core/page_pool_user.c:342
      Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 90 00 00 00 4c 8b a3 f0 06 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 68 48 85 ed 49 89 2c 24 74 24 e8 1b ca 07 f9 48 8d
      RSP: 0018:ffffc900039ff768 EFLAGS: 00010246
      RAX: dffffc0000000000 RBX: ffff88814ae02000 RCX: 0000000000000000
      RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88814ae026f0
      RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff1d57fdc
      R10: ffffffff8eabfee3 R11: ffffffff8aa0008b R12: 0000000000000000
      R13: ffff88814ae02000 R14: dffffc0000000000 R15: 0000000000000001
      FS:  000055555717a380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000002555398 CR3: 0000000025044000 CR4: 00000000003506f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       <TASK>
       __page_pool_destroy net/core/page_pool.c:851 [inline]
       page_pool_release+0x507/0x6b0 net/core/page_pool.c:891
       page_pool_destroy+0x1ac/0x4c0 net/core/page_pool.c:956
       xdp_test_run_teardown net/bpf/test_run.c:216 [inline]
       bpf_test_run_xdp_live+0x1578/0x1af0 net/bpf/test_run.c:388
       bpf_prog_test_run_xdp+0x827/0x1530 net/bpf/test_run.c:1254
       bpf_prog_test_run kernel/bpf/syscall.c:4041 [inline]
       __sys_bpf+0x11bf/0x4920 kernel/bpf/syscall.c:5402
       __do_sys_bpf kernel/bpf/syscall.c:5488 [inline]
       __se_sys_bpf kernel/bpf/syscall.c:5486 [inline]
       __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5486
      
      Fixes: 083772c9 ("net: page_pool: record pools per netdev")
      Reported-and-tested-by: syzbot+f9f8efb58a4db2ca98d0@syzkaller.appspotmail.com
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Tested-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Link: https://lore.kernel.org/r/20231130092259.3797753-1-edumazet@google.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      f9893fda
    • Paolo Abeni's avatar
      Merge branch 'net-ethernet-convert-to-platform-remove-callback-returning-void' · 7e022268
      Paolo Abeni authored
      Uwe Kleine-König says:
      
      ====================
      net: ethernet: Convert to platform remove callback returning void
      
      in (implicit) v1 of this series
      (https://lore.kernel.org/netdev/20231117091655.872426-1-u.kleine-koenig@pengutronix.de)
      I tried to address the resource leaks in the three cpsw drivers. However
      this is hard to get right without being able to test the changes. So
      here comes a series that just converts all drivers below
      drivers/net/ethernet to use .remove_new() and adds a comment about the
      potential leaks for someone else to fix the problem.
      
      See commit 5c5a7680 ("platform: Provide a remove callback that
      returns no value") for an extended explanation and the eventual goal.
      The TL;DR; is to prevent bugs like the three noticed here.
      
      Note this series results in no change of behaviour apart from improving
      the error message for the three cpsw drivers from
      
      	remove callback returned a non-zero value. This will be ignored.
      
      to
      
      	Failed to resume device (-ESOMETHING)
      ====================
      
      Link: https://lore.kernel.org/r/20231128173823.867512-1-u.kleine-koenig@pengutronix.deSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      7e022268
    • Uwe Kleine-König's avatar
      net: ethernet: ezchip: Convert to platform remove callback returning void · 7ec1bb2c
      Uwe Kleine-König authored
      The .remove() callback for a platform driver returns an int which makes
      many driver authors wrongly assume it's possible to do error handling by
      returning an error code. However the value returned is ignored (apart
      from emitting a warning) and this typically results in resource leaks.
      
      To improve here there is a quest to make the remove callback return
      void. In the first step of this quest all drivers are converted to
      .remove_new(), which already returns void. Eventually after all drivers
      are converted, .remove_new() will be renamed to .remove().
      
      Trivially convert this driver from always returning zero in the remove
      callback to the void returning variant.
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      7ec1bb2c
    • Uwe Kleine-König's avatar
      net: ethernet: ti: cpsw-new: Convert to platform remove callback returning void · a76772e2
      Uwe Kleine-König authored
      The .remove() callback for a platform driver returns an int which makes
      many driver authors wrongly assume it's possible to do error handling by
      returning an error code. However the value returned is ignored (apart
      from emitting a warning) and this typically results in resource leaks.
      
      To improve here there is a quest to make the remove callback return
      void. In the first step of this quest all drivers are converted to
      .remove_new(), which already returns void. Eventually after all drivers
      are converted, .remove_new() will be renamed to .remove().
      
      Replace the error path returning a non-zero value by an error message
      and a comment that there is more to do. With that this patch results in
      no change of behaviour in this driver apart from improving the error
      message.
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Reviewed-by: default avatarRoger Quadros <rogerq@kernel.org>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      a76772e2
    • Uwe Kleine-König's avatar
      net: ethernet: ti: cpsw: Convert to platform remove callback returning void · 7ac3f867
      Uwe Kleine-König authored
      The .remove() callback for a platform driver returns an int which makes
      many driver authors wrongly assume it's possible to do error handling by
      returning an error code. However the value returned is ignored (apart
      from emitting a warning) and this typically results in resource leaks.
      
      To improve here there is a quest to make the remove callback return
      void. In the first step of this quest all drivers are converted to
      .remove_new(), which already returns void. Eventually after all drivers
      are converted, .remove_new() will be renamed to .remove().
      
      Replace the error path returning a non-zero value by an error message
      and a comment that there is more to do. With that this patch results in
      no change of behaviour in this driver apart from improving the error
      message.
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Reviewed-by: default avatarRoger Quadros <rogerq@kernel.org>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      7ac3f867
    • Uwe Kleine-König's avatar
      net: ethernet: ti: am65-cpsw: Convert to platform remove callback returning void · 7234dc5c
      Uwe Kleine-König authored
      The .remove() callback for a platform driver returns an int which makes
      many driver authors wrongly assume it's possible to do error handling by
      returning an error code. However the value returned is ignored (apart
      from emitting a warning) and this typically results in resource leaks.
      
      To improve here there is a quest to make the remove callback return
      void. In the first step of this quest all drivers are converted to
      .remove_new(), which already returns void. Eventually after all drivers
      are converted, .remove_new() will be renamed to .remove().
      
      Replace the error path returning a non-zero value by an error message
      and a comment that there is more to do. With that this patch results in
      no change of behaviour in this driver apart from improving the error
      message.
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Reviewed-by: default avatarRoger Quadros <rogerq@kernel.org>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      7234dc5c
    • Paolo Abeni's avatar
      Merge branch 'devlink-warn-about-existing-entities-during-reload-reinit' · 04447185
      Paolo Abeni authored
      Jiri Pirko says:
      
      ====================
      devlink: warn about existing entities during reload-reinit
      
      Recently there has been a couple of attempts from drivers to block
      devlink reload in certain situations. Turned out, the drivers do not
      properly tear down ports and related netdevs during reload.
      
      To address this, add couple of checks to be done during devlink reload
      reinit action. Also, extend documentation to be more explicit.
      ====================
      
      Link: https://lore.kernel.org/r/20231128115255.773377-1-jiri@resnulli.usSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      04447185
    • Jiri Pirko's avatar
      devlink: warn about existing entities during reload-reinit · 9b2348e2
      Jiri Pirko authored
      During reload-reinit, all entities except for params, resources, regions
      and health reporter should be removed and re-added. Add a warning to
      be triggered in case the driver behaves differently.
      Signed-off-by: default avatarJiri Pirko <jiri@nvidia.com>
      Reviewed-by: default avatarPrzemek Kitszel <przemyslaw.kitszel@intel.com>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      9b2348e2
    • Jiri Pirko's avatar
      Documentation: devlink: extend reload-reinit description · 15d74e65
      Jiri Pirko authored
      Be more explicit about devlink entities that may stay and that have to
      be removed during reload reinit action.
      Signed-off-by: default avatarJiri Pirko <jiri@nvidia.com>
      Reviewed-by: default avatarPrzemek Kitszel <przemyslaw.kitszel@intel.com>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      15d74e65
    • Yujie Liu's avatar
      bpf/tests: Remove duplicate JSGT tests · f690ff91
      Yujie Liu authored
      It seems unnecessary that JSGT is tested twice (one before JSGE and one
      after JSGE) since others are tested only once. Remove the duplicate JSGT
      tests.
      
      Fixes: 0bbaa02b ("bpf/tests: Add tests to check source register zero-extension")
      Signed-off-by: default avatarYujie Liu <yujie.liu@intel.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarJohan Almbladh <johan.almbladh@anyfinetworks.com>
      Link: https://lore.kernel.org/bpf/20231130034018.2144963-1-yujie.liu@intel.com
      f690ff91
    • Paolo Abeni's avatar
      Merge branch 'net-ravb-fixes-for-the-ravb-driver' · 777f245e
      Paolo Abeni authored
      Claudiu Beznea says:
      
      ====================
      net: ravb: Fixes for the ravb driver
      
      This series adds some fixes for ravb driver. Patches in this series
      were initilly part of series at [1].
      
      Changes in v2:
      - in description of patch 1/6 documented the addition of
        out_free_netdev goto label
      - collected tags
      - s/out_runtime_disable/out_rpm_disable in patch 2/6
      - fixed typos in description of patch 6/6
      
      Changes since [1]:
      - addressed review comments
      - added patch 6/6
      
      [1] https://lore.kernel.org/all/20231120084606.4083194-1-claudiu.beznea.uj@bp.renesas.com/
      ====================
      
      Link: https://lore.kernel.org/r/20231128080439.852467-1-claudiu.beznea.uj@bp.renesas.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      777f245e
    • Claudiu Beznea's avatar
      net: ravb: Keep reverse order of operations in ravb_remove() · edf9bc39
      Claudiu Beznea authored
      On RZ/G3S SMARC Carrier II board having RGMII connections b/w Ethernet
      MACs and PHYs it has been discovered that doing unbind/bind for ravb
      driver in a loop leads to wrong speed and duplex for Ethernet links and
      broken connectivity (the connectivity cannot be restored even with
      bringing interface down/up). Before doing unbind/bind the Ethernet
      interfaces were configured though systemd. The sh instructions used to
      do unbind/bind were:
      
      $ cd /sys/bus/platform/drivers/ravb/
      $ while :; do echo 11c30000.ethernet > unbind ; \
        echo 11c30000.ethernet > bind; done
      
      It has been discovered that there is a race b/w IOCTLs initialized by
      systemd at the response of success binding and the
      "ravb_write(ndev, CCC_OPC_RESET, CCC)" call in ravb_remove() as
      follows:
      
      1/ as a result of bind success the user space open/configures the
         interfaces tough an IOCTL; the following stack trace has been
         identified on RZ/G3S:
      
      Call trace:
      dump_backtrace+0x9c/0x100
      show_stack+0x20/0x38
      dump_stack_lvl+0x48/0x60
      dump_stack+0x18/0x28
      ravb_open+0x70/0xa58
      __dev_open+0xf4/0x1e8
      __dev_change_flags+0x198/0x218
      dev_change_flags+0x2c/0x80
      devinet_ioctl+0x640/0x708
      inet_ioctl+0x1e4/0x200
      sock_do_ioctl+0x50/0x108
      sock_ioctl+0x240/0x358
      __arm64_sys_ioctl+0xb0/0x100
      invoke_syscall+0x50/0x128
      el0_svc_common.constprop.0+0xc8/0xf0
      do_el0_svc+0x24/0x38
      el0_svc+0x34/0xb8
      el0t_64_sync_handler+0xc0/0xc8
      el0t_64_sync+0x190/0x198
      
      2/ this call may execute concurrently with ravb_remove() as the
         unbind/bind operation was executed in a loop
      3/ if the operation mode is changed to RESET (through
         ravb_write(ndev, CCC_OPC_RESET, CCC) call in ravb_remove())
         while the above ravb_open() is in progress it may lead to MAC
         (or PHY, or MAC-PHY connection, the right point hasn't been identified
         at the moment) to be broken, thus the Ethernet connectivity fails to
         restore.
      
      The simple fix for this is to move ravb_write(ndev, CCC_OPC_RESET, CCC))
      after unregister_netdev() to avoid resetting the controller while the
      netdev interface is still registered.
      
      To avoid future issues in ravb_remove(), the patch follows the proper order
      of operations in ravb_remove(): reverse order compared with ravb_probe().
      This avoids described races as the IOCTLs as well as unregister_netdev()
      (called now at the beginning of ravb_remove()) calls rtnl_lock() before
      continuing and IOCTLs check (though devinet_ioctl()) if device is still
      registered just after taking the lock:
      
      int devinet_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr)
      {
      	// ...
      
              rtnl_lock();
      
              ret = -ENODEV;
              dev = __dev_get_by_name(net, ifr->ifr_name);
              if (!dev)
                      goto done;
      
      	// ...
      done:
              rtnl_unlock();
      out:
              return ret;
      }
      
      Fixes: c156633f ("Renesas Ethernet AVB driver proper")
      Reviewed-by: default avatarSergey Shtylyov <s.shtylyov@omp.ru>
      Signed-off-by: default avatarClaudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      edf9bc39
    • Claudiu Beznea's avatar
      net: ravb: Stop DMA in case of failures on ravb_open() · eac16a73
      Claudiu Beznea authored
      In case ravb_phy_start() returns with error the settings applied in
      ravb_dmac_init() are not reverted (e.g. config mode). For this call
      ravb_stop_dma() on failure path of ravb_open().
      
      Fixes: a0d2f206 ("Renesas Ethernet AVB PTP clock driver")
      Reviewed-by: default avatarSergey Shtylyov <s.shtylyov@omp.ru>
      Signed-off-by: default avatarClaudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      eac16a73
    • Claudiu Beznea's avatar
      net: ravb: Start TX queues after HW initialization succeeded · 6f32c086
      Claudiu Beznea authored
      ravb_phy_start() may fail. If that happens, the TX queues will remain
      started. Thus, move the netif_tx_start_all_queues() after PHY is
      successfully initialized.
      
      Fixes: c156633f ("Renesas Ethernet AVB driver proper")
      Reviewed-by: default avatarSergey Shtylyov <s.shtylyov@omp.ru>
      Signed-off-by: default avatarClaudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
      Reviewed-by: default avatarKalesh AP <kalesh-anakkur.purayil@broadcom.com>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      6f32c086