1. 26 Aug, 2021 19 commits
  2. 25 Aug, 2021 7 commits
    • kernel test robot's avatar
      net: usb: asix: ax88772: fix boolconv.cocci warnings · ec92e524
      kernel test robot authored
      drivers/net/usb/asix_devices.c:757:60-65: WARNING: conversion to bool not needed here
      
       Remove unneeded conversion to bool
      
      Semantic patch information:
       Relational and logical operators evaluate to bool,
       explicit conversion is overly verbose and unneeded.
      
      Generated by: scripts/coccinelle/misc/boolconv.cocci
      
      Fixes: 7a141e64 ("net: usb: asix: ax88772: move embedded PHY detection as early as possible")
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Signed-off-by: default avatarkernel test robot <lkp@intel.com>
      Reviewed-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      Link: https://lore.kernel.org/r/20210825183538.13070-1-o.rempel@pengutronix.deSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      ec92e524
    • Davide Caratti's avatar
      net/sched: ets: fix crash when flipping from 'strict' to 'quantum' · cd9b50ad
      Davide Caratti authored
      While running kselftests, Hangbin observed that sch_ets.sh often crashes,
      and splats like the following one are seen in the output of 'dmesg':
      
       BUG: kernel NULL pointer dereference, address: 0000000000000000
       #PF: supervisor read access in kernel mode
       #PF: error_code(0x0000) - not-present page
       PGD 159f12067 P4D 159f12067 PUD 159f13067 PMD 0
       Oops: 0000 [#1] SMP NOPTI
       CPU: 2 PID: 921 Comm: tc Not tainted 5.14.0-rc6+ #458
       Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
       RIP: 0010:__list_del_entry_valid+0x2d/0x50
       Code: 48 8b 57 08 48 b9 00 01 00 00 00 00 ad de 48 39 c8 0f 84 ac 6e 5b 00 48 b9 22 01 00 00 00 00 ad de 48 39 ca 0f 84 cf 6e 5b 00 <48> 8b 32 48 39 fe 0f 85 af 6e 5b 00 48 8b 50 08 48 39 f2 0f 85 94
       RSP: 0018:ffffb2da005c3890 EFLAGS: 00010217
       RAX: 0000000000000000 RBX: ffff9073ba23f800 RCX: dead000000000122
       RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff9073ba23fbc8
       RBP: ffff9073ba23f890 R08: 0000000000000001 R09: 0000000000000001
       R10: 0000000000000001 R11: 0000000000000001 R12: dead000000000100
       R13: ffff9073ba23fb00 R14: 0000000000000002 R15: 0000000000000002
       FS:  00007f93e5564e40(0000) GS:ffff9073bba00000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 0000000000000000 CR3: 000000014ad34000 CR4: 0000000000350ee0
       Call Trace:
        ets_qdisc_reset+0x6e/0x100 [sch_ets]
        qdisc_reset+0x49/0x1d0
        tbf_reset+0x15/0x60 [sch_tbf]
        qdisc_reset+0x49/0x1d0
        dev_reset_queue.constprop.42+0x2f/0x90
        dev_deactivate_many+0x1d3/0x3d0
        dev_deactivate+0x56/0x90
        qdisc_graft+0x47e/0x5a0
        tc_get_qdisc+0x1db/0x3e0
        rtnetlink_rcv_msg+0x164/0x4c0
        netlink_rcv_skb+0x50/0x100
        netlink_unicast+0x1a5/0x280
        netlink_sendmsg+0x242/0x480
        sock_sendmsg+0x5b/0x60
        ____sys_sendmsg+0x1f2/0x260
        ___sys_sendmsg+0x7c/0xc0
        __sys_sendmsg+0x57/0xa0
        do_syscall_64+0x3a/0x80
        entry_SYSCALL_64_after_hwframe+0x44/0xae
       RIP: 0033:0x7f93e44b8338
       Code: 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 25 43 2c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 41 89 d4 55
       RSP: 002b:00007ffc0db737a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
       RAX: ffffffffffffffda RBX: 0000000061255c06 RCX: 00007f93e44b8338
       RDX: 0000000000000000 RSI: 00007ffc0db73810 RDI: 0000000000000003
       RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
       R10: 000000000000000b R11: 0000000000000246 R12: 0000000000000001
       R13: 0000000000687880 R14: 0000000000000000 R15: 0000000000000000
       Modules linked in: sch_ets sch_tbf dummy rfkill iTCO_wdt iTCO_vendor_support intel_rapl_msr intel_rapl_common joydev i2c_i801 pcspkr i2c_smbus lpc_ich virtio_balloon ip_tables xfs libcrc32c crct10dif_pclmul crc32_pclmul crc32c_intel ahci libahci ghash_clmulni_intel libata serio_raw virtio_blk virtio_console virtio_net net_failover failover sunrpc dm_mirror dm_region_hash dm_log dm_mod
       CR2: 0000000000000000
      
      When the change() function decreases the value of 'nstrict', we must take
      into account that packets might be already enqueued on a class that flips
      from 'strict' to 'quantum': otherwise that class will not be added to the
      bandwidth-sharing list. Then, a call to ets_qdisc_reset() will attempt to
      do list_del(&alist) with 'alist' filled with zero, hence the NULL pointer
      dereference.
      For classes flipping from 'strict' to 'quantum', initialize an empty list
      and eventually add it to the bandwidth-sharing list, if there are packets
      already enqueued. In this way, the kernel will:
       a) prevent crashing as described above.
       b) avoid retaining the backlog packets (for an arbitrarily long time) in
          case no packet is enqueued after a change from 'strict' to 'quantum'.
      Reported-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Fixes: dcc68b4d ("net: sch_ets: Add a new Qdisc")
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cd9b50ad
    • Shai Malin's avatar
      qede: Fix memset corruption · e5434688
      Shai Malin authored
      Thanks to Kees Cook who detected the problem of memset that starting
      from not the first member, but sized for the whole struct.
      The better change will be to remove the redundant memset and to clear
      only the msix_cnt member.
      Signed-off-by: default avatarPrabhakar Kushwaha <pkushwaha@marvell.com>
      Signed-off-by: default avatarAriel Elior <aelior@marvell.com>
      Signed-off-by: default avatarShai Malin <smalin@marvell.com>
      Reported-by: default avatarKees Cook <keescook@chromium.org>
      Reviewed-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e5434688
    • Song Yoong Siang's avatar
      net: stmmac: fix kernel panic due to NULL pointer dereference of buf->xdp · 2b9fff64
      Song Yoong Siang authored
      Ensure a valid XSK buffer before proceed to free the xdp buffer.
      
      The following kernel panic is observed without this patch:
      
      RIP: 0010:xp_free+0x5/0x40
      Call Trace:
      stmmac_napi_poll_rxtx+0x332/0xb30 [stmmac]
      ? stmmac_tx_timer+0x3c/0xb0 [stmmac]
      net_rx_action+0x13d/0x3d0
      __do_softirq+0xfc/0x2fb
      ? smpboot_register_percpu_thread+0xe0/0xe0
      run_ksoftirqd+0x32/0x70
      smpboot_thread_fn+0x1d8/0x2c0
      kthread+0x169/0x1a0
      ? kthread_park+0x90/0x90
      ret_from_fork+0x1f/0x30
      ---[ end trace 0000000000000002 ]---
      
      Fixes: bba2556e ("net: stmmac: Enable RX via AF_XDP zero-copy")
      Cc: <stable@vger.kernel.org> # 5.13.x
      Suggested-by: default avatarOng Boon Leong <boon.leong.ong@intel.com>
      Signed-off-by: default avatarSong Yoong Siang <yoong.siang.song@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2b9fff64
    • Song Yoong Siang's avatar
      net: stmmac: fix kernel panic due to NULL pointer dereference of xsk_pool · a6451192
      Song Yoong Siang authored
      After free xsk_pool, there is possibility that napi polling is still
      running in the middle, thus causes a kernel crash due to kernel NULL
      pointer dereference of rx_q->xsk_pool and tx_q->xsk_pool.
      
      Fix this by changing the XDP pool setup sequence to:
       1. disable napi before free xsk_pool
       2. enable napi after init xsk_pool
      
      The following kernel panic is observed without this patch:
      
      RIP: 0010:xsk_uses_need_wakeup+0x5/0x10
      Call Trace:
      stmmac_napi_poll_rxtx+0x3a9/0xae0 [stmmac]
      __napi_poll+0x27/0x130
      net_rx_action+0x233/0x280
      __do_softirq+0xe2/0x2b6
      run_ksoftirqd+0x1a/0x20
      smpboot_thread_fn+0xac/0x140
      ? sort_range+0x20/0x20
      kthread+0x124/0x150
      ? set_kthread_struct+0x40/0x40
      ret_from_fork+0x1f/0x30
      ---[ end trace a77c8956b79ac107 ]---
      
      Fixes: bba2556e ("net: stmmac: Enable RX via AF_XDP zero-copy")
      Cc: <stable@vger.kernel.org> # 5.13.x
      Signed-off-by: default avatarSong Yoong Siang <yoong.siang.song@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a6451192
    • Harini Katakam's avatar
      net: macb: Add a NULL check on desc_ptp · 85520079
      Harini Katakam authored
      macb_ptp_desc will not return NULL under most circumstances with correct
      Kconfig and IP design config register. But for the sake of the extreme
      corner case, check for NULL when using the helper. In case of rx_tstamp,
      no action is necessary except to return (similar to timestamp disabled)
      and warn. In case of TX, return -EINVAL to let the skb be free. Perform
      this check before marking skb in progress.
      Fixes coverity warning:
      (4) Event dereference:
      Dereferencing a null pointer "desc_ptp"
      Signed-off-by: default avatarHarini Katakam <harini.katakam@xilinx.com>
      Reviewed-by: default avatarRadhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
      Signed-off-by: default avatarMichal Simek <michal.simek@xilinx.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      85520079
    • Michael Riesch's avatar
      net: stmmac: dwmac-rk: fix unbalanced pm_runtime_enable warnings · 2d26f6e3
      Michael Riesch authored
      This reverts commit 2c896fb0
      "net: stmmac: dwmac-rk: add pd_gmac support for rk3399" and fixes
      unbalanced pm_runtime_enable warnings.
      
      In the commit to be reverted, support for power management was
      introduced to the Rockchip glue code. Later, power management support
      was introduced to the stmmac core code, resulting in multiple
      invocations of pm_runtime_{enable,disable,get_sync,put_sync}.
      
      The multiple invocations happen in rk_gmac_powerup and
      stmmac_{dvr_probe, resume} as well as in rk_gmac_powerdown and
      stmmac_{dvr_remove, suspend}, respectively, which are always called
      in conjunction.
      
      Fixes: 5ec55823 ("net: stmmac: add clocks management for gmac driver")
      Signed-off-by: default avatarMichael Riesch <michael.riesch@wolfvision.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2d26f6e3
  3. 24 Aug, 2021 4 commits
  4. 23 Aug, 2021 7 commits
    • David S. Miller's avatar
      Merge branch 'asix-fixes' · 14315498
      David S. Miller authored
      Oleksij Rempel says:
      
      ====================
      asix fixes
      
      changes v2:
      - rebase against current net
      - add one more fix for the ax88178 variant
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      14315498
    • Oleksij Rempel's avatar
      net: usb: asix: do not call phy_disconnect() for ax88178 · 1406e8cb
      Oleksij Rempel authored
      Fix crash on reboot on a system with ASIX AX88178 USB adapter attached
      to it:
      | asix 1-1.4:1.0 eth0: unregister 'asix' usb-ci_hdrc.0-1.4, ASIX AX88178 USB 2.0 Ethernet
      | 8<--- cut here ---
      | Unable to handle kernel NULL pointer dereference at virtual address 0000028c
      | pgd = 5ec93aee
      | [0000028c] *pgd=00000000
      | Internal error: Oops: 5 [#1] PREEMPT SMP ARM
      | Modules linked in:
      | CPU: 1 PID: 1 Comm: systemd-shutdow Not tainted 5.14.0-rc1-20210811-1 #4
      | Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
      | PC is at phy_disconnect+0x8/0x48
      | LR is at ax88772_unbind+0x14/0x20
      | [<80650d04>] (phy_disconnect) from [<80741aa4>] (ax88772_unbind+0x14/0x20)
      | [<80741aa4>] (ax88772_unbind) from [<8074e250>] (usbnet_disconnect+0x48/0xd8)
      | [<8074e250>] (usbnet_disconnect) from [<807655e0>] (usb_unbind_interface+0x78/0x25c)
      | [<807655e0>] (usb_unbind_interface) from [<805b03a0>] (__device_release_driver+0x154/0x20c)
      | [<805b03a0>] (__device_release_driver) from [<805b0478>] (device_release_driver+0x20/0x2c)
      | [<805b0478>] (device_release_driver) from [<805af944>] (bus_remove_device+0xcc/0xf8)
      | [<805af944>] (bus_remove_device) from [<805ab26c>] (device_del+0x178/0x4b0)
      | [<805ab26c>] (device_del) from [<807634a4>] (usb_disable_device+0xcc/0x178)
      | [<807634a4>] (usb_disable_device) from [<8075a060>] (usb_disconnect+0xd8/0x238)
      | [<8075a060>] (usb_disconnect) from [<8075a02c>] (usb_disconnect+0xa4/0x238)
      | [<8075a02c>] (usb_disconnect) from [<8075a02c>] (usb_disconnect+0xa4/0x238)
      | [<8075a02c>] (usb_disconnect) from [<80af3520>] (usb_remove_hcd+0xa0/0x198)
      | [<80af3520>] (usb_remove_hcd) from [<807902e0>] (host_stop+0x38/0xa8)
      | [<807902e0>] (host_stop) from [<8078d9e4>] (ci_hdrc_remove+0x3c/0x118)
      | [<8078d9e4>] (ci_hdrc_remove) from [<805b27ec>] (platform_remove+0x20/0x50)
      | [<805b27ec>] (platform_remove) from [<805b03a0>] (__device_release_driver+0x154/0x20c)
      | [<805b03a0>] (__device_release_driver) from [<805b0478>] (device_release_driver+0x20/0x2c)
      | [<805b0478>] (device_release_driver) from [<805af944>] (bus_remove_device+0xcc/0xf8)
      | [<805af944>] (bus_remove_device) from [<805ab26c>] (device_del+0x178/0x4b0)
      
      For this adapter we call ax88178_bind() and ax88772_unbind(), which is
      related to different chip version and different counter part *bind()
      function.
      
      Since this chip is currently not ported to the PHYLIB, we do not need to
      call phy_disconnect() here. So, to fix this crash, we need to add
      ax88178_unbind().
      
      Fixes: e532a096 ("net: usb: asix: ax88772: add phylib support")
      Reported-by: default avatarRobin van der Gracht <robin@protonic.nl>
      Tested-by: default avatarRobin van der Gracht <robin@protonic.nl>
      Signed-off-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1406e8cb
    • Oleksij Rempel's avatar
      net: usb: asix: ax88772: move embedded PHY detection as early as possible · 7a141e64
      Oleksij Rempel authored
      Some HW revisions need additional MAC configuration before the embedded PHY
      can be enabled. If this is not done, we won't be able to get response
      from the internal PHY.
      
      This issue was detected on chipcode == AX_AX88772_CHIPCODE variant,
      where ax88772_hw_reset() was executed with missing embd_phy flag.
      
      Fixes: e532a096 ("net: usb: asix: ax88772: add phylib support")
      Reported-by: default avatarJarkko Nikula <jarkko.nikula@linux.intel.com>
      Tested-by: default avatarJarkko Nikula <jarkko.nikula@linux.intel.com>
      Signed-off-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7a141e64
    • Maxim Kiselev's avatar
      net: marvell: fix MVNETA_TX_IN_PRGRS bit number · 359f4cdd
      Maxim Kiselev authored
      According to Armada XP datasheet bit at 0 position is corresponding for
      TxInProg indication.
      
      Fixes: c5aff182 ("net: mvneta: driver for Marvell Armada 370/XP network unit")
      Signed-off-by: default avatarMaxim Kiselev <bigunclemax@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      359f4cdd
    • Wong Vee Khee's avatar
      net: stmmac: fix kernel panic due to NULL pointer dereference of plat->est · 82a44ae1
      Wong Vee Khee authored
      In the case of taprio offload is not enabled, the error handling path
      causes a kernel crash due to kernel NULL pointer deference.
      
      Fix this by adding check for NULL before attempt to access 'plat->est'
      on the mutex_lock() call.
      
      The following kernel panic is observed without this patch:
      
      RIP: 0010:mutex_lock+0x10/0x20
      Call Trace:
      tc_setup_taprio+0x482/0x560 [stmmac]
      kmem_cache_alloc_trace+0x13f/0x490
      taprio_disable_offload.isra.0+0x9d/0x180 [sch_taprio]
      taprio_destroy+0x6c/0x100 [sch_taprio]
      qdisc_create+0x2e5/0x4f0
      tc_modify_qdisc+0x126/0x740
      rtnetlink_rcv_msg+0x12b/0x380
      _raw_spin_lock_irqsave+0x19/0x40
      _raw_spin_unlock_irqrestore+0x18/0x30
      create_object+0x212/0x340
      rtnl_calcit.isra.0+0x110/0x110
      netlink_rcv_skb+0x50/0x100
      netlink_unicast+0x191/0x230
      netlink_sendmsg+0x243/0x470
      sock_sendmsg+0x5e/0x60
      ____sys_sendmsg+0x20b/0x280
      copy_msghdr_from_user+0x5c/0x90
      __mod_memcg_state+0x87/0xf0
       ___sys_sendmsg+0x7c/0xc0
      lru_cache_add+0x7f/0xa0
      _raw_spin_unlock+0x16/0x30
      wp_page_copy+0x449/0x890
      handle_mm_fault+0x921/0xfc0
      __sys_sendmsg+0x59/0xa0
      do_syscall_64+0x33/0x40
      entry_SYSCALL_64_after_hwframe+0x44/0xa9
      ---[ end trace b1f19b24368a96aa ]---
      
      Fixes: b60189e0 ("net: stmmac: Integrate EST with TAPRIO scheduler API")
      Cc: <stable@vger.kernel.org> # 5.10.x
      Signed-off-by: default avatarWong Vee Khee <vee.khee.wong@linux.intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      82a44ae1
    • David S. Miller's avatar
      Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue · 46002bf3
      David S. Miller authored
      Tony Nguyen says:
      
      ====================
      Intel Wired LAN Driver Updates 2021-08-20
      
      This series contains updates to igc and e1000e drivers.
      
      Aaron Ma resolves a page fault which occurs when thunderbolt is
      unplugged for igc.
      
      Toshiki Nishioka fixes Tx queue looping to use actual number of queues
      instead of max value for igc.
      
      Sasha fixes an incorrect latency comparison by decoding the values before
      comparing and prevents attempted writes to read-only NVMs for e1000e.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      46002bf3
    • Christophe JAILLET's avatar
      xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()' · 5ed74b03
      Christophe JAILLET authored
      A successful 'xge_mdio_config()' call should be balanced by a corresponding
      'xge_mdio_remove()' call in the error handling path of the probe, as
      already done in the remove function.
      
      Update the error handling path accordingly.
      
      Fixes: ea8ab16a ("drivers: net: xgene-v2: Add MDIO support")
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5ed74b03
  5. 22 Aug, 2021 2 commits
  6. 20 Aug, 2021 1 commit