1. 19 Sep, 2018 5 commits
    • Suren Baghdasaryan's avatar
      NFC: Fix possible memory corruption when handling SHDLC I-Frame commands · 674d9de0
      Suren Baghdasaryan authored
      When handling SHDLC I-Frame commands "pipe" field used for indexing
      into an array should be checked before usage. If left unchecked it
      might access memory outside of the array of size NFC_HCI_MAX_PIPES(127).
      
      Malformed NFC HCI frames could be injected by a malicious NFC device
      communicating with the device being attacked (remote attack vector),
      or even by an attacker with physical access to the I2C bus such that
      they could influence the data transfers on that bus (local attack vector).
      skb->data is controlled by the attacker and has only been sanitized in
      the most trivial ways (CRC check), therefore we can consider the
      create_info struct and all of its members to tainted. 'create_info->pipe'
      with max value of 255 (uint8) is used to take an offset of the
      hdev->pipes array of 127 elements which can lead to OOB write.
      
      Cc: Samuel Ortiz <sameo@linux.intel.com>
      Cc: Allen Pais <allen.pais@oracle.com>
      Cc: "David S. Miller" <davem@davemloft.net>
      Suggested-by: default avatarKevin Deus <kdeus@google.com>
      Signed-off-by: default avatarSuren Baghdasaryan <surenb@google.com>
      Acked-by: default avatarKees Cook <keescook@chromium.org>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      674d9de0
    • Sabrina Dubroca's avatar
      selftests: pmtu: properly redirect stderr to /dev/null · 0a286afe
      Sabrina Dubroca authored
      The cleanup function uses "$CMD 2 > /dev/null", which doesn't actually
      send stderr to /dev/null, so when the netns doesn't exist, the error
      message is shown. Use "2> /dev/null" instead, so that those messages
      disappear, as was intended.
      
      Fixes: d1f1b9cb ("selftests: net: Introduce first PMTU test")
      Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
      Acked-by: default avatarStefano Brivio <sbrivio@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0a286afe
    • David S. Miller's avatar
      Merge branch 'stmmac-Coalesce-and-tail-addr-fixes' · 87ebcffd
      David S. Miller authored
      Jose Abreu says:
      
      ====================
      net: stmmac: Coalesce and tail addr fixes
      
      The fix for coalesce timer and a fix in tail address setting that impacts
      XGMAC2 operation.
      
      The series is:
      Tested-by: default avatarJerome Brunet <jbrunet@baylibre.com>
      	on a113 s400 board (single queue)
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      87ebcffd
    • Jose Abreu's avatar
      net: stmmac: Fixup the tail addr setting in xmit path · 0431100b
      Jose Abreu authored
      Currently we are always setting the tail address of descriptor list to
      the end of the pre-allocated list.
      
      According to databook this is not correct. Tail address should point to
      the last available descriptor + 1, which means we have to update the
      tail address everytime we call the xmit function.
      
      This should make no impact in older versions of MAC but in newer
      versions there are some DMA features which allows the IP to fetch
      descriptors in advance and in a non sequential order so its critical
      that we set the tail address correctly.
      Signed-off-by: default avatarJose Abreu <joabreu@synopsys.com>
      Fixes: f748be53 ("stmmac: support new GMAC4")
      Cc: David S. Miller <davem@davemloft.net>
      Cc: Joao Pinto <jpinto@synopsys.com>
      Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
      Cc: Alexandre Torgue <alexandre.torgue@st.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0431100b
    • Jose Abreu's avatar
      net: stmmac: Rework coalesce timer and fix multi-queue races · 8fce3331
      Jose Abreu authored
      This follows David Miller advice and tries to fix coalesce timer in
      multi-queue scenarios.
      
      We are now using per-queue coalesce values and per-queue TX timer.
      
      Coalesce timer default values was changed to 1ms and the coalesce frames
      to 25.
      
      Tested in B2B setup between XGMAC2 and GMAC5.
      Signed-off-by: default avatarJose Abreu <joabreu@synopsys.com>
      Fixes: 	ce736788 ("net: stmmac: adding multiple buffers for TX")
      Cc: Florian Fainelli <f.fainelli@gmail.com>
      Cc: Neil Armstrong <narmstrong@baylibre.com>
      Cc: Jerome Brunet <jbrunet@baylibre.com>
      Cc: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: Joao Pinto <jpinto@synopsys.com>
      Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
      Cc: Alexandre Torgue <alexandre.torgue@st.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8fce3331
  2. 18 Sep, 2018 11 commits
    • Greg Kroah-Hartman's avatar
      Merge gitolite.kernel.org:/pub/scm/linux/kernel/git/davem/net · 5211da9c
      Greg Kroah-Hartman authored
      Dave writes:
        "Various fixes, all over the place:
      
         1) OOB data generation fix in bluetooth, from Matias Karhumaa.
      
         2) BPF BTF boundary calculation fix, from Martin KaFai Lau.
      
         3) Don't bug on excessive frags, to be compatible in situations mixing
            older and newer kernels on each end.  From Juergen Gross.
      
         4) Scheduling in RCU fix in hv_netvsc, from Stephen Hemminger.
      
         5) Zero keying information in TLS layer before freeing copies
            of them, from Sabrina Dubroca.
      
         6) Fix NULL deref in act_sample, from Davide Caratti.
      
         7) Orphan SKB before GRO in veth to prevent crashes with XDP,
            from Toshiaki Makita.
      
         8) Fix use after free in ip6_xmit, from Eric Dumazet.
      
         9) Fix VF mac address regression in bnxt_en, from Micahel Chan.
      
         10) Fix MSG_PEEK behavior in TLS layer, from Daniel Borkmann.
      
         11) Programming adjustments to r8169 which fix not being to enter deep
             sleep states on some machines, from Kai-Heng Feng and Hans de
             Goede.
      
         12) Fix DST_NOCOUNT flag handling for ipv6 routes, from Peter
             Oskolkov."
      
      * gitolite.kernel.org:/pub/scm/linux/kernel/git/davem/net: (45 commits)
        net/ipv6: do not copy dst flags on rt init
        qmi_wwan: set DTR for modems in forced USB2 mode
        clk: x86: Stop marking clocks as CLK_IS_CRITICAL
        r8169: Get and enable optional ether_clk clock
        clk: x86: add "ether_clk" alias for Bay Trail / Cherry Trail
        r8169: enable ASPM on RTL8106E
        r8169: Align ASPM/CLKREQ setting function with vendor driver
        Revert "kcm: remove any offset before parsing messages"
        kcm: remove any offset before parsing messages
        net: ethernet: Fix a unused function warning.
        net: dsa: mv88e6xxx: Fix ATU Miss Violation
        tls: fix currently broken MSG_PEEK behavior
        hv_netvsc: pair VF based on serial number
        PCI: hv: support reporting serial number as slot information
        bnxt_en: Fix VF mac address regression.
        ipv6: fix possible use-after-free in ip6_xmit()
        net: hp100: fix always-true check for link up state
        ARM: dts: at91: add new compatibility string for macb on sama5d3
        net: macb: disable scatter-gather for macb on sama5d3
        net: mvpp2: let phylink manage the carrier state
        ...
      5211da9c
    • Peter Oskolkov's avatar
      net/ipv6: do not copy dst flags on rt init · 30bfd930
      Peter Oskolkov authored
      DST_NOCOUNT in dst_entry::flags tracks whether the entry counts
      toward route cache size (net->ipv6.sysctl.ip6_rt_max_size).
      
      If the flag is NOT set, dst_ops::pcpuc_entries counter is incremented
      in dist_init() and decremented in dst_destroy().
      
      This flag is tied to allocation/deallocation of dst_entry and
      should not be copied from another dst/route. Otherwise it can happen
      that dst_ops::pcpuc_entries counter grows until no new routes can
      be allocated because the counter reached ip6_rt_max_size due to
      DST_NOCOUNT not set and thus no counter decrements on gc-ed routes.
      
      Fixes: 3b6761d1 ("net/ipv6: Move dst flags to booleans in fib entries")
      Cc: David Ahern <dsahern@gmail.com>
      Acked-by: default avatarWei Wang <weiwan@google.com>
      Signed-off-by: default avatarPeter Oskolkov <posk@google.com>
      Reviewed-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      30bfd930
    • Bjørn Mork's avatar
      qmi_wwan: set DTR for modems in forced USB2 mode · 922005c7
      Bjørn Mork authored
      Recent firmware revisions have added the ability to force
      these modems to USB2 mode, hiding their SuperSpeed
      capabilities from the host.  The driver has been using the
      SuperSpeed capability, as shown by the bcdUSB field of the
      device descriptor, to detect the need to enable the DTR
      quirk.  This method fails when the modems are forced to
      USB2 mode by the modem firmware.
      
      Fix by unconditionally enabling the DTR quirk for the
      affected device IDs.
      Reported-by: default avatarFred Veldini <fred.veldini@gmail.com>
      Reported-by: default avatarDeshu Wen <dwen@sierrawireless.com>
      Signed-off-by: default avatarBjørn Mork <bjorn@mork.no>
      Reported-by: default avatarFred Veldini <fred.veldini@gmail.com>
      Reported-by: default avatarDeshu Wen <dwen@sierrawireless.com>
      Signed-off-by: default avatarBjørn Mork <bjorn@mork.no>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      922005c7
    • David S. Miller's avatar
      Merge branch 'r8169-clk-fixes' · 89bfd48d
      David S. Miller authored
      Hans de Goede says:
      
      ====================
      r8169 (x86) clk fixes to fix S0ix not being reached
      
      This series adds code to the r8169 ethernet driver to get and enable an
      external clock if present, avoiding the need for a hack in the
      clk-pmc-atom driver where that clock was left on continuesly causing x86
      some devices to not reach deep power saving states (S0ix) when suspended
      causing to them to quickly drain their battery while suspended.
      
      The 3 commits in this series need to be merged in order to avoid
      regressions while bisecting. The clk-pmc-atom driver does not see much
      changes (it was last touched over a year ago). So the clk maintainers
      have agreed with merging all 3 patches through the net tree.
      All 3 patches have Stephen Boyd's Acked-by for this purpose.
      
      This v2 of the series only had some minor tweaks done to the commit
      messages and is ready for merging through the net tree now.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      89bfd48d
    • Hans de Goede's avatar
      clk: x86: Stop marking clocks as CLK_IS_CRITICAL · 648e9218
      Hans de Goede authored
      Commit d31fd43c ("clk: x86: Do not gate clocks enabled by the
      firmware"), which added the code to mark clocks as CLK_IS_CRITICAL, causes
      all unclaimed PMC clocks on Cherry Trail devices to be on all the time,
      resulting on the device not being able to reach S0i3 when suspended.
      
      The reason for this commit is that on some Bay Trail / Cherry Trail devices
      the r8169 ethernet controller uses pmc_plt_clk_4. Now that the clk-pmc-atom
      driver exports an "ether_clk" alias for pmc_plt_clk_4 and the r8169 driver
      has been modified to get and enable this clock (if present) the marking of
      the clocks as CLK_IS_CRITICAL is no longer necessary.
      
      This commit removes the CLK_IS_CRITICAL marking, fixing Cherry Trail
      devices not being able to reach S0i3 greatly decreasing their battery
      drain when suspended.
      
      Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=193891#c102
      Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=196861
      Cc: Johannes Stezenbach <js@sig21.net>
      Cc: Carlo Caione <carlo@endlessm.com>
      Reported-by: default avatarJohannes Stezenbach <js@sig21.net>
      Reviewed-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Acked-by: default avatarStephen Boyd <sboyd@kernel.org>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      648e9218
    • Hans de Goede's avatar
      r8169: Get and enable optional ether_clk clock · c2f6f3ee
      Hans de Goede authored
      On some boards a platform clock is used as clock for the r8169 chip,
      this commit adds support for getting and enabling this clock (assuming
      it has an "ether_clk" alias set on it).
      
      This is related to commit d31fd43c ("clk: x86: Do not gate clocks
      enabled by the firmware") which is a previous attempt to fix this for some
      x86 boards, but this causes all Cherry Trail SoC using boards to not reach
      there lowest power states when suspending.
      
      This commit (together with an atom-pmc-clk driver commit adding the alias)
      fixes things properly by making the r8169 get the clock and enable it when
      it needs it.
      
      Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=193891#c102
      Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=196861
      Cc: Johannes Stezenbach <js@sig21.net>
      Cc: Carlo Caione <carlo@endlessm.com>
      Reported-by: default avatarJohannes Stezenbach <js@sig21.net>
      Acked-by: default avatarStephen Boyd <sboyd@kernel.org>
      Reviewed-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c2f6f3ee
    • Hans de Goede's avatar
      clk: x86: add "ether_clk" alias for Bay Trail / Cherry Trail · b1e3454d
      Hans de Goede authored
      Commit d31fd43c ("clk: x86: Do not gate clocks enabled by the
      firmware") causes all unclaimed PMC clocks on Cherry Trail devices to be on
      all the time, resulting on the device not being able to reach S0i2 or S0i3
      when suspended.
      
      The reason for this commit is that on some Bay Trail / Cherry Trail devices
      the ethernet controller uses pmc_plt_clk_4. This commit adds an "ether_clk"
      alias, so that the relevant ethernet drivers can try to (optionally) use
      this, without needing X86 specific code / hacks, thus fixing ethernet on
      these devices without breaking S0i3 support.
      
      This commit uses clkdev_hw_create() to create the alias, mirroring the code
      for the already existing "mclk" alias for pmc_plt_clk_3.
      
      Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=193891#c102
      Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=196861
      Cc: Johannes Stezenbach <js@sig21.net>
      Cc: Carlo Caione <carlo@endlessm.com>
      Reported-by: default avatarJohannes Stezenbach <js@sig21.net>
      Acked-by: default avatarStephen Boyd <sboyd@kernel.org>
      Reviewed-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b1e3454d
    • Kai-Heng Feng's avatar
      r8169: enable ASPM on RTL8106E · 0866cd15
      Kai-Heng Feng authored
      The Intel SoC was prevented from entering lower idle state because
      of RTL8106E's ASPM was not enabled.
      
      So enable ASPM on RTL8106E (chip version 39).
      Now the Intel SoC can enter lower idle state, power consumption and
      temperature are much lower.
      Signed-off-by: default avatarKai-Heng Feng <kai.heng.feng@canonical.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0866cd15
    • Kai-Heng Feng's avatar
      r8169: Align ASPM/CLKREQ setting function with vendor driver · 94235460
      Kai-Heng Feng authored
      There's a small delay after setting ASPM in vendor drivers, r8101 and
      r8168.
      In addition, those drivers enable ASPM before ClkReq, also change that
      to align with vendor driver.
      
      I haven't seen anything bad becasue of this, but I think it's better to
      keep in sync with vendor driver.
      Signed-off-by: default avatarKai-Heng Feng <kai.heng.feng@canonical.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      94235460
    • David S. Miller's avatar
      Revert "kcm: remove any offset before parsing messages" · 3275b4df
      David S. Miller authored
      This reverts commit 072222b4.
      
      I just read that this causes regressions.
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3275b4df
    • Dominique Martinet's avatar
      kcm: remove any offset before parsing messages · 072222b4
      Dominique Martinet authored
      The current code assumes kcm users know they need to look for the
      strparser offset within their bpf program, which is not documented
      anywhere and examples laying around do not do.
      
      The actual recv function does handle the offset well, so we can create a
      temporary clone of the skb and pull that one up as required for parsing.
      
      The pull itself has a cost if we are pulling beyond the head data,
      measured to 2-3% latency in a noisy VM with a local client stressing
      that path. The clone's impact seemed too small to measure.
      
      This bug can be exhibited easily by implementing a "trivial" kcm parser
      taking the first bytes as size, and on the client sending at least two
      such packets in a single write().
      
      Note that bpf sockmap has the same problem, both for parse and for recv,
      so it would pulling twice or a real pull within the strparser logic if
      anyone cares about that.
      Signed-off-by: default avatarDominique Martinet <asmadeus@codewreck.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      072222b4
  3. 17 Sep, 2018 18 commits
    • Greg Kroah-Hartman's avatar
      Merge tag 'spi-fix-v4.19-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · 3918c21e
      Greg Kroah-Hartman authored
      Mark writes:
        "spi: Fixes for v4.19
      
        As well as one driver fix there's a couple of fixes here which address
        issues with the use of IDRs for allocation of dynamic bus numbers,
        ensuring that dynamic bus numbers interact well with static bus numbers
        assigned via DT and otherwise."
      
      * tag 'spi-fix-v4.19-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: spi-fsl-dspi: fix broken DSPI_EOQ_MODE
        spi: Fix double IDR allocation with DT aliases
        spi: fix IDR collision on systems with both fixed and dynamic SPI bus numbers
      3918c21e
    • zhong jiang's avatar
      net: ethernet: Fix a unused function warning. · c7348091
      zhong jiang authored
      Fix the following compile warning:
      
      drivers/net/ethernet/microchip/lan743x_main.c:2964:12: warning: ‘lan743x_pm_suspend’ defined but not used [-Wunused-function]
       static int lan743x_pm_suspend(struct device *dev)
      drivers/net/ethernet/microchip/lan743x_main.c:2987:12: warning: ‘lan743x_pm_resume’ defined but not used [-Wunused-function]
       static int lan743x_pm_resume(struct device *dev)
      Signed-off-by: default avatarzhong jiang <zhongjiang@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c7348091
    • Andrew Lunn's avatar
      net: dsa: mv88e6xxx: Fix ATU Miss Violation · ddca24df
      Andrew Lunn authored
      Fix a cut/paste error and a typo which results in ATU miss violations
      not being reported.
      
      Fixes: 0977644c ("net: dsa: mv88e6xxx: Decode ATU problem interrupt")
      Signed-off-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ddca24df
    • Daniel Borkmann's avatar
      tls: fix currently broken MSG_PEEK behavior · 50c6b58a
      Daniel Borkmann authored
      In kTLS MSG_PEEK behavior is currently failing, strace example:
      
        [pid  2430] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3
        [pid  2430] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 4
        [pid  2430] bind(4, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("0.0.0.0")}, 16) = 0
        [pid  2430] listen(4, 10)               = 0
        [pid  2430] getsockname(4, {sa_family=AF_INET, sin_port=htons(38855), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0
        [pid  2430] connect(3, {sa_family=AF_INET, sin_port=htons(38855), sin_addr=inet_addr("0.0.0.0")}, 16) = 0
        [pid  2430] setsockopt(3, SOL_TCP, 0x1f /* TCP_??? */, [7564404], 4) = 0
        [pid  2430] setsockopt(3, 0x11a /* SOL_?? */, 1, "\3\0033\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0
        [pid  2430] accept(4, {sa_family=AF_INET, sin_port=htons(49636), sin_addr=inet_addr("127.0.0.1")}, [16]) = 5
        [pid  2430] setsockopt(5, SOL_TCP, 0x1f /* TCP_??? */, [7564404], 4) = 0
        [pid  2430] setsockopt(5, 0x11a /* SOL_?? */, 2, "\3\0033\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0
        [pid  2430] close(4)                    = 0
        [pid  2430] sendto(3, "test_read_peek", 14, 0, NULL, 0) = 14
        [pid  2430] sendto(3, "_mult_recs\0", 11, 0, NULL, 0) = 11
        [pid  2430] recvfrom(5, "test_read_peektest_read_peektest"..., 64, MSG_PEEK, NULL, NULL) = 64
      
      As can be seen from strace, there are two TLS records sent,
      i) 'test_read_peek' and ii) '_mult_recs\0' where we end up
      peeking 'test_read_peektest_read_peektest'. This is clearly
      wrong, and what happens is that given peek cannot call into
      tls_sw_advance_skb() to unpause strparser and proceed with
      the next skb, we end up looping over the current one, copying
      the 'test_read_peek' over and over into the user provided
      buffer.
      
      Here, we can only peek into the currently held skb (current,
      full TLS record) as otherwise we would end up having to hold
      all the original skb(s) (depending on the peek depth) in a
      separate queue when unpausing strparser to process next
      records, minimally intrusive is to return only up to the
      current record's size (which likely was what c46234eb
      ("tls: RX path for ktls") originally intended as well). Thus,
      after patch we properly peek the first record:
      
        [pid  2046] wait4(2075,  <unfinished ...>
        [pid  2075] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3
        [pid  2075] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 4
        [pid  2075] bind(4, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("0.0.0.0")}, 16) = 0
        [pid  2075] listen(4, 10)               = 0
        [pid  2075] getsockname(4, {sa_family=AF_INET, sin_port=htons(55115), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0
        [pid  2075] connect(3, {sa_family=AF_INET, sin_port=htons(55115), sin_addr=inet_addr("0.0.0.0")}, 16) = 0
        [pid  2075] setsockopt(3, SOL_TCP, 0x1f /* TCP_??? */, [7564404], 4) = 0
        [pid  2075] setsockopt(3, 0x11a /* SOL_?? */, 1, "\3\0033\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0
        [pid  2075] accept(4, {sa_family=AF_INET, sin_port=htons(45732), sin_addr=inet_addr("127.0.0.1")}, [16]) = 5
        [pid  2075] setsockopt(5, SOL_TCP, 0x1f /* TCP_??? */, [7564404], 4) = 0
        [pid  2075] setsockopt(5, 0x11a /* SOL_?? */, 2, "\3\0033\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0
        [pid  2075] close(4)                    = 0
        [pid  2075] sendto(3, "test_read_peek", 14, 0, NULL, 0) = 14
        [pid  2075] sendto(3, "_mult_recs\0", 11, 0, NULL, 0) = 11
        [pid  2075] recvfrom(5, "test_read_peek", 64, MSG_PEEK, NULL, NULL) = 14
      
      Fixes: c46234eb ("tls: RX path for ktls")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      50c6b58a
    • David S. Miller's avatar
      Merge branch 'hv_netvsc-associate-VF-and-PV-device-by-serial-number' · aa079bd0
      David S. Miller authored
      Stephen Hemminger says:
      
      ====================
      hv_netvsc: associate VF and PV device by serial number
      
      The Hyper-V implementation of PCI controller has concept of 32 bit serial number
      (not to be confused with PCI-E serial number).  This value is sent in the protocol
      from the host to indicate SR-IOV VF device is attached to a synthetic NIC.
      
      Using the serial number (instead of MAC address) to associate the two devices
      avoids lots of potential problems when there are duplicate MAC addresses from
      tunnels or layered devices.
      
      The patch set is broken into two parts, one is for the PCI controller
      and the other is for the netvsc device. Normally, these go through different
      trees but sending them together here for better review. The PCI changes
      were submitted previously, but the main review comment was "why do you
      need this?". This is why.
      
      v2 - slot name can be shorter.
           remove locking when creating pci_slots; see comment for explaination
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      aa079bd0
    • Stephen Hemminger's avatar
      hv_netvsc: pair VF based on serial number · 00d7ddba
      Stephen Hemminger authored
      Matching network device based on MAC address is problematic
      since a non VF network device can be creted with a duplicate MAC
      address causing confusion and problems.  The VMBus API does provide
      a serial number that is a better matching method.
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      00d7ddba
    • Stephen Hemminger's avatar
      PCI: hv: support reporting serial number as slot information · a15f2c08
      Stephen Hemminger authored
      The Hyper-V host API for PCI provides a unique "serial number" which
      can be used as basis for sysfs PCI slot table. This can be useful
      for cases where userspace wants to find the PCI device based on
      serial number.
      
      When an SR-IOV NIC is added, the host sends an attach message
      with serial number. The kernel doesn't use the serial number, but
      it is useful when doing the same thing in a userspace driver such
      as the DPDK. By having /sys/bus/pci/slots/N it provides a direct
      way to find the matching PCI device.
      
      There maybe some cases where serial number is not unique such
      as when using GPU's. But the PCI slot infrastructure will handle
      that.
      
      This has a side effect which may also be useful. The common udev
      network device naming policy uses the slot information (rather
      than PCI address).
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a15f2c08
    • Michael Chan's avatar
      bnxt_en: Fix VF mac address regression. · 28ea334b
      Michael Chan authored
      The recent commit to always forward the VF MAC address to the PF for
      approval may not work if the PF driver or the firmware is older.  This
      will cause the VF driver to fail during probe:
      
        bnxt_en 0000:00:03.0 (unnamed net_device) (uninitialized): hwrm req_type 0xf seq id 0x5 error 0xffff
        bnxt_en 0000:00:03.0 (unnamed net_device) (uninitialized): VF MAC address 00:00:17:02:05:d0 not approved by the PF
        bnxt_en 0000:00:03.0: Unable to initialize mac address.
        bnxt_en: probe of 0000:00:03.0 failed with error -99
      
      We fix it by treating the error as fatal only if the VF MAC address is
      locally generated by the VF.
      
      Fixes: 707e7e96 ("bnxt_en: Always forward VF MAC address to the PF.")
      Reported-by: default avatarSeth Forshee <seth.forshee@canonical.com>
      Reported-by: default avatarSiwei Liu <loseweigh@gmail.com>
      Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      28ea334b
    • Eric Dumazet's avatar
      ipv6: fix possible use-after-free in ip6_xmit() · bbd6528d
      Eric Dumazet authored
      In the unlikely case ip6_xmit() has to call skb_realloc_headroom(),
      we need to call skb_set_owner_w() before consuming original skb,
      otherwise we risk a use-after-free.
      
      Bring IPv6 in line with what we do in IPv4 to fix this.
      
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bbd6528d
    • Colin Ian King's avatar
      net: hp100: fix always-true check for link up state · a7f38002
      Colin Ian King authored
      The operation ~(p100_inb(VG_LAN_CFG_1) & HP100_LINK_UP) returns a value
      that is always non-zero and hence the wait for the link to drop always
      terminates prematurely.  Fix this by using a logical not operator instead
      of a bitwise complement.  This issue has been in the driver since
      pre-2.6.12-rc2.
      
      Detected by CoverityScan, CID#114157 ("Logical vs. bitwise operator")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a7f38002
    • Nicolas Ferre's avatar
      ARM: dts: at91: add new compatibility string for macb on sama5d3 · 321cc359
      Nicolas Ferre authored
      We need this new compatibility string as we experienced different behavior
      for this 10/100Mbits/s macb interface on this particular SoC.
      Backward compatibility is preserved as we keep the alternative strings.
      Signed-off-by: default avatarNicolas Ferre <nicolas.ferre@microchip.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      321cc359
    • Nicolas Ferre's avatar
      net: macb: disable scatter-gather for macb on sama5d3 · eb4ed8e2
      Nicolas Ferre authored
      Create a new configuration for the sama5d3-macb new compatibility string.
      This configuration disables scatter-gather because we experienced lock down
      of the macb interface of this particular SoC under very high load.
      Signed-off-by: default avatarNicolas Ferre <nicolas.ferre@microchip.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      eb4ed8e2
    • Antoine Tenart's avatar
      net: mvpp2: let phylink manage the carrier state · 41948ccb
      Antoine Tenart authored
      Net drivers using phylink shouldn't mess with the link carrier
      themselves and should let phylink manage it. The mvpp2 driver wasn't
      following this best practice as the mac_config() function made calls to
      change the link carrier state. This led to wrongly reported carrier link
      state which then triggered other issues. This patch fixes this
      behaviour.
      
      But the PPv2 driver relied on this misbehaviour in two cases: for fixed
      links and when not using phylink (ACPI mode). The later was fixed by
      adding an explicit call to link_up(), which when the ACPI mode will use
      phylink should be removed.
      
      The fixed link case was relying on the mac_config() function to set the
      link up, as we found an issue in phylink_start() which assumes the
      carrier is off. If not, the link_up() function is never called. To fix
      this, a call to netif_carrier_off() is added just before phylink_start()
      so that we do not introduce a regression in the driver.
      
      Fixes: 4bb04326 ("net: mvpp2: phylink support")
      Reported-by: default avatarRussell King <linux@armlinux.org.uk>
      Signed-off-by: default avatarAntoine Tenart <antoine.tenart@bootlin.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      41948ccb
    • Guillaume Nault's avatar
      pppoe: fix reception of frames with no mac header · 8540827e
      Guillaume Nault authored
      pppoe_rcv() needs to look back at the Ethernet header in order to
      lookup the PPPoE session. Therefore we need to ensure that the mac
      header is big enough to contain an Ethernet header. Otherwise
      eth_hdr(skb)->h_source might access invalid data.
      
      ==================================================================
      BUG: KMSAN: uninit-value in __get_item drivers/net/ppp/pppoe.c:172 [inline]
      BUG: KMSAN: uninit-value in get_item drivers/net/ppp/pppoe.c:236 [inline]
      BUG: KMSAN: uninit-value in pppoe_rcv+0xcef/0x10e0 drivers/net/ppp/pppoe.c:450
      CPU: 0 PID: 4543 Comm: syz-executor355 Not tainted 4.16.0+ #87
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
      01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:17 [inline]
       dump_stack+0x185/0x1d0 lib/dump_stack.c:53
       kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
       __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
       __get_item drivers/net/ppp/pppoe.c:172 [inline]
       get_item drivers/net/ppp/pppoe.c:236 [inline]
       pppoe_rcv+0xcef/0x10e0 drivers/net/ppp/pppoe.c:450
       __netif_receive_skb_core+0x47df/0x4a90 net/core/dev.c:4562
       __netif_receive_skb net/core/dev.c:4627 [inline]
       netif_receive_skb_internal+0x49d/0x630 net/core/dev.c:4701
       netif_receive_skb+0x230/0x240 net/core/dev.c:4725
       tun_rx_batched drivers/net/tun.c:1555 [inline]
       tun_get_user+0x740f/0x7c60 drivers/net/tun.c:1962
       tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:1990
       call_write_iter include/linux/fs.h:1782 [inline]
       new_sync_write fs/read_write.c:469 [inline]
       __vfs_write+0x7fb/0x9f0 fs/read_write.c:482
       vfs_write+0x463/0x8d0 fs/read_write.c:544
       SYSC_write+0x172/0x360 fs/read_write.c:589
       SyS_write+0x55/0x80 fs/read_write.c:581
       do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
       entry_SYSCALL_64_after_hwframe+0x3d/0xa2
      RIP: 0033:0x4447c9
      RSP: 002b:00007fff64c8fc28 EFLAGS: 00000297 ORIG_RAX: 0000000000000001
      RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004447c9
      RDX: 000000000000fd87 RSI: 0000000020000600 RDI: 0000000000000004
      RBP: 00000000006cf018 R08: 00007fff64c8fda8 R09: 00007fff00006bda
      R10: 0000000000005fe7 R11: 0000000000000297 R12: 00000000004020d0
      R13: 0000000000402160 R14: 0000000000000000 R15: 0000000000000000
      
      Uninit was created at:
       kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
       kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188
       kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314
       kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321
       slab_post_alloc_hook mm/slab.h:445 [inline]
       slab_alloc_node mm/slub.c:2737 [inline]
       __kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369
       __kmalloc_reserve net/core/skbuff.c:138 [inline]
       __alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206
       alloc_skb include/linux/skbuff.h:984 [inline]
       alloc_skb_with_frags+0x1d4/0xb20 net/core/skbuff.c:5234
       sock_alloc_send_pskb+0xb56/0x1190 net/core/sock.c:2085
       tun_alloc_skb drivers/net/tun.c:1532 [inline]
       tun_get_user+0x2242/0x7c60 drivers/net/tun.c:1829
       tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:1990
       call_write_iter include/linux/fs.h:1782 [inline]
       new_sync_write fs/read_write.c:469 [inline]
       __vfs_write+0x7fb/0x9f0 fs/read_write.c:482
       vfs_write+0x463/0x8d0 fs/read_write.c:544
       SYSC_write+0x172/0x360 fs/read_write.c:589
       SyS_write+0x55/0x80 fs/read_write.c:581
       do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
       entry_SYSCALL_64_after_hwframe+0x3d/0xa2
      ==================================================================
      
      Fixes: 224cf5ad ("ppp: Move the PPP drivers")
      Reported-by: syzbot+f5f6080811c849739212@syzkaller.appspotmail.com
      Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8540827e
    • Corentin Labbe's avatar
      net: ethernet: ti: add missing GENERIC_ALLOCATOR dependency · f025571e
      Corentin Labbe authored
      This patch mades TI_DAVINCI_CPDMA select GENERIC_ALLOCATOR.
      without that, the following sparc64 build failure happen
      
      drivers/net/ethernet/ti/davinci_cpdma.o: In function `cpdma_check_free_tx_desc':
      (.text+0x278): undefined reference to `gen_pool_avail'
      drivers/net/ethernet/ti/davinci_cpdma.o: In function `cpdma_chan_submit':
      (.text+0x340): undefined reference to `gen_pool_alloc'
      (.text+0x5c4): undefined reference to `gen_pool_free'
      drivers/net/ethernet/ti/davinci_cpdma.o: In function `__cpdma_chan_free':
      davinci_cpdma.c:(.text+0x64c): undefined reference to `gen_pool_free'
      drivers/net/ethernet/ti/davinci_cpdma.o: In function `cpdma_desc_pool_destroy.isra.6':
      davinci_cpdma.c:(.text+0x17ac): undefined reference to `gen_pool_size'
      davinci_cpdma.c:(.text+0x17b8): undefined reference to `gen_pool_avail'
      davinci_cpdma.c:(.text+0x1824): undefined reference to `gen_pool_size'
      davinci_cpdma.c:(.text+0x1830): undefined reference to `gen_pool_avail'
      drivers/net/ethernet/ti/davinci_cpdma.o: In function `cpdma_ctlr_create':
      (.text+0x19f8): undefined reference to `devm_gen_pool_create'
      (.text+0x1a90): undefined reference to `gen_pool_add_virt'
      Makefile:1011: recipe for target 'vmlinux' failed
      Signed-off-by: default avatarCorentin Labbe <clabbe@baylibre.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f025571e
    • Greg Kroah-Hartman's avatar
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · ad3273d5
      Greg Kroah-Hartman authored
      Ted writes:
      	Various ext4 bug fixes; primarily making ext4 more robust against
      	maliciously crafted file systems, and some DAX fixes.
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4, dax: set ext4_dax_aops for dax files
        ext4, dax: add ext4_bmap to ext4_dax_aops
        ext4: don't mark mmp buffer head dirty
        ext4: show test_dummy_encryption mount option in /proc/mounts
        ext4: close race between direct IO and ext4_break_layouts()
        ext4: fix online resizing for bigalloc file systems with a 1k block size
        ext4: fix online resize's handling of a too-small final block group
        ext4: recalucate superblock checksum after updating free blocks/inodes
        ext4: avoid arithemetic overflow that can trigger a BUG
        ext4: avoid divide by zero fault when deleting corrupted inline directories
        ext4: check to make sure the rename(2)'s destination is not freed
        ext4: add nonstring annotations to ext4.h
      ad3273d5
    • Greg Kroah-Hartman's avatar
      Merge tag 'linux-kselftest-4.19-rc5' of... · c0747ad3
      Greg Kroah-Hartman authored
      Merge tag 'linux-kselftest-4.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
      
      Pulled kselftest fixes from Shuah:
       "This Kselftest fixes update for 4.9-rc5 consists of:
      
        -- fixes to build failures
        -- fixes to add missing config files to increase test coverage
        -- fixes to cgroup test and a new cgroup test for memory.oom.group"
      c0747ad3
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf · 0376d5dc
      David S. Miller authored
      Daniel Borkmann says:
      
      ====================
      pull-request: bpf 2018-09-16
      
      The following pull-request contains BPF updates for your *net* tree.
      
      The main changes are:
      
      1) Fix end boundary calculation in BTF for the type section, from Martin.
      
      2) Fix and revert subtraction of pointers that was accidentally allowed
         for unprivileged programs, from Alexei.
      
      3) Fix bpf_msg_pull_data() helper by using __GFP_COMP in order to avoid
         a warning in linearizing sg pages into a single one for large allocs,
         from Tushar.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0376d5dc
  4. 16 Sep, 2018 6 commits
    • Toshiaki Makita's avatar
      veth: Orphan skb before GRO · 4bf9ffa0
      Toshiaki Makita authored
      GRO expects skbs not to be owned by sockets, but when XDP is enabled veth
      passed skbs owned by sockets. It caused corrupted sk_wmem_alloc.
      
      Paolo Abeni reported the following splat:
      
      [  362.098904] refcount_t overflow at skb_set_owner_w+0x5e/0xa0 in iperf3[1644], uid/euid: 0/0
      [  362.108239] WARNING: CPU: 0 PID: 1644 at kernel/panic.c:648 refcount_error_report+0xa0/0xa4
      [  362.117547] Modules linked in: tcp_diag inet_diag veth intel_rapl sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel intel_cstate intel_uncore intel_rapl_perf ipmi_ssif iTCO_wdt sg ipmi_si iTCO_vendor_support ipmi_devintf mxm_wmi ipmi_msghandler pcspkr dcdbas mei_me wmi mei lpc_ich acpi_power_meter pcc_cpufreq xfs libcrc32c sd_mod mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ixgbe igb ttm ahci mdio libahci ptp crc32c_intel drm pps_core libata i2c_algo_bit dca dm_mirror dm_region_hash dm_log dm_mod
      [  362.176622] CPU: 0 PID: 1644 Comm: iperf3 Not tainted 4.19.0-rc2.vanilla+ #2025
      [  362.184777] Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.1.7 06/16/2016
      [  362.193124] RIP: 0010:refcount_error_report+0xa0/0xa4
      [  362.198758] Code: 08 00 00 48 8b 95 80 00 00 00 49 8d 8c 24 80 0a 00 00 41 89 c1 44 89 2c 24 48 89 de 48 c7 c7 18 4d e7 9d 31 c0 e8 30 fa ff ff <0f> 0b eb 88 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 54 49 89 fc
      [  362.219711] RSP: 0018:ffff9ee6ff603c20 EFLAGS: 00010282
      [  362.225538] RAX: 0000000000000000 RBX: ffffffff9de83e10 RCX: 0000000000000000
      [  362.233497] RDX: 0000000000000001 RSI: ffff9ee6ff6167d8 RDI: ffff9ee6ff6167d8
      [  362.241457] RBP: ffff9ee6ff603d78 R08: 0000000000000490 R09: 0000000000000004
      [  362.249416] R10: 0000000000000000 R11: ffff9ee6ff603990 R12: ffff9ee664b94500
      [  362.257377] R13: 0000000000000000 R14: 0000000000000004 R15: ffffffff9de615f9
      [  362.265337] FS:  00007f1d22d28740(0000) GS:ffff9ee6ff600000(0000) knlGS:0000000000000000
      [  362.274363] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  362.280773] CR2: 00007f1d222f35d0 CR3: 0000001fddfec003 CR4: 00000000001606f0
      [  362.288733] Call Trace:
      [  362.291459]  <IRQ>
      [  362.293702]  ex_handler_refcount+0x4e/0x80
      [  362.298269]  fixup_exception+0x35/0x40
      [  362.302451]  do_trap+0x109/0x150
      [  362.306048]  do_error_trap+0xd5/0x130
      [  362.315766]  invalid_op+0x14/0x20
      [  362.319460] RIP: 0010:skb_set_owner_w+0x5e/0xa0
      [  362.324512] Code: ef ff ff 74 49 48 c7 43 60 20 7b 4a 9d 8b 85 f4 01 00 00 85 c0 75 16 8b 83 e0 00 00 00 f0 01 85 44 01 00 00 0f 88 d8 23 16 00 <5b> 5d c3 80 8b 91 00 00 00 01 8b 85 f4 01 00 00 89 83 a4 00 00 00
      [  362.345465] RSP: 0018:ffff9ee6ff603e20 EFLAGS: 00010a86
      [  362.351291] RAX: 0000000000001100 RBX: ffff9ee65deec700 RCX: ffff9ee65e829244
      [  362.359250] RDX: 0000000000000100 RSI: ffff9ee65e829100 RDI: ffff9ee65deec700
      [  362.367210] RBP: ffff9ee65e829100 R08: 000000000002a380 R09: 0000000000000000
      [  362.375169] R10: 0000000000000002 R11: fffff1a4bf77bb00 R12: ffffc0754661d000
      [  362.383130] R13: ffff9ee65deec200 R14: ffff9ee65f597000 R15: 00000000000000aa
      [  362.391092]  veth_xdp_rcv+0x4e4/0x890 [veth]
      [  362.399357]  veth_poll+0x4d/0x17a [veth]
      [  362.403731]  net_rx_action+0x2af/0x3f0
      [  362.407912]  __do_softirq+0xdd/0x29e
      [  362.411897]  do_softirq_own_stack+0x2a/0x40
      [  362.416561]  </IRQ>
      [  362.418899]  do_softirq+0x4b/0x70
      [  362.422594]  __local_bh_enable_ip+0x50/0x60
      [  362.427258]  ip_finish_output2+0x16a/0x390
      [  362.431824]  ip_output+0x71/0xe0
      [  362.440670]  __tcp_transmit_skb+0x583/0xab0
      [  362.445333]  tcp_write_xmit+0x247/0xfb0
      [  362.449609]  __tcp_push_pending_frames+0x2d/0xd0
      [  362.454760]  tcp_sendmsg_locked+0x857/0xd30
      [  362.459424]  tcp_sendmsg+0x27/0x40
      [  362.463216]  sock_sendmsg+0x36/0x50
      [  362.467104]  sock_write_iter+0x87/0x100
      [  362.471382]  __vfs_write+0x112/0x1a0
      [  362.475369]  vfs_write+0xad/0x1a0
      [  362.479062]  ksys_write+0x52/0xc0
      [  362.482759]  do_syscall_64+0x5b/0x180
      [  362.486841]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [  362.492473] RIP: 0033:0x7f1d22293238
      [  362.496458] Code: 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 c5 54 2d 00 8b 00 85 c0 75 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 49 89 d4 55
      [  362.517409] RSP: 002b:00007ffebaef8008 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      [  362.525855] RAX: ffffffffffffffda RBX: 0000000000002800 RCX: 00007f1d22293238
      [  362.533816] RDX: 0000000000002800 RSI: 00007f1d22d36000 RDI: 0000000000000005
      [  362.541775] RBP: 00007f1d22d36000 R08: 00000002db777a30 R09: 0000562b70712b20
      [  362.549734] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
      [  362.557693] R13: 0000000000002800 R14: 00007ffebaef8060 R15: 0000562b70712260
      
      In order to avoid this, orphan the skb before entering GRO.
      
      Fixes: 948d4f21 ("veth: Add driver XDP")
      Reported-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarToshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
      Tested-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4bf9ffa0
    • David S. Miller's avatar
      Merge branch 'udp-add-missing-check-on-edumx-rx-path' · 97829888
      David S. Miller authored
      Paolo Abeni says:
      
      ====================
      udp: add missing check on edumx rx path
      
      The early demux RX path for the UDP protocol is currently missing
      some checks. Both ipv4 and ipv6 implementations lack checksum conversion
      and the ipv6 implementation additionally lack the zero checksum
      validation.
      
      The first patch takes care of UDPv4 and the second one of UDPv6
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      97829888
    • Paolo Abeni's avatar
      udp6: add missing checks on edumux packet processing · eb63f296
      Paolo Abeni authored
      Currently the UDPv6 early demux rx code path lacks some mandatory
      checks, already implemented into the normal RX code path - namely
      the checksum conversion and no_check6_rx check.
      
      Similar to the previous commit, we move the common processing to
      an UDPv6 specific helper and call it from both edemux code path
      and normal code path. In respect to the UDPv4, we need to add an
      explicit check for non zero csum according to no_check6_rx value.
      Reported-by: default avatarJianlin Shi <jishi@redhat.com>
      Suggested-by: default avatarXin Long <lucien.xin@gmail.com>
      Fixes: c9f2c1ae ("udp6: fix socket leak on early demux")
      Fixes: 2abb7cdc ("udp: Add support for doing checksum unnecessary conversion")
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      eb63f296
    • Paolo Abeni's avatar
      udp4: fix IP_CMSG_CHECKSUM for connected sockets · 2b5a9217
      Paolo Abeni authored
      commit 2abb7cdc ("udp: Add support for doing checksum
      unnecessary conversion") left out the early demux path for
      connected sockets. As a result IP_CMSG_CHECKSUM gives wrong
      values for such socket when GRO is not enabled/available.
      
      This change addresses the issue by moving the csum conversion to a
      common helper and using such helper in both the default and the
      early demux rx path.
      
      Fixes: 2abb7cdc ("udp: Add support for doing checksum unnecessary conversion")
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2b5a9217
    • Jongsung Kim's avatar
      stmmac: fix valid numbers of unicast filter entries · edf2ef72
      Jongsung Kim authored
      Synopsys DWC Ethernet MAC can be configured to have 1..32, 64, or
      128 unicast filter entries. (Table 7-8 MAC Address Registers from
      databook) Fix dwmac1000_validate_ucast_entries() to accept values
      between 1 and 32 in addition.
      Signed-off-by: default avatarJongsung Kim <neidhard.kim@lge.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      edf2ef72
    • Linus Torvalds's avatar
      Linux 4.19-rc4 · 7876320f
      Linus Torvalds authored
      7876320f