1. 12 Jun, 2023 6 commits
  2. 10 Jun, 2023 23 commits
  3. 09 Jun, 2023 8 commits
  4. 08 Jun, 2023 3 commits
    • Wei Fang's avatar
      net: enetc: correct the indexes of highest and 2nd highest TCs · 21225873
      Wei Fang authored
      For ENETC hardware, the TCs are numbered from 0 to N-1, where N
      is the number of TCs. Numerically higher TC has higher priority.
      It's obvious that the highest priority TC index should be N-1 and
      the 2nd highest priority TC index should be N-2.
      
      However, the previous logic uses netdev_get_prio_tc_map() to get
      the indexes of highest priority and 2nd highest priority TCs, it
      does not make sense and is incorrect to give a "tc" argument to
      netdev_get_prio_tc_map(). So the driver may get the wrong indexes
      of the two highest priotiry TCs which would lead to failed to set
      the CBS for the two highest priotiry TCs.
      
      e.g.
      $ tc qdisc add dev eno0 parent root handle 100: mqprio num_tc 6 \
      	map 0 0 1 1 2 3 4 5 queues 1@0 1@1 1@2 1@3 2@4 2@6 hw 1
      $ tc qdisc replace dev eno0 parent 100:6 cbs idleslope 100000 \
      	sendslope -900000 hicredit 12 locredit -113 offload 1
      $ Error: Specified device failed to setup cbs hardware offload.
        ^^^^^
      
      In this example, the previous logic deems the indexes of the two
      highest priotiry TCs should be 3 and 2. Actually, the indexes are
      5 and 4, because the number of TCs is 6. So it would be failed to
      configure the CBS for the two highest priority TCs.
      
      Fixes: c431047c ("enetc: add support Credit Based Shaper(CBS) for hardware offload")
      Signed-off-by: default avatarWei Fang <wei.fang@nxp.com>
      Reviewed-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Reviewed-by: default avatarMaciej Fijalkowski <maciej.fijalkowski@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      21225873
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE · 1240eb93
      Pablo Neira Ayuso authored
      In case of error when adding a new rule that refers to an anonymous set,
      deactivate expressions via NFT_TRANS_PREPARE state, not NFT_TRANS_RELEASE.
      Thus, the lookup expression marks anonymous sets as inactive in the next
      generation to ensure it is not reachable in this transaction anymore and
      decrement the set refcount as introduced by c1592a89 ("netfilter:
      nf_tables: deactivate anonymous set from preparation phase"). The abort
      step takes care of undoing the anonymous set.
      
      This is also consistent with rule deletion, where NFT_TRANS_PREPARE is
      used. Note that this error path is exercised in the preparation step of
      the commit protocol. This patch replaces nf_tables_rule_release() by the
      deactivate and destroy calls, this time with NFT_TRANS_PREPARE.
      
      Due to this incorrect error handling, it is possible to access a
      dangling pointer to the anonymous set that remains in the transaction
      list.
      
      [1009.379054] BUG: KASAN: use-after-free in nft_set_lookup_global+0x147/0x1a0 [nf_tables]
      [1009.379106] Read of size 8 at addr ffff88816c4c8020 by task nft-rule-add/137110
      [1009.379116] CPU: 7 PID: 137110 Comm: nft-rule-add Not tainted 6.4.0-rc4+ #256
      [1009.379128] Call Trace:
      [1009.379132]  <TASK>
      [1009.379135]  dump_stack_lvl+0x33/0x50
      [1009.379146]  ? nft_set_lookup_global+0x147/0x1a0 [nf_tables]
      [1009.379191]  print_address_description.constprop.0+0x27/0x300
      [1009.379201]  kasan_report+0x107/0x120
      [1009.379210]  ? nft_set_lookup_global+0x147/0x1a0 [nf_tables]
      [1009.379255]  nft_set_lookup_global+0x147/0x1a0 [nf_tables]
      [1009.379302]  nft_lookup_init+0xa5/0x270 [nf_tables]
      [1009.379350]  nf_tables_newrule+0x698/0xe50 [nf_tables]
      [1009.379397]  ? nf_tables_rule_release+0xe0/0xe0 [nf_tables]
      [1009.379441]  ? kasan_unpoison+0x23/0x50
      [1009.379450]  nfnetlink_rcv_batch+0x97c/0xd90 [nfnetlink]
      [1009.379470]  ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink]
      [1009.379485]  ? __alloc_skb+0xb8/0x1e0
      [1009.379493]  ? __alloc_skb+0xb8/0x1e0
      [1009.379502]  ? entry_SYSCALL_64_after_hwframe+0x46/0xb0
      [1009.379509]  ? unwind_get_return_address+0x2a/0x40
      [1009.379517]  ? write_profile+0xc0/0xc0
      [1009.379524]  ? avc_lookup+0x8f/0xc0
      [1009.379532]  ? __rcu_read_unlock+0x43/0x60
      
      Fixes: 958bee14 ("netfilter: nf_tables: use new transaction infrastructure to handle sets")
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      1240eb93
    • Kamil Maziarz's avatar
      ice: Fix XDP memory leak when NIC is brought up and down · 78c50d69
      Kamil Maziarz authored
      Fix the buffer leak that occurs while switching
      the port up and down with traffic and XDP by
      checking for an active XDP program and freeing all empty TX buffers.
      
      Fixes: efc2214b ("ice: Add support for XDP")
      Signed-off-by: default avatarKamil Maziarz <kamil.maziarz@intel.com>
      Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> (A Contingent Worker at Intel)
      Acked-by: default avatarMaciej Fijalkowski <maciej.fijalkowski@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      78c50d69