1. 21 Oct, 2022 4 commits
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2022-10-21' of git://anongit.freedesktop.org/drm/drm · e35184f3
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Usual fixes for the week.
      
        The amdgpu contains fixes for two regressions, one reported in
        response to rc1 which broke on SI GPUs, and one gfx9 APU regression.
      
        Otherwise it's mostly fixes for new IP, and some GPU reset fixes. vc4
        is just HDMI fixes, and panfrost has some mnor types fixes.
      
        Core:
         - fix connector DDC pointer
         - fix buffer overflow in format_helper_test
      
        amdgpu:
         - Mode2 reset fixes for Sienna Cichlid
         - Revert broken fan speed sensor fix
         - SMU 13.x fixes
         - GC 11.x fixes
         - RAS fixes
         - SR-IOV fixes
         - Fix BO move breakage on SI
         - Misc compiler fixes
         - Fix gfx9 APU regression caused by PCI AER fix
      
        vc4:
         - HDMI fixes
      
        panfrost:
         - compiler fixes"
      
      * tag 'drm-fixes-2022-10-21' of git://anongit.freedesktop.org/drm/drm: (35 commits)
        drm/amdgpu: fix sdma doorbell init ordering on APUs
        drm/panfrost: replace endian-specific types with native ones
        drm/panfrost: Remove type name from internal structs
        drm/connector: Set DDC pointer in drmm_connector_init
        drm: tests: Fix a buffer overflow in format_helper_test
        drm/amdgpu: use DRM_SCHED_FENCE_DONT_PIPELINE for VM updates
        drm/sched: add DRM_SCHED_FENCE_DONT_PIPELINE flag
        drm/amdgpu: Fix for BO move issue
        drm/amdgpu: dequeue mes scheduler during fini
        drm/amd/pm: enable thermal alert on smu_v13_0_10
        drm/amdgpu: Program GC registers through RLCG interface in gfx_v11/gmc_v11
        drm/amdkfd: Fix type of reset_type parameter in hqd_destroy() callback
        drm/amd/display: Increase frame size limit for display_mode_vba_util_32.o
        drm/amd/pm: add SMU IP v13.0.4 IF version define to V7
        drm/amd/pm: update SMU IP v13.0.4 driver interface version
        drm/amd/pm: Init pm_attr_list when dpm is disabled
        drm/amd/pm: disable cstate feature for gpu reset scenario
        drm/amd/pm: fulfill SMU13.0.7 cstate control interface
        drm/amd/pm: fulfill SMU13.0.0 cstate control interface
        drm/amdgpu: Add sriov vf ras support in amdgpu_ras_asic_supported
        ...
      e35184f3
    • Linus Torvalds's avatar
      Merge tag 'net-6.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 6d36c728
      Linus Torvalds authored
      Pull networking fixes from Paolo Abeni:
       "Including fixes from netfilter.
      
        Current release - regressions:
      
         - revert "net: fix cpu_max_bits_warn() usage in
           netif_attrmask_next{,_and}"
      
         - revert "net: sched: fq_codel: remove redundant resource cleanup in
           fq_codel_init()"
      
         - dsa: uninitialized variable in dsa_slave_netdevice_event()
      
         - eth: sunhme: uninitialized variable in happy_meal_init()
      
        Current release - new code bugs:
      
         - eth: octeontx2: fix resource not freed after malloc
      
        Previous releases - regressions:
      
         - sched: fix return value of qdisc ingress handling on success
      
         - sched: fix race condition in qdisc_graft()
      
         - udp: update reuse->has_conns under reuseport_lock.
      
         - tls: strp: make sure the TCP skbs do not have overlapping data
      
         - hsr: avoid possible NULL deref in skb_clone()
      
         - tipc: fix an information leak in tipc_topsrv_kern_subscr
      
         - phylink: add mac_managed_pm in phylink_config structure
      
         - eth: i40e: fix DMA mappings leak
      
         - eth: hyperv: fix a RX-path warning
      
         - eth: mtk: fix memory leaks
      
        Previous releases - always broken:
      
         - sched: cake: fix null pointer access issue when cake_init() fails"
      
      * tag 'net-6.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (43 commits)
        net: phy: dp83822: disable MDI crossover status change interrupt
        net: sched: fix race condition in qdisc_graft()
        net: hns: fix possible memory leak in hnae_ae_register()
        wwan_hwsim: fix possible memory leak in wwan_hwsim_dev_new()
        sfc: include vport_id in filter spec hash and equal()
        genetlink: fix kdoc warnings
        selftests: add selftest for chaining of tc ingress handling to egress
        net: Fix return value of qdisc ingress handling on success
        net: sched: sfb: fix null pointer access issue when sfb_init() fails
        Revert "net: sched: fq_codel: remove redundant resource cleanup in fq_codel_init()"
        net: sched: cake: fix null pointer access issue when cake_init() fails
        ethernet: marvell: octeontx2 Fix resource not freed after malloc
        netfilter: nf_tables: relax NFTA_SET_ELEM_KEY_END set flags requirements
        netfilter: rpfilter/fib: Set ->flowic_uid correctly for user namespaces.
        ionic: catch NULL pointer issue on reconfig
        net: hsr: avoid possible NULL deref in skb_clone()
        bnxt_en: fix memory leak in bnxt_nvm_test()
        ip6mr: fix UAF issue in ip6mr_sk_done() when addrconf_init_net() failed
        udp: Update reuse->has_conns under reuseport_lock.
        net: ethernet: mediatek: ppe: Remove the unused function mtk_foe_entry_usable()
        ...
      6d36c728
    • Linus Torvalds's avatar
      Merge tag 'ata-6.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata · c7b00652
      Linus Torvalds authored
      Pull ata fixes from Damien Le Moal:
       "Several minor fixes:
      
         - Fix the module alias for the ahci_imx driver to get autoloading to
           work (Alexander)
      
         - Fix a potential array-index-out-of-bounds problem with the
           enclosure managment support in the ahci driver (Kai-Heng)
      
         - Several patches to fix compilation warnings thrown by clang in the
           ahci_st, sata_rcar, ahci_brcm, ahci_xgene, ahci_imx and ahci_qoriq
           drivers (me)"
      
      * tag 'ata-6.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata:
        ata: ahci_qoriq: Fix compilation warning
        ata: ahci_imx: Fix compilation warning
        ata: ahci_xgene: Fix compilation warning
        ata: ahci_brcm: Fix compilation warning
        ata: sata_rcar: Fix compilation warning
        ata: ahci_st: Fix compilation warning
        ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
        ata: ahci-imx: Fix MODULE_ALIAS
      c7b00652
    • Linus Torvalds's avatar
      Merge tag 'for-6.1/dm-changes-v2' of... · a3ccea6e
      Linus Torvalds authored
      Merge tag 'for-6.1/dm-changes-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
      
      Pull device mapper updates from Mike Snitzer:
      
       - Fix dm-bufio to use test_bit_acquire to properly test_bit on arches
         with weaker memory ordering.
      
       - DM core replace DMWARN with DMERR or DMCRIT for fatal errors.
      
       - Enable WQ_HIGHPRI on DM verity target's verify_wq.
      
       - Add documentation for DM verity's try_verify_in_tasklet option.
      
       - Various typo and redundant word fixes in code and/or comments.
      
      * tag 'for-6.1/dm-changes-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm clone: Fix typo in block_device format specifier
        dm: remove unnecessary assignment statement in alloc_dev()
        dm verity: Add documentation for try_verify_in_tasklet option
        dm cache: delete the redundant word 'each' in comment
        dm raid: fix typo in analyse_superblocks code comment
        dm verity: enable WQ_HIGHPRI on verify_wq
        dm raid: delete the redundant word 'that' in comment
        dm: change from DMWARN to DMERR or DMCRIT for fatal errors
        dm bufio: use the acquire memory barrier when testing for B_READING
      a3ccea6e
  2. 20 Oct, 2022 15 commits
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2022-10-20' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · cbc543c5
      Dave Airlie authored
      drm-misc-fixes for v6.1-rc2:
      - Fix a buffer overflow in format_helper_test.
      - Set DDC pointer in drmm_connector_init.
      - Compiler fixes for panfrost.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/c4d05683-8ebe-93b8-d24c-d1d2c68f12c4@linux.intel.com
      cbc543c5
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-6.1-2022-10-20' of... · a4294d5c
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-6.1-2022-10-20' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
      
      amd-drm-fixes-6.1-2022-10-20:
      
      amdgpu:
      - Fix gfx9 APU regression caused by PCI AER fix
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20221020135225.562807-1-alexander.deucher@amd.com
      a4294d5c
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-6.1-2022-10-19' of... · f046ca4a
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-6.1-2022-10-19' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
      
      amd-drm-fixes-6.1-2022-10-19:
      
      amdgpu:
      - Mode2 reset fixes for Sienna Cichlid
      - Revert broken fan speed sensor fix
      - SMU 13.x fixes
      - GC 11.x fixes
      - RAS fixes
      - SR-IOV fixes
      - Fix BO move breakage on SI
      - Misc compiler fixes
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20221019191357.6208-1-alexander.deucher@amd.com
      f046ca4a
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2022-10-13' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · 8865dd75
      Dave Airlie authored
      Short summary of fixes pull:
      
       * vc4: HDMI fixes
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Thomas Zimmermann <tzimmermann@suse.de>
      Link: https://patchwork.freedesktop.org/patch/msgid/Y0gGdlujszCstDeP@linux-uq9g
      8865dd75
    • Alex Deucher's avatar
      drm/amdgpu: fix sdma doorbell init ordering on APUs · 50b0e4d4
      Alex Deucher authored
      Commit 8795e182 ("PCI/portdrv: Don't disable AER reporting in get_port_device_capability()")
      uncovered a bug in amdgpu that required a reordering of the driver
      init sequence to avoid accessing a special register on the GPU
      before it was properly set up leading to an PCI AER error.  This
      reordering uncovered a different hw programming ordering dependency
      in some APUs where the SDMA doorbells need to be programmed before
      the GFX doorbells. To fix this, move the SDMA doorbell programming
      back into the soc15 common code, but use the actual doorbell range
      values directly rather than the values stored in the ring structure
      since those will not be initialized at this point.
      
      This is a partial revert, but with the doorbell assignment
      fixed so the proper doorbell index is set before it's used.
      
      Fixes: e3163bc8 ("drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega")
      Acked-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Cc: skhan@linuxfoundation.org
      Cc: stable@vger.kernel.org
      50b0e4d4
    • Steven Price's avatar
      drm/panfrost: replace endian-specific types with native ones · 72655fb9
      Steven Price authored
      __le32 and __le64 types aren't portable and are not available on
      FreeBSD (which uses the same uAPI).
      
      Instead of attempting to always output little endian, just use native
      endianness in the dumps. Tools can detect the endianness in use by
      looking at the 'magic' field, but equally we don't expect big-endian to
      be used with Mali (there are no known implementations out there).
      
      Bug: https://gitlab.freedesktop.org/mesa/mesa/-/issues/7252
      Fixes: 730c2bf4 ("drm/panfrost: Add support for devcoredump")
      Reviewed-by: default avatarAlyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
      Signed-off-by: default avatarSteven Price <steven.price@arm.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20221017104602.142992-3-steven.price@arm.com
      72655fb9
    • Steven Price's avatar
      drm/panfrost: Remove type name from internal structs · 7228d9d7
      Steven Price authored
      The two structs internal to struct panfrost_dump_object_header were
      named, but sadly that is incompatible with C++, causing an error: "an
      anonymous union may only have public non-static data members".
      
      However nothing refers to struct pan_reg_hdr and struct pan_bomap_hdr
      and there's no need to export these definitions, so lets drop them. This
      fixes the C++ build error with the minimum change in userspace API.
      Reported-by: default avatarAdrián Larumbe <adrian.larumbe@collabora.com>
      Fixes: 730c2bf4 ("drm/panfrost: Add support for devcoredump")
      Reviewed-by: default avatarAlyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
      Signed-off-by: default avatarSteven Price <steven.price@arm.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20221017104602.142992-2-steven.price@arm.com
      7228d9d7
    • Maxime Ripard's avatar
      drm/connector: Set DDC pointer in drmm_connector_init · a91e5e3e
      Maxime Ripard authored
      Commit 35a3b82f ("drm/connector: Introduce drmm_connector_init")
      introduced the function drmm_connector_init() with a parameter for an
      optional ddc pointer to the i2c controller used to access the DDC bus.
      
      However, the underlying call to __drm_connector_init() was always
      setting it to NULL instead of passing the ddc argument around.
      
      This resulted in unexpected null pointer dereference on platforms
      expecting to get a DDC controller.
      
      Fixes: 35a3b82f ("drm/connector: Introduce drmm_connector_init")
      Reviewed-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Link: https://lore.kernel.org/r/20221019143442.1798964-1-maxime@cerno.techSigned-off-by: default avatarMaxime Ripard <maxime@cerno.tech>
      a91e5e3e
    • David Gow's avatar
      drm: tests: Fix a buffer overflow in format_helper_test · 70890033
      David Gow authored
      The xrgb2101010 format conversion test (unlike for other formats) does
      an endianness conversion on the results. However, it always converts
      TEST_BUF_SIZE 32-bit integers, which results in reading from (and
      writing to) more memory than in present in the result buffer. Instead,
      use the buffer size, divided by sizeof(u32).
      
      The issue could be reproduced with KASAN:
      ./tools/testing/kunit/kunit.py run --kunitconfig drivers/gpu/drm/tests \
      	--kconfig_add CONFIG_KASAN=y --kconfig_add CONFIG_KASAN_VMALLOC=y \
      	--kconfig_add CONFIG_KASAN_KUNIT_TEST=y \
      	drm_format_helper_test.*xrgb2101010
      Reported-by: default avatarLinux Kernel Functional Testing <lkft@linaro.org>
      Fixes: 45311431 ("drm/format-helper: Add KUnit tests for drm_fb_xrgb8888_to_xrgb2101010()")
      Signed-off-by: default avatarDavid Gow <davidgow@google.com>
      Reviewed-by: default avatarMaíra Canal <mairacanal@riseup.net>
      Reviewed-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
      Reviewed-by: default avatarJosé Expósito <jose.exposito89@gmail.com>
      Signed-off-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20221019073239.3779180-1-davidgow@google.com
      70890033
    • Thomas Zimmermann's avatar
      Merge drm/drm-fixes into drm-misc-fixes · 1aca5ce0
      Thomas Zimmermann authored
      Backmerging to get v6.1-rc1.
      Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      1aca5ce0
    • Felix Riemann's avatar
      net: phy: dp83822: disable MDI crossover status change interrupt · 7f378c03
      Felix Riemann authored
      If the cable is disconnected the PHY seems to toggle between MDI and
      MDI-X modes. With the MDI crossover status interrupt active this causes
      roughly 10 interrupts per second.
      
      As the crossover status isn't checked by the driver, the interrupt can
      be disabled to reduce the interrupt load.
      
      Fixes: 87461f7a ("net: phy: DP83822 initial driver submission")
      Signed-off-by: default avatarFelix Riemann <felix.riemann@sma.de>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Link: https://lore.kernel.org/r/20221018104755.30025-1-svc.sw.rte.linux@sma.deSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      7f378c03
    • Eric Dumazet's avatar
      net: sched: fix race condition in qdisc_graft() · ebda44da
      Eric Dumazet authored
      We had one syzbot report [1] in syzbot queue for a while.
      I was waiting for more occurrences and/or a repro but
      Dmitry Vyukov spotted the issue right away.
      
      <quoting Dmitry>
      qdisc_graft() drops reference to qdisc in notify_and_destroy
      while it's still assigned to dev->qdisc
      </quoting>
      
      Indeed, RCU rules are clear when replacing a data structure.
      The visible pointer (dev->qdisc in this case) must be updated
      to the new object _before_ RCU grace period is started
      (qdisc_put(old) in this case).
      
      [1]
      BUG: KASAN: use-after-free in __tcf_qdisc_find.part.0+0xa3a/0xac0 net/sched/cls_api.c:1066
      Read of size 4 at addr ffff88802065e038 by task syz-executor.4/21027
      
      CPU: 0 PID: 21027 Comm: syz-executor.4 Not tainted 6.0.0-rc3-syzkaller-00363-g7726d4c3 #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
      Call Trace:
      <TASK>
      __dump_stack lib/dump_stack.c:88 [inline]
      dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
      print_address_description mm/kasan/report.c:317 [inline]
      print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
      kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
      __tcf_qdisc_find.part.0+0xa3a/0xac0 net/sched/cls_api.c:1066
      __tcf_qdisc_find net/sched/cls_api.c:1051 [inline]
      tc_new_tfilter+0x34f/0x2200 net/sched/cls_api.c:2018
      rtnetlink_rcv_msg+0x955/0xca0 net/core/rtnetlink.c:6081
      netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
      netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
      netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
      netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
      sock_sendmsg_nosec net/socket.c:714 [inline]
      sock_sendmsg+0xcf/0x120 net/socket.c:734
      ____sys_sendmsg+0x6eb/0x810 net/socket.c:2482
      ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536
      __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565
      do_syscall_x64 arch/x86/entry/common.c:50 [inline]
      do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
      entry_SYSCALL_64_after_hwframe+0x63/0xcd
      RIP: 0033:0x7f5efaa89279
      Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
      RSP: 002b:00007f5efbc31168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
      RAX: ffffffffffffffda RBX: 00007f5efab9bf80 RCX: 00007f5efaa89279
      RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005
      RBP: 00007f5efaae32e9 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
      R13: 00007f5efb0cfb1f R14: 00007f5efbc31300 R15: 0000000000022000
      </TASK>
      
      Allocated by task 21027:
      kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
      kasan_set_track mm/kasan/common.c:45 [inline]
      set_alloc_info mm/kasan/common.c:437 [inline]
      ____kasan_kmalloc mm/kasan/common.c:516 [inline]
      ____kasan_kmalloc mm/kasan/common.c:475 [inline]
      __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:525
      kmalloc_node include/linux/slab.h:623 [inline]
      kzalloc_node include/linux/slab.h:744 [inline]
      qdisc_alloc+0xb0/0xc50 net/sched/sch_generic.c:938
      qdisc_create_dflt+0x71/0x4a0 net/sched/sch_generic.c:997
      attach_one_default_qdisc net/sched/sch_generic.c:1152 [inline]
      netdev_for_each_tx_queue include/linux/netdevice.h:2437 [inline]
      attach_default_qdiscs net/sched/sch_generic.c:1170 [inline]
      dev_activate+0x760/0xcd0 net/sched/sch_generic.c:1229
      __dev_open+0x393/0x4d0 net/core/dev.c:1441
      __dev_change_flags+0x583/0x750 net/core/dev.c:8556
      rtnl_configure_link+0xee/0x240 net/core/rtnetlink.c:3189
      rtnl_newlink_create net/core/rtnetlink.c:3371 [inline]
      __rtnl_newlink+0x10b8/0x17e0 net/core/rtnetlink.c:3580
      rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3593
      rtnetlink_rcv_msg+0x43a/0xca0 net/core/rtnetlink.c:6090
      netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
      netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
      netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
      netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
      sock_sendmsg_nosec net/socket.c:714 [inline]
      sock_sendmsg+0xcf/0x120 net/socket.c:734
      ____sys_sendmsg+0x6eb/0x810 net/socket.c:2482
      ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536
      __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565
      do_syscall_x64 arch/x86/entry/common.c:50 [inline]
      do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
      entry_SYSCALL_64_after_hwframe+0x63/0xcd
      
      Freed by task 21020:
      kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
      kasan_set_track+0x21/0x30 mm/kasan/common.c:45
      kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
      ____kasan_slab_free mm/kasan/common.c:367 [inline]
      ____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:329
      kasan_slab_free include/linux/kasan.h:200 [inline]
      slab_free_hook mm/slub.c:1754 [inline]
      slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1780
      slab_free mm/slub.c:3534 [inline]
      kfree+0xe2/0x580 mm/slub.c:4562
      rcu_do_batch kernel/rcu/tree.c:2245 [inline]
      rcu_core+0x7b5/0x1890 kernel/rcu/tree.c:2505
      __do_softirq+0x1d3/0x9c6 kernel/softirq.c:571
      
      Last potentially related work creation:
      kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
      __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
      call_rcu+0x99/0x790 kernel/rcu/tree.c:2793
      qdisc_put+0xcd/0xe0 net/sched/sch_generic.c:1083
      notify_and_destroy net/sched/sch_api.c:1012 [inline]
      qdisc_graft+0xeb1/0x1270 net/sched/sch_api.c:1084
      tc_modify_qdisc+0xbb7/0x1a00 net/sched/sch_api.c:1671
      rtnetlink_rcv_msg+0x43a/0xca0 net/core/rtnetlink.c:6090
      netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
      netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
      netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
      netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
      sock_sendmsg_nosec net/socket.c:714 [inline]
      sock_sendmsg+0xcf/0x120 net/socket.c:734
      ____sys_sendmsg+0x6eb/0x810 net/socket.c:2482
      ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536
      __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565
      do_syscall_x64 arch/x86/entry/common.c:50 [inline]
      do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
      entry_SYSCALL_64_after_hwframe+0x63/0xcd
      
      Second to last potentially related work creation:
      kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
      __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
      kvfree_call_rcu+0x74/0x940 kernel/rcu/tree.c:3322
      neigh_destroy+0x431/0x630 net/core/neighbour.c:912
      neigh_release include/net/neighbour.h:454 [inline]
      neigh_cleanup_and_release+0x1f8/0x330 net/core/neighbour.c:103
      neigh_del net/core/neighbour.c:225 [inline]
      neigh_remove_one+0x37d/0x460 net/core/neighbour.c:246
      neigh_forced_gc net/core/neighbour.c:276 [inline]
      neigh_alloc net/core/neighbour.c:447 [inline]
      ___neigh_create+0x18b5/0x29a0 net/core/neighbour.c:642
      ip6_finish_output2+0xfb8/0x1520 net/ipv6/ip6_output.c:125
      __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
      ip6_finish_output+0x690/0x1160 net/ipv6/ip6_output.c:206
      NF_HOOK_COND include/linux/netfilter.h:296 [inline]
      ip6_output+0x1ed/0x540 net/ipv6/ip6_output.c:227
      dst_output include/net/dst.h:451 [inline]
      NF_HOOK include/linux/netfilter.h:307 [inline]
      NF_HOOK include/linux/netfilter.h:301 [inline]
      mld_sendpack+0xa09/0xe70 net/ipv6/mcast.c:1820
      mld_send_cr net/ipv6/mcast.c:2121 [inline]
      mld_ifc_work+0x71c/0xdc0 net/ipv6/mcast.c:2653
      process_one_work+0x991/0x1610 kernel/workqueue.c:2289
      worker_thread+0x665/0x1080 kernel/workqueue.c:2436
      kthread+0x2e4/0x3a0 kernel/kthread.c:376
      ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
      
      The buggy address belongs to the object at ffff88802065e000
      which belongs to the cache kmalloc-1k of size 1024
      The buggy address is located 56 bytes inside of
      1024-byte region [ffff88802065e000, ffff88802065e400)
      
      The buggy address belongs to the physical page:
      page:ffffea0000819600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20658
      head:ffffea0000819600 order:3 compound_mapcount:0 compound_pincount:0
      flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
      raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888011841dc0
      raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
      page dumped because: kasan: bad access detected
      page_owner tracks the page as allocated
      page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3523, tgid 3523 (sshd), ts 41495190986, free_ts 41417713212
      prep_new_page mm/page_alloc.c:2532 [inline]
      get_page_from_freelist+0x109b/0x2ce0 mm/page_alloc.c:4283
      __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5515
      alloc_pages+0x1a6/0x270 mm/mempolicy.c:2270
      alloc_slab_page mm/slub.c:1824 [inline]
      allocate_slab+0x27e/0x3d0 mm/slub.c:1969
      new_slab mm/slub.c:2029 [inline]
      ___slab_alloc+0x7f1/0xe10 mm/slub.c:3031
      __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3118
      slab_alloc_node mm/slub.c:3209 [inline]
      __kmalloc_node_track_caller+0x2f2/0x380 mm/slub.c:4955
      kmalloc_reserve net/core/skbuff.c:358 [inline]
      __alloc_skb+0xd9/0x2f0 net/core/skbuff.c:430
      alloc_skb_fclone include/linux/skbuff.h:1307 [inline]
      tcp_stream_alloc_skb+0x38/0x580 net/ipv4/tcp.c:861
      tcp_sendmsg_locked+0xc36/0x2f80 net/ipv4/tcp.c:1325
      tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1483
      inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819
      sock_sendmsg_nosec net/socket.c:714 [inline]
      sock_sendmsg+0xcf/0x120 net/socket.c:734
      sock_write_iter+0x291/0x3d0 net/socket.c:1108
      call_write_iter include/linux/fs.h:2187 [inline]
      new_sync_write fs/read_write.c:491 [inline]
      vfs_write+0x9e9/0xdd0 fs/read_write.c:578
      ksys_write+0x1e8/0x250 fs/read_write.c:631
      page last free stack trace:
      reset_page_owner include/linux/page_owner.h:24 [inline]
      free_pages_prepare mm/page_alloc.c:1449 [inline]
      free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1499
      free_unref_page_prepare mm/page_alloc.c:3380 [inline]
      free_unref_page+0x19/0x4d0 mm/page_alloc.c:3476
      __unfreeze_partials+0x17c/0x1a0 mm/slub.c:2548
      qlink_free mm/kasan/quarantine.c:168 [inline]
      qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
      kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294
      __kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:447
      kasan_slab_alloc include/linux/kasan.h:224 [inline]
      slab_post_alloc_hook mm/slab.h:727 [inline]
      slab_alloc_node mm/slub.c:3243 [inline]
      slab_alloc mm/slub.c:3251 [inline]
      __kmem_cache_alloc_lru mm/slub.c:3258 [inline]
      kmem_cache_alloc+0x267/0x3b0 mm/slub.c:3268
      kmem_cache_zalloc include/linux/slab.h:723 [inline]
      alloc_buffer_head+0x20/0x140 fs/buffer.c:2974
      alloc_page_buffers+0x280/0x790 fs/buffer.c:829
      create_empty_buffers+0x2c/0xee0 fs/buffer.c:1558
      ext4_block_write_begin+0x1004/0x1530 fs/ext4/inode.c:1074
      ext4_da_write_begin+0x422/0xae0 fs/ext4/inode.c:2996
      generic_perform_write+0x246/0x560 mm/filemap.c:3738
      ext4_buffered_write_iter+0x15b/0x460 fs/ext4/file.c:270
      ext4_file_write_iter+0x44a/0x1660 fs/ext4/file.c:679
      call_write_iter include/linux/fs.h:2187 [inline]
      new_sync_write fs/read_write.c:491 [inline]
      vfs_write+0x9e9/0xdd0 fs/read_write.c:578
      
      Fixes: af356afa ("net_sched: reintroduce dev->qdisc for use by sch_api")
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Diagnosed-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Link: https://lore.kernel.org/r/20221018203258.2793282-1-edumazet@google.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      ebda44da
    • Yang Yingliang's avatar
      net: hns: fix possible memory leak in hnae_ae_register() · ff2f5ec5
      Yang Yingliang authored
      Inject fault while probing module, if device_register() fails,
      but the refcount of kobject is not decreased to 0, the name
      allocated in dev_set_name() is leaked. Fix this by calling
      put_device(), so that name can be freed in callback function
      kobject_cleanup().
      
      unreferenced object 0xffff00c01aba2100 (size 128):
        comm "systemd-udevd", pid 1259, jiffies 4294903284 (age 294.152s)
        hex dump (first 32 bytes):
          68 6e 61 65 30 00 00 00 18 21 ba 1a c0 00 ff ff  hnae0....!......
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        backtrace:
          [<0000000034783f26>] slab_post_alloc_hook+0xa0/0x3e0
          [<00000000748188f2>] __kmem_cache_alloc_node+0x164/0x2b0
          [<00000000ab0743e8>] __kmalloc_node_track_caller+0x6c/0x390
          [<000000006c0ffb13>] kvasprintf+0x8c/0x118
          [<00000000fa27bfe1>] kvasprintf_const+0x60/0xc8
          [<0000000083e10ed7>] kobject_set_name_vargs+0x3c/0xc0
          [<000000000b87affc>] dev_set_name+0x7c/0xa0
          [<000000003fd8fe26>] hnae_ae_register+0xcc/0x190 [hnae]
          [<00000000fe97edc9>] hns_dsaf_ae_init+0x9c/0x108 [hns_dsaf]
          [<00000000c36ff1eb>] hns_dsaf_probe+0x548/0x748 [hns_dsaf]
      
      Fixes: 6fe6611f ("net: add Hisilicon Network Subsystem hnae framework support")
      Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
      Reviewed-by: default avatarLeon Romanovsky <leonro@nvidia.com>
      Link: https://lore.kernel.org/r/20221018122451.1749171-1-yangyingliang@huawei.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      ff2f5ec5
    • Yang Yingliang's avatar
      wwan_hwsim: fix possible memory leak in wwan_hwsim_dev_new() · 258ad2fe
      Yang Yingliang authored
      Inject fault while probing module, if device_register() fails,
      but the refcount of kobject is not decreased to 0, the name
      allocated in dev_set_name() is leaked. Fix this by calling
      put_device(), so that name can be freed in callback function
      kobject_cleanup().
      
      unreferenced object 0xffff88810152ad20 (size 8):
        comm "modprobe", pid 252, jiffies 4294849206 (age 22.713s)
        hex dump (first 8 bytes):
          68 77 73 69 6d 30 00 ff                          hwsim0..
        backtrace:
          [<000000009c3504ed>] __kmalloc_node_track_caller+0x44/0x1b0
          [<00000000c0228a5e>] kvasprintf+0xb5/0x140
          [<00000000cff8c21f>] kvasprintf_const+0x55/0x180
          [<0000000055a1e073>] kobject_set_name_vargs+0x56/0x150
          [<000000000a80b139>] dev_set_name+0xab/0xe0
      
      Fixes: f36a111a ("wwan_hwsim: WWAN device simulator")
      Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
      Reviewed-by: default avatarLoic Poulain <loic.poulain@linaro.org>
      Acked-by: default avatarSergey Ryazanov <ryazanov.s.a@gmail.com>
      Link: https://lore.kernel.org/r/20221018131607.1901641-1-yangyingliang@huawei.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      258ad2fe
    • Pieter Jansen van Vuuren's avatar
      sfc: include vport_id in filter spec hash and equal() · c2bf23e4
      Pieter Jansen van Vuuren authored
      Filters on different vports are qualified by different implicit MACs and/or
      VLANs, so shouldn't be considered equal even if their other match fields
      are identical.
      
      Fixes: 7c460d9b ("sfc: Extend and abstract efx_filter_spec to cover Huntington/EF10")
      Co-developed-by: default avatarEdward Cree <ecree.xilinx@gmail.com>
      Signed-off-by: default avatarEdward Cree <ecree.xilinx@gmail.com>
      Signed-off-by: default avatarPieter Jansen van Vuuren <pieter.jansen-van-vuuren@amd.com>
      Reviewed-by: default avatarMartin Habets <habetsm.xilinx@gmail.com>
      Link: https://lore.kernel.org/r/20221018092841.32206-1-pieter.jansen-van-vuuren@amd.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      c2bf23e4
  3. 19 Oct, 2022 21 commits