- 24 Jun, 2020 5 commits
-
-
David S. Miller authored
Michael Chan says: ==================== bnxt_en: Bug fixes. The first patch stores the firmware version code which is needed by the next 2 patches to determine some worarounds based on the firmware version. The workarounds are to disable legacy TX push mode and to clear the hardware statistics during ifdown. The last patch checks that it is a PF before reading the VPD. Please also queue these for -stable. Thanks. ==================== Reviewed-by:
Jakub Kicinski <kuba@kernel.org> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Vasundhara Volam authored
Virtual functions does not have VPD information. This patch modifies calling bnxt_read_vpd_info() only for PFs and avoids an unnecessary error log. Fixes: a0d0fd70 ("bnxt_en: Read partno and serialno of the board from VPD") Signed-off-by:
Vasundhara Volam <vasundhara-v.volam@broadcom.com> Signed-off-by:
Michael Chan <michael.chan@broadcom.com> Signed-off-by:
-
Michael Chan authored
On older firmware, the hardware statistics are not cleared when the driver frees the hardware stats contexts during ifdown. The driver expects these stats to be cleared and saves a copy before freeing the stats contexts. During the next ifup, the driver will likely allocate the same hardware stats contexts and this will cause a big increase in the counters as the old counters are added back to the saved counters. We fix it by making an additional firmware call to clear the counters before freeing the hw stats contexts when the firmware is the older 20.x firmware. Fixes: b8875ca3 ("bnxt_en: Save ring statistics before reset.") Reported-by:
Jakub Kicinski <kicinski@fb.com> Reviewed-by:
-
Michael Chan authored
Older firmware may not support legacy TX push properly and may not be disabling it. So we check certain firmware versions that may have this problem and disable legacy TX push unconditionally. Fixes: c0c050c5 ("bnxt_en: New Broadcom ethernet driver.") Reviewed-by:
Edwin Peer <edwin.peer@broadcom.com> Signed-off-by:
-
Michael Chan authored
We currently only store the firmware version as a string for ethtool and devlink info. Store it also as a version code. The next 2 patches will need to check the firmware major version to determine some workarounds. We also use the 16-bit firmware version fields if the firmware is newer and provides the 16-bit fields. Reviewed-by:
-
- 23 Jun, 2020 34 commits
-
-
David S. Miller authored
Rahul Lakkireddy says: ==================== cxgb4/cxgb4vf: fix warnings reported by sparse This series of patches fix various warnings reported by the sparse tool. Patches 1 and 2 fix lock context imbalance warnings. Patch 3 fixes cast to restricted __be64 warning when fetching timestamp in PTP path. Patch 4 fixes several cast to restricted __be32 warnings in TC-U32 offload parser. Patch 5 fixes several cast from restricted __be16 warnings in parsing L4 ports for filters. Patch 6 fixes several restricted __be32 degrades to integer warnings when comparing IP address masks for exact-match filters. Patch 7 fixes cast to restricted __be64 warning when fetching SGE queue contexts in device dump collection. Patch 8 fixes cast from restricted __sum16 warning when saving IPv4 partial checksum. Patch 9 fixes issue with string array scope in DCB path. Patch 10 fixes a set but unused variable warning when DCB is disabled. Patch 11 fixes several kernel-doc comment warnings in cxgb4 driver. Patch 12 fixes several kernel-doc comment warnings in cxgb4vf driver. ==================== Signed-off-by: -
Rahul Lakkireddy authored
Update several kernel-doc line comments to fix warnings reported by make W=1. Fixes following class of warnings reported by make W=1 in several places: cxgb4vf_main.c:275: warning: Function parameter or member 'persistent' not described in 'cxgb4vf_change_mac' cxgb4vf_main.c:275: warning: Excess function parameter 'persist' description in 'cxgb4vf_change_mac' Fixes: 16f8bd4b ("cxgb4vf: Add core T4 PCI-E SR-IOV Virtual Function hardware definitions and device communication code") Fixes: c6e0d914 ("cxgb4vf: Add T4 Virtual Function Scatter-Gather Engine DMA code") Fixes: e0a8b34a ("cxgb4vf: Add and initialize some sge params for VF driver") Fixes: c3168cab ("cxgb4/cxgbvf: Handle 32-bit fw port capabilities") Fixes: 0e23daeb ("drivers/net: chelsio/cxgb*: Convert timers to use timer_setup()") Fixes: 3f8cfd0d ("cxgb4/cxgb4vf: Program hash region for {t4/t4vf}_change_mac()") Signed-off-by:
Rahul Lakkireddy <rahul.lakkireddy@chelsio.com> Signed-off-by:
-
Rahul Lakkireddy authored
Update several kernel-doc line comments to fix warnings reported by make W=1. Fixes following class of warnings reported by make W=1 in several places: l2t.c:616: warning: Cannot understand * @dev: net_device pointer t4_hw.c:3175: warning: Function parameter or member 'adap' not described in 't4_get_exprom_version' t4_hw.c:3175: warning: Excess function parameter 'adapter' description in 't4_get_exprom_version' Fixes: 56d36be4 ("cxgb4: Add HW and FW support code") Fixes: fd3a4790 ("cxgb4: Add packet queues and packet DMA code") Fixes: 26f7cbc0 ("cxgb4: Don't attempt to upgrade T4 firmware when cxgb4 will end up as a slave") Fixes: 793dad94 ("RDMA/cxgb4: Fix bug for active and passive LE hash collision path") Fixes: ba3f8cd5 ("cxgb4: Add support in cxgb4 to get expansion rom version via ethtool") Fixes: f7502659 ("cxgb4: Add API to alloc l2t entry; also update existing ones") Fixes: ddc7740d ("cxgb4: Decode link down reason code obtained from firmware") Fixes: 193c4c28 ("cxgb4: Update T6 Buffer Group and Channel Mappings") Fixes: 8f46d467 ("cxgb4: Use Firmware params to get buffer-group map") Fixes: a4569504 ("cxgb4: time stamping interface for PTP") Fixes: 9c33e420 ("cxgb4: Add PTP Hardware Clock (PHC) support") Fixes: c3168cab ("cxgb4/cxgbvf: Handle 32-bit fw port capabilities") Fixes: 5ccf9d04 ("cxgb4: update API for TP indirect register access") Fixes: 3bdb376e ("cxgb4: introduce SMT ops to prepare for SMAC rewrite support") Fixes: 736c3b94 ("cxgb4: collect egress and ingress SGE queue contexts") Fixes: f56ec676 ("cxgb4: Add support for ethtool i2c dump") Fixes: 9d5fd927 ("cxgb4/cxgb4vf: add support for ndo_set_vf_vlan") Fixes: 98f3697f ("cxgb4: add tc flower match support for tunnel VNI") Fixes: 02d805dc ("cxgb4: use new fw interface to get the VIN and smt index") Fixes: 3f8cfd0d ("cxgb4/cxgb4vf: Program hash region for {t4/t4vf}_change_mac()") Fixes: d429005f ("cxgb4/cxgb4vf: Add support for SGE doorbell queue timer") Fixes: 0e395b3c ("cxgb4: add FLOWC based QoS offload") Signed-off-by:
-
Rahul Lakkireddy authored
Remove the set but unused variable when DCB is disabled. Instead, do the calculation directly inline. Fixes following warning in make W=1: cxgb4_main.c: In function 'cfg_queues': cxgb4_main.c:5380:29: warning: variable 'n1g' set but not used [-Wunused-but-set-variable] u32 i, n10g = 0, qidx = 0, n1g = 0; ^ Fixes: 116ca924 ("cxgb4: fix checks for max queues to allocate") Signed-off-by: -
Rahul Lakkireddy authored
Move the DCB version string array extern to header file. Fixes following sparse warning: cxgb4_dcb.c:13:12: warning: symbol 'dcb_ver_array' was not declared. Should it be static? Fixes: ebddd97a ("cxgb4: add support to display DCB info") Signed-off-by:
-
Rahul Lakkireddy authored
The checksum field in IPv4 header is in __sum16 and ip_fast_csum() also returns __sum16. So, no need to cast it to u16. Fixes following sparse warning: sge.c:1539:47: warning: cast from restricted __sum16 sge.c:1539:44: warning: incorrect type in assignment (different base types) sge.c:1539:44: expected restricted __sum16 [usertype] check sge.c:1539:44: got unsigned short [usertype] Fixes: d0a1299c ("cxgb4: add support for vxlan segmentation offload") Signed-off-by:
-
Rahul Lakkireddy authored
The data in destination buffer is expected to be be parsed in big endian. So, use the right context. Fixes following sparse warning: cudbg_lib.c:2041:44: warning: incorrect type in assignment (different base types) cudbg_lib.c:2041:44: expected unsigned long long [usertype] cudbg_lib.c:2041:44: got restricted __be64 [usertype] Fixes: 736c3b94 ("cxgb4: collect egress and ingress SGE queue contexts") Signed-off-by:
-
Rahul Lakkireddy authored
Use correct type to check for all-mask exact match IP addresses. Fixes following sparse warnings due to big endian value checks against 0xffffffff in is_addr_all_mask(): cxgb4_filter.c:977:25: warning: restricted __be32 degrades to integer cxgb4_filter.c:983:37: warning: restricted __be32 degrades to integer cxgb4_filter.c:984:37: warning: restricted __be32 degrades to integer cxgb4_filter.c:985:37: warning: restricted __be32 degrades to integer cxgb4_filter.c:986:37: warning: restricted __be32 degrades to integer Fixes: 3eb8b62d ("cxgb4: add support to create hash-filters via tc-flower offload") Signed-off-by:
-
Rahul Lakkireddy authored
The source and destination L4 ports in filter offload need to be in CPU endian. They will finally be converted to Big Endian after all operations are done and before giving them to hardware. The L4 ports for NAT are expected to be passed as a byte stream TCB. So, treat them as such. Fixes following sparse warnings in several places: cxgb4_tc_flower.c:159:33: warning: cast from restricted __be16 cxgb4_tc_flower.c:159:33: warning: incorrect type in argument 1 (different base types) cxgb4_tc_flower.c:159:33: expected unsigned short [usertype] val cxgb4_tc_flower.c:159:33: got restricted __be16 [usertype] dst Fixes: dca4faeb ("cxgb4: Add LE hash collision bug fix path in LLD driver") Fixes: 62488e4b ("cxgb4: add basic tc flower offload support") Fixes: 557ccbf9 ("cxgb4: add tc flower support for L3/L4 rewrite") Signed-off-by:
-
Rahul Lakkireddy authored
TC-U32 passes all keys values and masks in __be32 format. The parser already expects this and hence pass the value and masks in __be32 natively to the parser. Fixes following sparse warnings in several places: cxgb4_tc_u32.c:57:21: warning: incorrect type in assignment (different base types) cxgb4_tc_u32.c:57:21: expected unsigned int [usertype] val cxgb4_tc_u32.c:57:21: got restricted __be32 [usertype] val cxgb4_tc_u32_parse.h:48:24: warning: cast to restricted __be32 Fixes: 2e8aad7b ("cxgb4: add parser to translate u32 filters to internal spec") Signed-off-by:
-
Rahul Lakkireddy authored
Use get_unaligned_be64() to fetch the timestamp needed for ns_to_ktime() conversion. Fixes following sparse warning: sge.c:3282:43: warning: cast to restricted __be64 Fixes: a4569504 ("cxgb4: time stamping interface for PTP") Signed-off-by:
-
Rahul Lakkireddy authored
Check for whether PTP is enabled or not at the caller and perform locking/unlocking at the caller. Fixes following sparse warning: sge.c:1641:26: warning: context imbalance in 'cxgb4_eth_xmit' - different lock contexts for basic block Fixes: a4569504 ("cxgb4: time stamping interface for PTP") Signed-off-by:
-
Rahul Lakkireddy authored
Move code handling L2T ARP failures to the only caller. Fixes following sparse warning: skbuff.h:2091:29: warning: context imbalance in 'handle_failed_resolution' - unexpected unlock Fixes: 749cb5fe ("cxgb4: Replace arpq_head/arpq_tail with SKB double link-list code") Signed-off-by:
-
David S. Miller authored
Alexander Lobakin says: ==================== net: qed/qede: various stability fixes This set addresses several near-critical issues that were observed and reproduced on different test and production configurations. v2: - don't split the "Fixes:" tag across several lines in patch 9; - no functional changes. ==================== Signed-off-by: -
Alexander Lobakin authored
Variable 'abs_ppfid' in qed_dev.c:qed_llh_add_mac_filter() always gets printed, but is initialized only under 'ref_cnt == 1' condition. This results in: In file included from ./include/linux/kernel.h:15:0, from ./include/asm-generic/bug.h:19, from ./arch/x86/include/asm/bug.h:86, from ./include/linux/bug.h:5, from ./include/linux/io.h:11, from drivers/net/ethernet/qlogic/qed/qed_dev.c:35: drivers/net/ethernet/qlogic/qed/qed_dev.c: In function 'qed_llh_add_mac_filter': ./include/linux/printk.h:358:2: warning: 'abs_ppfid' may be used uninitialized in this function [-Wmaybe-uninitialized] printk(KERN_NOTICE pr_fmt(fmt), ##__VA_ARGS__) ^~~~~~ drivers/net/ethernet/qlogic/qed/qed_dev.c:983:17: note: 'abs_ppfid' was declared here u8 filter_idx, abs_ppfid; ^~~~~~~~~ ...under W=1+. Fix this by initializing it with zero. Fixes: 79284ade ("qed: Add llh ppfid interface and 100g support for offload protocols") Signed-off-by:Alexander Lobakin <alobakin@marvell.com> Signed-off-by:
Igor Russkikh <irusskikh@marvell.com> Signed-off-by:
Michal Kalderon <michal.kalderon@marvell.com> Signed-off-by:
-
Alexander Lobakin authored
Sizes of all ILT blocks must be reset before ILT recomputing when disabling clients, or memory allocation may exceed ILT shadow array and provoke system crashes. Fixes: 1408cc1f ("qed: Introduce VFs") Signed-off-by:
-
Alexander Lobakin authored
Set edev->cdev pointer to NULL after calling remove() callback to avoid using of already freed object. Fixes: ccc67ef5 ("qede: Error recovery process") Signed-off-by:
-
Alexander Lobakin authored
Currently PTP cyclecounter and timecounter are initialized only on the first probing and are cleaned up during removal. This means that PTP becomes non-functional after device recovery. Fix this by unconditional PTP initialization on probing and clearing Tx pending bit on exiting. Fixes: ccc67ef5 ("qede: Error recovery process") Signed-off-by:
-
Alexander Lobakin authored
This is likely a copy'n'paste mistake. The amount of ILT lines to reserve for a single VF was being multiplied by the total VFs count. This led to a huge redundancy in reservation and potential lines drainouts. Fixes: 1408cc1f ("qed: Introduce VFs") Signed-off-by:
-
Alexander Lobakin authored
25ms sleep cycles in waiting for PF response are excessive and may lead to different timeout failures. Start to wait with short udelays, and in most cases polling will end here. If the time was not sufficient, switch to msleeps. usleep_range() may go far beyond 100us depending on platform and tick configuration, hence atomic udelays for consistency. Also add explicit DMA barriers since 'done' always comes from a shared request-response DMA pool, and note that in the comment nearby. Fixes: 1408cc1f ("qed: Introduce VFs") Signed-off-by:
-
Alexander Lobakin authored
Set rdma_wq pointer to NULL after destroying the workqueue and check for it when adding new events to fix crashes on driver unload. Fixes: cee9fbd8 ("qede: Add qedr framework") Signed-off-by:
-
Alexander Lobakin authored
qed_spq_unregister_async_cb() should be called before qed_rdma_info_free() to avoid crash-spawning uses-after-free. Instead of calling it from each subsystem exit code, do it in one place on PF down. Fixes: 291d57f6 ("qed: Fix rdma_info structure allocation") Signed-off-by:
-
Alexander Lobakin authored
qed_chain_get_element_left{,_u32} returned 0 when the difference between producer and consumer page count was equal to the total page count. Fix this by conditional expanding of producer value (vs unconditional). This allowed to eliminate normalizaton against total page count, which was the cause of this bug. Misc: replace open-coded constants with common defines. Fixes: a91eb52a ("qed: Revisit chain implementation") Signed-off-by: -
Alexander Lobakin authored
Commit e585f236 ("udp: Changes to udp_offload to support remote checksum offload") added new GSO type and a corresponding netdev feature, but missed Ethtool's 'netdev_features_strings' table. Give it a name so it will be exposed to userspace and become available for manual configuration. v3: - decouple from "netdev_features_strings[] cleanup" series; - no functional changes. v2: - don't split the "Fixes:" tag across lines; - no functional changes. Fixes: e585f236 ("udp: Changes to udp_offload to support remote checksum offload") Signed-off-by:
Alexander Lobakin <alobakin@pm.me> Signed-off-by:
-
David S. Miller authored
Jason A. Donenfeld says: ==================== wireguard fixes for 5.8-rc3 This series contains two fixes, one cosmetic and one quite important: 1) Avoid the `if ((x = f()) == y)` pattern, from Frank Werner-Krippendorf. 2) Mitigate a potential memory leak by creating circular netns references, while also making the netns semantics a bit more robust. Patch (2) has a "Fixes:" line and should be backported to stable. ==================== Signed-off-by: -
Jason A. Donenfeld authored
Before, we took a reference to the creating netns if the new netns was different. This caused issues with circular references, with two wireguard interfaces swapping namespaces. The solution is to rather not take any extra references at all, but instead simply invalidate the creating netns pointer when that netns is deleted. In order to prevent this from happening again, this commit improves the rough object leak tracking by allowing it to account for created and destroyed interfaces, aside from just peers and keys. That then makes it possible to check for the object leak when having two interfaces take a reference to each others' namespaces. Fixes: e7096c13 ("net: WireGuard secure network tunnel") Signed-off-by:
Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by:
-
Frank Werner-Krippendorf authored
Fixes an error condition reported by checkpatch.pl which caused by assigning a variable in an if condition in wg_noise_handshake_consume_ initiation(). Signed-off-by:
Frank Werner-Krippendorf <mail@hb9fxq.ch> Signed-off-by:
-
David S. Miller authored
Horatiu Vultur says: ==================== bridge: mrp: Update MRP_PORT_ROLE This patch series does the following: - fixes the enum br_mrp_port_role_type. It removes the port role none(0x2) because this is in conflict with the standard. The standard defines the interconnect port role as value 0x2. - adds checks regarding current defined port roles: primary(0x0) and secondary(0x1). v2: - add the validation code when setting the port role. ==================== Signed-off-by: -
Horatiu Vultur authored
This patch adds specific checks for primary(0x0) and secondary(0x1) when setting the port role. For any other value the function 'br_mrp_set_port_role' will return -EINVAL. Fixes: 20f6a05e ("bridge: mrp: Rework the MRP netlink interface") Signed-off-by:
Horatiu Vultur <horatiu.vultur@microchip.com> Signed-off-by:
-
Horatiu Vultur authored
Currently the MRP_PORT_ROLE_NONE has the value 0x2 but this is in conflict with the IEC 62439-2 standard. The standard defines the following port roles: primary (0x0), secondary(0x1), interconnect(0x2). Therefore remove the port role none. Fixes: 4714d137 ("bridge: uapi: mrp: Add mrp attributes.") Signed-off-by:
-
Aiden Leong authored
Fix a typo in gue.h Signed-off-by:
Aiden Leong <aiden.leong@aibsd.com> Signed-off-by:
-
Geliang Tang authored
In RFC 8684, we don't need to send sndr_key in SYN package anymore, so drop it. Fixes: cc7972ea ("mptcp: parse and emit MP_CAPABLE option according to v1 spec") Signed-off-by:
Geliang Tang <geliangtang@gmail.com> Reviewed-by:
Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by:
-
Gaurav Singh authored
Fix check in ethtool_rx_flow_rule_create Fixes: eca4205f ("ethtool: add ethtool_rx_flow_spec to flow_rule structure translator") Signed-off-by:
Gaurav Singh <gaurav1086@gmail.com> Signed-off-by:
-
Taehee Yoo authored
When an interface is being deleted, "/proc/net/dev_snmp6/<interface name>" is deleted. The function for this is addrconf_ifdown() in the addrconf_notify() and it is called by notification, which is NETDEV_UNREGISTER. But, if NETDEV_CHANGEMTU is triggered after NETDEV_UNREGISTER, this proc file will be created again. This recreated proc file will be deleted by netdev_wati_allrefs(). Before netdev_wait_allrefs() is called, creating a new HSR interface routine can be executed and It tries to create a proc file but it will find an un-deleted proc file. At this point, it warns about it. To avoid this situation, it can use ->dellink() instead of ->ndo_uninit() to release resources because ->dellink() is called before NETDEV_UNREGISTER. So, a proc file will not be recreated. Test commands ip link add dummy0 type dummy ip link add dummy1 type dummy ip link set dummy0 mtu 1300 #SHELL1 while : do ip link add hsr0 type hsr slave1 dummy0 slave2 dummy1 done #SHELL2 while : do ip link del hsr0 done Splat looks like: [ 9888.980852][ T2752] proc_dir_entry 'dev_snmp6/hsr0' already registered [ 9888.981797][ C2] WARNING: CPU: 2 PID: 2752 at fs/proc/generic.c:372 proc_register+0x2d5/0x430 [ 9888.981798][ C2] Modules linked in: hsr dummy veth openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6x [ 9888.981814][ C2] CPU: 2 PID: 2752 Comm: ip Tainted: G W 5.8.0-rc1+ #616 [ 9888.981815][ C2] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 9888.981816][ C2] RIP: 0010:proc_register+0x2d5/0x430 [ 9888.981818][ C2] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 65 01 00 00 49 8b b5 e0 00 00 00 48 89 ea 40 [ 9888.981819][ C2] RSP: 0018:ffff8880628dedf0 EFLAGS: 00010286 [ 9888.981821][ C2] RAX: dffffc0000000008 RBX: ffff888028c69170 RCX: ffffffffaae09a62 [ 9888.981822][ C2] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88806c9f75ac [ 9888.981823][ C2] RBP: ffff888028c693f4 R08: ffffed100d9401bd R09: ffffed100d9401bd [ 9888.981824][ C2] R10: ffffffffaddf406f R11: 0000000000000001 R12: ffff888028c69308 [ 9888.981825][ C2] R13: ffff8880663584c8 R14: dffffc0000000000 R15: ffffed100518d27e [ 9888.981827][ C2] FS: 00007f3876b3b0c0(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000 [ 9888.981828][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9888.981829][ C2] CR2: 00007f387601a8c0 CR3: 000000004101a002 CR4: 00000000000606e0 [ 9888.981830][ C2] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 9888.981831][ C2] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 9888.981832][ C2] Call Trace: [ 9888.981833][ C2] ? snmp6_seq_show+0x180/0x180 [ 9888.981834][ C2] proc_create_single_data+0x7c/0xa0 [ 9888.981835][ C2] snmp6_register_dev+0xb0/0x130 [ 9888.981836][ C2] ipv6_add_dev+0x4b7/0xf60 [ 9888.981837][ C2] addrconf_notify+0x684/0x1ca0 [ 9888.981838][ C2] ? __mutex_unlock_slowpath+0xd0/0x670 [ 9888.981839][ C2] ? kasan_unpoison_shadow+0x30/0x40 [ 9888.981840][ C2] ? wait_for_completion+0x250/0x250 [ 9888.981841][ C2] ? inet6_ifinfo_notify+0x100/0x100 [ 9888.981842][ C2] ? dropmon_net_event+0x227/0x410 [ 9888.981843][ C2] ? notifier_call_chain+0x90/0x160 [ 9888.981844][ C2] ? inet6_ifinfo_notify+0x100/0x100 [ 9888.981845][ C2] notifier_call_chain+0x90/0x160 [ 9888.981846][ C2] register_netdevice+0xbe5/0x1070 [ ... ] Reported-by: syzbot+1d51c8b74efa4c44adeb@syzkaller.appspotmail.com Fixes: e0a4b997 ("hsr: use upper/lower device infrastructure") Signed-off-by:Taehee Yoo <ap420073@gmail.com> Signed-off-by:
-
- 22 Jun, 2020 1 commit
-
-
Tuomas Tynkkynen authored
Syzbot reports an use-after-free in workqueue context: BUG: KASAN: use-after-free in mutex_unlock+0x19/0x40 kernel/locking/mutex.c:737 mutex_unlock+0x19/0x40 kernel/locking/mutex.c:737 __smsc95xx_mdio_read drivers/net/usb/smsc95xx.c:217 [inline] smsc95xx_mdio_read+0x583/0x870 drivers/net/usb/smsc95xx.c:278 check_carrier+0xd1/0x2e0 drivers/net/usb/smsc95xx.c:644 process_one_work+0x777/0xf90 kernel/workqueue.c:2274 worker_thread+0xa8f/0x1430 kernel/workqueue.c:2420 kthread+0x2df/0x300 kernel/kthread.c:255 It looks like that smsc95xx_unbind() is freeing the structures that are still in use by the concurrently running workqueue callback. Thus switch to using cancel_delayed_work_sync() to ensure the work callback really is no longer active. Reported-by: syzbot+29dc7d4ae19b703ff947@syzkaller.appspotmail.com Signed-off-by:
Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi> Signed-off-by:
-
