summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-07-08tools: bpftool: add completion for bpftool prog "loadall"Quentin Monnet
Bash completion for proposing the "loadall" subcommand is missing. Let's add it to the completion script. Add a specific case to propose "load" and "loadall" for completing: $ bpftool prog load ^ cursor is here Otherwise, completion considers that $command is in load|loadall and starts making related completions (file or directory names, as the number of words on the command line is below 6), when the only suggested keywords should be "load" and "loadall" until one has been picked and a space entered after that to move to the next word. Signed-off-by: Quentin Monnet <quentin.monnet@netronome.com> Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08bpf: avoid unused variable warning in tcp_bpf_rtt()Arnd Bergmann
When CONFIG_BPF is disabled, we get a warning for an unused variable: In file included from drivers/target/target_core_device.c:26: include/net/tcp.h:2226:19: error: unused variable 'tp' [-Werror,-Wunused-variable] struct tcp_sock *tp = tcp_sk(sk); The variable is only used in one place, so it can be replaced with its value there to avoid the warning. Fixes: 23729ff23186 ("bpf: add BPF_CGROUP_SOCK_OPS callback that is executed on every RTT") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Soheil Hassas Yeganeh <soheil@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08bpf: cgroup: Fix build error without CONFIG_NETYueHaibing
If CONFIG_NET is not set and CONFIG_CGROUP_BPF=y, gcc building fails: kernel/bpf/cgroup.o: In function `cg_sockopt_func_proto': cgroup.c:(.text+0x237e): undefined reference to `bpf_sk_storage_get_proto' cgroup.c:(.text+0x2394): undefined reference to `bpf_sk_storage_delete_proto' kernel/bpf/cgroup.o: In function `__cgroup_bpf_run_filter_getsockopt': (.text+0x2a1f): undefined reference to `lock_sock_nested' (.text+0x2ca2): undefined reference to `release_sock' kernel/bpf/cgroup.o: In function `__cgroup_bpf_run_filter_setsockopt': (.text+0x3006): undefined reference to `lock_sock_nested' (.text+0x32bb): undefined reference to `release_sock' Reported-by: Hulk Robot <hulkci@huawei.com> Suggested-by: Stanislav Fomichev <sdf@fomichev.me> Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks") Signed-off-by: YueHaibing <yuehaibing@huawei.com> Acked-by: Yonghong Song <yhs@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08selftests/bpf: fix test_attach_probe map definitionAndrii Nakryiko
ef99b02b23ef ("libbpf: capture value in BTF type info for BTF-defined map defs") changed BTF-defined maps syntax, while independently merged 1e8611bbdfc9 ("selftests/bpf: add kprobe/uprobe selftests") added new test using outdated syntax of maps. This patch fixes this test after corresponding patch sets were merged. Fixes: ef99b02b23ef ("libbpf: capture value in BTF type info for BTF-defined map defs") Fixes: 1e8611bbdfc9 ("selftests/bpf: add kprobe/uprobe selftests") Signed-off-by: Andrii Nakryiko <andriin@fb.com> Acked-by: Yonghong Song <yhs@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08Merge branch 'bpf-sockaddr-wide-store'Daniel Borkmann
Stanislav Fomichev says: ==================== Clang can generate 8-byte stores for user_ip6 & msg_src_ip6, let's support that on the verifier side. v3: * fix comments spelling an -> and (Andrii Nakryiko) v2: * Add simple cover letter (Yonghong Song) * Update comments (Yonghong Song) * Remove [4] selftests (Yonghong Song) ==================== Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08selftests/bpf: add verifier tests for wide storesStanislav Fomichev
Make sure that wide stores are allowed at proper (aligned) addresses. Note that user_ip6 is naturally aligned on 8-byte boundary, so correct addresses are user_ip6[0] and user_ip6[2]. msg_src_ip6 is, however, aligned on a 4-byte bondary, so only msg_src_ip6[1] can be wide-stored. Cc: Andrii Nakryiko <andriin@fb.com> Cc: Yonghong Song <yhs@fb.com> Acked-by: Andrii Nakryiko <andriin@fb.com> Signed-off-by: Stanislav Fomichev <sdf@google.com> Acked-by: Yonghong Song <yhs@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08bpf: sync bpf.h to tools/Stanislav Fomichev
Sync user_ip6 & msg_src_ip6 comments. Signed-off-by: Stanislav Fomichev <sdf@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08bpf: allow wide (u64) aligned stores for some fields of bpf_sock_addrStanislav Fomichev
Since commit cd17d7770578 ("bpf/tools: sync bpf.h") clang decided that it can do a single u64 store into user_ip6[2] instead of two separate u32 ones: # 17: (18) r2 = 0x100000000000000 # ; ctx->user_ip6[2] = bpf_htonl(DST_REWRITE_IP6_2); # 19: (7b) *(u64 *)(r1 +16) = r2 # invalid bpf_context access off=16 size=8 >From the compiler point of view it does look like a correct thing to do, so let's support it on the kernel side. Credit to Andrii Nakryiko for a proper implementation of bpf_ctx_wide_store_ok. Cc: Andrii Nakryiko <andriin@fb.com> Cc: Yonghong Song <yhs@fb.com> Fixes: cd17d7770578 ("bpf/tools: sync bpf.h") Reported-by: kernel test robot <rong.a.chen@intel.com> Acked-by: Yonghong Song <yhs@fb.com> Acked-by: Andrii Nakryiko <andriin@fb.com> Signed-off-by: Stanislav Fomichev <sdf@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08Merge branch 'bpf-libbpf-perf-rb-api'Daniel Borkmann
Andrii Nakryiko says: ==================== This patchset adds a high-level API for setting up and polling perf buffers associated with BPF_MAP_TYPE_PERF_EVENT_ARRAY map. Details of APIs are described in corresponding commit. Patch #1 adds a set of APIs to set up and work with perf buffer. Patch #2 enhances libbpf to support auto-setting PERF_EVENT_ARRAY map size. Patch #3 adds test. Patch #4 converts bpftool map event_pipe to new API. Patch #5 updates README to mention perf_buffer_ prefix. v6->v7: - __x64_ syscall prefix (Yonghong); v5->v6: - fix C99 for loop variable initialization usage (Yonghong); v4->v5: - initialize perf_buffer_raw_opts in bpftool map event_pipe (Jakub); - add perf_buffer_ to README; v3->v4: - fixed bpftool event_pipe cmd error handling (Jakub); v2->v3: - added perf_buffer__new_raw for more low-level control; - converted bpftool map event_pipe to new API (Daniel); - fixed bug with error handling in create_maps (Song); v1->v2: - add auto-sizing of PERF_EVENT_ARRAY maps; ==================== Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08libbpf: add perf_buffer_ prefix to READMEAndrii Nakryiko
perf_buffer "object" is part of libbpf API now, add it to the list of libbpf function prefixes. Suggested-by: Daniel Borkman <daniel@iogearbox.net> Signed-off-by: Andrii Nakryiko <andriin@fb.com> Acked-by: Yonghong Song <yhs@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08tools/bpftool: switch map event_pipe to libbpf's perf_bufferAndrii Nakryiko
Switch event_pipe implementation to rely on new libbpf perf buffer API (it's raw low-level variant). Signed-off-by: Andrii Nakryiko <andriin@fb.com> Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com> Acked-by: Yonghong Song <yhs@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08selftests/bpf: test perf buffer APIAndrii Nakryiko
Add test verifying perf buffer API functionality. Signed-off-by: Andrii Nakryiko <andriin@fb.com> Acked-by: Song Liu <songliubraving@fb.com> Acked-by: Yonghong Song <yhs@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08libbpf: auto-set PERF_EVENT_ARRAY size to number of CPUsAndrii Nakryiko
For BPF_MAP_TYPE_PERF_EVENT_ARRAY typically correct size is number of possible CPUs. This is impossible to specify at compilation time. This change adds automatic setting of PERF_EVENT_ARRAY size to number of system CPUs, unless non-zero size is specified explicitly. This allows to adjust size for advanced specific cases, while providing convenient and logical defaults. Signed-off-by: Andrii Nakryiko <andriin@fb.com> Acked-by: Song Liu <songliubraving@fb.com> Acked-by: Yonghong Song <yhs@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08libbpf: add perf buffer APIAndrii Nakryiko
BPF_MAP_TYPE_PERF_EVENT_ARRAY map is often used to send data from BPF program to user space for additional processing. libbpf already has very low-level API to read single CPU perf buffer, bpf_perf_event_read_simple(), but it's hard to use and requires a lot of code to set everything up. This patch adds perf_buffer abstraction on top of it, abstracting setting up and polling per-CPU logic into simple and convenient API, similar to what BCC provides. perf_buffer__new() sets up per-CPU ring buffers and updates corresponding BPF map entries. It accepts two user-provided callbacks: one for handling raw samples and one for get notifications of lost samples due to buffer overflow. perf_buffer__new_raw() is similar, but provides more control over how perf events are set up (by accepting user-provided perf_event_attr), how they are handled (perf_event_header pointer is passed directly to user-provided callback), and on which CPUs ring buffers are created (it's possible to provide a list of CPUs and corresponding map keys to update). This API allows advanced users fuller control. perf_buffer__poll() is used to fetch ring buffer data across all CPUs, utilizing epoll instance. perf_buffer__free() does corresponding clean up and unsets FDs from BPF map. All APIs are not thread-safe. User should ensure proper locking/coordination if used in multi-threaded set up. Signed-off-by: Andrii Nakryiko <andriin@fb.com> Acked-by: Yonghong Song <yhs@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-07-08ALSA: firewire-lib: code refactoring for local variablesTakashi Sakamoto
It's better to use int type for loop index. For consistency, the name of local variable for the number of data block should be plural. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-08ALSA: firewire-lib: code refactoring for post operation to data block counterTakashi Sakamoto
As a result of former commits, post operation to data block count for cases without CIP_DBC_IS_END_EVENT can be done just with data_block_counter member of amdtp_stream structure. This commit adds code refactoring to obsolete local variable for data block counter. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-08ALSA: firewire-lib: code refactoring for error path of parser for CIP headerTakashi Sakamoto
When a parser for CIP header returns -EAGAIN, no extra care is needed to probe tracepoints event. This commit adds code refactoring for the error path. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-08ALSA: firewire-lib: fix different data block counter between probed event ↵Takashi Sakamoto
and transferred isochronous packet For IT context, tracepoints event is probed after calculating next data block counter. This brings difference of data block counter between the probed event and actual isochronous packet. This commit fixes it. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-08ALSA: firewire-lib: fix initial value of data block count for IR context ↵Takashi Sakamoto
without CIP_DBC_IS_END_EVENT For IR context, ALSA IEC 61883-1/6 engine uses initial value of data block counter as UINT_MAX, to detect first isochronous packet in the middle of packet streaming. At present, when CIP_DBC_IS_END_EVENT is not used (i.e. for drivers except for ALSA fireworks driver), the initial value is used as is for tracepoints event. However, the engine can detect the value of dbc field in the payload of first isochronous packet and the value should be assigned to the event. This commit fixes the bug. Fixes: 76864868dbab ("ALSA: firewire-lib: cache next data_block_counter after probing tracepoints event for IR context") Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-08ALSA: firewire-lib/fireface: fix initial value of data block counter for IR ↵Takashi Sakamoto
context with CIP_NO_HEADER For IR context, ALSA IEC 61883-1/6 engine uses initial value of data block counter as UINT_MAX, to detect first isochronous packet in the middle of packet streaming. At present, when CIP_NO_HEADER is used (i.e. for ALSA fireface driver), the initial value is used for tracepoints event. 0x00 should be for the event when the initial value is UINT_MAX because isochronous packets with CIP_NO_HEADER option has no field for data block count. This commit fixes the bug. Fixes: 76864868dbab ("ALSA: firewire-lib: cache next data_block_counter after probing tracepoints event for IR context") Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-08ALSA: firewire-lib: fix invalid length of rx packet payload for tracepoint ↵Takashi Sakamoto
events Although CIP header is handled as context header, the length of isochronous packet includes two quadlets for its payload. In tracepoints event the value of payload_quadlets should includes the two quadlets. But at present it doesn't. This commit fixes the bug. Fixes: b18f0cfaf16b ("ALSA: firewire-lib: use 8 byte packet header for IT context to separate CIP header from CIP payload") Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-08Merge tag 'asoc-v5.3' of ↵Takashi Iwai
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v5.3 This is a very big update, mainly thanks to Morimoto-san's refactoring work and some fairly large new drivers. - Lots more work on moving towards a component based framework from Morimoto-san. - Support for force disconnecting muxes from Jerome Brunet. - New drivers for Cirrus Logic CS47L35, CS47L85 and CS47L90, Conexant CX2072X, Realtek RT1011 and RT1308. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-08Merge branches 'fixes' and 'misc'Russell King
Fix up the conflict between "VDSO: Drop implicit common-page-size linker flag" and "vdso: pass --be8 to linker if necessary" Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
2019-07-08Merge branches 'acpi-apei', 'acpi-doc' and 'acpi-soc'Rafael J. Wysocki
* acpi-apei: ACPI / APEI: Remove needless __ghes_check_estatus() calls * acpi-doc: docs: extcon: convert it to ReST and move to ACPI dir * acpi-soc: ACPI: APD: remove redundant assignment to pointer clk
2019-07-08Merge branch 'acpica'Rafael J. Wysocki
* acpica: ACPICA: Update version to 20190703 ACPICA: Update table load object initialization ACPICA: Update for object initialization sequence ACPICA: remove legacy module-level code due to deprecation ACPICA: Namespace: simplify creation of the initial/default namespace ACPICA: Clear status of GPEs on first direct enable
2019-07-08Merge branches 'acpi-tables', 'acpi-osl', 'acpi-misc' and 'acpi-tools'Rafael J. Wysocki
* acpi-tables: ACPI: configfs: Resolve objects on host-directed table loads ACPI: tables: Allow BGRT to be overridden * acpi-osl: ACPI: OSL: Make a W=1 kernel-doc warning go away * acpi-misc: ACPI: Make AC and battery drivers available on !X86 * acpi-tools: ACPI: tools: Exclude tools/* from .gitignore patterns
2019-07-08Merge branch 'pm-cpufreq'Rafael J. Wysocki
* pm-cpufreq: cpufreq: Avoid calling cpufreq_verify_current_freq() from handle_update() cpufreq: Consolidate cpufreq_update_current_freq() and __cpufreq_get() cpufreq: Don't skip frequency validation for has_target() drivers cpufreq: Use has_target() instead of !setpolicy cpufreq: Remove redundant !setpolicy check cpufreq: Move the IS_ENABLED(CPU_THERMAL) macro into a stub cpufreq: s5pv210: Don't flood kernel log after cpufreq change cpufreq: pcc-cpufreq: Fail initialization if driver cannot be registered cpufreq: add driver for Raspberry Pi cpufreq: Switch imx7d to imx-cpufreq-dt for speed grading cpufreq: imx-cpufreq-dt: Remove global platform match list cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency cpufreq: brcmstb-avs-cpufreq: Fix initial command check cpufreq: armada-37xx: Remove set but not used variable 'freq' cpufreq: imx-cpufreq-dt: Fix no OPPs available on unfused parts dt-bindings: imx-cpufreq-dt: Document opp-supported-hw usage cpufreq: Add imx-cpufreq-dt driver
2019-07-08Merge branches 'pm-opp', 'pm-misc', 'pm-avs' and 'pm-tools'Rafael J. Wysocki
* pm-opp: opp: Don't use IS_ERR on invalid supplies opp: Make dev_pm_opp_set_rate() handle freq = 0 to drop performance votes opp: Don't overwrite rounded clk rate opp: Allocate genpd_virt_devs from dev_pm_opp_attach_genpd() opp: Attach genpds to devices from within OPP core * pm-misc: PM / clk: Remove error message on out-of-memory condition drivers: base: power: clock_ops: Use of_clk_get_parent_count() * pm-avs: power: avs: smartreflex: no need to check return value of debugfs_create functions * pm-tools: cpupower : frequency-set -r option misses the last cpu in related cpu list cpupower: correct spelling of interval Add README and update pm-graph and sleepgraph docs Update to pm-graph 5.4 Update to pm-graph 5.3
2019-07-08Merge branch 'pm-sleep'Rafael J. Wysocki
* pm-sleep: PM: sleep: Drop dev_pm_skip_next_resume_phases() ACPI: PM: Drop unused function and function header ACPI: PM: Introduce "poweroff" callbacks for ACPI PM domain and LPSS ACPI: PM: Simplify and fix PM domain hibernation callbacks PCI: PM: Simplify bus-level hibernation callbacks PM: ACPI/PCI: Resume all devices during hibernation kernel: power: swap: use kzalloc() instead of kmalloc() followed by memset() PM: sleep: Update struct wakeup_source documentation drivers: base: power: remove wakeup_sources_stats_dentry variable PM: suspend: Rename pm_suspend_via_s2idle() PM: sleep: Show how long dpm_suspend_start() and dpm_suspend_end() take PM: hibernate: powerpc: Expose pfn_is_nosave() prototype
2019-07-08Merge branches 'acpi-pm' and 'pm-pci'Rafael J. Wysocki
* acpi-pm: ACPI: PM: Make acpi_sleep_state_supported() non-static ACPI: PM: Allow transitions to D0 to occur in special cases ACPI: PM: Avoid evaluating _PS3 on transitions from D3hot to D3cold ACPI / sleep: Switch to use acpi_dev_get_first_match_dev() ACPI / LPIT: Correct LPIT end address for lpit_process() * pm-pci: ACPI: PM: Unexport acpi_device_get_power() PCI: PM/ACPI: Refresh all stale power state data in pci_pm_complete() PCI / ACPI: Add _PR0 dependent devices ACPI / PM: Introduce concept of a _PR0 dependent device PCI / ACPI: Use cached ACPI device state to get PCI device power state PCI: Do not poll for PME if the device is in D3cold PCI: Add missing link delays required by the PCIe spec PCI: PM: Replace pci_dev_keep_suspended() with two functions PCI: PM: Avoid resuming devices in D3hot during system suspend
2019-07-07net: bpfilter: print umh messages to /dev/kmsgGary Lin
bpfilter_umh currently printed all messages to /dev/console and this might interfere the user activity(*). This commit changes the output device to /dev/kmsg so that the messages from bpfilter_umh won't show on the console directly. (*) https://bugzilla.suse.com/show_bug.cgi?id=1140221 Signed-off-by: Gary Lin <glin@suse.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07hinic: add fw version queryXue Chaojing
This patch adds firmware version query in ethtool -i. Signed-off-by: Xue Chaojing <xuechaojing@huawei.com> Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07gve: Fix error return code in gve_alloc_qpls()Wei Yongjun
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: f5cedc84a30d ("gve: Add transmit and receive support") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07net: nixge: Fix misuse of strlcpyJoe Perches
Probable cut&paste typo - use the correct field size. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07net: ethernet: sun4i-emac: Fix misuse of strlcpyJoe Perches
Probable cut&paste typo - use the correct field size. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07Merge branch 'gtp-fix-several-bugs'David S. Miller
Taehee Yoo says: ==================== gtp: fix several bugs This patch series fixes several bugs in the gtp module. First patch fixes suspicious RCU usage. The problem is to use rcu_dereference_sk_user_data() outside of RCU read critical section. Second patch fixes use-after-free. gtp_encap_destroy() is called twice. gtp_encap_destroy() use both gtp->sk0 and gtp->sk1u. these pointers can be freed in gtp_encap_destroy(). So, gtp_encap_destroy() should avoid using freed sk pointer. Third patch removes duplicate code in gtp_dellink(). gtp_dellink() calls gtp_encap_disable() twice. So, remove one of them. Fourth patch fixes usage of GFP_KERNEL. GFP_KERNEL can not be used in RCU read critical section. This patch make ipv4_pdp_add() to use GFP_ATOMIC instead of GFP_KERNEL. Fifth patch fixes use-after-free in gtp_newlink(). gtp_newlink() uses gtp_net which would be destroyed by the __exit_net routine. So, gtp_newlink should not be called after the __exit_net routine. Sixth patch adds missing error handling routine in gtp_encap_enable(). gtp_encap_enable() will fail, if invalid role value is sent from user-space. if so, gtp_encap_enable() should execute error handling routine. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable()Taehee Yoo
If an invalid role is sent from user space, gtp_encap_enable() will fail. Then, it should call gtp_encap_disable_sock() but current code doesn't. It makes memory leak. Fixes: 91ed81f9abc7 ("gtp: support SGSN-side tunnels") Signed-off-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07gtp: fix use-after-free in gtp_newlink()Taehee Yoo
Current gtp_newlink() could be called after unregister_pernet_subsys(). gtp_newlink() uses gtp_net but it can be destroyed by unregister_pernet_subsys(). So unregister_pernet_subsys() should be called after rtnl_link_unregister(). Test commands: #SHELL 1 while : do for i in {1..5} do ./gtp-link add gtp$i & done killall gtp-link done #SHELL 2 while : do modprobe -rv gtp done Splat looks like: [ 753.176631] BUG: KASAN: use-after-free in gtp_newlink+0x9b4/0xa5c [gtp] [ 753.177722] Read of size 8 at addr ffff8880d48f2458 by task gtp-link/7126 [ 753.179082] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G W 5.2.0-rc6+ #50 [ 753.185801] Call Trace: [ 753.186264] dump_stack+0x7c/0xbb [ 753.186863] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.187583] print_address_description+0xc7/0x240 [ 753.188382] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.189097] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.189846] __kasan_report+0x12a/0x16f [ 753.190542] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.191298] kasan_report+0xe/0x20 [ 753.191893] gtp_newlink+0x9b4/0xa5c [gtp] [ 753.192580] ? __netlink_ns_capable+0xc3/0xf0 [ 753.193370] __rtnl_newlink+0xb9f/0x11b0 [ ... ] [ 753.241201] Allocated by task 7186: [ 753.241844] save_stack+0x19/0x80 [ 753.242399] __kasan_kmalloc.constprop.3+0xa0/0xd0 [ 753.243192] __kmalloc+0x13e/0x300 [ 753.243764] ops_init+0xd6/0x350 [ 753.244314] register_pernet_operations+0x249/0x6f0 [ ... ] [ 753.251770] Freed by task 7178: [ 753.252288] save_stack+0x19/0x80 [ 753.252833] __kasan_slab_free+0x111/0x150 [ 753.253962] kfree+0xc7/0x280 [ 753.254509] ops_free_list.part.11+0x1c4/0x2d0 [ 753.255241] unregister_pernet_operations+0x262/0x390 [ ... ] [ 753.285883] list_add corruption. next->prev should be prev (ffff8880d48f2458), but was ffff8880d497d878. (next. [ 753.287241] ------------[ cut here ]------------ [ 753.287794] kernel BUG at lib/list_debug.c:25! [ 753.288364] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 753.289099] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G B W 5.2.0-rc6+ #50 [ 753.291036] RIP: 0010:__list_add_valid+0x74/0xd0 [ 753.291589] Code: 48 39 da 75 27 48 39 f5 74 36 48 39 dd 74 31 48 83 c4 08 b8 01 00 00 00 5b 5d c3 48 89 d9 48b [ 753.293779] RSP: 0018:ffff8880cae8f398 EFLAGS: 00010286 [ 753.294401] RAX: 0000000000000075 RBX: ffff8880d497d878 RCX: 0000000000000000 [ 753.296260] RDX: 0000000000000075 RSI: 0000000000000008 RDI: ffffed10195d1e69 [ 753.297070] RBP: ffff8880cd250ae0 R08: ffffed101b4bff21 R09: ffffed101b4bff21 [ 753.297899] R10: 0000000000000001 R11: ffffed101b4bff20 R12: ffff8880d497d878 [ 753.298703] R13: 0000000000000000 R14: ffff8880cd250ae0 R15: ffff8880d48f2458 [ 753.299564] FS: 00007f5f79805740(0000) GS:ffff8880da400000(0000) knlGS:0000000000000000 [ 753.300533] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 753.301231] CR2: 00007fe8c7ef4f10 CR3: 00000000b71a6006 CR4: 00000000000606f0 [ 753.302183] Call Trace: [ 753.302530] gtp_newlink+0x5f6/0xa5c [gtp] [ 753.303037] ? __netlink_ns_capable+0xc3/0xf0 [ 753.303576] __rtnl_newlink+0xb9f/0x11b0 [ 753.304092] ? rtnl_link_unregister+0x230/0x230 Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07gtp: fix Illegal context switch in RCU read-side critical section.Taehee Yoo
ipv4_pdp_add() is called in RCU read-side critical section. So GFP_KERNEL should not be used in the function. This patch make ipv4_pdp_add() to use GFP_ATOMIC instead of GFP_KERNEL. Test commands: gtp-link add gtp1 & gtp-tunnel add gtp1 v1 100 200 1.1.1.1 2.2.2.2 Splat looks like: [ 130.618881] ============================= [ 130.626382] WARNING: suspicious RCU usage [ 130.626994] 5.2.0-rc6+ #50 Not tainted [ 130.627622] ----------------------------- [ 130.628223] ./include/linux/rcupdate.h:266 Illegal context switch in RCU read-side critical section! [ 130.629684] [ 130.629684] other info that might help us debug this: [ 130.629684] [ 130.631022] [ 130.631022] rcu_scheduler_active = 2, debug_locks = 1 [ 130.632136] 4 locks held by gtp-tunnel/1025: [ 130.632925] #0: 000000002b93c8b7 (cb_lock){++++}, at: genl_rcv+0x15/0x40 [ 130.634159] #1: 00000000f17bc999 (genl_mutex){+.+.}, at: genl_rcv_msg+0xfb/0x130 [ 130.635487] #2: 00000000c644ed8e (rtnl_mutex){+.+.}, at: gtp_genl_new_pdp+0x18c/0x1150 [gtp] [ 130.636936] #3: 0000000007a1cde7 (rcu_read_lock){....}, at: gtp_genl_new_pdp+0x187/0x1150 [gtp] [ 130.638348] [ 130.638348] stack backtrace: [ 130.639062] CPU: 1 PID: 1025 Comm: gtp-tunnel Not tainted 5.2.0-rc6+ #50 [ 130.641318] Call Trace: [ 130.641707] dump_stack+0x7c/0xbb [ 130.642252] ___might_sleep+0x2c0/0x3b0 [ 130.642862] kmem_cache_alloc_trace+0x1cd/0x2b0 [ 130.643591] gtp_genl_new_pdp+0x6c5/0x1150 [gtp] [ 130.644371] genl_family_rcv_msg+0x63a/0x1030 [ 130.645074] ? mutex_lock_io_nested+0x1090/0x1090 [ 130.645845] ? genl_unregister_family+0x630/0x630 [ 130.646592] ? debug_show_all_locks+0x2d0/0x2d0 [ 130.647293] ? check_flags.part.40+0x440/0x440 [ 130.648099] genl_rcv_msg+0xa3/0x130 [ ... ] Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07gtp: remove duplicate code in gtp_dellink()Taehee Yoo
gtp_encap_disable() in gtp_dellink() is unnecessary because it will be called by unregister_netdevice(). unregister_netdevice() internally calls gtp_dev_uninit() by ->ndo_uninit(). And gtp_dev_uninit() calls gtp_encap_disable(). Signed-off-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07gtp: fix use-after-free in gtp_encap_destroy()Taehee Yoo
gtp_encap_destroy() is called twice. 1. When interface is deleted. 2. When udp socket is destroyed. either gtp->sk0 or gtp->sk1u could be freed by sock_put() in gtp_encap_destroy(). so, when gtp_encap_destroy() is called again, it would uses freed sk pointer. patch makes gtp_encap_destroy() to set either gtp->sk0 or gtp->sk1u to null. in addition, both gtp->sk0 and gtp->sk1u pointer are protected by rtnl_lock. so, rtnl_lock() is added. Test command: gtp-link add gtp1 & killall gtp-link ip link del gtp1 Splat looks like: [ 83.182767] BUG: KASAN: use-after-free in __lock_acquire+0x3a20/0x46a0 [ 83.184128] Read of size 8 at addr ffff8880cc7d5360 by task ip/1008 [ 83.185567] CPU: 1 PID: 1008 Comm: ip Not tainted 5.2.0-rc6+ #50 [ 83.188469] Call Trace: [ ... ] [ 83.200126] lock_acquire+0x141/0x380 [ 83.200575] ? lock_sock_nested+0x3a/0xf0 [ 83.201069] _raw_spin_lock_bh+0x38/0x70 [ 83.201551] ? lock_sock_nested+0x3a/0xf0 [ 83.202044] lock_sock_nested+0x3a/0xf0 [ 83.202520] gtp_encap_destroy+0x18/0xe0 [gtp] [ 83.203065] gtp_encap_disable.isra.14+0x13/0x50 [gtp] [ 83.203687] gtp_dellink+0x56/0x170 [gtp] [ 83.204190] rtnl_delete_link+0xb4/0x100 [ ... ] [ 83.236513] Allocated by task 976: [ 83.236925] save_stack+0x19/0x80 [ 83.237332] __kasan_kmalloc.constprop.3+0xa0/0xd0 [ 83.237894] kmem_cache_alloc+0xd8/0x280 [ 83.238360] sk_prot_alloc.isra.42+0x50/0x200 [ 83.238874] sk_alloc+0x32/0x940 [ 83.239264] inet_create+0x283/0xc20 [ 83.239684] __sock_create+0x2dd/0x540 [ 83.240136] __sys_socket+0xca/0x1a0 [ 83.240550] __x64_sys_socket+0x6f/0xb0 [ 83.240998] do_syscall_64+0x9c/0x450 [ 83.241466] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 83.242061] [ 83.242249] Freed by task 0: [ 83.242616] save_stack+0x19/0x80 [ 83.243013] __kasan_slab_free+0x111/0x150 [ 83.243498] kmem_cache_free+0x89/0x250 [ 83.244444] __sk_destruct+0x38f/0x5a0 [ 83.245366] rcu_core+0x7e9/0x1c20 [ 83.245766] __do_softirq+0x213/0x8fa Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07gtp: fix suspicious RCU usageTaehee Yoo
gtp_encap_enable_socket() and gtp_encap_destroy() are not protected by rcu_read_lock(). and it's not safe to write sk->sk_user_data. This patch make these functions to use lock_sock() instead of rcu_dereference_sk_user_data(). Test commands: gtp-link add gtp1 Splat looks like: [ 83.238315] ============================= [ 83.239127] WARNING: suspicious RCU usage [ 83.239702] 5.2.0-rc6+ #49 Not tainted [ 83.240268] ----------------------------- [ 83.241205] drivers/net/gtp.c:799 suspicious rcu_dereference_check() usage! [ 83.243828] [ 83.243828] other info that might help us debug this: [ 83.243828] [ 83.246325] [ 83.246325] rcu_scheduler_active = 2, debug_locks = 1 [ 83.247314] 1 lock held by gtp-link/1008: [ 83.248523] #0: 0000000017772c7f (rtnl_mutex){+.+.}, at: __rtnl_newlink+0x5f5/0x11b0 [ 83.251503] [ 83.251503] stack backtrace: [ 83.252173] CPU: 0 PID: 1008 Comm: gtp-link Not tainted 5.2.0-rc6+ #49 [ 83.253271] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 83.254562] Call Trace: [ 83.254995] dump_stack+0x7c/0xbb [ 83.255567] gtp_encap_enable_socket+0x2df/0x360 [gtp] [ 83.256415] ? gtp_find_dev+0x1a0/0x1a0 [gtp] [ 83.257161] ? memset+0x1f/0x40 [ 83.257843] gtp_newlink+0x90/0xa21 [gtp] [ 83.258497] ? __netlink_ns_capable+0xc3/0xf0 [ 83.259260] __rtnl_newlink+0xb9f/0x11b0 [ 83.260022] ? rtnl_link_unregister+0x230/0x230 [ ... ] Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07Linux 5.2v5.2Linus Torvalds
2019-07-07Merge branch 'net-dsa-Add-Vitesse-VSC73xx-parallel-mode'David S. Miller
Pawel Dembicki says: ==================== net: dsa: Add Vitesse VSC73xx parallel mode Main goal of this patch series is to add support for CPU attached parallel bus in Vitesse VSC73xx switches. Existing driver supports only SPI mode. Second change is needed for devices in unmanaged state. V3: - fix commit messages and descriptions about memory-mapped I/O mode V2: - drop changes in compatible strings - make changes less invasive - drop mutex in platform part and move mutex from core to spi part - fix indentation - fix devm_ioremap_resource result check - add cover letter ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07net: dsa: vsc73xx: Assert reset if iCPU is enabledPawel Dembicki
Driver allow to use devices with disabled iCPU only. Some devices have pre-initialised iCPU by bootloader. That state make switch unmanaged. This patch force reset if device is in unmanaged state. In the result chip lost internal firmware from RAM and it can be managed. Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07net: dsa: vsc73xx: add support for parallel modePawel Dembicki
This patch add platform part of vsc73xx driver. It allows to use chip connected to a parallel memory bus and work in memory-mapped I/O mode. (aka PI bus in chip manual) By default device is working in big endian mode. Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07net: dsa: vsc73xx: Split vsc73xx driverPawel Dembicki
This driver (currently) only takes control of the switch chip over SPI and configures it to route packages around when connected to a CPU port. But Vitesse chip support also parallel interface. This patch split driver into two parts: core and spi. It is required for add support to another managing interface. Tested-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07net: dsa: Change DT bindings for Vitesse VSC73xx switchesPawel Dembicki
This commit introduce how to use vsc73xx platform driver. Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07Merge branch 'net-tls-fix-poll-wake-up'David S. Miller
Jakub Kicinski says: ==================== net/tls: fix poll() wake up This small fix + selftest series is very similar to the previous commit 04b25a5411f9 ("net/tls: fix no wakeup on partial reads"). This time instead of recvmsg we're fixing poll wake up. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-07selftests/tls: add test for poll() with data in TLS ULPJakub Kicinski
Add a test which checks if leftover record data in TLS layer correctly wakes up poll(). Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit (git 2.34.1) at 2025-09-12 02:06:54 +0000