* [PATCH 3/5] net: emaclite: update kernel-doc comments
From: Radhey Shyam Pandey @ 2018-06-18 11:08 UTC (permalink / raw)
To: davem, andrew, michal.simek, radhey.shyam.pandey
Cc: netdev, linux-arm-kernel, linux-kernel
In-Reply-To: <1529320103-7711-1-git-send-email-radhey.shyam.pandey@xilinx.com>
This patch fixes below kernel-doc warnings:
Function parameter or member 'maxlen' not described in 'xemaclite_recv_data'
Function parameter or member 'address'not described in 'xemaclite_set_mac_address'
Excess function parameter 'addr' description in 'xemaclite_set_mac_address'
No description found for return value of 'xemaclite_interrupt'
No description found for return value of 'xemaclite_mdio_write'
Function parameter or member 'dev' not described in 'xemaclite_mdio_setup'
Excess function parameter 'ofdev' description in 'xemaclite_mdio_setup'
No description found for return value of 'xemaclite_open'
No description found for return value of 'xemaclite_close'
Excess function parameter 'match' description in 'xemaclite_of_probe'
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
---
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 8d84f58..0b41cc5 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -369,6 +369,7 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data,
* xemaclite_recv_data - Receive a frame
* @drvdata: Pointer to the Emaclite device private data
* @data: Address where the data is to be received
+ * @maxlen: Maximum supported ethernet packet length
*
* This function is intended to be called from the interrupt context or
* with a wrapper which waits for the receive frame to be available.
@@ -488,7 +489,7 @@ static void xemaclite_update_address(struct net_local *drvdata,
/**
* xemaclite_set_mac_address - Set the MAC address for this device
* @dev: Pointer to the network device instance
- * @addr: Void pointer to the sockaddr structure
+ * @address: Void pointer to the sockaddr structure
*
* This function copies the HW address from the sockaddr strucutre to the
* net_device structure and updates the address in HW.
@@ -637,6 +638,8 @@ static void xemaclite_rx_handler(struct net_device *dev)
* @dev_id: Void pointer to the network device instance used as callback
* reference
*
+ * Return: IRQ_HANDLED
+ *
* This function handles the Tx and Rx interrupts of the EmacLite device.
*/
static irqreturn_t xemaclite_interrupt(int irq, void *dev_id)
@@ -770,6 +773,8 @@ static int xemaclite_mdio_read(struct mii_bus *bus, int phy_id, int reg)
*
* This function waits till the device is ready to accept a new MDIO
* request and then writes the val to the MDIO Write Data register.
+ *
+ * Return: 0 upon success or a negative error upon failure
*/
static int xemaclite_mdio_write(struct mii_bus *bus, int phy_id, int reg,
u16 val)
@@ -803,7 +808,7 @@ static int xemaclite_mdio_write(struct mii_bus *bus, int phy_id, int reg,
/**
* xemaclite_mdio_setup - Register mii_bus for the Emaclite device
* @lp: Pointer to the Emaclite device private data
- * @ofdev: Pointer to OF device structure
+ * @dev: Pointer to OF device structure
*
* This function enables MDIO bus in the Emaclite device and registers a
* mii_bus.
@@ -903,6 +908,9 @@ static void xemaclite_adjust_link(struct net_device *ndev)
* This function sets the MAC address, requests an IRQ and enables interrupts
* for the Emaclite device and starts the Tx queue.
* It also connects to the phy device, if MDIO is included in Emaclite device.
+ *
+ * Return: 0 on success. -ENODEV, if PHY cannot be connected.
+ * Non-zero error value on failure.
*/
static int xemaclite_open(struct net_device *dev)
{
@@ -973,6 +981,8 @@ static int xemaclite_open(struct net_device *dev)
* This function stops the Tx queue, disables interrupts and frees the IRQ for
* the Emaclite device.
* It also disconnects the phy device associated with the Emaclite device.
+ *
+ * Return: 0, always.
*/
static int xemaclite_close(struct net_device *dev)
{
@@ -1064,7 +1074,6 @@ static const struct net_device_ops xemaclite_netdev_ops;
/**
* xemaclite_of_probe - Probe method for the Emaclite device.
* @ofdev: Pointer to OF device structure
- * @match: Pointer to the structure used for matching a device
*
* This function probes for the Emaclite device in the device tree.
* It initializes the driver data structure and the hardware, sets the MAC
--
2.7.4
^ permalink raw reply related
* [PATCH 4/5] net: emaclite: Fix block comments style
From: Radhey Shyam Pandey @ 2018-06-18 11:08 UTC (permalink / raw)
To: davem, andrew, michal.simek, radhey.shyam.pandey
Cc: netdev, linux-arm-kernel, linux-kernel
In-Reply-To: <1529320103-7711-1-git-send-email-radhey.shyam.pandey@xilinx.com>
This patch fixes below checkpatch warnings-
WARNING: Block comments use a trailing */ on a separate line
WARNING: Block comments use * on subsequent lines
WARNING: networking block comments don't use an empty /* line,
use /* Comment
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
---
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 34 +++++++++++++++++----------
1 file changed, 21 insertions(+), 13 deletions(-)
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 0b41cc5..e8bb7b3 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -70,7 +70,8 @@
#define XEL_TSR_XMIT_IE_MASK 0x00000008 /* Tx interrupt enable bit */
#define XEL_TSR_XMIT_ACTIVE_MASK 0x80000000 /* Buffer is active, SW bit
* only. This is not documented
- * in the HW spec */
+ * in the HW spec
+ */
/* Define for programming the MAC address into the EmacLite */
#define XEL_TSR_PROG_MAC_ADDR (XEL_TSR_XMIT_BUSY_MASK | XEL_TSR_PROGRAM_MASK)
@@ -336,7 +337,8 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data,
drvdata->next_tx_buf_to_use ^= XEL_BUFFER_OFFSET;
} else if (drvdata->tx_ping_pong != 0) {
/* If the expected buffer is full, try the other buffer,
- * if it is configured in HW */
+ * if it is configured in HW
+ */
addr = (void __iomem __force *)((u32 __force)addr ^
XEL_BUFFER_OFFSET);
@@ -357,7 +359,8 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data,
/* Update the Tx Status Register to indicate that there is a
* frame to send. Set the XEL_TSR_XMIT_ACTIVE_MASK flag which
* is used by the interrupt handler to check whether a frame
- * has been transmitted */
+ * has been transmitted
+ */
reg_data = xemaclite_readl(addr + XEL_TSR_OFFSET);
reg_data |= (XEL_TSR_XMIT_BUSY_MASK | XEL_TSR_XMIT_ACTIVE_MASK);
xemaclite_writel(reg_data, addr + XEL_TSR_OFFSET);
@@ -395,7 +398,8 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen)
/* The instance is out of sync, try other buffer if other
* buffer is configured, return 0 otherwise. If the instance is
* out of sync, do not update the 'next_rx_buf_to_use' since it
- * will correct on subsequent calls */
+ * will correct on subsequent calls
+ */
if (drvdata->rx_ping_pong != 0)
addr = (void __iomem __force *)((u32 __force)addr ^
XEL_BUFFER_OFFSET);
@@ -409,13 +413,15 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen)
return 0; /* No data was available */
}
- /* Get the protocol type of the ethernet frame that arrived */
+ /* Get the protocol type of the ethernet frame that arrived
+ */
proto_type = ((ntohl(xemaclite_readl(addr + XEL_HEADER_OFFSET +
XEL_RXBUFF_OFFSET)) >> XEL_HEADER_SHIFT) &
XEL_RPLR_LENGTH_MASK);
/* Check if received ethernet frame is a raw ethernet frame
- * or an IP packet or an ARP packet */
+ * or an IP packet or an ARP packet
+ */
if (proto_type > ETH_DATA_LEN) {
if (proto_type == ETH_P_IP) {
@@ -431,7 +437,8 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen)
length = XEL_ARP_PACKET_SIZE + ETH_HLEN + ETH_FCS_LEN;
else
/* Field contains type other than IP or ARP, use max
- * frame size and let user parse it */
+ * frame size and let user parse it
+ */
length = ETH_FRAME_LEN + ETH_FCS_LEN;
} else
/* Use the length in the frame, plus the header and trailer */
@@ -601,11 +608,11 @@ static void xemaclite_rx_handler(struct net_device *dev)
return;
}
- /*
- * A new skb should have the data halfword aligned, but this code is
+ /* A new skb should have the data halfword aligned, but this code is
* here just in case that isn't true. Calculate how many
* bytes we should reserve to get the data to start on a word
- * boundary */
+ * boundary
+ */
align = BUFFER_ALIGN(skb->data);
if (align)
skb_reserve(skb, align);
@@ -707,8 +714,8 @@ static int xemaclite_mdio_wait(struct net_local *lp)
unsigned long end = jiffies + 2;
/* wait for the MDIO interface to not be busy or timeout
- after some time.
- */
+ * after some time.
+ */
while (xemaclite_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET) &
XEL_MDIOCTRL_MDIOSTS_MASK) {
if (time_before_eq(end, jiffies)) {
@@ -1028,7 +1035,8 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
if (xemaclite_send_data(lp, (u8 *) new_skb->data, len) != 0) {
/* If the Emaclite Tx buffer is busy, stop the Tx queue and
* defer the skb for transmission during the ISR, after the
- * current transmission is complete */
+ * current transmission is complete
+ */
netif_stop_queue(dev);
lp->deferred_skb = new_skb;
/* Take the time stamp now, since we can't do this in an ISR. */
--
2.7.4
^ permalink raw reply related
* [PATCH 5/5] net: emaclite: Remove unnecessary spaces
From: Radhey Shyam Pandey @ 2018-06-18 11:08 UTC (permalink / raw)
To: davem, andrew, michal.simek, radhey.shyam.pandey
Cc: netdev, linux-arm-kernel, linux-kernel
In-Reply-To: <1529320103-7711-1-git-send-email-radhey.shyam.pandey@xilinx.com>
This patch fixes below checkpatch checks-
CHECK: spaces preferred around that '*' (ctx:VxV)
CHECK: No space is necessary after a cast
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
---
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index e8bb7b3..f62e4b6 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -95,11 +95,11 @@
-#define TX_TIMEOUT (60*HZ) /* Tx timeout is 60 seconds. */
+#define TX_TIMEOUT (60 * HZ) /* Tx timeout is 60 seconds. */
#define ALIGNMENT 4
/* BUFFER_ALIGN(adr) calculates the number of bytes to the next alignment. */
-#define BUFFER_ALIGN(adr) ((ALIGNMENT - ((u32) adr)) % ALIGNMENT)
+#define BUFFER_ALIGN(adr) ((ALIGNMENT - ((u32)adr)) % ALIGNMENT)
#ifdef __BIG_ENDIAN
#define xemaclite_readl ioread32be
@@ -239,8 +239,8 @@ static void xemaclite_aligned_write(void *src_ptr, u32 *dest_ptr,
/* Set up to output the remaining data */
align_buffer = 0;
- to_u8_ptr = (u8 *) &align_buffer;
- from_u8_ptr = (u8 *) from_u16_ptr;
+ to_u8_ptr = (u8 *)&align_buffer;
+ from_u8_ptr = (u8 *)from_u16_ptr;
/* Output the remaining data */
for (; length > 0; length--)
@@ -273,7 +273,7 @@ static void xemaclite_aligned_read(u32 *src_ptr, u8 *dest_ptr,
u32 align_buffer;
from_u32_ptr = src_ptr;
- to_u16_ptr = (u16 *) dest_ptr;
+ to_u16_ptr = (u16 *)dest_ptr;
for (; length > 3; length -= 4) {
/* Copy each word into the temporary buffer */
@@ -289,9 +289,9 @@ static void xemaclite_aligned_read(u32 *src_ptr, u8 *dest_ptr,
u8 *to_u8_ptr, *from_u8_ptr;
/* Set up to read the remaining data */
- to_u8_ptr = (u8 *) to_u16_ptr;
+ to_u8_ptr = (u8 *)to_u16_ptr;
align_buffer = *from_u32_ptr++;
- from_u8_ptr = (u8 *) &align_buffer;
+ from_u8_ptr = (u8 *)&align_buffer;
/* Read the remaining data */
for (; length > 0; length--)
@@ -351,7 +351,7 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data,
return -1; /* Buffer was full, return failure */
/* Write the frame to the buffer */
- xemaclite_aligned_write(data, (u32 __force *) addr, byte_count);
+ xemaclite_aligned_write(data, (u32 __force *)addr, byte_count);
xemaclite_writel((byte_count & XEL_TPLR_LENGTH_MASK),
addr + XEL_TPLR_OFFSET);
@@ -448,7 +448,7 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen)
length = maxlen;
/* Read from the EmacLite device */
- xemaclite_aligned_read((u32 __force *) (addr + XEL_RXBUFF_OFFSET),
+ xemaclite_aligned_read((u32 __force *)(addr + XEL_RXBUFF_OFFSET),
data, length);
/* Acknowledge the frame */
@@ -479,7 +479,7 @@ static void xemaclite_update_address(struct net_local *drvdata,
/* Determine the expected Tx buffer address */
addr = drvdata->base_addr + drvdata->next_tx_buf_to_use;
- xemaclite_aligned_write(address_ptr, (u32 __force *) addr, ETH_ALEN);
+ xemaclite_aligned_write(address_ptr, (u32 __force *)addr, ETH_ALEN);
xemaclite_writel(ETH_ALEN, addr + XEL_TPLR_OFFSET);
@@ -574,7 +574,7 @@ static void xemaclite_tx_handler(struct net_device *dev)
dev->stats.tx_packets++;
if (lp->deferred_skb) {
if (xemaclite_send_data(lp,
- (u8 *) lp->deferred_skb->data,
+ (u8 *)lp->deferred_skb->data,
lp->deferred_skb->len) != 0)
return;
dev->stats.tx_bytes += lp->deferred_skb->len;
@@ -619,7 +619,7 @@ static void xemaclite_rx_handler(struct net_device *dev)
skb_reserve(skb, 2);
- len = xemaclite_recv_data(lp, (u8 *) skb->data, len);
+ len = xemaclite_recv_data(lp, (u8 *)skb->data, len);
if (!len) {
dev->stats.rx_errors++;
@@ -1032,7 +1032,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
new_skb = orig_skb;
spin_lock_irqsave(&lp->reset_lock, flags);
- if (xemaclite_send_data(lp, (u8 *) new_skb->data, len) != 0) {
+ if (xemaclite_send_data(lp, (u8 *)new_skb->data, len) != 0) {
/* If the Emaclite Tx buffer is busy, stop the Tx queue and
* defer the skb for transmission during the ISR, after the
* current transmission is complete
--
2.7.4
^ permalink raw reply related
* Re: [PATCH] net: Fix device name resolving crash in default_device_exit()
From: Kirill Tkhai @ 2018-06-18 11:21 UTC (permalink / raw)
To: David Ahern, netdev
Cc: davem, daniel, jakub.kicinski, ast, linux, john.fastabend, brouer
In-Reply-To: <aaa7e53a-47bc-14b8-3598-3b2f4bf2f83c@gmail.com>
On 17.06.2018 21:58, David Ahern wrote:
> On 6/15/18 3:44 AM, Kirill Tkhai wrote:
>> Hm, but is this a likely case, when real device is moved to net ns, so it
>> requires moving to init_net back? It seems the most devices moved to !init_net
>> are virtual and they just destroyed in default_device_exit_batch(). Or we have
>> more devices to care here?
>>
>> I don't much want to insert here something like below:
>>
>> if (__dev_get_by_name(&init_net, dev->name))
>> snprintf(fb_name, IFNAMSIZ, "dev%d", dev->ifindex);
>> err = dev_change_net_namespace(dev, &init_net, "dev%d");
>>
>> because dev_change_net_namespace() is generic interface and it's used not only here,
>> and this will crumble the code in corner cases.
>>
>> Maybe you have better ideas about this?
>
> There are a lot of use cases these days (e.g., switch NOS) with 1000's
> (10's of 1000's) of netdevices. On top of that support for port netdevs
> in a namespace to create virtual switches needs to happen (and I suspect
> will happen in the next few years). That becomes one example where
> netdevices representing physical ports can be pushed back to init_net.
Oh, then we really need to do something with rtnl_mutex. Otherwise
this will stop working at all.
> That said, not many easy options at the moment for the bug you are fixing.
>
> Further, panic'ing a node because the move back to init_net fails is
> just wrong.
So, let's fix it for now like in the patch to avoid the panic. Then we
can rework this in generic way to make the generic fallback name for moved
devices. Maybe, something like to give all moved device a fallback name
like "__moved-<hash of jiffies>-<generated id>".
Kirill
^ permalink raw reply
* Re: [PATCH] net: Fix device name resolving crash in default_device_exit()
From: Kirill Tkhai @ 2018-06-18 11:26 UTC (permalink / raw)
To: David Ahern, netdev
Cc: davem, daniel, jakub.kicinski, ast, linux, john.fastabend, brouer
In-Reply-To: <c2ab891c-1043-3eca-5102-b795ef7d85ec@virtuozzo.com>
On 18.06.2018 14:21, Kirill Tkhai wrote:
> On 17.06.2018 21:58, David Ahern wrote:
>> On 6/15/18 3:44 AM, Kirill Tkhai wrote:
>>> Hm, but is this a likely case, when real device is moved to net ns, so it
>>> requires moving to init_net back? It seems the most devices moved to !init_net
>>> are virtual and they just destroyed in default_device_exit_batch(). Or we have
>>> more devices to care here?
>>>
>>> I don't much want to insert here something like below:
>>>
>>> if (__dev_get_by_name(&init_net, dev->name))
>>> snprintf(fb_name, IFNAMSIZ, "dev%d", dev->ifindex);
>>> err = dev_change_net_namespace(dev, &init_net, "dev%d");
>>>
>>> because dev_change_net_namespace() is generic interface and it's used not only here,
>>> and this will crumble the code in corner cases.
>>>
>>> Maybe you have better ideas about this?
>>
>> There are a lot of use cases these days (e.g., switch NOS) with 1000's
>> (10's of 1000's) of netdevices. On top of that support for port netdevs
>> in a namespace to create virtual switches needs to happen (and I suspect
>> will happen in the next few years). That becomes one example where
>> netdevices representing physical ports can be pushed back to init_net.
>
> Oh, then we really need to do something with rtnl_mutex. Otherwise
> this will stop working at all.
>
>> That said, not many easy options at the moment for the bug you are fixing.
>>
>> Further, panic'ing a node because the move back to init_net fails is
>> just wrong.
>
> So, let's fix it for now like in the patch to avoid the panic. Then we
> can rework this in generic way to make the generic fallback name for moved
> devices. Maybe, something like to give all moved device a fallback name
> like "__moved-<hash of jiffies>-<generated id>".
Just to clarify, I mean that this small fix will be easy to backport to stable.
Kirill
^ permalink raw reply
* Re: [PATCH rdma-next v2 09/20] IB/core: Improve uverbs_cleanup_ucontext algorithm
From: Yishai Hadas @ 2018-06-18 11:27 UTC (permalink / raw)
To: Jason Gunthorpe
Cc: Leon Romanovsky, Doug Ledford, Leon Romanovsky, RDMA mailing list,
Joonas Lahtinen, Matan Barak, Yishai Hadas, Saeed Mahameed,
linux-netdev, Majd Dibbiny
In-Reply-To: <20180617195106.eai7iajx4y5w3ii6@mellanox.com>
On 6/17/2018 10:51 PM, Jason Gunthorpe wrote:
> On Sun, Jun 17, 2018 at 12:59:55PM +0300, Leon Romanovsky wrote:
>
>> +void uverbs_cleanup_ucontext(struct ib_ucontext *ucontext, bool device_removed)
>> +{
>> /*
>> * Waits for all remove_commit and alloc_commit to finish. Logically, We
>> * want to hold this forever as the context is going to be destroyed,
>> * but we'll release it since it causes a "held lock freed" BUG message.
>> */
>> down_write(&ucontext->cleanup_rwsem);
>> + while (!list_empty(&ucontext->uobjects))
>> + if (__uverbs_cleanup_ucontext(ucontext, RDMA_REMOVE_DESTROY))
>> + /* No entry was cleaned-up successfully during this iteration */
>> + break;
>
> No, this isn't right, it must remain REMOVE or CLOSE here. The enum is
> a signal to the driver what is going on. DESTROY is only for user
> triggered destroy called in a user context.
>
The algorithm must enable the drivers an option to fully cleanup their
resources as was done before this change.
Using REMOVE or CLOSE without some following change won't do the work as
the infrastructure (e.g. remove_commit_idr_uobject) and other IB cleanup
functions during the road (e.g. uverbs_free_qp, uverbs_free_cq) will
force cleanup of some memory/idr/ref resources and prevent a second
successful iteration in case of a failure.
For that reason the initial iteration should be with some relaxed mode
and just later in case were left uncleaned-up resources the code should
use the REMOVE/CLOSE option.
However, I do agree that we need to preserve the original signal to let
downstream layers to know what happened, at the moment it looks like
there is one place that it's even a must as part of
uverbs_hot_unplug_completion_event_file() where
'RDMA_REMOVE_DRIVER_REMOVE' is used explicitly as part of the cleanup flow.
For that I suggest below [1] patch which replaces RDMA_REMOVE_DESTROY in
the first iteration with RDMA_REMOVE_DRIVER_REMOVE_RELAX/
RDMA_REMOVE_CLOSE_RELAX new enum values to do the job.
> There needs to be some kind of guarenteed return from the driver that
> destroy is failing due to elevated refcounts, and not some other
> reason.. This is just checking for any ret?
We can't rely on all drivers' return codes from legacy/current firmware
code for all objects to return a specific ret code for that case.
Even if we had such, the second iteration where we should force cleanup
might still fail with that ret code and a kernel memory leak would occur.
>
>> - while (!list_empty(&ucontext->uobjects)) {
>> - struct ib_uobject *obj, *next_obj;
>> - unsigned int next_order = UINT_MAX;
>> + if (!list_empty(&ucontext->uobjects))
>> + __uverbs_cleanup_ucontext(ucontext, device_removed ?
>> + RDMA_REMOVE_DRIVER_REMOVE : RDMA_REMOVE_CLOSE);
>
> Failure to cleanup is a driver bug, and should be reported with
> WARN_ON. This is also mis using the remove enum, CLOSE is not a
> 'bigger hammer'
>
The patch saves the previous behavior that set a warn message [2] and
not a WARN_ON, if you think that WARN_ON is better we can change to.
[2]
pr_warn("ib_uverbs: unable to remove uobject id %d err %d\n",
obj->id, err);
The suggested patch on top of current can look like below.
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 4685ef5..6b03ca7
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1468,8 +1468,21 @@ enum rdma_remove_reason {
RDMA_REMOVE_DRIVER_REMOVE,
/* Context is being cleaned-up, but commit was just completed */
RDMA_REMOVE_DURING_CLEANUP,
+ /* Driver is being hot-unplugged, retry may be called upon an
error */
+ RDMA_REMOVE_DRIVER_REMOVE_RELAX,
+ /* Context deletion, retry may be called upon an error */
+ RDMA_REMOVE_CLOSE_RELAX,
};
+static inline bool ib_is_remove_retry(enum rdma_remove_reason why)
+{
+ if (why == RDMA_REMOVE_DESTROY || why ==
RDMA_REMOVE_DRIVER_REMOVE_RELAX ||
+ why == RDMA_REMOVE_CLOSE_RELAX)
+ return true;
+
+ return false;
+}
+
// In the new algorithm below enums will be used instead of
//RDMA_REMOVE_DESTROY
@@ -700,7 +701,9 @@ void uverbs_cleanup_ucontext(struct ib_ucontext
*ucontext, bool device_removed)
*/
down_write(&ucontext->cleanup_rwsem);
while (!list_empty(&ucontext->uobjects))
- if (__uverbs_cleanup_ucontext(ucontext,
RDMA_REMOVE_DESTROY))
+ if (__uverbs_cleanup_ucontext(ucontext, device_removed ?
+ RDMA_REMOVE_DRIVER_REMOVE_RELAX :
+ RDMA_REMOVE_CLOSE_RELAX))
/* No entry was cleaned-up successfully during
this iteration */
break;
// Below logic will be replaced in all applicable places, I just put few
// of to demonstrate the solution.
--- a/drivers/infiniband/core/uverbs_std_types_cq.c
+++ b/drivers/infiniband/core/uverbs_std_types_cq.c
@@ -44,7 +44,7 @@ static int uverbs_free_cq(struct ib_uobject *uobject,
int ret;
ret = ib_destroy_cq(cq);
- if (!ret || why != RDMA_REMOVE_DESTROY)
+ if (!ret || !ib_is_remove_retry(why))
ib_uverbs_release_ucq(uobject->context->ufile, ev_queue
? container_of(ev_queue, struct ib_uverbs_completion_event_file,
++ b/drivers/infiniband/core/rdma_core.c
@@ -360,9 +360,10 @@ static int __must_check
remove_commit_idr_uobject(struct ib_uobject *uobj,
/*
* We can only fail gracefully if the user requested to destroy the
- * object. In the rest of the cases, just remove whatever you can.
+ * object or when a retry may be called upon an error.
+ * In the rest of the cases, just remove whatever you can.
*/
- if (why == RDMA_REMOVE_DESTROY && ret)
+ if (ret && ib_is_remove_retry(why))
return ret;
ib_rdmacg_uncharge(&uobj->cg_obj, uobj->context->device,
@@ -393,7 +394,7 @@ static int __must_check
remove_commit_fd_uobject(struct ib_uobject *uobj,
container_of(uobj, struct ib_uobject_file, uobj);
int ret = fd_type->context_closed(uobj_file, why);
- if (why == RDMA_REMOVE_DESTROY && ret)
+ if (ret && ib_is_remove_retry(why))
return ret;
//Here is the specific place that checks for RDMA_REMOVE_DRIVER_REMOVE.
// it should do the work also when RDMA_REMOVE_DRIVER_REMOVE was called.
@@ -187,7 +187,7 @@ static int
uverbs_hot_unplug_completion_event_file(struct ib_uobject_file *uobj_
event_queue->is_closed = 1;
spin_unlock_irq(&event_queue->lock);
- if (why == RDMA_REMOVE_DRIVER_REMOVE) {
+ if (why == RDMA_REMOVE_DRIVER_REMOVE || why ==
RDMA_REMOVE_DRIVER_REMOVE_RELAX) {
wake_up_interruptible(&event_queue->poll_wait);
kill_fasync(&event_queue->async_queue, SIGIO, POLL_IN);
}
What do you think ?
Yishai
^ permalink raw reply related
* Re: [PATCH] net: fix e100.rst Documentation build errors
From: Michal Kubecek @ 2018-06-18 11:44 UTC (permalink / raw)
To: Jani Nikula
Cc: Randy Dunlap, linux-doc@vger.kernel.org, netdev@vger.kernel.org,
Jeff Kirsher, David Miller, LKML, Aaron Brown
In-Reply-To: <87efh4y0yk.fsf@intel.com>
On Mon, Jun 18, 2018 at 11:04:51AM +0300, Jani Nikula wrote:
> On Sat, 16 Jun 2018, Randy Dunlap <rdunlap@infradead.org> wrote:
> > From: Randy Dunlap <rdunlap@infradead.org>
> >
> > Fix Documentation build errors in e100.rst. Several section titles
> > and the corresponding underlines should not be indented.
>
> Really the content blocks below the titles should not be indented
> either. It's not an error, but the end result is probably not what you
> want.
Also the indentation of this part:
> Rx Descriptors: Number of receive descriptors. A receive descriptor is a data
> structure that describes a receive buffer and its attributes to the network
> controller. The data in the descriptor is used by the controller to write
> data from the controller to host memory. In the 3.x.x driver the valid range
> for this parameter is 64-256. The default value is 256. This parameter can be
> changed using the command::
>
> ethtool -G eth? rx n
>
> Where n is the number of desired Rx descriptors.
>
> Tx Descriptors: Number of transmit descriptors. A transmit descriptor is a data
> structure that describes a transmit buffer and its attributes to the network
> controller. The data in the descriptor is used by the controller to read
> data from the host memory to the controller. In the 3.x.x driver the valid
> range for this parameter is 64-256. The default value is 128. This parameter
> can be changed using the command::
>
> ethtool -G eth? tx n
>
> Where n is the number of desired Tx descriptors.
>
> Speed/Duplex: The driver auto-negotiates the link speed and duplex settings by
> default. The ethtool utility can be used as follows to force speed/duplex.::
>
> ethtool -s eth? autoneg off speed {10|100} duplex {full|half}
>
> NOTE: setting the speed/duplex to incorrect values will cause the link to
> fail.
>
> Event Log Message Level: The driver uses the message level flag to log events
> to syslog. The message level can be set at driver load time. It can also be
> set using the command::
>
> ethtool -s eth? msglvl n
causes
.../Documentation/networking/e100.rst:56: WARNING: Literal block expected; none found.
.../Documentation/networking/e100.rst:67: WARNING: Literal block expected; none found.
.../Documentation/networking/e100.rst:74: WARNING: Literal block expected; none found.
.../Documentation/networking/e100.rst:83: WARNING: Literal block expected; none found.
as the literal block has the same indentation as preceding paragraph
(except for the first line).
Michal Kubecek
^ permalink raw reply
* [PATCH 0/5] Fixes coding style in xilinx_emaclite.c
From: Radhey Shyam Pandey @ 2018-06-18 11:50 UTC (permalink / raw)
To: davem, andrew, michal.simek, radhey.shyam.pandey
Cc: netdev, linux-arm-kernel, linux-kernel
This patchset fixes checkpatch and kernel-doc warnings in
xilinx emaclite driver. No functional change.
Radhey Shyam Pandey (5):
net: emaclite: Use __func__ instead of hardcoded name
net: emaclite: Balance braces in else statement
net: emaclite: update kernel-doc comments
net: emaclite: Fix block comments style
net: emaclite: Remove unnecessary spaces
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 101 +++++++++++++++-----------
1 file changed, 58 insertions(+), 43 deletions(-)
--
2.7.4
^ permalink raw reply
* [PATCH 1/5] net: emaclite: Use __func__ instead of hardcoded name
From: Radhey Shyam Pandey @ 2018-06-18 11:50 UTC (permalink / raw)
To: davem, andrew, michal.simek, radhey.shyam.pandey
Cc: netdev, linux-kernel, linux-arm-kernel
In-Reply-To: <1529322610-27215-1-git-send-email-radhey.shyam.pandey@xilinx.com>
Switch hardcoded function name with a reference to __func__ making
the code more maintainable. Address below checkpatch warning:
WARNING: Prefer using '"%s...", __func__' to using 'xemaclite_mdio_read',
this function's name, in a string
+ "xemaclite_mdio_read(phy_id=%i, reg=%x) == %x\n",
WARNING: Prefer using '"%s...", __func__' to using 'xemaclite_mdio_write',
this function's name, in a string
+ "xemaclite_mdio_write(phy_id=%i, reg=%x, val=%x)\n",
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
---
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 2a0c06e..0544134 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -757,7 +757,7 @@ static int xemaclite_mdio_read(struct mii_bus *bus, int phy_id, int reg)
rc = xemaclite_readl(lp->base_addr + XEL_MDIORD_OFFSET);
dev_dbg(&lp->ndev->dev,
- "xemaclite_mdio_read(phy_id=%i, reg=%x) == %x\n",
+ "%s(phy_id=%i, reg=%x) == %x\n", __func__,
phy_id, reg, rc);
return rc;
@@ -780,7 +780,7 @@ static int xemaclite_mdio_write(struct mii_bus *bus, int phy_id, int reg,
u32 ctrl_reg;
dev_dbg(&lp->ndev->dev,
- "xemaclite_mdio_write(phy_id=%i, reg=%x, val=%x)\n",
+ "%s(phy_id=%i, reg=%x, val=%x)\n", __func__,
phy_id, reg, val);
if (xemaclite_mdio_wait(lp))
--
2.7.4
^ permalink raw reply related
* [PATCH 2/5] net: emaclite: Balance braces in else statement
From: Radhey Shyam Pandey @ 2018-06-18 11:50 UTC (permalink / raw)
To: davem, andrew, michal.simek, radhey.shyam.pandey
Cc: netdev, linux-arm-kernel, linux-kernel
In-Reply-To: <1529322610-27215-1-git-send-email-radhey.shyam.pandey@xilinx.com>
Remove else as it is not required with if doing a return.
Fixes below checkpatch warning.
WARNING: else is not generally useful after a break or return
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
---
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 22 ++++++++++------------
1 file changed, 10 insertions(+), 12 deletions(-)
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 0544134..8d84f58 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -569,13 +569,11 @@ static void xemaclite_tx_handler(struct net_device *dev)
(u8 *) lp->deferred_skb->data,
lp->deferred_skb->len) != 0)
return;
- else {
- dev->stats.tx_bytes += lp->deferred_skb->len;
- dev_kfree_skb_irq(lp->deferred_skb);
- lp->deferred_skb = NULL;
- netif_trans_update(dev); /* prevent tx timeout */
- netif_wake_queue(dev);
- }
+ dev->stats.tx_bytes += lp->deferred_skb->len;
+ dev_kfree_skb_irq(lp->deferred_skb);
+ lp->deferred_skb = NULL;
+ netif_trans_update(dev); /* prevent tx timeout */
+ netif_wake_queue(dev);
}
}
@@ -1052,13 +1050,13 @@ static bool get_bool(struct platform_device *ofdev, const char *s)
{
u32 *p = (u32 *)of_get_property(ofdev->dev.of_node, s, NULL);
- if (p) {
+ if (p)
return (bool)*p;
- } else {
- dev_warn(&ofdev->dev, "Parameter %s not found,"
+
+ dev_warn(&ofdev->dev, "Parameter %s not found,"
"defaulting to false\n", s);
- return false;
- }
+
+ return false;
}
static const struct net_device_ops xemaclite_netdev_ops;
--
2.7.4
^ permalink raw reply related
* [PATCH 3/5] net: emaclite: update kernel-doc comments
From: Radhey Shyam Pandey @ 2018-06-18 11:50 UTC (permalink / raw)
To: davem, andrew, michal.simek, radhey.shyam.pandey
Cc: netdev, linux-arm-kernel, linux-kernel
In-Reply-To: <1529322610-27215-1-git-send-email-radhey.shyam.pandey@xilinx.com>
This patch fixes below kernel-doc warnings:
Function parameter or member 'maxlen' not described in 'xemaclite_recv_data'
Function parameter or member 'address'not described in 'xemaclite_set_mac_address'
Excess function parameter 'addr' description in 'xemaclite_set_mac_address'
No description found for return value of 'xemaclite_interrupt'
No description found for return value of 'xemaclite_mdio_write'
Function parameter or member 'dev' not described in 'xemaclite_mdio_setup'
Excess function parameter 'ofdev' description in 'xemaclite_mdio_setup'
No description found for return value of 'xemaclite_open'
No description found for return value of 'xemaclite_close'
Excess function parameter 'match' description in 'xemaclite_of_probe'
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
---
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 8d84f58..0b41cc5 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -369,6 +369,7 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data,
* xemaclite_recv_data - Receive a frame
* @drvdata: Pointer to the Emaclite device private data
* @data: Address where the data is to be received
+ * @maxlen: Maximum supported ethernet packet length
*
* This function is intended to be called from the interrupt context or
* with a wrapper which waits for the receive frame to be available.
@@ -488,7 +489,7 @@ static void xemaclite_update_address(struct net_local *drvdata,
/**
* xemaclite_set_mac_address - Set the MAC address for this device
* @dev: Pointer to the network device instance
- * @addr: Void pointer to the sockaddr structure
+ * @address: Void pointer to the sockaddr structure
*
* This function copies the HW address from the sockaddr strucutre to the
* net_device structure and updates the address in HW.
@@ -637,6 +638,8 @@ static void xemaclite_rx_handler(struct net_device *dev)
* @dev_id: Void pointer to the network device instance used as callback
* reference
*
+ * Return: IRQ_HANDLED
+ *
* This function handles the Tx and Rx interrupts of the EmacLite device.
*/
static irqreturn_t xemaclite_interrupt(int irq, void *dev_id)
@@ -770,6 +773,8 @@ static int xemaclite_mdio_read(struct mii_bus *bus, int phy_id, int reg)
*
* This function waits till the device is ready to accept a new MDIO
* request and then writes the val to the MDIO Write Data register.
+ *
+ * Return: 0 upon success or a negative error upon failure
*/
static int xemaclite_mdio_write(struct mii_bus *bus, int phy_id, int reg,
u16 val)
@@ -803,7 +808,7 @@ static int xemaclite_mdio_write(struct mii_bus *bus, int phy_id, int reg,
/**
* xemaclite_mdio_setup - Register mii_bus for the Emaclite device
* @lp: Pointer to the Emaclite device private data
- * @ofdev: Pointer to OF device structure
+ * @dev: Pointer to OF device structure
*
* This function enables MDIO bus in the Emaclite device and registers a
* mii_bus.
@@ -903,6 +908,9 @@ static void xemaclite_adjust_link(struct net_device *ndev)
* This function sets the MAC address, requests an IRQ and enables interrupts
* for the Emaclite device and starts the Tx queue.
* It also connects to the phy device, if MDIO is included in Emaclite device.
+ *
+ * Return: 0 on success. -ENODEV, if PHY cannot be connected.
+ * Non-zero error value on failure.
*/
static int xemaclite_open(struct net_device *dev)
{
@@ -973,6 +981,8 @@ static int xemaclite_open(struct net_device *dev)
* This function stops the Tx queue, disables interrupts and frees the IRQ for
* the Emaclite device.
* It also disconnects the phy device associated with the Emaclite device.
+ *
+ * Return: 0, always.
*/
static int xemaclite_close(struct net_device *dev)
{
@@ -1064,7 +1074,6 @@ static const struct net_device_ops xemaclite_netdev_ops;
/**
* xemaclite_of_probe - Probe method for the Emaclite device.
* @ofdev: Pointer to OF device structure
- * @match: Pointer to the structure used for matching a device
*
* This function probes for the Emaclite device in the device tree.
* It initializes the driver data structure and the hardware, sets the MAC
--
2.7.4
^ permalink raw reply related
* [PATCH 4/5] net: emaclite: Fix block comments style
From: Radhey Shyam Pandey @ 2018-06-18 11:50 UTC (permalink / raw)
To: davem, andrew, michal.simek, radhey.shyam.pandey
Cc: netdev, linux-arm-kernel, linux-kernel
In-Reply-To: <1529322610-27215-1-git-send-email-radhey.shyam.pandey@xilinx.com>
This patch fixes below checkpatch warnings-
WARNING: Block comments use a trailing */ on a separate line
WARNING: Block comments use * on subsequent lines
WARNING: networking block comments don't use an empty /* line,
use /* Comment
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
---
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 34 +++++++++++++++++----------
1 file changed, 21 insertions(+), 13 deletions(-)
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 0b41cc5..e8bb7b3 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -70,7 +70,8 @@
#define XEL_TSR_XMIT_IE_MASK 0x00000008 /* Tx interrupt enable bit */
#define XEL_TSR_XMIT_ACTIVE_MASK 0x80000000 /* Buffer is active, SW bit
* only. This is not documented
- * in the HW spec */
+ * in the HW spec
+ */
/* Define for programming the MAC address into the EmacLite */
#define XEL_TSR_PROG_MAC_ADDR (XEL_TSR_XMIT_BUSY_MASK | XEL_TSR_PROGRAM_MASK)
@@ -336,7 +337,8 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data,
drvdata->next_tx_buf_to_use ^= XEL_BUFFER_OFFSET;
} else if (drvdata->tx_ping_pong != 0) {
/* If the expected buffer is full, try the other buffer,
- * if it is configured in HW */
+ * if it is configured in HW
+ */
addr = (void __iomem __force *)((u32 __force)addr ^
XEL_BUFFER_OFFSET);
@@ -357,7 +359,8 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data,
/* Update the Tx Status Register to indicate that there is a
* frame to send. Set the XEL_TSR_XMIT_ACTIVE_MASK flag which
* is used by the interrupt handler to check whether a frame
- * has been transmitted */
+ * has been transmitted
+ */
reg_data = xemaclite_readl(addr + XEL_TSR_OFFSET);
reg_data |= (XEL_TSR_XMIT_BUSY_MASK | XEL_TSR_XMIT_ACTIVE_MASK);
xemaclite_writel(reg_data, addr + XEL_TSR_OFFSET);
@@ -395,7 +398,8 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen)
/* The instance is out of sync, try other buffer if other
* buffer is configured, return 0 otherwise. If the instance is
* out of sync, do not update the 'next_rx_buf_to_use' since it
- * will correct on subsequent calls */
+ * will correct on subsequent calls
+ */
if (drvdata->rx_ping_pong != 0)
addr = (void __iomem __force *)((u32 __force)addr ^
XEL_BUFFER_OFFSET);
@@ -409,13 +413,15 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen)
return 0; /* No data was available */
}
- /* Get the protocol type of the ethernet frame that arrived */
+ /* Get the protocol type of the ethernet frame that arrived
+ */
proto_type = ((ntohl(xemaclite_readl(addr + XEL_HEADER_OFFSET +
XEL_RXBUFF_OFFSET)) >> XEL_HEADER_SHIFT) &
XEL_RPLR_LENGTH_MASK);
/* Check if received ethernet frame is a raw ethernet frame
- * or an IP packet or an ARP packet */
+ * or an IP packet or an ARP packet
+ */
if (proto_type > ETH_DATA_LEN) {
if (proto_type == ETH_P_IP) {
@@ -431,7 +437,8 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen)
length = XEL_ARP_PACKET_SIZE + ETH_HLEN + ETH_FCS_LEN;
else
/* Field contains type other than IP or ARP, use max
- * frame size and let user parse it */
+ * frame size and let user parse it
+ */
length = ETH_FRAME_LEN + ETH_FCS_LEN;
} else
/* Use the length in the frame, plus the header and trailer */
@@ -601,11 +608,11 @@ static void xemaclite_rx_handler(struct net_device *dev)
return;
}
- /*
- * A new skb should have the data halfword aligned, but this code is
+ /* A new skb should have the data halfword aligned, but this code is
* here just in case that isn't true. Calculate how many
* bytes we should reserve to get the data to start on a word
- * boundary */
+ * boundary
+ */
align = BUFFER_ALIGN(skb->data);
if (align)
skb_reserve(skb, align);
@@ -707,8 +714,8 @@ static int xemaclite_mdio_wait(struct net_local *lp)
unsigned long end = jiffies + 2;
/* wait for the MDIO interface to not be busy or timeout
- after some time.
- */
+ * after some time.
+ */
while (xemaclite_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET) &
XEL_MDIOCTRL_MDIOSTS_MASK) {
if (time_before_eq(end, jiffies)) {
@@ -1028,7 +1035,8 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
if (xemaclite_send_data(lp, (u8 *) new_skb->data, len) != 0) {
/* If the Emaclite Tx buffer is busy, stop the Tx queue and
* defer the skb for transmission during the ISR, after the
- * current transmission is complete */
+ * current transmission is complete
+ */
netif_stop_queue(dev);
lp->deferred_skb = new_skb;
/* Take the time stamp now, since we can't do this in an ISR. */
--
2.7.4
^ permalink raw reply related
* [PATCH 5/5] net: emaclite: Remove unnecessary spaces
From: Radhey Shyam Pandey @ 2018-06-18 11:50 UTC (permalink / raw)
To: davem, andrew, michal.simek, radhey.shyam.pandey
Cc: netdev, linux-arm-kernel, linux-kernel
In-Reply-To: <1529322610-27215-1-git-send-email-radhey.shyam.pandey@xilinx.com>
This patch fixes below checkpatch checks-
CHECK: spaces preferred around that '*' (ctx:VxV)
CHECK: No space is necessary after a cast
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
---
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index e8bb7b3..f62e4b6 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -95,11 +95,11 @@
-#define TX_TIMEOUT (60*HZ) /* Tx timeout is 60 seconds. */
+#define TX_TIMEOUT (60 * HZ) /* Tx timeout is 60 seconds. */
#define ALIGNMENT 4
/* BUFFER_ALIGN(adr) calculates the number of bytes to the next alignment. */
-#define BUFFER_ALIGN(adr) ((ALIGNMENT - ((u32) adr)) % ALIGNMENT)
+#define BUFFER_ALIGN(adr) ((ALIGNMENT - ((u32)adr)) % ALIGNMENT)
#ifdef __BIG_ENDIAN
#define xemaclite_readl ioread32be
@@ -239,8 +239,8 @@ static void xemaclite_aligned_write(void *src_ptr, u32 *dest_ptr,
/* Set up to output the remaining data */
align_buffer = 0;
- to_u8_ptr = (u8 *) &align_buffer;
- from_u8_ptr = (u8 *) from_u16_ptr;
+ to_u8_ptr = (u8 *)&align_buffer;
+ from_u8_ptr = (u8 *)from_u16_ptr;
/* Output the remaining data */
for (; length > 0; length--)
@@ -273,7 +273,7 @@ static void xemaclite_aligned_read(u32 *src_ptr, u8 *dest_ptr,
u32 align_buffer;
from_u32_ptr = src_ptr;
- to_u16_ptr = (u16 *) dest_ptr;
+ to_u16_ptr = (u16 *)dest_ptr;
for (; length > 3; length -= 4) {
/* Copy each word into the temporary buffer */
@@ -289,9 +289,9 @@ static void xemaclite_aligned_read(u32 *src_ptr, u8 *dest_ptr,
u8 *to_u8_ptr, *from_u8_ptr;
/* Set up to read the remaining data */
- to_u8_ptr = (u8 *) to_u16_ptr;
+ to_u8_ptr = (u8 *)to_u16_ptr;
align_buffer = *from_u32_ptr++;
- from_u8_ptr = (u8 *) &align_buffer;
+ from_u8_ptr = (u8 *)&align_buffer;
/* Read the remaining data */
for (; length > 0; length--)
@@ -351,7 +351,7 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data,
return -1; /* Buffer was full, return failure */
/* Write the frame to the buffer */
- xemaclite_aligned_write(data, (u32 __force *) addr, byte_count);
+ xemaclite_aligned_write(data, (u32 __force *)addr, byte_count);
xemaclite_writel((byte_count & XEL_TPLR_LENGTH_MASK),
addr + XEL_TPLR_OFFSET);
@@ -448,7 +448,7 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen)
length = maxlen;
/* Read from the EmacLite device */
- xemaclite_aligned_read((u32 __force *) (addr + XEL_RXBUFF_OFFSET),
+ xemaclite_aligned_read((u32 __force *)(addr + XEL_RXBUFF_OFFSET),
data, length);
/* Acknowledge the frame */
@@ -479,7 +479,7 @@ static void xemaclite_update_address(struct net_local *drvdata,
/* Determine the expected Tx buffer address */
addr = drvdata->base_addr + drvdata->next_tx_buf_to_use;
- xemaclite_aligned_write(address_ptr, (u32 __force *) addr, ETH_ALEN);
+ xemaclite_aligned_write(address_ptr, (u32 __force *)addr, ETH_ALEN);
xemaclite_writel(ETH_ALEN, addr + XEL_TPLR_OFFSET);
@@ -574,7 +574,7 @@ static void xemaclite_tx_handler(struct net_device *dev)
dev->stats.tx_packets++;
if (lp->deferred_skb) {
if (xemaclite_send_data(lp,
- (u8 *) lp->deferred_skb->data,
+ (u8 *)lp->deferred_skb->data,
lp->deferred_skb->len) != 0)
return;
dev->stats.tx_bytes += lp->deferred_skb->len;
@@ -619,7 +619,7 @@ static void xemaclite_rx_handler(struct net_device *dev)
skb_reserve(skb, 2);
- len = xemaclite_recv_data(lp, (u8 *) skb->data, len);
+ len = xemaclite_recv_data(lp, (u8 *)skb->data, len);
if (!len) {
dev->stats.rx_errors++;
@@ -1032,7 +1032,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
new_skb = orig_skb;
spin_lock_irqsave(&lp->reset_lock, flags);
- if (xemaclite_send_data(lp, (u8 *) new_skb->data, len) != 0) {
+ if (xemaclite_send_data(lp, (u8 *)new_skb->data, len) != 0) {
/* If the Emaclite Tx buffer is busy, stop the Tx queue and
* defer the skb for transmission during the ISR, after the
* current transmission is complete
--
2.7.4
^ permalink raw reply related
* FROM THE OFFICE OF: MR Jean Louis Ekra. Director Of Operation Bank Du Atlantique 105 Ahmadu Bello WAY Lome Togo
From: Jean Louis Ekra @ 2018-06-18 11:57 UTC (permalink / raw)
FROM THE OFFICE OF: MR Jean Louis Ekra.
Director Of Operation
Bank Du Antique
105 Ahmad Bellow WAY Lome Togo,
NUMBER: +228 913 539 68
Attention:
I am Mr Jean Louis Ekra, Director Of Operation Bank Du Antique Lome
Togo, After waiting to hear from you or Banquet Antique and other
correspondent banks partners for a long time now, I decided to make
this direct approach to you in other not to let it be as if I have
anything in mind against you, I do not know if you have asked yourself
why each time the release of these funds is approved, all of a sudden,
the payment will be stopped or one problem or the other will come up.
If you have not asked this question or you do not know, this is an
opportunity for me to tell you,Some time ago your friends, I mean the
Barrister that introduced you to the project UNPAID INHERITANCE FUND
approached me through my dear wife who works with the federal Ministry
of Finance, requested me to assist them conclude a money transfer deal
they had with you, they requested me to assist them by removing the
original contractors name,company's name and bank particulars from
Bank Antique, Industries vetting computer and replacing them with your
names and your bank details in order to make you appear as the
rightful Beneficiary of these UNPAID INHERITANCE FUND,I agreed on one
condition that they will pay me $800,000 US D as
soon as your names appears as the beneficiary.
I did as agreed and demanded to be paid but your friends started
telling me stories. They even told me that you promise to send money
to me. Do you know that up till now, I have not received a single cent
from them and have not set my eyes on any of them. Based on their
attitude, I decided to stop the funds release movement because I
cannot be denied of my right in my own office considering the risk as
it might affect my job.Please should my proposal meet your interest do
let me know for more explanations and details.This is my whats-app
number (+228 913 539 68).
Regards,
Mr Jean Louis Ekra
Director Of Operation
GOD BLESS YOU.
number (+228 913 539 68).
^ permalink raw reply
* [PATCH] net: net_failover: fix typo in net_failover_slave_register()
From: Liran Alon @ 2018-06-18 12:04 UTC (permalink / raw)
To: davem, netdev, linux-kernel; +Cc: idan.brown, Liran Alon
Sync both unicast and multicast lists instead of unicast twice.
Fixes: cfc80d9a116 ("net: Introduce net_failover driver")
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Liran Alon <liran.alon@oracle.com>
---
drivers/net/net_failover.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c
index 83f7420ddea5..4f390fa557e4 100644
--- a/drivers/net/net_failover.c
+++ b/drivers/net/net_failover.c
@@ -527,7 +527,7 @@ static int net_failover_slave_register(struct net_device *slave_dev,
netif_addr_lock_bh(failover_dev);
dev_uc_sync_multiple(slave_dev, failover_dev);
- dev_uc_sync_multiple(slave_dev, failover_dev);
+ dev_mc_sync_multiple(slave_dev, failover_dev);
netif_addr_unlock_bh(failover_dev);
err = vlan_vids_add_by_dev(slave_dev, failover_dev);
--
1.9.1
^ permalink raw reply related
* Re: [PATCH net] netfilter: nf_queue: augment nfqa_cfg_policy
From: Pablo Neira Ayuso @ 2018-06-18 12:13 UTC (permalink / raw)
To: Eric Dumazet
Cc: Jozsef Kadlecsik, Florian Westphal, netfilter-devel, netdev,
Eric Dumazet
In-Reply-To: <20180613161339.144919-1-edumazet@google.com>
On Wed, Jun 13, 2018 at 09:13:39AM -0700, Eric Dumazet wrote:
> Three attributes are currently not verified, thus can trigger KMSAN
> warnings such as :
>
> BUG: KMSAN: uninit-value in __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline]
> BUG: KMSAN: uninit-value in __fswab32 include/uapi/linux/swab.h:59 [inline]
> BUG: KMSAN: uninit-value in nfqnl_recv_config+0x939/0x17d0 net/netfilter/nfnetlink_queue.c:1268
> CPU: 1 PID: 4521 Comm: syz-executor120 Not tainted 4.17.0+ #5
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Applied, thanks Eric.
^ permalink raw reply
* Re: [PATCH net] netfilter: ipv6: nf_defrag: reduce struct net memory waste
From: Pablo Neira Ayuso @ 2018-06-18 12:14 UTC (permalink / raw)
To: Eric Dumazet
Cc: Jozsef Kadlecsik, Florian Westphal, netfilter-devel, netdev,
Eric Dumazet
In-Reply-To: <20180613171156.240889-1-edumazet@google.com>
On Wed, Jun 13, 2018 at 10:11:56AM -0700, Eric Dumazet wrote:
> It is a waste of memory to use a full "struct netns_sysctl_ipv6"
> while only one pointer is really used, considering netns_sysctl_ipv6
> keeps growing.
>
> Also, since "struct netns_frags" has cache line alignment,
> it is better to move the frags_hdr pointer outside, otherwise
> we spend a full cache line for this pointer.
>
> This saves 192 bytes of memory per netns.
Also applied, thanks.
^ permalink raw reply
* Re: KASAN: use-after-free Read in fib6_table_lookup
From: Eric Dumazet @ 2018-06-18 12:14 UTC (permalink / raw)
To: syzbot, davem, kuznet, linux-kernel, netdev, syzkaller-bugs,
David Ahern
In-Reply-To: <00000000000031e74b056ee45c71@google.com>
On 06/17/2018 11:06 PM, syzbot wrote:
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: f0dc7f9c6dd9 Merge git://git.kernel.org/pub/scm/linux/kern..
> git tree: bpf-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=16725130400000
> kernel config: https://syzkaller.appspot.com/x/.config?x=fa9c20c48788d1c1
> dashboard link: https://syzkaller.appspot.com/bug?extid=9e6d75e3edef427ee888
> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+9e6d75e3edef427ee888@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:188 [inline]
> BUG: KASAN: use-after-free in find_rr_leaf net/ipv6/route.c:705 [inline]
> BUG: KASAN: use-after-free in rt6_select net/ipv6/route.c:761 [inline]
> BUG: KASAN: use-after-free in fib6_table_lookup+0x12b7/0x14d0 net/ipv6/route.c:1823
> Read of size 8 at addr ffff8801b5df2588 by task udevd/1407
>
> overlayfs: unrecognized mount option "Sl�tI��p�5�Wӌ���c��\x14&�\x1ee"\x03�M��q�W����u�r'�v�-br\x10E1n��U(��K�g�==;GZ�� \x18�\x1d\x1e��<��2 N���\x13�������\x19\x05l�\x0f8_��'�%]�]X�7���aNvD�cA��_�\x12(\x0f�"��w��Q��++Q%5�����/��>*4Ϻ��k�{�)<��^\x01r\aΎ�B��b\x1ĕ��(�ӷ�ӌ���l\aå�
> �b��\v������b�@\x04iO^[�A�s��\aN� � �91�¢^[��m�Gc�\x10��\x10�j��\�2G-k\x03��\x16'��UI\x18\x05�\8\x16��\b}0�\x11�.�Gh�P�\x0ew�����U�^9�\���\x17\x05Sݐ�ʊ��n��a]��T�E�����gaj=Zڒ�_kP��l!�Þ\x02���r��s\x0e��.\x12�9��\�D]��b�y$���\x11mQ�\x17����ڨҙM�q��~vX'��6�ň$5��a+^[�.}�\x14U\x11uc9݇o.׃�.S܉I��7\x13�5�e�D8��k��E�M#������m�����Vy����7=jV����\x16:�k[(>M
> #�b���Z秺]k/^�\x19�\x03���৴�\x1e�;�v\x04����^[`G6�m>�\x16��'e0�^[�q
> �s|�wJ�'\x16r\x04A����M�$�^[��r\x170\x14� u�U\x0fU~\x03|��}>P{1\x1eflt��i�1+A� �%۪(7˧Ȯ�?ܟ�\x12����)_�\a����[�w������9W\a�
> �،��\x0e�&B�M�m�\x1a\x122�\x10b֊ɹ�S@�q�
> ��4\x01j�h�%��\fT�'$'�\x05!�ٌt�4C3�g�nypBŔ���o�B�\x19q\v�o�'�}��!�Tp9d\x06˨^[���c��U`}_EҨ��\\x0e\a\x06�I�X�—�q\x18^�7-[\x10��v[�-�_G�\x0eg)�?#~��h
> CPU: 0 PID: 1407 Comm: udevd Not tainted 4.17.0+ #39
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
> <IRQ>
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x1b9/0x294 lib/dump_stack.c:113
> print_address_description+0x6c/0x20b mm/kasan/report.c:256
> kasan_report_error mm/kasan/report.c:354 [inline]
> kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
> __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
> __read_once_size include/linux/compiler.h:188 [inline]
> find_rr_leaf net/ipv6/route.c:705 [inline]
> rt6_select net/ipv6/route.c:761 [inline]
> fib6_table_lookup+0x12b7/0x14d0 net/ipv6/route.c:1823
> ip6_pol_route+0x1c2/0x1020 net/ipv6/route.c:1856
> ip6_pol_route_output+0x54/0x70 net/ipv6/route.c:2082
> fib6_rule_lookup+0x211/0x6d0 net/ipv6/fib6_rules.c:122
> ip6_route_output_flags+0x2c5/0x350 net/ipv6/route.c:2110
> ip6_route_output include/net/ip6_route.h:82 [inline]
> icmpv6_xrlim_allow net/ipv6/icmp.c:211 [inline]
> icmp6_send+0x147c/0x2da0 net/ipv6/icmp.c:535
> icmpv6_send+0x17a/0x300 net/ipv6/ip6_icmp.c:43
> ip6_link_failure+0xa5/0x790 net/ipv6/route.c:2244
> dst_link_failure include/net/dst.h:427 [inline]
> ndisc_error_report+0xd1/0x1c0 net/ipv6/ndisc.c:695
> neigh_invalidate+0x246/0x550 net/core/neighbour.c:892
> neigh_timer_handler+0xaf9/0xde0 net/core/neighbour.c:978
> call_timer_fn+0x230/0x940 kernel/time/timer.c:1326
> expire_timers kernel/time/timer.c:1363 [inline]
> __run_timers+0x79e/0xc50 kernel/time/timer.c:1666
> run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
> __do_softirq+0x2e0/0xaf5 kernel/softirq.c:284
> invoke_softirq kernel/softirq.c:364 [inline]
> irq_exit+0x1d1/0x200 kernel/softirq.c:404
> exiting_irq arch/x86/include/asm/apic.h:527 [inline]
> smp_apic_timer_interrupt+0x17e/0x710 arch/x86/kernel/apic/apic.c:1052
> apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
> </IRQ>
> RIP: 0010:strlen+0x5e/0xa0 lib/string.c:482
> Code: 24 00 74 3b 48 bb 00 00 00 00 00 fc ff df 4c 89 e0 48 83 c0 01 48 89 c2 48 89 c1 48 c1 ea 03 83 e1 07 0f b6 14 1a 38 ca 7f 04 <84> d2 75 23 80 38 00 75 de 48 83 c4 08 4c 29 e0 5b 41 5c 5d c3 48
> RSP: 0018:ffff8801af117850 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
> RAX: ffff880197f53bd0 RBX: dffffc0000000000 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: ffffffff81c5b06c RDI: ffff880197f53bc0
> RBP: ffff8801af117868 R08: ffff88019a976540 R09: 0000000000000000
> R10: ffff88019a976540 R11: 0000000000000000 R12: ffff880197f53bc0
> R13: ffff880197f53bc0 R14: ffffffff899e4e90 R15: ffff8801d91c6a00
> strlen include/linux/string.h:267 [inline]
> getname_kernel+0x24/0x370 fs/namei.c:218
> open_exec+0x17/0x70 fs/exec.c:882
> load_elf_binary+0x968/0x5610 fs/binfmt_elf.c:780
> search_binary_handler+0x17d/0x570 fs/exec.c:1653
> exec_binprm fs/exec.c:1695 [inline]
> __do_execve_file.isra.35+0x16fe/0x2710 fs/exec.c:1819
> do_execveat_common fs/exec.c:1866 [inline]
> do_execve fs/exec.c:1883 [inline]
> __do_sys_execve fs/exec.c:1964 [inline]
> __se_sys_execve fs/exec.c:1959 [inline]
> __x64_sys_execve+0x8f/0xc0 fs/exec.c:1959
> do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x7f1576a46207
> Code: 77 19 f4 48 89 d7 44 89 c0 0f 05 48 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 f7 d8 64 41 89 01 eb df b8 3b 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 02 f3 c3 48 8b 15 00 8c 2d 00 f7 d8 64 89 02
> RSP: 002b:00007ffff2784568 EFLAGS: 00000202 ORIG_RAX: 000000000000003b
> RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f1576a46207
> RDX: 0000000001215b10 RSI: 00007ffff2784660 RDI: 00007ffff2785670
> RBP: 0000000000625500 R08: 000000000000589c R09: 000000000000589c
> R10: 0000000000000000 R11: 0000000000000202 R12: 0000000001215b10
> R13: 0000000000000007 R14: 0000000001204250 R15: 0000000000000005
>
> Allocated by task 12188:
> save_stack+0x43/0xd0 mm/kasan/kasan.c:448
> set_track mm/kasan/kasan.c:460 [inline]
> kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
> kmem_cache_alloc_trace+0x152/0x780 mm/slab.c:3620
> kmalloc include/linux/slab.h:513 [inline]
> kzalloc include/linux/slab.h:706 [inline]
> fib6_info_alloc+0xbb/0x280 net/ipv6/ip6_fib.c:152
> ip6_route_info_create+0x782/0x2b50 net/ipv6/route.c:3013
> ip6_route_add+0x23/0xb0 net/ipv6/route.c:3154
> ipv6_route_ioctl+0x5a5/0x760 net/ipv6/route.c:3660
> inet6_ioctl+0x100/0x1f0 net/ipv6/af_inet6.c:546
> sock_do_ioctl+0xe4/0x3e0 net/socket.c:973
> sock_ioctl+0x30d/0x680 net/socket.c:1097
> vfs_ioctl fs/ioctl.c:46 [inline]
> file_ioctl fs/ioctl.c:500 [inline]
> do_vfs_ioctl+0x1cf/0x16f0 fs/ioctl.c:684
> ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
> __do_sys_ioctl fs/ioctl.c:708 [inline]
> __se_sys_ioctl fs/ioctl.c:706 [inline]
> __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706
> do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> Freed by task 1402:
> save_stack+0x43/0xd0 mm/kasan/kasan.c:448
> set_track mm/kasan/kasan.c:460 [inline]
> __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
> kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
> __cache_free mm/slab.c:3498 [inline]
> kfree+0xd9/0x260 mm/slab.c:3813
> fib6_info_destroy+0x29b/0x350 net/ipv6/ip6_fib.c:207
> fib6_info_release include/net/ip6_fib.h:286 [inline]
> __ip6_del_rt_siblings net/ipv6/route.c:3235 [inline]
> ip6_route_del+0x11c4/0x13b0 net/ipv6/route.c:3316
> ipv6_route_ioctl+0x616/0x760 net/ipv6/route.c:3663
> inet6_ioctl+0x100/0x1f0 net/ipv6/af_inet6.c:546
> sock_do_ioctl+0xe4/0x3e0 net/socket.c:973
> sock_ioctl+0x30d/0x680 net/socket.c:1097
> vfs_ioctl fs/ioctl.c:46 [inline]
> file_ioctl fs/ioctl.c:500 [inline]
> do_vfs_ioctl+0x1cf/0x16f0 fs/ioctl.c:684
> ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
> __do_sys_ioctl fs/ioctl.c:708 [inline]
> __se_sys_ioctl fs/ioctl.c:706 [inline]
> __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706
> do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> The buggy address belongs to the object at ffff8801b5df2580
> which belongs to the cache kmalloc-256 of size 256
> The buggy address is located 8 bytes inside of
> 256-byte region [ffff8801b5df2580, ffff8801b5df2680)
> The buggy address belongs to the page:
> page:ffffea0006d77c80 count:1 mapcount:0 mapping:ffff8801da8007c0 index:0xffff8801b5df2e40
> flags: 0x2fffc0000000100(slab)
> raw: 02fffc0000000100 ffffea0006c5cc48 ffffea0007363308 ffff8801da8007c0
> raw: ffff8801b5df2e40 ffff8801b5df2080 0000000100000006 0000000000000000
> page dumped because: kasan: bad access detected
>
> Memory state around the buggy address:
> ffff8801b5df2480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801b5df2500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>> ffff8801b5df2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ^
> ffff8801b5df2600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801b5df2680: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> ==================================================================
>
>
> ---
> This bug is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this bug report. See:
> https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot.
I will test the following fix, and sent it formally.
Fixes: a64efe142f5e ("net/ipv6: introduce fib6_info struct and helpers")
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 5cba71d2dc44b9ea2366725ff68c9f668f639345..71b9043aa0e7995c7e61f17b4493acd99410d1bc 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -170,6 +170,7 @@ struct fib6_info {
unused:3;
struct fib6_nh fib6_nh;
+ struct rcu_head rcu;
};
struct rt6_info {
@@ -273,7 +274,7 @@ static inline void ip6_rt_put(struct rt6_info *rt)
}
struct fib6_info *fib6_info_alloc(gfp_t gfp_flags);
-void fib6_info_destroy(struct fib6_info *f6i);
+void fib6_info_destroy_rcu(struct rcu_head *head);
static inline void fib6_info_hold(struct fib6_info *f6i)
{
@@ -283,7 +284,7 @@ static inline void fib6_info_hold(struct fib6_info *f6i)
static inline void fib6_info_release(struct fib6_info *f6i)
{
if (f6i && atomic_dec_and_test(&f6i->fib6_ref))
- fib6_info_destroy(f6i);
+ call_rcu(&f6i->rcu, fib6_info_destroy_rcu);
}
enum fib6_walk_state {
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 39d1d487eca25faceacbc3619fc6c4c38088d62a..1fb2f3118d60c73433e09f3a71abdbf9a8d92227 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -167,8 +167,9 @@ struct fib6_info *fib6_info_alloc(gfp_t gfp_flags)
return f6i;
}
-void fib6_info_destroy(struct fib6_info *f6i)
+void fib6_info_destroy_rcu(struct rcu_head *head)
{
+ struct fib6_info *f6i = container_of(head, struct fib6_info, rcu);
struct rt6_exception_bucket *bucket;
struct dst_metrics *m;
@@ -206,7 +207,7 @@ void fib6_info_destroy(struct fib6_info *f6i)
kfree(f6i);
}
-EXPORT_SYMBOL_GPL(fib6_info_destroy);
+EXPORT_SYMBOL_GPL(fib6_info_destroy_rcu);
static struct fib6_node *node_alloc(struct net *net)
{
^ permalink raw reply related
* [PATCH net] net/ipv6: respect rcu grace period before freeing fib6_info
From: Eric Dumazet @ 2018-06-18 12:24 UTC (permalink / raw)
To: David S . Miller; +Cc: netdev, Eric Dumazet, Eric Dumazet, David Ahern
syzbot reported use after free that is caused by fib6_info being
freed without a proper RCU grace period.
CPU: 0 PID: 1407 Comm: udevd Not tainted 4.17.0+ #39
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b9/0x294 lib/dump_stack.c:113
print_address_description+0x6c/0x20b mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
__read_once_size include/linux/compiler.h:188 [inline]
find_rr_leaf net/ipv6/route.c:705 [inline]
rt6_select net/ipv6/route.c:761 [inline]
fib6_table_lookup+0x12b7/0x14d0 net/ipv6/route.c:1823
ip6_pol_route+0x1c2/0x1020 net/ipv6/route.c:1856
ip6_pol_route_output+0x54/0x70 net/ipv6/route.c:2082
fib6_rule_lookup+0x211/0x6d0 net/ipv6/fib6_rules.c:122
ip6_route_output_flags+0x2c5/0x350 net/ipv6/route.c:2110
ip6_route_output include/net/ip6_route.h:82 [inline]
icmpv6_xrlim_allow net/ipv6/icmp.c:211 [inline]
icmp6_send+0x147c/0x2da0 net/ipv6/icmp.c:535
icmpv6_send+0x17a/0x300 net/ipv6/ip6_icmp.c:43
ip6_link_failure+0xa5/0x790 net/ipv6/route.c:2244
dst_link_failure include/net/dst.h:427 [inline]
ndisc_error_report+0xd1/0x1c0 net/ipv6/ndisc.c:695
neigh_invalidate+0x246/0x550 net/core/neighbour.c:892
neigh_timer_handler+0xaf9/0xde0 net/core/neighbour.c:978
call_timer_fn+0x230/0x940 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x79e/0xc50 kernel/time/timer.c:1666
run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
__do_softirq+0x2e0/0xaf5 kernel/softirq.c:284
invoke_softirq kernel/softirq.c:364 [inline]
irq_exit+0x1d1/0x200 kernel/softirq.c:404
exiting_irq arch/x86/include/asm/apic.h:527 [inline]
smp_apic_timer_interrupt+0x17e/0x710 arch/x86/kernel/apic/apic.c:1052
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
</IRQ>
RIP: 0010:strlen+0x5e/0xa0 lib/string.c:482
Code: 24 00 74 3b 48 bb 00 00 00 00 00 fc ff df 4c 89 e0 48 83 c0 01 48 89 c2 48 89 c1 48 c1 ea 03 83 e1 07 0f b6 14 1a 38 ca 7f 04 <84> d2 75 23 80 38 00 75 de 48 83 c4 08 4c 29 e0 5b 41 5c 5d c3 48
RSP: 0018:ffff8801af117850 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: ffff880197f53bd0 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81c5b06c RDI: ffff880197f53bc0
RBP: ffff8801af117868 R08: ffff88019a976540 R09: 0000000000000000
R10: ffff88019a976540 R11: 0000000000000000 R12: ffff880197f53bc0
R13: ffff880197f53bc0 R14: ffffffff899e4e90 R15: ffff8801d91c6a00
strlen include/linux/string.h:267 [inline]
getname_kernel+0x24/0x370 fs/namei.c:218
open_exec+0x17/0x70 fs/exec.c:882
load_elf_binary+0x968/0x5610 fs/binfmt_elf.c:780
search_binary_handler+0x17d/0x570 fs/exec.c:1653
exec_binprm fs/exec.c:1695 [inline]
__do_execve_file.isra.35+0x16fe/0x2710 fs/exec.c:1819
do_execveat_common fs/exec.c:1866 [inline]
do_execve fs/exec.c:1883 [inline]
__do_sys_execve fs/exec.c:1964 [inline]
__se_sys_execve fs/exec.c:1959 [inline]
__x64_sys_execve+0x8f/0xc0 fs/exec.c:1959
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f1576a46207
Code: 77 19 f4 48 89 d7 44 89 c0 0f 05 48 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 f7 d8 64 41 89 01 eb df b8 3b 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 02 f3 c3 48 8b 15 00 8c 2d 00 f7 d8 64 89 02
RSP: 002b:00007ffff2784568 EFLAGS: 00000202 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f1576a46207
RDX: 0000000001215b10 RSI: 00007ffff2784660 RDI: 00007ffff2785670
RBP: 0000000000625500 R08: 000000000000589c R09: 000000000000589c
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000001215b10
R13: 0000000000000007 R14: 0000000001204250 R15: 0000000000000005
Allocated by task 12188:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
kmem_cache_alloc_trace+0x152/0x780 mm/slab.c:3620
kmalloc include/linux/slab.h:513 [inline]
kzalloc include/linux/slab.h:706 [inline]
fib6_info_alloc+0xbb/0x280 net/ipv6/ip6_fib.c:152
ip6_route_info_create+0x782/0x2b50 net/ipv6/route.c:3013
ip6_route_add+0x23/0xb0 net/ipv6/route.c:3154
ipv6_route_ioctl+0x5a5/0x760 net/ipv6/route.c:3660
inet6_ioctl+0x100/0x1f0 net/ipv6/af_inet6.c:546
sock_do_ioctl+0xe4/0x3e0 net/socket.c:973
sock_ioctl+0x30d/0x680 net/socket.c:1097
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x1cf/0x16f0 fs/ioctl.c:684
ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
__do_sys_ioctl fs/ioctl.c:708 [inline]
__se_sys_ioctl fs/ioctl.c:706 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 1402:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3498 [inline]
kfree+0xd9/0x260 mm/slab.c:3813
fib6_info_destroy+0x29b/0x350 net/ipv6/ip6_fib.c:207
fib6_info_release include/net/ip6_fib.h:286 [inline]
__ip6_del_rt_siblings net/ipv6/route.c:3235 [inline]
ip6_route_del+0x11c4/0x13b0 net/ipv6/route.c:3316
ipv6_route_ioctl+0x616/0x760 net/ipv6/route.c:3663
inet6_ioctl+0x100/0x1f0 net/ipv6/af_inet6.c:546
sock_do_ioctl+0xe4/0x3e0 net/socket.c:973
sock_ioctl+0x30d/0x680 net/socket.c:1097
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x1cf/0x16f0 fs/ioctl.c:684
ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
__do_sys_ioctl fs/ioctl.c:708 [inline]
__se_sys_ioctl fs/ioctl.c:706 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8801b5df2580
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 8 bytes inside of
256-byte region [ffff8801b5df2580, ffff8801b5df2680)
The buggy address belongs to the page:
page:ffffea0006d77c80 count:1 mapcount:0 mapping:ffff8801da8007c0 index:0xffff8801b5df2e40
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea0006c5cc48 ffffea0007363308 ffff8801da8007c0
raw: ffff8801b5df2e40 ffff8801b5df2080 0000000100000006 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801b5df2480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801b5df2500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> ffff8801b5df2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8801b5df2600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801b5df2680: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
Fixes: a64efe142f5e ("net/ipv6: introduce fib6_info struct and helpers")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: David Ahern <dsahern@gmail.com>
Reported-by: syzbot+9e6d75e3edef427ee888@syzkaller.appspotmail.com
---
include/net/ip6_fib.h | 5 +++--
net/ipv6/ip6_fib.c | 5 +++--
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 5cba71d2dc44b9ea2366725ff68c9f668f639345..71b9043aa0e7995c7e61f17b4493acd99410d1bc 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -170,6 +170,7 @@ struct fib6_info {
unused:3;
struct fib6_nh fib6_nh;
+ struct rcu_head rcu;
};
struct rt6_info {
@@ -273,7 +274,7 @@ static inline void ip6_rt_put(struct rt6_info *rt)
}
struct fib6_info *fib6_info_alloc(gfp_t gfp_flags);
-void fib6_info_destroy(struct fib6_info *f6i);
+void fib6_info_destroy_rcu(struct rcu_head *head);
static inline void fib6_info_hold(struct fib6_info *f6i)
{
@@ -283,7 +284,7 @@ static inline void fib6_info_hold(struct fib6_info *f6i)
static inline void fib6_info_release(struct fib6_info *f6i)
{
if (f6i && atomic_dec_and_test(&f6i->fib6_ref))
- fib6_info_destroy(f6i);
+ call_rcu(&f6i->rcu, fib6_info_destroy_rcu);
}
enum fib6_walk_state {
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 39d1d487eca25faceacbc3619fc6c4c38088d62a..1fb2f3118d60c73433e09f3a71abdbf9a8d92227 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -167,8 +167,9 @@ struct fib6_info *fib6_info_alloc(gfp_t gfp_flags)
return f6i;
}
-void fib6_info_destroy(struct fib6_info *f6i)
+void fib6_info_destroy_rcu(struct rcu_head *head)
{
+ struct fib6_info *f6i = container_of(head, struct fib6_info, rcu);
struct rt6_exception_bucket *bucket;
struct dst_metrics *m;
@@ -206,7 +207,7 @@ void fib6_info_destroy(struct fib6_info *f6i)
kfree(f6i);
}
-EXPORT_SYMBOL_GPL(fib6_info_destroy);
+EXPORT_SYMBOL_GPL(fib6_info_destroy_rcu);
static struct fib6_node *node_alloc(struct net *net)
{
--
2.18.0.rc1.244.gcf134e6275-goog
^ permalink raw reply related
* [PATCH] mac80211: fix potential null pointer dereference
From: Gustavo A. R. Silva @ 2018-06-18 12:41 UTC (permalink / raw)
To: Johannes Berg, David S. Miller
Cc: linux-wireless, netdev, linux-kernel, Gustavo A. R. Silva
he_op is being dereferenced before it is null checked, hence there
is a potential null pointer dereference.
Fix this by moving the pointer dereference after he_op has been
properly null checked.
Notice that, currently, he_op is already being null checked before
calling this function at 4593:
4593 if (!he_oper ||
4594 !ieee80211_verify_sta_he_mcs_support(sband, he_oper))
4595 ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
but in case ieee80211_verify_sta_he_mcs_support is ever called
without verifying he_oper is not null, we will end up having a
null pointer dereference. So, we better don't take any chances.
Addresses-Coverity-ID: 1470068 ("Dereference before null check")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
---
net/mac80211/mlme.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0322d78..f451303 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -4458,12 +4458,14 @@ ieee80211_verify_sta_he_mcs_support(struct ieee80211_supported_band *sband,
{
const struct ieee80211_sta_he_cap *sta_he_cap =
ieee80211_get_he_sta_cap(sband);
- u16 ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
+ u16 ap_min_req_set;
int i;
if (!sta_he_cap || !he_op)
return false;
+ ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
+
/* Need to go over for 80MHz, 160MHz and for 80+80 */
for (i = 0; i < 3; i++) {
const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
--
2.7.4
^ permalink raw reply related
* Re: [PATCH 3/6] arcnet: com20020: Add com20020 io mapped version
From: Andrea Greco @ 2018-06-18 12:51 UTC (permalink / raw)
To: David Miller
Cc: kbuild-all, tobin, Andrea Greco, Michael Grzeschik, linux-kernel,
netdev
In-Reply-To: <201806120034.bUpoIKOC%fengguang.wu@intel.com>
On 06/11/2018 06:35 PM, kbuild test robot wrote:
> drivers/net/arcnet/com20020-io.c:34:17: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
> return ioread8((void *__iomem) addr + offset);
> ^
> drivers/net/arcnet/com20020-io.c: In function 'io_arc_outb':
> drivers/net/arcnet/com20020-io.c:39:18: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
> iowrite8(value, (void *__iomem)addr + offset);
> ^
> drivers/net/arcnet/com20020-io.c: In function 'io_arc_insb':
> drivers/net/arcnet/com20020-io.c:44:14: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
> ioread8_rep((void *__iomem) (addr + offset), buffer, count);
> ^
> drivers/net/arcnet/com20020-io.c: In function 'io_arc_outsb':
> drivers/net/arcnet/com20020-io.c:49:15: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
> iowrite8_rep((void *__iomem) (addr + offset), buffer, count);
> ^
> drivers/net/arcnet/com20020-io.c: In function 'com20020_probe':
> drivers/net/arcnet/com20020-io.c:219:11: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
> ioaddr = (int)devm_ioremap(&pdev->dev, iores->start,
> ^
> drivers/net/arcnet/com20020-io.c:288:27: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
> devm_iounmap(&pdev->dev, (void __iomem *)ioaddr);
> ^
Is there some clean way for fix this.
Some architetture int size is 32 bit and ptr is 64, this rise warning,
of spark64 compiler.
Change ioaddr type means introduce a lots of casting in all other driver.
Which is the best way for proceed ?
Andrea
^ permalink raw reply
* Re: Re: [Qemu-devel] [PATCH] qemu: Introduce VIRTIO_NET_F_STANDBY feature bit to virtio_net
From: Cornelia Huck @ 2018-06-18 13:27 UTC (permalink / raw)
To: Michael S. Tsirkin
Cc: Siwei Liu, Samudrala, Sridhar, Alexander Duyck, virtio-dev,
aaron.f.brown, Jiri Pirko, Jakub Kicinski, Netdev, qemu-devel,
virtualization
In-Reply-To: <20180615152926-mutt-send-email-mst@kernel.org>
On Fri, 15 Jun 2018 15:31:43 +0300
"Michael S. Tsirkin" <mst@redhat.com> wrote:
> On Fri, Jun 15, 2018 at 11:32:42AM +0200, Cornelia Huck wrote:
> > On Fri, 15 Jun 2018 05:34:24 +0300
> > "Michael S. Tsirkin" <mst@redhat.com> wrote:
> >
> > > On Thu, Jun 14, 2018 at 12:02:31PM +0200, Cornelia Huck wrote:
> >
> > > > > > I am not all that familiar with how Qemu manages network devices. If we can
> > > > > > do all the
> > > > > > required management of the primary/standby devices within Qemu, that is
> > > > > > definitely a better
> > > > > > approach without upper layer involvement.
> > > > >
> > > > > Right. I would imagine in the extreme case the upper layer doesn't
> > > > > have to be involved at all if QEMU manages all hot plug/unplug logic.
> > > > > The management tool can supply passthrough device and virtio with the
> > > > > same group UUID, QEMU auto-manages the presence of the primary, and
> > > > > hot plug the device as needed before or after the migration.
> > > >
> > > > I do not really see how you can manage that kind of stuff in QEMU only.
> > >
> > > So right now failover is limited to pci passthrough devices only.
> > > The idea is to realize the vfio device but not expose it
> > > to guest. Have a separate command to expose it to guest.
> > > Hotunplug would also hide it from guest but not unrealize it.
> >
> > So, this would not be real hot(un)plug, but 'hide it from the guest',
> > right? The concept of "we have it realized in QEMU, but the guest can't
> > discover and use it" should be translatable to non-pci as well (at
> > least for ccw).
> >
> > >
> > > This will help ensure that e.g. on migration failure we can
> > > re-expose the device without risk of running out of resources.
> >
> > Makes sense.
> >
> > Should that 'hidden' state be visible/settable from outside as well
> > (e.g. via a property)? I guess yes, so that management software has a
> > chance to see whether a device is visible.
>
> Might be handy for debug, but note that since QEMU manages this
> state it's transient: can change at any time, so it's kind
> of hard for management to rely on it.
Might be another reason to have this controlled by management software;
being able to find out easily why a device is not visible to the guest
seems to be a useful thing.
Anyway, let's defer this discussion until it is clear how we actually
want to handle the whole setup.
>
> > Settable may be useful if we
> > find another use case for hiding realized devices.
^ permalink raw reply
* KASAN: use-after-free Read in ipv6_gso_pull_exthdrs
From: syzbot @ 2018-06-18 13:31 UTC (permalink / raw)
To: davem, kuznet, linux-kernel, netdev, syzkaller-bugs, yoshfuji
Hello,
syzbot found the following crash on:
HEAD commit: f0dc7f9c6dd9 Merge git://git.kernel.org/pub/scm/linux/kern..
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1463121f800000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa9c20c48788d1c1
dashboard link: https://syzkaller.appspot.com/bug?extid=7b9ed9872dab8c32305d
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7b9ed9872dab8c32305d@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in ipv6_gso_pull_exthdrs+0x53e/0x5d0
net/ipv6/ip6_offload.c:45
Read of size 1 at addr ffff8801cf0d7769 by task syz-executor0/21808
CPU: 1 PID: 21808 Comm: syz-executor0 Not tainted 4.17.0+ #84
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b9/0x294 lib/dump_stack.c:113
print_address_description+0x6c/0x20b mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
__asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430
ipv6_gso_pull_exthdrs+0x53e/0x5d0 net/ipv6/ip6_offload.c:45
netlink: 48 bytes leftover after parsing attributes in process
`syz-executor6'.
ipv6_gso_segment+0x372/0x11c0 net/ipv6/ip6_offload.c:87
skb_mac_gso_segment+0x3ad/0x720 net/core/dev.c:2792
nsh_gso_segment+0x470/0xb40 net/nsh/nsh.c:111
skb_mac_gso_segment+0x3ad/0x720 net/core/dev.c:2792
__skb_gso_segment+0x3bb/0x870 net/core/dev.c:2865
skb_gso_segment include/linux/netdevice.h:4079 [inline]
validate_xmit_skb+0x638/0xf20 net/core/dev.c:3104
__dev_queue_xmit+0xc0c/0x3900 net/core/dev.c:3561
dev_queue_xmit+0x17/0x20 net/core/dev.c:3602
packet_snd net/packet/af_packet.c:2921 [inline]
packet_sendmsg+0x4275/0x6100 net/packet/af_packet.c:2946
sock_sendmsg_nosec net/socket.c:645 [inline]
sock_sendmsg+0xd5/0x120 net/socket.c:655
__sys_sendto+0x3d7/0x670 net/socket.c:1833
__do_sys_sendto net/socket.c:1845 [inline]
__se_sys_sendto net/socket.c:1841 [inline]
__x64_sys_sendto+0xe1/0x1a0 net/socket.c:1841
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455b29
Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f1665cd0c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f1665cd16d4 RCX: 0000000000455b29
RDX: 000000000000020b RSI: 00000000200016c0 RDI: 0000000000000013
RBP: 000000000072bea0 R08: 00000000200000c0 R09: 000000000000001c
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004c0eb8 R14: 00000000004d0960 R15: 0000000000000000
Allocated by task 21219:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
kmem_cache_alloc+0x12e/0x760 mm/slab.c:3554
getname_flags+0xd0/0x5a0 fs/namei.c:140
user_path_at_empty+0x2d/0x50 fs/namei.c:2555
user_path_at include/linux/namei.h:57 [inline]
do_faccessat+0x24a/0x7c0 fs/open.c:389
__do_sys_access fs/open.c:441 [inline]
__se_sys_access fs/open.c:439 [inline]
__x64_sys_access+0x59/0x80 fs/open.c:439
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 21219:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3498 [inline]
kmem_cache_free+0x86/0x2d0 mm/slab.c:3756
putname+0xf2/0x130 fs/namei.c:261
filename_lookup+0x38b/0x4f0 fs/namei.c:2330
user_path_at_empty+0x40/0x50 fs/namei.c:2555
user_path_at include/linux/namei.h:57 [inline]
do_faccessat+0x24a/0x7c0 fs/open.c:389
__do_sys_access fs/open.c:441 [inline]
__se_sys_access fs/open.c:439 [inline]
__x64_sys_access+0x59/0x80 fs/open.c:439
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8801cf0d6d00
which belongs to the cache names_cache of size 4096
The buggy address is located 2665 bytes inside of
4096-byte region [ffff8801cf0d6d00, ffff8801cf0d7d00)
The buggy address belongs to the page:
page:ffffea00073c3580 count:1 mapcount:0 mapping:ffff8801da986dc0 index:0x0
compound_mapcount: 0
flags: 0x2fffc0000008100(slab|head)
raw: 02fffc0000008100 ffffea00073c3508 ffffea0006a10008 ffff8801da986dc0
raw: 0000000000000000 ffff8801cf0d6d00 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801cf0d7600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801cf0d7680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801cf0d7700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8801cf0d7780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801cf0d7800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
^ permalink raw reply
* [PATCH net] ipvlan: call dev_change_flags when reset ipvlan mode
From: Hangbin Liu @ 2018-06-18 14:04 UTC (permalink / raw)
To: netdev
Cc: Stefano Brivio, Paolo Abeni, David Miller, Mahesh Bandewar,
Hangbin Liu
After we change the ipvlan mode from l3 to l2, or vice versa. We only
reset IFF_NOARP flag, but don't flush the ARP table cache, which will
cause eth->h_dest to be equal to eth->h_source in ipvlan_xmit_mode_l2().
Then the message will not come out of host.
Here is the reproducer on local host:
ip link set eth1 up
ip addr add 192.168.1.1/24 dev eth1
ip link add link eth1 ipvlan1 type ipvlan mode l3
ip netns add net1
ip link set ipvlan1 netns net1
ip netns exec net1 ip link set ipvlan1 up
ip netns exec net1 ip addr add 192.168.2.1/24 dev ipvlan1
ip route add 192.168.2.0/24 via 192.168.1.2
ping 192.168.2.2 -c 2
ip netns exec net1 ip link set ipvlan1 type ipvlan mode l2
ping 192.168.2.2 -c 2
Add the same configuration on remote host. After we set the mode to l2,
we could find that the src/dst MAC addresses are the same on eth1:
21:26:06.648565 00:b7:13:ad:d3:05 > 00:b7:13:ad:d3:05, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 58356, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.2.1 > 192.168.2.2: ICMP echo request, id 22686, seq 1, length 64
Fix this by calling dev_change_flags(), which will call netdevice notifier
with flag change info.
Reported-by: Jianlin Shi <jishi@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
---
drivers/net/ipvlan/ipvlan_main.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 4377c26..368712b 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -75,6 +75,7 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval)
{
struct ipvl_dev *ipvlan;
struct net_device *mdev = port->dev;
+ unsigned int flags;
int err = 0;
ASSERT_RTNL();
@@ -94,10 +95,13 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval)
mdev->l3mdev_ops = NULL;
}
list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
+ flags = ipvlan->dev->flags;
if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S)
- ipvlan->dev->flags |= IFF_NOARP;
+ dev_change_flags(ipvlan->dev,
+ flags | IFF_NOARP);
else
- ipvlan->dev->flags &= ~IFF_NOARP;
+ dev_change_flags(ipvlan->dev,
+ flags & ~IFF_NOARP);
}
port->mode = nval;
}
--
2.5.5
^ permalink raw reply related
* Pending payments
From: hotels @ 2018-06-18 10:20 UTC (permalink / raw)
[-- Attachment #1: Type: text/plain, Size: 159 bytes --]
Dear Sir,
Please find the attached copy of pending bills payment FYI and NA. this
is for the month of APR-18
Please release the payment ASAP.
Best Regards,
[-- Attachment #2: Pending bill of Apr.zip --]
[-- Type: application/zip, Size: 209047 bytes --]
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox