* WARNING: ODEBUG bug in netdev_freemem (2)
From: syzbot @ 2019-06-24 8:53 UTC (permalink / raw)
To: alexander.h.duyck, amritha.nambiar, andriy.shevchenko, davem,
dmitry.torokhov, f.fainelli, gregkh, idosch, linux-kernel, netdev,
syzkaller-bugs, tglx, tyhicks, wanghai26, yuehaibing
Hello,
syzbot found the following crash on:
HEAD commit: fd6b99fa Merge branch 'akpm' (patches from Andrew)
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=144de256a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa9f7e1b6a8bb586
dashboard link: https://syzkaller.appspot.com/bug?extid=c4521ac872a4ccc3afec
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c4521ac872a4ccc3afec@syzkaller.appspotmail.com
device hsr_slave_0 left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
bond0 (unregistering): Releasing backup interface bond_slave_1
bond0 (unregistering): Releasing backup interface bond_slave_0
bond0 (unregistering): Released all slaves
------------[ cut here ]------------
ODEBUG: free active (active state 0) object type: timer_list hint:
delayed_work_timer_fn+0x0/0x90 arch/x86/include/asm/paravirt.h:767
WARNING: CPU: 1 PID: 25149 at lib/debugobjects.c:325
debug_print_object+0x168/0x250 lib/debugobjects.c:325
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 25149 Comm: kworker/u4:1 Not tainted 5.2.0-rc4+ #31
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
panic+0x2cb/0x744 kernel/panic.c:219
__warn.cold+0x20/0x4d kernel/panic.c:576
report_bug+0x263/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:179 [inline]
fixup_bug arch/x86/kernel/traps.c:174 [inline]
do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272
do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:986
RIP: 0010:debug_print_object+0x168/0x250 lib/debugobjects.c:325
Code: dd e0 c9 a4 87 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b5 00 00 00 48
8b 14 dd e0 c9 a4 87 48 c7 c7 80 bf a4 87 e8 16 75 0d fe <0f> 0b 83 05 4b
46 4b 06 01 48 83 c4 20 5b 41 5c 41 5d 41 5e 5d c3
RSP: 0018:ffff888058c07838 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff815ac956 RDI: ffffed100b180ef9
RBP: ffff888058c07878 R08: ffff88805692a340 R09: ffffed1015d240f1
R10: ffffed1015d240f0 R11: ffff8880ae920787 R12: 0000000000000001
R13: ffffffff88bad1a0 R14: ffffffff816039d0 R15: ffff88805f992e60
__debug_check_no_obj_freed lib/debugobjects.c:785 [inline]
debug_check_no_obj_freed+0x29f/0x464 lib/debugobjects.c:817
kfree+0xbd/0x220 mm/slab.c:3754
kvfree+0x61/0x70 mm/util.c:460
netdev_freemem+0x4c/0x60 net/core/dev.c:9070
netdev_release+0x86/0xb0 net/core/net-sysfs.c:1635
device_release+0x7a/0x210 drivers/base/core.c:1064
kobject_cleanup lib/kobject.c:691 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put.cold+0x289/0x2e6 lib/kobject.c:737
netdev_run_todo+0x53b/0x7c0 net/core/dev.c:8975
rtnl_unlock+0xe/0x10 net/core/rtnetlink.c:112
default_device_exit_batch+0x358/0x410 net/core/dev.c:9756
ops_exit_list.isra.0+0xfc/0x150 net/core/net_namespace.c:157
cleanup_net+0x3fb/0x960 net/core/net_namespace.c:553
process_one_work+0x989/0x1790 kernel/workqueue.c:2269
worker_thread+0x98/0xe40 kernel/workqueue.c:2415
kthread+0x354/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
======================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply
* [PATCH v2 net-next 4/4] cxgb4: Add MPS refcounting for alloc/free mac filters
From: Raju Rangoju @ 2019-06-24 8:50 UTC (permalink / raw)
To: netdev, davem; +Cc: nirranjan, dt, rajur
In-Reply-To: <20190624085037.2358-1-rajur@chelsio.com>
This patch adds reference counting support for
alloc/free mac filters
Signed-off-by: Raju Rangoju <rajur@chelsio.com>
---
drivers/net/ethernet/chelsio/cxgb4/cxgb4.h | 6 +++
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 12 +++--
drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c | 72 +++++++++++++++++++++++++
3 files changed, 87 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index 6260240743d5..1fbb640e896a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -1915,6 +1915,12 @@ int cxgb4_change_mac(struct port_info *pi, unsigned int viid,
int *tcam_idx, const u8 *addr,
bool persistent, u8 *smt_idx);
+int cxgb4_alloc_mac_filt(struct adapter *adap, unsigned int viid,
+ bool free, unsigned int naddr,
+ const u8 **addr, u16 *idx,
+ u64 *hash, bool sleep_ok);
+int cxgb4_free_mac_filt(struct adapter *adap, unsigned int viid,
+ unsigned int naddr, const u8 **addr, bool sleep_ok);
int cxgb4_init_mps_ref_entries(struct adapter *adap);
void cxgb4_free_mps_ref_entries(struct adapter *adap);
int cxgb4_alloc_encap_mac_filt(struct adapter *adap, unsigned int viid,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 1520e5294289..b08efc48d42f 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -366,13 +366,19 @@ static int cxgb4_mac_sync(struct net_device *netdev, const u8 *mac_addr)
int ret;
u64 mhash = 0;
u64 uhash = 0;
+ /* idx stores the index of allocated filters,
+ * its size should be modified based on the number of
+ * MAC addresses that we allocate filters for
+ */
+
+ u16 idx[1] = {};
bool free = false;
bool ucast = is_unicast_ether_addr(mac_addr);
const u8 *maclist[1] = {mac_addr};
struct hash_mac_addr *new_entry;
- ret = t4_alloc_mac_filt(adap, adap->mbox, pi->viid, free, 1, maclist,
- NULL, ucast ? &uhash : &mhash, false);
+ ret = cxgb4_alloc_mac_filt(adap, pi->viid, free, 1, maclist,
+ idx, ucast ? &uhash : &mhash, false);
if (ret < 0)
goto out;
/* if hash != 0, then add the addr to hash addr list
@@ -410,7 +416,7 @@ static int cxgb4_mac_unsync(struct net_device *netdev, const u8 *mac_addr)
}
}
- ret = t4_free_mac_filt(adap, adap->mbox, pi->viid, 1, maclist, false);
+ ret = cxgb4_free_mac_filt(adap, pi->viid, 1, maclist, false);
return ret < 0 ? -EINVAL : 0;
}
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c
index f9d2271c0706..f18388e4e95b 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c
@@ -3,6 +3,31 @@
#include "cxgb4.h"
+static int cxgb4_mps_ref_dec_by_mac(struct adapter *adap,
+ const u8 *addr, const u8 *mask)
+{
+ u8 bitmask[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+ struct mps_entries_ref *mps_entry, *tmp;
+ int ret = -EINVAL;
+
+ spin_lock_bh(&adap->mps_ref_lock);
+ list_for_each_entry_safe(mps_entry, tmp, &adap->mps_ref, list) {
+ if (ether_addr_equal(mps_entry->addr, addr) &&
+ ether_addr_equal(mps_entry->mask, mask ? mask : bitmask)) {
+ if (!atomic_dec_and_test(&mps_entry->refcnt)) {
+ spin_unlock_bh(&adap->mps_ref_lock);
+ return -EBUSY;
+ }
+ list_del(&mps_entry->list);
+ kfree(mps_entry);
+ ret = 0;
+ break;
+ }
+ }
+ spin_unlock_bh(&adap->mps_ref_lock);
+ return ret;
+}
+
static int cxgb4_mps_ref_dec(struct adapter *adap, u16 idx)
{
struct mps_entries_ref *mps_entry, *tmp;
@@ -54,6 +79,53 @@ static int cxgb4_mps_ref_inc(struct adapter *adap, const u8 *mac_addr,
return ret;
}
+int cxgb4_free_mac_filt(struct adapter *adap, unsigned int viid,
+ unsigned int naddr, const u8 **addr, bool sleep_ok)
+{
+ int ret, i;
+
+ for (i = 0; i < naddr; i++) {
+ if (!cxgb4_mps_ref_dec_by_mac(adap, addr[i], NULL)) {
+ ret = t4_free_mac_filt(adap, adap->mbox, viid,
+ 1, &addr[i], sleep_ok);
+ if (ret < 0)
+ return ret;
+ }
+ }
+
+ /* return number of filters freed */
+ return naddr;
+}
+
+int cxgb4_alloc_mac_filt(struct adapter *adap, unsigned int viid,
+ bool free, unsigned int naddr, const u8 **addr,
+ u16 *idx, u64 *hash, bool sleep_ok)
+{
+ int ret, i;
+
+ ret = t4_alloc_mac_filt(adap, adap->mbox, viid, free,
+ naddr, addr, idx, hash, sleep_ok);
+ if (ret < 0)
+ return ret;
+
+ for (i = 0; i < naddr; i++) {
+ if (idx[i] != 0xffff) {
+ if (cxgb4_mps_ref_inc(adap, addr[i], idx[i], NULL)) {
+ ret = -ENOMEM;
+ goto error;
+ }
+ }
+ }
+
+ goto out;
+error:
+ cxgb4_free_mac_filt(adap, viid, naddr, addr, sleep_ok);
+
+out:
+ /* Returns a negative error number or the number of filters allocated */
+ return ret;
+}
+
int cxgb4_update_mac_filt(struct port_info *pi, unsigned int viid,
int *tcam_idx, const u8 *addr,
bool persistent, u8 *smt_idx)
--
2.12.0
^ permalink raw reply related
* [PATCH v2 net-next 3/4] cxgb4: Add MPS TCAM refcounting for cxgb4 change mac
From: Raju Rangoju @ 2019-06-24 8:50 UTC (permalink / raw)
To: netdev, davem; +Cc: nirranjan, dt, rajur
In-Reply-To: <20190624085037.2358-1-rajur@chelsio.com>
This patch adds TCAM reference counting
support for cxgb4 change mac path
Signed-off-by: Raju Rangoju <rajur@chelsio.com>
---
drivers/net/ethernet/chelsio/cxgb4/cxgb4.h | 7 +++++++
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 14 +++++++-------
drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c | 15 +++++++++++++++
3 files changed, 29 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index c7ab57fd03be..6260240743d5 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -1911,6 +1911,10 @@ int cxgb4_set_msix_aff(struct adapter *adap, unsigned short vec,
cpumask_var_t *aff_mask, int idx);
void cxgb4_clear_msix_aff(unsigned short vec, cpumask_var_t aff_mask);
+int cxgb4_change_mac(struct port_info *pi, unsigned int viid,
+ int *tcam_idx, const u8 *addr,
+ bool persistent, u8 *smt_idx);
+
int cxgb4_init_mps_ref_entries(struct adapter *adap);
void cxgb4_free_mps_ref_entries(struct adapter *adap);
int cxgb4_alloc_encap_mac_filt(struct adapter *adap, unsigned int viid,
@@ -1935,5 +1939,8 @@ int cxgb4_alloc_raw_mac_filt(struct adapter *adap,
u8 lookup_type,
u8 port_id,
bool sleep_ok);
+int cxgb4_update_mac_filt(struct port_info *pi, unsigned int viid,
+ int *tcam_idx, const u8 *addr,
+ bool persistent, u8 *smt_idx);
#endif /* __CXGB4_H__ */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 4632827f05ba..1520e5294289 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -449,9 +449,9 @@ static int set_rxmode(struct net_device *dev, int mtu, bool sleep_ok)
* Addresses are programmed to hash region, if tcam runs out of entries.
*
*/
-static int cxgb4_change_mac(struct port_info *pi, unsigned int viid,
- int *tcam_idx, const u8 *addr, bool persist,
- u8 *smt_idx)
+int cxgb4_change_mac(struct port_info *pi, unsigned int viid,
+ int *tcam_idx, const u8 *addr, bool persist,
+ u8 *smt_idx)
{
struct adapter *adapter = pi->adapter;
struct hash_mac_addr *entry, *new_entry;
@@ -505,8 +505,8 @@ static int link_start(struct net_device *dev)
ret = t4_set_rxmode(pi->adapter, mb, pi->viid, dev->mtu, -1, -1, -1,
!!(dev->features & NETIF_F_HW_VLAN_CTAG_RX), true);
if (ret == 0)
- ret = cxgb4_change_mac(pi, pi->viid, &pi->xact_addr_filt,
- dev->dev_addr, true, &pi->smt_idx);
+ ret = cxgb4_update_mac_filt(pi, pi->viid, &pi->xact_addr_filt,
+ dev->dev_addr, true, &pi->smt_idx);
if (ret == 0)
ret = t4_link_l1cfg(pi->adapter, mb, pi->tx_chan,
&pi->link_cfg);
@@ -3020,8 +3020,8 @@ static int cxgb_set_mac_addr(struct net_device *dev, void *p)
if (!is_valid_ether_addr(addr->sa_data))
return -EADDRNOTAVAIL;
- ret = cxgb4_change_mac(pi, pi->viid, &pi->xact_addr_filt,
- addr->sa_data, true, &pi->smt_idx);
+ ret = cxgb4_update_mac_filt(pi, pi->viid, &pi->xact_addr_filt,
+ addr->sa_data, true, &pi->smt_idx);
if (ret < 0)
return ret;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c
index 87939638e8fc..f9d2271c0706 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c
@@ -54,6 +54,21 @@ static int cxgb4_mps_ref_inc(struct adapter *adap, const u8 *mac_addr,
return ret;
}
+int cxgb4_update_mac_filt(struct port_info *pi, unsigned int viid,
+ int *tcam_idx, const u8 *addr,
+ bool persistent, u8 *smt_idx)
+{
+ int ret;
+
+ ret = cxgb4_change_mac(pi, viid, tcam_idx,
+ addr, persistent, smt_idx);
+ if (ret < 0)
+ return ret;
+
+ cxgb4_mps_ref_inc(pi->adapter, addr, *tcam_idx, NULL);
+ return ret;
+}
+
int cxgb4_free_raw_mac_filt(struct adapter *adap,
unsigned int viid,
const u8 *addr,
--
2.12.0
^ permalink raw reply related
* [PATCH v2 net-next 2/4] cxgb4: Add MPS TCAM refcounting for raw mac filters
From: Raju Rangoju @ 2019-06-24 8:50 UTC (permalink / raw)
To: netdev, davem; +Cc: nirranjan, dt, rajur
In-Reply-To: <20190624085037.2358-1-rajur@chelsio.com>
This patch adds TCAM reference counting
support for raw mac filters.
Signed-off-by: Raju Rangoju <rajur@chelsio.com>
---
drivers/net/ethernet/chelsio/cxgb4/cxgb4.h | 16 +++++++++
drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c | 46 ++++++++++++++++++++++++++
2 files changed, 62 insertions(+)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index 39ccd4c64d48..c7ab57fd03be 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -1919,5 +1919,21 @@ int cxgb4_alloc_encap_mac_filt(struct adapter *adap, unsigned int viid,
u8 dip_hit, u8 lookup_type, bool sleep_ok);
int cxgb4_free_encap_mac_filt(struct adapter *adap, unsigned int viid,
int idx, bool sleep_ok);
+int cxgb4_free_raw_mac_filt(struct adapter *adap,
+ unsigned int viid,
+ const u8 *addr,
+ const u8 *mask,
+ unsigned int idx,
+ u8 lookup_type,
+ u8 port_id,
+ bool sleep_ok);
+int cxgb4_alloc_raw_mac_filt(struct adapter *adap,
+ unsigned int viid,
+ const u8 *addr,
+ const u8 *mask,
+ unsigned int idx,
+ u8 lookup_type,
+ u8 port_id,
+ bool sleep_ok);
#endif /* __CXGB4_H__ */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c
index ab8f1ade981a..87939638e8fc 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c
@@ -54,6 +54,52 @@ static int cxgb4_mps_ref_inc(struct adapter *adap, const u8 *mac_addr,
return ret;
}
+int cxgb4_free_raw_mac_filt(struct adapter *adap,
+ unsigned int viid,
+ const u8 *addr,
+ const u8 *mask,
+ unsigned int idx,
+ u8 lookup_type,
+ u8 port_id,
+ bool sleep_ok)
+{
+ int ret = 0;
+
+ if (!cxgb4_mps_ref_dec(adap, idx))
+ ret = t4_free_raw_mac_filt(adap, viid, addr,
+ mask, idx, lookup_type,
+ port_id, sleep_ok);
+
+ return ret;
+}
+
+int cxgb4_alloc_raw_mac_filt(struct adapter *adap,
+ unsigned int viid,
+ const u8 *addr,
+ const u8 *mask,
+ unsigned int idx,
+ u8 lookup_type,
+ u8 port_id,
+ bool sleep_ok)
+{
+ int ret;
+
+ ret = t4_alloc_raw_mac_filt(adap, viid, addr,
+ mask, idx, lookup_type,
+ port_id, sleep_ok);
+ if (ret < 0)
+ return ret;
+
+ if (cxgb4_mps_ref_inc(adap, addr, ret, mask)) {
+ ret = -ENOMEM;
+ t4_free_raw_mac_filt(adap, viid, addr,
+ mask, idx, lookup_type,
+ port_id, sleep_ok);
+ }
+
+ return ret;
+}
+
int cxgb4_free_encap_mac_filt(struct adapter *adap, unsigned int viid,
int idx, bool sleep_ok)
{
--
2.12.0
^ permalink raw reply related
* [PATCH v2 net-next 1/4] cxgb4: Re-work the logic for mps refcounting
From: Raju Rangoju @ 2019-06-24 8:50 UTC (permalink / raw)
To: netdev, davem; +Cc: nirranjan, dt, rajur
In-Reply-To: <20190624085037.2358-1-rajur@chelsio.com>
Remove existing mps refcounting code which was
added only for encap filters and add necessary
data structures/functions to support mps reference
counting for all the mac filters. Also add wrapper
functions for allocating and freeing encap mac
filters.
Signed-off-by: Raju Rangoju <rajur@chelsio.com>
---
drivers/net/ethernet/chelsio/cxgb4/Makefile | 2 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4.h | 24 ++++-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 8 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 14 +--
drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c | 109 ++++++++++++++++++++++
5 files changed, 135 insertions(+), 22 deletions(-)
create mode 100644 drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c
diff --git a/drivers/net/ethernet/chelsio/cxgb4/Makefile b/drivers/net/ethernet/chelsio/cxgb4/Makefile
index 91d8a885deba..20390f6afbb4 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/Makefile
+++ b/drivers/net/ethernet/chelsio/cxgb4/Makefile
@@ -7,7 +7,7 @@ obj-$(CONFIG_CHELSIO_T4) += cxgb4.o
cxgb4-objs := cxgb4_main.o l2t.o smt.o t4_hw.o sge.o clip_tbl.o cxgb4_ethtool.o \
cxgb4_uld.o srq.o sched.o cxgb4_filter.o cxgb4_tc_u32.o \
- cxgb4_ptp.o cxgb4_tc_flower.o cxgb4_cudbg.o \
+ cxgb4_ptp.o cxgb4_tc_flower.o cxgb4_cudbg.o cxgb4_mps.o \
cudbg_common.o cudbg_lib.o cudbg_zlib.o
cxgb4-$(CONFIG_CHELSIO_T4_DCB) += cxgb4_dcb.o
cxgb4-$(CONFIG_CHELSIO_T4_FCOE) += cxgb4_fcoe.o
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index db2ec46ba6b6..39ccd4c64d48 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -905,10 +905,6 @@ struct mbox_list {
struct list_head list;
};
-struct mps_encap_entry {
- atomic_t refcnt;
-};
-
#if IS_ENABLED(CONFIG_THERMAL)
struct ch_thermal {
struct thermal_zone_device *tzdev;
@@ -917,6 +913,14 @@ struct ch_thermal {
};
#endif
+struct mps_entries_ref {
+ struct list_head list;
+ u8 addr[ETH_ALEN];
+ u8 mask[ETH_ALEN];
+ u16 idx;
+ refcount_t refcnt;
+};
+
struct adapter {
void __iomem *regs;
void __iomem *bar2;
@@ -969,7 +973,6 @@ struct adapter {
unsigned int rawf_start;
unsigned int rawf_cnt;
struct smt_data *smt;
- struct mps_encap_entry *mps_encap;
struct cxgb4_uld_info *uld;
void *uld_handle[CXGB4_ULD_MAX];
unsigned int num_uld;
@@ -977,6 +980,8 @@ struct adapter {
struct list_head list_node;
struct list_head rcu_node;
struct list_head mac_hlist; /* list of MAC addresses in MPS Hash */
+ struct list_head mps_ref;
+ spinlock_t mps_ref_lock; /* lock for syncing mps ref/def activities */
void *iscsi_ppm;
@@ -1906,4 +1911,13 @@ int cxgb4_set_msix_aff(struct adapter *adap, unsigned short vec,
cpumask_var_t *aff_mask, int idx);
void cxgb4_clear_msix_aff(unsigned short vec, cpumask_var_t aff_mask);
+int cxgb4_init_mps_ref_entries(struct adapter *adap);
+void cxgb4_free_mps_ref_entries(struct adapter *adap);
+int cxgb4_alloc_encap_mac_filt(struct adapter *adap, unsigned int viid,
+ const u8 *addr, const u8 *mask,
+ unsigned int vni, unsigned int vni_mask,
+ u8 dip_hit, u8 lookup_type, bool sleep_ok);
+int cxgb4_free_encap_mac_filt(struct adapter *adap, unsigned int viid,
+ int idx, bool sleep_ok);
+
#endif /* __CXGB4_H__ */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
index 6232236d7abc..43b0f8c57da7 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
@@ -727,10 +727,8 @@ void clear_filter(struct adapter *adap, struct filter_entry *f)
cxgb4_smt_release(f->smt);
if (f->fs.val.encap_vld && f->fs.val.ovlan_vld)
- if (atomic_dec_and_test(&adap->mps_encap[f->fs.val.ovlan &
- 0x1ff].refcnt))
- t4_free_encap_mac_filt(adap, pi->viid,
- f->fs.val.ovlan & 0x1ff, 0);
+ t4_free_encap_mac_filt(adap, pi->viid,
+ f->fs.val.ovlan & 0x1ff, 0);
if ((f->fs.hash || is_t6(adap->params.chip)) && f->fs.type)
cxgb4_clip_release(f->dev, (const u32 *)&f->fs.val.lip, 1);
@@ -1177,7 +1175,6 @@ static int cxgb4_set_hash_filter(struct net_device *dev,
if (ret < 0)
goto free_atid;
- atomic_inc(&adapter->mps_encap[ret].refcnt);
f->fs.val.ovlan = ret;
f->fs.mask.ovlan = 0xffff;
f->fs.val.ovlan_vld = 1;
@@ -1420,7 +1417,6 @@ int __cxgb4_set_filter(struct net_device *dev, int filter_id,
if (ret < 0)
goto free_clip;
- atomic_inc(&adapter->mps_encap[ret].refcnt);
f->fs.val.ovlan = ret;
f->fs.mask.ovlan = 0x1ff;
f->fs.val.ovlan_vld = 1;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 54908002c786..4632827f05ba 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -3273,8 +3273,6 @@ static void cxgb_del_udp_tunnel(struct net_device *netdev,
i);
return;
}
- atomic_dec(&adapter->mps_encap[adapter->rawf_start +
- pi->port_id].refcnt);
}
}
@@ -3363,7 +3361,6 @@ static void cxgb_add_udp_tunnel(struct net_device *netdev,
cxgb_del_udp_tunnel(netdev, ti);
return;
}
- atomic_inc(&adapter->mps_encap[ret].refcnt);
}
}
@@ -5446,7 +5443,6 @@ static void free_some_resources(struct adapter *adapter)
{
unsigned int i;
- kvfree(adapter->mps_encap);
kvfree(adapter->smt);
kvfree(adapter->l2t);
kvfree(adapter->srq);
@@ -5972,12 +5968,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
adapter->params.offload = 0;
}
- adapter->mps_encap = kvcalloc(adapter->params.arch.mps_tcam_size,
- sizeof(struct mps_encap_entry),
- GFP_KERNEL);
- if (!adapter->mps_encap)
- dev_warn(&pdev->dev, "could not allocate MPS Encap entries, continuing\n");
-
#if IS_ENABLED(CONFIG_IPV6)
if (chip_ver <= CHELSIO_T5 &&
(!(t4_read_reg(adapter, LE_DB_CONFIG_A) & ASLIPCOMPEN_F))) {
@@ -6053,6 +6043,8 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
/* check for PCI Express bandwidth capabiltites */
pcie_print_link_status(pdev);
+ cxgb4_init_mps_ref_entries(adapter);
+
err = init_rss(adapter);
if (err)
goto out_free_dev;
@@ -6179,6 +6171,8 @@ static void remove_one(struct pci_dev *pdev)
disable_interrupts(adapter);
+ cxgb4_free_mps_ref_entries(adapter);
+
for_each_port(adapter, i)
if (adapter->port[i]->reg_state == NETREG_REGISTERED)
unregister_netdev(adapter->port[i]);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c
new file mode 100644
index 000000000000..ab8f1ade981a
--- /dev/null
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2019 Chelsio Communications, Inc. All rights reserved. */
+
+#include "cxgb4.h"
+
+static int cxgb4_mps_ref_dec(struct adapter *adap, u16 idx)
+{
+ struct mps_entries_ref *mps_entry, *tmp;
+ int ret = -EINVAL;
+
+ spin_lock(&adap->mps_ref_lock);
+ list_for_each_entry_safe(mps_entry, tmp, &adap->mps_ref, list) {
+ if (mps_entry->idx == idx) {
+ if (!refcount_dec_and_test(&mps_entry->refcnt)) {
+ spin_unlock(&adap->mps_ref_lock);
+ return -EBUSY;
+ }
+ list_del(&mps_entry->list);
+ kfree(mps_entry);
+ ret = 0;
+ break;
+ }
+ }
+ spin_unlock(&adap->mps_ref_lock);
+ return ret;
+}
+
+static int cxgb4_mps_ref_inc(struct adapter *adap, const u8 *mac_addr,
+ u16 idx, const u8 *mask)
+{
+ u8 bitmask[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+ struct mps_entries_ref *mps_entry;
+ int ret = 0;
+
+ spin_lock_bh(&adap->mps_ref_lock);
+ list_for_each_entry(mps_entry, &adap->mps_ref, list) {
+ if (mps_entry->idx == idx) {
+ refcount_inc(&mps_entry->refcnt);
+ goto unlock;
+ }
+ }
+ mps_entry = kzalloc(sizeof(*mps_entry), GFP_ATOMIC);
+ if (!mps_entry) {
+ ret = -ENOMEM;
+ goto unlock;
+ }
+ ether_addr_copy(mps_entry->mask, mask ? mask : bitmask);
+ ether_addr_copy(mps_entry->addr, mac_addr);
+ mps_entry->idx = idx;
+ refcount_set(&mps_entry->refcnt, 1);
+ list_add_tail(&mps_entry->list, &adap->mps_ref);
+unlock:
+ spin_unlock_bh(&adap->mps_ref_lock);
+ return ret;
+}
+
+int cxgb4_free_encap_mac_filt(struct adapter *adap, unsigned int viid,
+ int idx, bool sleep_ok)
+{
+ int ret = 0;
+
+ if (!cxgb4_mps_ref_dec(adap, idx))
+ ret = t4_free_encap_mac_filt(adap, viid, idx, sleep_ok);
+
+ return ret;
+}
+
+int cxgb4_alloc_encap_mac_filt(struct adapter *adap, unsigned int viid,
+ const u8 *addr, const u8 *mask,
+ unsigned int vni, unsigned int vni_mask,
+ u8 dip_hit, u8 lookup_type, bool sleep_ok)
+{
+ int ret;
+
+ ret = t4_alloc_encap_mac_filt(adap, viid, addr, mask, vni, vni_mask,
+ dip_hit, lookup_type, sleep_ok);
+ if (ret < 0)
+ return ret;
+
+ if (cxgb4_mps_ref_inc(adap, addr, ret, mask)) {
+ ret = -ENOMEM;
+ t4_free_encap_mac_filt(adap, viid, ret, sleep_ok);
+ }
+ return ret;
+}
+
+int cxgb4_init_mps_ref_entries(struct adapter *adap)
+{
+ spin_lock_init(&adap->mps_ref_lock);
+ INIT_LIST_HEAD(&adap->mps_ref);
+
+ return 0;
+}
+
+void cxgb4_free_mps_ref_entries(struct adapter *adap)
+{
+ struct mps_entries_ref *mps_entry, *tmp;
+
+ if (!list_empty(&adap->mps_ref))
+ return;
+
+ spin_lock(&adap->mps_ref_lock);
+ list_for_each_entry_safe(mps_entry, tmp, &adap->mps_ref, list) {
+ list_del(&mps_entry->list);
+ kfree(mps_entry);
+ }
+ spin_unlock(&adap->mps_ref_lock);
+}
+
--
2.12.0
^ permalink raw reply related
* [PATCH v2 net-next 0/4] cxgb4: Reference count MPS TCAM entries within a PF
From: Raju Rangoju @ 2019-06-24 8:50 UTC (permalink / raw)
To: netdev, davem; +Cc: nirranjan, dt, rajur
Firmware reference counts the MPS TCAM entries by PF and VF,
but it does not do it for usage within a PF or VF. This patch
adds the support to track MPS TCAM entries within a PF.
v1->v2:
Use refcount_t type instead of atomic_t for mps reference count
Raju Rangoju (4):
cxgb4: Re-work the logic for mps refcounting
cxgb4: Add MPS TCAM refcounting for raw mac filters
cxgb4: Add MPS TCAM refcounting for cxgb4 change mac
cxgb4: Add MPS refcounting for alloc/free mac filters
drivers/net/ethernet/chelsio/cxgb4/Makefile | 2 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4.h | 53 ++++-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 8 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 40 ++--
drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c | 242 ++++++++++++++++++++++
5 files changed, 313 insertions(+), 32 deletions(-)
create mode 100644 drivers/net/ethernet/chelsio/cxgb4/cxgb4_mps.c
--
2.12.0
^ permalink raw reply
* Re: KASAN: use-after-free Read in _free_event
From: Alexander Shishkin @ 2019-06-24 8:39 UTC (permalink / raw)
To: syzbot, acme, ast, bpf, daniel, jolsa, kafai, linux-kernel, mingo,
namhyung, netdev, peterz, songliubraving, syzkaller-bugs, yhs,
mark.rutland, alexander.shishkin
In-Reply-To: <000000000000dea828058c0d815d@google.com>
syzbot <syzbot+37100ea87beb0cac28f4@syzkaller.appspotmail.com> writes:
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+37100ea87beb0cac28f4@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: use-after-free in atomic_read
> include/asm-generic/atomic-instrumented.h:26 [inline]
> BUG: KASAN: use-after-free in refcount_sub_and_test_checked+0x87/0x200
> lib/refcount.c:182
> Read of size 4 at addr ffff88804e9f06e0 by task syz-executor.5/13046
Looks exactly like [1]. There's a proposed fix there, too.
[1] https://marc.info/?l=linux-kernel&m=153111554522295
Regards,
--
Alex
^ permalink raw reply
* [PATCH net-next] can: dev: call netif_carrier_off() in register_candev()
From: Rasmus Villemoes @ 2019-06-24 8:34 UTC (permalink / raw)
To: Wolfgang Grandegger, Marc Kleine-Budde, David S. Miller
Cc: Rasmus Villemoes, linux-can@vger.kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
CONFIG_CAN_LEDS is deprecated. When trying to use the generic netdev
trigger as suggested, there's a small inconsistency with the link
property: The LED is on initially, stays on when the device is brought
up, and then turns off (as expected) when the device is brought down.
Make sure the LED always reflects the state of the CAN device.
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
---
drivers/net/can/dev.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index c05e4d50d43d..fad27ace6248 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -1260,6 +1260,7 @@ int register_candev(struct net_device *dev)
return -EINVAL;
dev->rtnl_link_ops = &can_link_ops;
+ netif_carrier_off(dev);
return register_netdev(dev);
}
EXPORT_SYMBOL_GPL(register_candev);
--
2.20.1
^ permalink raw reply related
* Re: [PATCH net] tipc: check msg->req data len in tipc_nl_compat_bearer_disable
From: Eric Dumazet @ 2019-06-24 8:33 UTC (permalink / raw)
To: Xin Long, network dev
Cc: davem, Jon Maloy, Ying Xue, tipc-discussion, syzkaller-bugs
In-Reply-To: <4fd888cb669434b00dce24ace4410524665be285.1561363146.git.lucien.xin@gmail.com>
On 6/24/19 12:59 AM, Xin Long wrote:
> This patch is to fix an uninit-value issue, reported by syzbot:
>
> BUG: KMSAN: uninit-value in memchr+0xce/0x110 lib/string.c:981
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x191/0x1f0 lib/dump_stack.c:113
> kmsan_report+0x130/0x2a0 mm/kmsan/kmsan.c:622
> __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:310
> memchr+0xce/0x110 lib/string.c:981
> string_is_valid net/tipc/netlink_compat.c:176 [inline]
> tipc_nl_compat_bearer_disable+0x2a1/0x480 net/tipc/netlink_compat.c:449
> __tipc_nl_compat_doit net/tipc/netlink_compat.c:327 [inline]
> tipc_nl_compat_doit+0x3ac/0xb00 net/tipc/netlink_compat.c:360
> tipc_nl_compat_handle net/tipc/netlink_compat.c:1178 [inline]
> tipc_nl_compat_recv+0x1b1b/0x27b0 net/tipc/netlink_compat.c:1281
>
> TLV_GET_DATA_LEN() may return a negtive int value, which will be
> used as size_t (becoming a big unsigned long) passed into memchr,
> cause this issue.
>
> Similar to what it does in tipc_nl_compat_bearer_enable(), this
> fix is to return -EINVAL when TLV_GET_DATA_LEN() is negtive in
> tipc_nl_compat_bearer_disable(), as well as in
> tipc_nl_compat_link_stat_dump() and tipc_nl_compat_link_reset_stats().
>
> Reported-by: syzbot+30eaa8bf392f7fafffaf@syzkaller.appspotmail.com
> Signed-off-by: Xin Long <lucien.xin@gmail.com>
Please add an appropriate Fixes: tag, thanks !
^ permalink raw reply
* KASAN: use-after-free Read in _free_event
From: syzbot @ 2019-06-24 8:22 UTC (permalink / raw)
To: acme, alexander.shishkin, ast, bpf, daniel, jolsa, kafai,
linux-kernel, mingo, namhyung, netdev, peterz, songliubraving,
syzkaller-bugs, yhs
Hello,
syzbot found the following crash on:
HEAD commit: abf02e29 Merge tag 'pm-5.2-rc6' of git://git.kernel.org/pu..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=179ccd3aa00000
kernel config: https://syzkaller.appspot.com/x/.config?x=e5c77f8090a3b96b
dashboard link: https://syzkaller.appspot.com/bug?extid=37100ea87beb0cac28f4
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+37100ea87beb0cac28f4@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in atomic_read
include/asm-generic/atomic-instrumented.h:26 [inline]
BUG: KASAN: use-after-free in refcount_sub_and_test_checked+0x87/0x200
lib/refcount.c:182
Read of size 4 at addr ffff88804e9f06e0 by task syz-executor.5/13046
CPU: 1 PID: 13046 Comm: syz-executor.5 Not tainted 5.2.0-rc5+ #38
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:188
__kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
kasan_report+0x12/0x20 mm/kasan/common.c:614
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x123/0x190 mm/kasan/generic.c:191
kasan_check_read+0x11/0x20 mm/kasan/common.c:94
atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
refcount_sub_and_test_checked+0x87/0x200 lib/refcount.c:182
refcount_dec_and_test_checked+0x1b/0x20 lib/refcount.c:220
put_task_struct include/linux/sched/task.h:98 [inline]
_free_event+0x3d5/0x13a0 kernel/events/core.c:4470
free_event+0x5f/0xd0 kernel/events/core.c:4491
perf_event_release_kernel+0x5b2/0xbe0 kernel/events/core.c:4652
perf_release+0x37/0x50 kernel/events/core.c:4666
__fput+0x2ff/0x890 fs/file_table.c:280
____fput+0x16/0x20 fs/file_table.c:313
task_work_run+0x145/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:185 [inline]
exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:168
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:279 [inline]
do_syscall_64+0x58e/0x680 arch/x86/entry/common.c:304
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x412fb1
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48
83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48
89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffe25e1b730 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000412fb1
RDX: 0000000000000000 RSI: 0000000000000081 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000760a38 R09: ffffffffffffffff
R10: 00007ffe25e1b800 R11: 0000000000000293 R12: 0000000000760a40
R13: 0000000000000003 R14: 0000000000000001 R15: 000000000075bfd4
Allocated by task 13049:
save_stack+0x23/0x90 mm/kasan/common.c:71
set_track mm/kasan/common.c:79 [inline]
__kasan_kmalloc mm/kasan/common.c:489 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:462
kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:497
slab_post_alloc_hook mm/slab.h:437 [inline]
slab_alloc_node mm/slab.c:3269 [inline]
kmem_cache_alloc_node+0x131/0x710 mm/slab.c:3579
alloc_task_struct_node kernel/fork.c:160 [inline]
dup_task_struct kernel/fork.c:848 [inline]
copy_process.part.0+0x43f7/0x6790 kernel/fork.c:1868
copy_process kernel/fork.c:1800 [inline]
_do_fork+0x25d/0xfe0 kernel/fork.c:2369
__do_sys_clone kernel/fork.c:2476 [inline]
__se_sys_clone kernel/fork.c:2470 [inline]
__x64_sys_clone+0xbf/0x150 kernel/fork.c:2470
do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 8689:
save_stack+0x23/0x90 mm/kasan/common.c:71
set_track mm/kasan/common.c:79 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:451
kasan_slab_free+0xe/0x10 mm/kasan/common.c:459
__cache_free mm/slab.c:3432 [inline]
kmem_cache_free+0x86/0x260 mm/slab.c:3698
free_task_struct kernel/fork.c:165 [inline]
free_task+0xdd/0x120 kernel/fork.c:460
__delayed_free_task+0x19/0x20 kernel/fork.c:1744
__rcu_reclaim kernel/rcu/rcu.h:222 [inline]
rcu_do_batch kernel/rcu/tree.c:2092 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2310 [inline]
rcu_core+0xba5/0x1500 kernel/rcu/tree.c:2291
__do_softirq+0x25c/0x94c kernel/softirq.c:292
The buggy address belongs to the object at ffff88804e9f06c0
which belongs to the cache task_struct(97:syz5) of size 6080
The buggy address is located 32 bytes inside of
6080-byte region [ffff88804e9f06c0, ffff88804e9f1e80)
The buggy address belongs to the page:
page:ffffea00013a7c00 refcount:1 mapcount:0 mapping:ffff888090b5de40
index:0x0 compound_mapcount: 0
flags: 0x1fffc0000010200(slab|head)
raw: 01fffc0000010200 ffffea0001681f88 ffffea0001576488 ffff888090b5de40
raw: 0000000000000000 ffff88804e9f06c0 0000000100000001 ffff888058fda540
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff888058fda540
Memory state around the buggy address:
ffff88804e9f0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88804e9f0600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff88804e9f0680: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff88804e9f0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88804e9f0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply
* BUG: workqueue leaked lock or atomic in smc_tx_work
From: syzbot @ 2019-06-24 8:21 UTC (permalink / raw)
To: davem, kgraul, linux-kernel, linux-s390, netdev, syzkaller-bugs,
ubraun
Hello,
syzbot found the following crash on:
HEAD commit: abf02e29 Merge tag 'pm-5.2-rc6' of git://git.kernel.org/pu..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16ef68aaa00000
kernel config: https://syzkaller.appspot.com/x/.config?x=e5c77f8090a3b96b
dashboard link: https://syzkaller.appspot.com/bug?extid=8759e3927fd85a7c520a
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+8759e3927fd85a7c520a@syzkaller.appspotmail.com
BUG: workqueue leaked lock or atomic: kworker/1:2/0x00000000/22354
last function: smc_tx_work
1 lock held by kworker/1:2/22354:
#0: 0000000093e90241 (sk_lock-AF_SMC){+.+.}, at: lock_sock
include/net/sock.h:1522 [inline]
#0: 0000000093e90241 (sk_lock-AF_SMC){+.+.}, at: smc_tx_work+0x22/0x1d0
net/smc/smc_tx.c:577
CPU: 1 PID: 22354 Comm: kworker/1:2 Not tainted 5.2.0-rc5+ #57
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events smc_tx_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
process_one_work+0x108f/0x1790 kernel/workqueue.c:2284
worker_thread+0x98/0xe40 kernel/workqueue.c:2415
kthread+0x354/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
======================================================
WARNING: possible circular locking dependency detected
5.2.0-rc5+ #57 Not tainted
------------------------------------------------------
kworker/1:2/22354 is trying to acquire lock:
0000000007a836d5 ((wq_completion)events){+.+.}, at: __write_once_size
include/linux/compiler.h:221 [inline]
0000000007a836d5 ((wq_completion)events){+.+.}, at: arch_atomic64_set
arch/x86/include/asm/atomic64_64.h:34 [inline]
0000000007a836d5 ((wq_completion)events){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:855 [inline]
0000000007a836d5 ((wq_completion)events){+.+.}, at: atomic_long_set
include/asm-generic/atomic-long.h:40 [inline]
0000000007a836d5 ((wq_completion)events){+.+.}, at: set_work_data
kernel/workqueue.c:620 [inline]
0000000007a836d5 ((wq_completion)events){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:647 [inline]
0000000007a836d5 ((wq_completion)events){+.+.}, at:
process_one_work+0x87e/0x1790 kernel/workqueue.c:2240
but task is already holding lock:
0000000093e90241 (sk_lock-AF_SMC){+.+.}, at: lock_sock
include/net/sock.h:1522 [inline]
0000000093e90241 (sk_lock-AF_SMC){+.+.}, at: smc_tx_work+0x22/0x1d0
net/smc/smc_tx.c:577
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (sk_lock-AF_SMC){+.+.}:
lock_sock_nested+0xcb/0x120 net/core/sock.c:2924
lock_sock include/net/sock.h:1522 [inline]
smc_tcp_listen_work+0x8a/0xf60 net/smc/af_smc.c:1366
process_one_work+0x989/0x1790 kernel/workqueue.c:2269
worker_thread+0x98/0xe40 kernel/workqueue.c:2415
kthread+0x354/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
-> #1 ((work_completion)(&smc->tcp_listen_work)){+.+.}:
process_one_work+0x90f/0x1790 kernel/workqueue.c:2245
worker_thread+0x98/0xe40 kernel/workqueue.c:2415
kthread+0x354/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
-> #0 ((wq_completion)events){+.+.}:
lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4303
process_one_work+0x8df/0x1790 kernel/workqueue.c:2244
worker_thread+0x98/0xe40 kernel/workqueue.c:2415
kthread+0x354/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
other info that might help us debug this:
Chain exists of:
(wq_completion)events --> (work_completion)(&smc->tcp_listen_work) -->
sk_lock-AF_SMC
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(sk_lock-AF_SMC);
lock((work_completion)(&smc->tcp_listen_work));
lock(sk_lock-AF_SMC);
lock((wq_completion)events);
*** DEADLOCK ***
1 lock held by kworker/1:2/22354:
#0: 0000000093e90241 (sk_lock-AF_SMC){+.+.}, at: lock_sock
include/net/sock.h:1522 [inline]
#0: 0000000093e90241 (sk_lock-AF_SMC){+.+.}, at: smc_tx_work+0x22/0x1d0
net/smc/smc_tx.c:577
stack backtrace:
CPU: 1 PID: 22354 Comm: kworker/1:2 Not tainted 5.2.0-rc5+ #57
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events vmpressure_work_fn
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_circular_bug.cold+0x1cc/0x28f kernel/locking/lockdep.c:1565
check_prev_add kernel/locking/lockdep.c:2310 [inline]
check_prevs_add kernel/locking/lockdep.c:2418 [inline]
validate_chain kernel/locking/lockdep.c:2800 [inline]
__lock_acquire+0x3755/0x5490 kernel/locking/lockdep.c:3793
lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4303
process_one_work+0x8df/0x1790 kernel/workqueue.c:2244
worker_thread+0x98/0xe40 kernel/workqueue.c:2415
kthread+0x354/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply
* Re: [PATCH] [v2] ipsec: select crypto ciphers for xfrm_algo
From: Steffen Klassert @ 2019-06-24 8:20 UTC (permalink / raw)
To: Arnd Bergmann
Cc: Herbert Xu, David S. Miller, Florian Westphal, netdev,
linux-kernel
In-Reply-To: <20190618112227.3322313-1-arnd@arndb.de>
On Tue, Jun 18, 2019 at 01:22:13PM +0200, Arnd Bergmann wrote:
> kernelci.org reports failed builds on arc because of what looks
> like an old missed 'select' statement:
>
> net/xfrm/xfrm_algo.o: In function `xfrm_probe_algs':
> xfrm_algo.c:(.text+0x1e8): undefined reference to `crypto_has_ahash'
>
> I don't see this in randconfig builds on other architectures, but
> it's fairly clear we want to select the hash code for it, like we
> do for all its other users. As Herbert points out, CRYPTO_BLKCIPHER
> is also required even though it has not popped up in build tests.
>
> Fixes: 17bc19702221 ("ipsec: Use skcipher and ahash when probing algorithms")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Applied, thanks a lot!
^ permalink raw reply
* [PATCH net] tipc: remove the unnecessary msg->req check from tipc_nl_compat_bearer_set
From: Xin Long @ 2019-06-24 8:02 UTC (permalink / raw)
To: network dev; +Cc: davem, Jon Maloy, Ying Xue, tipc-discussion
tipc_nl_compat_bearer_set() is only called by tipc_nl_compat_link_set()
which already does the check for msg->req check, so remove it from
tipc_nl_compat_bearer_set(), and do the same in tipc_nl_compat_media_set().
Signed-off-by: Xin Long <lucien.xin@gmail.com>
---
net/tipc/netlink_compat.c | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index cf15506..d86030e 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -691,7 +691,6 @@ static int tipc_nl_compat_media_set(struct sk_buff *skb,
struct nlattr *prop;
struct nlattr *media;
struct tipc_link_config *lc;
- int len;
lc = (struct tipc_link_config *)TLV_DATA(msg->req);
@@ -699,10 +698,6 @@ static int tipc_nl_compat_media_set(struct sk_buff *skb,
if (!media)
return -EMSGSIZE;
- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_MEDIA_NAME);
- if (!string_is_valid(lc->name, len))
- return -EINVAL;
-
if (nla_put_string(skb, TIPC_NLA_MEDIA_NAME, lc->name))
return -EMSGSIZE;
@@ -723,7 +718,6 @@ static int tipc_nl_compat_bearer_set(struct sk_buff *skb,
struct nlattr *prop;
struct nlattr *bearer;
struct tipc_link_config *lc;
- int len;
lc = (struct tipc_link_config *)TLV_DATA(msg->req);
@@ -731,10 +725,6 @@ static int tipc_nl_compat_bearer_set(struct sk_buff *skb,
if (!bearer)
return -EMSGSIZE;
- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_MEDIA_NAME);
- if (!string_is_valid(lc->name, len))
- return -EINVAL;
-
if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, lc->name))
return -EMSGSIZE;
--
2.1.0
^ permalink raw reply related
* [PATCH net] tipc: check msg->req data len in tipc_nl_compat_bearer_disable
From: Xin Long @ 2019-06-24 7:59 UTC (permalink / raw)
To: network dev; +Cc: davem, Jon Maloy, Ying Xue, tipc-discussion, syzkaller-bugs
This patch is to fix an uninit-value issue, reported by syzbot:
BUG: KMSAN: uninit-value in memchr+0xce/0x110 lib/string.c:981
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x191/0x1f0 lib/dump_stack.c:113
kmsan_report+0x130/0x2a0 mm/kmsan/kmsan.c:622
__msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:310
memchr+0xce/0x110 lib/string.c:981
string_is_valid net/tipc/netlink_compat.c:176 [inline]
tipc_nl_compat_bearer_disable+0x2a1/0x480 net/tipc/netlink_compat.c:449
__tipc_nl_compat_doit net/tipc/netlink_compat.c:327 [inline]
tipc_nl_compat_doit+0x3ac/0xb00 net/tipc/netlink_compat.c:360
tipc_nl_compat_handle net/tipc/netlink_compat.c:1178 [inline]
tipc_nl_compat_recv+0x1b1b/0x27b0 net/tipc/netlink_compat.c:1281
TLV_GET_DATA_LEN() may return a negtive int value, which will be
used as size_t (becoming a big unsigned long) passed into memchr,
cause this issue.
Similar to what it does in tipc_nl_compat_bearer_enable(), this
fix is to return -EINVAL when TLV_GET_DATA_LEN() is negtive in
tipc_nl_compat_bearer_disable(), as well as in
tipc_nl_compat_link_stat_dump() and tipc_nl_compat_link_reset_stats().
Reported-by: syzbot+30eaa8bf392f7fafffaf@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
---
net/tipc/netlink_compat.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index c6a04c0..cf15506 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -445,7 +445,11 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd,
if (!bearer)
return -EMSGSIZE;
- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
+ len = TLV_GET_DATA_LEN(msg->req);
+ if (len <= 0)
+ return -EINVAL;
+
+ len = min_t(int, len, TIPC_MAX_BEARER_NAME);
if (!string_is_valid(name, len))
return -EINVAL;
@@ -539,7 +543,11 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg,
name = (char *)TLV_DATA(msg->req);
- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+ len = TLV_GET_DATA_LEN(msg->req);
+ if (len <= 0)
+ return -EINVAL;
+
+ len = min_t(int, len, TIPC_MAX_BEARER_NAME);
if (!string_is_valid(name, len))
return -EINVAL;
@@ -817,7 +825,11 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd,
if (!link)
return -EMSGSIZE;
- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+ len = TLV_GET_DATA_LEN(msg->req);
+ if (len <= 0)
+ return -EINVAL;
+
+ len = min_t(int, len, TIPC_MAX_BEARER_NAME);
if (!string_is_valid(name, len))
return -EINVAL;
--
2.1.0
^ permalink raw reply related
* Re: [PATCH net-next 10/16] qlge: Factor out duplicated expression
From: Benjamin Poirier @ 2019-06-24 7:52 UTC (permalink / raw)
To: David Miller; +Cc: manishc, GR-Linux-NIC-Dev, netdev
In-Reply-To: <20190623.105935.2293591576103857913.davem@davemloft.net>
On 2019/06/23 10:59, David Miller wrote:
> From: Benjamin Poirier <bpoirier@suse.com>
> Date: Mon, 17 Jun 2019 16:48:52 +0900
>
> > Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
> > ---
> > drivers/net/ethernet/qlogic/qlge/qlge.h | 6 ++++++
> > drivers/net/ethernet/qlogic/qlge/qlge_main.c | 18 ++++++------------
> > 2 files changed, 12 insertions(+), 12 deletions(-)
> >
> > diff --git a/drivers/net/ethernet/qlogic/qlge/qlge.h b/drivers/net/ethernet/qlogic/qlge/qlge.h
> > index 5a4b2520cd2a..0bb7ccdca6a7 100644
> > --- a/drivers/net/ethernet/qlogic/qlge/qlge.h
> > +++ b/drivers/net/ethernet/qlogic/qlge/qlge.h
> > @@ -77,6 +77,12 @@
> > #define LSD(x) ((u32)((u64)(x)))
> > #define MSD(x) ((u32)((((u64)(x)) >> 32)))
> >
> > +#define QLGE_FIT16(value) \
> > +({ \
> > + typeof(value) _value = value; \
> > + (_value) == 65536 ? 0 : (u16)(_value); \
> > +})
> > +
>
> "(u16) 65536" is zero and the range of these values is 0 -- 65536.
>
> This whole expression is way overdone.
Indeed, I missed that a simple cast is enough :/
What I inferred from the presence of that expression though is that in
the places where it is used, the device interprets a value of 0 as
65536. Manish, can you confirm that? As David points out, the expression
is useless. A comment might not be however.
^ permalink raw reply
* Re: [PATCH net-next 1/4] cxgb4: Re-work the logic for mps refcounting
From: Raju Rangoju @ 2019-06-24 7:42 UTC (permalink / raw)
To: David Miller; +Cc: netdev, nirranjan, dt
In-Reply-To: <20190623.113423.151452943171499414.davem@davemloft.net>
On Sunday, June 06/23/19, 2019 at 11:34:23 -0700, David Miller wrote:
> From: Raju Rangoju <rajur@chelsio.com>
> Date: Fri, 21 Jun 2019 20:06:33 +0530
>
> > +struct mps_entries_ref {
> > + struct list_head list;
> > + u8 addr[ETH_ALEN];
> > + u8 mask[ETH_ALEN];
> > + u16 idx;
> > + atomic_t refcnt;
> > +};
>
> Since you're making this change, please use refcnt_t.
Sure. Will send out v2 with suggested changes.
Thanks,
Raju
^ permalink raw reply
* Re: [PATCH 08/15] ARM: mmp: cleanup cppcheck shifting errors
From: Lubomir Rintel @ 2019-06-24 7:35 UTC (permalink / raw)
To: Phong Tran, mark.rutland, kstewart, songliubraving, andrew,
peterz, nsekhar, ast, jolsa, netdev, gerg, lorenzo.pieralisi,
will, linux-samsung-soc, daniel, festevam, gregory.clement,
allison, linux, krzk, haojian.zhuang, bgolaszewski, tony, mingo,
linux-imx, yhs, sebastian.hesselbarth, illusionist.neo, jason,
liviu.dudau, s.hauer, acme, robert.jarzmik, dmg, swinslow,
namhyung, tglx, linux-omap, alexander.sverdlin, linux-arm-kernel,
info, gregkh, linux-kernel, alexander.shishkin, hsweeten, kgene,
kernel, sudeep.holla, bpf, shawnguo, kafai, daniel
In-Reply-To: <20190623151313.970-9-tranmanphong@gmail.com>
On Sun, 2019-06-23 at 22:13 +0700, Phong Tran wrote:
> [arch/arm/mach-mmp/pm-mmp2.c:121]: (error) Shifting signed 32-bit value
> by 31 bits is undefined behaviour
> [arch/arm/mach-mmp/pm-mmp2.c:136]: (error) Shifting signed 32-bit value
> by 31 bits is undefined behaviour
> [arch/arm/mach-mmp/pm-mmp2.c:244]: (error) Shifting signed 32-bit value
> by 31 bits is undefined behaviour
> [arch/arm/mach-mmp/pm-pxa910.c:141]: (error) Shifting signed 32-bit
> value by 31 bits is undefined behaviour
> [arch/arm/mach-mmp/pm-pxa910.c:159]: (error) Shifting signed 32-bit
> value by 31 bits is undefined behaviour
>
> Signed-off-by: Phong Tran <tranmanphong@gmail.com>
Like others already pointed out, you may want to send out a v2 that
would use the BIT() macro. Either way works for me:
Acked-by: Lubomir Rintel <lkundrak@v3.sk> [mmp]
Thank you
Lubo
> ---
> arch/arm/mach-mmp/pm-mmp2.h | 40 +++++++++++------------
> arch/arm/mach-mmp/pm-pxa910.h | 76 +++++++++++++++++++++----------------------
> 2 files changed, 58 insertions(+), 58 deletions(-)
>
> diff --git a/arch/arm/mach-mmp/pm-mmp2.h b/arch/arm/mach-mmp/pm-mmp2.h
> index 70299a9450d3..87fd1c81547d 100644
> --- a/arch/arm/mach-mmp/pm-mmp2.h
> +++ b/arch/arm/mach-mmp/pm-mmp2.h
> @@ -12,37 +12,37 @@
> #include "addr-map.h"
>
> #define APMU_PJ_IDLE_CFG APMU_REG(0x018)
> -#define APMU_PJ_IDLE_CFG_PJ_IDLE (1 << 1)
> -#define APMU_PJ_IDLE_CFG_PJ_PWRDWN (1 << 5)
> +#define APMU_PJ_IDLE_CFG_PJ_IDLE (1U << 1)
> +#define APMU_PJ_IDLE_CFG_PJ_PWRDWN (1U << 5)
> #define APMU_PJ_IDLE_CFG_PWR_SW(x) ((x) << 16)
> -#define APMU_PJ_IDLE_CFG_L2_PWR_SW (1 << 19)
> +#define APMU_PJ_IDLE_CFG_L2_PWR_SW (1U << 19)
> #define APMU_PJ_IDLE_CFG_ISO_MODE_CNTRL_MASK (3 << 28)
>
> #define APMU_SRAM_PWR_DWN APMU_REG(0x08c)
>
> #define MPMU_SCCR MPMU_REG(0x038)
> #define MPMU_PCR_PJ MPMU_REG(0x1000)
> -#define MPMU_PCR_PJ_AXISD (1 << 31)
> -#define MPMU_PCR_PJ_SLPEN (1 << 29)
> -#define MPMU_PCR_PJ_SPSD (1 << 28)
> -#define MPMU_PCR_PJ_DDRCORSD (1 << 27)
> -#define MPMU_PCR_PJ_APBSD (1 << 26)
> -#define MPMU_PCR_PJ_INTCLR (1 << 24)
> -#define MPMU_PCR_PJ_SLPWP0 (1 << 23)
> -#define MPMU_PCR_PJ_SLPWP1 (1 << 22)
> -#define MPMU_PCR_PJ_SLPWP2 (1 << 21)
> -#define MPMU_PCR_PJ_SLPWP3 (1 << 20)
> -#define MPMU_PCR_PJ_VCTCXOSD (1 << 19)
> -#define MPMU_PCR_PJ_SLPWP4 (1 << 18)
> -#define MPMU_PCR_PJ_SLPWP5 (1 << 17)
> -#define MPMU_PCR_PJ_SLPWP6 (1 << 16)
> -#define MPMU_PCR_PJ_SLPWP7 (1 << 15)
> +#define MPMU_PCR_PJ_AXISD (1U << 31)
> +#define MPMU_PCR_PJ_SLPEN (1U << 29)
> +#define MPMU_PCR_PJ_SPSD (1U << 28)
> +#define MPMU_PCR_PJ_DDRCORSD (1U << 27)
> +#define MPMU_PCR_PJ_APBSD (1U << 26)
> +#define MPMU_PCR_PJ_INTCLR (1U << 24)
> +#define MPMU_PCR_PJ_SLPWP0 (1U << 23)
> +#define MPMU_PCR_PJ_SLPWP1 (1U << 22)
> +#define MPMU_PCR_PJ_SLPWP2 (1U << 21)
> +#define MPMU_PCR_PJ_SLPWP3 (1U << 20)
> +#define MPMU_PCR_PJ_VCTCXOSD (1U << 19)
> +#define MPMU_PCR_PJ_SLPWP4 (1U << 18)
> +#define MPMU_PCR_PJ_SLPWP5 (1U << 17)
> +#define MPMU_PCR_PJ_SLPWP6 (1U << 16)
> +#define MPMU_PCR_PJ_SLPWP7 (1U << 15)
>
> #define MPMU_PLL2_CTRL1 MPMU_REG(0x0414)
> #define MPMU_CGR_PJ MPMU_REG(0x1024)
> #define MPMU_WUCRM_PJ MPMU_REG(0x104c)
> -#define MPMU_WUCRM_PJ_WAKEUP(x) (1 << (x))
> -#define MPMU_WUCRM_PJ_RTC_ALARM (1 << 17)
> +#define MPMU_WUCRM_PJ_WAKEUP(x) (1U << (x))
> +#define MPMU_WUCRM_PJ_RTC_ALARM (1U << 17)
>
> enum {
> POWER_MODE_ACTIVE = 0,
> diff --git a/arch/arm/mach-mmp/pm-pxa910.h b/arch/arm/mach-mmp/pm-pxa910.h
> index 8e6344adaf51..0958cde1ca6e 100644
> --- a/arch/arm/mach-mmp/pm-pxa910.h
> +++ b/arch/arm/mach-mmp/pm-pxa910.h
> @@ -10,54 +10,54 @@
> #define __PXA910_PM_H__
>
> #define APMU_MOH_IDLE_CFG APMU_REG(0x0018)
> -#define APMU_MOH_IDLE_CFG_MOH_IDLE (1 << 1)
> -#define APMU_MOH_IDLE_CFG_MOH_PWRDWN (1 << 5)
> -#define APMU_MOH_IDLE_CFG_MOH_SRAM_PWRDWN (1 << 6)
> +#define APMU_MOH_IDLE_CFG_MOH_IDLE (1U << 1)
> +#define APMU_MOH_IDLE_CFG_MOH_PWRDWN (1U << 5)
> +#define APMU_MOH_IDLE_CFG_MOH_SRAM_PWRDWN (1U << 6)
> #define APMU_MOH_IDLE_CFG_MOH_PWR_SW(x) (((x) & 0x3) << 16)
> #define APMU_MOH_IDLE_CFG_MOH_L2_PWR_SW(x) (((x) & 0x3) << 18)
> -#define APMU_MOH_IDLE_CFG_MOH_DIS_MC_SW_REQ (1 << 21)
> -#define APMU_MOH_IDLE_CFG_MOH_MC_WAKE_EN (1 << 20)
> +#define APMU_MOH_IDLE_CFG_MOH_DIS_MC_SW_REQ (1U << 21)
> +#define APMU_MOH_IDLE_CFG_MOH_MC_WAKE_EN (1U << 20)
>
> #define APMU_SQU_CLK_GATE_CTRL APMU_REG(0x001c)
> #define APMU_MC_HW_SLP_TYPE APMU_REG(0x00b0)
>
> #define MPMU_FCCR MPMU_REG(0x0008)
> #define MPMU_APCR MPMU_REG(0x1000)
> -#define MPMU_APCR_AXISD (1 << 31)
> -#define MPMU_APCR_DSPSD (1 << 30)
> -#define MPMU_APCR_SLPEN (1 << 29)
> -#define MPMU_APCR_DTCMSD (1 << 28)
> -#define MPMU_APCR_DDRCORSD (1 << 27)
> -#define MPMU_APCR_APBSD (1 << 26)
> -#define MPMU_APCR_BBSD (1 << 25)
> -#define MPMU_APCR_SLPWP0 (1 << 23)
> -#define MPMU_APCR_SLPWP1 (1 << 22)
> -#define MPMU_APCR_SLPWP2 (1 << 21)
> -#define MPMU_APCR_SLPWP3 (1 << 20)
> -#define MPMU_APCR_VCTCXOSD (1 << 19)
> -#define MPMU_APCR_SLPWP4 (1 << 18)
> -#define MPMU_APCR_SLPWP5 (1 << 17)
> -#define MPMU_APCR_SLPWP6 (1 << 16)
> -#define MPMU_APCR_SLPWP7 (1 << 15)
> -#define MPMU_APCR_MSASLPEN (1 << 14)
> -#define MPMU_APCR_STBYEN (1 << 13)
> +#define MPMU_APCR_AXISD (1U << 31)
> +#define MPMU_APCR_DSPSD (1U << 30)
> +#define MPMU_APCR_SLPEN (1U << 29)
> +#define MPMU_APCR_DTCMSD (1U << 28)
> +#define MPMU_APCR_DDRCORSD (1U << 27)
> +#define MPMU_APCR_APBSD (1U << 26)
> +#define MPMU_APCR_BBSD (1U << 25)
> +#define MPMU_APCR_SLPWP0 (1U << 23)
> +#define MPMU_APCR_SLPWP1 (1U << 22)
> +#define MPMU_APCR_SLPWP2 (1U << 21)
> +#define MPMU_APCR_SLPWP3 (1U << 20)
> +#define MPMU_APCR_VCTCXOSD (1U << 19)
> +#define MPMU_APCR_SLPWP4 (1U << 18)
> +#define MPMU_APCR_SLPWP5 (1U << 17)
> +#define MPMU_APCR_SLPWP6 (1U << 16)
> +#define MPMU_APCR_SLPWP7 (1U << 15)
> +#define MPMU_APCR_MSASLPEN (1U << 14)
> +#define MPMU_APCR_STBYEN (1U << 13)
>
> #define MPMU_AWUCRM MPMU_REG(0x104c)
> -#define MPMU_AWUCRM_AP_ASYNC_INT (1 << 25)
> -#define MPMU_AWUCRM_AP_FULL_IDLE (1 << 24)
> -#define MPMU_AWUCRM_SDH1 (1 << 23)
> -#define MPMU_AWUCRM_SDH2 (1 << 22)
> -#define MPMU_AWUCRM_KEYPRESS (1 << 21)
> -#define MPMU_AWUCRM_TRACKBALL (1 << 20)
> -#define MPMU_AWUCRM_NEWROTARY (1 << 19)
> -#define MPMU_AWUCRM_RTC_ALARM (1 << 17)
> -#define MPMU_AWUCRM_AP2_TIMER_3 (1 << 13)
> -#define MPMU_AWUCRM_AP2_TIMER_2 (1 << 12)
> -#define MPMU_AWUCRM_AP2_TIMER_1 (1 << 11)
> -#define MPMU_AWUCRM_AP1_TIMER_3 (1 << 10)
> -#define MPMU_AWUCRM_AP1_TIMER_2 (1 << 9)
> -#define MPMU_AWUCRM_AP1_TIMER_1 (1 << 8)
> -#define MPMU_AWUCRM_WAKEUP(x) (1 << ((x) & 0x7))
> +#define MPMU_AWUCRM_AP_ASYNC_INT (1U << 25)
> +#define MPMU_AWUCRM_AP_FULL_IDLE (1U << 24)
> +#define MPMU_AWUCRM_SDH1 (1U << 23)
> +#define MPMU_AWUCRM_SDH2 (1U << 22)
> +#define MPMU_AWUCRM_KEYPRESS (1U << 21)
> +#define MPMU_AWUCRM_TRACKBALL (1U << 20)
> +#define MPMU_AWUCRM_NEWROTARY (1U << 19)
> +#define MPMU_AWUCRM_RTC_ALARM (1U << 17)
> +#define MPMU_AWUCRM_AP2_TIMER_3 (1U << 13)
> +#define MPMU_AWUCRM_AP2_TIMER_2 (1U << 12)
> +#define MPMU_AWUCRM_AP2_TIMER_1 (1U << 11)
> +#define MPMU_AWUCRM_AP1_TIMER_3 (1U << 10)
> +#define MPMU_AWUCRM_AP1_TIMER_2 (1U << 9)
> +#define MPMU_AWUCRM_AP1_TIMER_1 (1U << 8)
> +#define MPMU_AWUCRM_WAKEUP(x) (1U << ((x) & 0x7))
>
> enum {
> POWER_MODE_ACTIVE = 0,
^ permalink raw reply
* Re: [PATCH 10/15] ARM: orion5x: cleanup cppcheck shifting errors
From: Gregory CLEMENT @ 2019-06-24 7:31 UTC (permalink / raw)
To: Phong Tran, mark.rutland, kstewart, songliubraving, andrew,
peterz, nsekhar, ast, jolsa, netdev, gerg, lorenzo.pieralisi,
will, linux-samsung-soc, daniel, tranmanphong, festevam, allison,
linux, krzk, haojian.zhuang, bgolaszewski, tony, mingo, linux-imx,
yhs, sebastian.hesselbarth, illusionist.neo, jason, liviu.dudau,
s.hauer, acme, lkundrak, robert.jarzmik, dmg, swinslow, namhyung,
tglx, linux-omap, alexander.sverdlin, linux-arm-kernel, info,
gregkh, linux-kernel, alexander.shishkin, hsweeten, kgene, kernel,
sudeep.holla, bpf, shawnguo, kafai, daniel
In-Reply-To: <20190623151313.970-11-tranmanphong@gmail.com>
Hi Phong,
> [arch/arm/mach-orion5x/pci.c:281]: (error) Shifting signed 32-bit value
> by 31 bits is undefined behaviour
> [arch/arm/mach-orion5x/pci.c:305]: (error) Shifting signed 32-bit value
> by 31 bits is undefined behaviour
>
While Andrew was Ok with this version, I will wait for your v2 using
BIT() marcro.
Thanks,
Gregory
> Signed-off-by: Phong Tran <tranmanphong@gmail.com>
> ---
> arch/arm/mach-orion5x/pci.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/arch/arm/mach-orion5x/pci.c b/arch/arm/mach-orion5x/pci.c
> index 76951bfbacf5..1b2c077ee7b8 100644
> --- a/arch/arm/mach-orion5x/pci.c
> +++ b/arch/arm/mach-orion5x/pci.c
> @@ -200,13 +200,13 @@ static int __init pcie_setup(struct pci_sys_data *sys)
> /*
> * PCI_MODE bits
> */
> -#define PCI_MODE_64BIT (1 << 2)
> -#define PCI_MODE_PCIX ((1 << 4) | (1 << 5))
> +#define PCI_MODE_64BIT (1U << 2)
> +#define PCI_MODE_PCIX ((1U << 4) | (1U << 5))
>
> /*
> * PCI_CMD bits
> */
> -#define PCI_CMD_HOST_REORDER (1 << 29)
> +#define PCI_CMD_HOST_REORDER (1U << 29)
>
> /*
> * PCI_P2P_CONF bits
> @@ -223,7 +223,7 @@ static int __init pcie_setup(struct pci_sys_data *sys)
> #define PCI_CONF_FUNC(func) (((func) & 0x3) << 8)
> #define PCI_CONF_DEV(dev) (((dev) & 0x1f) << 11)
> #define PCI_CONF_BUS(bus) (((bus) & 0xff) << 16)
> -#define PCI_CONF_ADDR_EN (1 << 31)
> +#define PCI_CONF_ADDR_EN (1U << 31)
>
> /*
> * Internal configuration space
> --
> 2.11.0
>
--
Gregory Clement, Bootlin
Embedded Linux and Kernel engineering
http://bootlin.com
^ permalink raw reply
* memory leak in sctp_v4_create_accept_sk
From: syzbot @ 2019-06-24 7:27 UTC (permalink / raw)
To: davem, linux-kernel, linux-sctp, marcelo.leitner, netdev, nhorman,
syzkaller-bugs, vyasevich
Hello,
syzbot found the following crash on:
HEAD commit: abf02e29 Merge tag 'pm-5.2-rc6' of git://git.kernel.org/pu..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13470eb2a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=56f1da14935c3cce
dashboard link: https://syzkaller.appspot.com/bug?extid=afabda3890cc2f765041
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15100a91a00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10c46026a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+afabda3890cc2f765041@syzkaller.appspotmail.com
ffffffffda RBX: 00000000006fbc38 RCX: 0000000000446a79
BUG: memory leak
unreferenced object 0xffff888118137680 (size 1352):
comm "syz-executor360", pid 7164, jiffies 4294941839 (age 13.960s)
hex dump (first 32 bytes):
ac 14 ff aa 0a 80 01 1a 00 00 00 00 00 00 00 00 ................
02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
backtrace:
[<000000006c358063>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<000000006c358063>] slab_post_alloc_hook mm/slab.h:439 [inline]
[<000000006c358063>] slab_alloc mm/slab.c:3326 [inline]
[<000000006c358063>] kmem_cache_alloc+0x134/0x270 mm/slab.c:3488
[<00000000f2fb26e7>] sk_prot_alloc+0x41/0x170 net/core/sock.c:1596
[<000000003c036edc>] sk_alloc+0x35/0x2f0 net/core/sock.c:1656
[<00000000c25725a4>] sctp_v4_create_accept_sk+0x32/0xb0
net/sctp/protocol.c:556
[<0000000049bd7e55>] sctp_accept+0x1df/0x290 net/sctp/socket.c:4913
[<00000000d287a63e>] inet_accept+0x4e/0x1d0 net/ipv4/af_inet.c:734
[<00000000acb0fc20>] __sys_accept4+0x12a/0x280 net/socket.c:1760
[<00000000bbdaf60b>] __do_sys_accept4 net/socket.c:1795 [inline]
[<00000000bbdaf60b>] __se_sys_accept4 net/socket.c:1792 [inline]
[<00000000bbdaf60b>] __x64_sys_accept4+0x22/0x30 net/socket.c:1792
[<000000006da547ee>] do_syscall_64+0x76/0x1a0
arch/x86/entry/common.c:301
[<00000000025f5c93>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply
* memory leak in fdb_create
From: syzbot @ 2019-06-24 7:27 UTC (permalink / raw)
To: bridge, davem, linux-kernel, netdev, nikolay, roopa,
syzkaller-bugs
Hello,
syzbot found the following crash on:
HEAD commit: abf02e29 Merge tag 'pm-5.2-rc6' of git://git.kernel.org/pu..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12970eb2a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=56f1da14935c3cce
dashboard link: https://syzkaller.appspot.com/bug?extid=88533dc8b582309bf3ee
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16de5c06a00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10546026a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+88533dc8b582309bf3ee@syzkaller.appspotmail.com
ffffffffda RBX: 0000000000000000 RCX: 0000000000441519
BUG: memory leak
unreferenced object 0xffff888123886800 (size 128):
comm "softirq", pid 0, jiffies 4294945699 (age 13.160s)
hex dump (first 32 bytes):
81 89 f8 20 81 88 ff ff 00 00 00 00 00 00 00 00 ... ............
32 f9 fc b7 11 e2 01 00 00 00 00 00 00 00 00 00 2...............
backtrace:
[<00000000ca2421fa>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<00000000ca2421fa>] slab_post_alloc_hook mm/slab.h:439 [inline]
[<00000000ca2421fa>] slab_alloc mm/slab.c:3326 [inline]
[<00000000ca2421fa>] kmem_cache_alloc+0x134/0x270 mm/slab.c:3488
[<000000007faade68>] fdb_create+0x49/0x5a0 net/bridge/br_fdb.c:492
[<00000000772dfc36>] fdb_insert+0xb7/0x100 net/bridge/br_fdb.c:536
[<00000000ded35dd0>] br_fdb_insert+0x3b/0x60 net/bridge/br_fdb.c:552
[<00000000758ae277>] __vlan_add+0x617/0xdf0 net/bridge/br_vlan.c:284
[<0000000054c3b165>] br_vlan_add+0x26f/0x480 net/bridge/br_vlan.c:678
[<00000000ed895462>] br_vlan_init+0xe9/0x130 net/bridge/br_vlan.c:1061
[<00000000f916c753>] br_dev_init+0xa6/0x170 net/bridge/br_device.c:137
[<00000000a4e1a1ea>] register_netdevice+0xbf/0x600 net/core/dev.c:8663
[<00000000bdcf4ebd>] register_netdev+0x24/0x40 net/core/dev.c:8851
[<0000000042e6c0c4>] br_add_bridge+0x5e/0xa0 net/bridge/br_if.c:456
[<0000000036402409>] br_ioctl_deviceless_stub+0x30c/0x350
net/bridge/br_ioctl.c:374
[<00000000e57c9a76>] sock_ioctl+0x287/0x480 net/socket.c:1141
[<00000000109b8329>] vfs_ioctl fs/ioctl.c:46 [inline]
[<00000000109b8329>] file_ioctl fs/ioctl.c:509 [inline]
[<00000000109b8329>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
[<00000000d8eb5a5e>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
[<00000000cd162915>] __do_sys_ioctl fs/ioctl.c:720 [inline]
[<00000000cd162915>] __se_sys_ioctl fs/ioctl.c:718 [inline]
[<00000000cd162915>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
BUG: memory leak
unreferenced object 0xffff88811ced2de0 (size 32):
comm "syz-executor140", pid 6998, jiffies 4294945699 (age 13.160s)
hex dump (first 32 bytes):
d3 d2 f1 a7 6c 83 5b 30 30 15 a1 6f 77 3f 00 00 ....l.[00..ow?..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000d53fdc1e>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<00000000d53fdc1e>] slab_post_alloc_hook mm/slab.h:439 [inline]
[<00000000d53fdc1e>] slab_alloc mm/slab.c:3326 [inline]
[<00000000d53fdc1e>] __do_kmalloc mm/slab.c:3658 [inline]
[<00000000d53fdc1e>] __kmalloc_track_caller+0x15d/0x2c0 mm/slab.c:3675
[<00000000c742d29c>] kstrdup+0x3a/0x70 mm/util.c:52
[<00000000d3df5d2b>] kstrdup_const+0x48/0x60 mm/util.c:74
[<00000000d75a8fa8>] kvasprintf_const+0x7e/0xe0 lib/kasprintf.c:48
[<00000000ebee37a0>] kobject_set_name_vargs+0x40/0xe0 lib/kobject.c:289
[<00000000c23c056a>] dev_set_name+0x63/0x90 drivers/base/core.c:1915
[<000000004c47b6d3>] netdev_register_kobject+0x5a/0x1b0
net/core/net-sysfs.c:1727
[<000000005fb074af>] register_netdevice+0x397/0x600 net/core/dev.c:8733
[<00000000bdcf4ebd>] register_netdev+0x24/0x40 net/core/dev.c:8851
[<0000000042e6c0c4>] br_add_bridge+0x5e/0xa0 net/bridge/br_if.c:456
[<0000000036402409>] br_ioctl_deviceless_stub+0x30c/0x350
net/bridge/br_ioctl.c:374
[<00000000e57c9a76>] sock_ioctl+0x287/0x480 net/socket.c:1141
[<00000000109b8329>] vfs_ioctl fs/ioctl.c:46 [inline]
[<00000000109b8329>] file_ioctl fs/ioctl.c:509 [inline]
[<00000000109b8329>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
[<00000000d8eb5a5e>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
[<00000000cd162915>] __do_sys_ioctl fs/ioctl.c:720 [inline]
[<00000000cd162915>] __se_sys_ioctl fs/ioctl.c:718 [inline]
[<00000000cd162915>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
[<0000000069b4ac36>] do_syscall_64+0x76/0x1a0
arch/x86/entry/common.c:301
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply
* Re: [PATCH net-next 13/18] ionic: Add initial ethtool support
From: Michal Kubecek @ 2019-06-24 7:26 UTC (permalink / raw)
To: netdev; +Cc: Shannon Nelson
In-Reply-To: <4588d437-6308-0b6c-50e9-964a877b833f@pensando.io>
On Fri, Jun 21, 2019 at 03:30:20PM -0700, Shannon Nelson wrote:
> On 6/20/19 7:32 PM, Michal Kubecek wrote:
> > On Thu, Jun 20, 2019 at 01:24:19PM -0700, Shannon Nelson wrote:
> > > + if (ring->tx_pending > IONIC_MAX_TXRX_DESC ||
> > > + ring->tx_pending < IONIC_MIN_TXRX_DESC ||
> > > + ring->rx_pending > IONIC_MAX_TXRX_DESC ||
> > > + ring->rx_pending < IONIC_MIN_TXRX_DESC) {
> > > + netdev_info(netdev, "Descriptors count must be in the range [%d-%d]\n",
> > > + IONIC_MIN_TXRX_DESC, IONIC_MAX_TXRX_DESC);
> > > + return -EINVAL;
> > > + }
> > The upper bounds have been already checked in ethtool_set_ringparam() so
> > that the two conditions can never be satisfied here.
> >
> > ...
> > > +static int ionic_set_channels(struct net_device *netdev,
> > > + struct ethtool_channels *ch)
> > > +{
> > > + struct lif *lif = netdev_priv(netdev);
> > > + bool running;
> > > +
> > > + if (!ch->combined_count || ch->other_count ||
> > > + ch->rx_count || ch->tx_count)
> > > + return -EINVAL;
> > > +
> > > + if (ch->combined_count > lif->ionic->ntxqs_per_lif)
> > > + return -EINVAL;
> > This has been already checked in ethtool_set_channels().
>
> That's what I get for copying from an existing driver. I'll check those and
> clean them up.
The checks in general code were only added recently so most drivers
probably still have their own checks.
Michal Kubecek
^ permalink raw reply
* Re: [PATCH 01/15] arm: perf: cleanup cppcheck shifting error
From: Peter Zijlstra @ 2019-06-24 7:11 UTC (permalink / raw)
To: Phong Tran
Cc: mark.rutland, kstewart, songliubraving, andrew, nsekhar, ast,
jolsa, netdev, gerg, lorenzo.pieralisi, will, linux-samsung-soc,
daniel, festevam, gregory.clement, allison, linux, krzk,
haojian.zhuang, bgolaszewski, tony, mingo, linux-imx, yhs,
sebastian.hesselbarth, illusionist.neo, jason, liviu.dudau,
s.hauer, acme, lkundrak, robert.jarzmik, dmg, swinslow, namhyung,
tglx, linux-omap, alexander.sverdlin, linux-arm-kernel, info,
gregkh, linux-kernel, alexander.shishkin, hsweeten, kgene, kernel,
sudeep.holla, bpf, shawnguo, kafai, daniel
In-Reply-To: <20190623151313.970-2-tranmanphong@gmail.com>
On Sun, Jun 23, 2019 at 10:12:59PM +0700, Phong Tran wrote:
> fix "Shifting signed 32-bit value by 31 bits is undefined behaviour
> errors"
>
> [arch/arm/kernel/perf_event_v7.c:1080]: (error) Shifting signed 32-bit
> value by 31 bits is undefined behaviour
> [arch/arm/kernel/perf_event_v7.c:1436]: (error) Shifting signed 32-bit
> value by 31 bits is undefined behaviour
> [arch/arm/kernel/perf_event_v7.c:1783]: (error) Shifting signed 32-bit
> value by 31 bits is undefined behaviour
I don't think that is true; the kernel uses -fno-strict-overflow (which
implies -fwrapv) and that takes away all the signed UB.
^ permalink raw reply
* [net-next v2] tipc: add loopback device tracking
From: john.rutherford @ 2019-06-24 6:44 UTC (permalink / raw)
To: netdev; +Cc: John Rutherford
Since node internal messages are passed directly to socket it is not
possible to observe this message exchange via tcpdump or wireshark.
We now remedy this by making it possible to clone such messages and send
the clones to the loopback interface. The clones are dropped at reception
and have no functional role except making the traffic visible.
The feature is turned on/off by enabling/disabling the loopback "bearer"
"eth:lo".
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: John Rutherford <john.rutherford@dektech.com.au>
---
net/tipc/bcast.c | 4 +++-
net/tipc/bearer.c | 67 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
net/tipc/bearer.h | 3 +++
net/tipc/core.c | 5 ++++-
net/tipc/core.h | 12 ++++++++++
net/tipc/node.c | 1 +
net/tipc/topsrv.c | 2 ++
7 files changed, 92 insertions(+), 2 deletions(-)
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 6c997d4..235331d 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -406,8 +406,10 @@ int tipc_mcast_xmit(struct net *net, struct sk_buff_head *pkts,
rc = tipc_bcast_xmit(net, pkts, cong_link_cnt);
}
- if (dests->local)
+ if (dests->local) {
+ tipc_loopback_trace(net, &localq);
tipc_sk_mcast_rcv(net, &localq, &inputq);
+ }
exit:
/* This queue should normally be empty by now */
__skb_queue_purge(pkts);
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 2bed658..27b4fd7 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -836,6 +836,12 @@ int __tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
name = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
+ if (!strcmp(name, "eth:lo")) {
+ tipc_net(net)->loopback_trace = false;
+ pr_info("Disabled packet tracing on loopback interface\n");
+ return 0;
+ }
+
bearer = tipc_bearer_find(net, name);
if (!bearer)
return -EINVAL;
@@ -881,6 +887,12 @@ int __tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
bearer = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
+ if (!strcmp(bearer, "eth:lo")) {
+ tipc_net(net)->loopback_trace = true;
+ pr_info("Enabled packet tracing on loopback interface\n");
+ return 0;
+ }
+
if (attrs[TIPC_NLA_BEARER_DOMAIN])
domain = nla_get_u32(attrs[TIPC_NLA_BEARER_DOMAIN]);
@@ -1021,6 +1033,61 @@ int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
return err;
}
+void tipc_clone_to_loopback(struct net *net, struct sk_buff_head *xmitq)
+{
+ struct net_device *dev = net->loopback_dev;
+ struct sk_buff *skb, *_skb;
+ int exp;
+
+ skb_queue_walk(xmitq, _skb) {
+ skb = pskb_copy(_skb, GFP_ATOMIC);
+ if (!skb)
+ continue;
+ exp = SKB_DATA_ALIGN(dev->hard_header_len - skb_headroom(skb));
+ if (exp > 0 && pskb_expand_head(skb, exp, 0, GFP_ATOMIC)) {
+ kfree_skb(skb);
+ continue;
+ }
+ skb_reset_network_header(skb);
+ skb->dev = dev;
+ skb->protocol = htons(ETH_P_TIPC);
+ dev_hard_header(skb, dev, ETH_P_TIPC, dev->dev_addr,
+ dev->dev_addr, skb->len);
+ dev_queue_xmit(skb);
+ }
+}
+
+static int tipc_loopback_rcv_pkt(struct sk_buff *skb, struct net_device *dev,
+ struct packet_type *pt, struct net_device *od)
+{
+ consume_skb(skb);
+ return NET_RX_SUCCESS;
+}
+
+int tipc_attach_loopback(struct net *net)
+{
+ struct net_device *dev = net->loopback_dev;
+ struct tipc_net *tn = tipc_net(net);
+
+ if (!dev)
+ return -ENODEV;
+ dev_hold(dev);
+ tn->loopback_pt.dev = dev;
+ tn->loopback_pt.type = htons(ETH_P_TIPC);
+ tn->loopback_pt.func = tipc_loopback_rcv_pkt;
+ tn->loopback_trace = false;
+ dev_add_pack(&tn->loopback_pt);
+ return 0;
+}
+
+void tipc_detach_loopback(struct net *net)
+{
+ struct tipc_net *tn = tipc_net(net);
+
+ dev_remove_pack(&tn->loopback_pt);
+ dev_put(net->loopback_dev);
+}
+
static int __tipc_nl_add_media(struct tipc_nl_msg *msg,
struct tipc_media *media, int nlflags)
{
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 7f4c569..ef7fad9 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -232,6 +232,9 @@ void tipc_bearer_xmit(struct net *net, u32 bearer_id,
struct tipc_media_addr *dst);
void tipc_bearer_bc_xmit(struct net *net, u32 bearer_id,
struct sk_buff_head *xmitq);
+void tipc_clone_to_loopback(struct net *net, struct sk_buff_head *xmitq);
+int tipc_attach_loopback(struct net *net);
+void tipc_detach_loopback(struct net *net);
/* check if device MTU is too low for tipc headers */
static inline bool tipc_mtu_bad(struct net_device *dev, unsigned int reserve)
diff --git a/net/tipc/core.c b/net/tipc/core.c
index ed536c0..1867687 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -81,7 +81,9 @@ static int __net_init tipc_init_net(struct net *net)
err = tipc_bcast_init(net);
if (err)
goto out_bclink;
-
+ err = tipc_attach_loopback(net);
+ if (err)
+ goto out_bclink;
return 0;
out_bclink:
@@ -94,6 +96,7 @@ static int __net_init tipc_init_net(struct net *net)
static void __net_exit tipc_exit_net(struct net *net)
{
+ tipc_detach_loopback(net);
tipc_net_stop(net);
tipc_bcast_stop(net);
tipc_nametbl_stop(net);
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 7a68e1b..c1c2906 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -67,6 +67,7 @@ struct tipc_link;
struct tipc_name_table;
struct tipc_topsrv;
struct tipc_monitor;
+void tipc_clone_to_loopback(struct net *net, struct sk_buff_head *pkts);
#define TIPC_MOD_VER "2.0.0"
@@ -125,6 +126,10 @@ struct tipc_net {
/* Cluster capabilities */
u16 capabilities;
+
+ /* Tracing of node internal messages */
+ struct packet_type loopback_pt;
+ bool loopback_trace;
};
static inline struct tipc_net *tipc_net(struct net *net)
@@ -152,6 +157,13 @@ static inline struct tipc_topsrv *tipc_topsrv(struct net *net)
return tipc_net(net)->topsrv;
}
+static inline void tipc_loopback_trace(struct net *net,
+ struct sk_buff_head *pkts)
+{
+ if (unlikely(tipc_net(net)->loopback_trace))
+ tipc_clone_to_loopback(net, pkts);
+}
+
static inline unsigned int tipc_hashfn(u32 addr)
{
return addr & (NODE_HTABLE_SIZE - 1);
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 9e106d3..7e58831 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1439,6 +1439,7 @@ int tipc_node_xmit(struct net *net, struct sk_buff_head *list,
int rc;
if (in_own_node(net, dnode)) {
+ tipc_loopback_trace(net, list);
tipc_sk_rcv(net, list);
return 0;
}
diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
index f345662..e3a6ba1 100644
--- a/net/tipc/topsrv.c
+++ b/net/tipc/topsrv.c
@@ -40,6 +40,7 @@
#include "socket.h"
#include "addr.h"
#include "msg.h"
+#include "bearer.h"
#include <net/sock.h>
#include <linux/module.h>
@@ -608,6 +609,7 @@ static void tipc_topsrv_kern_evt(struct net *net, struct tipc_event *evt)
memcpy(msg_data(buf_msg(skb)), evt, sizeof(*evt));
skb_queue_head_init(&evtq);
__skb_queue_tail(&evtq, skb);
+ tipc_loopback_trace(net, &evtq);
tipc_sk_rcv(net, &evtq);
}
--
2.11.0
^ permalink raw reply related
* [net-next] tipc: fix missing indentation in source code
From: john.rutherford @ 2019-06-24 6:45 UTC (permalink / raw)
To: netdev; +Cc: John Rutherford
Fix misalignment of policy statement in netlink.c due to automatic
spatch code transformation.
Fixes: 3b0f31f2b8c9 ("genetlink: make policy common to family")
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: John Rutherford <john.rutherford@dektech.com.au>
---
net/tipc/netlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 99bd166..d6165ad 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -261,7 +261,7 @@ struct genl_family tipc_genl_family __ro_after_init = {
.version = TIPC_GENL_V2_VERSION,
.hdrsize = 0,
.maxattr = TIPC_NLA_MAX,
- .policy = tipc_nl_policy,
+ .policy = tipc_nl_policy,
.netnsok = true,
.module = THIS_MODULE,
.ops = tipc_genl_v2_ops,
--
2.11.0
^ permalink raw reply related
* RE: [PATCH v4 4/5] net: macb: add support for high speed interface
From: Parshuram Raju Thombare @ 2019-06-24 6:52 UTC (permalink / raw)
To: Andrew Lunn
Cc: nicolas.ferre@microchip.com, davem@davemloft.net,
f.fainelli@gmail.com, linux@armlinux.org.uk,
netdev@vger.kernel.org, hkallweit1@gmail.com,
linux-kernel@vger.kernel.org, Rafal Ciepiela, Anil Joy Varughese,
Piotr Sroka
In-Reply-To: <20190623150902.GB28942@lunn.ch>
Hi Andrew,
>> +enum {
>> + MACB_SERDES_RATE_5_PT_15625Gbps = 5,
>> + MACB_SERDES_RATE_10_PT_3125Gbps = 10,
>> +};
>What do the units mean here? Why would you clock the SERDES at 15Tbps,
>or 3Tbps? 3.125Mbps would give you 2.5Gbps when using 8b/10b encoding.
>
MACB_SERDES_RATE_5_PT_15625Gbps is for 5.15625Gbps, I think this should be just
MACB_SERDES_RATE_5_Gbps and MACB_SERDES_RATE_10_Gbps. I will do it in next patch set.
>Xilinx documentation:
>https://urldefense.proofpoint.com/v2/url?u=https-
>3A__www.xilinx.com_support_documentation_ip-5Fdocumentation_usxgmii_v1-
>5F1_pg251-
>2Dusxgmii.pdf&d=DwIBAg&c=aUq983L2pue2FqKFoP6PGHMJQyoJ7kl3s3GZ-
>_haXqY&r=GTefrem3hiBCnsjCOqAuapQHRN8-rKC1FRbk0it-
>LDs&m=6V8fNIg49czRjfvVtDJ5BbR28p9UPlLLyB7fah7ypcw&s=LsDphgLBe1VDpM
>_K9pkuyal873WeKqHDv64NDRUWy1Q&e=
>seems to suggest USXGMII uses a fixed rate of 10.3125Gb/s. So why do
>you need to change the rate?
For USXGMII, Cadence MAC need to be correctly programmed for external serdes rate.
Regards,
Parshuram Thombare
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox