* [PATCH AUTOSEL 5.1 67/95] cfg80211: report measurement start TSF correctly
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Avraham Stern, Luca Coelho, Johannes Berg, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Avraham Stern <avraham.stern@intel.com>
[ Upstream commit b65842025335711e2a0259feb4dbadb0c9ffb6d9 ]
Instead of reporting the AP's TSF, host time was reported. Fix it.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/pmsr.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 5e2ab01d325c..d06d514f0bba 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0 */
/*
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
*/
#ifndef __PMSR_H
#define __PMSR_H
@@ -446,7 +446,7 @@ static int nl80211_pmsr_send_result(struct sk_buff *msg,
if (res->ap_tsf_valid &&
nla_put_u64_64bit(msg, NL80211_PMSR_RESP_ATTR_AP_TSF,
- res->host_time, NL80211_PMSR_RESP_ATTR_PAD))
+ res->ap_tsf, NL80211_PMSR_RESP_ATTR_PAD))
goto error;
if (res->final && nla_put_flag(msg, NL80211_PMSR_RESP_ATTR_FINAL))
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 66/95] cfg80211: util: fix bit count off by one
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mordechay Goodstein, Luca Coelho, Johannes Berg, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Mordechay Goodstein <mordechay.goodstein@intel.com>
[ Upstream commit 1a473d6092d5d182914bea854ce0b21e6d12519d ]
The bits of Rx MCS Map in VHT capability were enumerated
with index transform - index i -> (i + 1) bit => nss i. BUG!
while it should be - index i -> (i + 1) bit => (i + 1) nss.
The bug was exposed in commit a53b2a0b1245 ("iwlwifi: mvm: implement VHT
extended NSS support in rs.c"), where iwlwifi started using the
function.
Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: b0aa75f0b1b2 ("ieee80211: add new VHT capability fields/parsing")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 5a03f38788e7..5ac66a571e33 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1989,7 +1989,7 @@ int ieee80211_get_vht_max_nss(struct ieee80211_vht_cap *cap,
continue;
if (supp >= mcs_encoding) {
- max_vht_nss = i;
+ max_vht_nss = i + 1;
break;
}
}
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 58/95] bpf: fix div64 overflow tests to properly detect errors
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Naveen N. Rao, Daniel Borkmann, Sasha Levin, linux-kselftest,
netdev, bpf
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
[ Upstream commit 3e0682695199bad51dd898fe064d1564637ff77a ]
If the result of the division is LLONG_MIN, current tests do not detect
the error since the return value is truncated to a 32-bit value and ends
up being 0.
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../testing/selftests/bpf/verifier/div_overflow.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/bpf/verifier/div_overflow.c b/tools/testing/selftests/bpf/verifier/div_overflow.c
index bd3f38dbe796..acab4f00819f 100644
--- a/tools/testing/selftests/bpf/verifier/div_overflow.c
+++ b/tools/testing/selftests/bpf/verifier/div_overflow.c
@@ -29,8 +29,11 @@
"DIV64 overflow, check 1",
.insns = {
BPF_MOV64_IMM(BPF_REG_1, -1),
- BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
- BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
+ BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
+ BPF_ALU64_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
+ BPF_MOV32_IMM(BPF_REG_0, 0),
+ BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 1),
+ BPF_MOV32_IMM(BPF_REG_0, 1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
@@ -40,8 +43,11 @@
{
"DIV64 overflow, check 2",
.insns = {
- BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
- BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, -1),
+ BPF_LD_IMM64(BPF_REG_1, LLONG_MIN),
+ BPF_ALU64_IMM(BPF_DIV, BPF_REG_1, -1),
+ BPF_MOV32_IMM(BPF_REG_0, 0),
+ BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_1, 1),
+ BPF_MOV32_IMM(BPF_REG_0, 1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 45/95] ibmvnic: Fix unchecked return codes of memory allocations
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Falcon, David S . Miller, Sasha Levin, netdev,
linuxppc-dev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Thomas Falcon <tlfalcon@linux.ibm.com>
[ Upstream commit 7c940b1a5291e5069d561f5b8f0e51db6b7a259a ]
The return values for these memory allocations are unchecked,
which may cause an oops if the driver does not handle them after
a failure. Fix by checking the function's return code.
Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ibm/ibmvnic.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 664e52fa7919..0e4029c54241 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -438,9 +438,10 @@ static int reset_rx_pools(struct ibmvnic_adapter *adapter)
if (rx_pool->buff_size != be64_to_cpu(size_array[i])) {
free_long_term_buff(adapter, &rx_pool->long_term_buff);
rx_pool->buff_size = be64_to_cpu(size_array[i]);
- alloc_long_term_buff(adapter, &rx_pool->long_term_buff,
- rx_pool->size *
- rx_pool->buff_size);
+ rc = alloc_long_term_buff(adapter,
+ &rx_pool->long_term_buff,
+ rx_pool->size *
+ rx_pool->buff_size);
} else {
rc = reset_long_term_buff(adapter,
&rx_pool->long_term_buff);
@@ -706,9 +707,9 @@ static int init_tx_pools(struct net_device *netdev)
return rc;
}
- init_one_tx_pool(netdev, &adapter->tso_pool[i],
- IBMVNIC_TSO_BUFS,
- IBMVNIC_TSO_BUF_SZ);
+ rc = init_one_tx_pool(netdev, &adapter->tso_pool[i],
+ IBMVNIC_TSO_BUFS,
+ IBMVNIC_TSO_BUF_SZ);
if (rc) {
release_tx_pools(adapter);
return rc;
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 43/95] ibmvnic: Do not close unopened driver during reset
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Falcon, David S . Miller, Sasha Levin, netdev,
linuxppc-dev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Thomas Falcon <tlfalcon@linux.ibm.com>
[ Upstream commit 1f94608b0ce141be5286dde31270590bdf35b86a ]
Check driver state before halting it during a reset. If the driver is
not running, do nothing. Otherwise, a request to deactivate a down link
can cause an error and the reset will fail.
Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ibm/ibmvnic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 3dfb2d131eb7..71bf895409a1 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1751,7 +1751,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
ibmvnic_cleanup(netdev);
- if (adapter->reset_reason != VNIC_RESET_MOBILITY &&
+ if (reset_state == VNIC_OPEN &&
+ adapter->reset_reason != VNIC_RESET_MOBILITY &&
adapter->reset_reason != VNIC_RESET_FAILOVER) {
rc = __ibmvnic_close(netdev);
if (rc)
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 39/95] can: m_can: implement errata "Needless activation of MRAF irq"
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Eugen Hristev, Ludovic Desroches, Marc Kleine-Budde, Sasha Levin,
linux-can, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Eugen Hristev <eugen.hristev@microchip.com>
[ Upstream commit 3e82f2f34c930a2a0a9e69fdc2de2f2f1388b442 ]
During frame reception while the MCAN is in Error Passive state and the
Receive Error Counter has thevalue MCAN_ECR.REC = 127, it may happen
that MCAN_IR.MRAF is set although there was no Message RAM access
failure. If MCAN_IR.MRAF is enabled, an interrupt to the Host CPU is
generated.
Work around:
The Message RAM Access Failure interrupt routine needs to check whether
MCAN_ECR.RP = '1' and MCAN_ECR.REC = '127'.
In this case, reset MCAN_IR.MRAF. No further action is required.
This affects versions older than 3.2.0
Errata explained on Sama5d2 SoC which includes this hardware block:
http://ww1.microchip.com/downloads/en/DeviceDoc/SAMA5D2-Family-Silicon-Errata-and-Data-Sheet-Clarification-DS80000803B.pdf
chapter 6.2
Reproducibility: If 2 devices with m_can are connected back to back,
configuring different bitrate on them will lead to interrupt storm on
the receiving side, with error "Message RAM access failure occurred".
Another way is to have a bad hardware connection. Bad wire connection
can lead to this issue as well.
This patch fixes the issue according to provided workaround.
Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Reviewed-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/m_can/m_can.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 9b449400376b..deb274a19ba0 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -822,6 +822,27 @@ static int m_can_poll(struct napi_struct *napi, int quota)
if (!irqstatus)
goto end;
+ /* Errata workaround for issue "Needless activation of MRAF irq"
+ * During frame reception while the MCAN is in Error Passive state
+ * and the Receive Error Counter has the value MCAN_ECR.REC = 127,
+ * it may happen that MCAN_IR.MRAF is set although there was no
+ * Message RAM access failure.
+ * If MCAN_IR.MRAF is enabled, an interrupt to the Host CPU is generated
+ * The Message RAM Access Failure interrupt routine needs to check
+ * whether MCAN_ECR.RP = ’1’ and MCAN_ECR.REC = 127.
+ * In this case, reset MCAN_IR.MRAF. No further action is required.
+ */
+ if ((priv->version <= 31) && (irqstatus & IR_MRAF) &&
+ (m_can_read(priv, M_CAN_ECR) & ECR_RP)) {
+ struct can_berr_counter bec;
+
+ __m_can_get_berr_counter(dev, &bec);
+ if (bec.rxerr == 127) {
+ m_can_write(priv, M_CAN_IR, IR_MRAF);
+ irqstatus &= ~IR_MRAF;
+ }
+ }
+
psr = m_can_read(priv, M_CAN_PSR);
if (irqstatus & IR_ERR_STATE)
work_done += m_can_handle_state_errors(dev, psr);
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 38/95] can: mcp251x: add support for mcp25625
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sean Nyekjaer, Marc Kleine-Budde, Sasha Levin, linux-can, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Sean Nyekjaer <sean@geanix.com>
[ Upstream commit 35b7fa4d07c43ad79b88e6462119e7140eae955c ]
Fully compatible with mcp2515, the mcp25625 have integrated transceiver.
This patch adds support for the mcp25625 to the existing mcp251x driver.
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/spi/Kconfig | 5 +++--
drivers/net/can/spi/mcp251x.c | 25 ++++++++++++++++---------
2 files changed, 19 insertions(+), 11 deletions(-)
diff --git a/drivers/net/can/spi/Kconfig b/drivers/net/can/spi/Kconfig
index 8f2e0dd7b756..792e9c6c4a2f 100644
--- a/drivers/net/can/spi/Kconfig
+++ b/drivers/net/can/spi/Kconfig
@@ -8,9 +8,10 @@ config CAN_HI311X
Driver for the Holt HI311x SPI CAN controllers.
config CAN_MCP251X
- tristate "Microchip MCP251x SPI CAN controllers"
+ tristate "Microchip MCP251x and MCP25625 SPI CAN controllers"
depends on HAS_DMA
---help---
- Driver for the Microchip MCP251x SPI CAN controllers.
+ Driver for the Microchip MCP251x and MCP25625 SPI CAN
+ controllers.
endmenu
diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
index e90817608645..da64e71a62ee 100644
--- a/drivers/net/can/spi/mcp251x.c
+++ b/drivers/net/can/spi/mcp251x.c
@@ -1,5 +1,5 @@
/*
- * CAN bus driver for Microchip 251x CAN Controller with SPI Interface
+ * CAN bus driver for Microchip 251x/25625 CAN Controller with SPI Interface
*
* MCP2510 support and bug fixes by Christian Pellegrin
* <chripell@evolware.org>
@@ -41,7 +41,7 @@
* static struct spi_board_info spi_board_info[] = {
* {
* .modalias = "mcp2510",
- * // or "mcp2515" depending on your controller
+ * // "mcp2515" or "mcp25625" depending on your controller
* .platform_data = &mcp251x_info,
* .irq = IRQ_EINT13,
* .max_speed_hz = 2*1000*1000,
@@ -238,6 +238,7 @@ static const struct can_bittiming_const mcp251x_bittiming_const = {
enum mcp251x_model {
CAN_MCP251X_MCP2510 = 0x2510,
CAN_MCP251X_MCP2515 = 0x2515,
+ CAN_MCP251X_MCP25625 = 0x25625,
};
struct mcp251x_priv {
@@ -280,7 +281,6 @@ static inline int mcp251x_is_##_model(struct spi_device *spi) \
}
MCP251X_IS(2510);
-MCP251X_IS(2515);
static void mcp251x_clean(struct net_device *net)
{
@@ -639,7 +639,7 @@ static int mcp251x_hw_reset(struct spi_device *spi)
/* Wait for oscillator startup timer after reset */
mdelay(MCP251X_OST_DELAY_MS);
-
+
reg = mcp251x_read_reg(spi, CANSTAT);
if ((reg & CANCTRL_REQOP_MASK) != CANCTRL_REQOP_CONF)
return -ENODEV;
@@ -820,9 +820,8 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev_id)
/* receive buffer 0 */
if (intf & CANINTF_RX0IF) {
mcp251x_hw_rx(spi, 0);
- /*
- * Free one buffer ASAP
- * (The MCP2515 does this automatically.)
+ /* Free one buffer ASAP
+ * (The MCP2515/25625 does this automatically.)
*/
if (mcp251x_is_2510(spi))
mcp251x_write_bits(spi, CANINTF, CANINTF_RX0IF, 0x00);
@@ -831,7 +830,7 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev_id)
/* receive buffer 1 */
if (intf & CANINTF_RX1IF) {
mcp251x_hw_rx(spi, 1);
- /* the MCP2515 does this automatically */
+ /* The MCP2515/25625 does this automatically. */
if (mcp251x_is_2510(spi))
clear_intf |= CANINTF_RX1IF;
}
@@ -1006,6 +1005,10 @@ static const struct of_device_id mcp251x_of_match[] = {
.compatible = "microchip,mcp2515",
.data = (void *)CAN_MCP251X_MCP2515,
},
+ {
+ .compatible = "microchip,mcp25625",
+ .data = (void *)CAN_MCP251X_MCP25625,
+ },
{ }
};
MODULE_DEVICE_TABLE(of, mcp251x_of_match);
@@ -1019,6 +1022,10 @@ static const struct spi_device_id mcp251x_id_table[] = {
.name = "mcp2515",
.driver_data = (kernel_ulong_t)CAN_MCP251X_MCP2515,
},
+ {
+ .name = "mcp25625",
+ .driver_data = (kernel_ulong_t)CAN_MCP251X_MCP25625,
+ },
{ }
};
MODULE_DEVICE_TABLE(spi, mcp251x_id_table);
@@ -1259,5 +1266,5 @@ module_spi_driver(mcp251x_can_driver);
MODULE_AUTHOR("Chris Elston <celston@katalix.com>, "
"Christian Pellegrin <chripell@evolware.org>");
-MODULE_DESCRIPTION("Microchip 251x CAN driver");
+MODULE_DESCRIPTION("Microchip 251x/25625 CAN driver");
MODULE_LICENSE("GPL v2");
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 37/95] dt-bindings: can: mcp251x: add mcp25625 support
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sean Nyekjaer, Marc Kleine-Budde, Sasha Levin, linux-can, netdev,
devicetree
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Sean Nyekjaer <sean@geanix.com>
[ Upstream commit 0df82dcd55832a99363ab7f9fab954fcacdac3ae ]
Fully compatible with mcp2515, the mcp25625 have integrated transceiver.
This patch add the mcp25625 to the device tree bindings documentation.
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/devicetree/bindings/net/can/microchip,mcp251x.txt | 1 +
1 file changed, 1 insertion(+)
diff --git a/Documentation/devicetree/bindings/net/can/microchip,mcp251x.txt b/Documentation/devicetree/bindings/net/can/microchip,mcp251x.txt
index 188c8bd4eb67..5a0111d4de58 100644
--- a/Documentation/devicetree/bindings/net/can/microchip,mcp251x.txt
+++ b/Documentation/devicetree/bindings/net/can/microchip,mcp251x.txt
@@ -4,6 +4,7 @@ Required properties:
- compatible: Should be one of the following:
- "microchip,mcp2510" for MCP2510.
- "microchip,mcp2515" for MCP2515.
+ - "microchip,mcp25625" for MCP25625.
- reg: SPI chip select.
- clocks: The clock feeding the CAN controller.
- interrupts: Should contain IRQ line for the CAN controller.
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 33/95] tools: bpftool: Fix JSON output when lookup fails
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Krzesimir Nowak, Quentin Monnet, Andrii Nakryiko, Daniel Borkmann,
Sasha Levin, netdev, bpf
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Krzesimir Nowak <krzesimir@kinvolk.io>
[ Upstream commit 1884c066579a7a274dd981a4d9639ca63db66a23 ]
In commit 9a5ab8bf1d6d ("tools: bpftool: turn err() and info() macros
into functions") one case of error reporting was special cased, so it
could report a lookup error for a specific key when dumping the map
element. What the code forgot to do is to wrap the key and value keys
into a JSON object, so an example output of pretty JSON dump of a
sockhash map (which does not support looking up its values) is:
[
"key": ["0x0a","0x41","0x00","0x02","0x1f","0x78","0x00","0x00"
],
"value": {
"error": "Operation not supported"
},
"key": ["0x0a","0x41","0x00","0x02","0x1f","0x78","0x00","0x01"
],
"value": {
"error": "Operation not supported"
}
]
Note the key-value pairs inside the toplevel array. They should be
wrapped inside a JSON object, otherwise it is an invalid JSON. This
commit fixes this, so the output now is:
[{
"key": ["0x0a","0x41","0x00","0x02","0x1f","0x78","0x00","0x00"
],
"value": {
"error": "Operation not supported"
}
},{
"key": ["0x0a","0x41","0x00","0x02","0x1f","0x78","0x00","0x01"
],
"value": {
"error": "Operation not supported"
}
}
]
Fixes: 9a5ab8bf1d6d ("tools: bpftool: turn err() and info() macros into functions")
Cc: Quentin Monnet <quentin.monnet@netronome.com>
Signed-off-by: Krzesimir Nowak <krzesimir@kinvolk.io>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bpf/bpftool/map.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 994a7e0d16fb..14f581b562bd 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -713,12 +713,14 @@ static int dump_map_elem(int fd, void *key, void *value,
return 0;
if (json_output) {
+ jsonw_start_object(json_wtr);
jsonw_name(json_wtr, "key");
print_hex_data_json(key, map_info->key_size);
jsonw_name(json_wtr, "value");
jsonw_start_object(json_wtr);
jsonw_string_field(json_wtr, "error", strerror(lookup_errno));
jsonw_end_object(json_wtr);
+ jsonw_end_object(json_wtr);
} else {
if (errno == ENOENT)
print_entry_plain(map_info, key, NULL);
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 32/95] netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Guillaume Nault, Pablo Neira Ayuso, Sasha Levin, netfilter-devel,
coreteam, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Guillaume Nault <gnault@redhat.com>
[ Upstream commit a0d56cb911ca301de81735f1d73c2aab424654ba ]
With commit 997dd9647164 ("net: IP6 defrag: use rbtrees in
nf_conntrack_reasm.c"), nf_ct_frag6_reasm() is now called from
nf_ct_frag6_queue(). With this change, nf_ct_frag6_queue() can fail
after the skb has been added to the fragment queue and
nf_ct_frag6_gather() was adapted to handle this case.
But nf_ct_frag6_queue() can still fail before the fragment has been
queued. nf_ct_frag6_gather() can't handle this case anymore, because it
has no way to know if nf_ct_frag6_queue() queued the fragment before
failing. If it didn't, the skb is lost as the error code is overwritten
with -EINPROGRESS.
Fix this by setting -EINPROGRESS directly in nf_ct_frag6_queue(), so
that nf_ct_frag6_gather() can propagate the error as is.
Fixes: 997dd9647164 ("net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c")
Signed-off-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/netfilter/nf_conntrack_reasm.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 3de0e9b0a482..5b3f65e29b6f 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -293,7 +293,11 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
skb->_skb_refdst = 0UL;
err = nf_ct_frag6_reasm(fq, skb, prev, dev);
skb->_skb_refdst = orefdst;
- return err;
+
+ /* After queue has assumed skb ownership, only 0 or
+ * -EINPROGRESS must be returned.
+ */
+ return err ? -EINPROGRESS : 0;
}
skb_dst_drop(skb);
@@ -480,12 +484,6 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
ret = 0;
}
- /* after queue has assumed skb ownership, only 0 or -EINPROGRESS
- * must be returned.
- */
- if (ret)
- ret = -EINPROGRESS;
-
spin_unlock_bh(&fq->q.lock);
inet_frag_put(&fq->q);
return ret;
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 27/95] iwlwifi: fix AX201 killer sku loading firmware issue
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Matt Chen, Luca Coelho, Kalle Valo, Sasha Levin, linux-wireless,
netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Matt Chen <matt.chen@intel.com>
[ Upstream commit b17dc0632a17fbfe66b34ee7c24e1cc10cfc503e ]
When try to bring up the AX201 2 killer sku, we
run into:
[81261.392463] iwlwifi 0000:01:00.0: loaded firmware version 46.8c20f243.0 op_mode iwlmvm
[81261.407407] iwlwifi 0000:01:00.0: Detected Intel(R) Dual Band Wireless AX 22000, REV=0x340
[81262.424778] iwlwifi 0000:01:00.0: Collecting data: trigger 16 fired.
[81262.673359] iwlwifi 0000:01:00.0: Start IWL Error Log Dump:
[81262.673365] iwlwifi 0000:01:00.0: Status: 0x00000000, count: -906373681
[81262.673368] iwlwifi 0000:01:00.0: Loaded firmware version: 46.8c20f243.0
[81262.673371] iwlwifi 0000:01:00.0: 0x507C015D | ADVANCED_SYSASSERT
Fix this issue by adding 2 more cfg to avoid modifying the
original cfg configuration.
Signed-off-by: Matt Chen <matt.chen@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 2a03d34afa3b..80695584e406 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -3585,7 +3585,9 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
}
} else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR) &&
- (trans->cfg != &iwl_ax200_cfg_cc ||
+ ((trans->cfg != &iwl_ax200_cfg_cc &&
+ trans->cfg != &killer1650x_2ax_cfg &&
+ trans->cfg != &killer1650w_2ax_cfg) ||
trans->hw_rev == CSR_HW_REV_TYPE_QNJ_B0)) {
u32 hw_status;
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 26/95] iwlwifi: clear persistence bit according to device family
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shahar S Matityahu, Luca Coelho, Kalle Valo, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Shahar S Matityahu <shahar.s.matityahu@intel.com>
[ Upstream commit 44f61b5c832c4085fcf476484efeaeef96dcfb8b ]
The driver attempts to clear persistence bit on any device familiy even
though only 9000 and 22000 families require it. Clear the bit only on
the relevant device families.
Each HW has different address to the write protection register. Use the
right register for each HW
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Fixes: 8954e1eb2270 ("iwlwifi: trans: Clear persistence bit when starting the FW")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/iwl-prph.h | 7 ++-
.../net/wireless/intel/iwlwifi/pcie/trans.c | 46 +++++++++++++------
2 files changed, 39 insertions(+), 14 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
index 1af9f9e1ecd4..0c0799d13e15 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
@@ -402,7 +402,12 @@ enum aux_misc_master1_en {
#define AUX_MISC_MASTER1_SMPHR_STATUS 0xA20800
#define RSA_ENABLE 0xA24B08
#define PREG_AUX_BUS_WPROT_0 0xA04CC0
-#define PREG_PRPH_WPROT_0 0xA04CE0
+
+/* device family 9000 WPROT register */
+#define PREG_PRPH_WPROT_9000 0xA04CE0
+/* device family 22000 WPROT register */
+#define PREG_PRPH_WPROT_22000 0xA04D00
+
#define SB_CPU_1_STATUS 0xA01E30
#define SB_CPU_2_STATUS 0xA01E34
#define UMAG_SB_CPU_1_STATUS 0xA038C0
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index c4375b868901..2a03d34afa3b 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -1696,26 +1696,26 @@ static int iwl_pcie_init_msix_handler(struct pci_dev *pdev,
return 0;
}
-static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
+static int iwl_trans_pcie_clear_persistence_bit(struct iwl_trans *trans)
{
- struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
- u32 hpm;
- int err;
-
- lockdep_assert_held(&trans_pcie->mutex);
+ u32 hpm, wprot;
- err = iwl_pcie_prepare_card_hw(trans);
- if (err) {
- IWL_ERR(trans, "Error while preparing HW: %d\n", err);
- return err;
+ switch (trans->cfg->device_family) {
+ case IWL_DEVICE_FAMILY_9000:
+ wprot = PREG_PRPH_WPROT_9000;
+ break;
+ case IWL_DEVICE_FAMILY_22000:
+ wprot = PREG_PRPH_WPROT_22000;
+ break;
+ default:
+ return 0;
}
hpm = iwl_read_umac_prph_no_grab(trans, HPM_DEBUG);
if (hpm != 0xa5a5a5a0 && (hpm & PERSISTENCE_BIT)) {
- int wfpm_val = iwl_read_umac_prph_no_grab(trans,
- PREG_PRPH_WPROT_0);
+ u32 wprot_val = iwl_read_umac_prph_no_grab(trans, wprot);
- if (wfpm_val & PREG_WFPM_ACCESS) {
+ if (wprot_val & PREG_WFPM_ACCESS) {
IWL_ERR(trans,
"Error, can not clear persistence bit\n");
return -EPERM;
@@ -1724,6 +1724,26 @@ static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
hpm & ~PERSISTENCE_BIT);
}
+ return 0;
+}
+
+static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
+{
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+ int err;
+
+ lockdep_assert_held(&trans_pcie->mutex);
+
+ err = iwl_pcie_prepare_card_hw(trans);
+ if (err) {
+ IWL_ERR(trans, "Error while preparing HW: %d\n", err);
+ return err;
+ }
+
+ err = iwl_trans_pcie_clear_persistence_bit(trans);
+ if (err)
+ return err;
+
iwl_trans_pcie_sw_reset(trans);
err = iwl_pcie_apm_init(trans);
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 25/95] iwlwifi: fix load in rfkill flow for unified firmware
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Emmanuel Grumbach, Luca Coelho, Kalle Valo, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
[ Upstream commit b3500b472c880b5abe90ffd5c4a25aa736f906ad ]
When we have a single image (same firmware image for INIT and
OPERATIONAL), we couldn't load the driver and register to the
stack if we had hardware RF-Kill asserted.
Fix this. This required a few changes:
1) Run the firmware as part of the INIT phase even if its
ucode_type is not IWL_UCODE_INIT.
2) Send the commands that are sent to the unified image in
INIT flow even in RF-Kill.
3) Don't ask the transport to stop the hardware upon RF-Kill
interrupt if the RF-Kill is asserted.
4) Allow the RF-Kill interrupt to take us out of L1A so that
the RF-Kill interrupt will be received by the host (to
enable the radio).
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 23 ++++++++++++++-----
.../net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 17 ++++++++++----
.../wireless/intel/iwlwifi/pcie/internal.h | 2 +-
5 files changed, 33 insertions(+), 13 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index ab68b5d53ec9..153717587aeb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -311,6 +311,8 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
int ret;
enum iwl_ucode_type old_type = mvm->fwrt.cur_fw_img;
static const u16 alive_cmd[] = { MVM_ALIVE };
+ bool run_in_rfkill =
+ ucode_type == IWL_UCODE_INIT || iwl_mvm_has_unified_ucode(mvm);
if (ucode_type == IWL_UCODE_REGULAR &&
iwl_fw_dbg_conf_usniffer(mvm->fw, FW_DBG_START_FROM_ALIVE) &&
@@ -328,7 +330,12 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
alive_cmd, ARRAY_SIZE(alive_cmd),
iwl_alive_fn, &alive_data);
- ret = iwl_trans_start_fw(mvm->trans, fw, ucode_type == IWL_UCODE_INIT);
+ /*
+ * We want to load the INIT firmware even in RFKILL
+ * For the unified firmware case, the ucode_type is not
+ * INIT, but we still need to run it.
+ */
+ ret = iwl_trans_start_fw(mvm->trans, fw, run_in_rfkill);
if (ret) {
iwl_fw_set_current_image(&mvm->fwrt, old_type);
iwl_remove_notification(&mvm->notif_wait, &alive_wait);
@@ -433,7 +440,8 @@ static int iwl_run_unified_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
* commands
*/
ret = iwl_mvm_send_cmd_pdu(mvm, WIDE_ID(SYSTEM_GROUP,
- INIT_EXTENDED_CFG_CMD), 0,
+ INIT_EXTENDED_CFG_CMD),
+ CMD_SEND_IN_RFKILL,
sizeof(init_cfg), &init_cfg);
if (ret) {
IWL_ERR(mvm, "Failed to run init config command: %d\n",
@@ -457,7 +465,8 @@ static int iwl_run_unified_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
}
ret = iwl_mvm_send_cmd_pdu(mvm, WIDE_ID(REGULATORY_AND_NVM_GROUP,
- NVM_ACCESS_COMPLETE), 0,
+ NVM_ACCESS_COMPLETE),
+ CMD_SEND_IN_RFKILL,
sizeof(nvm_complete), &nvm_complete);
if (ret) {
IWL_ERR(mvm, "Failed to run complete NVM access: %d\n",
@@ -482,6 +491,8 @@ static int iwl_run_unified_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
}
}
+ mvm->rfkill_safe_init_done = true;
+
return 0;
error:
@@ -526,7 +537,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
lockdep_assert_held(&mvm->mutex);
- if (WARN_ON_ONCE(mvm->calibrating))
+ if (WARN_ON_ONCE(mvm->rfkill_safe_init_done))
return 0;
iwl_init_notification_wait(&mvm->notif_wait,
@@ -576,7 +587,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
goto remove_notif;
}
- mvm->calibrating = true;
+ mvm->rfkill_safe_init_done = true;
/* Send TX valid antennas before triggering calibrations */
ret = iwl_send_tx_ant_cfg(mvm, iwl_mvm_get_valid_tx_ant(mvm));
@@ -612,7 +623,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
remove_notif:
iwl_remove_notification(&mvm->notif_wait, &calib_wait);
out:
- mvm->calibrating = false;
+ mvm->rfkill_safe_init_done = false;
if (iwlmvm_mod_params.init_dbg && !mvm->nvm_data) {
/* we want to debug INIT and we have no NVM - fake */
mvm->nvm_data = kzalloc(sizeof(struct iwl_nvm_data) +
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 6a3b11dd2edf..4ddf620c267d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -1211,7 +1211,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
mvm->scan_status = 0;
mvm->ps_disabled = false;
- mvm->calibrating = false;
+ mvm->rfkill_safe_init_done = false;
/* just in case one was running */
iwl_mvm_cleanup_roc_te(mvm);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index a50dc53df086..b698d55ace1b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -877,7 +877,7 @@ struct iwl_mvm {
struct iwl_mvm_vif *bf_allowed_vif;
bool hw_registered;
- bool calibrating;
+ bool rfkill_safe_init_done;
bool support_umac_log;
u32 ampdu_ref;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 13681b03c10e..20115770e75a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1222,7 +1222,8 @@ void iwl_mvm_set_hw_ctkill_state(struct iwl_mvm *mvm, bool state)
static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
{
struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
- bool calibrating = READ_ONCE(mvm->calibrating);
+ bool rfkill_safe_init_done = READ_ONCE(mvm->rfkill_safe_init_done);
+ bool unified = iwl_mvm_has_unified_ucode(mvm);
if (state)
set_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status);
@@ -1231,15 +1232,23 @@ static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
iwl_mvm_set_rfkill_state(mvm);
- /* iwl_run_init_mvm_ucode is waiting for results, abort it */
- if (calibrating)
+ /* iwl_run_init_mvm_ucode is waiting for results, abort it. */
+ if (rfkill_safe_init_done)
iwl_abort_notification_waits(&mvm->notif_wait);
+ /*
+ * Don't ask the transport to stop the firmware. We'll do it
+ * after cfg80211 takes us down.
+ */
+ if (unified)
+ return false;
+
/*
* Stop the device if we run OPERATIONAL firmware or if we are in the
* middle of the calibrations.
*/
- return state && (mvm->fwrt.cur_fw_img != IWL_UCODE_INIT || calibrating);
+ return state && (mvm->fwrt.cur_fw_img != IWL_UCODE_INIT ||
+ rfkill_safe_init_done);
}
static void iwl_mvm_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
index 59213164f35e..2afce5c41322 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
@@ -948,7 +948,7 @@ static inline void iwl_enable_rfkill_int(struct iwl_trans *trans)
MSIX_HW_INT_CAUSES_REG_RF_KILL);
}
- if (trans->cfg->device_family == IWL_DEVICE_FAMILY_9000) {
+ if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_9000) {
/*
* On 9000-series devices this bit isn't enabled by default, so
* when we power down the device we need set the bit to allow it
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 23/95] mwifiex: Abort at too short BSS descriptor element
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Takashi Iwai, Kalle Valo, Sasha Levin, linux-wireless, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 685c9b7750bfacd6fc1db50d86579980593b7869 ]
Currently mwifiex_update_bss_desc_with_ie() implicitly assumes that
the source descriptor entries contain the enough size for each type
and performs copying without checking the source size. This may lead
to read over boundary.
Fix this by putting the source size check in appropriate places.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/scan.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index 64ab6fe78c0d..c269a0de9413 100644
--- a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -1269,6 +1269,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_FH_PARAMS:
+ if (element_len + 2 < sizeof(*fh_param_set))
+ return -EINVAL;
fh_param_set =
(struct ieee_types_fh_param_set *) current_ptr;
memcpy(&bss_entry->phy_param_set.fh_param_set,
@@ -1277,6 +1279,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_DS_PARAMS:
+ if (element_len + 2 < sizeof(*ds_param_set))
+ return -EINVAL;
ds_param_set =
(struct ieee_types_ds_param_set *) current_ptr;
@@ -1288,6 +1292,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_CF_PARAMS:
+ if (element_len + 2 < sizeof(*cf_param_set))
+ return -EINVAL;
cf_param_set =
(struct ieee_types_cf_param_set *) current_ptr;
memcpy(&bss_entry->ss_param_set.cf_param_set,
@@ -1296,6 +1302,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_IBSS_PARAMS:
+ if (element_len + 2 < sizeof(*ibss_param_set))
+ return -EINVAL;
ibss_param_set =
(struct ieee_types_ibss_param_set *)
current_ptr;
@@ -1305,10 +1313,14 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_ERP_INFO:
+ if (!element_len)
+ return -EINVAL;
bss_entry->erp_flags = *(current_ptr + 2);
break;
case WLAN_EID_PWR_CONSTRAINT:
+ if (!element_len)
+ return -EINVAL;
bss_entry->local_constraint = *(current_ptr + 2);
bss_entry->sensed_11h = true;
break;
@@ -1349,6 +1361,9 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_VENDOR_SPECIFIC:
+ if (element_len + 2 < sizeof(vendor_ie->vend_hdr))
+ return -EINVAL;
+
vendor_ie = (struct ieee_types_vendor_specific *)
current_ptr;
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 20/95] mac80211: free peer keys before vif down in mesh
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Pradeep Kumar Chitrapu, Johannes Berg, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
[ Upstream commit 0112fa557c3bb3a002bc85760dc3761d737264d3 ]
freeing peer keys after vif down is resulting in peer key uninstall
to fail due to interface lookup failure. so fix that.
Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/mesh.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index d5aba5029cb0..fe44f0d98de0 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -929,6 +929,7 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
/* flush STAs and mpaths on this iface */
sta_info_flush(sdata);
+ ieee80211_free_keys(sdata, true);
mesh_path_flush_by_iface(sdata);
/* stop the beacon */
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 13/95] mac80211: fix rate reporting inside cfg80211_calculate_bitrate_he()
From: Sasha Levin @ 2019-06-27 0:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: John Crispin, Shashidhar Lakkavalli, Johannes Berg, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: John Crispin <john@phrozen.org>
[ Upstream commit 25d16d124a5e249e947c0487678b61dcff25cf8b ]
The reported rate is not scaled down correctly. After applying this patch,
the function will behave just like the v/ht equivalents.
Signed-off-by: Shashidhar Lakkavalli <slakkavalli@datto.com>
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 75899b62bdc9..5a03f38788e7 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1237,7 +1237,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)
if (rate->he_dcm)
result /= 2;
- return result;
+ return result / 10000;
}
u32 cfg80211_calculate_bitrate(struct rate_info *rate)
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 10/95] samples, bpf: suppress compiler warning
From: Sasha Levin @ 2019-06-27 0:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Matteo Croce, Daniel Borkmann, Sasha Levin, netdev, bpf
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Matteo Croce <mcroce@redhat.com>
[ Upstream commit a195cefff49f60054998333e81ee95170ce8bf92 ]
GCC 9 fails to calculate the size of local constant strings and produces a
false positive:
samples/bpf/task_fd_query_user.c: In function ‘test_debug_fs_uprobe’:
samples/bpf/task_fd_query_user.c:242:67: warning: ‘%s’ directive output may be truncated writing up to 255 bytes into a region of size 215 [-Wformat-truncation=]
242 | snprintf(buf, sizeof(buf), "/sys/kernel/debug/tracing/events/%ss/%s/id",
| ^~
243 | event_type, event_alias);
| ~~~~~~~~~~~
samples/bpf/task_fd_query_user.c:242:2: note: ‘snprintf’ output between 45 and 300 bytes into a destination of size 256
242 | snprintf(buf, sizeof(buf), "/sys/kernel/debug/tracing/events/%ss/%s/id",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
243 | event_type, event_alias);
| ~~~~~~~~~~~~~~~~~~~~~~~~
Workaround this by lowering the buffer size to a reasonable value.
Related GCC Bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83431
Signed-off-by: Matteo Croce <mcroce@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
samples/bpf/task_fd_query_user.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/samples/bpf/task_fd_query_user.c b/samples/bpf/task_fd_query_user.c
index aff2b4ae914e..e39938058223 100644
--- a/samples/bpf/task_fd_query_user.c
+++ b/samples/bpf/task_fd_query_user.c
@@ -216,7 +216,7 @@ static int test_debug_fs_uprobe(char *binary_path, long offset, bool is_return)
{
const char *event_type = "uprobe";
struct perf_event_attr attr = {};
- char buf[256], event_alias[256];
+ char buf[256], event_alias[sizeof("test_1234567890")];
__u64 probe_offset, probe_addr;
__u32 len, prog_id, fd_type;
int err, res, kfd, efd;
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 09/95] samples, bpf: fix to change the buffer size for read()
From: Sasha Levin @ 2019-06-27 0:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Chang-Hsien Tsai, Daniel Borkmann, Sasha Levin, netdev, bpf
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Chang-Hsien Tsai <luke.tw@gmail.com>
[ Upstream commit f7c2d64bac1be2ff32f8e4f500c6e5429c1003e0 ]
If the trace for read is larger than 4096, the return
value sz will be 4096. This results in off-by-one error
on buf:
static char buf[4096];
ssize_t sz;
sz = read(trace_fd, buf, sizeof(buf));
if (sz > 0) {
buf[sz] = 0;
puts(buf);
}
Signed-off-by: Chang-Hsien Tsai <luke.tw@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
samples/bpf/bpf_load.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/samples/bpf/bpf_load.c b/samples/bpf/bpf_load.c
index eae7b635343d..6e87cc831e84 100644
--- a/samples/bpf/bpf_load.c
+++ b/samples/bpf/bpf_load.c
@@ -678,7 +678,7 @@ void read_trace_pipe(void)
static char buf[4096];
ssize_t sz;
- sz = read(trace_fd, buf, sizeof(buf));
+ sz = read(trace_fd, buf, sizeof(buf) - 1);
if (sz > 0) {
buf[sz] = 0;
puts(buf);
--
2.20.1
^ permalink raw reply related
* Re: [PATCH mlx5-next v1 02/12] net/mlx5: Use event mask based on device capabilities
From: Saeed Mahameed @ 2019-06-27 0:23 UTC (permalink / raw)
To: Jason Gunthorpe, leon@kernel.org, dledford@redhat.com
Cc: Yishai Hadas, netdev@vger.kernel.org, Leon Romanovsky,
linux-rdma@vger.kernel.org
In-Reply-To: <20190618171540.11729-3-leon@kernel.org>
On Tue, 2019-06-18 at 20:15 +0300, Leon Romanovsky wrote:
> From: Yishai Hadas <yishaih@mellanox.com>
>
> Use the reported device capabilities for the supported user events
> (i.e.
> affiliated and un-affiliated) to set the EQ mask.
>
> As the event mask can be up to 256 defined by 4 entries of u64 change
> the applicable code to work accordingly.
>
> Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
> Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
> ---
> drivers/infiniband/hw/mlx5/odp.c | 3 +-
> drivers/net/ethernet/mellanox/mlx5/core/eq.c | 45 ++++++++++++++++
> ----
> drivers/net/ethernet/mellanox/mlx5/core/fw.c | 6 +++
> include/linux/mlx5/device.h | 6 ++-
> include/linux/mlx5/eq.h | 4 +-
> include/linux/mlx5/mlx5_ifc.h | 13 ++++--
> 6 files changed, 63 insertions(+), 14 deletions(-)
>
> diff --git a/drivers/infiniband/hw/mlx5/odp.c
> b/drivers/infiniband/hw/mlx5/odp.c
> index 600fe23e2eae..a6740ec308ed 100644
> --- a/drivers/infiniband/hw/mlx5/odp.c
> +++ b/drivers/infiniband/hw/mlx5/odp.c
> @@ -1559,10 +1559,11 @@ mlx5_ib_create_pf_eq(struct mlx5_ib_dev *dev,
> struct mlx5_ib_pf_eq *eq)
> eq->irq_nb.notifier_call = mlx5_ib_eq_pf_int;
> param = (struct mlx5_eq_param) {
> .irq_index = 0,
> - .mask = 1 << MLX5_EVENT_TYPE_PAGE_FAULT,
> .nent = MLX5_IB_NUM_PF_EQE,
> };
> eq->core = mlx5_eq_create_generic(dev->mdev, ¶m);
> +
> + param.mask[0] = 1ull << MLX5_EVENT_TYPE_PAGE_FAULT;
As Yishai already pointer out, there is a regression here,
the line above was merged in the wrong order, mask should be setup
before calling mlx5_eq_create_generic.
I will expect V3.
> if (IS_ERR(eq->core)) {
> err = PTR_ERR(eq->core);
> goto err_wq;
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
> b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
> index 8000d2a4a7e2..9d07add38940 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
> @@ -256,6 +256,7 @@ create_map_eq(struct mlx5_core_dev *dev, struct
> mlx5_eq *eq,
> int inlen;
> u32 *in;
> int err;
> + int i;
>
> /* Init CQ table */
> memset(cq_table, 0, sizeof(*cq_table));
> @@ -283,10 +284,12 @@ create_map_eq(struct mlx5_core_dev *dev, struct
> mlx5_eq *eq,
> mlx5_fill_page_array(&eq->buf, pas);
>
> MLX5_SET(create_eq_in, in, opcode, MLX5_CMD_OP_CREATE_EQ);
> - if (!param->mask && MLX5_CAP_GEN(dev, log_max_uctx))
> + if (!param->mask[0] && MLX5_CAP_GEN(dev, log_max_uctx))
> MLX5_SET(create_eq_in, in, uid,
> MLX5_SHARED_RESOURCE_UID);
>
> - MLX5_SET64(create_eq_in, in, event_bitmask, param->mask);
> + for (i = 0; i < 4; i++)
> + MLX5_ARRAY_SET64(create_eq_in, in, event_bitmask, i,
> + param->mask[i]);
>
> eqc = MLX5_ADDR_OF(create_eq_in, in, eq_context_entry);
> MLX5_SET(eqc, eqc, log_eq_size, ilog2(eq->nent));
> @@ -507,10 +510,32 @@ static int cq_err_event_notifier(struct
> notifier_block *nb,
> return NOTIFY_OK;
> }
>
> -static u64 gather_async_events_mask(struct mlx5_core_dev *dev)
> +static void gather_async_events_from_cap(struct mlx5_core_dev *dev,
> + u64 mask[4])
> +{
> + __be64 *user_unaffiliated_events;
> + __be64 *user_affiliated_events;
> + int i;
> +
> + user_affiliated_events =
> + MLX5_CAP_DEV_EVENT(dev, user_affiliated_events);
> + user_unaffiliated_events =
> + MLX5_CAP_DEV_EVENT(dev, user_unaffiliated_events);
> +
> + for (i = 0; i < 4; i++)
> + mask[i] = be64_to_cpu(user_affiliated_events[i] |
> + user_unaffiliated_events[i]);
> +}
> +
> +static void gather_async_events_mask(struct mlx5_core_dev *dev, u64
> mask[4])
> {
> u64 async_event_mask = MLX5_ASYNC_EVENT_MASK;
>
> + if (MLX5_CAP_GEN(dev, event_cap)) {
> + gather_async_events_from_cap(dev, mask);
> + return;
> + }
> +
> if (MLX5_VPORT_MANAGER(dev))
> async_event_mask |= (1ull <<
> MLX5_EVENT_TYPE_NIC_VPORT_CHANGE);
>
> @@ -544,7 +569,7 @@ static u64 gather_async_events_mask(struct
> mlx5_core_dev *dev)
> async_event_mask |=
> (1ull <<
> MLX5_EVENT_TYPE_ESW_FUNCTIONS_CHANGED);
>
> - return async_event_mask;
> + mask[0] = async_event_mask;
> }
>
> static int create_async_eqs(struct mlx5_core_dev *dev)
> @@ -559,9 +584,11 @@ static int create_async_eqs(struct mlx5_core_dev
> *dev)
> table->cmd_eq.irq_nb.notifier_call = mlx5_eq_async_int;
> param = (struct mlx5_eq_param) {
> .irq_index = 0,
> - .mask = 1ull << MLX5_EVENT_TYPE_CMD,
> + .mask = {1ull << MLX5_EVENT_TYPE_CMD},
> .nent = MLX5_NUM_CMD_EQE,
> };
> +
> + param.mask[0] = 1ull << MLX5_EVENT_TYPE_CMD;
No need to setup the mask twice,
here and everywhere in this patch, pick one approach to set it.
> err = create_async_eq(dev, &table->cmd_eq.core, ¶m);
> if (err) {
> mlx5_core_warn(dev, "failed to create cmd EQ %d\n",
> err);
> @@ -577,9 +604,9 @@ static int create_async_eqs(struct mlx5_core_dev
> *dev)
> table->async_eq.irq_nb.notifier_call = mlx5_eq_async_int;
> param = (struct mlx5_eq_param) {
> .irq_index = 0,
> - .mask = gather_async_events_mask(dev),
> .nent = MLX5_NUM_ASYNC_EQE,
> };
> + gather_async_events_mask(dev, param.mask);
> err = create_async_eq(dev, &table->async_eq.core, ¶m);
> if (err) {
> mlx5_core_warn(dev, "failed to create async EQ %d\n",
> err);
> @@ -595,9 +622,11 @@ static int create_async_eqs(struct mlx5_core_dev
> *dev)
> table->pages_eq.irq_nb.notifier_call = mlx5_eq_async_int;
> param = (struct mlx5_eq_param) {
> .irq_index = 0,
> - .mask = 1 << MLX5_EVENT_TYPE_PAGE_REQUEST,
> + .mask = {1 << MLX5_EVENT_TYPE_PAGE_REQUEST},
> .nent = /* TODO: sriov max_vf + */ 1,
> };
> +
> + param.mask[0] = 1ull << MLX5_EVENT_TYPE_PAGE_REQUEST;
> err = create_async_eq(dev, &table->pages_eq.core, ¶m);
> if (err) {
> mlx5_core_warn(dev, "failed to create pages EQ %d\n",
> err);
> @@ -789,7 +818,7 @@ static int create_comp_eqs(struct mlx5_core_dev
> *dev)
> eq->irq_nb.notifier_call = mlx5_eq_comp_int;
> param = (struct mlx5_eq_param) {
> .irq_index = vecidx,
> - .mask = 0,
> + .mask = {0},
> .nent = nent,
> };
> err = create_map_eq(dev, &eq->core, ¶m);
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw.c
> b/drivers/net/ethernet/mellanox/mlx5/core/fw.c
> index 1ab6f7e3bec6..05367f15c3a7 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/fw.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/fw.c
> @@ -202,6 +202,12 @@ int mlx5_query_hca_caps(struct mlx5_core_dev
> *dev)
> return err;
> }
>
> + if (MLX5_CAP_GEN(dev, event_cap)) {
> + err = mlx5_core_get_caps(dev, MLX5_CAP_DEV_EVENT);
> + if (err)
> + return err;
> + }
> +
> return 0;
> }
>
> diff --git a/include/linux/mlx5/device.h
> b/include/linux/mlx5/device.h
> index 5e760067ac41..0d1abe097627 100644
> --- a/include/linux/mlx5/device.h
> +++ b/include/linux/mlx5/device.h
> @@ -351,7 +351,7 @@ enum mlx5_event {
>
> MLX5_EVENT_TYPE_DEVICE_TRACER = 0x26,
>
> - MLX5_EVENT_TYPE_MAX =
> MLX5_EVENT_TYPE_DEVICE_TRACER + 1,
> + MLX5_EVENT_TYPE_MAX = 0x100,
> };
>
> enum {
> @@ -1077,6 +1077,7 @@ enum mlx5_cap_type {
> MLX5_CAP_DEBUG,
> MLX5_CAP_RESERVED_14,
> MLX5_CAP_DEV_MEM,
> + MLX5_CAP_DEV_EVENT = 0x14,
> /* NUM OF CAP Types */
> MLX5_CAP_NUM
> };
> @@ -1255,6 +1256,9 @@ enum mlx5_qcam_feature_groups {
> #define MLX5_CAP64_DEV_MEM(mdev, cap)\
> MLX5_GET64(device_mem_cap, mdev-
> >caps.hca_cur[MLX5_CAP_DEV_MEM], cap)
>
> +#define MLX5_CAP_DEV_EVENT(mdev, cap)\
> + MLX5_ADDR_OF(device_event_cap, (mdev)-
> >caps.hca_cur[MLX5_CAP_DEV_EVENT], cap)
> +
> enum {
> MLX5_CMD_STAT_OK = 0x0,
> MLX5_CMD_STAT_INT_ERR = 0x1,
> diff --git a/include/linux/mlx5/eq.h b/include/linux/mlx5/eq.h
> index 70e16dcfb4c4..202df2e5fe8c 100644
> --- a/include/linux/mlx5/eq.h
> +++ b/include/linux/mlx5/eq.h
> @@ -15,7 +15,9 @@ struct mlx5_core_dev;
> struct mlx5_eq_param {
> u8 irq_index;
> int nent;
> - u64 mask;
> + u64 mask[4];
> + void *context;
> + irq_handler_t handler;
> };
>
> struct mlx5_eq *
> diff --git a/include/linux/mlx5/mlx5_ifc.h
> b/include/linux/mlx5/mlx5_ifc.h
> index 16348528fef6..3ef716c054c2 100644
> --- a/include/linux/mlx5/mlx5_ifc.h
> +++ b/include/linux/mlx5/mlx5_ifc.h
> @@ -823,6 +823,12 @@ struct mlx5_ifc_device_mem_cap_bits {
> u8 reserved_at_180[0x680];
> };
>
> +struct mlx5_ifc_device_event_cap_bits {
> + u8 user_affiliated_events[4][0x40];
> +
> + u8 user_unaffiliated_events[4][0x40];
> +};
> +
> enum {
> MLX5_ATOMIC_CAPS_ATOMIC_SIZE_QP_1_BYTE = 0x0,
> MLX5_ATOMIC_CAPS_ATOMIC_SIZE_QP_2_BYTES = 0x2,
> @@ -980,7 +986,8 @@ struct mlx5_ifc_cmd_hca_cap_bits {
>
> u8 log_max_srq_sz[0x8];
> u8 log_max_qp_sz[0x8];
> - u8 reserved_at_90[0x8];
> + u8 event_cap[0x1];
> + u8 reserved_at_91[0x7];
> u8 prio_tag_required[0x1];
> u8 reserved_at_99[0x2];
> u8 log_max_qp[0x5];
> @@ -7364,9 +7371,9 @@ struct mlx5_ifc_create_eq_in_bits {
>
> u8 reserved_at_280[0x40];
>
> - u8 event_bitmask[0x40];
> + u8 event_bitmask[4][0x40];
>
> - u8 reserved_at_300[0x580];
> + u8 reserved_at_3c0[0x4c0];
>
> u8 pas[0][0x40];
> };
^ permalink raw reply
* Re: [PATCH bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf
From: Greg KH @ 2019-06-27 0:08 UTC (permalink / raw)
To: Song Liu
Cc: Daniel Borkmann, Networking, bpf, Alexei Starovoitov, Kernel Team,
jannh@google.com
In-Reply-To: <5A472047-F329-43C3-9DBC-9BCFC0A19F1C@fb.com>
On Wed, Jun 26, 2019 at 03:17:47PM +0000, Song Liu wrote:
> >> +static struct miscdevice bpf_dev = {
> >> + .minor = MISC_DYNAMIC_MINOR,
> >> + .name = "bpf",
> >> + .fops = &bpf_chardev_ops,
> >> + .mode = 0440,
> >> + .nodename = "bpf",
> >
> > Here's what kvm does:
> >
> > static struct miscdevice kvm_dev = {
> > KVM_MINOR,
> > "kvm",
> > &kvm_chardev_ops,
> > };
Ick, I thought we converted all of these to named initializers a long
time ago :)
> > Is there an actual reason that mode is not 0 by default in bpf case? Why
> > we need to define nodename?
>
> Based on my understanding, mode of 0440 is what we want. If we leave it
> as 0, it will use default value of 0600. I guess we can just set it to
> 0440, as user space can change it later anyway.
Don't rely on userspace changing it, set it to what you want the
permissions to be in the kernel here, otherwise you have to create a new
udev rule and get it merged into all of the distros. Just do it right
the first time and there is no need for it.
What is wrong with 0600 for this? Why 0440?
thanks,
greg k-h
^ permalink raw reply
* Re: KASAN: use-after-free Read in corrupted (3)
From: syzbot @ 2019-06-26 23:55 UTC (permalink / raw)
To: aarcange, akpm, ast, christian, daniel, ebiederm, elena.reshetova,
guro, john.fastabend, keescook, linux-kernel, luto, mhocko, mingo,
namit, netdev, peterz, riel, syzkaller-bugs, wad
In-Reply-To: <000000000000f4f847058c387616@google.com>
syzbot has bisected this bug to:
commit e9db4ef6bf4ca9894bb324c76e01b8f1a16b2650
Author: John Fastabend <john.fastabend@gmail.com>
Date: Sat Jun 30 13:17:47 2018 +0000
bpf: sockhash fix omitted bucket lock in sock_close
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11bb4e3da00000
start commit: 045df37e Merge branch 'cxgb4-Reference-count-MPS-TCAM-entr..
git tree: net-next
final crash: https://syzkaller.appspot.com/x/report.txt?x=13bb4e3da00000
console output: https://syzkaller.appspot.com/x/log.txt?x=15bb4e3da00000
kernel config: https://syzkaller.appspot.com/x/.config?x=dd16b8dc9d0d210c
dashboard link: https://syzkaller.appspot.com/bug?extid=8a821b383523654227bf
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1389f5b5a00000
Reported-by: syzbot+8a821b383523654227bf@syzkaller.appspotmail.com
Fixes: e9db4ef6bf4c ("bpf: sockhash fix omitted bucket lock in sock_close")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply
* Re: linux-next: Fixes tag needs some work in the bpf tree
From: Roman Gushchin @ 2019-06-26 23:43 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Alexei Starovoitov, Daniel Borkmann, Stephen Rothwell, Networking,
Linux Next Mailing List, Linux Kernel Mailing List
In-Reply-To: <CAADnVQJiMH=jfuD0FGpr2JmzyQsMKHJ4pM1kfQ8jhSxrAe0XWg@mail.gmail.com>
On Wed, Jun 26, 2019 at 04:36:50PM -0700, Alexei Starovoitov wrote:
> On Wed, Jun 26, 2019 at 3:14 PM Roman Gushchin <guro@fb.com> wrote:
> >
> > On Thu, Jun 27, 2019 at 08:05:21AM +1000, Stephen Rothwell wrote:
> > > Hi all,
> > >
> > > In commit
> > >
> > > 12771345a467 ("bpf: fix cgroup bpf release synchronization")
> > >
> > > Fixes tag
> > >
> > > Fixes: 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf from
> > >
> > > has these problem(s):
> > >
> > > - Subject has leading but no trailing parentheses
> > > - Subject has leading but no trailing quotes
> > >
> > > Please don't split Fixes tags across more than one line.
> >
> > Oops, sorry.
> >
> > Alexei, can you fix this in place?
> > Or should I send an updated version?
>
> I cannot easily do it since -p and --signoff are incompatible flags.
> I need to use -p to preserve merge commits,
> but I also need to use --signoff to add my sob to all
> other commits that were committed by Daniel
> after your commit.
I see... Sorry for the hassle!
>
> Daniel, can you fix Roman's patch instead?
> you can do:
> git rebase -i -p 12771345a467^
> fix Roman's, add you sob only to that one
> and re-push the whole thing.
Thanks!
^ permalink raw reply
* Re: [PATCH net-next] gso: enable udp gso for virtual devices
From: Willem de Bruijn @ 2019-06-26 23:41 UTC (permalink / raw)
To: Jason Baron
Cc: Alexander Duyck, David Miller, Netdev, Joshua Hunt,
Willem de Bruijn, Paolo Abeni
In-Reply-To: <d5dea281-67c0-1385-95c1-b476825e6afa@akamai.com>
On Wed, Jun 26, 2019 at 3:17 PM Jason Baron <jbaron@akamai.com> wrote:
>
>
>
> On 6/14/19 4:53 PM, Jason Baron wrote:
> >
> >
> > On 6/13/19 5:20 PM, Willem de Bruijn wrote:
> >>>>> @@ -237,6 +237,7 @@ static inline int find_next_netdev_feature(u64 feature, unsigned long start)
> >>>>> NETIF_F_GSO_GRE_CSUM | \
> >>>>> NETIF_F_GSO_IPXIP4 | \
> >>>>> NETIF_F_GSO_IPXIP6 | \
> >>>>> + NETIF_F_GSO_UDP_L4 | \
> >>>>> NETIF_F_GSO_UDP_TUNNEL | \
> >>>>> NETIF_F_GSO_UDP_TUNNEL_CSUM)
> >>>>
> >>>> Are you adding this to NETIF_F_GSO_ENCAP_ALL? Wouldn't it make more
> >>>> sense to add it to NETIF_F_GSO_SOFTWARE?
> >>>>
> >>>
> >>> Yes, I'm adding to NETIF_F_GSO_ENCAP_ALL (not very clear from the
> >>> context). I will fix the commit log.
> >>>
> >>> In: 83aa025 udp: add gso support to virtual devices, the support was
> >>> also added to NETIF_F_GSO_ENCAP_ALL (although subsequently reverted due
> >>> to UDP GRO not being in place), so I wonder what the reason was for that?
> >>
> >> That was probably just a bad choice on my part.
> >>
> >> It worked in practice, but if NETIF_F_GSO_SOFTWARE works the same
> >> without unexpected side effects, then I agree that it is the better choice.
> >>
> >> That choice does appear to change behavior when sending over tunnel
> >> devices. Might it send tunneled GSO packets over loopback?
> >>
> >>
> >
> > I set up a test case using fou tunneling through a bridge device using
> > the udpgso_bench_tx test where packets are not received correctly if
> > NETIF_F_GSO_UDP_L4 is added to NETIF_F_GSO_SOFTWARE. If I have it added
> > to NETIF_F_GSO_ENCAP_ALL, it does work correctly. So there are more
> > fixes required to include it in NETIF_F_GSO_SOFTWARE.
> >
> > The use-case I have only requires it to be in NETIF_F_GSO_ENCAP_ALL, but
> > if it needs to go in NETIF_F_GSO_SOFTWARE, I can look at what's required
> > more next week.
> >
>
> Hi,
>
> I haven't had a chance to investigate what goes wrong with including
> NETIF_F_GSO_UDP_L4 in NETIF_F_GSO_SOFTWARE - but I was just wondering if
> people are ok with NETIF_F_GSO_UDP_L4 being added to
> NETIF_F_GSO_ENCAP_ALL and not NETIF_F_GSO_SOFTWARE (ie the original
> patch as posted)?
>
> As I mentioned that is sufficient for my use-case, and its how Willem
> originally proposed this.
Indeed, based on the previous discussion this sounds fine to me.
^ permalink raw reply
* Re: linux-next: Fixes tag needs some work in the bpf tree
From: Alexei Starovoitov @ 2019-06-26 23:36 UTC (permalink / raw)
To: Roman Gushchin
Cc: Alexei Starovoitov, Daniel Borkmann, Stephen Rothwell, Networking,
Linux Next Mailing List, Linux Kernel Mailing List
In-Reply-To: <20190626221347.GA17762@tower.DHCP.thefacebook.com>
On Wed, Jun 26, 2019 at 3:14 PM Roman Gushchin <guro@fb.com> wrote:
>
> On Thu, Jun 27, 2019 at 08:05:21AM +1000, Stephen Rothwell wrote:
> > Hi all,
> >
> > In commit
> >
> > 12771345a467 ("bpf: fix cgroup bpf release synchronization")
> >
> > Fixes tag
> >
> > Fixes: 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf from
> >
> > has these problem(s):
> >
> > - Subject has leading but no trailing parentheses
> > - Subject has leading but no trailing quotes
> >
> > Please don't split Fixes tags across more than one line.
>
> Oops, sorry.
>
> Alexei, can you fix this in place?
> Or should I send an updated version?
I cannot easily do it since -p and --signoff are incompatible flags.
I need to use -p to preserve merge commits,
but I also need to use --signoff to add my sob to all
other commits that were committed by Daniel
after your commit.
Daniel, can you fix Roman's patch instead?
you can do:
git rebase -i -p 12771345a467^
fix Roman's, add you sob only to that one
and re-push the whole thing.
^ permalink raw reply
* Re: [PATCH net-next 0/2] net: ipv4: remove erroneous advancement of list pointer
From: Florian Westphal @ 2019-06-26 23:32 UTC (permalink / raw)
To: Ran Rozenstein
Cc: Florian Westphal, Tariq Toukan, netdev@vger.kernel.org,
Maor Gottlieb, edumazet@google.com
In-Reply-To: <AM4PR0501MB2769CE8DC11EE4A076B62CCCC5E20@AM4PR0501MB2769.eurprd05.prod.outlook.com>
Ran Rozenstein <ranro@mellanox.com> wrote:
> The test dose stress on the interface by running this 2 commands in loop:
>
> command is: /sbin/ip -f inet addr add $IP/16 brd + dev ens8f1
> command is: ifconfig ens8f1 $IP netmask 255.255.0.0
>
> when $IP change every iteration.
>
> It execute every second when we see the reproduce somewhere between 40 to 200 seconds of execution.
I can reproduce this now, I'll submit a fix tomorrow.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox