Netdev List
 help / color / mirror / Atom feed
* Re: [PATCH bpf-next 0/4] bpf: Generate helpers for pinning through bpf object skeleton
From: Andrii Nakryiko @ 2022-04-26  6:45 UTC (permalink / raw)
  To: Yafang Shao
  Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Martin Lau,
	Song Liu, Yonghong Song, john fastabend, KP Singh, Networking,
	bpf
In-Reply-To: <20220423140058.54414-1-laoar.shao@gmail.com>

On Sat, Apr 23, 2022 at 7:01 AM Yafang Shao <laoar.shao@gmail.com> wrote:
>
> Currently there're helpers for allowing to open/load/attach BPF object
> through BPF object skeleton. Let's also add helpers for pinning through
> BPF object skeleton. It could simplify BPF userspace code which wants to
> pin the progs into bpffs.
>
> After this change, with command 'bpftool gen skeleton XXX.bpf.o', the
> helpers for pinning BPF prog will be generated in BPF object skeleton.
>
> The new helpers are named with __{pin, unpin}_prog, because it only pins
> bpf progs. If the user also wants to pin bpf maps, he can use
> LIBBPF_PIN_BY_NAME.

API says it's pinning programs, but really it's trying to pin links.
But those links might not even be created for non-auto-attachable
programs, and for others users might or might not set
<skel>.links.<prog_name> links.

There are lots of questions about this new functionality... But the
main one is why do we need it? What does it bring that's hard to do
otherwise?

>
> Yafang Shao (4):
>   libbpf: Define DEFAULT_BPFFS
>   libbpf: Add helpers for pinning bpf prog through bpf object skeleton
>   bpftool: Fix incorrect return in generated detach helper
>   bpftool: Generate helpers for pinning prog through bpf object skeleton
>
>  tools/bpf/bpftool/gen.c     | 18 ++++++++++-
>  tools/lib/bpf/bpf_helpers.h |  2 +-
>  tools/lib/bpf/libbpf.c      | 61 ++++++++++++++++++++++++++++++++++++-
>  tools/lib/bpf/libbpf.h      | 10 ++++--
>  tools/lib/bpf/libbpf.map    |  2 ++
>  5 files changed, 88 insertions(+), 5 deletions(-)
>
> --
> 2.17.1
>

^ permalink raw reply

* [PATCH memcg v4] net: set proper memcg for net_init hooks allocations
From: Vasily Averin @ 2022-04-26  6:43 UTC (permalink / raw)
  To: Vlastimil Babka, Shakeel Butt, Roman Gushchin
  Cc: kernel, Florian Westphal, linux-kernel, Michal Hocko, cgroups,
	netdev, David S. Miller, Jakub Kicinski, Paolo Abeni
In-Reply-To: <YmdeCqi6wmgiSiWh@carbon>

__register_pernet_operations() executes init hook of registered
pernet_operation structure in all existing net namespaces.

Typically, these hooks are called by a process associated with
the specified net namespace, and all __GFP_ACCOUNT marked
allocation are accounted for corresponding container/memcg.

However __register_pernet_operations() calls the hooks in the same
context, and as a result all marked allocations are accounted
to one memcg for all processed net namespaces.

This patch adjusts active memcg for each net namespace and helps
to account memory allocated inside ops_init() into the proper memcg.

Signed-off-by: Vasily Averin <vvs@openvz.org>
---
v4: get_mem_cgroup_from_kmem() renamed to get_mem_cgroup_from_obj(),
    get_net_memcg() replaced by mem_cgroup_or_root(), suggested by Roman.

v3: put_net_memcg() replaced by an alreay existing mem_cgroup_put()
    It checks memcg before accessing it, this is required for
    __register_pernet_operations() called before memcg initialization.
    Additionally fixed leading whitespaces in non-memcg_kmem version
    of mem_cgroup_from_obj().

v2: introduced get/put_net_memcg(),
    new functions are moved under CONFIG_MEMCG_KMEM
    to fix compilation issues reported by Intel's kernel test robot

v1: introduced get_mem_cgroup_from_kmem(), which takes the refcount
    for the found memcg, suggested by Shakeel
---
 include/linux/memcontrol.h | 27 ++++++++++++++++++++++++++-
 net/core/net_namespace.c   |  7 +++++++
 2 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 0abbd685703b..6dd4ed7d3b6f 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -1714,6 +1714,22 @@ static inline int memcg_cache_id(struct mem_cgroup *memcg)
 
 struct mem_cgroup *mem_cgroup_from_obj(void *p);
 
+static inline struct mem_cgroup *get_mem_cgroup_from_obj(void *p)
+{
+	struct mem_cgroup *memcg;
+
+	rcu_read_lock();
+	do {
+		memcg = mem_cgroup_from_obj(p);
+	} while (memcg && !css_tryget(&memcg->css));
+	rcu_read_unlock();
+	return memcg;
+}
+
+static inline struct mem_cgroup *mem_cgroup_or_root(struct mem_cgroup *memcg)
+{
+	return memcg ? memcg : root_mem_cgroup;
+}
 #else
 static inline bool mem_cgroup_kmem_disabled(void)
 {
@@ -1763,9 +1779,18 @@ static inline void memcg_put_cache_ids(void)
 
 static inline struct mem_cgroup *mem_cgroup_from_obj(void *p)
 {
-       return NULL;
+	return NULL;
 }
 
+static inline struct mem_cgroup *get_mem_cgroup_from_obj(void *p)
+{
+	return NULL;
+}
+
+static inline struct mem_cgroup *mem_cgroup_or_root(struct mem_cgroup *memcg)
+{
+	return NULL;
+}
 #endif /* CONFIG_MEMCG_KMEM */
 
 #endif /* _LINUX_MEMCONTROL_H */
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index a5b5bb99c644..240f3db77dec 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -26,6 +26,7 @@
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 
+#include <linux/sched/mm.h>
 /*
  *	Our network namespace constructor/destructor lists
  */
@@ -1147,7 +1148,13 @@ static int __register_pernet_operations(struct list_head *list,
 		 * setup_net() and cleanup_net() are not possible.
 		 */
 		for_each_net(net) {
+			struct mem_cgroup *old, *memcg;
+
+			memcg = mem_cgroup_or_root(get_mem_cgroup_from_obj(net));
+			old = set_active_memcg(memcg);
 			error = ops_init(ops, net);
+			set_active_memcg(old);
+			mem_cgroup_put(memcg);
 			if (error)
 				goto out_undo;
 			list_add_tail(&net->exit_list, &net_exit_list);
-- 
2.31.1


^ permalink raw reply related

* Re: [PATCH] ath10k: skip ath10k_halt during suspend for driver state RESTARTING
From: Abhishek Kumar @ 2022-04-26  6:42 UTC (permalink / raw)
  To: Brian Norris
  Cc: kvalo, linux-kernel, linux-wireless, ath10k, netdev, Wen Gong,
	David S. Miller, Jakub Kicinski, Paolo Abeni
In-Reply-To: <YmcrBFZ0CB/7abzW@google.com>

On Mon, Apr 25, 2022 at 4:13 PM Brian Norris <briannorris@chromium.org> wrote:
>
> On Mon, Apr 25, 2022 at 04:11:44PM -0700, Brian Norris wrote:
> > On Mon, Apr 25, 2022 at 02:15:20AM +0000, Abhishek Kumar wrote:
> > > --- a/drivers/net/wireless/ath/ath10k/mac.c
> > > +++ b/drivers/net/wireless/ath/ath10k/mac.c
> > > @@ -5345,8 +5345,22 @@ static void ath10k_stop(struct ieee80211_hw *hw)
> ...
> > > +                   /* If the current driver state is RESTARTING but not yet
> > > +                    * fully RESTARTED because of incoming suspend event,
> > > +                    * then ath11k_halt is already called via
> >
> > s/ath11k/ath10k/
> >
> > I know ath11k is the hot new thing, but this is ath10k ;)
> >
> > > +                    * ath10k_core_restart and should not be called here.
> >
> > s/ath10k/ath11k/
>
> Oh boy, I got *that* backwards! Should be this, obviously:
>
> s/ath11k/ath10k/
>
> > > +                    */
> > > +                   if (ar->state != ATH10K_STATE_RESTARTING)
> > > +                           ath10k_halt(ar);
> > > +                   else
> > > +                           /* Suspending here, because when in RESTARTING
> > > +                            * state, ath11k_core_stop skips
> >
> > s/ath10k/ath11k/
>
> Same.
Oh!, lately working on ath11k mostly and the muscle memory kicked in
... sorry about this, will fix in next revision. Kale whenever you get
time, let me know if the logic looks good to you and if ath11k/ath10k
typo fix is the only comment.

Thanks
Abhishek
>
> Brian

^ permalink raw reply

* Re: [PATCH bpf-next 2/7] bpf: add bpf_skc_to_mptcp_sock_proto
From: Andrii Nakryiko @ 2022-04-26  6:36 UTC (permalink / raw)
  To: Daniel Borkmann
  Cc: Mat Martineau, Networking, bpf, Geliang Tang, Alexei Starovoitov,
	Andrii Nakryiko, mptcp, Nicolas Rybowski, Matthieu Baerts
In-Reply-To: <779c3a31-381d-75b4-5f7b-be36e9816068@iogearbox.net>

On Mon, Apr 25, 2022 at 7:29 AM Daniel Borkmann <daniel@iogearbox.net> wrote:
>
> On 4/25/22 4:26 PM, Daniel Borkmann wrote:
> [...]
> >
> > Looking at bpf_skc_to_tcp6_sock(), do we similarly need a BTF_TYPE_EMIT() here?
>
> (Plus, CONFIG_MPTCP should be enabled in CI config (Andrii).)

Should be done once [0] is merged in.

  [0] https://github.com/kernel-patches/vmtest/pull/77

>
> Cheers,
> Daniel

^ permalink raw reply

* Re: [PATCH bpf-next v5 3/8] bpf: per-cgroup lsm flavor
From: Martin KaFai Lau @ 2022-04-26  6:30 UTC (permalink / raw)
  To: Stanislav Fomichev; +Cc: netdev, bpf, ast, daniel, andrii
In-Reply-To: <20220426062705.siikmhdj5vhsffjq@kafai-mbp.dhcp.thefacebook.com>

On Mon, Apr 25, 2022 at 11:27:08PM -0700, Martin KaFai Lau wrote:
> On Tue, Apr 19, 2022 at 12:00:48PM -0700, Stanislav Fomichev wrote:
> > Allow attaching to lsm hooks in the cgroup context.
> > 
> > Attaching to per-cgroup LSM works exactly like attaching
> > to other per-cgroup hooks. New BPF_LSM_CGROUP is added
> > to trigger new mode; the actual lsm hook we attach to is
> > signaled via existing attach_btf_id.
> > 
> > For the hooks that have 'struct socket' as its first argument,
> > we use the cgroup associated with that socket. For the rest,
> > we use 'current' cgroup (this is all on default hierarchy == v2 only).
> > Note that for the hooks that work on 'struct sock' we still
> > take the cgroup from 'current' because most of the time,
> > the 'sock' argument is not properly initialized.
> This paragraph is out-dated.
> 
> > Behind the scenes, we allocate a shim program that is attached
> > to the trampoline and runs cgroup effective BPF programs array.
> > This shim has some rudimentary ref counting and can be shared
> > between several programs attaching to the same per-cgroup lsm hook.
> > 
> > Note that this patch bloats cgroup size because we add 211
> > cgroup_bpf_attach_type(s) for simplicity sake. This will be
> > addressed in the subsequent patch.
> > 
> > Also note that we only add non-sleepable flavor for now. To enable
> > sleepable use-cases, BPF_PROG_RUN_ARRAY_CG has to grab trace rcu,
> s/BPF_PROG_RUN_ARRAY_CG/bpf_prog_run_array_cg/
> 
> > shim programs have to be freed via trace rcu, cgroup_bpf.effective
> > should be also trace-rcu-managed + maybe some other changes that
> > I'm not aware of.
Will continue the review tomorrow. thanks.

^ permalink raw reply

* Re: [Patch bpf-next v1 1/4] tcp: introduce tcp_read_skb()
From: John Fastabend @ 2022-04-26  6:27 UTC (permalink / raw)
  To: Cong Wang, John Fastabend
  Cc: Linux Kernel Network Developers, Cong Wang, Eric Dumazet,
	Daniel Borkmann, Jakub Sitnicki
In-Reply-To: <CAM_iQpWQwsJ1eWv9X9O5DqJUhH3Cx-gz+CfHXQsyjeqF04bJPQ@mail.gmail.com>

Cong Wang wrote:
> On Tue, Apr 12, 2022 at 1:00 PM John Fastabend <john.fastabend@gmail.com> wrote:
> >
> > Cong Wang wrote:
> > > From: Cong Wang <cong.wang@bytedance.com>
> > >
> > > This patch inroduces tcp_read_skb() based on tcp_read_sock(),
> > > a preparation for the next patch which actually introduces
> > > a new sock ops.
> > >
> > > TCP is special here, because it has tcp_read_sock() which is
> > > mainly used by splice(). tcp_read_sock() supports partial read
> > > and arbitrary offset, neither of them is needed for sockmap.
> > >
> > > Cc: Eric Dumazet <edumazet@google.com>
> > > Cc: John Fastabend <john.fastabend@gmail.com>
> > > Cc: Daniel Borkmann <daniel@iogearbox.net>
> > > Cc: Jakub Sitnicki <jakub@cloudflare.com>
> > > Signed-off-by: Cong Wang <cong.wang@bytedance.com>
> > > ---
> >
> > Thanks for doing this Cong comment/question inline.
> >
> > [...]
> >
> > > +int tcp_read_skb(struct sock *sk, read_descriptor_t *desc,
> > > +              sk_read_actor_t recv_actor)
> > > +{
> > > +     struct sk_buff *skb;
> > > +     struct tcp_sock *tp = tcp_sk(sk);
> > > +     u32 seq = tp->copied_seq;
> > > +     u32 offset;
> > > +     int copied = 0;
> > > +
> > > +     if (sk->sk_state == TCP_LISTEN)
> > > +             return -ENOTCONN;
> > > +     while ((skb = tcp_recv_skb(sk, seq, &offset, true)) != NULL) {
> >
> > I'm trying to see why we might have an offset here if we always
> > consume the entire skb. There is a comment in tcp_recv_skb around
> > GRO packets, but not clear how this applies here if it does at all
> > to me yet. Will read a bit more I guess.
> >
> > If the offset can be >0 than we also need to fix the recv_actor to
> > account for the extra offset in the skb. As is the bpf prog might
> > see duplicate data. This is a problem on the stream parser now.
> >
> > Then another fallout is if offset is zero than we could just do
> > a skb_dequeue here and skip the tcp_recv_skb bool flag addition
> > and upate.
> 
> I think it is mainly for splice(), and of course strparser, but none of
> them is touched by my patchset.
> 
> >
> > I'll continue reading after a few other things I need to get
> > sorted this afternoon, but maybe you have the answer on hand.
> >
> 
> Please let me know if you have any other comments.

For now no more comments. If its not used then we can drop the offset
logic in this patch and the code looks much simpler.

> 
> Thanks.



^ permalink raw reply

* Re: [PATCH bpf-next v5 3/8] bpf: per-cgroup lsm flavor
From: Martin KaFai Lau @ 2022-04-26  6:27 UTC (permalink / raw)
  To: Stanislav Fomichev; +Cc: netdev, bpf, ast, daniel, andrii
In-Reply-To: <20220419190053.3395240-4-sdf@google.com>

On Tue, Apr 19, 2022 at 12:00:48PM -0700, Stanislav Fomichev wrote:
> Allow attaching to lsm hooks in the cgroup context.
> 
> Attaching to per-cgroup LSM works exactly like attaching
> to other per-cgroup hooks. New BPF_LSM_CGROUP is added
> to trigger new mode; the actual lsm hook we attach to is
> signaled via existing attach_btf_id.
> 
> For the hooks that have 'struct socket' as its first argument,
> we use the cgroup associated with that socket. For the rest,
> we use 'current' cgroup (this is all on default hierarchy == v2 only).
> Note that for the hooks that work on 'struct sock' we still
> take the cgroup from 'current' because most of the time,
> the 'sock' argument is not properly initialized.
This paragraph is out-dated.

> Behind the scenes, we allocate a shim program that is attached
> to the trampoline and runs cgroup effective BPF programs array.
> This shim has some rudimentary ref counting and can be shared
> between several programs attaching to the same per-cgroup lsm hook.
> 
> Note that this patch bloats cgroup size because we add 211
> cgroup_bpf_attach_type(s) for simplicity sake. This will be
> addressed in the subsequent patch.
> 
> Also note that we only add non-sleepable flavor for now. To enable
> sleepable use-cases, BPF_PROG_RUN_ARRAY_CG has to grab trace rcu,
s/BPF_PROG_RUN_ARRAY_CG/bpf_prog_run_array_cg/

> shim programs have to be freed via trace rcu, cgroup_bpf.effective
> should be also trace-rcu-managed + maybe some other changes that
> I'm not aware of.
> 

[ ... ]

> diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
> index 064eccba641d..2161cba1fe0c 100644
> --- a/kernel/bpf/bpf_lsm.c
> +++ b/kernel/bpf/bpf_lsm.c
> @@ -16,6 +16,7 @@
>  #include <linux/bpf_local_storage.h>
>  #include <linux/btf_ids.h>
>  #include <linux/ima.h>
> +#include <linux/bpf-cgroup.h>
>  
>  /* For every LSM hook that allows attachment of BPF programs, declare a nop
>   * function where a BPF program can be attached.
> @@ -35,6 +36,68 @@ BTF_SET_START(bpf_lsm_hooks)
>  #undef LSM_HOOK
>  BTF_SET_END(bpf_lsm_hooks)
>  
> +/* List of LSM hooks that should operate on 'current' cgroup regardless
> + * of function signature.
> + */
> +BTF_SET_START(bpf_lsm_current_hooks)
> +/* operate on freshly allocated sk without any cgroup association */
> +BTF_ID(func, bpf_lsm_sk_alloc_security)
> +BTF_ID(func, bpf_lsm_sk_free_security)
> +BTF_SET_END(bpf_lsm_current_hooks)
> +
> +int bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog,
> +			     bpf_func_t *bpf_func)
> +{
> +	const struct btf_type *first_arg_type;
> +	const struct btf_type *sock_type;
> +	const struct btf_type *sk_type;
> +	const struct btf *btf_vmlinux;
> +	const struct btf_param *args;
> +	s32 type_id;
> +
> +	if (!prog->aux->attach_func_proto ||
> +	    !btf_type_is_func_proto(prog->aux->attach_func_proto))
> +		return -EINVAL;
> +
> +	if (btf_type_vlen(prog->aux->attach_func_proto) < 1 ||
> +	    btf_id_set_contains(&bpf_lsm_current_hooks,
> +				prog->aux->attach_btf_id)) {
> +		*bpf_func = __cgroup_bpf_run_lsm_current;
> +		return 0;
> +	}
> +
> +	args = btf_params(prog->aux->attach_func_proto);
> +
> +	btf_vmlinux = bpf_get_btf_vmlinux();
> +	if (!btf_vmlinux)
Remove this check and other similar checks because the btf_vmlinux has
been successfully parsed during the prog load time.

> +		return -EINVAL;
> +
> +	type_id = btf_find_by_name_kind(btf_vmlinux, "socket", BTF_KIND_STRUCT);
> +	if (type_id < 0)
> +		return -EINVAL;
> +	sock_type = btf_type_by_id(btf_vmlinux, type_id);
> +
> +	type_id = btf_find_by_name_kind(btf_vmlinux, "sock", BTF_KIND_STRUCT);
> +	if (type_id < 0)
> +		return -EINVAL;
> +	sk_type = btf_type_by_id(btf_vmlinux, type_id);
> +
> +	first_arg_type = btf_type_resolve_ptr(btf_vmlinux, args[0].type, NULL);
> +	if (first_arg_type == sock_type)
> +		*bpf_func = __cgroup_bpf_run_lsm_socket;
> +	else if (first_arg_type == sk_type)
> +		*bpf_func = __cgroup_bpf_run_lsm_sock;
> +	else
> +		*bpf_func = __cgroup_bpf_run_lsm_current;
> +
> +	return 0;
> +}
> +
> +int bpf_lsm_hook_idx(u32 btf_id)
> +{
> +	return btf_id_set_index(&bpf_lsm_hooks, btf_id);
> +}
> +
>  int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
>  			const struct bpf_prog *prog)
>  {
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 0918a39279f6..4199de31f49c 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -4971,6 +4971,7 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
>  
>  	if (arg == nr_args) {
>  		switch (prog->expected_attach_type) {
> +		case BPF_LSM_CGROUP:
>  		case BPF_LSM_MAC:
>  		case BPF_TRACE_FEXIT:
>  			/* When LSM programs are attached to void LSM hooks
> @@ -6396,6 +6397,16 @@ static int btf_id_cmp_func(const void *a, const void *b)
>  	return *pa - *pb;
>  }
>  
> +int btf_id_set_index(const struct btf_id_set *set, u32 id)
> +{
> +	const u32 *p;
> +
> +	p = bsearch(&id, set->ids, set->cnt, sizeof(u32), btf_id_cmp_func);
> +	if (!p)
> +		return -1;
> +	return p - set->ids;
> +}
> +
>  bool btf_id_set_contains(const struct btf_id_set *set, u32 id)
>  {
>  	return bsearch(&id, set->ids, set->cnt, sizeof(u32), btf_id_cmp_func) != NULL;
> diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
> index aaf9e36f2736..ba0e0c7a661d 100644
> --- a/kernel/bpf/cgroup.c
> +++ b/kernel/bpf/cgroup.c
> @@ -14,6 +14,9 @@
>  #include <linux/string.h>
>  #include <linux/bpf.h>
>  #include <linux/bpf-cgroup.h>
> +#include <linux/btf_ids.h>
> +#include <linux/bpf_lsm.h>
> +#include <linux/bpf_verifier.h>
>  #include <net/sock.h>
>  #include <net/bpf_sk_storage.h>
>  
> @@ -88,6 +91,85 @@ bpf_prog_run_array_cg(const struct cgroup_bpf *cgrp,
>  	return run_ctx.retval;
>  }
>  
> +unsigned int __cgroup_bpf_run_lsm_sock(const void *ctx,
> +				       const struct bpf_insn *insn)
> +{
> +	const struct bpf_prog *shim_prog;
> +	struct sock *sk;
> +	struct cgroup *cgrp;
> +	int ret = 0;
> +	u64 *regs;
> +
> +	regs = (u64 *)ctx;
> +	sk = (void *)(unsigned long)regs[BPF_REG_0];
> +	/*shim_prog = container_of(insn, struct bpf_prog, insnsi);*/
> +	shim_prog = (const struct bpf_prog *)((void *)insn - offsetof(struct bpf_prog, insnsi));
> +
> +	cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
> +	if (likely(cgrp))
> +		ret = bpf_prog_run_array_cg(&cgrp->bpf,
> +					    shim_prog->aux->cgroup_atype,
> +					    ctx, bpf_prog_run, 0);
> +	return ret;
> +}
> +
> +unsigned int __cgroup_bpf_run_lsm_socket(const void *ctx,
> +					 const struct bpf_insn *insn)
> +{
> +	const struct bpf_prog *shim_prog;
> +	struct socket *sock;
> +	struct cgroup *cgrp;
> +	int ret = 0;
> +	u64 *regs;
> +
> +	regs = (u64 *)ctx;
> +	sock = (void *)(unsigned long)regs[BPF_REG_0];
> +	/*shim_prog = container_of(insn, struct bpf_prog, insnsi);*/
> +	shim_prog = (const struct bpf_prog *)((void *)insn - offsetof(struct bpf_prog, insnsi));
> +
> +	cgrp = sock_cgroup_ptr(&sock->sk->sk_cgrp_data);
> +	if (likely(cgrp))
> +		ret = bpf_prog_run_array_cg(&cgrp->bpf,
> +					    shim_prog->aux->cgroup_atype,
> +					    ctx, bpf_prog_run, 0);
> +	return ret;
> +}
> +
> +unsigned int __cgroup_bpf_run_lsm_current(const void *ctx,
> +					  const struct bpf_insn *insn)
> +{
> +	const struct bpf_prog *shim_prog;
> +	struct cgroup *cgrp;
> +	int ret = 0;
> +
> +	if (unlikely(!current))
> +		return 0;
> +
> +	/*shim_prog = container_of(insn, struct bpf_prog, insnsi);*/
> +	shim_prog = (const struct bpf_prog *)((void *)insn - offsetof(struct bpf_prog, insnsi));
> +
> +	rcu_read_lock();
> +	cgrp = task_dfl_cgroup(current);
> +	if (likely(cgrp))
> +		ret = bpf_prog_run_array_cg(&cgrp->bpf,
> +					    shim_prog->aux->cgroup_atype,
> +					    ctx, bpf_prog_run, 0);
> +	rcu_read_unlock();
> +	return ret;
> +}
> +
> +#ifdef CONFIG_BPF_LSM
> +static enum cgroup_bpf_attach_type bpf_lsm_attach_type_get(u32 attach_btf_id)
> +{
> +	return CGROUP_LSM_START + bpf_lsm_hook_idx(attach_btf_id);
> +}
> +#else
> +static enum cgroup_bpf_attach_type bpf_lsm_attach_type_get(u32 attach_btf_id)
> +{
> +	return -EOPNOTSUPP;
> +}
> +#endif /* CONFIG_BPF_LSM */
> +
>  void cgroup_bpf_offline(struct cgroup *cgrp)
>  {
>  	cgroup_get(cgrp);
> @@ -155,6 +237,14 @@ static void bpf_cgroup_storages_link(struct bpf_cgroup_storage *storages[],
>  		bpf_cgroup_storage_link(storages[stype], cgrp, attach_type);
>  }
>  
> +static void bpf_cgroup_storages_unlink(struct bpf_cgroup_storage *storages[])
> +{
> +	enum bpf_cgroup_storage_type stype;
> +
> +	for_each_cgroup_storage_type(stype)
> +		bpf_cgroup_storage_unlink(storages[stype]);
> +}
> +
>  /* Called when bpf_cgroup_link is auto-detached from dying cgroup.
>   * It drops cgroup and bpf_prog refcounts, and marks bpf_link as defunct. It
>   * doesn't free link memory, which will eventually be done by bpf_link's
> @@ -166,6 +256,16 @@ static void bpf_cgroup_link_auto_detach(struct bpf_cgroup_link *link)
>  	link->cgroup = NULL;
>  }
>  
> +static void bpf_cgroup_lsm_shim_release(struct bpf_prog *prog,
> +					enum cgroup_bpf_attach_type atype)
> +{
> +	if (prog->aux->cgroup_atype < CGROUP_LSM_START ||
> +	    prog->aux->cgroup_atype > CGROUP_LSM_END)
These checks are unnecessary.  cgroup_atype was set by the kernel
during attach and it could not be invalid during detach.

Remove this helper and directly call bpf_trampoline_unlink_cgroup_shim(prog)
instead.

> +		return;
> +
> +	bpf_trampoline_unlink_cgroup_shim(prog);
> +}
> +
>  /**
>   * cgroup_bpf_release() - put references of all bpf programs and
>   *                        release all cgroup bpf data
> @@ -190,10 +290,18 @@ static void cgroup_bpf_release(struct work_struct *work)
>  
>  		hlist_for_each_entry_safe(pl, pltmp, progs, node) {
>  			hlist_del(&pl->node);
> -			if (pl->prog)
> +			if (pl->prog) {
> +				if (atype == BPF_LSM_CGROUP)
> +					bpf_cgroup_lsm_shim_release(pl->prog,
> +								    atype);
>  				bpf_prog_put(pl->prog);
> -			if (pl->link)
> +			}
> +			if (pl->link) {
> +				if (atype == BPF_LSM_CGROUP)
> +					bpf_cgroup_lsm_shim_release(pl->link->link.prog,
> +								    atype);
>  				bpf_cgroup_link_auto_detach(pl->link);
> +			}
>  			kfree(pl);
>  			static_branch_dec(&cgroup_bpf_enabled_key[atype]);
>  		}
> @@ -506,6 +614,7 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp,
>  	struct bpf_prog *old_prog = NULL;
>  	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
>  	struct bpf_cgroup_storage *new_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
> +	struct bpf_attach_target_info tgt_info = {};
>  	enum cgroup_bpf_attach_type atype;
>  	struct bpf_prog_list *pl;
>  	struct hlist_head *progs;
> @@ -522,9 +631,35 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp,
>  		/* replace_prog implies BPF_F_REPLACE, and vice versa */
>  		return -EINVAL;
>  
> -	atype = to_cgroup_bpf_attach_type(type);
> -	if (atype < 0)
> -		return -EINVAL;
> +	if (type == BPF_LSM_CGROUP) {
> +		struct bpf_prog *p = prog ? : link->link.prog;
> +
> +		if (replace_prog) {
> +			/* Reusing shim from the original program.
> +			 */
> +			if (replace_prog->aux->attach_btf_id !=
> +			    p->aux->attach_btf_id)
> +				return -EINVAL;
> +
> +			atype = replace_prog->aux->cgroup_atype;
> +		} else {
> +			err = bpf_check_attach_target(NULL, p, NULL,
> +						      p->aux->attach_btf_id,
> +						      &tgt_info);
> +			if (err)
> +				return -EINVAL;
> +
> +			atype = bpf_lsm_attach_type_get(p->aux->attach_btf_id);
> +			if (atype < 0)
> +				return atype;
> +		}
> +
> +		p->aux->cgroup_atype = atype;
> +	} else {
> +		atype = to_cgroup_bpf_attach_type(type);
> +		if (atype < 0)
> +			return -EINVAL;
> +	}
>  
>  	progs = &cgrp->bpf.progs[atype];
>  
> @@ -580,13 +715,26 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp,
>  	if (err)
>  		goto cleanup;
>  
> +	bpf_cgroup_storages_link(new_storage, cgrp, type);
It looks everything is ready for the cgrp local_storage.
How about also allowing bpf_get_local_storage() for BPF_LSM_CGROUP?

> +
> +	if (type == BPF_LSM_CGROUP && !old_prog) {
> +		struct bpf_prog *p = prog ? : link->link.prog;
> +
> +		err = bpf_trampoline_link_cgroup_shim(p, &tgt_info);
> +		if (err)
> +			goto cleanup_trampoline;
> +	}
> +
>  	if (old_prog)
>  		bpf_prog_put(old_prog);
>  	else
>  		static_branch_inc(&cgroup_bpf_enabled_key[atype]);
> -	bpf_cgroup_storages_link(new_storage, cgrp, type);
> +
>  	return 0;
>  
> +cleanup_trampoline:
> +	bpf_cgroup_storages_unlink(new_storage);
> +
>  cleanup:
>  	if (old_prog) {
>  		pl->prog = old_prog;
> @@ -678,9 +826,13 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp,
>  	struct hlist_head *progs;
>  	bool found = false;
>  
> -	atype = to_cgroup_bpf_attach_type(link->type);
> -	if (atype < 0)
> -		return -EINVAL;
> +	if (link->type == BPF_LSM_CGROUP) {
> +		atype = link->link.prog->aux->cgroup_atype;
> +	} else {
> +		atype = to_cgroup_bpf_attach_type(link->type);
> +		if (atype < 0)
> +			return -EINVAL;
> +	}
>  
>  	progs = &cgrp->bpf.progs[atype];
>  
> @@ -696,6 +848,9 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp,
>  	if (!found)
>  		return -ENOENT;
>  
> +	if (link->type == BPF_LSM_CGROUP)
> +		new_prog->aux->cgroup_atype = atype;
Does it also need to check attach_btf_id between the
new_prog and the old prog?

> +
>  	old_prog = xchg(&link->link.prog, new_prog);
>  	replace_effective_prog(cgrp, atype, link);
>  	bpf_prog_put(old_prog);
> @@ -779,9 +934,15 @@ static int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
>  	u32 flags;
>  	int err;
>  
> -	atype = to_cgroup_bpf_attach_type(type);
> -	if (atype < 0)
> -		return -EINVAL;
> +	if (type == BPF_LSM_CGROUP) {
> +		struct bpf_prog *p = prog ? : link->link.prog;
> +
> +		atype = p->aux->cgroup_atype;
> +	} else {
> +		atype = to_cgroup_bpf_attach_type(type);
> +		if (atype < 0)
> +			return -EINVAL;
> +	}
>  
>  	progs = &cgrp->bpf.progs[atype];
>  	flags = cgrp->bpf.flags[atype];
> @@ -803,6 +964,10 @@ static int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
>  	if (err)
>  		goto cleanup;
>  
> +	if (type == BPF_LSM_CGROUP)
> +		bpf_cgroup_lsm_shim_release(prog ? : link->link.prog,
> +					    atype);
After looking at find_detach_entry(),
the pl->prog may not be the same as the prog or link->link.prog here.

> +
>  	/* now can actually delete it from this cgroup list */
>  	hlist_del(&pl->node);
>  
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index e9621cfa09f2..d94f4951154e 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -3139,6 +3139,11 @@ static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog,
>  		return prog->enforce_expected_attach_type &&
>  			prog->expected_attach_type != attach_type ?
>  			-EINVAL : 0;
> +	case BPF_PROG_TYPE_LSM:
> +		if (prog->expected_attach_type != BPF_LSM_CGROUP)
> +			return -EINVAL;
> +		return 0;
> +
>  	default:
>  		return 0;
>  	}
> @@ -3194,6 +3199,8 @@ attach_type_to_prog_type(enum bpf_attach_type attach_type)
>  		return BPF_PROG_TYPE_SK_LOOKUP;
>  	case BPF_XDP:
>  		return BPF_PROG_TYPE_XDP;
> +	case BPF_LSM_CGROUP:
> +		return BPF_PROG_TYPE_LSM;
>  	default:
>  		return BPF_PROG_TYPE_UNSPEC;
>  	}
> @@ -3247,6 +3254,7 @@ static int bpf_prog_attach(const union bpf_attr *attr)
>  	case BPF_PROG_TYPE_CGROUP_SOCKOPT:
>  	case BPF_PROG_TYPE_CGROUP_SYSCTL:
>  	case BPF_PROG_TYPE_SOCK_OPS:
> +	case BPF_PROG_TYPE_LSM:
>  		ret = cgroup_bpf_prog_attach(attr, ptype, prog);
>  		break;
>  	default:
> @@ -3284,6 +3292,7 @@ static int bpf_prog_detach(const union bpf_attr *attr)
>  	case BPF_PROG_TYPE_CGROUP_SOCKOPT:
>  	case BPF_PROG_TYPE_CGROUP_SYSCTL:
>  	case BPF_PROG_TYPE_SOCK_OPS:
> +	case BPF_PROG_TYPE_LSM:
>  		return cgroup_bpf_prog_detach(attr, ptype);
>  	default:
>  		return -EINVAL;
> @@ -4317,6 +4326,7 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr)
>  	case BPF_PROG_TYPE_CGROUP_DEVICE:
>  	case BPF_PROG_TYPE_CGROUP_SYSCTL:
>  	case BPF_PROG_TYPE_CGROUP_SOCKOPT:
> +	case BPF_PROG_TYPE_LSM:
>  		ret = cgroup_bpf_link_attach(attr, prog);
>  		break;
>  	case BPF_PROG_TYPE_TRACING:
> diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> index 0c4fd194e801..c76dfa4ea2d9 100644
> --- a/kernel/bpf/trampoline.c
> +++ b/kernel/bpf/trampoline.c
> @@ -11,6 +11,8 @@
>  #include <linux/rcupdate_wait.h>
>  #include <linux/module.h>
>  #include <linux/static_call.h>
> +#include <linux/bpf_verifier.h>
> +#include <linux/bpf_lsm.h>
>  
>  /* dummy _ops. The verifier will operate on target program's ops. */
>  const struct bpf_verifier_ops bpf_extension_verifier_ops = {
> @@ -485,6 +487,149 @@ int bpf_trampoline_unlink_prog(struct bpf_prog *prog, struct bpf_trampoline *tr)
>  	return err;
>  }
>  
> +#if defined(CONFIG_BPF_JIT) && defined(CONFIG_BPF_SYSCALL)
> +static struct bpf_prog *cgroup_shim_alloc(const struct bpf_prog *prog,
> +					  bpf_func_t bpf_func)
> +{
> +	struct bpf_prog *p;
> +
> +	p = bpf_prog_alloc(1, 0);
> +	if (!p)
> +		return NULL;
> +
> +	p->jited = false;
> +	p->bpf_func = bpf_func;
> +
> +	p->aux->cgroup_atype = prog->aux->cgroup_atype;
> +	p->aux->attach_func_proto = prog->aux->attach_func_proto;
> +	p->aux->attach_btf_id = prog->aux->attach_btf_id;
> +	p->aux->attach_btf = prog->aux->attach_btf;
> +	btf_get(p->aux->attach_btf);
> +	p->type = BPF_PROG_TYPE_LSM;
> +	p->expected_attach_type = BPF_LSM_MAC;
> +	bpf_prog_inc(p);
> +
> +	return p;
> +}
> +
> +static struct bpf_prog *cgroup_shim_find(struct bpf_trampoline *tr,
> +					 bpf_func_t bpf_func)
> +{
> +	const struct bpf_prog_aux *aux;
> +	int kind;
> +
> +	for (kind = 0; kind < BPF_TRAMP_MAX; kind++) {
> +		hlist_for_each_entry(aux, &tr->progs_hlist[kind], tramp_hlist) {
> +			struct bpf_prog *p = aux->prog;
> +
> +			if (p->bpf_func == bpf_func)
> +				return p;
> +		}
> +	}
> +
> +	return NULL;
> +}
> +
> +int bpf_trampoline_link_cgroup_shim(struct bpf_prog *prog,
> +				    struct bpf_attach_target_info *tgt_info)
> +{
> +	struct bpf_prog *shim_prog = NULL;
> +	struct bpf_trampoline *tr;
> +	bpf_func_t bpf_func;
> +	u64 key;
> +	int err;
> +
> +	key = bpf_trampoline_compute_key(NULL, prog->aux->attach_btf,
> +					 prog->aux->attach_btf_id);
> +
> +	err = bpf_lsm_find_cgroup_shim(prog, &bpf_func);
> +	if (err)
> +		return err;
> +
> +	tr = bpf_trampoline_get(key, tgt_info);
> +	if (!tr)
> +		return  -ENOMEM;
> +
> +	mutex_lock(&tr->mutex);
> +
> +	shim_prog = cgroup_shim_find(tr, bpf_func);
> +	if (shim_prog) {
> +		/* Reusing existing shim attached by the other program.
> +		 */
nit.  Avoid extra line in '*/' for one liner comment.  Didn't
see this convention in other bpf codes.

Also, how about the earlier comment regarding to another __bpf_prog_enter
and __bpf_prog_exit for BPF_LSM_CGROUP that don't do the active counts
and stats collection ?

> +		bpf_prog_inc(shim_prog);
> +		mutex_unlock(&tr->mutex);
> +		return 0;
> +	}
> +
> +	/* Allocate and install new shim.
> +	 */
Same here.

> +
> +	shim_prog = cgroup_shim_alloc(prog, bpf_func);
> +	if (!shim_prog) {
> +		err = -ENOMEM;
> +		goto out;
> +	}
> +
> +	err = __bpf_trampoline_link_prog(shim_prog, tr);
> +	if (err)
> +		goto out;
> +
> +	mutex_unlock(&tr->mutex);
> +
> +	return 0;
> +out:
> +	if (shim_prog)
> +		bpf_prog_put(shim_prog);
> +
> +	mutex_unlock(&tr->mutex);
> +	return err;
> +}
> +
> +void bpf_trampoline_unlink_cgroup_shim(struct bpf_prog *prog)
> +{
> +	struct bpf_prog *shim_prog;
> +	struct bpf_trampoline *tr;
> +	bpf_func_t bpf_func;
> +	u64 key;
> +	int err;
> +
> +	key = bpf_trampoline_compute_key(NULL, prog->aux->attach_btf,
> +					 prog->aux->attach_btf_id);
> +
> +	err = bpf_lsm_find_cgroup_shim(prog, &bpf_func);
> +	if (err)
> +		return;
> +
> +	tr = bpf_trampoline_lookup(key);
> +	if (!tr)
> +		return;
> +
> +	mutex_lock(&tr->mutex);
> +
> +	shim_prog = cgroup_shim_find(tr, bpf_func);
> +	if (shim_prog) {
> +		/* We use shim_prog refcnt for tracking whether to
> +		 * remove the shim program from the trampoline.
> +		 * Trampoline's mutex is held while refcnt is
> +		 * added/subtracted so we don't need to care about
> +		 * potential races.
> +		 */
> +
> +		if (atomic64_read(&shim_prog->aux->refcnt) == 1)
> +			WARN_ON_ONCE(__bpf_trampoline_unlink_prog(shim_prog, tr));
> +
> +		bpf_prog_put(shim_prog);
> +	}
> +
> +	mutex_unlock(&tr->mutex);
> +
> +	bpf_trampoline_put(tr); /* bpf_trampoline_lookup */
> +
> +	if (shim_prog)
> +		bpf_trampoline_put(tr);
> +}
> +#endif
> +
>  struct bpf_trampoline *bpf_trampoline_get(u64 key,
>  					  struct bpf_attach_target_info *tgt_info)
>  {
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 9c1a02b82ecd..cc84954846d7 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -14197,6 +14197,7 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,
>  		fallthrough;
>  	case BPF_MODIFY_RETURN:
>  	case BPF_LSM_MAC:
> +	case BPF_LSM_CGROUP:
>  	case BPF_TRACE_FENTRY:
>  	case BPF_TRACE_FEXIT:
>  		if (!btf_type_is_func(t)) {
> diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
> index d14b10b85e51..bbe48a2dd852 100644
> --- a/tools/include/uapi/linux/bpf.h
> +++ b/tools/include/uapi/linux/bpf.h
> @@ -998,6 +998,7 @@ enum bpf_attach_type {
>  	BPF_SK_REUSEPORT_SELECT_OR_MIGRATE,
>  	BPF_PERF_EVENT,
>  	BPF_TRACE_KPROBE_MULTI,
> +	BPF_LSM_CGROUP,
>  	__MAX_BPF_ATTACH_TYPE
>  };
>  
> -- 
> 2.36.0.rc0.470.gd361397f0d-goog
> 

^ permalink raw reply

* Re: [PATCH bpf-next v6 5/6] bpf: Add selftests for raw syncookie helpers
From: Andrii Nakryiko @ 2022-04-26  6:26 UTC (permalink / raw)
  To: Alexei Starovoitov
  Cc: Maxim Mikityanskiy, bpf, Alexei Starovoitov, Daniel Borkmann,
	Andrii Nakryiko, Networking, Tariq Toukan, Martin KaFai Lau,
	Song Liu, Yonghong Song, John Fastabend, KP Singh,
	David S. Miller, Jakub Kicinski, Petar Penkov, Lorenz Bauer,
	Eric Dumazet, Hideaki YOSHIFUJI, David Ahern, Shuah Khan,
	Jesper Dangaard Brouer, Nathan Chancellor, Nick Desaulniers,
	Joe Stringer, Florent Revest, open list:KERNEL SELFTEST FRAMEWORK,
	Toke Høiland-Jørgensen, Kumar Kartikeya Dwivedi,
	Florian Westphal, pabeni
In-Reply-To: <20220426001223.wlnfd2kmmogip5d5@MBP-98dd607d3435.dhcp.thefacebook.com>

On Mon, Apr 25, 2022 at 5:12 PM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Fri, Apr 22, 2022 at 08:24:21PM +0300, Maxim Mikityanskiy wrote:
> > +void test_xdp_synproxy(void)
> > +{
> > +     int server_fd = -1, client_fd = -1, accept_fd = -1;
> > +     struct nstoken *ns = NULL;
> > +     FILE *ctrl_file = NULL;
> > +     char buf[1024];
> > +     size_t size;
> > +
> > +     SYS("ip netns add synproxy");
> > +
> > +     SYS("ip link add tmp0 type veth peer name tmp1");
> > +     SYS("ip link set tmp1 netns synproxy");
> > +     SYS("ip link set tmp0 up");
> > +     SYS("ip addr replace 198.18.0.1/24 dev tmp0");
> > +
> > +     // When checksum offload is enabled, the XDP program sees wrong
> > +     // checksums and drops packets.
> > +     SYS("ethtool -K tmp0 tx off");
>
> BPF CI image doesn't have ethtool installed.
> It will take some time to get it updated. Until then we cannot land the patch set.
> Can you think of a way to run this test without shelling to ethtool?

Good news: we got updated CI image with ethtool, so that shouldn't be
a problem anymore.

Bad news: this selftest still fails, but in different place:

test_synproxy:FAIL:iptables -t raw -I PREROUTING -i tmp1 -p tcp -m tcp
--syn --dport 8080 -j CT --notrack unexpected error: 512 (errno 2)

See [0].

  [0] https://github.com/kernel-patches/bpf/runs/6169439612?check_suite_focus=true

^ permalink raw reply

* Re: [PATCH perf/core 4/5] perf tools: Register perfkprobe libbpf section handler
From: Andrii Nakryiko @ 2022-04-26  6:22 UTC (permalink / raw)
  To: Jiri Olsa
  Cc: Arnaldo Carvalho de Melo, Alexei Starovoitov, Daniel Borkmann,
	Andrii Nakryiko, linux-perf-use., Networking, bpf, Ingo Molnar,
	Namhyung Kim, Alexander Shishkin, Peter Zijlstra,
	Martin KaFai Lau, Song Liu, Yonghong Song, John Fastabend,
	Ian Rogers
In-Reply-To: <20220422100025.1469207-5-jolsa@kernel.org>

On Fri, Apr 22, 2022 at 3:01 AM Jiri Olsa <jolsa@kernel.org> wrote:
>
> Perf is using section name to declare special kprobe arguments,
> which no longer works with current libbpf, that either requires
> certain form of the section name or allows to register custom
> handler.
>
> Adding support for 'perfkprobe/' section name handler to take
> care of perf kprobe programs.
>
> The handler servers two purposes:
>   - allows perf programs to have special arguments in section name
>   - allows perf to use pre-load callback where we can attach init
>     code (zeroing all argument registers) to each perf program
>
> The second is essential part of new prologue generation code,
> that's coming in following patch.
>
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> ---
>  tools/perf/util/bpf-loader.c | 50 ++++++++++++++++++++++++++++++++++++
>  1 file changed, 50 insertions(+)
>
> diff --git a/tools/perf/util/bpf-loader.c b/tools/perf/util/bpf-loader.c
> index f8ad581ea247..92dd8cc18edb 100644
> --- a/tools/perf/util/bpf-loader.c
> +++ b/tools/perf/util/bpf-loader.c
> @@ -86,6 +86,7 @@ bpf_perf_object__next(struct bpf_perf_object *prev)
>              (perf_obj) = (tmp), (tmp) = bpf_perf_object__next(tmp))
>
>  static bool libbpf_initialized;
> +static int libbpf_sec_handler;
>
>  static int bpf_perf_object__add(struct bpf_object *obj)
>  {
> @@ -99,12 +100,61 @@ static int bpf_perf_object__add(struct bpf_object *obj)
>         return perf_obj ? 0 : -ENOMEM;
>  }
>
> +static struct bpf_insn prologue_init_insn[] = {
> +       BPF_MOV64_IMM(BPF_REG_0, 0),
> +       BPF_MOV64_IMM(BPF_REG_1, 0),
> +       BPF_MOV64_IMM(BPF_REG_2, 0),
> +       BPF_MOV64_IMM(BPF_REG_3, 0),
> +       BPF_MOV64_IMM(BPF_REG_4, 0),
> +       BPF_MOV64_IMM(BPF_REG_5, 0),
> +};
> +
> +#define LIBBPF_SEC_PREFIX "perfkprobe/"

libbpf allows to register fallback handler that will handle any SEC()
definition besides the ones that libbpf handles. Would that work in
this case instead of adding a custom prefix handler here? See
prog_tests/custom_sec_handlers.c for example:

fallback_id = libbpf_register_prog_handler(NULL,
BPF_PROG_TYPE_SYSCALL, 0, &opts);

> +

[...]

^ permalink raw reply

* Re: [PATCH perf/core 3/5] perf tools: Move libbpf init in libbpf_init function
From: Andrii Nakryiko @ 2022-04-26  6:21 UTC (permalink / raw)
  To: Jiri Olsa
  Cc: Arnaldo Carvalho de Melo, Jiri Olsa, Alexei Starovoitov,
	Daniel Borkmann, Andrii Nakryiko, linux-perf-use., Networking,
	bpf, Ingo Molnar, Namhyung Kim, Alexander Shishkin,
	Peter Zijlstra, Martin KaFai Lau, Song Liu, Yonghong Song,
	John Fastabend, Ian Rogers
In-Reply-To: <YmZM0kd7uWqPOu0x@krava>

On Mon, Apr 25, 2022 at 12:25 AM Jiri Olsa <olsajiri@gmail.com> wrote:
>
> On Fri, Apr 22, 2022 at 02:03:24PM -0300, Arnaldo Carvalho de Melo wrote:
> > Em Fri, Apr 22, 2022 at 12:00:23PM +0200, Jiri Olsa escreveu:
> > > Moving the libbpf init code into single function,
> > > so we have single place doing that.
> >
> > Cherry picked this one, waiting for Andrii to chime in wrt the libbpf
> > changes, if its acceptable, how to proceed, i.e. in what tree to carry
> > these?
>
> I think at this point it's ok with either yours perf/core or bpf-next/master,
> I waited for them to be in sync for this ;-)

I'd rather have all the libbpf code stay in bpf-next, otherwise Github
sync process becomes very hairy. BTW, I think libbpf v0.8 release is
pretty close, I plan to add few small features before cutting it, but
that should be done pretty soon

>
> but as you pointed out there's issue with perf linked with dynamic libbpf,
> because the current version does not have the libbpf_register_prog_handler
> api that perf needs now.. also it needs the fix and api introduced in this
> patchset
>
> I'll check and perhaps we can temporirly disable perf/bpf prologue generation
> for dynamic linking..? until the libbpf release has all the needed changes
>
> jirka
>
> >
> > - Arnaldo
> >
> > > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> > > ---
> > >  tools/perf/util/bpf-loader.c | 27 ++++++++++++++++++---------
> > >  1 file changed, 18 insertions(+), 9 deletions(-)
> > >

[...]

^ permalink raw reply

* Re: [PATCH perf/core 1/5] libbpf: Add bpf_program__set_insns function
From: Andrii Nakryiko @ 2022-04-26  6:19 UTC (permalink / raw)
  To: Daniel Borkmann
  Cc: Jiri Olsa, Arnaldo Carvalho de Melo, Alexei Starovoitov,
	Andrii Nakryiko, linux-perf-use., Networking, bpf, Ingo Molnar,
	Namhyung Kim, Alexander Shishkin, Peter Zijlstra,
	Martin KaFai Lau, Song Liu, Yonghong Song, John Fastabend,
	Ian Rogers
In-Reply-To: <52f36e85-fea6-e307-344e-5bbb5b8431f7@iogearbox.net>

On Mon, Apr 25, 2022 at 9:22 AM Daniel Borkmann <daniel@iogearbox.net> wrote:
>
> On 4/22/22 12:00 PM, Jiri Olsa wrote:
> > Adding bpf_program__set_insns that allows to set new
> > instructions for program.
> >
> > Also moving bpf_program__attach_kprobe_multi_opts on
> > the proper name sorted place in map file.

would make sense to fix it as a separate patch, it has nothing to do
with bpf_program__set_insns() API itself

> >
> > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> > ---
> >   tools/lib/bpf/libbpf.c   |  8 ++++++++
> >   tools/lib/bpf/libbpf.h   | 12 ++++++++++++
> >   tools/lib/bpf/libbpf.map |  3 ++-
> >   3 files changed, 22 insertions(+), 1 deletion(-)
> >
> > diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> > index 809fe209cdcc..284790d81c1b 100644
> > --- a/tools/lib/bpf/libbpf.c
> > +++ b/tools/lib/bpf/libbpf.c
> > @@ -8457,6 +8457,14 @@ size_t bpf_program__insn_cnt(const struct bpf_program *prog)
> >       return prog->insns_cnt;
> >   }
> >
> > +void bpf_program__set_insns(struct bpf_program *prog,
> > +                         struct bpf_insn *insns, size_t insns_cnt)
> > +{
> > +     free(prog->insns);
> > +     prog->insns = insns;
> > +     prog->insns_cnt = insns_cnt;

let's not store user-provided pointer here. Please realloc prog->insns
as necessary and copy over insns into it.

Also let's at least add the check for prog->loaded and return -EBUSY
in such a case. And of course this API should return int, not void.

> > +}
> > +
> >   int bpf_program__set_prep(struct bpf_program *prog, int nr_instances,
> >                         bpf_program_prep_t prep)
> >   {
> > diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
> > index 05dde85e19a6..b31ad58d335f 100644
> > --- a/tools/lib/bpf/libbpf.h
> > +++ b/tools/lib/bpf/libbpf.h
> > @@ -323,6 +323,18 @@ struct bpf_insn;
> >    * different.
> >    */
> >   LIBBPF_API const struct bpf_insn *bpf_program__insns(const struct bpf_program *prog);
> > +
> > +/**
> > + * @brief **bpf_program__set_insns()** can set BPF program's underlying
> > + * BPF instructions.
> > + * @param prog BPF program for which to return instructions
> > + * @param insn a pointer to an array of BPF instructions
> > + * @param insns_cnt number of `struct bpf_insn`'s that form
> > + * specified BPF program
> > + */

This API makes me want to cry... but I can't come up with anything
better for perf's use case.

But it can only more or less safely and sanely be used from the
prog_prepare_load_fn callback, so please add a big warning here saying
that this is a very advanced libbpf API and the user needs to know
what they are doing and this should be used from prog_prepare_load_fn
callback only. If bpf_program__set_insns() is called before
prog_prepare_load_fn any map/subprog/etc relocation will most probably
fail or corrupt BPF program code.

> > +LIBBPF_API void bpf_program__set_insns(struct bpf_program *prog,
> > +                                    struct bpf_insn *insns, size_t insns_cnt);

s/insns_cnt/insn_cnt/

> > +
>
> Iiuc, patch 2 should be squashed into this one given they logically belong to the
> same change?
>
> Fwiw, I think the API description should be elaborated a bit more, in particular that
> the passed-in insns need to be from allocated dynamic memory which is later on passed
> to free(), and maybe also constraints at which point in time bpf_program__set_insns()
> may be called.. (as well as high-level description on potential use cases e.g. around
> patch 4).

Yep, patch #1 is kind of broken without patch #2, so let's combine them.

>
> >   /**
> >    * @brief **bpf_program__insn_cnt()** returns number of `struct bpf_insn`'s
> >    * that form specified BPF program.
> > diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map
> > index dd35ee58bfaa..afa10d24ab41 100644
> > --- a/tools/lib/bpf/libbpf.map
> > +++ b/tools/lib/bpf/libbpf.map
> > @@ -444,7 +444,8 @@ LIBBPF_0.8.0 {
> >       global:
> >               bpf_object__destroy_subskeleton;
> >               bpf_object__open_subskeleton;
> > +             bpf_program__attach_kprobe_multi_opts;
> > +             bpf_program__set_insns;
> >               libbpf_register_prog_handler;
> >               libbpf_unregister_prog_handler;
> > -             bpf_program__attach_kprobe_multi_opts;
> >   } LIBBPF_0.7.0;
> >
>

^ permalink raw reply

* Re: [PATCH perf/core 1/5] libbpf: Add bpf_program__set_insns function
From: Jiri Olsa @ 2022-04-26  6:19 UTC (permalink / raw)
  To: Daniel Borkmann
  Cc: Jiri Olsa, Arnaldo Carvalho de Melo, Alexei Starovoitov,
	Andrii Nakryiko, linux-perf-users, netdev, bpf, Ingo Molnar,
	Namhyung Kim, Alexander Shishkin, Peter Zijlstra,
	Martin KaFai Lau, Song Liu, Yonghong Song, John Fastabend,
	Ian Rogers
In-Reply-To: <52f36e85-fea6-e307-344e-5bbb5b8431f7@iogearbox.net>

On Mon, Apr 25, 2022 at 06:22:37PM +0200, Daniel Borkmann wrote:
> On 4/22/22 12:00 PM, Jiri Olsa wrote:
> > Adding bpf_program__set_insns that allows to set new
> > instructions for program.
> > 
> > Also moving bpf_program__attach_kprobe_multi_opts on
> > the proper name sorted place in map file.
> > 
> > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> > ---
> >   tools/lib/bpf/libbpf.c   |  8 ++++++++
> >   tools/lib/bpf/libbpf.h   | 12 ++++++++++++
> >   tools/lib/bpf/libbpf.map |  3 ++-
> >   3 files changed, 22 insertions(+), 1 deletion(-)
> > 
> > diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> > index 809fe209cdcc..284790d81c1b 100644
> > --- a/tools/lib/bpf/libbpf.c
> > +++ b/tools/lib/bpf/libbpf.c
> > @@ -8457,6 +8457,14 @@ size_t bpf_program__insn_cnt(const struct bpf_program *prog)
> >   	return prog->insns_cnt;
> >   }
> > +void bpf_program__set_insns(struct bpf_program *prog,
> > +			    struct bpf_insn *insns, size_t insns_cnt)
> > +{
> > +	free(prog->insns);
> > +	prog->insns = insns;
> > +	prog->insns_cnt = insns_cnt;
> > +}
> > +
> >   int bpf_program__set_prep(struct bpf_program *prog, int nr_instances,
> >   			  bpf_program_prep_t prep)
> >   {
> > diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
> > index 05dde85e19a6..b31ad58d335f 100644
> > --- a/tools/lib/bpf/libbpf.h
> > +++ b/tools/lib/bpf/libbpf.h
> > @@ -323,6 +323,18 @@ struct bpf_insn;
> >    * different.
> >    */
> >   LIBBPF_API const struct bpf_insn *bpf_program__insns(const struct bpf_program *prog);
> > +
> > +/**
> > + * @brief **bpf_program__set_insns()** can set BPF program's underlying
> > + * BPF instructions.
> > + * @param prog BPF program for which to return instructions
> > + * @param insn a pointer to an array of BPF instructions
> > + * @param insns_cnt number of `struct bpf_insn`'s that form
> > + * specified BPF program
> > + */
> > +LIBBPF_API void bpf_program__set_insns(struct bpf_program *prog,
> > +				       struct bpf_insn *insns, size_t insns_cnt);
> > +
> 
> Iiuc, patch 2 should be squashed into this one given they logically belong to the
> same change?

right, that's probably better

> 
> Fwiw, I think the API description should be elaborated a bit more, in particular that
> the passed-in insns need to be from allocated dynamic memory which is later on passed
> to free(), and maybe also constraints at which point in time bpf_program__set_insns()
> may be called.. (as well as high-level description on potential use cases e.g. around
> patch 4).

ok, will add that

thanks,
jirka

> 
> >   /**
> >    * @brief **bpf_program__insn_cnt()** returns number of `struct bpf_insn`'s
> >    * that form specified BPF program.
> > diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map
> > index dd35ee58bfaa..afa10d24ab41 100644
> > --- a/tools/lib/bpf/libbpf.map
> > +++ b/tools/lib/bpf/libbpf.map
> > @@ -444,7 +444,8 @@ LIBBPF_0.8.0 {
> >   	global:
> >   		bpf_object__destroy_subskeleton;
> >   		bpf_object__open_subskeleton;
> > +		bpf_program__attach_kprobe_multi_opts;
> > +		bpf_program__set_insns;
> >   		libbpf_register_prog_handler;
> >   		libbpf_unregister_prog_handler;
> > -		bpf_program__attach_kprobe_multi_opts;
> >   } LIBBPF_0.7.0;
> > 
> 

^ permalink raw reply

* [syzbot] KASAN: use-after-free Read in ieee80211_scan_rx (3)
From: syzbot @ 2022-04-26  6:10 UTC (permalink / raw)
  To: davem, johannes, kuba, linux-kernel, linux-wireless, netdev,
	pabeni, syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    af2d861d4cd2 Linux 5.18-rc4
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13bf73b2f00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4071c85377b36266
dashboard link: https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in ieee80211_scan_rx+0x7d0/0x7e0 net/mac80211/scan.c:293
Read of size 4 at addr ffff888025e7f02c by task ksoftirqd/2/28

CPU: 2 PID: 28 Comm: ksoftirqd/2 Not tainted 5.18.0-rc4-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 ieee80211_scan_rx+0x7d0/0x7e0 net/mac80211/scan.c:293
 __ieee80211_rx_handle_packet net/mac80211/rx.c:4782 [inline]
 ieee80211_rx_list+0x1fe3/0x2740 net/mac80211/rx.c:4975
 ieee80211_rx_napi+0xdb/0x3d0 net/mac80211/rx.c:4998
 ieee80211_rx include/net/mac80211.h:4611 [inline]
 ieee80211_tasklet_handler+0xd4/0x130 net/mac80211/main.c:235
 tasklet_action_common.constprop.0+0x201/0x2e0 kernel/softirq.c:784
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 run_ksoftirqd kernel/softirq.c:921 [inline]
 run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913
 smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>

Allocated by task 12352:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:436 [inline]
 ____kasan_kmalloc mm/kasan/common.c:515 [inline]
 ____kasan_kmalloc mm/kasan/common.c:474 [inline]
 __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524
 kasan_kmalloc include/linux/kasan.h:234 [inline]
 kmem_cache_alloc_trace+0x1ea/0x4a0 mm/slab.c:3583
 kmalloc include/linux/slab.h:581 [inline]
 sl_alloc_bufs drivers/net/slip/slip.c:157 [inline]
 slip_open+0x9e3/0x11b0 drivers/net/slip/slip.c:827
 tty_ldisc_open+0x9b/0x110 drivers/tty/tty_ldisc.c:433
 tty_set_ldisc+0x2f1/0x680 drivers/tty/tty_ldisc.c:558
 tiocsetd drivers/tty/tty_io.c:2433 [inline]
 tty_ioctl+0xae0/0x15e0 drivers/tty/tty_io.c:2714
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl fs/ioctl.c:856 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Last potentially related work creation:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 __kasan_record_aux_stack+0x7e/0x90 mm/kasan/generic.c:348
 kvfree_call_rcu+0x74/0x990 kernel/rcu/tree.c:3595
 drop_sysctl_table+0x3c0/0x4e0 fs/proc/proc_sysctl.c:1705
 unregister_sysctl_table fs/proc/proc_sysctl.c:1743 [inline]
 unregister_sysctl_table+0xc0/0x190 fs/proc/proc_sysctl.c:1718
 sctp_sysctl_net_unregister+0x58/0x80 net/sctp/sysctl.c:602
 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:162
 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

Second to last potentially related work creation:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 __kasan_record_aux_stack+0x7e/0x90 mm/kasan/generic.c:348
 kvfree_call_rcu+0x74/0x990 kernel/rcu/tree.c:3595
 drop_sysctl_table+0x3c0/0x4e0 fs/proc/proc_sysctl.c:1705
 unregister_sysctl_table fs/proc/proc_sysctl.c:1743 [inline]
 unregister_sysctl_table+0xc0/0x190 fs/proc/proc_sysctl.c:1718
 __devinet_sysctl_unregister net/ipv4/devinet.c:2611 [inline]
 devinet_sysctl_unregister net/ipv4/devinet.c:2639 [inline]
 inetdev_destroy net/ipv4/devinet.c:327 [inline]
 inetdev_event+0xcaf/0x15d0 net/ipv4/devinet.c:1604
 notifier_call_chain+0xb5/0x200 kernel/notifier.c:84
 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1938
 call_netdevice_notifiers_extack net/core/dev.c:1976 [inline]
 call_netdevice_notifiers net/core/dev.c:1990 [inline]
 unregister_netdevice_many+0x92e/0x1890 net/core/dev.c:10751
 ip_tunnel_delete_nets+0x39f/0x5b0 net/ipv4/ip_tunnel.c:1124
 ops_exit_list+0x125/0x170 net/core/net_namespace.c:167
 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

The buggy address belongs to the object at ffff888025e7f000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 44 bytes inside of
 2048-byte region [ffff888025e7f000, ffff888025e7f800)

The buggy address belongs to the physical page:
page:ffffea0000979fc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25e7f
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea00008aaa88 ffffea000081d988 ffff888010c40800
raw: 0000000000000000 ffff888025e7f000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 28931, tgid 28930 (syz-executor.2), ts 858983317706, free_ts 817324026609
 prep_new_page mm/page_alloc.c:2441 [inline]
 get_page_from_freelist+0xba2/0x3e00 mm/page_alloc.c:4182
 __alloc_pages_slowpath.constprop.0+0x2eb/0x20e0 mm/page_alloc.c:4953
 __alloc_pages+0x412/0x500 mm/page_alloc.c:5421
 __alloc_pages_node include/linux/gfp.h:587 [inline]
 kmem_getpages mm/slab.c:1378 [inline]
 cache_grow_begin+0x75/0x350 mm/slab.c:2584
 cache_alloc_refill+0x27f/0x380 mm/slab.c:2957
 ____cache_alloc mm/slab.c:3040 [inline]
 ____cache_alloc mm/slab.c:3023 [inline]
 __do_cache_alloc mm/slab.c:3267 [inline]
 slab_alloc mm/slab.c:3309 [inline]
 __do_kmalloc mm/slab.c:3708 [inline]
 __kmalloc+0x3b3/0x4d0 mm/slab.c:3719
 kmalloc include/linux/slab.h:586 [inline]
 kzalloc include/linux/slab.h:714 [inline]
 __register_sysctl_table+0x112/0x1090 fs/proc/proc_sysctl.c:1335
 __devinet_sysctl_register+0x156/0x280 net/ipv4/devinet.c:2588
 devinet_sysctl_register net/ipv4/devinet.c:2628 [inline]
 devinet_sysctl_register+0x160/0x230 net/ipv4/devinet.c:2618
 inetdev_init+0x286/0x580 net/ipv4/devinet.c:279
 inetdev_event+0xa8a/0x15d0 net/ipv4/devinet.c:1536
 notifier_call_chain+0xb5/0x200 kernel/notifier.c:84
 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1938
 call_netdevice_notifiers_extack net/core/dev.c:1976 [inline]
 call_netdevice_notifiers net/core/dev.c:1990 [inline]
 register_netdevice+0x109e/0x15b0 net/core/dev.c:9994
 __ip_tunnel_create+0x398/0x5c0 net/ipv4/ip_tunnel.c:267
 ip_tunnel_init_net+0x2e4/0x9d0 net/ipv4/ip_tunnel.c:1071
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1356 [inline]
 free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1406
 free_unref_page_prepare mm/page_alloc.c:3328 [inline]
 free_unref_page+0x19/0x6a0 mm/page_alloc.c:3423
 slab_destroy mm/slab.c:1630 [inline]
 drain_freelist.isra.0+0xc6/0x130 mm/slab.c:2222
 cache_reap+0x1ba/0x290 mm/slab.c:4041
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

Memory state around the buggy address:
 ffff888025e7ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888025e7ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888025e7f000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                  ^
 ffff888025e7f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888025e7f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

^ permalink raw reply

* Re: [PATCH net-next 08/10] tls: rx: use async as an in-out argument
From: Gal Pressman @ 2022-04-26  6:08 UTC (permalink / raw)
  To: Jakub Kicinski
  Cc: davem, pabeni, netdev, borisp, john.fastabend, daniel, vfedorenko
In-Reply-To: <20220425075438.6c87e969@kernel.org>

On 25/04/2022 17:54, Jakub Kicinski wrote:
> On Mon, 25 Apr 2022 10:19:45 +0300 Gal Pressman wrote:
>> On 11/04/2022 22:19, Jakub Kicinski wrote:
>>> Propagating EINPROGRESS thru multiple layers of functions is
>>> error prone. Use darg->async as an in/out argument, like we
>>> use darg->zc today. On input it tells the code if async is
>>> allowed, on output if it took place.
>>>
>>> Signed-off-by: Jakub Kicinski <kuba@kernel.org>  
>> I know this is not much to go on, but this patch broke our tls workflows
>> when device offload is enabled.
>> I'm still looking into it, but maybe you have an idea what might have
>> went wrong?
> Oof right, sorry. When packet is already decrypted by HW we'll skip 
> the decrypt completely and leave async to whatever it was at input.
>
> Something like this?
>
> --->8---------
>
> diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
> index ddbe05ec5489..80094528eadb 100644
> --- a/net/tls/tls_sw.c
> +++ b/net/tls/tls_sw.c
> @@ -1562,6 +1562,7 @@ static int decrypt_skb_update(struct sock *sk, struct sk_buff *skb,
>  
>  	if (tlm->decrypted) {
>  		darg->zc = false;
> +		darg->async = false;
>  		return 0;
>  	}
>  
> @@ -1572,6 +1573,7 @@ static int decrypt_skb_update(struct sock *sk, struct sk_buff *skb,
>  		if (err > 0) {
>  			tlm->decrypted = 1;
>  			darg->zc = false;
> +			darg->async = false;
>  			goto decrypt_done;
>  		}
>  	}

Thank you Jakub!
I will run the patch you sent through our testing.

^ permalink raw reply

* Re: [PATCH memcg v3] net: set proper memcg for net_init hooks allocations
From: Vasily Averin @ 2022-04-26  5:58 UTC (permalink / raw)
  To: Roman Gushchin
  Cc: Vlastimil Babka, Shakeel Butt, kernel, Florian Westphal,
	linux-kernel, Michal Hocko, cgroups, netdev, David S. Miller,
	Jakub Kicinski, Paolo Abeni
In-Reply-To: <YmdeCqi6wmgiSiWh@carbon>

On 4/26/22 05:50, Roman Gushchin wrote:
> On Mon, Apr 25, 2022 at 01:56:02PM +0300, Vasily Averin wrote:
>> +
>> +static inline struct mem_cgroup *get_net_memcg(void *p)
>> +{
>> +	struct mem_cgroup *memcg;
>> +
>> +	memcg = get_mem_cgroup_from_kmem(p);
>> +
>> +	if (!memcg)
>> +		memcg = root_mem_cgroup;
>> +
>> +	return memcg;
>> +}
> 
> I'm not a fan of this helper: it has nothing to do with the networking,
> actually it's a wrapper of get_mem_cgroup_from_kmem() replacing NULL
> with root_mem_cgroup.
> 
> Overall the handling of root_mem_cgroup is very messy, I don't blame
> this patch. But I wonder if it's better to simple move this code
> to the call site without introducing a new function?

Unfortunately root_mem_cgroup is defined under CONFIG_MEMCG,
so we cannot use it outside without ifdefs.

> Alternatively, you can introduce something like:
> struct mem_cgroup *mem_cgroup_or_root(struct mem_cgroup *memcg)
> {
> 	return memcg ? memcg : root_mem_cgroup;
> }

Thank you for the hint, this looks much better.
	Vasily Averin

^ permalink raw reply

* [linux-next:master] BUILD REGRESSION e7d6987e09a328d4a949701db40ef63fbb970670
From: kernel test robot @ 2022-04-26  5:42 UTC (permalink / raw)
  To: Andrew Morton
  Cc: netdev, linux-sh, linux-mm, linux-mips, linux-media, linux-edac,
	linux-crypto, linux-btrfs, linux-arm-msm, linux-arm-kernel,
	linaro-mm-sig, io-uring, dri-devel, bpf, ath11k,
	Linux Memory Management List

tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
branch HEAD: e7d6987e09a328d4a949701db40ef63fbb970670  Add linux-next specific files for 20220422

Error/Warning reports:

https://lore.kernel.org/linux-mm/202204081656.6x4pfen4-lkp@intel.com
https://lore.kernel.org/linux-mm/202204231818.yVvV3Oxp-lkp@intel.com
https://lore.kernel.org/linux-mm/202204240458.z2cymyl5-lkp@intel.com
https://lore.kernel.org/linux-mm/202204241527.n36cr1e5-lkp@intel.com
https://lore.kernel.org/llvm/202204230717.gJP3yZ5j-lkp@intel.com

Error/Warning: (recently discovered and may have been fixed)

ERROR: modpost: "omap_set_dma_priority" [drivers/video/fbdev/omap/omapfb.ko] undefined!
arch/sh/include/asm/io.h:274:33: error: expected expression before 'do'
drivers/bus/mhi/host/main.c:787:13: warning: parameter 'event_quota' set but not used [-Wunused-but-set-parameter]
drivers/char/hw_random/mpfs-rng.c:49:9: error: call to undeclared function 'mpfs_blocking_transaction'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
drivers/char/hw_random/mpfs-rng.c:74:27: warning: incompatible integer to pointer conversion assigning to 'struct mpfs_sys_controller *' from 'int' [-Wint-conversion]
drivers/char/hw_random/mpfs-rng.c:74:30: error: call to undeclared function 'mpfs_sys_controller_get'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
drivers/gpu/drm/solomon/ssd130x-spi.c:154:35: warning: unused variable 'ssd130x_spi_table' [-Wunused-const-variable]
drivers/usb/atm/cxacru.c:259:9: warning: Call to function 'sprintf' is insecure as it does not provide bounding of the memory buffer or security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
drivers/usb/atm/usbatm.c:739:10: warning: Call to function 'sprintf' is insecure as it does not provide bounding of the memory buffer or security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
drivers/usb/chipidea/core.c:956:10: warning: Call to function 'sprintf' is insecure as it does not provide bounding of the memory buffer or security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
drivers/usb/gadget/udc/core.c:1664:9: warning: Call to function 'sprintf' is insecure as it does not provide bounding of the memory buffer or security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
mpfs-rng.c:(.data.rel.ro+0x20): undefined reference to `mpfs_sys_controller_get'
mpfs-rng.c:(.data.rel.ro+0x8): undefined reference to `mpfs_blocking_transaction'
omapfb_main.c:(.text+0x41ec): undefined reference to `omap_set_dma_priority'

Unverified Error/Warning (likely false positive, please contact us if interested):

Makefile:684: arch/h8300/Makefile: No such file or directory
arch/Kconfig:10: can't open file "arch/h8300/Kconfig"
arch/s390/include/asm/spinlock.h:81:3: error: unexpected token in '.rept' directive
arch/s390/include/asm/spinlock.h:81:3: error: unknown directive
arch/s390/include/asm/spinlock.h:81:3: error: unmatched '.endr' directive
arch/s390/lib/spinlock.c:78:3: error: unexpected token in '.rept' directive
arch/s390/lib/spinlock.c:78:3: error: unknown directive
arch/s390/lib/spinlock.c:78:3: error: unmatched '.endr' directive
crypto/sm3.c:246:1: internal compiler error: Segmentation fault
csky-linux-ld: mpfs-rng.c:(.text+0x10c): undefined reference to `mpfs_sys_controller_get'
csky-linux-ld: mpfs-rng.c:(.text+0x70): undefined reference to `mpfs_blocking_transaction'
drivers/base/topology.c:158:17: warning: Value stored to 'dev' during its initialization is never read [clang-analyzer-deadcode.DeadStores]
drivers/char/hw_random/mpfs-rng.c:49:23: error: implicit declaration of function 'mpfs_blocking_transaction' [-Werror=implicit-function-declaration]
drivers/char/hw_random/mpfs-rng.c:74:34: warning: assignment to 'struct mpfs_sys_controller *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
drivers/char/hw_random/mpfs-rng.c:74:37: error: implicit declaration of function 'mpfs_sys_controller_get' [-Werror=implicit-function-declaration]
drivers/dma-buf/st-dma-fence-unwrap.c:125:13: warning: variable 'err' set but not used [-Wunused-but-set-variable]
drivers/edac/edac_device.c:79 edac_device_alloc_ctl_info() warn: Please consider using kcalloc instead
drivers/edac/edac_mc.c:396:24: warning: Variable 'layer' is not assigned a value. [unassignedVariable]
drivers/hid/wacom_wac.c:2411:42: warning: format specifies type 'unsigned short' but the argument has type 'int' [-Wformat]
drivers/net/ethernet/mellanox/mlxsw/core_linecards.c:851:8: warning: Use of memory after it is freed [clang-analyzer-unix.Malloc]
drivers/net/wireless/ath/ath11k/peer.c:520 ath11k_peer_rhash_id_tbl_init() warn: missing error code 'ret'
drivers/net/wireless/ath/ath11k/peer.c:575 ath11k_peer_rhash_addr_tbl_init() warn: missing error code 'ret'
drivers/pinctrl/pinctrl-ingenic.c:162 is_soc_or_above() warn: bitwise AND condition is false here
fs/btrfs/ctree.c:1412:7: warning: Local variable 'unlock_up' shadows outer function [shadowFunction]
fs/btrfs/send.c:6857:13: warning: Either the condition '*level==0' is redundant or the array 'path->nodes[8]' is accessed at index -1, which is out of bounds. [negativeIndex]
fs/btrfs/send.c:6858:13: warning: Either the condition '*level==0' is redundant or the array 'path->slots[8]' is accessed at index -1, which is out of bounds. [negativeIndex]
kernel/bpf/core.c:1667:3: warning: Syntax Error: AST broken, binary operator '=' doesn't have two operands. [internalAstError]
kernel/bpf/syscall.c:4944:13: warning: no previous prototype for function 'unpriv_ebpf_notify' [-Wmissing-prototypes]
kernel/module/kallsyms.c:157:24: warning: Redundant assignment of 'mod->init_layout.size' to itself. [selfAssignment]
kernel/module/kallsyms.c:424:3: warning: Assignment of function parameter has no effect outside the function. [uselessAssignmentArg]
kernel/module/main.c:2113:26: warning: Redundant assignment of 'mod->core_layout.size' to itself. [selfAssignment]
kernel/module/main.c:2147:26: warning: Redundant assignment of 'mod->init_layout.size' to itself. [selfAssignment]
kernel/module/main.c:2189:4: warning: Null pointer passed as 1st argument to memory copy function [clang-analyzer-unix.cstring.NullArg]
kernel/module/main.c:2261:70: warning: Parameter 'debug' can be declared with const [constParameter]
kernel/module/main.c:357:20: warning: Local variable 'arr' shadows outer variable [shadowVariable]
kernel/module/main.c:924:9: warning: Call to function 'sprintf' is insecure as it does not provide bounding of the memory buffer or security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
lib/iov_iter.c:1837:61: warning: Parameter 'old' can be declared with const [constParameter]
lib/iov_iter.c:1884:6: warning: Redundant initialization for 'ret'. The initialized value is overwritten before it is read. [redundantInitialization]
lib/vsprintf.c:588:41: warning: Parameter 'end' can be declared with const [constParameter]
make[1]: *** No rule to make target 'arch/h8300/Makefile'.
mm/memory.c: linux/mm_inline.h is included more than once.
mm/sparse-vmemmap.c:740:17: warning: Value stored to 'next' during its initialization is never read [clang-analyzer-deadcode.DeadStores]
mpfs-rng.c:(.text+0x3c): undefined reference to `mpfs_blocking_transaction'
mpfs-rng.c:(.text+0x98): undefined reference to `mpfs_sys_controller_get'
net/ipv4/tcp_cong.c:430:32: warning: Division by zero [clang-analyzer-core.DivideZero]
{standard input}:1628: Error: operands mismatch -- statement `mulu.l 4(%a0),%d3:%d0' ignored
{standard input}:1628: Error: operands mismatch -- statement `mulu.l 8(%a0),%d2:%d4' ignored
{standard input}:2648: Error: operands mismatch -- statement `divu.l %d0,%d3:%d7' ignored
{standard input}:2677: Error: operands mismatch -- statement `mulu.l %d3,%d2:%d7' ignored

Error/Warning ids grouped by kconfigs:

gcc_recent_errors
|-- alpha-allmodconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- alpha-allyesconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- alpha-buildonly-randconfig-r004-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- alpha-randconfig-r033-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- arc-allmodconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- arc-allyesconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- arc-randconfig-p001-20220422
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- arc-randconfig-r043-20220424
|   |-- drivers-char-hw_random-mpfs-rng.c:error:implicit-declaration-of-function-mpfs_blocking_transaction
|   |-- drivers-char-hw_random-mpfs-rng.c:error:implicit-declaration-of-function-mpfs_sys_controller_get
|   `-- drivers-char-hw_random-mpfs-rng.c:warning:assignment-to-struct-mpfs_sys_controller-from-int-makes-pointer-from-integer-without-a-cast
|-- arc-randconfig-s031-20220421
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- arm-allmodconfig
|   |-- ERROR:omap_set_dma_priority-drivers-video-fbdev-omap-omapfb.ko-undefined
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- arm-allyesconfig
|   |-- arch-arm-mach-omap2-sram.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   |-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|   `-- omapfb_main.c:(.text):undefined-reference-to-omap_set_dma_priority
|-- arm-randconfig-c002-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- arm64-allmodconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- arm64-allyesconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- arm64-randconfig-c003-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- csky-allmodconfig
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- csky-allyesconfig
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- csky-randconfig-r003-20220424
|   |-- csky-linux-ld:mpfs-rng.c:(.text):undefined-reference-to-mpfs_blocking_transaction
|   |-- csky-linux-ld:mpfs-rng.c:(.text):undefined-reference-to-mpfs_sys_controller_get
|   |-- mpfs-rng.c:(.text):undefined-reference-to-mpfs_blocking_transaction
|   `-- mpfs-rng.c:(.text):undefined-reference-to-mpfs_sys_controller_get
|-- h8300-allmodconfig
|   |-- Makefile:arch-h8300-Makefile:No-such-file-or-directory
|   |-- arch-Kconfig:can-t-open-file-arch-h8300-Kconfig
|   `-- make:No-rule-to-make-target-arch-h8300-Makefile-.
|-- h8300-allyesconfig
|   |-- Makefile:arch-h8300-Makefile:No-such-file-or-directory
|   |-- arch-Kconfig:can-t-open-file-arch-h8300-Kconfig
|   `-- make:No-rule-to-make-target-arch-h8300-Makefile-.
|-- h8300-buildonly-randconfig-r006-20220421
|   |-- Makefile:arch-h8300-Makefile:No-such-file-or-directory
|   |-- arch-Kconfig:can-t-open-file-arch-h8300-Kconfig
|   `-- make:No-rule-to-make-target-arch-h8300-Makefile-.
|-- i386-allmodconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- i386-allyesconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- i386-randconfig-m021
|   `-- drivers-edac-edac_device.c-edac_device_alloc_ctl_info()-warn:Please-consider-using-kcalloc-instead
|-- i386-randconfig-s001
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- ia64-allmodconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- ia64-allyesconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- ia64-randconfig-r032-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- m68k-allmodconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- m68k-allyesconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- m68k-buildonly-randconfig-r005-20220422
|   |-- drivers-char-hw_random-mpfs-rng.c:error:implicit-declaration-of-function-mpfs_blocking_transaction
|   |-- drivers-char-hw_random-mpfs-rng.c:error:implicit-declaration-of-function-mpfs_sys_controller_get
|   |-- drivers-char-hw_random-mpfs-rng.c:warning:assignment-to-struct-mpfs_sys_controller-from-int-makes-pointer-from-integer-without-a-cast
|   |-- standard-input:Error:operands-mismatch-statement-divu.l-d0-d3:d7-ignored
|   |-- standard-input:Error:operands-mismatch-statement-mulu.l-(-a0)-d2:d4-ignored
|   |-- standard-input:Error:operands-mismatch-statement-mulu.l-(-a0)-d3:d0-ignored
|   `-- standard-input:Error:operands-mismatch-statement-mulu.l-d3-d2:d7-ignored
|-- m68k-randconfig-r011-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- m68k-randconfig-r013-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- m68k-randconfig-r026-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- microblaze-randconfig-p002-20220422
|   |-- fs-btrfs-ctree.c:warning:Local-variable-unlock_up-shadows-outer-function-shadowFunction
|   |-- fs-btrfs-send.c:warning:Either-the-condition-level-is-redundant-or-the-array-path-nodes-is-accessed-at-index-which-is-out-of-bounds.-negativeIndex
|   `-- fs-btrfs-send.c:warning:Either-the-condition-level-is-redundant-or-the-array-path-slots-is-accessed-at-index-which-is-out-of-bounds.-negativeIndex
|-- mips-allmodconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-mem-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- mips-allyesconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-mem-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- nios2-allmodconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- nios2-allyesconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- nios2-randconfig-r005-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- parisc-allmodconfig
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- parisc-allyesconfig
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- parisc-buildonly-randconfig-r004-20220422
|   |-- mpfs-rng.c:(.data.rel.ro):undefined-reference-to-mpfs_blocking_transaction
|   `-- mpfs-rng.c:(.data.rel.ro):undefined-reference-to-mpfs_sys_controller_get
|-- powerpc-allmodconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- powerpc-allyesconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- powerpc-buildonly-randconfig-r005-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- powerpc64-randconfig-p001-20220422
|   |-- drivers-edac-edac_mc.c:warning:Variable-layer-is-not-assigned-a-value.-unassignedVariable
|   |-- kernel-bpf-core.c:warning:Syntax-Error:AST-broken-binary-operator-doesn-t-have-two-operands.-internalAstError
|   |-- kernel-module-kallsyms.c:warning:Assignment-of-function-parameter-has-no-effect-outside-the-function.-uselessAssignmentArg
|   |-- kernel-module-kallsyms.c:warning:Redundant-assignment-of-mod-init_layout.size-to-itself.-selfAssignment
|   |-- kernel-module-main.c:warning:Local-variable-arr-shadows-outer-variable-shadowVariable
|   |-- kernel-module-main.c:warning:Parameter-debug-can-be-declared-with-const-constParameter
|   |-- kernel-module-main.c:warning:Redundant-assignment-of-mod-core_layout.size-to-itself.-selfAssignment
|   |-- kernel-module-main.c:warning:Redundant-assignment-of-mod-data_layout.size-to-itself.-selfAssignment
|   |-- kernel-module-main.c:warning:Redundant-assignment-of-mod-init_layout.size-to-itself.-selfAssignment
|   |-- lib-iov_iter.c:warning:Parameter-old-can-be-declared-with-const-constParameter
|   |-- lib-iov_iter.c:warning:Redundant-initialization-for-ret-.-The-initialized-value-is-overwritten-before-it-is-read.-redundantInitialization
|   `-- lib-vsprintf.c:warning:Parameter-end-can-be-declared-with-const-constParameter
|-- powerpc64-randconfig-r021-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- riscv-allmodconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- riscv-allyesconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- riscv-buildonly-randconfig-r001-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- riscv-buildonly-randconfig-r003-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- riscv-randconfig-r035-20220422
|   `-- crypto-sm3.c:internal-compiler-error:Segmentation-fault
|-- s390-allmodconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- s390-allyesconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- s390-randconfig-r025-20220421
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- sh-allmodconfig
|   |-- arch-sh-include-asm-io.h:error:expected-expression-before-do
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- sh-allyesconfig
|   |-- arch-sh-include-asm-io.h:error:expected-expression-before-do
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- sh-randconfig-c004-20220421
|   `-- arch-sh-include-asm-io.h:error:expected-expression-before-do
|-- sparc-allmodconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- sparc-allyesconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:cast-to-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-restricted-__le32
|   |-- drivers-soc-qcom-smem.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-smem_partition_header-phdr-got-void-noderef-__iomem-virt_base
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- um-i386_defconfig
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- um-x86_64_defconfig
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- x86_64-allmodconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- x86_64-allnoconfig
|   `-- mm-memory.c:linux-mm_inline.h-is-included-more-than-once.
|-- x86_64-allyesconfig
|   |-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- x86_64-randconfig-m001
|   `-- drivers-edac-edac_device.c-edac_device_alloc_ctl_info()-warn:Please-consider-using-kcalloc-instead
|-- x86_64-randconfig-m001-20220418
|   |-- drivers-net-wireless-ath-ath11k-peer.c-ath11k_peer_rhash_addr_tbl_init()-warn:missing-error-code-ret
|   `-- drivers-net-wireless-ath-ath11k-peer.c-ath11k_peer_rhash_id_tbl_init()-warn:missing-error-code-ret
|-- x86_64-randconfig-s021
|   `-- fs-io_uring.c:sparse:sparse:marked-inline-but-without-a-definition
|-- xtensa-allmodconfig
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- xtensa-allyesconfig
|   `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used
|-- xtensa-randconfig-m031-20220422
|   `-- drivers-pinctrl-pinctrl-ingenic.c-is_soc_or_above()-warn:bitwise-AND-condition-is-false-here
`-- xtensa-randconfig-r002-20220421
    `-- drivers-dma-buf-st-dma-fence-unwrap.c:warning:variable-err-set-but-not-used

clang_recent_errors
|-- arm-randconfig-c002-20220422
|   |-- drivers-usb-atm-cxacru.c:warning:Call-to-function-sprintf-is-insecure-as-it-does-not-provide-bounding-of-the-memory-buffer-or-security-checks-introduced-in-the-C11-standard.-Replace-with-analogous-fun
|   |-- drivers-usb-atm-usbatm.c:warning:Call-to-function-sprintf-is-insecure-as-it-does-not-provide-bounding-of-the-memory-buffer-or-security-checks-introduced-in-the-C11-standard.-Replace-with-analogous-fun
|   |-- drivers-usb-chipidea-core.c:warning:Call-to-function-sprintf-is-insecure-as-it-does-not-provide-bounding-of-the-memory-buffer-or-security-checks-introduced-in-the-C11-standard.-Replace-with-analogous-
|   |-- drivers-usb-gadget-udc-core.c:warning:Call-to-function-sprintf-is-insecure-as-it-does-not-provide-bounding-of-the-memory-buffer-or-security-checks-introduced-in-the-C11-standard.-Replace-with-analogou
|   |-- kernel-module-main.c:warning:Call-to-function-sprintf-is-insecure-as-it-does-not-provide-bounding-of-the-memory-buffer-or-security-checks-introduced-in-the-C11-standard.-Replace-with-analogous-functio
|   `-- kernel-module-main.c:warning:Null-pointer-passed-as-1st-argument-to-memory-copy-function-clang-analyzer-unix.cstring.NullArg
|-- arm-randconfig-r015-20220421
|   |-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|   `-- kernel-bpf-syscall.c:warning:no-previous-prototype-for-function-unpriv_ebpf_notify
|-- arm64-buildonly-randconfig-r002-20220421
|   `-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|-- arm64-randconfig-r021-20220422
|   |-- drivers-char-hw_random-mpfs-rng.c:error:call-to-undeclared-function-mpfs_blocking_transaction-ISO-C99-and-later-do-not-support-implicit-function-declarations
|   |-- drivers-char-hw_random-mpfs-rng.c:error:call-to-undeclared-function-mpfs_sys_controller_get-ISO-C99-and-later-do-not-support-implicit-function-declarations
|   `-- drivers-char-hw_random-mpfs-rng.c:warning:incompatible-integer-to-pointer-conversion-assigning-to-struct-mpfs_sys_controller-from-int
|-- arm64-randconfig-r035-20220421
|   |-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|   `-- kernel-bpf-syscall.c:warning:no-previous-prototype-for-function-unpriv_ebpf_notify
|-- hexagon-randconfig-r034-20220421
|   `-- kernel-bpf-syscall.c:warning:no-previous-prototype-for-function-unpriv_ebpf_notify
|-- hexagon-randconfig-r041-20220421
|   `-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|-- hexagon-randconfig-r045-20220421
|   `-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|-- hexagon-randconfig-r045-20220424
|   |-- drivers-char-hw_random-mpfs-rng.c:error:call-to-undeclared-function-mpfs_blocking_transaction-ISO-C99-and-later-do-not-support-implicit-function-declarations
|   |-- drivers-char-hw_random-mpfs-rng.c:error:call-to-undeclared-function-mpfs_sys_controller_get-ISO-C99-and-later-do-not-support-implicit-function-declarations
|   `-- drivers-char-hw_random-mpfs-rng.c:warning:incompatible-integer-to-pointer-conversion-assigning-to-struct-mpfs_sys_controller-from-int
|-- i386-randconfig-a002
|   `-- kernel-bpf-syscall.c:warning:no-previous-prototype-for-function-unpriv_ebpf_notify
|-- i386-randconfig-a004
|   `-- kernel-bpf-syscall.c:warning:no-previous-prototype-for-function-unpriv_ebpf_notify
|-- i386-randconfig-a011
|   |-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|   `-- kernel-bpf-syscall.c:warning:no-previous-prototype-for-function-unpriv_ebpf_notify
|-- i386-randconfig-a013
|   |-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|   `-- kernel-bpf-syscall.c:warning:no-previous-prototype-for-function-unpriv_ebpf_notify
|-- i386-randconfig-a015
|   |-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|   `-- kernel-bpf-syscall.c:warning:no-previous-prototype-for-function-unpriv_ebpf_notify
|-- i386-randconfig-c001
|   |-- drivers-base-topology.c:warning:Value-stored-to-dev-during-its-initialization-is-never-read-clang-analyzer-deadcode.DeadStores
|   |-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|   |-- kernel-bpf-syscall.c:warning:no-previous-prototype-for-function-unpriv_ebpf_notify
|   |-- kernel-module-main.c:warning:Call-to-function-sprintf-is-insecure-as-it-does-not-provide-bounding-of-the-memory-buffer-or-security-checks-introduced-in-the-C11-standard.-Replace-with-analogous-functio
|   |-- kernel-module-main.c:warning:Null-pointer-passed-as-1st-argument-to-memory-copy-function-clang-analyzer-unix.cstring.NullArg
|   `-- net-ipv4-tcp_cong.c:warning:Division-by-zero-clang-analyzer-core.DivideZero
|-- riscv-randconfig-c006-20220422
|   `-- kernel-bpf-syscall.c:warning:no-previous-prototype-for-function-unpriv_ebpf_notify
|-- riscv-randconfig-c006-20220424
|   `-- drivers-net-ethernet-mellanox-mlxsw-core_linecards.c:warning:Use-of-memory-after-it-is-freed-clang-analyzer-unix.Malloc
|-- riscv-randconfig-r004-20220421
|   `-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|-- riscv-randconfig-r026-20220420
|   `-- drivers-hid-wacom_wac.c:warning:format-specifies-type-unsigned-short-but-the-argument-has-type-int
|-- s390-alldefconfig
|   |-- arch-s390-include-asm-spinlock.h:error:unexpected-token-in-.rept-directive
|   |-- arch-s390-include-asm-spinlock.h:error:unknown-directive
|   |-- arch-s390-include-asm-spinlock.h:error:unmatched-.endr-directive
|   |-- arch-s390-lib-spinlock.c:error:unexpected-token-in-.rept-directive
|   |-- arch-s390-lib-spinlock.c:error:unknown-directive
|   `-- arch-s390-lib-spinlock.c:error:unmatched-.endr-directive
|-- s390-randconfig-c005-20220422
|   |-- arch-s390-include-asm-spinlock.h:error:unexpected-token-in-.rept-directive
|   |-- arch-s390-include-asm-spinlock.h:error:unknown-directive
|   |-- arch-s390-include-asm-spinlock.h:error:unmatched-.endr-directive
|   |-- arch-s390-lib-spinlock.c:error:unexpected-token-in-.rept-directive
|   |-- arch-s390-lib-spinlock.c:error:unknown-directive
|   `-- arch-s390-lib-spinlock.c:error:unmatched-.endr-directive
|-- s390-randconfig-r003-20220421
|   |-- arch-s390-include-asm-spinlock.h:error:unexpected-token-in-.rept-directive
|   |-- arch-s390-include-asm-spinlock.h:error:unknown-directive
|   |-- arch-s390-include-asm-spinlock.h:error:unmatched-.endr-directive
|   |-- arch-s390-lib-spinlock.c:error:unexpected-token-in-.rept-directive
|   |-- arch-s390-lib-spinlock.c:error:unknown-directive
|   |-- arch-s390-lib-spinlock.c:error:unmatched-.endr-directive
|   `-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|-- s390-randconfig-r006-20220421
|   |-- arch-s390-include-asm-spinlock.h:error:unexpected-token-in-.rept-directive
|   |-- arch-s390-include-asm-spinlock.h:error:unknown-directive
|   |-- arch-s390-include-asm-spinlock.h:error:unmatched-.endr-directive
|   |-- arch-s390-lib-spinlock.c:error:unexpected-token-in-.rept-directive
|   |-- arch-s390-lib-spinlock.c:error:unknown-directive
|   |-- arch-s390-lib-spinlock.c:error:unmatched-.endr-directive
|   `-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|-- x86_64-allyesconfig
|   `-- drivers-gpu-drm-solomon-ssd13-spi.c:warning:unused-variable-ssd13_spi_table
|-- x86_64-randconfig-a001
|   |-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|   `-- kernel-bpf-syscall.c:warning:no-previous-prototype-for-function-unpriv_ebpf_notify
|-- x86_64-randconfig-a005
|   `-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|-- x86_64-randconfig-a012
|   |-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|   `-- kernel-bpf-syscall.c:warning:no-previous-prototype-for-function-unpriv_ebpf_notify
|-- x86_64-randconfig-a014
|   `-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
|-- x86_64-randconfig-a016
|   `-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
`-- x86_64-randconfig-c007
    |-- drivers-bus-mhi-host-main.c:warning:parameter-event_quota-set-but-not-used
    |-- kernel-bpf-syscall.c:warning:no-previous-prototype-for-function-unpriv_ebpf_notify
    |-- kernel-module-main.c:warning:Call-to-function-sprintf-is-insecure-as-it-does-not-provide-bounding-of-the-memory-buffer-or-security-checks-introduced-in-the-C11-standard.-Replace-with-analogous-functio
    |-- kernel-module-main.c:warning:Null-pointer-passed-as-1st-argument-to-memory-copy-function-clang-analyzer-unix.cstring.NullArg
    |-- mm-sparse-vmemmap.c:warning:Value-stored-to-next-during-its-initialization-is-never-read-clang-analyzer-deadcode.DeadStores
    `-- net-ipv4-tcp_cong.c:warning:Division-by-zero-clang-analyzer-core.DivideZero

elapsed time: 5684m

configs tested: 130
configs skipped: 3

gcc tested configs:
arm                              allmodconfig
arm                              allyesconfig
arm                                 defconfig
arm64                               defconfig
arm64                            allyesconfig
ia64                             allmodconfig
i386                             allyesconfig
ia64                             allyesconfig
x86_64                           allyesconfig
mips                             allyesconfig
riscv                            allyesconfig
um                           x86_64_defconfig
riscv                            allmodconfig
um                             i386_defconfig
mips                             allmodconfig
powerpc                          allmodconfig
m68k                             allyesconfig
s390                             allmodconfig
s390                             allyesconfig
m68k                             allmodconfig
powerpc                          allyesconfig
i386                          randconfig-c001
sparc                            allyesconfig
parisc                           allyesconfig
sh                               allmodconfig
h8300                            allyesconfig
xtensa                           allyesconfig
arc                              allyesconfig
alpha                            allyesconfig
nios2                            allyesconfig
mips                 decstation_r4k_defconfig
powerpc                 mpc834x_mds_defconfig
ia64                            zx1_defconfig
mips                     decstation_defconfig
arm                          exynos_defconfig
arm                          simpad_defconfig
mips                            gpr_defconfig
m68k                        mvme147_defconfig
sh                           se7722_defconfig
sh                            hp6xx_defconfig
xtensa                    xip_kc705_defconfig
arm                          iop32x_defconfig
parisc64                            defconfig
sh                   rts7751r2dplus_defconfig
arm                        mini2440_defconfig
sparc                       sparc32_defconfig
powerpc                  storcenter_defconfig
arm                        keystone_defconfig
sh                           se7343_defconfig
powerpc                     sequoia_defconfig
arc                                 defconfig
xtensa                       common_defconfig
sh                            shmin_defconfig
sh                               alldefconfig
powerpc                      ppc6xx_defconfig
sh                     sh7710voipgw_defconfig
sh                          rsk7269_defconfig
sh                           se7750_defconfig
arm                  randconfig-c002-20220421
x86_64                        randconfig-c001
ia64                                defconfig
m68k                                defconfig
alpha                               defconfig
csky                                defconfig
nios2                               defconfig
parisc                              defconfig
s390                                defconfig
i386                   debian-10.3-kselftests
i386                              debian-10.3
i386                                defconfig
sparc                               defconfig
powerpc                           allnoconfig
i386                          randconfig-a001
i386                          randconfig-a003
i386                          randconfig-a005
x86_64                        randconfig-a013
x86_64                        randconfig-a011
x86_64                        randconfig-a015
i386                          randconfig-a014
i386                          randconfig-a012
i386                          randconfig-a016
x86_64                        randconfig-a004
x86_64                        randconfig-a002
x86_64                        randconfig-a006
arc                  randconfig-r043-20220421
riscv                randconfig-r042-20220421
s390                 randconfig-r044-20220421
riscv                    nommu_k210_defconfig
riscv                    nommu_virt_defconfig
riscv                             allnoconfig
riscv                          rv32_defconfig
riscv                               defconfig
x86_64                          rhel-8.3-func
x86_64                              defconfig
x86_64                                  kexec
x86_64                               rhel-8.3
x86_64                         rhel-8.3-kunit
x86_64                    rhel-8.3-kselftests

clang tested configs:
arm                  randconfig-c002-20220422
powerpc              randconfig-c003-20220422
s390                 randconfig-c005-20220422
mips                 randconfig-c004-20220422
x86_64                        randconfig-c007
i386                          randconfig-c001
riscv                randconfig-c006-20220422
s390                             alldefconfig
powerpc                      ppc64e_defconfig
mips                           rs90_defconfig
mips                        workpad_defconfig
arm                           spitz_defconfig
powerpc                 mpc8313_rdb_defconfig
powerpc                 mpc836x_mds_defconfig
powerpc                      obs600_defconfig
powerpc                        fsp2_defconfig
powerpc                     tqm8560_defconfig
hexagon                          alldefconfig
arm                     davinci_all_defconfig
i386                          randconfig-a002
i386                          randconfig-a006
i386                          randconfig-a004
x86_64                        randconfig-a016
x86_64                        randconfig-a012
x86_64                        randconfig-a014
i386                          randconfig-a013
i386                          randconfig-a011
i386                          randconfig-a015
x86_64                        randconfig-a005
x86_64                        randconfig-a001
x86_64                        randconfig-a003
hexagon              randconfig-r041-20220421
hexagon              randconfig-r045-20220421

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp

^ permalink raw reply

* [syzbot] WARNING: suspicious RCU usage in mac80211_hwsim_sta_rc_update
From: syzbot @ 2022-04-26  5:01 UTC (permalink / raw)
  To: davem, johannes, kuba, kvalo, linux-kernel, linux-wireless,
	netdev, pabeni, syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    59f0c2447e25 Merge tag 'net-5.18-rc4' of git://git.kernel...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=165262fcf00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=71bf5c8488a4e33a
dashboard link: https://syzkaller.appspot.com/bug?extid=efb5967310cacc5ac63e
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+efb5967310cacc5ac63e@syzkaller.appspotmail.com

wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
=============================
WARNING: suspicious RCU usage
5.18.0-rc3-syzkaller-00060-g59f0c2447e25 #0 Not tainted
-----------------------------
drivers/net/wireless/mac80211_hwsim.c:2206 suspicious rcu_dereference_check() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
4 locks held by kworker/u4:6/3738:
 #0: ffff8881488a1138 ((wq_completion)phy37){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff8881488a1138 ((wq_completion)phy37){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 #0: ffff8881488a1138 ((wq_completion)phy37){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1280 [inline]
 #0: ffff8881488a1138 ((wq_completion)phy37){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:636 [inline]
 #0: ffff8881488a1138 ((wq_completion)phy37){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:663 [inline]
 #0: ffff8881488a1138 ((wq_completion)phy37){+.+.}-{0:0}, at: process_one_work+0x87a/0x1610 kernel/workqueue.c:2260
 #1: ffffc90003fbfda8 ((work_completion)(&sdata->work)){+.+.}-{0:0}, at: process_one_work+0x8ae/0x1610 kernel/workqueue.c:2264
 #2: ffff888080bf0dc0 (&wdev->mtx){+.+.}-{3:3}, at: sdata_lock net/mac80211/ieee80211_i.h:1039 [inline]
 #2: ffff888080bf0dc0 (&wdev->mtx){+.+.}-{3:3}, at: ieee80211_ibss_rx_queued_mgmt+0x101/0x33b0 net/mac80211/ibss.c:1628
 #3: ffff8880430e9870 (&local->sta_mtx){+.+.}-{3:3}, at: sta_info_insert_rcu+0xc1/0x2b50 net/mac80211/sta_info.c:726

stack backtrace:
CPU: 0 PID: 3738 Comm: kworker/u4:6 Not tainted 5.18.0-rc3-syzkaller-00060-g59f0c2447e25 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy37 ieee80211_iface_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 mac80211_hwsim_sta_rc_update+0x2b8/0x430 drivers/net/wireless/mac80211_hwsim.c:2206
 mac80211_hwsim_sta_add+0xba/0x170 drivers/net/wireless/mac80211_hwsim.c:2224
 drv_sta_add net/mac80211/driver-ops.h:465 [inline]
 drv_sta_state+0x5cf/0x1520 net/mac80211/driver-ops.c:127
 sta_info_insert_drv_state net/mac80211/sta_info.c:575 [inline]
 sta_info_insert_finish net/mac80211/sta_info.c:679 [inline]
 sta_info_insert_rcu+0x14ab/0x2b50 net/mac80211/sta_info.c:736
 ieee80211_ibss_finish_sta+0x212/0x390 net/mac80211/ibss.c:585
 ieee80211_ibss_add_sta+0x405/0x740 net/mac80211/ibss.c:643
 ieee80211_update_sta_info net/mac80211/ibss.c:1027 [inline]
 ieee80211_rx_bss_info net/mac80211/ibss.c:1117 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1610 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x271d/0x33b0 net/mac80211/ibss.c:1639
 ieee80211_iface_process_skb net/mac80211/iface.c:1527 [inline]
 ieee80211_iface_work+0xa6f/0xd10 net/mac80211/iface.c:1581
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

^ permalink raw reply

* Re: [PATCH bpf-next] samples/bpf: detach xdp prog when program exits unexpectedly in xdp_rxq_info_user
From: Andrii Nakryiko @ 2022-04-26  4:35 UTC (permalink / raw)
  To: Zhengchao Shao
  Cc: bpf, Networking, open list, Alexei Starovoitov, Daniel Borkmann,
	David S. Miller, Jakub Kicinski, Jesper Dangaard Brouer,
	john fastabend, Andrii Nakryiko, Martin Lau, Song Liu,
	Yonghong Song, KP Singh, Wei Yongjun, YueHaibing
In-Reply-To: <20220421120925.330160-1-shaozhengchao@huawei.com>

On Thu, Apr 21, 2022 at 5:07 AM Zhengchao Shao <shaozhengchao@huawei.com> wrote:
>
> When xdp_rxq_info_user program exits unexpectedly, it doesn't detach xdp
> prog of device, and other xdp prog can't be attached to the device. So
> call init_exit() to detach xdp prog when program exits unexpectedly.
>
> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
> ---
>  samples/bpf/xdp_rxq_info_user.c | 21 +++++++++++++++------
>  1 file changed, 15 insertions(+), 6 deletions(-)
>

you are introducing a new compilation warning, please fix it


/data/users/andriin/linux/samples/bpf/xdp_rxq_info_user.c: In function
‘options2str’:
/data/users/andriin/linux/samples/bpf/xdp_rxq_info_user.c:153:1:
warning: control reaches end of non-void function [-Wreturn-type]
  153 | }
      | ^

It also would be good to instead use bpf_link-based XDP attachment
that would be auto-detached automatically on process crash
(bpf_link_create() FTW). Please consider also converting this sample
to skeleton (and then bpf_program__attach_xdp() as high-level
alternative to bpf_link_create()).

> diff --git a/samples/bpf/xdp_rxq_info_user.c b/samples/bpf/xdp_rxq_info_user.c
> index f2d90cba5164..6378007e085a 100644
> --- a/samples/bpf/xdp_rxq_info_user.c
> +++ b/samples/bpf/xdp_rxq_info_user.c
> @@ -18,7 +18,7 @@ static const char *__doc__ = " XDP RX-queue info extract example\n\n"
>  #include <getopt.h>
>  #include <net/if.h>
>  #include <time.h>

[...]

^ permalink raw reply

* Re: [EXTERNAL] Re: [PATCH v22 1/2] wireless: Initial driver submission for pureLiFi STA devices
From: Kalle Valo @ 2022-04-26  4:17 UTC (permalink / raw)
  To: Srinivasan Raju
  Cc: Mostafa Afgani, David S. Miller, Jakub Kicinski, open list,
	open list:NETWORKING DRIVERS (WIRELESS),
	open list:NETWORKING DRIVERS
In-Reply-To: <CWLP265MB32173F6188304F6B2CB90C79E0F89@CWLP265MB3217.GBRP265.PROD.OUTLOOK.COM>

Srinivasan Raju <srini.raju@purelifi.com> writes:

>> Unless I don't get any comments I'm planning to merge this on Wednesday.
>
> Thanks Kalle , I do not have any comments.

Please don't use HTML, our lists drop all HTML mail.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

^ permalink raw reply

* Re: [PATCH bpf-next v2 4/6] bpf, arm64: Impelment bpf_arch_text_poke() for arm64
From: Xu Kuohai @ 2022-04-26  4:01 UTC (permalink / raw)
  To: Jakub Sitnicki
  Cc: bpf, linux-arm-kernel, linux-kernel, netdev, linux-kselftest,
	Catalin Marinas, Will Deacon, Steven Rostedt, Ingo Molnar,
	Daniel Borkmann, Alexei Starovoitov, Zi Shen Lim, Andrii Nakryiko,
	Martin KaFai Lau, Song Liu, Yonghong Song, John Fastabend,
	KP Singh, David S . Miller, Hideaki YOSHIFUJI, David Ahern,
	Thomas Gleixner, Borislav Petkov, Dave Hansen, x86, hpa,
	Shuah Khan, Mark Rutland, Ard Biesheuvel, Pasha Tatashin,
	Peter Collingbourne, Daniel Kiss, Sudeep Holla, Steven Price,
	Marc Zyngier, Mark Brown, Kumar Kartikeya Dwivedi,
	Delyan Kratunov, kernel-team
In-Reply-To: <87pml56xsr.fsf@cloudflare.com>

On 4/25/2022 10:26 PM, Jakub Sitnicki wrote:
> On Sun, Apr 24, 2022 at 01:05 PM +08, Xu Kuohai wrote:
>> Thanks for your testing and suggestion! I added bpf2bpf poking to this
>> series and rebased it to [2] a few days ago, so there are some conflicts
>> with the bpf-next branch. I'll rebase it to bpf-next and send v3.
>>
>> [2] https://lore.kernel.org/bpf/20220416042940.656344-1-kuifeng@fb.com/
> 
> Looking forward to it.
> 
> I think it would be okay to post v3 saying that it depends on the
> "Attach a cookie to a tracing program" series and won't apply cleanly to
> bpf-next with out.
> 
> It would give us more time to review.
> .

Ah, already sent v3 based on bpf-next :(, will send an update after [2]
is merged.

^ permalink raw reply

* Re: [PATCH v2 net] net: Use this_cpu_inc() to increment net->core_stats
From: Eric Dumazet @ 2022-04-26  3:43 UTC (permalink / raw)
  To: Sebastian Andrzej Siewior
  Cc: Jakub Kicinski, netdev, David S. Miller, Paolo Abeni,
	Thomas Gleixner, Peter Zijlstra
In-Reply-To: <YmbO0pxgtKpCw4SY@linutronix.de>

On Mon, Apr 25, 2022 at 9:39 AM Sebastian Andrzej Siewior
<bigeasy@linutronix.de> wrote:
>
> The macro dev_core_stats_##FIELD##_inc() disables preemption and invokes
> netdev_core_stats_alloc() to return a per-CPU pointer.
> netdev_core_stats_alloc() will allocate memory on its first invocation
> which breaks on PREEMPT_RT because it requires non-atomic context for
> memory allocation.
>
> This can be avoided by enabling preemption in netdev_core_stats_alloc()
> assuming the caller always disables preemption.
>
> Use unsigned long as type for the counter. Use this_cpu_inc() to
> increment the counter. Use a plain read of the counter.
>
> Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> ---
> v1…v2:
>         - Add missing __percpu annotation as noticed by Jakub + robot
>         - Use READ_ONCE() in dev_get_stats() to avoid possible split
>           reads, noticed by Eric.
>

SGTM, thanks.

Note this will cause a merge conflict in net-next

Reviewed-by: Eric Dumazet <edumazet@google.com>

^ permalink raw reply

* Re: [PATCH v0] mctp: defer the kfree of object mdev->addrs
From: Jeremy Kerr @ 2022-04-26  3:30 UTC (permalink / raw)
  To: Lin Ma, matt, davem, kuba, pabeni, netdev, linux-kernel
In-Reply-To: <20220422114340.32346-1-linma@zju.edu.cn>

Hi Lin,

> The function mctp_unregister() reclaims the device's relevant resource
> when a netcard detaches. However, a running routine may be unaware of
> this and cause the use-after-free of the mdev->addrs object.

[...]

> To this end, just like the commit e04480920d1e ("Bluetooth: defer
> cleanup of resources in hci_unregister_dev()")  this patch defers the
> destructive kfree(mdev->addrs) in mctp_unregister to the mctp_dev_put,
> where the refcount of mdev is zero and the entire device is reclaimed.
> This prevents the use-after-free because the sendmsg thread holds the
> reference of mdev in the mctp_route object.

Looks good to me, thanks for checking this out.

We could also check out the semantics of ->addrs over a release (perhaps
we should clear addresses immediately with the write lock held?), but
that would be best done as a separate change.

So:

Acked-by: Jeremy Kerr <jk@codeconstruct.com.au>

Cheers,


Jeremy

^ permalink raw reply

* RE: [PATCH net-next v9 2/2] net: ethernet: Add driver for Sunplus SP7021
From: Wells Lu 呂芳騰 @ 2022-04-26  3:03 UTC (permalink / raw)
  To: Stephen Hemminger, Wells Lu
  Cc: davem@davemloft.net, kuba@kernel.org, robh+dt@kernel.org,
	netdev@vger.kernel.org, devicetree@vger.kernel.org,
	linux-kernel@vger.kernel.org, p.zabel@pengutronix.de,
	pabeni@redhat.com, krzk+dt@kernel.org, roopa@nvidia.com,
	andrew@lunn.ch, edumazet@google.com
In-Reply-To: <20220425093234.0ab232ff@hermes.local>

Hi Stephen,


> > +int spl2sw_rx_poll(struct napi_struct *napi, int budget) {
> > +	struct spl2sw_common *comm = container_of(napi, struct spl2sw_common, rx_napi);
> > +	struct spl2sw_mac_desc *desc, *h_desc;
> > +	struct net_device_stats *stats;
> > +	struct sk_buff *skb, *new_skb;
> > +	struct spl2sw_skb_info *sinfo;
> > +	int budget_left = budget;
> > +	u32 rx_pos, pkg_len;
> > +	u32 num, rx_count;
> > +	s32 queue;
> > +	u32 mask;
> > +	int port;
> > +	u32 cmd;
> > +
> > +	/* Process high-priority queue and then low-priority queue. */
> > +	for (queue = 0; queue < RX_DESC_QUEUE_NUM; queue++) {
> > +		rx_pos = comm->rx_pos[queue];
> > +		rx_count = comm->rx_desc_num[queue];
> > +
> > +		for (num = 0; num < rx_count && budget_left; num++) {
> > +			sinfo = comm->rx_skb_info[queue] + rx_pos;
> > +			desc = comm->rx_desc[queue] + rx_pos;
> > +			cmd = desc->cmd1;
> > +
> > +			if (cmd & RXD_OWN)
> > +				break;
> > +
> > +			port = FIELD_GET(RXD_PKT_SP, cmd);
> > +			if (port < MAX_NETDEV_NUM && comm->ndev[port])
> > +				stats = &comm->ndev[port]->stats;
> > +			else
> > +				goto spl2sw_rx_poll_rec_err;
> > +
> > +			pkg_len = FIELD_GET(RXD_PKT_LEN, cmd);
> > +			if (unlikely((cmd & RXD_ERR_CODE) || pkg_len < ETH_ZLEN + 4)) {
> > +				stats->rx_length_errors++;
> > +				stats->rx_dropped++;
> > +				goto spl2sw_rx_poll_rec_err;
> > +			}
> > +
> > +			dma_unmap_single(&comm->pdev->dev, sinfo->mapping,
> > +					 comm->rx_desc_buff_size, DMA_FROM_DEVICE);
> > +
> > +			skb = sinfo->skb;
> > +			skb_put(skb, pkg_len - 4); /* Minus FCS */
> > +			skb->ip_summed = CHECKSUM_NONE;
> > +			skb->protocol = eth_type_trans(skb, comm->ndev[port]);
> > +			netif_receive_skb(skb);
> > +
> > +			stats->rx_packets++;
> > +			stats->rx_bytes += skb->len;
> > +
> > +			/* Allocate a new skb for receiving. */
> > +			new_skb = netdev_alloc_skb(NULL, comm->rx_desc_buff_size);
> > +			if (unlikely(!new_skb)) {
> > +				desc->cmd2 = (rx_pos == comm->rx_desc_num[queue] - 1) ?
> > +					     RXD_EOR : 0;
> > +				sinfo->skb = NULL;
> > +				sinfo->mapping = 0;
> > +				desc->addr1 = 0;
> > +				goto spl2sw_rx_poll_alloc_err;
> > +			}
> > +
> > +			sinfo->mapping = dma_map_single(&comm->pdev->dev, new_skb->data,
> > +							comm->rx_desc_buff_size,
> > +							DMA_FROM_DEVICE);
> > +			if (dma_mapping_error(&comm->pdev->dev, sinfo->mapping)) {
> > +				dev_kfree_skb_irq(new_skb);
> > +				desc->cmd2 = (rx_pos == comm->rx_desc_num[queue] - 1) ?
> > +					     RXD_EOR : 0;
> > +				sinfo->skb = NULL;
> > +				sinfo->mapping = 0;
> > +				desc->addr1 = 0;
> > +				goto spl2sw_rx_poll_alloc_err;
> > +			}
> > +
> > +			sinfo->skb = new_skb;
> > +			desc->addr1 = sinfo->mapping;
> > +
> > +spl2sw_rx_poll_rec_err:
> > +			desc->cmd2 = (rx_pos == comm->rx_desc_num[queue] - 1) ?
> > +				     RXD_EOR | comm->rx_desc_buff_size :
> > +				     comm->rx_desc_buff_size;
> > +
> > +			wmb();	/* Set RXD_OWN after other fields are effective. */
> > +			desc->cmd1 = RXD_OWN;
> > +
> > +spl2sw_rx_poll_alloc_err:
> > +			/* Move rx_pos to next position */
> > +			rx_pos = ((rx_pos + 1) == comm->rx_desc_num[queue]) ? 0 : rx_pos +
> > +1;
> > +
> > +			budget_left--;
> > +
> > +			/* If there are packets in high-priority queue,
> > +			 * stop processing low-priority queue.
> > +			 */
> > +			if (queue == 1 && !(h_desc->cmd1 & RXD_OWN))
> > +				break;
> > +		}
> > +
> > +		comm->rx_pos[queue] = rx_pos;
> > +
> > +		/* Save pointer to last rx descriptor of high-priority queue. */
> > +		if (queue == 0)
> > +			h_desc = comm->rx_desc[queue] + rx_pos;
> > +	}
> > +
> > +	wmb();	/* make sure settings are effective. */
> > +	mask = readl(comm->l2sw_reg_base + L2SW_SW_INT_MASK_0);
> > +	mask &= ~MAC_INT_RX;
> > +	writel(mask, comm->l2sw_reg_base + L2SW_SW_INT_MASK_0);
> > +
> > +	napi_complete(napi);
> > +	return 0;
> > +}
> > +
> > +int spl2sw_tx_poll(struct napi_struct *napi, int budget) {
> > +	struct spl2sw_common *comm = container_of(napi, struct spl2sw_common, tx_napi);
> > +	struct spl2sw_skb_info *skbinfo;
> > +	struct net_device_stats *stats;
> > +	int budget_left = budget;
> > +	u32 tx_done_pos;
> > +	u32 mask;
> > +	u32 cmd;
> > +	int i;
> > +
> > +	spin_lock(&comm->tx_lock);
> > +
> > +	tx_done_pos = comm->tx_done_pos;
> > +	while (((tx_done_pos != comm->tx_pos) || (comm->tx_desc_full == 1)) && budget_left)
> {
> > +		cmd = comm->tx_desc[tx_done_pos].cmd1;
> > +		if (cmd & TXD_OWN)
> > +			break;
> > +
> > +		skbinfo = &comm->tx_temp_skb_info[tx_done_pos];
> > +		if (unlikely(!skbinfo->skb))
> > +			goto spl2sw_tx_poll_next;
> > +
> > +		i = ffs(FIELD_GET(TXD_VLAN, cmd)) - 1;
> > +		if (i < MAX_NETDEV_NUM && comm->ndev[i])
> > +			stats = &comm->ndev[i]->stats;
> > +		else
> > +			goto spl2sw_tx_poll_unmap;
> > +
> > +		if (unlikely(cmd & (TXD_ERR_CODE))) {
> > +			stats->tx_errors++;
> > +		} else {
> > +			stats->tx_packets++;
> > +			stats->tx_bytes += skbinfo->len;
> > +		}
> > +
> > +spl2sw_tx_poll_unmap:
> > +		dma_unmap_single(&comm->pdev->dev, skbinfo->mapping, skbinfo->len,
> > +				 DMA_TO_DEVICE);
> > +		skbinfo->mapping = 0;
> > +		dev_kfree_skb_irq(skbinfo->skb);
> > +		skbinfo->skb = NULL;
> > +
> > +spl2sw_tx_poll_next:
> > +		/* Move tx_done_pos to next position */
> > +		tx_done_pos = ((tx_done_pos + 1) == TX_DESC_NUM) ? 0 : tx_done_pos
> > ++ 1;
> > +
> > +		if (comm->tx_desc_full == 1)
> > +			comm->tx_desc_full = 0;
> > +
> > +		budget_left--;
> > +	}
> > +
> > +	comm->tx_done_pos = tx_done_pos;
> > +	if (!comm->tx_desc_full)
> > +		for (i = 0; i < MAX_NETDEV_NUM; i++)
> > +			if (comm->ndev[i])
> > +				if (netif_queue_stopped(comm->ndev[i]))
> > +					netif_wake_queue(comm->ndev[i]);
> > +
> > +	spin_unlock(&comm->tx_lock);
> > +
> > +	wmb();			/* make sure settings are effective. */
> > +	mask = readl(comm->l2sw_reg_base + L2SW_SW_INT_MASK_0);
> > +	mask &= ~MAC_INT_TX;
> > +	writel(mask, comm->l2sw_reg_base + L2SW_SW_INT_MASK_0);
> > +
> > +	napi_complete(napi);
> > +	return 0;
> > +}
> 
> This doesn't look like it is doing NAPI properly.
> 
> The driver is supposed to return the amount of packets processed.
> If budget is used, it should return budget.

I'll modify code to return the amount of processed packets:

	return budge - budget_left;


Thank you for your review.


Best regards,
Wells

^ permalink raw reply

* Re: [PATCH net-next v1 1/4] net: phy: broadcom: Add PTP support for some Broadcom PHYs.
From: Richard Cochran @ 2022-04-26  3:02 UTC (permalink / raw)
  To: Jonathan Lemon
  Cc: f.fainelli, bcm-kernel-feedback-list, andrew, hkallweit1, linux,
	netdev, kernel-team
In-Reply-To: <20220426024915.GA22745@hoboy.vegasvil.org>

On Mon, Apr 25, 2022 at 07:49:15PM -0700, Richard Cochran wrote:
> On Mon, Apr 25, 2022 at 04:30:43PM -0700, Jonathan Lemon wrote:

> > The BCM chip inserts a 64-bit sec.nsec RX timestamp immediately after
> > the PTP header.  So I'm recovering it here.  I'll also update the patch
> > to memmove() the tail of the skb up in order to remove it, just in case
> > it makes a difference.
> 
> Okay, this is something different.  This won't work because that
> corrupts the PTP message format.

Wait, I see, you want to copy the back of the frame data over the time
stamp.  That makes sense, and it avoids clobbering the reserved1 field
(which aquired a meaning in 1588 v2.1)

Thanks,
Richard

^ permalink raw reply

* Re: [PATCH net-next v1 1/4] net: phy: broadcom: Add PTP support for some Broadcom PHYs.
From: Richard Cochran @ 2022-04-26  2:53 UTC (permalink / raw)
  To: Jonathan Lemon
  Cc: f.fainelli, bcm-kernel-feedback-list, andrew, hkallweit1, linux,
	netdev, kernel-team
In-Reply-To: <20220425235540.vuacu26xb6bzpxob@bsd-mbp.dhcp.thefacebook.com>

On Mon, Apr 25, 2022 at 04:55:40PM -0700, Jonathan Lemon wrote:

> We could just have a chip-specific version of this function.  The
> recovered timestamp is passed back in a structure, so the rest of the
> code would be unchanged.

Yeah, but it means that I'll have to check each and every bit of every
register to see what other random changes are there...

> Jonathan    (no, not volunteering to do this...)

For now, just get your chip merged, and then the next chip's driver
will refactor/reuse as needed.

Thanks,
Richard

^ permalink raw reply


This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox