* Re: [syzbot] KASAN: slab-out-of-bounds Write in copy_array
From: syzbot @ 2022-12-20 19:53 UTC (permalink / raw)
To: sdf
Cc: andrii, ast, bpf, daniel, davem, haoluo, hawk, john.fastabend,
jolsa, kpsingh, kuba, linux-kernel, llvm, martin.lau, nathan,
ndesaulniers, netdev, sdf, song, syzkaller-bugs, trix, yhs
In-Reply-To: <Y6ISmUxKqXP6VpLS@google.com>
> On 11/28, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: c35bd4e42885 Add linux-next specific files for 20221124
>> git tree: linux-next
>> console+strace: https://syzkaller.appspot.com/x/log.txt?x=13369dc5880000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=11e19c740a0b2926
>> dashboard link: https://syzkaller.appspot.com/bug?extid=b1e1f7feb407b56d0355
>> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1345a205880000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124c644b880000
>>
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/968fee464d14/disk-c35bd4e4.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/4f46fe801b5b/vmlinux-c35bd4e4.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/c2cdf8fb264e/bzImage-c35bd4e4.xz
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+b1e1f7feb407b56d0355@syzkaller.appspotmail.com
>>
>> ==================================================================
>> BUG: KASAN: slab-out-of-bounds in copy_array+0x96/0x100 kernel/bpf/verifier.c:1032
>> Write of size 232 at addr ffff88801ed62600 by task syz-executor990/5290
>>
>> CPU: 0 PID: 5290 Comm: syz-executor990 Not tainted 6.1.0-rc6-next-20221124-syzkaller #0
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
>> Call Trace:
>> <TASK>
>> __dump_stack lib/dump_stack.c:88 [inline]
>> dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
>> print_address_description mm/kasan/report.c:253 [inline]
>> print_report+0x15e/0x45d mm/kasan/report.c:364
>> kasan_report+0xbf/0x1f0 mm/kasan/report.c:464
>> check_region_inline mm/kasan/generic.c:183 [inline]
>> kasan_check_range+0x141/0x190 mm/kasan/generic.c:189
>> memcpy+0x3d/0x60 mm/kasan/shadow.c:66
>> copy_array+0x96/0x100 kernel/bpf/verifier.c:1032
>> copy_verifier_state+0xa9/0xbe0 kernel/bpf/verifier.c:1210
>> pop_stack+0x8c/0x2f0 kernel/bpf/verifier.c:1273
>> do_check kernel/bpf/verifier.c:13733 [inline]
>> do_check_common+0x372b/0xc5e0 kernel/bpf/verifier.c:15991
>> do_check_main kernel/bpf/verifier.c:16054 [inline]
>> bpf_check+0x7371/0xad00 kernel/bpf/verifier.c:16624
>> bpf_prog_load+0x1543/0x2230 kernel/bpf/syscall.c:2619
>> __sys_bpf+0x1436/0x4ff0 kernel/bpf/syscall.c:4979
>> __do_sys_bpf kernel/bpf/syscall.c:5083 [inline]
>> __se_sys_bpf kernel/bpf/syscall.c:5081 [inline]
>> __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5081
>> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>> do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
>> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>> RIP: 0033:0x7fc18e7bbc29
>> Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
>> RSP: 002b:00007ffd8f27a968 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
>> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc18e7bbc29
>> RDX: 0000000000000048 RSI: 0000000020000200 RDI: 0000000000000005
>> RBP: 00007fc18e77fdd0 R08: 0000000000000000 R09: 0000000000000000
>> R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fc18e77fe60
>> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
>> </TASK>
>>
>> Allocated by task 5290:
>> kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
>> kasan_set_track+0x25/0x30 mm/kasan/common.c:52
>> ____kasan_kmalloc mm/kasan/common.c:376 [inline]
>> ____kasan_kmalloc mm/kasan/common.c:335 [inline]
>> __kasan_krealloc+0x145/0x180 mm/kasan/common.c:444
>> kasan_krealloc include/linux/kasan.h:232 [inline]
>> __do_krealloc mm/slab_common.c:1348 [inline]
>> krealloc+0xa8/0x100 mm/slab_common.c:1385
>> push_jmp_history+0x89/0x260 kernel/bpf/verifier.c:2528
>> is_state_visited kernel/bpf/verifier.c:13269 [inline]
>> do_check kernel/bpf/verifier.c:13466 [inline]
>> do_check_common+0x4b47/0xc5e0 kernel/bpf/verifier.c:15991
>> do_check_main kernel/bpf/verifier.c:16054 [inline]
>> bpf_check+0x7371/0xad00 kernel/bpf/verifier.c:16624
>> bpf_prog_load+0x1543/0x2230 kernel/bpf/syscall.c:2619
>> __sys_bpf+0x1436/0x4ff0 kernel/bpf/syscall.c:4979
>> __do_sys_bpf kernel/bpf/syscall.c:5083 [inline]
>> __se_sys_bpf kernel/bpf/syscall.c:5081 [inline]
>> __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5081
>> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>> do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
>> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>>
>> The buggy address belongs to the object at ffff88801ed62600
>> which belongs to the cache kmalloc-256 of size 256
>> The buggy address is located 0 bytes inside of
>> 256-byte region [ffff88801ed62600, ffff88801ed62700)
>>
>> The buggy address belongs to the physical page:
>> page:ffffea00007b5880 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ed62
>> head:ffffea00007b5880 order:1 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0
>> flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
>> raw: 00fff00000010200 ffff888012441b40 ffffea0000809f80 dead000000000002
>> raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
>> page dumped because: kasan: bad access detected
>> page_owner tracks the page as allocated
>> page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 56, tgid 56 (kworker/u4:4), ts 7761288109, free_ts 0
>> prep_new_page mm/page_alloc.c:2541 [inline]
>> get_page_from_freelist+0x119c/0x2cd0 mm/page_alloc.c:4293
>> __alloc_pages+0x1cb/0x5b0 mm/page_alloc.c:5551
>> alloc_pages+0x1aa/0x270 mm/mempolicy.c:2285
>> alloc_slab_page mm/slub.c:1833 [inline]
>> allocate_slab+0x25e/0x350 mm/slub.c:1980
>> new_slab mm/slub.c:2033 [inline]
>> ___slab_alloc+0xa91/0x1400 mm/slub.c:3211
>> __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3310
>> slab_alloc_node mm/slub.c:3395 [inline]
>> __kmem_cache_alloc_node+0x1a9/0x430 mm/slub.c:3472
>> kmalloc_trace+0x26/0x60 mm/slab_common.c:1049
>> kmalloc include/linux/slab.h:571 [inline]
>> scsi_probe_and_add_lun+0x3ae/0x34d0 drivers/scsi/scsi_scan.c:1186
>> __scsi_scan_target+0x21f/0xda0 drivers/scsi/scsi_scan.c:1664
>> scsi_scan_channel drivers/scsi/scsi_scan.c:1752 [inline]
>> scsi_scan_channel+0x148/0x1e0 drivers/scsi/scsi_scan.c:1728
>> scsi_scan_host_selected+0x2e3/0x3b0 drivers/scsi/scsi_scan.c:1781
>> do_scsi_scan_host+0x1e8/0x260 drivers/scsi/scsi_scan.c:1920
>> do_scan_async+0x42/0x500 drivers/scsi/scsi_scan.c:1930
>> async_run_entry_fn+0x9c/0x530 kernel/async.c:127
>> process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
>> page_owner free stack trace missing
>>
>> Memory state around the buggy address:
>> ffff88801ed62500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> ffff88801ed62580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> >ffff88801ed62600: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
>> ^
>> ffff88801ed62680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> ffff88801ed62700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> ==================================================================
>>
>>
>> ---
>> This report is generated by a bot. It may contain errors.
>> See https://goo.gl/tpsmEJ for more information about syzbot.
>> syzbot engineers can be reached at syzkaller@googlegroups.com.
>>
>> syzbot will keep track of this issue. See:
>> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>> syzbot can test patches for this issue, for details see:
>> https://goo.gl/tpsmEJ#testing-patches
>
> #syz test
want 2 args (repo, branch), got 1
^ permalink raw reply
* Re: [syzbot] KASAN: slab-out-of-bounds Write in copy_array
From: sdf @ 2022-12-20 19:52 UTC (permalink / raw)
To: syzbot
Cc: andrii, ast, bpf, daniel, davem, haoluo, hawk, john.fastabend,
jolsa, kpsingh, kuba, linux-kernel, llvm, martin.lau, nathan,
ndesaulniers, netdev, song, syzkaller-bugs, trix, yhs
In-Reply-To: <000000000000ab724705ee87e321@google.com>
[-- Attachment #1: Type: text/plain, Size: 7705 bytes --]
On 11/28, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: c35bd4e42885 Add linux-next specific files for 20221124
> git tree: linux-next
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=13369dc5880000
> kernel config: https://syzkaller.appspot.com/x/.config?x=11e19c740a0b2926
> dashboard link: https://syzkaller.appspot.com/bug?extid=b1e1f7feb407b56d0355
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1345a205880000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124c644b880000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/968fee464d14/disk-c35bd4e4.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/4f46fe801b5b/vmlinux-c35bd4e4.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/c2cdf8fb264e/bzImage-c35bd4e4.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b1e1f7feb407b56d0355@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in copy_array+0x96/0x100 kernel/bpf/verifier.c:1032
> Write of size 232 at addr ffff88801ed62600 by task syz-executor990/5290
>
> CPU: 0 PID: 5290 Comm: syz-executor990 Not tainted 6.1.0-rc6-next-20221124-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
> print_address_description mm/kasan/report.c:253 [inline]
> print_report+0x15e/0x45d mm/kasan/report.c:364
> kasan_report+0xbf/0x1f0 mm/kasan/report.c:464
> check_region_inline mm/kasan/generic.c:183 [inline]
> kasan_check_range+0x141/0x190 mm/kasan/generic.c:189
> memcpy+0x3d/0x60 mm/kasan/shadow.c:66
> copy_array+0x96/0x100 kernel/bpf/verifier.c:1032
> copy_verifier_state+0xa9/0xbe0 kernel/bpf/verifier.c:1210
> pop_stack+0x8c/0x2f0 kernel/bpf/verifier.c:1273
> do_check kernel/bpf/verifier.c:13733 [inline]
> do_check_common+0x372b/0xc5e0 kernel/bpf/verifier.c:15991
> do_check_main kernel/bpf/verifier.c:16054 [inline]
> bpf_check+0x7371/0xad00 kernel/bpf/verifier.c:16624
> bpf_prog_load+0x1543/0x2230 kernel/bpf/syscall.c:2619
> __sys_bpf+0x1436/0x4ff0 kernel/bpf/syscall.c:4979
> __do_sys_bpf kernel/bpf/syscall.c:5083 [inline]
> __se_sys_bpf kernel/bpf/syscall.c:5081 [inline]
> __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5081
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> RIP: 0033:0x7fc18e7bbc29
> Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffd8f27a968 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc18e7bbc29
> RDX: 0000000000000048 RSI: 0000000020000200 RDI: 0000000000000005
> RBP: 00007fc18e77fdd0 R08: 0000000000000000 R09: 0000000000000000
> R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fc18e77fe60
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> </TASK>
>
> Allocated by task 5290:
> kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
> kasan_set_track+0x25/0x30 mm/kasan/common.c:52
> ____kasan_kmalloc mm/kasan/common.c:376 [inline]
> ____kasan_kmalloc mm/kasan/common.c:335 [inline]
> __kasan_krealloc+0x145/0x180 mm/kasan/common.c:444
> kasan_krealloc include/linux/kasan.h:232 [inline]
> __do_krealloc mm/slab_common.c:1348 [inline]
> krealloc+0xa8/0x100 mm/slab_common.c:1385
> push_jmp_history+0x89/0x260 kernel/bpf/verifier.c:2528
> is_state_visited kernel/bpf/verifier.c:13269 [inline]
> do_check kernel/bpf/verifier.c:13466 [inline]
> do_check_common+0x4b47/0xc5e0 kernel/bpf/verifier.c:15991
> do_check_main kernel/bpf/verifier.c:16054 [inline]
> bpf_check+0x7371/0xad00 kernel/bpf/verifier.c:16624
> bpf_prog_load+0x1543/0x2230 kernel/bpf/syscall.c:2619
> __sys_bpf+0x1436/0x4ff0 kernel/bpf/syscall.c:4979
> __do_sys_bpf kernel/bpf/syscall.c:5083 [inline]
> __se_sys_bpf kernel/bpf/syscall.c:5081 [inline]
> __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5081
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> The buggy address belongs to the object at ffff88801ed62600
> which belongs to the cache kmalloc-256 of size 256
> The buggy address is located 0 bytes inside of
> 256-byte region [ffff88801ed62600, ffff88801ed62700)
>
> The buggy address belongs to the physical page:
> page:ffffea00007b5880 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ed62
> head:ffffea00007b5880 order:1 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0
> flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
> raw: 00fff00000010200 ffff888012441b40 ffffea0000809f80 dead000000000002
> raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
> page dumped because: kasan: bad access detected
> page_owner tracks the page as allocated
> page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 56, tgid 56 (kworker/u4:4), ts 7761288109, free_ts 0
> prep_new_page mm/page_alloc.c:2541 [inline]
> get_page_from_freelist+0x119c/0x2cd0 mm/page_alloc.c:4293
> __alloc_pages+0x1cb/0x5b0 mm/page_alloc.c:5551
> alloc_pages+0x1aa/0x270 mm/mempolicy.c:2285
> alloc_slab_page mm/slub.c:1833 [inline]
> allocate_slab+0x25e/0x350 mm/slub.c:1980
> new_slab mm/slub.c:2033 [inline]
> ___slab_alloc+0xa91/0x1400 mm/slub.c:3211
> __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3310
> slab_alloc_node mm/slub.c:3395 [inline]
> __kmem_cache_alloc_node+0x1a9/0x430 mm/slub.c:3472
> kmalloc_trace+0x26/0x60 mm/slab_common.c:1049
> kmalloc include/linux/slab.h:571 [inline]
> scsi_probe_and_add_lun+0x3ae/0x34d0 drivers/scsi/scsi_scan.c:1186
> __scsi_scan_target+0x21f/0xda0 drivers/scsi/scsi_scan.c:1664
> scsi_scan_channel drivers/scsi/scsi_scan.c:1752 [inline]
> scsi_scan_channel+0x148/0x1e0 drivers/scsi/scsi_scan.c:1728
> scsi_scan_host_selected+0x2e3/0x3b0 drivers/scsi/scsi_scan.c:1781
> do_scsi_scan_host+0x1e8/0x260 drivers/scsi/scsi_scan.c:1920
> do_scan_async+0x42/0x500 drivers/scsi/scsi_scan.c:1930
> async_run_entry_fn+0x9c/0x530 kernel/async.c:127
> process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
> page_owner free stack trace missing
>
> Memory state around the buggy address:
> ffff88801ed62500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff88801ed62580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> >ffff88801ed62600: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
> ^
> ffff88801ed62680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff88801ed62700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ==================================================================
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> syzbot can test patches for this issue, for details see:
> https://goo.gl/tpsmEJ#testing-patches
#syz test
[-- Attachment #2: syz.patch --]
[-- Type: text/x-diff, Size: 3676 bytes --]
commit 589aa8077dcf413b06c78c6d8095496c98720c25
Author: Stanislav Fomichev <sdf@google.com>
AuthorDate: Tue Dec 20 11:51:17 2022 -0800
Commit: Stanislav Fomichev <sdf@google.com>
CommitDate: Tue Dec 20 11:51:17 2022 -0800
Revert "mm: Make ksize() a reporting-only function"
This reverts commit 38931d8989b5760b0bd17c9ec99e81986258e4cb.
diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c
index 73684642c42d..0d59098f0876 100644
--- a/mm/kasan/kasan_test.c
+++ b/mm/kasan/kasan_test.c
@@ -783,30 +783,23 @@ static void kasan_global_oob_left(struct kunit *test)
KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
}
-/* Check that ksize() does NOT unpoison whole object. */
+/* Check that ksize() makes the whole object accessible. */
static void ksize_unpoisons_memory(struct kunit *test)
{
char *ptr;
- size_t size = 128 - KASAN_GRANULE_SIZE - 5;
- size_t real_size;
+ size_t size = 123, real_size;
ptr = kmalloc(size, GFP_KERNEL);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
-
real_size = ksize(ptr);
- KUNIT_EXPECT_GT(test, real_size, size);
OPTIMIZER_HIDE_VAR(ptr);
- /* These accesses shouldn't trigger a KASAN report. */
- ptr[0] = 'x';
- ptr[size - 1] = 'x';
+ /* This access shouldn't trigger a KASAN report. */
+ ptr[size] = 'x';
- /* These must trigger a KASAN report. */
- if (IS_ENABLED(CONFIG_KASAN_GENERIC))
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]);
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size + 5]);
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[real_size - 1]);
+ /* This one must. */
+ KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[real_size]);
kfree(ptr);
}
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 7e96abf1bd7d..33b1886b06eb 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -1333,11 +1333,11 @@ __do_krealloc(const void *p, size_t new_size, gfp_t flags)
void *ret;
size_t ks;
- /* Check for double-free before calling ksize. */
+ /* Don't use instrumented ksize to allow precise KASAN poisoning. */
if (likely(!ZERO_OR_NULL_PTR(p))) {
if (!kasan_check_byte(p))
return NULL;
- ks = ksize(p);
+ ks = kfence_ksize(p) ?: __ksize(p);
} else
ks = 0;
@@ -1405,10 +1405,8 @@ void kfree_sensitive(const void *p)
void *mem = (void *)p;
ks = ksize(mem);
- if (ks) {
- kasan_unpoison_range(mem, ks);
+ if (ks)
memzero_explicit(mem, ks);
- }
kfree(mem);
}
EXPORT_SYMBOL(kfree_sensitive);
@@ -1429,11 +1427,13 @@ EXPORT_SYMBOL(kfree_sensitive);
*/
size_t ksize(const void *objp)
{
+ size_t size;
+
/*
- * We need to first check that the pointer to the object is valid.
- * The KASAN report printed from ksize() is more useful, then when
- * it's printed later when the behaviour could be undefined due to
- * a potential use-after-free or double-free.
+ * We need to first check that the pointer to the object is valid, and
+ * only then unpoison the memory. The report printed from ksize() is
+ * more useful, then when it's printed later when the behaviour could
+ * be undefined due to a potential use-after-free or double-free.
*
* We use kasan_check_byte(), which is supported for the hardware
* tag-based KASAN mode, unlike kasan_check_read/write().
@@ -1447,7 +1447,13 @@ size_t ksize(const void *objp)
if (unlikely(ZERO_OR_NULL_PTR(objp)) || !kasan_check_byte(objp))
return 0;
- return kfence_ksize(objp) ?: __ksize(objp);
+ size = kfence_ksize(objp) ?: __ksize(objp);
+ /*
+ * We assume that ksize callers could use whole allocated area,
+ * so we need to unpoison this area.
+ */
+ kasan_unpoison_range(objp, size);
+ return size;
}
EXPORT_SYMBOL(ksize);
^ permalink raw reply related
* [PATCH net 2/2] mptcp: fix lockdep false positive
From: Mat Martineau @ 2022-12-20 19:52 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, davem, kuba, edumazet, imagedong, mptcp,
Matthieu Baerts, Mat Martineau
In-Reply-To: <20221220195215.238353-1-mathew.j.martineau@linux.intel.com>
From: Paolo Abeni <pabeni@redhat.com>
MattB reported a lockdep splat in the mptcp listener code cleanup:
WARNING: possible circular locking dependency detected
packetdrill/14278 is trying to acquire lock:
ffff888017d868f0 ((work_completion)(&msk->work)){+.+.}-{0:0}, at: __flush_work (kernel/workqueue.c:3069)
but task is already holding lock:
ffff888017d84130 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close (net/mptcp/protocol.c:2973)
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (sk_lock-AF_INET){+.+.}-{0:0}:
__lock_acquire (kernel/locking/lockdep.c:5055)
lock_acquire (kernel/locking/lockdep.c:466)
lock_sock_nested (net/core/sock.c:3463)
mptcp_worker (net/mptcp/protocol.c:2614)
process_one_work (kernel/workqueue.c:2294)
worker_thread (include/linux/list.h:292)
kthread (kernel/kthread.c:376)
ret_from_fork (arch/x86/entry/entry_64.S:312)
-> #0 ((work_completion)(&msk->work)){+.+.}-{0:0}:
check_prev_add (kernel/locking/lockdep.c:3098)
validate_chain (kernel/locking/lockdep.c:3217)
__lock_acquire (kernel/locking/lockdep.c:5055)
lock_acquire (kernel/locking/lockdep.c:466)
__flush_work (kernel/workqueue.c:3070)
__cancel_work_timer (kernel/workqueue.c:3160)
mptcp_cancel_work (net/mptcp/protocol.c:2758)
mptcp_subflow_queue_clean (net/mptcp/subflow.c:1817)
__mptcp_close_ssk (net/mptcp/protocol.c:2363)
mptcp_destroy_common (net/mptcp/protocol.c:3170)
mptcp_destroy (include/net/sock.h:1495)
__mptcp_destroy_sock (net/mptcp/protocol.c:2886)
__mptcp_close (net/mptcp/protocol.c:2959)
mptcp_close (net/mptcp/protocol.c:2974)
inet_release (net/ipv4/af_inet.c:432)
__sock_release (net/socket.c:651)
sock_close (net/socket.c:1367)
__fput (fs/file_table.c:320)
task_work_run (kernel/task_work.c:181 (discriminator 1))
exit_to_user_mode_prepare (include/linux/resume_user_mode.h:49)
syscall_exit_to_user_mode (kernel/entry/common.c:130)
do_syscall_64 (arch/x86/entry/common.c:87)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(sk_lock-AF_INET);
lock((work_completion)(&msk->work));
lock(sk_lock-AF_INET);
lock((work_completion)(&msk->work));
*** DEADLOCK ***
The report is actually a false positive, since the only existing lock
nesting is the msk socket lock acquired by the mptcp work.
cancel_work_sync() is invoked without the relevant socket lock being
held, but under a different (the msk listener) socket lock.
We could silence the splat adding a per workqueue dynamic lockdep key,
but that looks overkill. Instead just tell lockdep the msk socket lock
is not held around cancel_work_sync().
--
v1 -> v2:
- fix a few typos (MatM)
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/322
Fixes: 30e51b923e43 ("mptcp: fix unreleased socket in accept queue")
Reported-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
---
net/mptcp/protocol.c | 2 +-
net/mptcp/protocol.h | 2 +-
net/mptcp/subflow.c | 19 +++++++++++++++++--
3 files changed, 19 insertions(+), 4 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 907b435e2984..b7ad030dfe89 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2357,7 +2357,7 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,
/* otherwise tcp will dispose of the ssk and subflow ctx */
if (ssk->sk_state == TCP_LISTEN) {
tcp_set_state(ssk, TCP_CLOSE);
- mptcp_subflow_queue_clean(ssk);
+ mptcp_subflow_queue_clean(sk, ssk);
inet_csk_listen_stop(ssk);
mptcp_event_pm_listener(ssk, MPTCP_EVENT_LISTENER_CLOSED);
}
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index f47d3e4018b5..a0d1658ce59e 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -628,7 +628,7 @@ void mptcp_close_ssk(struct sock *sk, struct sock *ssk,
struct mptcp_subflow_context *subflow);
void __mptcp_subflow_send_ack(struct sock *ssk);
void mptcp_subflow_reset(struct sock *ssk);
-void mptcp_subflow_queue_clean(struct sock *ssk);
+void mptcp_subflow_queue_clean(struct sock *sk, struct sock *ssk);
void mptcp_sock_graft(struct sock *sk, struct socket *parent);
struct socket *__mptcp_nmpc_socket(const struct mptcp_sock *msk);
bool __mptcp_close(struct sock *sk, long timeout);
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index d1d32a66ae3f..bd387d4b5a38 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -1791,7 +1791,7 @@ static void subflow_state_change(struct sock *sk)
}
}
-void mptcp_subflow_queue_clean(struct sock *listener_ssk)
+void mptcp_subflow_queue_clean(struct sock *listener_sk, struct sock *listener_ssk)
{
struct request_sock_queue *queue = &inet_csk(listener_ssk)->icsk_accept_queue;
struct mptcp_sock *msk, *next, *head = NULL;
@@ -1840,8 +1840,23 @@ void mptcp_subflow_queue_clean(struct sock *listener_ssk)
do_cancel_work = __mptcp_close(sk, 0);
release_sock(sk);
- if (do_cancel_work)
+ if (do_cancel_work) {
+ /* lockdep will report a false positive ABBA deadlock
+ * between cancel_work_sync and the listener socket.
+ * The involved locks belong to different sockets WRT
+ * the existing AB chain.
+ * Using a per socket key is problematic as key
+ * deregistration requires process context and must be
+ * performed at socket disposal time, in atomic
+ * context.
+ * Just tell lockdep to consider the listener socket
+ * released here.
+ */
+ mutex_release(&listener_sk->sk_lock.dep_map, _RET_IP_);
mptcp_cancel_work(sk);
+ mutex_acquire(&listener_sk->sk_lock.dep_map,
+ SINGLE_DEPTH_NESTING, 0, _RET_IP_);
+ }
sock_put(sk);
}
--
2.39.0
^ permalink raw reply related
* [PATCH net 1/2] mptcp: fix deadlock in fastopen error path
From: Mat Martineau @ 2022-12-20 19:52 UTC (permalink / raw)
To: netdev; +Cc: Paolo Abeni, davem, kuba, edumazet, imagedong, mptcp,
Mat Martineau
In-Reply-To: <20221220195215.238353-1-mathew.j.martineau@linux.intel.com>
From: Paolo Abeni <pabeni@redhat.com>
MatM reported a deadlock at fastopening time:
INFO: task syz-executor.0:11454 blocked for more than 143 seconds.
Tainted: G S 6.1.0-rc5-03226-gdb0157db5153 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0 state:D stack:25104 pid:11454 ppid:424 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5191 [inline]
__schedule+0x5c2/0x1550 kernel/sched/core.c:6503
schedule+0xe8/0x1c0 kernel/sched/core.c:6579
__lock_sock+0x142/0x260 net/core/sock.c:2896
lock_sock_nested+0xdb/0x100 net/core/sock.c:3466
__mptcp_close_ssk+0x1a3/0x790 net/mptcp/protocol.c:2328
mptcp_destroy_common+0x16a/0x650 net/mptcp/protocol.c:3171
mptcp_disconnect+0xb8/0x450 net/mptcp/protocol.c:3019
__inet_stream_connect+0x897/0xa40 net/ipv4/af_inet.c:720
tcp_sendmsg_fastopen+0x3dd/0x740 net/ipv4/tcp.c:1200
mptcp_sendmsg_fastopen net/mptcp/protocol.c:1682 [inline]
mptcp_sendmsg+0x128a/0x1a50 net/mptcp/protocol.c:1721
inet6_sendmsg+0x11f/0x150 net/ipv6/af_inet6.c:663
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xf7/0x190 net/socket.c:734
____sys_sendmsg+0x336/0x970 net/socket.c:2476
___sys_sendmsg+0x122/0x1c0 net/socket.c:2530
__sys_sendmmsg+0x18d/0x460 net/socket.c:2616
__do_sys_sendmmsg net/socket.c:2645 [inline]
__se_sys_sendmmsg net/socket.c:2642 [inline]
__x64_sys_sendmmsg+0x9d/0x110 net/socket.c:2642
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5920a75e7d
RSP: 002b:00007f59201e8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007f5920bb4f80 RCX: 00007f5920a75e7d
RDX: 0000000000000001 RSI: 0000000020002940 RDI: 0000000000000005
RBP: 00007f5920ae7593 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020004050 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f5920bb4f80 R15: 00007f59201c8000
</TASK>
In the error path, tcp_sendmsg_fastopen() ends-up calling
mptcp_disconnect(), and the latter tries to close each
subflow, acquiring the socket lock on each of them.
At fastopen time, we have a single subflow, and such subflow
socket lock is already held by the called, causing the deadlock.
We already track the 'fastopen in progress' status inside the msk
socket. Use it to address the issue, making mptcp_disconnect() a
no op when invoked from the fastopen (error) path and doing the
relevant cleanup after releasing the subflow socket lock.
While at the above, rename the fastopen status bit to something
more meaningful.
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/321
Fixes: fa9e57468aa1 ("mptcp: fix abba deadlock on fastopen")
Reported-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
---
net/mptcp/protocol.c | 18 +++++++++++++++---
net/mptcp/protocol.h | 2 +-
2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index f6f93957275b..907b435e2984 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -1662,6 +1662,8 @@ static void mptcp_set_nospace(struct sock *sk)
set_bit(MPTCP_NOSPACE, &mptcp_sk(sk)->flags);
}
+static int mptcp_disconnect(struct sock *sk, int flags);
+
static int mptcp_sendmsg_fastopen(struct sock *sk, struct sock *ssk, struct msghdr *msg,
size_t len, int *copied_syn)
{
@@ -1672,9 +1674,9 @@ static int mptcp_sendmsg_fastopen(struct sock *sk, struct sock *ssk, struct msgh
lock_sock(ssk);
msg->msg_flags |= MSG_DONTWAIT;
msk->connect_flags = O_NONBLOCK;
- msk->is_sendmsg = 1;
+ msk->fastopening = 1;
ret = tcp_sendmsg_fastopen(ssk, msg, copied_syn, len, NULL);
- msk->is_sendmsg = 0;
+ msk->fastopening = 0;
msg->msg_flags = saved_flags;
release_sock(ssk);
@@ -1688,6 +1690,8 @@ static int mptcp_sendmsg_fastopen(struct sock *sk, struct sock *ssk, struct msgh
*/
if (ret && ret != -EINPROGRESS && ret != -ERESTARTSYS && ret != -EINTR)
*copied_syn = 0;
+ } else if (ret && ret != -EINPROGRESS) {
+ mptcp_disconnect(sk, 0);
}
return ret;
@@ -2989,6 +2993,14 @@ static int mptcp_disconnect(struct sock *sk, int flags)
{
struct mptcp_sock *msk = mptcp_sk(sk);
+ /* We are on the fastopen error path. We can't call straight into the
+ * subflows cleanup code due to lock nesting (we are already under
+ * msk->firstsocket lock). Do nothing and leave the cleanup to the
+ * caller.
+ */
+ if (msk->fastopening)
+ return 0;
+
inet_sk_state_store(sk, TCP_CLOSE);
mptcp_stop_timer(sk);
@@ -3532,7 +3544,7 @@ static int mptcp_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
/* if reaching here via the fastopen/sendmsg path, the caller already
* acquired the subflow socket lock, too.
*/
- if (msk->is_sendmsg)
+ if (msk->fastopening)
err = __inet_stream_connect(ssock, uaddr, addr_len, msk->connect_flags, 1);
else
err = inet_stream_connect(ssock, uaddr, addr_len, msk->connect_flags);
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 955fb3d88eb3..f47d3e4018b5 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -295,7 +295,7 @@ struct mptcp_sock {
u8 recvmsg_inq:1,
cork:1,
nodelay:1,
- is_sendmsg:1;
+ fastopening:1;
int connect_flags;
struct work_struct work;
struct sk_buff *ooo_last_skb;
--
2.39.0
^ permalink raw reply related
* [PATCH net 0/2] mptcp: Locking fixes
From: Mat Martineau @ 2022-12-20 19:52 UTC (permalink / raw)
To: netdev; +Cc: Mat Martineau, davem, kuba, pabeni, edumazet, imagedong, mptcp
Two separate locking fixes for the networking tree:
Patch 1 addresses a MPTCP fastopen error-path deadlock that was found
with syzkaller.
Patch 2 works around a lockdep false-positive between MPTCP listening and
non-listening sockets at socket destruct time.
Paolo Abeni (2):
mptcp: fix deadlock in fastopen error path
mptcp: fix lockdep false positive
net/mptcp/protocol.c | 20 ++++++++++++++++----
net/mptcp/protocol.h | 4 ++--
net/mptcp/subflow.c | 19 +++++++++++++++++--
3 files changed, 35 insertions(+), 8 deletions(-)
base-commit: 4be84df38a6f49b81e5909ede78242ba1538c1e6
--
2.39.0
^ permalink raw reply
* Re: [PATCH v2] octeontx2_pf: Select NET_DEVLINK when enabling OCTEONTX2_PF
From: Paul Gazzillo @ 2022-12-20 19:49 UTC (permalink / raw)
To: Jakub Kicinski
Cc: David S. Miller, Eric Dumazet, Paolo Abeni, Yang Yingliang,
Zheng Bin, Suman Ghosh, Sunil Goutham, Subbaraya Sundeep, netdev,
linux-kernel
In-Reply-To: <20221220113822.4efe142e@kernel.org>
On 12/20/2022, Jakub Kicinski wrote:
> On Mon, 19 Dec 2022 12:19:11 -0500 Paul Gazzillo wrote:
> > When using COMPILE_TEST, the driver controlled by OCTEONTX2_PF does
> > not select NET_DEVLINK while the related OCTEONTX2_AF driver does.
> > This means that when OCTEONTX2_PF is enabled from a default
> > configuration, linker errors will occur due to undefined references to
> > code controlled by NET_DEVLINK.
>
> This has been fixed a long time ago by 9cbc3367968d ("octeontx2-pf:
> select CONFIG_NET_DEVLINK") no?
You are right. My apologies. I was looking at an older kernel.
^ permalink raw reply
* RE: [PATCH v3 1/3] net: phy: add EXPORT_SYMBOL to phy_disable_interrupts()
From: Woojung.Huh @ 2022-12-20 19:43 UTC (permalink / raw)
To: andrew, enguerrand.de-ribaucourt
Cc: hkallweit1, netdev, pabeni, davem, UNGLinuxDriver, linux
In-Reply-To: <Y6Ho5rIlRHYPePEo@lunn.ch>
Hi Andrew,
Let me check with our team.
Best regards,
Woojung
> -----Original Message-----
> From: Andrew Lunn <andrew@lunn.ch>
> Sent: Tuesday, December 20, 2022 11:55 AM
> To: Enguerrand de Ribaucourt <enguerrand.de-
> ribaucourt@savoirfairelinux.com>
> Cc: Heiner Kallweit <hkallweit1@gmail.com>; netdev
> <netdev@vger.kernel.org>; Paolo Abeni <pabeni@redhat.com>; Woojung
> Huh - C21699 <Woojung.Huh@microchip.com>; davem
> <davem@davemloft.net>; UNGLinuxDriver
> <UNGLinuxDriver@microchip.com>; Russell King - ARM Linux
> <linux@armlinux.org.uk>
> Subject: Re: [PATCH v3 1/3] net: phy: add EXPORT_SYMBOL to
> phy_disable_interrupts()
>
> EXTERNAL EMAIL: Do not click links or open attachments unless you know the
> content is safe
>
> On Tue, Dec 20, 2022 at 10:48:25AM -0500, Enguerrand de Ribaucourt wrote:
> > > From: "Heiner Kallweit" <hkallweit1@gmail.com>
> > > To: "Enguerrand de Ribaucourt" <enguerrand.de-
> ribaucourt@savoirfairelinux.com>
> > > Cc: "netdev" <netdev@vger.kernel.org>, "Paolo Abeni"
> <pabeni@redhat.com>, "woojung huh" <woojung.huh@microchip.com>,
> > > "davem" <davem@davemloft.net>, "UNGLinuxDriver"
> <UNGLinuxDriver@microchip.com>, "Andrew Lunn" <andrew@lunn.ch>,
> > > "Russell King - ARM Linux" <linux@armlinux.org.uk>
> > > Sent: Tuesday, December 20, 2022 4:19:40 PM
> > > Subject: Re: [PATCH v3 1/3] net: phy: add EXPORT_SYMBOL to
> phy_disable_interrupts()
> > My proposed approach would be to copy the original workaround actions
> > within link_change_notify():
> > 1. disable interrupts
> > 2. reset speed
> > 3. enable interrupts
> >
> > However, I don't have access to the LAN8835 to test if this would work. I
> also
> > don't have knowledge about which other Microchip PHYs could be
> impacted. Maybe
> > there is an active Microchip developer we could communicate with to find
> out?
>
> Woojung Huh added this code, and he sometimes contributes here.
>
> Woojung, do you still have access to the hardware?
>
> Andrew
^ permalink raw reply
* Re: [PATCH] treewide: Convert del_timer*() to timer_shutdown*()
From: Pavel Machek @ 2022-12-20 19:39 UTC (permalink / raw)
To: Steven Rostedt
Cc: Linus Torvalds, Thomas Gleixner, LKML, Stephen Boyd,
Guenter Roeck, Anna-Maria Gleixner, Andrew Morton, Julia Lawall,
linux-sh, cgroups, linux-block, linux-acpi, linux-atm-general,
netdev, drbd-dev, linux-bluetooth, intel-gfx, dri-devel,
linux-input, linux-leds, linux-media, intel-wired-lan, linux-usb,
linux-wireless, brcm80211-dev-list.pdl, SHA-cyfmac-dev-list,
linux-scsi, linux-staging, linux-ext4, linux-nilfs, bridge,
netfilter-devel, coreteam, lvs-devel, linux-nfs, tipc-discussion,
alsa-devel
In-Reply-To: <20221220134519.3dd1318b@gandalf.local.home>
[-- Attachment #1: Type: text/plain, Size: 1545 bytes --]
On Tue 2022-12-20 13:45:19, Steven Rostedt wrote:
> [
> Linus,
>
> I ran the script against your latest master branch:
> commit b6bb9676f2165d518b35ba3bea5f1fcfc0d969bf
>
> As the timer_shutdown*() code is now in your tree, I figured
> we can start doing the conversions. At least add the trivial ones
> now as Thomas suggested that this gets applied at the end of the
> merge window, to avoid conflicts with linux-next during the
> development cycle. I can wait to Friday to run it again, and
> resubmit.
>
> What is the best way to handle this?
> ]
>
> From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
>
> Due to several bugs caused by timers being re-armed after they are
> shutdown and just before they are freed, a new state of timers was added
> called "shutdown". After a timer is set to this state, then it can no
> longer be re-armed.
>
> The following script was run to find all the trivial locations where
> del_timer() or del_timer_sync() is called in the same function that the
> object holding the timer is freed. It also ignores any locations where the
> timer->function is modified between the del_timer*() and the free(), as
> that is not considered a "trivial" case.
>
> This was created by using a coccinelle script and the following
commands:
LED parts looks good to me.
Getting it in just before -rc1 would be best solution for me.
Best regards,
Pavel
--
People of Russia, stop Putin before his war on Ukraine escalates.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply
* Re: [PATCH v2] octeontx2_pf: Select NET_DEVLINK when enabling OCTEONTX2_PF
From: Jakub Kicinski @ 2022-12-20 19:38 UTC (permalink / raw)
To: Paul Gazzillo
Cc: David S. Miller, Eric Dumazet, Paolo Abeni, Randy Dunlap,
Yang Yingliang, Zheng Bin, Suman Ghosh, Sunil Goutham,
Subbaraya Sundeep, netdev, linux-kernel
In-Reply-To: <20221219171918.834772-1-paul@pgazz.com>
On Mon, 19 Dec 2022 12:19:11 -0500 Paul Gazzillo wrote:
> When using COMPILE_TEST, the driver controlled by OCTEONTX2_PF does
> not select NET_DEVLINK while the related OCTEONTX2_AF driver does.
> This means that when OCTEONTX2_PF is enabled from a default
> configuration, linker errors will occur due to undefined references to
> code controlled by NET_DEVLINK.
This has been fixed a long time ago by 9cbc3367968d ("octeontx2-pf:
select CONFIG_NET_DEVLINK") no?
^ permalink raw reply
* Re: [syzbot] KASAN: use-after-free Read in put_pmu_ctx
From: syzbot @ 2022-12-20 19:37 UTC (permalink / raw)
To: acme, alexander.shishkin, bpf, jolsa, linux-kernel,
linux-perf-users, mark.rutland, mingo, namhyung, netdev, peterz,
sdf, syzkaller-bugs
In-Reply-To: <CAKH8qBs1UiikX=_CBzRC_2rg3sp8CU5hhB7sOkNkNBqm8OqFEw@mail.gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: rcu detected stall in corrupted
rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { P5778 } 2673 jiffies s: 2773 root: 0x0/T
rcu: blocking rcu_node structures (internal RCU debug):
Tested on:
commit: 13e3c779 Merge tag 'for-netdev' of https://git.kernel...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
console output: https://syzkaller.appspot.com/x/log.txt?x=12cb0e5d880000
kernel config: https://syzkaller.appspot.com/x/.config?x=b0e91ad4b5f69c47
dashboard link: https://syzkaller.appspot.com/bug?extid=b8e8c01c8ade4fe6e48f
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=12df6a9b880000
^ permalink raw reply
* Re: [PATCH V2 net] net: fec: Coverity issue: Dereference null return value
From: Jakub Kicinski @ 2022-12-20 19:36 UTC (permalink / raw)
To: wei.fang
Cc: davem, edumazet, pabeni, xiaoning.wang, shenwei.wang,
alexander.duyck, linux-imx, netdev, linux-kernel
In-Reply-To: <20221219022755.1047573-1-wei.fang@nxp.com>
On Mon, 19 Dec 2022 10:27:55 +0800 wei.fang@nxp.com wrote:
> From: Wei Fang <wei.fang@nxp.com>
>
> The build_skb might return a null pointer but there is no check on the
> return value in the fec_enet_rx_queue(). So a null pointer dereference
> might occur. To avoid this, we check the return value of build_skb. If
> the return value is a null pointer, the driver will recycle the page and
> update the statistic of ndev. Then jump to rx_processing_done to clear
> the status flags of the BD so that the hardware can recycle the BD.
Applied but I had to change the subject because the subject should
describe the change. Mentioning the tool which found the problem
belongs in the body of the message.
^ permalink raw reply
* Re: [syzbot] kernel BUG in rxrpc_put_peer
From: syzbot @ 2022-12-20 19:15 UTC (permalink / raw)
To: davem, dhowells, edumazet, kuba, linux-afs, linux-kernel,
marc.dionne, netdev, pabeni, syzkaller-bugs
In-Reply-To: <1924955.1671552163@warthog.procyon.org.uk>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: rcu detected stall in corrupted
rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { P5782 } 2677 jiffies s: 2821 root: 0x0/T
rcu: blocking rcu_node structures (internal RCU debug):
Tested on:
commit: 2bc80899 rxrpc: Fix a couple of potential use-after-fr..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/
console output: https://syzkaller.appspot.com/x/log.txt?x=12729378480000
kernel config: https://syzkaller.appspot.com/x/.config?x=b0e91ad4b5f69c47
dashboard link: https://syzkaller.appspot.com/bug?extid=c22650d2844392afdcfd
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
^ permalink raw reply
* [PATCH] veth: Fix race with AF_XDP exposing old or uninitialized descriptors
From: Shawn Bohrer @ 2022-12-20 18:59 UTC (permalink / raw)
To: magnus.karlsson; +Cc: netdev, bpf, bjorn, kernel-team, davem, Shawn Bohrer
In-Reply-To: <Y5pO+XL54ZlzZ7Qe@sbohrer-cf-dell>
When AF_XDP is used on on a veth interface the RX ring is updated in two
steps. veth_xdp_rcv() removes packet descriptors from the FILL ring
fills them and places them in the RX ring updating the cached_prod
pointer. Later xdp_do_flush() syncs the RX ring prod pointer with the
cached_prod pointer allowing user-space to see the recently filled in
descriptors. The rings are intended to be SPSC, however the existing
order in veth_poll allows the xdp_do_flush() to run concurrently with
another CPU creating a race condition that allows user-space to see old
or uninitialized descriptors in the RX ring. This bug has been observed
in production systems.
To summarize, we are expecting this ordering:
CPU 0 __xsk_rcv_zc()
CPU 0 __xsk_map_flush()
CPU 2 __xsk_rcv_zc()
CPU 2 __xsk_map_flush()
But we are seeing this order:
CPU 0 __xsk_rcv_zc()
CPU 2 __xsk_rcv_zc()
CPU 0 __xsk_map_flush()
CPU 2 __xsk_map_flush()
This occurs because we rely on NAPI to ensure that only one napi_poll
handler is running at a time for the given veth receive queue.
napi_schedule_prep() will prevent multiple instances from getting
scheduled. However calling napi_complete_done() signals that this
napi_poll is complete and allows subsequent calls to
napi_schedule_prep() and __napi_schedule() to succeed in scheduling a
concurrent napi_poll before the xdp_do_flush() has been called. For the
veth driver a concurrent call to napi_schedule_prep() and
__napi_schedule() can occur on a different CPU because the veth xmit
path can additionally schedule a napi_poll creating the race.
The fix as suggested by Magnus Karlsson, is to simply move the
xdp_do_flush() call before napi_complete_done(). This syncs the
producer ring pointers before another instance of napi_poll can be
scheduled on another CPU. It will also slightly improve performance by
moving the flush closer to when the descriptors were placed in the
RX ring.
Fixes: d1396004dd86 ("veth: Add XDP TX and REDIRECT")
Suggested-by: Magnus Karlsson <magnus.karlsson@gmail.com>
Signed-off-by: Shawn Bohrer <sbohrer@cloudflare.com>
---
drivers/net/veth.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index ac7c0653695f..dfc7d87fad59 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -974,6 +974,9 @@ static int veth_poll(struct napi_struct *napi, int budget)
xdp_set_return_frame_no_direct();
done = veth_xdp_rcv(rq, budget, &bq, &stats);
+ if (stats.xdp_redirect > 0)
+ xdp_do_flush();
+
if (done < budget && napi_complete_done(napi, done)) {
/* Write rx_notify_masked before reading ptr_ring */
smp_store_mb(rq->rx_notify_masked, false);
@@ -987,8 +990,6 @@ static int veth_poll(struct napi_struct *napi, int budget)
if (stats.xdp_tx > 0)
veth_xdp_flush(rq, &bq);
- if (stats.xdp_redirect > 0)
- xdp_do_flush();
xdp_clear_return_frame_no_direct();
return done;
--
2.38.1
^ permalink raw reply related
* Re: [PATCH net] net: vrf: determine the dst using the original ifindex for multicast
From: David Ahern @ 2022-12-20 18:58 UTC (permalink / raw)
To: Antoine Tenart, davem, kuba, pabeni, edumazet; +Cc: netdev, Jianlin Shi
In-Reply-To: <20221220171825.1172237-1-atenart@kernel.org>
On 12/20/22 10:18 AM, Antoine Tenart wrote:
> Multicast packets received on an interface bound to a VRF are marked as
> belonging to the VRF and the skb device is updated to point to the VRF
> device itself. This was fine even when a route was associated to a
> device as when performing a fib table lookup 'oif' in fib6_table_lookup
> (coming from 'skb->dev->ifindex' in ip6_route_input) was set to 0 when
> FLOWI_FLAG_SKIP_NH_OIF was set.
>
> With commit 40867d74c374 ("net: Add l3mdev index to flow struct and
> avoid oif reset for port devices") this is not longer true and multicast
> traffic is not received on the original interface.
>
> Instead of adding back a similar check in fib6_table_lookup determine
> the dst using the original ifindex for multicast VRF traffic. To make
> things consistent across the function do the above for all strict
> packets, which was the logic before commit 6f12fa775530 ("vrf: mark skb
> for multicast or link-local as enslaved to VRF"). Note that reverting to
> this behavior should be fine as the change was about marking packets
> belonging to the VRF, not about their dst.
>
> Fixes: 40867d74c374 ("net: Add l3mdev index to flow struct and avoid oif reset for port devices")
> Cc: David Ahern <dsahern@kernel.org>
> Reported-by: Jianlin Shi <jishi@redhat.com>
> Signed-off-by: Antoine Tenart <atenart@kernel.org>
> ---
> drivers/net/vrf.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
Reviewed-by: David Ahern <dsahern@kernel.org>
^ permalink raw reply
* [PATCH] treewide: Convert del_timer*() to timer_shutdown*()
From: Steven Rostedt @ 2022-12-20 18:45 UTC (permalink / raw)
To: Linus Torvalds, Thomas Gleixner
Cc: LKML, Stephen Boyd, Guenter Roeck, Anna-Maria Gleixner,
Andrew Morton, Julia Lawall, linux-sh, cgroups, linux-block,
linux-acpi, linux-atm-general, netdev, drbd-dev, linux-bluetooth,
intel-gfx, dri-devel, linux-input, linux-leds, linux-media,
intel-wired-lan, linux-usb, linux-wireless,
brcm80211-dev-list.pdl, SHA-cyfmac-dev-list, linux-scsi,
linux-staging, linux-ext4, linux-nilfs, bridge, netfilter-devel,
coreteam, lvs-devel, linux-nfs, tipc-discussion, alsa-devel
[
Linus,
I ran the script against your latest master branch:
commit b6bb9676f2165d518b35ba3bea5f1fcfc0d969bf
As the timer_shutdown*() code is now in your tree, I figured
we can start doing the conversions. At least add the trivial ones
now as Thomas suggested that this gets applied at the end of the
merge window, to avoid conflicts with linux-next during the
development cycle. I can wait to Friday to run it again, and
resubmit.
What is the best way to handle this?
]
From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
Due to several bugs caused by timers being re-armed after they are
shutdown and just before they are freed, a new state of timers was added
called "shutdown". After a timer is set to this state, then it can no
longer be re-armed.
The following script was run to find all the trivial locations where
del_timer() or del_timer_sync() is called in the same function that the
object holding the timer is freed. It also ignores any locations where the
timer->function is modified between the del_timer*() and the free(), as
that is not considered a "trivial" case.
This was created by using a coccinelle script and the following commands:
$ cat timer.cocci
@@
expression ptr, slab;
identifier timer, rfield;
@@
(
- del_timer(&ptr->timer);
+ timer_shutdown(&ptr->timer);
|
- del_timer_sync(&ptr->timer);
+ timer_shutdown_sync(&ptr->timer);
)
... when strict
when != ptr->timer
(
kfree_rcu(ptr, rfield);
|
kmem_cache_free(slab, ptr);
|
kfree(ptr);
)
$ spatch timer.cocci . > /tmp/t.patch
$ patch -p1 < /tmp/t.patch
Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
---
arch/sh/drivers/push-switch.c | 2 +-
block/blk-iocost.c | 2 +-
block/blk-iolatency.c | 2 +-
block/kyber-iosched.c | 2 +-
drivers/acpi/apei/ghes.c | 2 +-
drivers/atm/idt77252.c | 6 +++---
drivers/block/drbd/drbd_main.c | 2 +-
drivers/block/loop.c | 2 +-
drivers/bluetooth/hci_bcsp.c | 2 +-
drivers/gpu/drm/i915/i915_sw_fence.c | 2 +-
drivers/hid/hid-wiimote-core.c | 2 +-
drivers/input/keyboard/locomokbd.c | 2 +-
drivers/input/keyboard/omap-keypad.c | 2 +-
drivers/input/mouse/alps.c | 2 +-
drivers/isdn/mISDN/l1oip_core.c | 4 ++--
drivers/isdn/mISDN/timerdev.c | 4 ++--
drivers/leds/trigger/ledtrig-activity.c | 2 +-
drivers/leds/trigger/ledtrig-heartbeat.c | 2 +-
drivers/leds/trigger/ledtrig-pattern.c | 2 +-
drivers/leds/trigger/ledtrig-transient.c | 2 +-
drivers/media/pci/ivtv/ivtv-driver.c | 2 +-
drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 16 ++++++++--------
drivers/media/usb/s2255/s2255drv.c | 4 ++--
drivers/net/ethernet/intel/i40e/i40e_main.c | 6 +++---
drivers/net/ethernet/marvell/sky2.c | 2 +-
drivers/net/ethernet/sun/sunvnet.c | 2 +-
drivers/net/usb/sierra_net.c | 2 +-
.../broadcom/brcm80211/brcmfmac/btcoex.c | 2 +-
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 2 +-
drivers/net/wireless/intersil/hostap/hostap_ap.c | 2 +-
drivers/net/wireless/marvell/mwifiex/main.c | 2 +-
drivers/net/wireless/microchip/wilc1000/hif.c | 6 +++---
drivers/nfc/pn533/pn533.c | 2 +-
drivers/nfc/pn533/uart.c | 2 +-
drivers/pcmcia/bcm63xx_pcmcia.c | 2 +-
drivers/pcmcia/electra_cf.c | 2 +-
drivers/pcmcia/omap_cf.c | 2 +-
drivers/pcmcia/pd6729.c | 4 ++--
drivers/pcmcia/yenta_socket.c | 4 ++--
drivers/scsi/qla2xxx/qla_edif.c | 4 ++--
.../staging/media/atomisp/i2c/atomisp-lm3554.c | 2 +-
drivers/staging/wlan-ng/prism2usb.c | 6 +++---
drivers/tty/n_gsm.c | 2 +-
drivers/tty/sysrq.c | 2 +-
drivers/usb/gadget/udc/m66592-udc.c | 2 +-
drivers/usb/serial/garmin_gps.c | 2 +-
drivers/usb/serial/mos7840.c | 4 ++--
fs/ext4/super.c | 2 +-
fs/nilfs2/segment.c | 2 +-
net/802/garp.c | 2 +-
net/802/mrp.c | 4 ++--
net/bridge/br_multicast.c | 8 ++++----
net/bridge/br_multicast_eht.c | 4 ++--
net/core/gen_estimator.c | 2 +-
net/ipv4/ipmr.c | 2 +-
net/ipv6/ip6mr.c | 2 +-
net/mac80211/mesh_pathtbl.c | 2 +-
net/netfilter/ipset/ip_set_list_set.c | 2 +-
net/netfilter/ipvs/ip_vs_lblc.c | 2 +-
net/netfilter/ipvs/ip_vs_lblcr.c | 2 +-
net/netfilter/xt_IDLETIMER.c | 4 ++--
net/netfilter/xt_LED.c | 2 +-
net/sched/cls_flow.c | 2 +-
net/sunrpc/svc.c | 2 +-
net/tipc/discover.c | 2 +-
net/tipc/monitor.c | 2 +-
sound/i2c/other/ak4117.c | 2 +-
sound/synth/emux/emux.c | 2 +-
69 files changed, 97 insertions(+), 97 deletions(-)
diff --git a/arch/sh/drivers/push-switch.c b/arch/sh/drivers/push-switch.c
index 2813140fd92b..c95f48ff3f6f 100644
--- a/arch/sh/drivers/push-switch.c
+++ b/arch/sh/drivers/push-switch.c
@@ -102,7 +102,7 @@ static int switch_drv_remove(struct platform_device *pdev)
platform_set_drvdata(pdev, NULL);
flush_work(&psw->work);
- del_timer_sync(&psw->debounce);
+ timer_shutdown_sync(&psw->debounce);
free_irq(irq, pdev);
kfree(psw);
diff --git a/block/blk-iocost.c b/block/blk-iocost.c
index d1bdc12deaa7..aeea49870c0e 100644
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@@ -2818,7 +2818,7 @@ static void ioc_rqos_exit(struct rq_qos *rqos)
ioc->running = IOC_STOP;
spin_unlock_irq(&ioc->lock);
- del_timer_sync(&ioc->timer);
+ timer_shutdown_sync(&ioc->timer);
free_percpu(ioc->pcpu_stat);
kfree(ioc);
}
diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
index 778a0057193e..ecdc10741836 100644
--- a/block/blk-iolatency.c
+++ b/block/blk-iolatency.c
@@ -644,7 +644,7 @@ static void blkcg_iolatency_exit(struct rq_qos *rqos)
{
struct blk_iolatency *blkiolat = BLKIOLATENCY(rqos);
- del_timer_sync(&blkiolat->timer);
+ timer_shutdown_sync(&blkiolat->timer);
flush_work(&blkiolat->enable_work);
blkcg_deactivate_policy(rqos->q, &blkcg_policy_iolatency);
kfree(blkiolat);
diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
index b05357bced99..2146969237bf 100644
--- a/block/kyber-iosched.c
+++ b/block/kyber-iosched.c
@@ -434,7 +434,7 @@ static void kyber_exit_sched(struct elevator_queue *e)
struct kyber_queue_data *kqd = e->elevator_data;
int i;
- del_timer_sync(&kqd->timer);
+ timer_shutdown_sync(&kqd->timer);
blk_stat_disable_accounting(kqd->q);
for (i = 0; i < KYBER_NUM_DOMAINS; i++)
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 066dc1f5c235..34ad071a64e9 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -1431,7 +1431,7 @@ static int ghes_remove(struct platform_device *ghes_dev)
ghes->flags |= GHES_EXITING;
switch (generic->notify.type) {
case ACPI_HEST_NOTIFY_POLLED:
- del_timer_sync(&ghes->timer);
+ timer_shutdown_sync(&ghes->timer);
break;
case ACPI_HEST_NOTIFY_EXTERNAL:
free_irq(ghes->irq, ghes);
diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index 681cb3786794..eec0cc2144e0 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -2213,7 +2213,7 @@ idt77252_init_ubr(struct idt77252_dev *card, struct vc_map *vc,
}
spin_unlock_irqrestore(&vc->lock, flags);
if (est) {
- del_timer_sync(&est->timer);
+ timer_shutdown_sync(&est->timer);
kfree(est);
}
@@ -2530,7 +2530,7 @@ idt77252_close(struct atm_vcc *vcc)
vc->tx_vcc = NULL;
if (vc->estimator) {
- del_timer(&vc->estimator->timer);
+ timer_shutdown(&vc->estimator->timer);
kfree(vc->estimator);
vc->estimator = NULL;
}
@@ -3752,7 +3752,7 @@ static void __exit idt77252_exit(void)
card = idt77252_chain;
dev = card->atmdev;
idt77252_chain = card->next;
- del_timer_sync(&card->tst_timer);
+ timer_shutdown_sync(&card->tst_timer);
if (dev->phy->stop)
dev->phy->stop(dev);
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 2f16e1bfb6e7..e43dfb9eb6ad 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -2184,7 +2184,7 @@ void drbd_destroy_device(struct kref *kref)
struct drbd_resource *resource = device->resource;
struct drbd_peer_device *peer_device, *tmp_peer_device;
- del_timer_sync(&device->request_timer);
+ timer_shutdown_sync(&device->request_timer);
/* paranoia asserts */
D_ASSERT(device, device->open_cnt == 0);
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 1f8f3b87bdfa..4b366b658eea 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1755,7 +1755,7 @@ static void lo_free_disk(struct gendisk *disk)
if (lo->workqueue)
destroy_workqueue(lo->workqueue);
loop_free_idle_workers(lo, true);
- del_timer_sync(&lo->timer);
+ timer_shutdown_sync(&lo->timer);
mutex_destroy(&lo->lo_mutex);
kfree(lo);
}
diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index 8055f63603f4..2a5a27d713f8 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -737,7 +737,7 @@ static int bcsp_close(struct hci_uart *hu)
{
struct bcsp_struct *bcsp = hu->priv;
- del_timer_sync(&bcsp->tbcsp);
+ timer_shutdown_sync(&bcsp->tbcsp);
hu->priv = NULL;
diff --git a/drivers/gpu/drm/i915/i915_sw_fence.c b/drivers/gpu/drm/i915/i915_sw_fence.c
index cc2a8821d22a..8a9aad523eec 100644
--- a/drivers/gpu/drm/i915/i915_sw_fence.c
+++ b/drivers/gpu/drm/i915/i915_sw_fence.c
@@ -465,7 +465,7 @@ static void irq_i915_sw_fence_work(struct irq_work *wrk)
struct i915_sw_dma_fence_cb_timer *cb =
container_of(wrk, typeof(*cb), work);
- del_timer_sync(&cb->timer);
+ timer_shutdown_sync(&cb->timer);
dma_fence_put(cb->dma);
kfree_rcu(cb, rcu);
diff --git a/drivers/hid/hid-wiimote-core.c b/drivers/hid/hid-wiimote-core.c
index 09db8111dc26..26167cfb696f 100644
--- a/drivers/hid/hid-wiimote-core.c
+++ b/drivers/hid/hid-wiimote-core.c
@@ -1771,7 +1771,7 @@ static void wiimote_destroy(struct wiimote_data *wdata)
spin_unlock_irqrestore(&wdata->state.lock, flags);
cancel_work_sync(&wdata->init_worker);
- del_timer_sync(&wdata->timer);
+ timer_shutdown_sync(&wdata->timer);
device_remove_file(&wdata->hdev->dev, &dev_attr_devtype);
device_remove_file(&wdata->hdev->dev, &dev_attr_extension);
diff --git a/drivers/input/keyboard/locomokbd.c b/drivers/input/keyboard/locomokbd.c
index dae053596572..f866c03b9d0e 100644
--- a/drivers/input/keyboard/locomokbd.c
+++ b/drivers/input/keyboard/locomokbd.c
@@ -310,7 +310,7 @@ static void locomokbd_remove(struct locomo_dev *dev)
free_irq(dev->irq[0], locomokbd);
- del_timer_sync(&locomokbd->timer);
+ timer_shutdown_sync(&locomokbd->timer);
input_unregister_device(locomokbd->input);
locomo_set_drvdata(dev, NULL);
diff --git a/drivers/input/keyboard/omap-keypad.c b/drivers/input/keyboard/omap-keypad.c
index 57447d6c9007..24440b498645 100644
--- a/drivers/input/keyboard/omap-keypad.c
+++ b/drivers/input/keyboard/omap-keypad.c
@@ -296,7 +296,7 @@ static int omap_kp_remove(struct platform_device *pdev)
omap_writew(1, OMAP1_MPUIO_BASE + OMAP_MPUIO_KBD_MASKIT);
free_irq(omap_kp->irq, omap_kp);
- del_timer_sync(&omap_kp->timer);
+ timer_shutdown_sync(&omap_kp->timer);
tasklet_kill(&kp_tasklet);
/* unregister everything */
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 4a6b33bbe7ea..989228b5a0a4 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -2970,7 +2970,7 @@ static void alps_disconnect(struct psmouse *psmouse)
struct alps_data *priv = psmouse->private;
psmouse_reset(psmouse);
- del_timer_sync(&priv->timer);
+ timer_shutdown_sync(&priv->timer);
if (priv->dev2)
input_unregister_device(priv->dev2);
if (!IS_ERR_OR_NULL(priv->dev3))
diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c
index c24771336f61..f010b35a0531 100644
--- a/drivers/isdn/mISDN/l1oip_core.c
+++ b/drivers/isdn/mISDN/l1oip_core.c
@@ -1236,8 +1236,8 @@ release_card(struct l1oip *hc)
hc->shutdown = true;
- del_timer_sync(&hc->keep_tl);
- del_timer_sync(&hc->timeout_tl);
+ timer_shutdown_sync(&hc->keep_tl);
+ timer_shutdown_sync(&hc->timeout_tl);
cancel_work_sync(&hc->workq);
diff --git a/drivers/isdn/mISDN/timerdev.c b/drivers/isdn/mISDN/timerdev.c
index abdf36ac3bee..83d6b484d3c6 100644
--- a/drivers/isdn/mISDN/timerdev.c
+++ b/drivers/isdn/mISDN/timerdev.c
@@ -74,7 +74,7 @@ mISDN_close(struct inode *ino, struct file *filep)
while (!list_empty(list)) {
timer = list_first_entry(list, struct mISDNtimer, list);
spin_unlock_irq(&dev->lock);
- del_timer_sync(&timer->tl);
+ timer_shutdown_sync(&timer->tl);
spin_lock_irq(&dev->lock);
/* it might have been moved to ->expired */
list_del(&timer->list);
@@ -204,7 +204,7 @@ misdn_del_timer(struct mISDNtimerdev *dev, int id)
list_del_init(&timer->list);
timer->id = -1;
spin_unlock_irq(&dev->lock);
- del_timer_sync(&timer->tl);
+ timer_shutdown_sync(&timer->tl);
kfree(timer);
return id;
}
diff --git a/drivers/leds/trigger/ledtrig-activity.c b/drivers/leds/trigger/ledtrig-activity.c
index 30bc9df03636..33cbf8413658 100644
--- a/drivers/leds/trigger/ledtrig-activity.c
+++ b/drivers/leds/trigger/ledtrig-activity.c
@@ -208,7 +208,7 @@ static void activity_deactivate(struct led_classdev *led_cdev)
{
struct activity_data *activity_data = led_get_trigger_data(led_cdev);
- del_timer_sync(&activity_data->timer);
+ timer_shutdown_sync(&activity_data->timer);
kfree(activity_data);
clear_bit(LED_BLINK_SW, &led_cdev->work_flags);
}
diff --git a/drivers/leds/trigger/ledtrig-heartbeat.c b/drivers/leds/trigger/ledtrig-heartbeat.c
index 7fe0a05574d2..393b3ae832f4 100644
--- a/drivers/leds/trigger/ledtrig-heartbeat.c
+++ b/drivers/leds/trigger/ledtrig-heartbeat.c
@@ -151,7 +151,7 @@ static void heartbeat_trig_deactivate(struct led_classdev *led_cdev)
struct heartbeat_trig_data *heartbeat_data =
led_get_trigger_data(led_cdev);
- del_timer_sync(&heartbeat_data->timer);
+ timer_shutdown_sync(&heartbeat_data->timer);
kfree(heartbeat_data);
clear_bit(LED_BLINK_SW, &led_cdev->work_flags);
}
diff --git a/drivers/leds/trigger/ledtrig-pattern.c b/drivers/leds/trigger/ledtrig-pattern.c
index 885ca63f383f..fadd87dbe993 100644
--- a/drivers/leds/trigger/ledtrig-pattern.c
+++ b/drivers/leds/trigger/ledtrig-pattern.c
@@ -430,7 +430,7 @@ static void pattern_trig_deactivate(struct led_classdev *led_cdev)
if (led_cdev->pattern_clear)
led_cdev->pattern_clear(led_cdev);
- del_timer_sync(&data->timer);
+ timer_shutdown_sync(&data->timer);
led_set_brightness(led_cdev, LED_OFF);
kfree(data);
diff --git a/drivers/leds/trigger/ledtrig-transient.c b/drivers/leds/trigger/ledtrig-transient.c
index 80635183fac8..f111fa7635e5 100644
--- a/drivers/leds/trigger/ledtrig-transient.c
+++ b/drivers/leds/trigger/ledtrig-transient.c
@@ -180,7 +180,7 @@ static void transient_trig_deactivate(struct led_classdev *led_cdev)
{
struct transient_trig_data *transient_data = led_get_trigger_data(led_cdev);
- del_timer_sync(&transient_data->timer);
+ timer_shutdown_sync(&transient_data->timer);
led_set_brightness_nosleep(led_cdev, transient_data->restore_state);
kfree(transient_data);
}
diff --git a/drivers/media/pci/ivtv/ivtv-driver.c b/drivers/media/pci/ivtv/ivtv-driver.c
index f5846c22c799..ba503d820e48 100644
--- a/drivers/media/pci/ivtv/ivtv-driver.c
+++ b/drivers/media/pci/ivtv/ivtv-driver.c
@@ -1425,7 +1425,7 @@ static void ivtv_remove(struct pci_dev *pdev)
/* Interrupts */
ivtv_set_irq_mask(itv, 0xffffffff);
- del_timer_sync(&itv->dma_timer);
+ timer_shutdown_sync(&itv->dma_timer);
/* Kill irq worker */
kthread_flush_worker(&itv->irq_worker);
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
index 62ff1fa1c753..75c89b07e86a 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
@@ -2605,10 +2605,10 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
return hdw;
fail:
if (hdw) {
- del_timer_sync(&hdw->quiescent_timer);
- del_timer_sync(&hdw->decoder_stabilization_timer);
- del_timer_sync(&hdw->encoder_run_timer);
- del_timer_sync(&hdw->encoder_wait_timer);
+ timer_shutdown_sync(&hdw->quiescent_timer);
+ timer_shutdown_sync(&hdw->decoder_stabilization_timer);
+ timer_shutdown_sync(&hdw->encoder_run_timer);
+ timer_shutdown_sync(&hdw->encoder_wait_timer);
flush_work(&hdw->workpoll);
v4l2_device_unregister(&hdw->v4l2_dev);
usb_free_urb(hdw->ctl_read_urb);
@@ -2668,10 +2668,10 @@ void pvr2_hdw_destroy(struct pvr2_hdw *hdw)
if (!hdw) return;
pvr2_trace(PVR2_TRACE_INIT,"pvr2_hdw_destroy: hdw=%p",hdw);
flush_work(&hdw->workpoll);
- del_timer_sync(&hdw->quiescent_timer);
- del_timer_sync(&hdw->decoder_stabilization_timer);
- del_timer_sync(&hdw->encoder_run_timer);
- del_timer_sync(&hdw->encoder_wait_timer);
+ timer_shutdown_sync(&hdw->quiescent_timer);
+ timer_shutdown_sync(&hdw->decoder_stabilization_timer);
+ timer_shutdown_sync(&hdw->encoder_run_timer);
+ timer_shutdown_sync(&hdw->encoder_wait_timer);
if (hdw->fw_buffer) {
kfree(hdw->fw_buffer);
hdw->fw_buffer = NULL;
diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c
index acf18e2251a5..3c2627712fe9 100644
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -1487,7 +1487,7 @@ static void s2255_destroy(struct s2255_dev *dev)
/* board shutdown stops the read pipe if it is running */
s2255_board_shutdown(dev);
/* make sure firmware still not trying to load */
- del_timer_sync(&dev->timer); /* only started in .probe and .open */
+ timer_shutdown_sync(&dev->timer); /* only started in .probe and .open */
if (dev->fw_data->fw_urb) {
usb_kill_urb(dev->fw_data->fw_urb);
usb_free_urb(dev->fw_data->fw_urb);
@@ -2322,7 +2322,7 @@ static int s2255_probe(struct usb_interface *interface,
errorFWDATA2:
usb_free_urb(dev->fw_data->fw_urb);
errorFWURB:
- del_timer_sync(&dev->timer);
+ timer_shutdown_sync(&dev->timer);
errorEP:
usb_put_dev(dev->udev);
errorUDEV:
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 94feea3b2599..53d0083e35da 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -15586,7 +15586,7 @@ static int i40e_init_recovery_mode(struct i40e_pf *pf, struct i40e_hw *hw)
err_switch_setup:
i40e_reset_interrupt_capability(pf);
- del_timer_sync(&pf->service_timer);
+ timer_shutdown_sync(&pf->service_timer);
i40e_shutdown_adminq(hw);
iounmap(hw->hw_addr);
pci_disable_pcie_error_reporting(pf->pdev);
@@ -16205,7 +16205,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
kfree(pf->vsi);
err_switch_setup:
i40e_reset_interrupt_capability(pf);
- del_timer_sync(&pf->service_timer);
+ timer_shutdown_sync(&pf->service_timer);
err_mac_addr:
err_configure_lan_hmc:
(void)i40e_shutdown_lan_hmc(hw);
@@ -16267,7 +16267,7 @@ static void i40e_remove(struct pci_dev *pdev)
set_bit(__I40E_SUSPENDED, pf->state);
set_bit(__I40E_DOWN, pf->state);
if (pf->service_timer.function)
- del_timer_sync(&pf->service_timer);
+ timer_shutdown_sync(&pf->service_timer);
if (pf->service_task.func)
cancel_work_sync(&pf->service_task);
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index ff97b140886a..7c487f9b36ec 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -5013,7 +5013,7 @@ static void sky2_remove(struct pci_dev *pdev)
if (!hw)
return;
- del_timer_sync(&hw->watchdog_timer);
+ timer_shutdown_sync(&hw->watchdog_timer);
cancel_work_sync(&hw->restart_work);
for (i = hw->ports-1; i >= 0; --i)
diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
index acda6cbd0238..fe86fbd58586 100644
--- a/drivers/net/ethernet/sun/sunvnet.c
+++ b/drivers/net/ethernet/sun/sunvnet.c
@@ -524,7 +524,7 @@ static void vnet_port_remove(struct vio_dev *vdev)
hlist_del_rcu(&port->hash);
synchronize_rcu();
- del_timer_sync(&port->clean_timer);
+ timer_shutdown_sync(&port->clean_timer);
sunvnet_port_rm_txq_common(port);
netif_napi_del(&port->napi);
sunvnet_port_free_tx_bufs_common(port);
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
index b3ae949e6f1c..673d3aa83792 100644
--- a/drivers/net/usb/sierra_net.c
+++ b/drivers/net/usb/sierra_net.c
@@ -759,7 +759,7 @@ static void sierra_net_unbind(struct usbnet *dev, struct usb_interface *intf)
dev_dbg(&dev->udev->dev, "%s", __func__);
/* kill the timer and work */
- del_timer_sync(&priv->sync_timer);
+ timer_shutdown_sync(&priv->sync_timer);
cancel_work_sync(&priv->sierra_net_kevent);
/* tell modem we are going away */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
index f9f18ff451ea..7ea2631b8069 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
@@ -394,7 +394,7 @@ void brcmf_btcoex_detach(struct brcmf_cfg80211_info *cfg)
if (cfg->btcoex->timer_on) {
cfg->btcoex->timer_on = false;
- del_timer_sync(&cfg->btcoex->timer);
+ timer_shutdown_sync(&cfg->btcoex->timer);
}
cancel_work_sync(&cfg->btcoex->work);
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
index 6d6c12999645..48e7376a5fea 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
@@ -371,7 +371,7 @@ void iwl_dbg_tlv_del_timers(struct iwl_trans *trans)
struct iwl_dbg_tlv_timer_node *node, *tmp;
list_for_each_entry_safe(node, tmp, timer_list, list) {
- del_timer_sync(&node->timer);
+ timer_shutdown_sync(&node->timer);
list_del(&node->list);
kfree(node);
}
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 6c9c5d6e7783..69634fb82a9b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2835,7 +2835,7 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
/* synchronize all rx queues so we can safely delete */
iwl_mvm_free_reorder(mvm, baid_data);
- del_timer_sync(&baid_data->session_timer);
+ timer_shutdown_sync(&baid_data->session_timer);
RCU_INIT_POINTER(mvm->baid_map[baid], NULL);
kfree_rcu(baid_data, rcu_head);
IWL_DEBUG_HT(mvm, "BAID %d is free\n", baid);
diff --git a/drivers/net/wireless/intersil/hostap/hostap_ap.c b/drivers/net/wireless/intersil/hostap/hostap_ap.c
index 462ccc7d7d1a..9b546a71e7a2 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_ap.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_ap.c
@@ -135,7 +135,7 @@ static void ap_free_sta(struct ap_data *ap, struct sta_info *sta)
if (!sta->ap)
kfree(sta->u.sta.challenge);
- del_timer_sync(&sta->timer);
+ timer_shutdown_sync(&sta->timer);
#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
kfree(sta);
diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
index da2e6557e684..ea22a08e6c08 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.c
+++ b/drivers/net/wireless/marvell/mwifiex/main.c
@@ -123,7 +123,7 @@ static int mwifiex_unregister(struct mwifiex_adapter *adapter)
if (adapter->if_ops.cleanup_if)
adapter->if_ops.cleanup_if(adapter);
- del_timer_sync(&adapter->cmd_timer);
+ timer_shutdown_sync(&adapter->cmd_timer);
/* Free private structures */
for (i = 0; i < adapter->priv_num; i++) {
diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c
index 67df8221b5ae..5adc69d5bcae 100644
--- a/drivers/net/wireless/microchip/wilc1000/hif.c
+++ b/drivers/net/wireless/microchip/wilc1000/hif.c
@@ -1531,10 +1531,10 @@ int wilc_deinit(struct wilc_vif *vif)
mutex_lock(&vif->wilc->deinit_lock);
- del_timer_sync(&hif_drv->scan_timer);
- del_timer_sync(&hif_drv->connect_timer);
+ timer_shutdown_sync(&hif_drv->scan_timer);
+ timer_shutdown_sync(&hif_drv->connect_timer);
del_timer_sync(&vif->periodic_rssi);
- del_timer_sync(&hif_drv->remain_on_ch_timer);
+ timer_shutdown_sync(&hif_drv->remain_on_ch_timer);
if (hif_drv->usr_scan_req.scan_result) {
hif_drv->usr_scan_req.scan_result(SCAN_EVENT_ABORTED, NULL,
diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
index d9f6367b9993..0a1d0b4e3bb8 100644
--- a/drivers/nfc/pn533/pn533.c
+++ b/drivers/nfc/pn533/pn533.c
@@ -2788,7 +2788,7 @@ void pn53x_common_clean(struct pn533 *priv)
struct pn533_cmd *cmd, *n;
/* delete the timer before cleanup the worker */
- del_timer_sync(&priv->listen_timer);
+ timer_shutdown_sync(&priv->listen_timer);
flush_delayed_work(&priv->poll_work);
destroy_workqueue(priv->wq);
diff --git a/drivers/nfc/pn533/uart.c b/drivers/nfc/pn533/uart.c
index 07596bf5f7d6..a556acdb947b 100644
--- a/drivers/nfc/pn533/uart.c
+++ b/drivers/nfc/pn533/uart.c
@@ -310,7 +310,7 @@ static void pn532_uart_remove(struct serdev_device *serdev)
pn53x_unregister_nfc(pn532->priv);
serdev_device_close(serdev);
pn53x_common_clean(pn532->priv);
- del_timer_sync(&pn532->cmd_timeout);
+ timer_shutdown_sync(&pn532->cmd_timeout);
kfree_skb(pn532->recv_skb);
kfree(pn532);
}
diff --git a/drivers/pcmcia/bcm63xx_pcmcia.c b/drivers/pcmcia/bcm63xx_pcmcia.c
index bb06311d0b5f..dd3c26099048 100644
--- a/drivers/pcmcia/bcm63xx_pcmcia.c
+++ b/drivers/pcmcia/bcm63xx_pcmcia.c
@@ -443,7 +443,7 @@ static int bcm63xx_drv_pcmcia_remove(struct platform_device *pdev)
struct resource *res;
skt = platform_get_drvdata(pdev);
- del_timer_sync(&skt->timer);
+ timer_shutdown_sync(&skt->timer);
iounmap(skt->base);
iounmap(skt->io_base);
res = skt->reg_res;
diff --git a/drivers/pcmcia/electra_cf.c b/drivers/pcmcia/electra_cf.c
index 40a5cffe24a4..efc27bc15152 100644
--- a/drivers/pcmcia/electra_cf.c
+++ b/drivers/pcmcia/electra_cf.c
@@ -317,7 +317,7 @@ static int electra_cf_remove(struct platform_device *ofdev)
cf->active = 0;
pcmcia_unregister_socket(&cf->socket);
free_irq(cf->irq, cf);
- del_timer_sync(&cf->timer);
+ timer_shutdown_sync(&cf->timer);
iounmap(cf->io_virt);
iounmap(cf->mem_base);
diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c
index d3f827d4224a..e613818dc0bc 100644
--- a/drivers/pcmcia/omap_cf.c
+++ b/drivers/pcmcia/omap_cf.c
@@ -296,7 +296,7 @@ static int __exit omap_cf_remove(struct platform_device *pdev)
cf->active = 0;
pcmcia_unregister_socket(&cf->socket);
- del_timer_sync(&cf->timer);
+ timer_shutdown_sync(&cf->timer);
release_mem_region(cf->phys_cf, SZ_8K);
free_irq(cf->irq, cf);
kfree(cf);
diff --git a/drivers/pcmcia/pd6729.c b/drivers/pcmcia/pd6729.c
index f0af9985ca09..a0a2e7f18356 100644
--- a/drivers/pcmcia/pd6729.c
+++ b/drivers/pcmcia/pd6729.c
@@ -727,7 +727,7 @@ static int pd6729_pci_probe(struct pci_dev *dev,
if (irq_mode == 1)
free_irq(dev->irq, socket);
else
- del_timer_sync(&socket->poll_timer);
+ timer_shutdown_sync(&socket->poll_timer);
err_out_free_res:
pci_release_regions(dev);
err_out_disable:
@@ -754,7 +754,7 @@ static void pd6729_pci_remove(struct pci_dev *dev)
if (irq_mode == 1)
free_irq(dev->irq, socket);
else
- del_timer_sync(&socket->poll_timer);
+ timer_shutdown_sync(&socket->poll_timer);
pci_release_regions(dev);
pci_disable_device(dev);
diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
index 3966a6ceb1ac..1365eaa20ff4 100644
--- a/drivers/pcmcia/yenta_socket.c
+++ b/drivers/pcmcia/yenta_socket.c
@@ -814,7 +814,7 @@ static void yenta_close(struct pci_dev *dev)
if (sock->cb_irq)
free_irq(sock->cb_irq, sock);
else
- del_timer_sync(&sock->poll_timer);
+ timer_shutdown_sync(&sock->poll_timer);
iounmap(sock->base);
yenta_free_resources(sock);
@@ -1285,7 +1285,7 @@ static int yenta_probe(struct pci_dev *dev, const struct pci_device_id *id)
if (socket->cb_irq)
free_irq(socket->cb_irq, socket);
else
- del_timer_sync(&socket->poll_timer);
+ timer_shutdown_sync(&socket->poll_timer);
unmap:
iounmap(socket->base);
yenta_free_resources(socket);
diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
index 00ccc41cef14..e4240aae5f9e 100644
--- a/drivers/scsi/qla2xxx/qla_edif.c
+++ b/drivers/scsi/qla2xxx/qla_edif.c
@@ -416,7 +416,7 @@ static void __qla2x00_release_all_sadb(struct scsi_qla_host *vha,
*/
if (edif_entry->delete_sa_index !=
INVALID_EDIF_SA_INDEX) {
- del_timer(&edif_entry->timer);
+ timer_shutdown(&edif_entry->timer);
/* build and send the aen */
fcport->edif.rx_sa_set = 1;
@@ -2799,7 +2799,7 @@ qla28xx_sa_update_iocb_entry(scsi_qla_host_t *v, struct req_que *req,
"%s: removing edif_entry %p, new sa_index: 0x%x\n",
__func__, edif_entry, pkt->sa_index);
qla_edif_list_delete_sa_index(sp->fcport, edif_entry);
- del_timer(&edif_entry->timer);
+ timer_shutdown(&edif_entry->timer);
ql_dbg(ql_dbg_edif, vha, 0x5033,
"%s: releasing edif_entry %p, new sa_index: 0x%x\n",
diff --git a/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c b/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c
index 75d16b525294..c4ce4cd445d7 100644
--- a/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c
+++ b/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c
@@ -921,7 +921,7 @@ static void lm3554_remove(struct i2c_client *client)
atomisp_gmin_remove_subdev(sd);
- del_timer_sync(&flash->flash_off_delay);
+ timer_shutdown_sync(&flash->flash_off_delay);
lm3554_gpio_uninit(client);
diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c
index c13f1699e5a2..80e36d03c4e2 100644
--- a/drivers/staging/wlan-ng/prism2usb.c
+++ b/drivers/staging/wlan-ng/prism2usb.c
@@ -170,9 +170,9 @@ static void prism2sta_disconnect_usb(struct usb_interface *interface)
*/
prism2sta_ifstate(wlandev, P80211ENUM_ifstate_disable);
- del_timer_sync(&hw->throttle);
- del_timer_sync(&hw->reqtimer);
- del_timer_sync(&hw->resptimer);
+ timer_shutdown_sync(&hw->throttle);
+ timer_shutdown_sync(&hw->reqtimer);
+ timer_shutdown_sync(&hw->resptimer);
/* Unlink all the URBs. This "removes the wheels"
* from the entire CTLX handling mechanism.
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index daf12132deb1..348d85c13f91 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2444,7 +2444,7 @@ static void gsm_dlci_free(struct tty_port *port)
{
struct gsm_dlci *dlci = container_of(port, struct gsm_dlci, port);
- del_timer_sync(&dlci->t1);
+ timer_shutdown_sync(&dlci->t1);
dlci->gsm->dlci[dlci->addr] = NULL;
kfifo_free(&dlci->fifo);
while ((dlci->skb = skb_dequeue(&dlci->skb_list)))
diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index d2b2720db6ca..b6e70c5cfa17 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -1003,7 +1003,7 @@ static void sysrq_disconnect(struct input_handle *handle)
input_close_device(handle);
cancel_work_sync(&sysrq->reinject_work);
- del_timer_sync(&sysrq->keyreset_timer);
+ timer_shutdown_sync(&sysrq->keyreset_timer);
input_unregister_handle(handle);
kfree(sysrq);
}
diff --git a/drivers/usb/gadget/udc/m66592-udc.c b/drivers/usb/gadget/udc/m66592-udc.c
index 931e6362a13d..c7e421b449f3 100644
--- a/drivers/usb/gadget/udc/m66592-udc.c
+++ b/drivers/usb/gadget/udc/m66592-udc.c
@@ -1519,7 +1519,7 @@ static int m66592_remove(struct platform_device *pdev)
usb_del_gadget_udc(&m66592->gadget);
- del_timer_sync(&m66592->timer);
+ timer_shutdown_sync(&m66592->timer);
iounmap(m66592->reg);
free_irq(platform_get_irq(pdev, 0), m66592);
m66592_free_request(&m66592->ep[0].ep, m66592->ep0_req);
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index f1a8d8343623..670e942fdaaa 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -1405,7 +1405,7 @@ static void garmin_port_remove(struct usb_serial_port *port)
usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
usb_kill_urb(port->interrupt_in_urb);
- del_timer_sync(&garmin_data_p->timer);
+ timer_shutdown_sync(&garmin_data_p->timer);
kfree(garmin_data_p);
}
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 6b12bb4648b8..73370eaae0ab 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1725,8 +1725,8 @@ static void mos7840_port_remove(struct usb_serial_port *port)
/* Turn off LED */
mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0300);
- del_timer_sync(&mos7840_port->led_timer1);
- del_timer_sync(&mos7840_port->led_timer2);
+ timer_shutdown_sync(&mos7840_port->led_timer1);
+ timer_shutdown_sync(&mos7840_port->led_timer2);
usb_kill_urb(mos7840_port->led_urb);
usb_free_urb(mos7840_port->led_urb);
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 16a343e8047d..260c1b3e3ef2 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1225,7 +1225,7 @@ static void ext4_put_super(struct super_block *sb)
}
ext4_es_unregister_shrinker(sbi);
- del_timer_sync(&sbi->s_err_report);
+ timer_shutdown_sync(&sbi->s_err_report);
ext4_release_system_zone(sb);
ext4_mb_release(sb);
ext4_ext_release(sb);
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 3335ef352915..76c3bd88b858 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2752,7 +2752,7 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci)
down_write(&nilfs->ns_segctor_sem);
- del_timer_sync(&sci->sc_timer);
+ timer_shutdown_sync(&sci->sc_timer);
kfree(sci);
}
diff --git a/net/802/garp.c b/net/802/garp.c
index 77aac2763835..ab24b21fbb49 100644
--- a/net/802/garp.c
+++ b/net/802/garp.c
@@ -618,7 +618,7 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl
/* Delete timer and generate a final TRANSMIT_PDU event to flush out
* all pending messages before the applicant is gone. */
- del_timer_sync(&app->join_timer);
+ timer_shutdown_sync(&app->join_timer);
spin_lock_bh(&app->lock);
garp_gid_event(app, GARP_EVENT_TRANSMIT_PDU);
diff --git a/net/802/mrp.c b/net/802/mrp.c
index 66fcbf23b486..eafc21ecc287 100644
--- a/net/802/mrp.c
+++ b/net/802/mrp.c
@@ -911,8 +911,8 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl)
/* Delete timer and generate a final TX event to flush out
* all pending messages before the applicant is gone.
*/
- del_timer_sync(&app->join_timer);
- del_timer_sync(&app->periodic_timer);
+ timer_shutdown_sync(&app->join_timer);
+ timer_shutdown_sync(&app->periodic_timer);
spin_lock_bh(&app->lock);
mrp_mad_event(app, MRP_EVENT_TX);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 48170bd3785e..dea1ee1bd095 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -606,7 +606,7 @@ static void br_multicast_destroy_mdb_entry(struct net_bridge_mcast_gc *gc)
WARN_ON(!hlist_unhashed(&mp->mdb_node));
WARN_ON(mp->ports);
- del_timer_sync(&mp->timer);
+ timer_shutdown_sync(&mp->timer);
kfree_rcu(mp, rcu);
}
@@ -647,7 +647,7 @@ static void br_multicast_destroy_group_src(struct net_bridge_mcast_gc *gc)
src = container_of(gc, struct net_bridge_group_src, mcast_gc);
WARN_ON(!hlist_unhashed(&src->node));
- del_timer_sync(&src->timer);
+ timer_shutdown_sync(&src->timer);
kfree_rcu(src, rcu);
}
@@ -676,8 +676,8 @@ static void br_multicast_destroy_port_group(struct net_bridge_mcast_gc *gc)
WARN_ON(!hlist_unhashed(&pg->mglist));
WARN_ON(!hlist_empty(&pg->src_list));
- del_timer_sync(&pg->rexmit_timer);
- del_timer_sync(&pg->timer);
+ timer_shutdown_sync(&pg->rexmit_timer);
+ timer_shutdown_sync(&pg->timer);
kfree_rcu(pg, rcu);
}
diff --git a/net/bridge/br_multicast_eht.c b/net/bridge/br_multicast_eht.c
index f91c071d1608..c126aa4e7551 100644
--- a/net/bridge/br_multicast_eht.c
+++ b/net/bridge/br_multicast_eht.c
@@ -142,7 +142,7 @@ static void br_multicast_destroy_eht_set_entry(struct net_bridge_mcast_gc *gc)
set_h = container_of(gc, struct net_bridge_group_eht_set_entry, mcast_gc);
WARN_ON(!RB_EMPTY_NODE(&set_h->rb_node));
- del_timer_sync(&set_h->timer);
+ timer_shutdown_sync(&set_h->timer);
kfree(set_h);
}
@@ -154,7 +154,7 @@ static void br_multicast_destroy_eht_set(struct net_bridge_mcast_gc *gc)
WARN_ON(!RB_EMPTY_NODE(&eht_set->rb_node));
WARN_ON(!RB_EMPTY_ROOT(&eht_set->entry_tree));
- del_timer_sync(&eht_set->timer);
+ timer_shutdown_sync(&eht_set->timer);
kfree(eht_set);
}
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 4fcbdd71c59f..fae9c4694186 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -208,7 +208,7 @@ void gen_kill_estimator(struct net_rate_estimator __rcu **rate_est)
est = xchg((__force struct net_rate_estimator **)rate_est, NULL);
if (est) {
- del_timer_sync(&est->timer);
+ timer_shutdown_sync(&est->timer);
kfree_rcu(est, rcu);
}
}
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index b58df3c1bf7d..eec1f6df80d8 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -412,7 +412,7 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id)
static void ipmr_free_table(struct mr_table *mrt)
{
- del_timer_sync(&mrt->ipmr_expire_timer);
+ timer_shutdown_sync(&mrt->ipmr_expire_timer);
mroute_clean_tables(mrt, MRT_FLUSH_VIFS | MRT_FLUSH_VIFS_STATIC |
MRT_FLUSH_MFC | MRT_FLUSH_MFC_STATIC);
rhltable_destroy(&mrt->mfc_hash);
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 23e766597f36..51cf37abd142 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -392,7 +392,7 @@ static struct mr_table *ip6mr_new_table(struct net *net, u32 id)
static void ip6mr_free_table(struct mr_table *mrt)
{
- del_timer_sync(&mrt->ipmr_expire_timer);
+ timer_shutdown_sync(&mrt->ipmr_expire_timer);
mroute_clean_tables(mrt, MRT6_FLUSH_MIFS | MRT6_FLUSH_MIFS_STATIC |
MRT6_FLUSH_MFC | MRT6_FLUSH_MFC_STATIC);
rhltable_destroy(&mrt->mfc_hash);
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 69d5e1ec6ede..3b81e6df3f34 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -512,7 +512,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl,
mpath->flags |= MESH_PATH_RESOLVING | MESH_PATH_DELETED;
mesh_gate_del(tbl, mpath);
spin_unlock_bh(&mpath->state_lock);
- del_timer_sync(&mpath->timer);
+ timer_shutdown_sync(&mpath->timer);
atomic_dec(&sdata->u.mesh.mpaths);
atomic_dec(&tbl->entries);
mesh_path_flush_pending(mpath);
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index 5a67f7966574..e162636525cf 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -427,7 +427,7 @@ list_set_destroy(struct ip_set *set)
struct set_elem *e, *n;
if (SET_WITH_TIMEOUT(set))
- del_timer_sync(&map->gc);
+ timer_shutdown_sync(&map->gc);
list_for_each_entry_safe(e, n, &map->members, list) {
list_del(&e->list);
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index 7ac7473e3804..1b87214d385e 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -384,7 +384,7 @@ static void ip_vs_lblc_done_svc(struct ip_vs_service *svc)
struct ip_vs_lblc_table *tbl = svc->sched_data;
/* remove periodic timer */
- del_timer_sync(&tbl->periodic_timer);
+ timer_shutdown_sync(&tbl->periodic_timer);
/* got to clean up table entries here */
ip_vs_lblc_flush(svc);
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index 77c323c36a88..ad8f5fea6d3a 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -547,7 +547,7 @@ static void ip_vs_lblcr_done_svc(struct ip_vs_service *svc)
struct ip_vs_lblcr_table *tbl = svc->sched_data;
/* remove periodic timer */
- del_timer_sync(&tbl->periodic_timer);
+ timer_shutdown_sync(&tbl->periodic_timer);
/* got to clean up table entries here */
ip_vs_lblcr_flush(svc);
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index 0f8bb0bf558f..8d36303f3935 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -413,7 +413,7 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param *par)
pr_debug("deleting timer %s\n", info->label);
list_del(&info->timer->entry);
- del_timer_sync(&info->timer->timer);
+ timer_shutdown_sync(&info->timer->timer);
cancel_work_sync(&info->timer->work);
sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);
kfree(info->timer->attr.attr.name);
@@ -441,7 +441,7 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par)
if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
alarm_cancel(&info->timer->alarm);
} else {
- del_timer_sync(&info->timer->timer);
+ timer_shutdown_sync(&info->timer->timer);
}
cancel_work_sync(&info->timer->work);
sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);
diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c
index 0371c387b0d1..66b0f941d8fb 100644
--- a/net/netfilter/xt_LED.c
+++ b/net/netfilter/xt_LED.c
@@ -166,7 +166,7 @@ static void led_tg_destroy(const struct xt_tgdtor_param *par)
list_del(&ledinternal->list);
- del_timer_sync(&ledinternal->timer);
+ timer_shutdown_sync(&ledinternal->timer);
led_trigger_unregister(&ledinternal->netfilter_led_trigger);
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 535668e1f748..6ab317b48d6c 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -369,7 +369,7 @@ static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = {
static void __flow_destroy_filter(struct flow_filter *f)
{
- del_timer_sync(&f->perturb_timer);
+ timer_shutdown_sync(&f->perturb_timer);
tcf_exts_destroy(&f->exts);
tcf_em_tree_destroy(&f->ematches);
tcf_exts_put_net(&f->exts);
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 8f1b596db33f..85f0c3cfc877 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -567,7 +567,7 @@ svc_destroy(struct kref *ref)
struct svc_serv *serv = container_of(ref, struct svc_serv, sv_refcnt);
dprintk("svc: svc_destroy(%s)\n", serv->sv_program->pg_name);
- del_timer_sync(&serv->sv_temptimer);
+ timer_shutdown_sync(&serv->sv_temptimer);
/*
* The last user is gone and thus all sockets have to be destroyed to
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index e8dcdf267c0c..685389d4b245 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -388,7 +388,7 @@ int tipc_disc_create(struct net *net, struct tipc_bearer *b,
*/
void tipc_disc_delete(struct tipc_discoverer *d)
{
- del_timer_sync(&d->timer);
+ timer_shutdown_sync(&d->timer);
kfree_skb(d->skb);
kfree(d);
}
diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
index 9618e4429f0f..77a3d016cade 100644
--- a/net/tipc/monitor.c
+++ b/net/tipc/monitor.c
@@ -700,7 +700,7 @@ void tipc_mon_delete(struct net *net, int bearer_id)
}
mon->self = NULL;
write_unlock_bh(&mon->lock);
- del_timer_sync(&mon->timer);
+ timer_shutdown_sync(&mon->timer);
kfree(self->domain);
kfree(self);
kfree(mon);
diff --git a/sound/i2c/other/ak4117.c b/sound/i2c/other/ak4117.c
index 1bc43e927d82..640501bb3ca6 100644
--- a/sound/i2c/other/ak4117.c
+++ b/sound/i2c/other/ak4117.c
@@ -47,7 +47,7 @@ static void reg_dump(struct ak4117 *ak4117)
static void snd_ak4117_free(struct ak4117 *chip)
{
- del_timer_sync(&chip->timer);
+ timer_shutdown_sync(&chip->timer);
kfree(chip);
}
diff --git a/sound/synth/emux/emux.c b/sound/synth/emux/emux.c
index a870759d179e..0006c3ddb51d 100644
--- a/sound/synth/emux/emux.c
+++ b/sound/synth/emux/emux.c
@@ -129,7 +129,7 @@ int snd_emux_free(struct snd_emux *emu)
if (! emu)
return -EINVAL;
- del_timer_sync(&emu->tlist);
+ timer_shutdown_sync(&emu->tlist);
snd_emux_proc_free(emu);
snd_emux_delete_virmidi(emu);
--
2.35.1
^ permalink raw reply related
* Re: [Intel-wired-lan] igc: 5.10.146 Kernel BUG at 0xffffffff813ce19f
From: Kyle Sanderson @ 2022-12-20 18:29 UTC (permalink / raw)
To: Neftin, Sasha
Cc: Linux-Kernal, Linus Torvalds, intel-wired-lan, anthony.l.nguyen,
jesse.brandeburg, netdev, Ruinskiy, Dima, Lifshits, Vitaly,
naamax.meir, Avivi, Amir
In-Reply-To: <a752422c-4630-e53d-c9cd-cc9ed866f853@intel.com>
re-sending as plain text - my apologies.
> On Sun, 18 Dec 2022, 23:31 Neftin, Sasha wrote:
> What is a board in use (LAN on board or NIC)?
> What is lspci, lspci -t and lspci -s 0000:[lan bus:device.function] -vvv output?
It's embedded on the board, could very well be on a bridge though as a
card. The box has 6 ports, 2 were in-use while testing.
00:00.0 Host bridge: Intel Corporation Device 4522 (rev 01)
00:02.0 VGA compatible controller: Intel Corporation Elkhart Lake [UHD
Graphics Gen11 16EU] (rev 01)
00:08.0 System peripheral: Intel Corporation Device 4511 (rev 01)
00:14.0 USB controller: Intel Corporation Device 4b7d (rev 11)
00:14.2 RAM memory: Intel Corporation Device 4b7f (rev 11)
00:16.0 Communication controller: Intel Corporation Device 4b70 (rev 11)
00:17.0 SATA controller: Intel Corporation Device 4b63 (rev 11)
00:1c.0 PCI bridge: Intel Corporation Device 4b38 (rev 11)
00:1c.1 PCI bridge: Intel Corporation Device 4b39 (rev 11)
00:1c.2 PCI bridge: Intel Corporation Device 4b3a (rev 11)
00:1c.3 PCI bridge: Intel Corporation Device 4b3b (rev 11)
00:1c.4 PCI bridge: Intel Corporation Device 4b3c (rev 11)
00:1c.6 PCI bridge: Intel Corporation Device 4b3e (rev 11)
00:1f.0 ISA bridge: Intel Corporation Device 4b00 (rev 11)
00:1f.3 Audio device: Intel Corporation Device 4b58 (rev 11)
00:1f.4 SMBus: Intel Corporation Device 4b23 (rev 11)
00:1f.5 Serial bus controller: Intel Corporation Device 4b24 (rev 11)
01:00.0 Ethernet controller: Intel Corporation Device 125c (rev 04)
02:00.0 Ethernet controller: Intel Corporation Device 125c (rev 04)
03:00.0 Ethernet controller: Intel Corporation Device 125c (rev 04)
04:00.0 Ethernet controller: Intel Corporation Device 125c (rev 04)
05:00.0 Ethernet controller: Intel Corporation Device 125c (rev 04)
06:00.0 Ethernet controller: Intel Corporation Device 125c (rev 04)
-[0000:00]-+-00.0
+-02.0
+-08.0
+-14.0
+-14.2
+-16.0
+-17.0
+-1c.0-[01]----00.0
+-1c.1-[02]----00.0
+-1c.2-[03]----00.0
+-1c.3-[04]----00.0
+-1c.4-[05]----00.0
+-1c.6-[06]----00.0
+-1f.0
+-1f.3
+-1f.4
\-1f.5
01:00.0 Ethernet controller: Intel Corporation Device 125c (rev 04)
Subsystem: Intel Corporation Device 0000
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort-
<TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0
Interrupt: pin A routed to IRQ 16
Region 0: Memory at 80600000 (32-bit, non-prefetchable) [size=1M]
Region 3: Memory at 80700000 (32-bit, non-prefetchable) [size=16K]
Capabilities: [40] Power Management version 3
Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)
Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=1 PME-
Capabilities: [50] MSI: Enable- Count=1/1 Maskable+ 64bit+
Address: 0000000000000000 Data: 0000
Masking: 00000000 Pending: 00000000
Capabilities: [70] MSI-X: Enable+ Count=5 Masked-
Vector table: BAR=3 offset=00000000
PBA: BAR=3 offset=00002000
Capabilities: [a0] Express (v2) Endpoint, MSI 00
DevCap: MaxPayload 512 bytes, PhantFunc 0, Latency L0s <512ns, L1 <64us
ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset+ SlotPowerLimit 0W
DevCtl: CorrErr+ NonFatalErr+ FatalErr+ UnsupReq+
RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+ FLReset-
MaxPayload 128 bytes, MaxReadReq 512 bytes
DevSta: CorrErr- NonFatalErr- FatalErr- UnsupReq- AuxPwr+ TransPend-
LnkCap: Port #0, Speed 5GT/s, Width x1, ASPM L1, Exit Latency L1 <4us
ClockPM- Surprise- LLActRep- BwNot- ASPMOptComp+
LnkCtl: ASPM Disabled; RCB 64 bytes, Disabled- CommClk+
ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
LnkSta: Speed 5GT/s, Width x1
TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
DevCap2: Completion Timeout: Range ABCD, TimeoutDis+ NROPrPrP- LTR+
10BitTagComp- 10BitTagReq- OBFF Not Supported, ExtFmt- EETLPPrefix-
EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit-
FRS- TPHComp- ExtTPHComp-
AtomicOpsCap: 32bit- 64bit- 128bitCAS-
DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis- LTR+
10BitTagReq- OBFF Disabled,
AtomicOpsCtl: ReqEn-
LnkCtl2: Target Link Speed: 5GT/s, EnterCompliance- SpeedDis-
Transmit Margin: Normal Operating Range, EnterModifiedCompliance-
ComplianceSOS-
Compliance Preset/De-emphasis: -6dB de-emphasis, 0dB preshoot
LnkSta2: Current De-emphasis Level: -6dB, EqualizationComplete-
EqualizationPhase1-
EqualizationPhase2- EqualizationPhase3- LinkEqualizationRequest-
Retimer- 2Retimers- CrosslinkRes: unsupported
Capabilities: [100 v2] Advanced Error Reporting
UESta: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF-
MalfTLP- ECRC- UnsupReq- ACSViol-
UEMsk: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF-
MalfTLP- ECRC- UnsupReq- ACSViol-
UESvrt: DLP+ SDES+ TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+
MalfTLP+ ECRC- UnsupReq- ACSViol-
CESta: RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr-
CEMsk: RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
AERCap: First Error Pointer: 00, ECRCGenCap+ ECRCGenEn- ECRCChkCap+ ECRCChkEn-
MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap-
HeaderLog: 00000000 00000000 00000000 00000000
Capabilities: [140 v1] Device Serial Number e4-3a-6e-ff-ff-5d-bb-54
Capabilities: [1c0 v1] Latency Tolerance Reporting
Max snoop latency: 3145728ns
Max no snoop latency: 3145728ns
Capabilities: [1f0 v1] Precision Time Measurement
PTMCap: Requester:+ Responder:- Root:-
PTMClockGranularity: 4ns
PTMControl: Enabled:- RootSelected:-
PTMEffectiveGranularity: Unknown
Capabilities: [1e0 v1] L1 PM Substates
L1SubCap: PCI-PM_L1.2+ PCI-PM_L1.1+ ASPM_L1.2+ ASPM_L1.1+ L1_PM_Substates+
PortCommonModeRestoreTime=55us PortTPowerOnTime=70us
L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2- ASPM_L1.1-
T_CommonMode=0us LTR1.2_Threshold=81920ns
L1SubCtl2: T_PwrOn=50us
Kernel driver in use: igc
Kernel modules: igc
On Sun, Dec 18, 2022 at 10:31 PM Neftin, Sasha <sasha.neftin@intel.com> wrote:
>
> On 12/16/2022 00:28, Kyle Sanderson wrote:
> > (Un)fortunately I can reproduce this bug by simply removing the
> > ethernet cable from the box while there is traffic flowing. kprint
> > below from a console line. Please CC / to me for any additional
> > information I can provide for this panic.
> What is a board in use (LAN on board or NIC)? What is lspci, lspci -t
> and lspci -s 0000:[lan bus:device.function] -vvv output?
> >
> > [ 156.707054] igc 0000:01:00.0 eth0: NIC Link is Down
> > [ 156.712981] br-lan: port 1(eth0) entered disabled state
> > [ 156.719246] igc 0000:01:00.0 eth0: Register Dump
> > [ 156.724784] igc 0000:01:00.0 eth0: Register Name Value
> > [ 156.731067] igc 0000:01:00.0 eth0: CTRL 181c0641
> > [ 156.737607] igc 0000:01:00.0 eth0: STATUS 00380681
> > [ 156.744133] igc 0000:01:00.0 eth0: CTRL_EXT 100000c0
> > [ 156.750759] igc 0000:01:00.0 eth0: MDIC 18017949
> > [ 156.757258] igc 0000:01:00.0 eth0: ICR 00000001
> > [ 156.763785] igc 0000:01:00.0 eth0: RCTL 0440803a
> > [ 156.770324] igc 0000:01:00.0 eth0: RDLEN[0-3] 00001000
> > 00001000 00001000 00001000
> > [ 156.779457] igc 0000:01:00.0 eth0: RDH[0-3] 000000ef
> > 000000a1 00000092 000000ba
> > [ 156.788500] igc 0000:01:00.0 eth0: RDT[0-3] 000000ee
> > 000000a0 00000091 000000b9
> > [ 156.797650] igc 0000:01:00.0 eth0: RXDCTL[0-3] 02040808
> > 02040808 02040808 02040808
> > [ 156.806688] igc 0000:01:00.0 eth0: RDBAL[0-3] 02f43000
> > 02180000 02e7f000 02278000
> > [ 156.815781] igc 0000:01:00.0 eth0: RDBAH[0-3] 00000001
> > 00000001 00000001 00000001
> > [ 156.824928] igc 0000:01:00.0 eth0: TCTL a503f0fa
> > [ 156.831587] igc 0000:01:00.0 eth0: TDBAL[0-3] 02f43000
> > 02180000 02e7f000 02278000
> > [ 156.840637] igc 0000:01:00.0 eth0: TDBAH[0-3] 00000001
> > 00000001 00000001 00000001
> > [ 156.849753] igc 0000:01:00.0 eth0: TDLEN[0-3] 00001000
> > 00001000 00001000 00001000
> > [ 156.858760] igc 0000:01:00.0 eth0: TDH[0-3] 000000d4
> > 0000003d 000000af 0000002a
> > [ 156.867771] igc 0000:01:00.0 eth0: TDT[0-3] 000000e4
> > 0000005a 000000c8 0000002a
> > [ 156.876864] igc 0000:01:00.0 eth0: TXDCTL[0-3] 02100108
> > 02100108 02100108 02100108
> > [ 156.885905] igc 0000:01:00.0 eth0: Reset adapter
> > [ 160.307195] igc 0000:01:00.0 eth0: NIC Link is Up 1000 Mbps Full
> > Duplex, Flow Control: RX/TX
> > [ 160.317974] br-lan: port 1(eth0) entered blocking state
> > [ 160.324532] br-lan: port 1(eth0) entered forwarding state
> > [ 161.197263] ------------[ cut here ]------------
> > [ 161.202669] Kernel BUG at 0xffffffff813ce19f [verbose debug info unavailable]
> > [ 161.210769] invalid opcode: 0000 [#1] SMP NOPTI
> > [ 161.216022] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.10.146 #0
> > [ 161.222980] Hardware name: Default string Default string/Default
> > string, BIOS 5.19 09/23/2022
> > [ 161.232546] RIP: 0010:0xffffffff813ce19f
> > [ 161.237167] Code: 03 01 4c 89 48 58 e9 2f ff ff ff 85 db 41 0f 95
> > c2 45 39 d9 41 0f 95 c1 45 84 ca 74 05 45 85 e4 78 0a 44 89 c2 e9 10
> > ff ff ff <0f> 0b 01 d2 45 89 c1 41 29 d1 ba 00 00 00 00 44 0f 48 ca eb
> > 80 cc
> > [ 161.258651] RSP: 0018:ffffc90000118e88 EFLAGS: 00010283
> > [ 161.264736] RAX: ffff888101f8f200 RBX: ffffc900006f9bd0 RCX: 000000000000050e
> > [ 161.272837] RDX: ffff888101fec000 RSI: 0000000000000a1c RDI: 0000000000061a10
> > [ 161.280942] RBP: ffffc90000118ef8 R08: 0000000000000000 R09: 0000000000061502
> > [ 161.289089] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffff3f
> > [ 161.297229] R13: ffff888101f8f140 R14: 0000000000000000 R15: ffff888100ad9b00
> > [ 161.305345] FS: 0000000000000000(0000) GS:ffff88903fe80000(0000)
> > knlGS:00000 00000000000
> > [ 161.314492] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [ 161.321139] CR2: 00007f941ad43a9b CR3: 000000000340a000 CR4: 0000000000350ee0
> > [ 161.329284] Call Trace:
> > [ 161.332373] <IRQ>
> > [ 161.334981] ? 0xffffffffa0185f78 [igc@00000000f400031b+0x13000]
> > [ 161.341949] 0xffffffff8185b047
> > [ 161.345797] 0xffffffff8185b2ca
> > [ 161.349637] 0xffffffff81e000bb
> > [ 161.353465] 0xffffffff81c0109f
> > [ 161.357304] </IRQ>
> > [ 161.359988] 0xffffffff8102cdac
> > [ 161.363783] 0xffffffff810bfdaf
> > [ 161.367584] 0xffffffff81a2e616
> > [ 161.371374] 0xffffffff81c00c9e
> > [ 161.375192] RIP: 0010:0xffffffff817e331b
> > [ 161.379840] Code: 21 90 ff 65 8b 3d 45 23 83 7e e8 80 20 90 ff 31
> > ff 49 89 c6 e8 26 2d 90 ff 80 7d d7 00 0f 85 9e 01 00 00 fb 66 0f 1f
> > 44 00 00 <45> 85 ff 0f 88 cf 00 00 00 49 63 cf 48 8d 04 49 48 8d 14 81
> > 48 c1
> > [ 161.401397] RSP: 0018:ffffc900000d3e80 EFLAGS: 00000246
> > [ 161.407493] RAX: ffff88903fea5180 RBX: ffff88903feadf00 RCX: 000000000000001f
> > [ 161.415648] RDX: 0000000000000000 RSI: 0000000046ec0743 RDI: 0000000000000000
> > [ 161.423811] RBP: ffffc900000d3eb8 R08: 00000025881a3b81 R09: ffff888100317340
> > [ 161.432003] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000003
> > [ 161.440154] R13: ffffffff824c7bc0 R14: 00000025881a3b81 R15: 0000000000000003
> > [ 161.448285] 0xffffffff817e357f
> > [ 161.452123] 0xffffffff810e6258
> > [ 161.455938] 0xffffffff810e63fb
> > [ 161.459746] 0xffffffff8104bec0
> > [ 161.463526] 0xffffffff810000f5
> > [ 161.467290] Modules linked in: pppoe ppp_async nft_fib_inet
> > nf_flow_table_ipv 6 nf_flow_table_ipv4 nf_flow_table_inet wireguard
> > pppox ppp_generic nft_reject_i pv6 nft_reject_ipv4 nft_reject_inet
> > nft_reject nft_redir nft_quota nft_objref nf t_numgen nft_nat nft_masq
> > nft_log nft_limit nft_hash nft_flow_offload nft_fib_ip v6 nft_fib_ipv4
> > nft_fib nft_ct nft_counter nft_chain_nat nf_tables nf_nat nf_flo
> > w_table nf_conntrack libchacha20poly1305 curve25519_x86_64
> > chacha_x86_64 slhc r8 169 poly1305_x86_64 nfnetlink nf_reject_ipv6
> > nf_reject_ipv4 nf_log_ipv6 nf_log_i pv4 nf_log_common nf_defrag_ipv6
> > nf_defrag_ipv4 libcurve25519_generic libcrc32c libchacha igc forcedeth
> > e1000e crc_ccitt bnx2 i2c_dev ixgbe e1000 amd_xgbe ip6_u dp_tunnel
> > udp_tunnel mdio nls_utf8 ena kpp nls_iso8859_1 nls_cp437 vfat fat igb
> > button_hotplug tg3 ptp realtek pps_core mii
> > [ 161.550507] ---[ end trace b1cb18ab2d1741bd ]---
> > [ 161.555938] RIP: 0010:0xffffffff813ce19f
> > [ 161.560634] Code: 03 01 4c 89 48 58 e9 2f ff ff ff 85 db 41 0f 95
> > c2 45 39 d9 41 0f 95 c1 45 84 ca 74 05 45 85 e4 78 0a 44 89 c2 e9 10
> > ff ff ff <0f> 0b 01 d2 45 89 c1 41 29 d1 ba 00 00 00 00 44 0f 48 ca eb
> > 80 cc
> > [ 161.582281] RSP: 0018:ffffc90000118e88 EFLAGS: 00010283
> > [ 161.588426] RAX: ffff888101f8f200 RBX: ffffc900006f9bd0 RCX: 000000000000050e
> > [ 161.596668] RDX: ffff888101fec000 RSI: 0000000000000a1c RDI: 0000000000061a10
> > [ 161.604860] RBP: ffffc90000118ef8 R08: 0000000000000000 R09: 0000000000061502
> > [ 161.613052] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffff3f
> > [ 161.621291] R13: ffff888101f8f140 R14: 0000000000000000 R15: ffff888100ad9b00
> > [ 161.629505] FS: 0000000000000000(0000) GS:ffff88903fe80000(0000)
> > knlGS:00000 00000000000
> > [ 161.638781] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [ 161.645549] CR2: 00007f941ad43a9b CR3: 000000000340a000 CR4: 0000000000350ee0
> > [ 161.653841] Kernel panic - not syncing: Fatal exception in interrupt
> > [ 161.661287] Kernel Offset: disabled
> > [ 161.665644] Rebooting in 3 seconds..
> > [ 164.670313] ACPI MEMORY or I/O RESET_REG.
> >
> > Kyle.
> > _______________________________________________
> > Intel-wired-lan mailing list
> > Intel-wired-lan@osuosl.org
> > https://lists.osuosl.org/mailman/listinfo/intel-wired-lan
>
^ permalink raw reply
* Re: kernel BUG in __skb_gso_segment
From: Willem de Bruijn @ 2022-12-20 18:27 UTC (permalink / raw)
To: Tudor Ambarus
Cc: mst, jasowang, virtualization, edumazet, davem, kuba, pabeni,
netdev, willemb, syzkaller, liuhangbin, linux-kernel, joneslee
In-Reply-To: <82b18028-7246-9af9-c992-528a0e77f6ba@linaro.org>
On Tue, Dec 20, 2022 at 8:21 AM Tudor Ambarus <tudor.ambarus@linaro.org> wrote:
>
> Hi,
>
> There's a bug [1] reported by syzkaller in linux-5.15.y that I'd like
> to squash. The commit in stable that introduces the bug is:
> b99c71f90978 net: skip virtio_net_hdr_set_proto if protocol already set
> The upstream commit for this is:
> 1ed1d592113959f00cc552c3b9f47ca2d157768f
>
> I discovered that in mainline this bug was squashed by the following
> commits:
> e9d3f80935b6 ("net/af_packet: make sure to pull mac header")
> dfed913e8b55 ("net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO")
>
> I'm seeking for some guidance on how to fix linux-5.15.y. From what I
> understand, the bug in stable is triggered because we end up with a
> header offset of 18, that eventually triggers the GSO crash in
> __skb_pull. If I revert the commit in culprit from linux-5.15.y, we'll
> end up with a header offset of 14, the bug is not hit and the packet is
> dropped at validate_xmit_skb() time. I'm wondering if reverting it is
> the right thing to do, as the commit is marked as a fix. Backporting the
> 2 commits from mainline is not an option as they introduce new support.
> Would such a patch be better than reverting the offending commit?
If both patches can be backported without conflicts, in this case I
think that is the preferred solution.
If the fix were obvious that would be an option. But the history for
this code indicates that it isn't. It has a history of fixes for edge
cases.
Backporting the two avoids a fork that would make backporting
additional fixes harder. The first of the two is technically not a
fix, but evidently together they are for this case. And the additional
logic and risk backported seems manageable.
Admittedly that is subjective. I can help take a closer look at a
custom fix if consensus is that is preferable.
^ permalink raw reply
* [RFC net-next 2/2] act_mirred: use the backlog for nested calls to mirred ingress
From: Davide Caratti @ 2022-12-20 18:25 UTC (permalink / raw)
To: netdev
Cc: jhs, jiri, marcelo.leitner, pabeni, wizhao, xiyou.wangcong,
lucien.xin
In-Reply-To: <ae44a3c9e42476d3a0f6edd87873fbea70b520bf.1671560567.git.dcaratti@redhat.com>
William reports kernel soft-lockups on some OVS topologies when TC mirred
egress->ingress action is hit by local TCP traffic [1].
The same can also be reproduced with SCTP (thanks Xin for verifying), when
client and server reach themselves through mirred egress to ingress, and
one of the two peers sends a "heartbeat" packet (from within a timer).
Enqueueing to backlog proved to fix this soft lockup; however, as Cong
noticed [2], we should preserve - when possible - the current mirred
behavior that counts as "overlimits" any eventual packet drop subsequent to
the mirred forwarding action [3]. A compromise solution might use the
backlog only when tcf_mirred_act() has a nest level greater than one:
change tcf_mirred_forward() accordingly.
Also, add a kselftest that can reproduce the lockup and verifies TC mirred
ability to account for further packet drops after TC mirred egress->ingress
(when the nest level is 1).
[1] https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.1663945716.git.dcaratti@redhat.com/
[2] https://lore.kernel.org/netdev/Y0w%2FWWY60gqrtGLp@pop-os.localdomain/
[3] such behavior is not guaranteed: for example, if RPS or skb RX
timestamping is enabled on the mirred target device, the kernel
can defer receiving the skb and return NET_RX_SUCCESS inside
tcf_mirred_forward().
Reported-by: William Zhao <wizhao@redhat.com>
CC: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
---
net/sched/act_mirred.c | 7 +++
.../selftests/net/forwarding/tc_actions.sh | 49 ++++++++++++++++++-
2 files changed, 55 insertions(+), 1 deletion(-)
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index c8abb5136491..8037ec9b1d31 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -206,12 +206,19 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
return err;
}
+static bool is_mirred_nested(void)
+{
+ return unlikely(__this_cpu_read(mirred_nest_level) > 1);
+}
+
static int tcf_mirred_forward(bool want_ingress, struct sk_buff *skb)
{
int err;
if (!want_ingress)
err = tcf_dev_queue_xmit(skb, dev_queue_xmit);
+ else if (is_mirred_nested())
+ err = netif_rx(skb);
else
err = netif_receive_skb(skb);
diff --git a/tools/testing/selftests/net/forwarding/tc_actions.sh b/tools/testing/selftests/net/forwarding/tc_actions.sh
index 1e0a62f638fe..919c0dd9fe4b 100755
--- a/tools/testing/selftests/net/forwarding/tc_actions.sh
+++ b/tools/testing/selftests/net/forwarding/tc_actions.sh
@@ -3,7 +3,8 @@
ALL_TESTS="gact_drop_and_ok_test mirred_egress_redirect_test \
mirred_egress_mirror_test matchall_mirred_egress_mirror_test \
- gact_trap_test mirred_egress_to_ingress_test"
+ gact_trap_test mirred_egress_to_ingress_test \
+ mirred_egress_to_ingress_tcp_test"
NUM_NETIFS=4
source tc_common.sh
source lib.sh
@@ -198,6 +199,52 @@ mirred_egress_to_ingress_test()
log_test "mirred_egress_to_ingress ($tcflags)"
}
+mirred_egress_to_ingress_tcp_test()
+{
+ local tmpfile=$(mktemp) tmpfile1=$(mktemp)
+
+ RET=0
+ dd conv=sparse status=none if=/dev/zero bs=1M count=2 of=$tmpfile
+ tc filter add dev $h1 protocol ip pref 100 handle 100 egress flower \
+ $tcflags ip_proto tcp src_ip 192.0.2.1 dst_ip 192.0.2.2 \
+ action ct commit nat src addr 192.0.2.2 pipe \
+ action ct clear pipe \
+ action ct commit nat dst addr 192.0.2.1 pipe \
+ action ct clear pipe \
+ action skbedit ptype host pipe \
+ action mirred ingress redirect dev $h1
+ tc filter add dev $h1 protocol ip pref 101 handle 101 egress flower \
+ $tcflags ip_proto icmp \
+ action mirred ingress redirect dev $h1
+ tc filter add dev $h1 protocol ip pref 102 handle 102 ingress flower \
+ ip_proto icmp \
+ action drop
+
+ ip vrf exec v$h1 nc --recv-only -w10 -l -p 12345 -o $tmpfile1 &
+ local rpid=$!
+ ip vrf exec v$h1 nc -w1 --send-only 192.0.2.2 12345 <$tmpfile
+ wait -n $rpid
+ cmp -s $tmpfile $tmpfile1
+ check_err $? "server output check failed"
+
+ $MZ $h1 -c 10 -p 64 -a $h1mac -b $h1mac -A 192.0.2.1 -B 192.0.2.1 \
+ -t icmp "ping,id=42,seq=5" -q
+ tc_check_packets "dev $h1 egress" 101 10
+ check_err $? "didn't mirred redirect ICMP"
+ tc_check_packets "dev $h1 ingress" 102 10
+ check_err $? "didn't drop mirred ICMP"
+ local overlimits=$(tc_rule_stats_get ${h1} 101 egress .overlimits)
+ test ${overlimits} = 10
+ check_err $? "wrong overlimits, expected 10 got ${overlimits}"
+
+ tc filter del dev $h1 egress protocol ip pref 100 handle 100 flower
+ tc filter del dev $h1 egress protocol ip pref 101 handle 101 flower
+ tc filter del dev $h1 ingress protocol ip pref 102 handle 102 flower
+
+ rm -f $tmpfile $tmpfile1
+ log_test "mirred_egress_to_ingress_tcp ($tcflags)"
+}
+
setup_prepare()
{
h1=${NETIFS[p1]}
--
2.38.1
^ permalink raw reply related
* [RFC net-next 1/2] net/sched: act_mirred: better wording on protection against excessive stack growth
From: Davide Caratti @ 2022-12-20 18:25 UTC (permalink / raw)
To: netdev
Cc: jhs, jiri, marcelo.leitner, pabeni, wizhao, xiyou.wangcong,
lucien.xin
with commit e2ca070f89ec ("net: sched: protect against stack overflow in
TC act_mirred"), act_mirred protected itself against excessive stack growth
using per_cpu counter of nested calls to tcf_mirred_act(), and capping it
to MIRRED_RECURSION_LIMIT. However, such protection does not detect
recursion/loops in case the packet is enqueued to the backlog (for example,
when the mirred target device has RPS or skb timestamping enabled). Change
the wording from "recursion" to "nesting" to make it more clear to readers.
CC: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
---
net/sched/act_mirred.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 7284bcea7b0b..c8abb5136491 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -29,8 +29,8 @@
static LIST_HEAD(mirred_list);
static DEFINE_SPINLOCK(mirred_list_lock);
-#define MIRRED_RECURSION_LIMIT 4
-static DEFINE_PER_CPU(unsigned int, mirred_rec_level);
+#define MIRRED_NEST_LIMIT 4
+static DEFINE_PER_CPU(unsigned int, mirred_nest_level);
static bool tcf_mirred_is_act_redirect(int action)
{
@@ -226,7 +226,7 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,
struct sk_buff *skb2 = skb;
bool m_mac_header_xmit;
struct net_device *dev;
- unsigned int rec_level;
+ unsigned int nest_level;
int retval, err = 0;
bool use_reinsert;
bool want_ingress;
@@ -237,11 +237,11 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,
int mac_len;
bool at_nh;
- rec_level = __this_cpu_inc_return(mirred_rec_level);
- if (unlikely(rec_level > MIRRED_RECURSION_LIMIT)) {
+ nest_level = __this_cpu_inc_return(mirred_nest_level);
+ if (unlikely(nest_level > MIRRED_NEST_LIMIT)) {
net_warn_ratelimited("Packet exceeded mirred recursion limit on dev %s\n",
netdev_name(skb->dev));
- __this_cpu_dec(mirred_rec_level);
+ __this_cpu_dec(mirred_nest_level);
return TC_ACT_SHOT;
}
@@ -310,7 +310,7 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,
err = tcf_mirred_forward(want_ingress, skb);
if (err)
tcf_action_inc_overlimit_qstats(&m->common);
- __this_cpu_dec(mirred_rec_level);
+ __this_cpu_dec(mirred_nest_level);
return TC_ACT_CONSUMED;
}
}
@@ -322,7 +322,7 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,
if (tcf_mirred_is_act_redirect(m_eaction))
retval = TC_ACT_SHOT;
}
- __this_cpu_dec(mirred_rec_level);
+ __this_cpu_dec(mirred_nest_level);
return retval;
}
--
2.38.1
^ permalink raw reply related
* Re: [RFC bpf-next 2/8] net: introduce XDP features flag
From: Stanislav Fomichev @ 2022-12-20 18:03 UTC (permalink / raw)
To: Lorenzo Bianconi
Cc: Marek Majtyka, Lorenzo Bianconi, bpf, netdev, ast, daniel, andrii,
davem, kuba, hawk, pabeni, edumazet, toke, memxor, saeedm,
anthony.l.nguyen, gospo, vladimir.oltean, nbd, john, leon,
simon.horman, aelior, christophe.jaillet, ecree.xilinx,
grygorii.strashko, mst, bjorn, magnus.karlsson,
maciej.fijalkowski, intel-wired-lan
In-Reply-To: <Y6GKN/1iOC9eTsEE@lore-desk>
On Tue, Dec 20, 2022 at 2:11 AM Lorenzo Bianconi
<lorenzo.bianconi@redhat.com> wrote:
>
> On Dec 19, Stanislav Fomichev wrote:
> > On Mon, Dec 19, 2022 at 3:51 PM Marek Majtyka <alardam@gmail.com> wrote:
> > >
> > > At the time of writing, I wanted to be able to read additional information about the XDP capabilities of each network interface using ethtool. This change was intended for Linux users/admins, and not for XDP experts who mostly don't need it and prefer tasting XDP with netlink and bpf rather than reading network interface features with ethtool.
> >
> > Anything preventing ethtool from doing probing similar to 'bpftool
> > feature probe'?
> > The problem with these feature bits is that they might diverge and/or
> > not work at all for the backported patches (where the fix/feature has
> > been backported, but the part that exports the bit hasn't) :-(
> > OTOH, I'm not sure we can probe everything from your list, but we
> > might try and see what's missing..
>
> Hi Stanislav,
>
> I have not added the ethtool support to this series yet since userspace part is
> still missing but I think we can consider XDP as a sort of sw offload so it
> would be nice for the user/sysadmin (not xdp or bpf developer) to check the NIC
> XDP capabilities similar to what we can already do for other hw offload
> features.
[..]
> Moreover let's consider XDP_REDIRECT of a scatter-gather XDP frame into a
> devmap. I do not think there is a way to test if the 'target' device supports
> SG and so we are forced to disable this feature until all drivers support it.
See below for more questions, but why "target device has prog
installed and the aux->xdp_has_frags == true" won't work for the
internal kernel consumers?
> Introducing XDP features we can enable it on per-driver basis.
> I think the same apply for other capabilities as well and just assuming a given
> feature is not supported if an e2e test is not working seems a bit inaccurate.
Ok, I see that these bits are used in the later patches in xsk and
devmap. But I guess I'm still confused about why we add all these
flags, but only use mostly XDP_F_REDIRECT_TARGET; maybe start with
that one? And why does it have to be exposed to the userspace?
(userspace can still probe per-device features by trying to load
different progs?)
Also, it seems like XDP_F_REDIRECT_TARGET really means "the bpf
program has been installed on this device". Instead of a flag, why not
explicitly check whether the target device has a prog installed (and,
if needed, whether the installed program has frags support)?
> Regards,
> Lorenzo
>
> >
> > > On Mon, Dec 19, 2022 at 9:03 PM <sdf@google.com> wrote:
> > >>
> > >> On 12/19, Lorenzo Bianconi wrote:
> > >> > From: Marek Majtyka <alardam@gmail.com>
> > >>
> > >> > Implement support for checking what kind of XDP features a netdev
> > >> > supports. Previously, there was no way to do this other than to try to
> > >> > create an AF_XDP socket on the interface or load an XDP program and see
> > >> > if it worked. This commit changes this by adding a new variable which
> > >> > describes all xdp supported functions on pretty detailed level:
> > >>
> > >> > - aborted
> > >> > - drop
> > >> > - pass
> > >> > - tx
> > >> > - redirect
> > >> > - sock_zerocopy
> > >> > - hw_offload
> > >> > - redirect_target
> > >> > - tx_lock
> > >> > - frag_rx
> > >> > - frag_target
> > >>
> > >> > Zerocopy mode requires that redirect XDP operation is implemented in a
> > >> > driver and the driver supports also zero copy mode. Full mode requires
> > >> > that all XDP operation are implemented in the driver. Basic mode is just
> > >> > full mode without redirect operation. Frag target requires
> > >> > redirect_target one is supported by the driver.
> > >>
> > >> Can you share more about _why_ is it needed? If we can already obtain
> > >> most of these signals via probing, why export the flags?
> > >>
> > >> > Initially, these new flags are disabled for all drivers by default.
> > >>
> > >> > Co-developed-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> > >> > Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> > >> > Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
> > >> > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> > >> > Signed-off-by: Marek Majtyka <alardam@gmail.com>
> > >> > ---
> > >> > .../networking/netdev-xdp-features.rst | 60 +++++++++++++++++
> > >> > include/linux/netdevice.h | 2 +
> > >> > include/linux/xdp_features.h | 64 +++++++++++++++++++
> > >> > include/uapi/linux/if_link.h | 7 ++
> > >> > include/uapi/linux/xdp_features.h | 34 ++++++++++
> > >> > net/core/rtnetlink.c | 34 ++++++++++
> > >> > tools/include/uapi/linux/if_link.h | 7 ++
> > >> > tools/include/uapi/linux/xdp_features.h | 34 ++++++++++
> > >> > 8 files changed, 242 insertions(+)
> > >> > create mode 100644 Documentation/networking/netdev-xdp-features.rst
> > >> > create mode 100644 include/linux/xdp_features.h
> > >> > create mode 100644 include/uapi/linux/xdp_features.h
> > >> > create mode 100644 tools/include/uapi/linux/xdp_features.h
> > >>
> > >> > diff --git a/Documentation/networking/netdev-xdp-features.rst
> > >> > b/Documentation/networking/netdev-xdp-features.rst
> > >> > new file mode 100644
> > >> > index 000000000000..1dc803fe72dd
> > >> > --- /dev/null
> > >> > +++ b/Documentation/networking/netdev-xdp-features.rst
> > >> > @@ -0,0 +1,60 @@
> > >> > +.. SPDX-License-Identifier: GPL-2.0
> > >> > +
> > >> > +=====================
> > >> > +Netdev XDP features
> > >> > +=====================
> > >> > +
> > >> > + * XDP FEATURES FLAGS
> > >> > +
> > >> > +Following netdev xdp features flags can be retrieved over route netlink
> > >> > +interface (compact form) - the same way as netdev feature flags.
> > >> > +These features flags are read only and cannot be change at runtime.
> > >> > +
> > >> > +* XDP_ABORTED
> > >> > +
> > >> > +This feature informs if netdev supports xdp aborted action.
> > >> > +
> > >> > +* XDP_DROP
> > >> > +
> > >> > +This feature informs if netdev supports xdp drop action.
> > >> > +
> > >> > +* XDP_PASS
> > >> > +
> > >> > +This feature informs if netdev supports xdp pass action.
> > >> > +
> > >> > +* XDP_TX
> > >> > +
> > >> > +This feature informs if netdev supports xdp tx action.
> > >> > +
> > >> > +* XDP_REDIRECT
> > >> > +
> > >> > +This feature informs if netdev supports xdp redirect action.
> > >> > +It assumes the all beforehand mentioned flags are enabled.
> > >> > +
> > >> > +* XDP_SOCK_ZEROCOPY
> > >> > +
> > >> > +This feature informs if netdev driver supports xdp zero copy.
> > >> > +It assumes the all beforehand mentioned flags are enabled.
> > >> > +
> > >> > +* XDP_HW_OFFLOAD
> > >> > +
> > >> > +This feature informs if netdev driver supports xdp hw oflloading.
> > >> > +
> > >> > +* XDP_TX_LOCK
> > >> > +
> > >> > +This feature informs if netdev ndo_xdp_xmit function requires locking.
> > >> > +
> > >> > +* XDP_REDIRECT_TARGET
> > >> > +
> > >> > +This feature informs if netdev implements ndo_xdp_xmit callback.
> > >> > +
> > >> > +* XDP_FRAG_RX
> > >> > +
> > >> > +This feature informs if netdev implements non-linear xdp buff support in
> > >> > +the driver napi callback.
> > >> > +
> > >> > +* XDP_FRAG_TARGET
> > >> > +
> > >> > +This feature informs if netdev implements non-linear xdp buff support in
> > >> > +ndo_xdp_xmit callback. XDP_FRAG_TARGET requires XDP_REDIRECT_TARGET is
> > >> > properly
> > >> > +supported.
> > >> > diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
> > >> > index aad12a179e54..ae5a8564383b 100644
> > >> > --- a/include/linux/netdevice.h
> > >> > +++ b/include/linux/netdevice.h
> > >> > @@ -43,6 +43,7 @@
> > >> > #include <net/xdp.h>
> > >>
> > >> > #include <linux/netdev_features.h>
> > >> > +#include <linux/xdp_features.h>
> > >> > #include <linux/neighbour.h>
> > >> > #include <uapi/linux/netdevice.h>
> > >> > #include <uapi/linux/if_bonding.h>
> > >> > @@ -2362,6 +2363,7 @@ struct net_device {
> > >> > struct rtnl_hw_stats64 *offload_xstats_l3;
> > >>
> > >> > struct devlink_port *devlink_port;
> > >> > + xdp_features_t xdp_features;
> > >> > };
> > >> > #define to_net_dev(d) container_of(d, struct net_device, dev)
> > >>
> > >> > diff --git a/include/linux/xdp_features.h b/include/linux/xdp_features.h
> > >> > new file mode 100644
> > >> > index 000000000000..4e72a86ef329
> > >> > --- /dev/null
> > >> > +++ b/include/linux/xdp_features.h
> > >> > @@ -0,0 +1,64 @@
> > >> > +/* SPDX-License-Identifier: GPL-2.0-or-later */
> > >> > +/*
> > >> > + * Network device xdp features.
> > >> > + */
> > >> > +#ifndef _LINUX_XDP_FEATURES_H
> > >> > +#define _LINUX_XDP_FEATURES_H
> > >> > +
> > >> > +#include <linux/types.h>
> > >> > +#include <linux/bitops.h>
> > >> > +#include <asm/byteorder.h>
> > >> > +#include <uapi/linux/xdp_features.h>
> > >> > +
> > >> > +typedef u32 xdp_features_t;
> > >> > +
> > >> > +#define __XDP_F_BIT(bit) ((xdp_features_t)1 << (bit))
> > >> > +#define __XDP_F(name) __XDP_F_BIT(XDP_F_##name##_BIT)
> > >> > +
> > >> > +#define XDP_F_ABORTED __XDP_F(ABORTED)
> > >> > +#define XDP_F_DROP __XDP_F(DROP)
> > >> > +#define XDP_F_PASS __XDP_F(PASS)
> > >> > +#define XDP_F_TX __XDP_F(TX)
> > >> > +#define XDP_F_REDIRECT __XDP_F(REDIRECT)
> > >> > +#define XDP_F_REDIRECT_TARGET __XDP_F(REDIRECT_TARGET)
> > >> > +#define XDP_F_SOCK_ZEROCOPY __XDP_F(SOCK_ZEROCOPY)
> > >> > +#define XDP_F_HW_OFFLOAD __XDP_F(HW_OFFLOAD)
> > >> > +#define XDP_F_TX_LOCK __XDP_F(TX_LOCK)
> > >> > +#define XDP_F_FRAG_RX __XDP_F(FRAG_RX)
> > >> > +#define XDP_F_FRAG_TARGET __XDP_F(FRAG_TARGET)
> > >> > +
> > >> > +#define XDP_F_BASIC (XDP_F_ABORTED | XDP_F_DROP | \
> > >> > + XDP_F_PASS | XDP_F_TX)
> > >> > +
> > >> > +#define XDP_F_FULL (XDP_F_BASIC | XDP_F_REDIRECT)
> > >> > +
> > >> > +#define XDP_F_FULL_ZC (XDP_F_FULL | XDP_F_SOCK_ZEROCOPY)
> > >> > +
> > >> > +#define XDP_FEATURES_ABORTED_STR "xdp-aborted"
> > >> > +#define XDP_FEATURES_DROP_STR "xdp-drop"
> > >> > +#define XDP_FEATURES_PASS_STR "xdp-pass"
> > >> > +#define XDP_FEATURES_TX_STR "xdp-tx"
> > >> > +#define XDP_FEATURES_REDIRECT_STR "xdp-redirect"
> > >> > +#define XDP_FEATURES_REDIRECT_TARGET_STR "xdp-redirect-target"
> > >> > +#define XDP_FEATURES_SOCK_ZEROCOPY_STR "xdp-sock-zerocopy"
> > >> > +#define XDP_FEATURES_HW_OFFLOAD_STR "xdp-hw-offload"
> > >> > +#define XDP_FEATURES_TX_LOCK_STR "xdp-tx-lock"
> > >> > +#define XDP_FEATURES_FRAG_RX_STR "xdp-frag-rx"
> > >> > +#define XDP_FEATURES_FRAG_TARGET_STR "xdp-frag-target"
> > >> > +
> > >> > +#define DECLARE_XDP_FEATURES_TABLE(name, length) \
> > >> > + const char name[][length] = { \
> > >> > + [XDP_F_ABORTED_BIT] = XDP_FEATURES_ABORTED_STR, \
> > >> > + [XDP_F_DROP_BIT] = XDP_FEATURES_DROP_STR, \
> > >> > + [XDP_F_PASS_BIT] = XDP_FEATURES_PASS_STR, \
> > >> > + [XDP_F_TX_BIT] = XDP_FEATURES_TX_STR, \
> > >> > + [XDP_F_REDIRECT_BIT] = XDP_FEATURES_REDIRECT_STR, \
> > >> > + [XDP_F_REDIRECT_TARGET_BIT] = XDP_FEATURES_REDIRECT_TARGET_STR, \
> > >> > + [XDP_F_SOCK_ZEROCOPY_BIT] = XDP_FEATURES_SOCK_ZEROCOPY_STR, \
> > >> > + [XDP_F_HW_OFFLOAD_BIT] = XDP_FEATURES_HW_OFFLOAD_STR, \
> > >> > + [XDP_F_TX_LOCK_BIT] = XDP_FEATURES_TX_LOCK_STR, \
> > >> > + [XDP_F_FRAG_RX_BIT] = XDP_FEATURES_FRAG_RX_STR, \
> > >> > + [XDP_F_FRAG_TARGET_BIT] = XDP_FEATURES_FRAG_TARGET_STR, \
> > >> > + }
> > >> > +
> > >> > +#endif /* _LINUX_XDP_FEATURES_H */
> > >> > diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
> > >> > index 1021a7e47a86..971c658ceaea 100644
> > >> > --- a/include/uapi/linux/if_link.h
> > >> > +++ b/include/uapi/linux/if_link.h
> > >> > @@ -374,6 +374,8 @@ enum {
> > >>
> > >> > IFLA_DEVLINK_PORT,
> > >>
> > >> > + IFLA_XDP_FEATURES,
> > >> > +
> > >> > __IFLA_MAX
> > >> > };
> > >>
> > >> > @@ -1318,6 +1320,11 @@ enum {
> > >>
> > >> > #define IFLA_XDP_MAX (__IFLA_XDP_MAX - 1)
> > >>
> > >> > +enum {
> > >> > + IFLA_XDP_FEATURES_WORD_UNSPEC = 0,
> > >> > + IFLA_XDP_FEATURES_BITS_WORD,
> > >> > +};
> > >> > +
> > >> > enum {
> > >> > IFLA_EVENT_NONE,
> > >> > IFLA_EVENT_REBOOT, /* internal reset / reboot */
> > >> > diff --git a/include/uapi/linux/xdp_features.h
> > >> > b/include/uapi/linux/xdp_features.h
> > >> > new file mode 100644
> > >> > index 000000000000..48eb42069bcd
> > >> > --- /dev/null
> > >> > +++ b/include/uapi/linux/xdp_features.h
> > >> > @@ -0,0 +1,34 @@
> > >> > +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
> > >> > +/*
> > >> > + * Copyright (c) 2020 Intel
> > >> > + */
> > >> > +
> > >> > +#ifndef __UAPI_LINUX_XDP_FEATURES__
> > >> > +#define __UAPI_LINUX_XDP_FEATURES__
> > >> > +
> > >> > +enum {
> > >> > + XDP_F_ABORTED_BIT,
> > >> > + XDP_F_DROP_BIT,
> > >> > + XDP_F_PASS_BIT,
> > >> > + XDP_F_TX_BIT,
> > >> > + XDP_F_REDIRECT_BIT,
> > >> > + XDP_F_REDIRECT_TARGET_BIT,
> > >> > + XDP_F_SOCK_ZEROCOPY_BIT,
> > >> > + XDP_F_HW_OFFLOAD_BIT,
> > >> > + XDP_F_TX_LOCK_BIT,
> > >> > + XDP_F_FRAG_RX_BIT,
> > >> > + XDP_F_FRAG_TARGET_BIT,
> > >> > + /*
> > >> > + * Add your fresh new property above and remember to update
> > >> > + * documentation.
> > >> > + */
> > >> > + XDP_FEATURES_COUNT,
> > >> > +};
> > >> > +
> > >> > +#define XDP_FEATURES_WORDS ((XDP_FEATURES_COUNT + 32 - 1) / 32)
> > >> > +#define XDP_FEATURES_WORD(blocks, index) ((blocks)[(index) / 32U])
> > >> > +#define XDP_FEATURES_FIELD_FLAG(index) (1U << (index) % 32U)
> > >> > +#define XDP_FEATURES_BIT_IS_SET(blocks, index) \
> > >> > + (XDP_FEATURES_WORD(blocks, index) & XDP_FEATURES_FIELD_FLAG(index))
> > >> > +
> > >> > +#endif /* __UAPI_LINUX_XDP_FEATURES__ */
> > >> > diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> > >> > index 64289bc98887..1c299746b614 100644
> > >> > --- a/net/core/rtnetlink.c
> > >> > +++ b/net/core/rtnetlink.c
> > >> > @@ -1016,6 +1016,14 @@ static size_t rtnl_xdp_size(void)
> > >> > return xdp_size;
> > >> > }
> > >>
> > >> > +static size_t rtnl_xdp_features_size(void)
> > >> > +{
> > >> > + size_t xdp_size = nla_total_size(0) + /* nest IFLA_XDP_FEATURES */
> > >> > + XDP_FEATURES_WORDS * nla_total_size(4);
> > >> > +
> > >> > + return xdp_size;
> > >> > +}
> > >> > +
> > >> > static size_t rtnl_prop_list_size(const struct net_device *dev)
> > >> > {
> > >> > struct netdev_name_node *name_node;
> > >> > @@ -1103,6 +1111,7 @@ static noinline size_t if_nlmsg_size(const struct
> > >> > net_device *dev,
> > >> > + rtnl_prop_list_size(dev)
> > >> > + nla_total_size(MAX_ADDR_LEN) /* IFLA_PERM_ADDRESS */
> > >> > + rtnl_devlink_port_size(dev)
> > >> > + + rtnl_xdp_features_size() /* IFLA_XDP_FEATURES */
> > >> > + 0;
> > >> > }
> > >>
> > >> > @@ -1546,6 +1555,27 @@ static int rtnl_xdp_fill(struct sk_buff *skb,
> > >> > struct net_device *dev)
> > >> > return err;
> > >> > }
> > >>
> > >> > +static int rtnl_xdp_features_fill(struct sk_buff *skb, struct net_device
> > >> > *dev)
> > >> > +{
> > >> > + struct nlattr *attr;
> > >> > +
> > >> > + attr = nla_nest_start_noflag(skb, IFLA_XDP_FEATURES);
> > >> > + if (!attr)
> > >> > + return -EMSGSIZE;
> > >> > +
> > >> > + BUILD_BUG_ON(XDP_FEATURES_WORDS != 1);
> > >> > + if (nla_put_u32(skb, IFLA_XDP_FEATURES_BITS_WORD, dev->xdp_features))
> > >> > + goto err_cancel;
> > >> > +
> > >> > + nla_nest_end(skb, attr);
> > >> > +
> > >> > + return 0;
> > >> > +
> > >> > +err_cancel:
> > >> > + nla_nest_cancel(skb, attr);
> > >> > + return -EMSGSIZE;
> > >> > +}
> > >> > +
> > >> > static u32 rtnl_get_event(unsigned long event)
> > >> > {
> > >> > u32 rtnl_event_type = IFLA_EVENT_NONE;
> > >> > @@ -1904,6 +1934,9 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
> > >> > if (rtnl_fill_devlink_port(skb, dev))
> > >> > goto nla_put_failure;
> > >>
> > >> > + if (rtnl_xdp_features_fill(skb, dev))
> > >> > + goto nla_put_failure;
> > >> > +
> > >> > nlmsg_end(skb, nlh);
> > >> > return 0;
> > >>
> > >> > @@ -1968,6 +2001,7 @@ static const struct nla_policy
> > >> > ifla_policy[IFLA_MAX+1] = {
> > >> > [IFLA_TSO_MAX_SIZE] = { .type = NLA_REJECT },
> > >> > [IFLA_TSO_MAX_SEGS] = { .type = NLA_REJECT },
> > >> > [IFLA_ALLMULTI] = { .type = NLA_REJECT },
> > >> > + [IFLA_XDP_FEATURES] = { .type = NLA_NESTED },
> > >> > };
> > >>
> > >> > static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
> > >> > diff --git a/tools/include/uapi/linux/if_link.h
> > >> > b/tools/include/uapi/linux/if_link.h
> > >> > index 82fe18f26db5..994228e9909a 100644
> > >> > --- a/tools/include/uapi/linux/if_link.h
> > >> > +++ b/tools/include/uapi/linux/if_link.h
> > >> > @@ -354,6 +354,8 @@ enum {
> > >>
> > >> > IFLA_DEVLINK_PORT,
> > >>
> > >> > + IFLA_XDP_FEATURES,
> > >> > +
> > >> > __IFLA_MAX
> > >> > };
> > >>
> > >> > @@ -1222,6 +1224,11 @@ enum {
> > >>
> > >> > #define IFLA_XDP_MAX (__IFLA_XDP_MAX - 1)
> > >>
> > >> > +enum {
> > >> > + IFLA_XDP_FEATURES_WORD_UNSPEC = 0,
> > >> > + IFLA_XDP_FEATURES_BITS_WORD,
> > >> > +};
> > >> > +
> > >> > enum {
> > >> > IFLA_EVENT_NONE,
> > >> > IFLA_EVENT_REBOOT, /* internal reset / reboot */
> > >> > diff --git a/tools/include/uapi/linux/xdp_features.h
> > >> > b/tools/include/uapi/linux/xdp_features.h
> > >> > new file mode 100644
> > >> > index 000000000000..48eb42069bcd
> > >> > --- /dev/null
> > >> > +++ b/tools/include/uapi/linux/xdp_features.h
> > >> > @@ -0,0 +1,34 @@
> > >> > +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
> > >> > +/*
> > >> > + * Copyright (c) 2020 Intel
> > >> > + */
> > >> > +
> > >> > +#ifndef __UAPI_LINUX_XDP_FEATURES__
> > >> > +#define __UAPI_LINUX_XDP_FEATURES__
> > >> > +
> > >> > +enum {
> > >> > + XDP_F_ABORTED_BIT,
> > >> > + XDP_F_DROP_BIT,
> > >> > + XDP_F_PASS_BIT,
> > >> > + XDP_F_TX_BIT,
> > >> > + XDP_F_REDIRECT_BIT,
> > >> > + XDP_F_REDIRECT_TARGET_BIT,
> > >> > + XDP_F_SOCK_ZEROCOPY_BIT,
> > >> > + XDP_F_HW_OFFLOAD_BIT,
> > >> > + XDP_F_TX_LOCK_BIT,
> > >> > + XDP_F_FRAG_RX_BIT,
> > >> > + XDP_F_FRAG_TARGET_BIT,
> > >> > + /*
> > >> > + * Add your fresh new property above and remember to update
> > >> > + * documentation.
> > >> > + */
> > >> > + XDP_FEATURES_COUNT,
> > >> > +};
> > >> > +
> > >> > +#define XDP_FEATURES_WORDS ((XDP_FEATURES_COUNT + 32 - 1) / 32)
> > >> > +#define XDP_FEATURES_WORD(blocks, index) ((blocks)[(index) / 32U])
> > >> > +#define XDP_FEATURES_FIELD_FLAG(index) (1U << (index) % 32U)
> > >> > +#define XDP_FEATURES_BIT_IS_SET(blocks, index) \
> > >> > + (XDP_FEATURES_WORD(blocks, index) & XDP_FEATURES_FIELD_FLAG(index))
> > >> > +
> > >> > +#endif /* __UAPI_LINUX_XDP_FEATURES__ */
> > >> > --
> > >> > 2.38.1
> > >>
> >
^ permalink raw reply
* Re: [PATCH v2 4/9] dt-bindings: net: Add bindings for StarFive dwmac
From: Rob Herring @ 2022-12-20 18:03 UTC (permalink / raw)
To: Yanhong Wang
Cc: linux-riscv, netdev, devicetree, linux-kernel, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Krzysztof Kozlowski,
Emil Renner Berthing, Richard Cochran, Andrew Lunn,
Heiner Kallweit, Peter Geis
In-Reply-To: <20221216070632.11444-5-yanhong.wang@starfivetech.com>
On Fri, Dec 16, 2022 at 03:06:27PM +0800, Yanhong Wang wrote:
> Add documentation to describe StarFive dwmac driver(GMAC).
>
> Signed-off-by: Yanhong Wang <yanhong.wang@starfivetech.com>
> ---
> .../devicetree/bindings/net/snps,dwmac.yaml | 1 +
> .../bindings/net/starfive,jh71x0-dwmac.yaml | 103 ++++++++++++++++++
> MAINTAINERS | 5 +
> 3 files changed, 109 insertions(+)
> create mode 100644 Documentation/devicetree/bindings/net/starfive,jh71x0-dwmac.yaml
>
> diff --git a/Documentation/devicetree/bindings/net/snps,dwmac.yaml b/Documentation/devicetree/bindings/net/snps,dwmac.yaml
> index 7870228b4cd3..cdb045d1c618 100644
> --- a/Documentation/devicetree/bindings/net/snps,dwmac.yaml
> +++ b/Documentation/devicetree/bindings/net/snps,dwmac.yaml
> @@ -91,6 +91,7 @@ properties:
> - snps,dwmac-5.20
> - snps,dwxgmac
> - snps,dwxgmac-2.10
> + - starfive,jh7110-dwmac
>
> reg:
> minItems: 1
> diff --git a/Documentation/devicetree/bindings/net/starfive,jh71x0-dwmac.yaml b/Documentation/devicetree/bindings/net/starfive,jh71x0-dwmac.yaml
> new file mode 100644
> index 000000000000..5cb1272fe959
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/net/starfive,jh71x0-dwmac.yaml
> @@ -0,0 +1,103 @@
> +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +# Copyright (C) 2022 StarFive Technology Co., Ltd.
> +%YAML 1.2
> +---
> +$id: http://devicetree.org/schemas/net/starfive,jh71x0-dwmac.yaml#
> +$schema: http://devicetree.org/meta-schemas/core.yaml#
> +
> +title: StarFive JH71x0 DWMAC glue layer
> +
> +maintainers:
> + - Yanhong Wang <yanhong.wang@starfivetech.com>
> +
> +select:
> + properties:
> + compatible:
> + contains:
> + enum:
> + - starfive,jh7110-dwmac
> + required:
> + - compatible
> +
> +allOf:
> + - $ref: snps,dwmac.yaml#
> +
> +properties:
> + compatible:
> + items:
> + - enum:
> + - starfive,jh7110-dwmac
> + - const: snps,dwmac-5.20
> +
> + clocks:
> + items:
> + - description: GMAC main clock
> + - description: GMAC AHB clock
> + - description: PTP clock
> + - description: TX clock
> + - description: GTXC clock
> + - description: GTX clock
> +
> + clock-names:
> + items:
> + - const: stmmaceth
> + - const: pclk
> + - const: ptp_ref
> + - const: tx
> + - const: gtxc
> + - const: gtx
> +
> +required:
> + - compatible
> + - clocks
> + - clock-names
> + - resets
> + - reset-names
> +
> +unevaluatedProperties: false
> +
> +examples:
> + - |
> + stmmac_axi_setup: stmmac-axi-config {
The schema says put this as a child node of ethernet@16030000.
> + snps,lpi_en;
> + snps,wr_osr_lmt = <4>;
> + snps,rd_osr_lmt = <4>;
> + snps,blen = <256 128 64 32 0 0 0>;
> + };
> +
> + gmac0: ethernet@16030000 {
Drop unused labels.
> + compatible = "starfive,jh7110-dwmac", "snps,dwmac-5.20";
> + reg = <0x16030000 0x10000>;
> + clocks = <&clk 3>, <&clk 2>, <&clk 109>,
> + <&clk 5>, <&clk 111>, <&clk 108>;
> + clock-names = "stmmaceth", "pclk", "ptp_ref",
> + "tx", "gtxc", "gtx";
> + resets = <&rst 1>, <&rst 2>;
> + reset-names = "stmmaceth", "ahb";
> + interrupts = <7>, <6>, <5>;
> + interrupt-names = "macirq", "eth_wake_irq", "eth_lpi";
> + phy-mode = "rgmii-id";
> + snps,multicast-filter-bins = <64>;
> + snps,perfect-filter-entries = <8>;
> + rx-fifo-depth = <2048>;
> + tx-fifo-depth = <2048>;
> + snps,fixed-burst;
> + snps,no-pbl-x8;
> + snps,tso;
> + snps,force_thresh_dma_mode;
> + snps,axi-config = <&stmmac_axi_setup>;
> + snps,en-tx-lpi-clockgating;
> + snps,txpbl = <16>;
> + snps,rxpbl = <16>;
> + phy-handle = <&phy0>;
> +
> + mdio {
> + #address-cells = <1>;
> + #size-cells = <0>;
> + compatible = "snps,dwmac-mdio";
> +
> + phy0: ethernet-phy@0 {
> + reg = <0>;
> + };
> + };
> + };
> diff --git a/MAINTAINERS b/MAINTAINERS
> index a70c1d0f303e..166b0009f63c 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -19606,6 +19606,11 @@ F: Documentation/devicetree/bindings/clock/starfive*
> F: drivers/clk/starfive/
> F: include/dt-bindings/clock/starfive*
>
> +STARFIVE DWMAC GLUE LAYER
> +M: Yanhong Wang <yanhong.wang@starfivetech.com>
> +S: Maintained
> +F: Documentation/devicetree/bindings/net/starfive,jh71x0-dwmac.yaml
> +
> STARFIVE PINCTRL DRIVER
> M: Emil Renner Berthing <kernel@esmil.dk>
> M: Jianlong Huang <jianlong.huang@starfivetech.com>
> --
> 2.17.1
>
>
^ permalink raw reply
* [PATCH net 1/1] ice: xsk: do not use xdp_return_frame() on tx_buf->raw_buf
From: Tony Nguyen @ 2022-12-20 17:54 UTC (permalink / raw)
To: davem, kuba, pabeni, edumazet
Cc: Maciej Fijalkowski, netdev, anthony.l.nguyen, magnus.karlsson,
ast, daniel, hawk, john.fastabend, bpf, Robin Cowley,
Chandan Kumar Rout
From: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Previously ice XDP xmit routine was changed in a way that it avoids
xdp_buff->xdp_frame conversion as it is simply not needed for handling
XDP_TX action and what is more it saves us CPU cycles. This routine is
re-used on ZC driver to handle XDP_TX action.
Although for XDP_TX on Rx ZC xdp_buff that comes from xsk_buff_pool is
converted to xdp_frame, xdp_frame itself is not stored inside
ice_tx_buf, we only store raw data pointer. Casting this pointer to
xdp_frame and calling against it xdp_return_frame in
ice_clean_xdp_tx_buf() results in undefined behavior.
To fix this, simply call page_frag_free() on tx_buf->raw_buf.
Later intention is to remove the buff->frame conversion in order to
simplify the codebase and improve XDP_TX performance on ZC.
Fixes: 126cdfe1007a ("ice: xsk: Improve AF_XDP ZC Tx and use batching API")
Reported-and-tested-by: Robin Cowley <robin.cowley@thehutgroup.com>
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> (A Contingent Worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/ice/ice_xsk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_xsk.c b/drivers/net/ethernet/intel/ice/ice_xsk.c
index 907055b77af0..7105de6fb344 100644
--- a/drivers/net/ethernet/intel/ice/ice_xsk.c
+++ b/drivers/net/ethernet/intel/ice/ice_xsk.c
@@ -783,7 +783,7 @@ int ice_clean_rx_irq_zc(struct ice_rx_ring *rx_ring, int budget)
static void
ice_clean_xdp_tx_buf(struct ice_tx_ring *xdp_ring, struct ice_tx_buf *tx_buf)
{
- xdp_return_frame((struct xdp_frame *)tx_buf->raw_buf);
+ page_frag_free(tx_buf->raw_buf);
xdp_ring->xdp_tx_active--;
dma_unmap_single(xdp_ring->dev, dma_unmap_addr(tx_buf, dma),
dma_unmap_len(tx_buf, len), DMA_TO_DEVICE);
--
2.35.1
^ permalink raw reply related
* Re: [PATCH v7 11/11] dt-bindings: net: dsa: qca8k: add LEDs definition example
From: Rob Herring @ 2022-12-20 17:39 UTC (permalink / raw)
To: Christian Marangi
Cc: Andrew Lunn, Florian Fainelli, Vladimir Oltean, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Krzysztof Kozlowski,
Jonathan Corbet, Pavel Machek, Russell King (Oracle),
John Crispin, netdev, devicetree, linux-kernel, linux-doc,
linux-leds, Tim Harvey, Alexander Stein, Rasmus Villemoes
In-Reply-To: <20221214235438.30271-12-ansuelsmth@gmail.com>
On Thu, Dec 15, 2022 at 12:54:38AM +0100, Christian Marangi wrote:
> Add LEDs definition example for qca8k using the offload trigger as the
> default trigger and add all the supported offload triggers by the
> switch.
>
> Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
> ---
> .../devicetree/bindings/net/dsa/qca8k.yaml | 24 +++++++++++++++++++
> 1 file changed, 24 insertions(+)
>
> diff --git a/Documentation/devicetree/bindings/net/dsa/qca8k.yaml b/Documentation/devicetree/bindings/net/dsa/qca8k.yaml
> index 978162df51f7..4090cf65c41c 100644
> --- a/Documentation/devicetree/bindings/net/dsa/qca8k.yaml
> +++ b/Documentation/devicetree/bindings/net/dsa/qca8k.yaml
> @@ -65,6 +65,8 @@ properties:
> internal mdio access is used.
> With the legacy mapping the reg corresponding to the internal
> mdio is the switch reg with an offset of -1.
> + Each phy have at least 3 LEDs connected and can be declared
> + using the standard LEDs structure.
>
> patternProperties:
> "^(ethernet-)?ports$":
> @@ -202,6 +204,7 @@ examples:
> };
> - |
> #include <dt-bindings/gpio/gpio.h>
> + #include <dt-bindings/leds/common.h>
>
> mdio {
> #address-cells = <1>;
> @@ -284,6 +287,27 @@ examples:
>
> internal_phy_port1: ethernet-phy@0 {
> reg = <0>;
> +
> + leds {
> + #address-cells = <1>;
> + #size-cells = <0>;
> +
> + led@0 {
> + reg = <0>;
> + color = <LED_COLOR_ID_WHITE>;
> + function = LED_FUNCTION_LAN;
> + function-enumerator = <1>;
> + linux,default-trigger = "netdev";
'function' should replace this. Don't encourage more users.
Also, 'netdev' is not documented which leaves me wondering why there's
no warning? Either this patch didn't apply or there's a problem in the
schema that's not checking this node.
> + };
> +
> + led@1 {
> + reg = <1>;
> + color = <LED_COLOR_ID_AMBER>;
> + function = LED_FUNCTION_LAN;
> + function-enumerator = <1>;
Typo? These are supposed to be unique. Can't you use 'reg' in your case?
> + linux,default-trigger = "netdev";
> + };
> + };
> };
>
> internal_phy_port2: ethernet-phy@1 {
> --
> 2.37.2
>
>
^ permalink raw reply
* Re: [RFC PATCH] mm: remove zap_page_range and change callers to use zap_vma_page_range
From: Peter Xu @ 2022-12-20 17:38 UTC (permalink / raw)
To: Mike Kravetz
Cc: linux-mm, linux-kernel, linuxppc-dev, linux-riscv, linux-s390,
netdev, David Hildenbrand, Michal Hocko, Nadav Amit,
Matthew Wilcox, Vlastimil Babka, Rik van Riel, Will Deacon,
Michael Ellerman, Palmer Dabbelt, Christian Borntraeger,
Dave Hansen, Christian Brauner, Eric Dumazet, Andrew Morton
In-Reply-To: <20221216192012.13562-1-mike.kravetz@oracle.com>
On Fri, Dec 16, 2022 at 11:20:12AM -0800, Mike Kravetz wrote:
> zap_page_range was originally designed to unmap pages within an address
> range that could span multiple vmas. While working on [1], it was
> discovered that all callers of zap_page_range pass a range entirely within
> a single vma. In addition, the mmu notification call within zap_page
> range does not correctly handle ranges that span multiple vmas as calls
> should be vma specific.
>
> Instead of fixing zap_page_range, change all callers to use the new
> routine zap_vma_page_range. zap_vma_page_range is just a wrapper around
> zap_page_range_single passing in NULL zap details. The name is also
> more in line with other exported routines that operate within a vma.
> We can then remove zap_page_range.
>
> Also, change madvise_dontneed_single_vma to use this new routine.
>
> [1] https://lore.kernel.org/linux-mm/20221114235507.294320-2-mike.kravetz@oracle.com/
> Suggested-by: Peter Xu <peterx@redhat.com>
> Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Acked-by: Peter Xu <peterx@redhat.com>
Thanks!
--
Peter Xu
^ permalink raw reply
* Re: [PATCH v2 1/3] dsa: marvell: Provide per device information about max frame size
From: Lukasz Majewski @ 2022-12-20 17:33 UTC (permalink / raw)
To: Alexander Duyck
Cc: Andrew Lunn, Vladimir Oltean, Vivien Didelot, Florian Fainelli,
David S. Miller, Jakub Kicinski, Russell King, netdev,
linux-kernel
In-Reply-To: <20221219130005.6e995cb0@wsk>
[-- Attachment #1: Type: text/plain, Size: 4804 bytes --]
Hi Alexander,
> Hi Alexander,
>
> > On Fri, Dec 16, 2022 at 5:05 AM Lukasz Majewski <lukma@denx.de>
> > wrote:
> > >
> > > Hi Alexander,
> > >
> > > > On Thu, 2022-12-15 at 15:45 +0100, Lukasz Majewski wrote:
> > > > > Different Marvell DSA switches support different size of max
> > > > > frame bytes to be sent.
> > > > >
> > > > > For example mv88e6185 supports max 1632 bytes, which is now
> > > > > in-driver standard value. On the other hand - mv88e6250
> > > > > supports 2048 bytes.
> > > > >
> > > > > As this value is internal and may be different for each switch
> > > > > IC, new entry in struct mv88e6xxx_info has been added to store
> > > > > it.
> > > > >
> > > > > Signed-off-by: Lukasz Majewski <lukma@denx.de>
> > > > > ---
> > > > > Changes for v2:
> > > > > - Define max_frame_size with default value of 1632 bytes,
> > > > > - Set proper value for the mv88e6250 switch SoC (linkstreet)
> > > > > family ---
> > > > > drivers/net/dsa/mv88e6xxx/chip.c | 13 ++++++++++++-
> > > > > drivers/net/dsa/mv88e6xxx/chip.h | 1 +
> > > > > 2 files changed, 13 insertions(+), 1 deletion(-)
> > > > >
> > > > > diff --git a/drivers/net/dsa/mv88e6xxx/chip.c
> > > > > b/drivers/net/dsa/mv88e6xxx/chip.c index
> > > > > 2ca3cbba5764..7ae4c389ce50 100644 ---
> > > > > a/drivers/net/dsa/mv88e6xxx/chip.c +++
> > > > > b/drivers/net/dsa/mv88e6xxx/chip.c @@ -3093,7 +3093,9 @@
> > > > > static int mv88e6xxx_get_max_mtu(struct dsa_switch *ds, int
> > > > > port) if (chip->info->ops->port_set_jumbo_size) return 10240 -
> > > > > VLAN_ETH_HLEN - EDSA_HLEN - ETH_FCS_LEN; else if
> > > > > (chip->info->ops->set_max_frame_size)
> > > > > - return 1632 - VLAN_ETH_HLEN - EDSA_HLEN -
> > > > > ETH_FCS_LEN;
> > > > > + return (chip->info->max_frame_size -
> > > > > VLAN_ETH_HLEN
> > > > > + - EDSA_HLEN - ETH_FCS_LEN);
> > > > > +
> > > > > return 1522 - VLAN_ETH_HLEN - EDSA_HLEN - ETH_FCS_LEN;
> > > > > }
> > > > >
> > > > >
> > > >
> > > > Is there any specific reason for triggering this based on the
> > > > existance of the function call?
> > >
> > > This was the original code in this driver.
> > >
> > > This value (1632 or 2048 bytes) is SoC (family) specific.
> > >
> > > By checking which device defines set_max_frame_size callback, I
> > > could fill the chip->info->max_frame_size with 1632 value.
> > >
> > > > Why not just replace:
> > > > else if (chip->info->ops->set_max_frame_size)
> > > > with:
> > > > else if (chip->info->max_frame_size)
> > > >
> > >
> > > I think that the callback check is a bit "defensive" approach ->
> > > 1522B is the default value and 1632 (or 10240 - jumbo) can be set
> > > only when proper callback is defined.
> > >
> > > > Otherwise my concern is one gets defined without the other
> > > > leading to a future issue as 0 - extra headers will likely wrap
> > > > and while the return value may be a signed int, it is usually
> > > > stored in an unsigned int so it would effectively uncap the
> > > > MTU.
> > >
> > > Please correct me if I misunderstood something:
> > >
> > > The problem is with new mv88eXXXX devices, which will not provide
> > > max_frame_size information to their chip->info struct?
> > >
> > > Or is there any other issue?
> >
> > That was mostly my concern. I was adding a bit of my own defensive
> > programming in the event that somebody forgot to fill out the
> > chip->info. If nothing else it might make sense to add a check to
> > verify that the max_frame_size is populated before blindly using it.
> > So perhaps you could do something similar to the max_t approach I
> > had called out earlier but instead of applying it on the last case
> > you could apply it for the "set_max_frame_size" case with 1632
> > being the minimum and being overwritten by 2048 if it is set in
> > max_frame_size.
>
> I think that I shall add:
>
> else if (chip->info->ops->set_max_frame_size)
> return max_t(int, chip->info->max_frame_size, 1632) -
> (headers)
>
> So then the "default" value of 1632 will be overwritten by 2048 bytes.
>
Is this approach acceptable for you?
>
> Best regards,
>
> Lukasz Majewski
>
> --
>
> DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
> HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
> Phone: (+49)-8142-66989-59 Fax: (+49)-8142-66989-80 Email:
> lukma@denx.de
Best regards,
Lukasz Majewski
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-59 Fax: (+49)-8142-66989-80 Email: lukma@denx.de
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox