)]}' { "log": [ { "commit": "845d63c86fea02d5acb991ac8acb5bf240e6b793", "tree": "95e633fd344d57118f7d4011eee0252080d71d9d", "parents": [ "de5ca4c3852f896cacac2bf259597aab5e17d9e3" ], "author": { "name": "Alexander Aring", "email": "aahringo@redhat.com", "time": "Thu Feb 16 23:25:04 2023 -0500" }, "committer": { "name": "Stefan Schmidt", "email": "stefan@datenfreihafen.org", "time": "Sat Feb 18 16:21:49 2023 +0100" }, "message": "ca8210: fix mac_len negative array access\n\nThis patch fixes a buffer overflow access of skb-\u003edata if\nieee802154_hdr_peek_addrs() fails.\n\nReported-by: lianhui tang \u003cbluetlh@gmail.com\u003e\nSigned-off-by: Alexander Aring \u003caahringo@redhat.com\u003e\nLink: https://lore.kernel.org/r/20230217042504.3303396-1-aahringo@redhat.com\nSigned-off-by: Stefan Schmidt \u003cstefan@datenfreihafen.org\u003e\n" }, { "commit": "de5ca4c3852f896cacac2bf259597aab5e17d9e3", "tree": "f8444769663180faad7673b3d7c88f81d12d4723", "parents": [ "f3eceaed9edd7c0e0d9fb057613131f92973626f" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Fri Jan 27 14:40:37 2023 -0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jan 31 10:37:58 2023 +0100" }, "message": "net: sched: sch: Bounds check priority\n\nNothing was explicitly bounds checking the priority index used to access\nclpriop[]. WARN and bail out early if it\u0027s pathological. Seen with GCC 13:\n\n../net/sched/sch_htb.c: In function \u0027htb_activate_prios\u0027:\n../net/sched/sch_htb.c:437:44: warning: array subscript [0, 31] is outside array bounds of \u0027struct htb_prio[8]\u0027 [-Warray-bounds\u003d]\n 437 | if (p-\u003einner.clprio[prio].feed.rb_node)\n | ~~~~~~~~~~~~~~~^~~~~~\n../net/sched/sch_htb.c:131:41: note: while referencing \u0027clprio\u0027\n 131 | struct htb_prio clprio[TC_HTB_NUMPRIO];\n | ^~~~~~\n\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Jakub Kicinski \u003ckuba@kernel.org\u003e\nCc: Paolo Abeni \u003cpabeni@redhat.com\u003e\nCc: netdev@vger.kernel.org\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReviewed-by: Simon Horman \u003csimon.horman@corigine.com\u003e\nReviewed-by: Cong Wang \u003ccong.wang@bytedance.com\u003e\nLink: https://lore.kernel.org/r/20230127224036.never.561-kees@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f3eceaed9edd7c0e0d9fb057613131f92973626f", "tree": "c388632cbbe744405217fe3179700e8f6b52e2cf", "parents": [ "9b3fc325c2a7e9e17e22b008357cb0ceb810d9b2" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Fri Jan 27 14:38:54 2023 -0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jan 31 10:36:48 2023 +0100" }, "message": "net: ethernet: mtk_eth_soc: Avoid truncating allocation\n\nThere doesn\u0027t appear to be a reason to truncate the allocation used for\nflow_info, so do a full allocation and remove the unused empty struct.\nGCC does not like having a reference to an object that has been\npartially allocated, as bounds checking may become impossible when\nsuch an object is passed to other code. Seen with GCC 13:\n\n../drivers/net/ethernet/mediatek/mtk_ppe.c: In function \u0027mtk_foe_entry_commit_subflow\u0027:\n../drivers/net/ethernet/mediatek/mtk_ppe.c:623:18: warning: array subscript \u0027struct mtk_flow_entry[0]\u0027 is partly outside array bounds of \u0027unsigned char[48]\u0027 [-Warray-bounds\u003d]\n 623 | flow_info-\u003el2_data.base_flow \u003d entry;\n | ^~\n\nCc: Felix Fietkau \u003cnbd@nbd.name\u003e\nCc: John Crispin \u003cjohn@phrozen.org\u003e\nCc: Sean Wang \u003csean.wang@mediatek.com\u003e\nCc: Mark Lee \u003cMark-MC.Lee@mediatek.com\u003e\nCc: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Jakub Kicinski \u003ckuba@kernel.org\u003e\nCc: Paolo Abeni \u003cpabeni@redhat.com\u003e\nCc: Matthias Brugger \u003cmatthias.bgg@gmail.com\u003e\nCc: netdev@vger.kernel.org\nCc: linux-arm-kernel@lists.infradead.org\nCc: linux-mediatek@lists.infradead.org\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReviewed-by: Simon Horman \u003csimon.horman@corigine.com\u003e\nLink: https://lore.kernel.org/r/20230127223853.never.014-kees@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9b3fc325c2a7e9e17e22b008357cb0ceb810d9b2", "tree": "0564a6841093e187f64c843bf7c54f5a3d6ff96d", "parents": [ "ffe2a22562444720b05bdfeb999c03e810d84cbb", "71a06f1034b91e15d3ba6b5539c7d3a2d7f13030" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 30 21:11:11 2023 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 30 21:11:11 2023 -0800" }, "message": "Merge tag \u0027ieee802154-for-net-2023-01-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan\n\nStefan Schmidt says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nieee802154 for net 2023-01-30\n\nOnly one fix this time around.\n\nMiquel Raynal fixed a potential double free spotted by Dan Carpenter.\n\n* tag \u0027ieee802154-for-net-2023-01-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan:\n mac802154: Fix possible double free upon parsing error\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20230130095646.301448-1-stefan@datenfreihafen.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ffe2a22562444720b05bdfeb999c03e810d84cbb", "tree": "a569626672c79e0b68e338034c69f8f10e4f85d3", "parents": [ "84115f0e74ea73eccc44842a125f242a02097493" ], "author": { "name": "Pietro Borrello", "email": "borrello@diag.uniroma1.it", "time": "Sat Jan 28 16:29:17 2023 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 30 21:06:08 2023 -0800" }, "message": "net/tls: tls_is_tx_ready() checked list_entry\n\ntls_is_tx_ready() checks that list_first_entry() does not return NULL.\nThis condition can never happen. For empty lists, list_first_entry()\nreturns the list_entry() of the head, which is a type confusion.\nUse list_first_entry_or_null() which returns NULL in case of empty\nlists.\n\nFixes: a42055e8d2c3 (\"net/tls: Add support for async encryption of records for performance\")\nSigned-off-by: Pietro Borrello \u003cborrello@diag.uniroma1.it\u003e\nLink: https://lore.kernel.org/r/20230128-list-entry-null-check-tls-v1-1-525bbfe6f0d0@diag.uniroma1.it\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "84115f0e74ea73eccc44842a125f242a02097493", "tree": "e068360a78375d20084e2ad8a156c838c8a4fdb3", "parents": [ "73a876022273cbc9c1db7869a54444ce8b9d085e", "53b9b77dcf48dad1c6111b0c0a7310b3f9364776" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 30 21:02:44 2023 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 30 21:02:44 2023 -0800" }, "message": "Merge branch \u0027100GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2023-01-27 (ice)\n\nThis series contains updates to ice driver only.\n\nDave prevents modifying channels when RDMA is active as this will break\nRDMA traffic.\n\nMichal fixes a broken URL.\n\n* \u0027100GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n ice: Fix broken link in ice NAPI doc\n ice: Prevent set_channel from changing queues while RDMA active\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20230127225333.1534783-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "73a876022273cbc9c1db7869a54444ce8b9d085e", "tree": "0fb5a577deee919ebb151cfe48f2bf37b4d52580", "parents": [ "611792920925fb088ddccbe2783c7f92fdfb6b64" ], "author": { "name": "Colin Foster", "email": "colin.foster@in-advantage.com", "time": "Fri Jan 27 09:14:27 2023 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 30 09:24:15 2023 +0000" }, "message": "net: phy: fix null dereference in phy_attach_direct\n\nCommit bc66fa87d4fd (\"net: phy: Add link between phy dev and mac dev\")\nintroduced a link between net devices and phy devices. It fails to check\nwhether dev is NULL, leading to a NULL dereference error.\n\nFixes: bc66fa87d4fd (\"net: phy: Add link between phy dev and mac dev\")\nSigned-off-by: Colin Foster \u003ccolin.foster@in-advantage.com\u003e\nReviewed-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "611792920925fb088ddccbe2783c7f92fdfb6b64", "tree": "bce28c7e6f75be6120b600c5b50ed51e8ed19f48", "parents": [ "54aa39a513dbf2164ca462a19f04519b2407a224" ], "author": { "name": "Hyunwoo Kim", "email": "v4bel@theori.io", "time": "Thu Jan 26 18:32:50 2023 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 30 07:30:47 2023 +0000" }, "message": "netrom: Fix use-after-free caused by accept on already connected socket\n\nIf you call listen() and accept() on an already connect()ed\nAF_NETROM socket, accept() can successfully connect.\nThis is because when the peer socket sends data to sendmsg,\nthe skb with its own sk stored in the connected socket\u0027s\nsk-\u003esk_receive_queue is connected, and nr_accept() dequeues\nthe skb waiting in the sk-\u003esk_receive_queue.\n\nAs a result, nr_accept() allocates and returns a sock with\nthe sk of the parent AF_NETROM socket.\n\nAnd here use-after-free can happen through complex race conditions:\n```\n cpu0 cpu1\n 1. socket_2 \u003d socket(AF_NETROM)\n .\n .\n listen(socket_2)\n accepted_socket \u003d accept(socket_2)\n 2. socket_1 \u003d socket(AF_NETROM)\n nr_create() // sk refcount : 1\n connect(socket_1)\n 3. write(accepted_socket)\n nr_sendmsg()\n nr_output()\n nr_kick()\n nr_send_iframe()\n nr_transmit_buffer()\n nr_route_frame()\n nr_loopback_queue()\n nr_loopback_timer()\n nr_rx_frame()\n nr_process_rx_frame(sk, skb); // sk : socket_1\u0027s sk\n nr_state3_machine()\n nr_queue_rx_frame()\n sock_queue_rcv_skb()\n sock_queue_rcv_skb_reason()\n __sock_queue_rcv_skb()\n __skb_queue_tail(list, skb); // list : socket_1\u0027s sk-\u003esk_receive_queue\n 4. listen(socket_1)\n nr_listen()\n uaf_socket \u003d accept(socket_1)\n nr_accept()\n skb_dequeue(\u0026sk-\u003esk_receive_queue);\n 5. close(accepted_socket)\n nr_release()\n nr_write_internal(sk, NR_DISCREQ)\n nr_transmit_buffer() // NR_DISCREQ\n nr_route_frame()\n nr_loopback_queue()\n nr_loopback_timer()\n nr_rx_frame() // sk : socket_1\u0027s sk\n nr_process_rx_frame() // NR_STATE_3\n nr_state3_machine() // NR_DISCREQ\n nr_disconnect()\n nr_sk(sk)-\u003estate \u003d NR_STATE_0;\n 6. close(socket_1) // sk refcount : 3\n nr_release() // NR_STATE_0\n sock_put(sk); // sk refcount : 0\n sk_free(sk);\n close(uaf_socket)\n nr_release()\n sock_hold(sk); // UAF\n```\n\nKASAN report by syzbot:\n```\nBUG: KASAN: use-after-free in nr_release+0x66/0x460 net/netrom/af_netrom.c:520\nWrite of size 4 at addr ffff8880235d8080 by task syz-executor564/5128\n\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:306 [inline]\n print_report+0x15e/0x461 mm/kasan/report.c:417\n kasan_report+0xbf/0x1f0 mm/kasan/report.c:517\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0x141/0x190 mm/kasan/generic.c:189\n instrument_atomic_read_write include/linux/instrumented.h:102 [inline]\n atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:116 [inline]\n __refcount_add include/linux/refcount.h:193 [inline]\n __refcount_inc include/linux/refcount.h:250 [inline]\n refcount_inc include/linux/refcount.h:267 [inline]\n sock_hold include/net/sock.h:775 [inline]\n nr_release+0x66/0x460 net/netrom/af_netrom.c:520\n __sock_release+0xcd/0x280 net/socket.c:650\n sock_close+0x1c/0x20 net/socket.c:1365\n __fput+0x27c/0xa90 fs/file_table.c:320\n task_work_run+0x16f/0x270 kernel/task_work.c:179\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0xaa8/0x2950 kernel/exit.c:867\n do_group_exit+0xd4/0x2a0 kernel/exit.c:1012\n get_signal+0x21c3/0x2450 kernel/signal.c:2859\n arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306\n exit_to_user_mode_loop kernel/entry/common.c:168 [inline]\n exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203\n __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]\n syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296\n do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7f6c19e3c9b9\nCode: Unable to access opcode bytes at 0x7f6c19e3c98f.\nRSP: 002b:00007fffd4ba2ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133\nRAX: 0000000000000116 RBX: 0000000000000003 RCX: 00007f6c19e3c9b9\nRDX: 0000000000000318 RSI: 00000000200bd000 RDI: 0000000000000006\nRBP: 0000000000000003 R08: 000000000000000d R09: 000000000000000d\nR10: 0000000000000000 R11: 0000000000000246 R12: 000055555566a2c0\nR13: 0000000000000011 R14: 0000000000000000 R15: 0000000000000000\n \u003c/TASK\u003e\n\nAllocated by task 5128:\n kasan_save_stack+0x22/0x40 mm/kasan/common.c:45\n kasan_set_track+0x25/0x30 mm/kasan/common.c:52\n ____kasan_kmalloc mm/kasan/common.c:371 [inline]\n ____kasan_kmalloc mm/kasan/common.c:330 [inline]\n __kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:380\n kasan_kmalloc include/linux/kasan.h:211 [inline]\n __do_kmalloc_node mm/slab_common.c:968 [inline]\n __kmalloc+0x5a/0xd0 mm/slab_common.c:981\n kmalloc include/linux/slab.h:584 [inline]\n sk_prot_alloc+0x140/0x290 net/core/sock.c:2038\n sk_alloc+0x3a/0x7a0 net/core/sock.c:2091\n nr_create+0xb6/0x5f0 net/netrom/af_netrom.c:433\n __sock_create+0x359/0x790 net/socket.c:1515\n sock_create net/socket.c:1566 [inline]\n __sys_socket_create net/socket.c:1603 [inline]\n __sys_socket_create net/socket.c:1588 [inline]\n __sys_socket+0x133/0x250 net/socket.c:1636\n __do_sys_socket net/socket.c:1649 [inline]\n __se_sys_socket net/socket.c:1647 [inline]\n __x64_sys_socket+0x73/0xb0 net/socket.c:1647\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nFreed by task 5128:\n kasan_save_stack+0x22/0x40 mm/kasan/common.c:45\n kasan_set_track+0x25/0x30 mm/kasan/common.c:52\n kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:518\n ____kasan_slab_free mm/kasan/common.c:236 [inline]\n ____kasan_slab_free+0x13b/0x1a0 mm/kasan/common.c:200\n kasan_slab_free include/linux/kasan.h:177 [inline]\n __cache_free mm/slab.c:3394 [inline]\n __do_kmem_cache_free mm/slab.c:3580 [inline]\n __kmem_cache_free+0xcd/0x3b0 mm/slab.c:3587\n sk_prot_free net/core/sock.c:2074 [inline]\n __sk_destruct+0x5df/0x750 net/core/sock.c:2166\n sk_destruct net/core/sock.c:2181 [inline]\n __sk_free+0x175/0x460 net/core/sock.c:2192\n sk_free+0x7c/0xa0 net/core/sock.c:2203\n sock_put include/net/sock.h:1991 [inline]\n nr_release+0x39e/0x460 net/netrom/af_netrom.c:554\n __sock_release+0xcd/0x280 net/socket.c:650\n sock_close+0x1c/0x20 net/socket.c:1365\n __fput+0x27c/0xa90 fs/file_table.c:320\n task_work_run+0x16f/0x270 kernel/task_work.c:179\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0xaa8/0x2950 kernel/exit.c:867\n do_group_exit+0xd4/0x2a0 kernel/exit.c:1012\n get_signal+0x21c3/0x2450 kernel/signal.c:2859\n arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306\n exit_to_user_mode_loop kernel/entry/common.c:168 [inline]\n exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203\n __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]\n syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296\n do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n```\n\nTo fix this issue, nr_listen() returns -EINVAL for sockets that\nsuccessfully nr_connect().\n\nReported-by: syzbot+caa188bdfc1eeafeb418@syzkaller.appspotmail.com\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Hyunwoo Kim \u003cv4bel@theori.io\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "54aa39a513dbf2164ca462a19f04519b2407a224", "tree": "7a0cbfaab484ff6f8fe6e5c6c504efc7c589aa90", "parents": [ "a6efc42a86c0c87cfe2f1c3d1f09a4c9b13ba890" ], "author": { "name": "Andrey Konovalov", "email": "andrey.konovalov@linaro.org", "time": "Fri Jan 27 00:35:39 2023 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 30 07:21:25 2023 +0000" }, "message": "net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC\n\nCurrently in phy_init_eee() the driver unconditionally configures the PHY\nto stop RX_CLK after entering Rx LPI state. This causes an LPI interrupt\nstorm on my qcs404-base board.\n\nChange the PHY initialization so that for \"qcom,qcs404-ethqos\" compatible\ndevice RX_CLK continues to run even in Rx LPI state.\n\nSigned-off-by: Andrey Konovalov \u003candrey.konovalov@linaro.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a6efc42a86c0c87cfe2f1c3d1f09a4c9b13ba890", "tree": "bdb58aeda300b2dd9df3e14647cf5232c390f43c", "parents": [ "906ad3c9bf66e3c6dd4ebe14a7af1b339a2afacf" ], "author": { "name": "Andrei Gherzan", "email": "andrei.gherzan@canonical.com", "time": "Thu Jan 26 16:55:48 2023 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Jan 28 13:55:12 2023 +0000" }, "message": "selftest: net: Improve IPV6_TCLASS/IPV6_HOPLIMIT tests apparmor compatibility\n\n\"tcpdump\" is used to capture traffic in these tests while using a random,\ntemporary and not suffixed file for it. This can interfere with apparmor\nconfiguration where the tool is only allowed to read from files with\n\u0027known\u0027 extensions.\n\nThe MINE type application/vnd.tcpdump.pcap was registered with IANA for\npcap files and .pcap is the extension that is both most common but also\naligned with standard apparmor configurations. See TCPDUMP(8) for more\ndetails.\n\nThis improves compatibility with standard apparmor configurations by\nusing \".pcap\" as the file extension for the tests\u0027 temporary files.\n\nSigned-off-by: Andrei Gherzan \u003candrei.gherzan@canonical.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "906ad3c9bf66e3c6dd4ebe14a7af1b339a2afacf", "tree": "ac547964f725388e0ce9e873b6fbd6aea94a7be1", "parents": [ "60bd1d9008a50cc78c4033a16a6f5d78210d481c", "e3d6d152a1cbdee25f2e3962009a2751b54e2297" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Jan 28 13:20:21 2023 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Jan 28 13:20:21 2023 +0000" }, "message": "Merge branch \u0027t7xx-pm-fixes\u0027\n\nKornel Dulęba says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: wwan: t7xx: Fix Runtime PM implementation\n\nd10b3a695ba0 (\"net: wwan: t7xx: Runtime PM\") introduced support for\nRuntime PM for this driver, but due to a bug in the initialization logic\nthe usage refcount would never reach 0, leaving the feature unused.\nThis patchset addresses that, together with a bug found after runtime\nsuspend was enabled.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e3d6d152a1cbdee25f2e3962009a2751b54e2297", "tree": "ac547964f725388e0ce9e873b6fbd6aea94a7be1", "parents": [ "364d0221f1788e5225006ba7a0026e5968431c29" ], "author": { "name": "Kornel Dulęba", "email": "mindal@semihalf.com", "time": "Thu Jan 26 13:25:35 2023 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Jan 28 13:20:21 2023 +0000" }, "message": "net: wwan: t7xx: Fix Runtime PM initialization\n\nFor PCI devices the Runtime PM refcount is incremented twice:\n1. During device enumeration with a call to pm_runtime_forbid.\n2. Just before a driver probe logic is called.\nBecause of that in order to enable Runtime PM on a given device\nwe have to call both pm_runtime_allow and pm_runtime_put_noidle,\nonce it\u0027s ready to be runtime suspended.\nThe former was missing causing the pm refcount to never reach 0.\n\nFixes: d10b3a695ba0 (\"net: wwan: t7xx: Runtime PM\")\nSigned-off-by: Kornel Dulęba \u003cmindal@semihalf.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "364d0221f1788e5225006ba7a0026e5968431c29", "tree": "8e3e9848afd992547cafac38dbcfcb7ef5dcb66f", "parents": [ "60bd1d9008a50cc78c4033a16a6f5d78210d481c" ], "author": { "name": "Kornel Dulęba", "email": "mindal@semihalf.com", "time": "Thu Jan 26 13:25:34 2023 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Jan 28 13:20:20 2023 +0000" }, "message": "net: wwan: t7xx: Fix Runtime PM resume sequence\n\nResume device before calling napi_schedule, instead of doing in the napi\npoll routine. Polling is done in softrq context. We can\u0027t call the PM\nresume logic from there as it\u0027s blocking and not irq safe.\nIn order to make it work modify the interrupt handler to be run from irq\nhandler thread.\n\nFixes: 5545b7b9f294 (\"net: wwan: t7xx: Add NAPI support\")\nSigned-off-by: Kornel Dulęba \u003cmindal@semihalf.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "60bd1d9008a50cc78c4033a16a6f5d78210d481c", "tree": "288300a5ff8f036e7c06077f5aab42087fb86c3b", "parents": [ "422ae7d9c7221e8d4c8526d0f54106307d69d2dc" ], "author": { "name": "Jeremy Kerr", "email": "jk@codeconstruct.com.au", "time": "Thu Jan 26 14:45:51 2023 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sat Jan 28 00:26:09 2023 -0800" }, "message": "net: mctp: purge receive queues on sk destruction\n\nWe may have pending skbs in the receive queue when the sk is being\ndestroyed; add a destructor to purge the queue.\n\nMCTP doesn\u0027t use the error queue, so only the receive_queue is purged.\n\nFixes: 833ef3b91de6 (\"mctp: Populate socket implementation\")\nSigned-off-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nReviewed-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nLink: https://lore.kernel.org/r/20230126064551.464468-1-jk@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "422ae7d9c7221e8d4c8526d0f54106307d69d2dc", "tree": "c53c7348a892d0a100eff4e9085dedda2982fa4c", "parents": [ "29de68c2b32ce58d64dea496d281e25ad0f551bd" ], "author": { "name": "Andre Kalb", "email": "andre.kalb@sma.de", "time": "Wed Jan 25 19:23:26 2023 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sat Jan 28 00:23:58 2023 -0800" }, "message": "net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices\n\nThe probe() function is only used for the DP83822 PHY, leaving the\nprivate data pointer uninitialized for the smaller DP83825/26 models.\nWhile all uses of the private data structure are hidden in 82822 specific\ncallbacks, configuring the interrupt is shared across all models.\nThis causes a NULL pointer dereference on the smaller PHYs as it accesses\nthe private data unchecked. Verifying the pointer avoids that.\n\nFixes: 5dc39fd5ef35 (\"net: phy: DP83822: Add ability to advertise Fiber connection\")\nSigned-off-by: Andre Kalb \u003candre.kalb@sma.de\u003e\nReviewed-by: Simon Horman \u003csimon.horman@corigine.com\u003e\nLink: https://lore.kernel.org/r/Y9FzniUhUtbaGKU7@pc6682\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "29de68c2b32ce58d64dea496d281e25ad0f551bd", "tree": "ffd972702cac2a34a6a48a86d2317d8a22984a19", "parents": [ "14caefcf9837a2be765a566005ad82cd0d2a429f" ], "author": { "name": "Natalia Petrova", "email": "n.petrova@fintech.ru", "time": "Wed Jan 25 16:48:31 2023 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sat Jan 28 00:21:32 2023 -0800" }, "message": "net: qrtr: free memory on error path in radix_tree_insert()\n\nFunction radix_tree_insert() returns errors if the node hasn\u0027t\nbeen initialized and added to the tree.\n\n\"kfree(node)\" and return value \"NULL\" of node_get() help\nto avoid using unclear node in other calls.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\nCc: \u003cstable@vger.kernel.org\u003e # 5.7\nFixes: 0c2204a4ad71 (\"net: qrtr: Migrate nameservice to kernel from userspace\")\nSigned-off-by: Natalia Petrova \u003cn.petrova@fintech.ru\u003e\nReviewed-by: Simon Horman \u003csimon.horman@corigine.com\u003e\nReviewed-by: Manivannan Sadhasivam \u003cmani@kernel.org\u003e\nLink: https://lore.kernel.org/r/20230125134831.8090-1-n.petrova@fintech.ru\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "14caefcf9837a2be765a566005ad82cd0d2a429f", "tree": "6cf24163eefe3ca98e41293a1a6a756f85464d60", "parents": [ "ffffd2454a7a1bc9f7242b12c4cc0b05c12692b4" ], "author": { "name": "Hyunwoo Kim", "email": "v4bel@theori.io", "time": "Wed Jan 25 02:59:44 2023 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sat Jan 28 00:19:57 2023 -0800" }, "message": "net/rose: Fix to not accept on connected socket\n\nIf you call listen() and accept() on an already connect()ed\nrose socket, accept() can successfully connect.\nThis is because when the peer socket sends data to sendmsg,\nthe skb with its own sk stored in the connected socket\u0027s\nsk-\u003esk_receive_queue is connected, and rose_accept() dequeues\nthe skb waiting in the sk-\u003esk_receive_queue.\n\nThis creates a child socket with the sk of the parent\nrose socket, which can cause confusion.\n\nFix rose_listen() to return -EINVAL if the socket has\nalready been successfully connected, and add lock_sock\nto prevent this issue.\n\nSigned-off-by: Hyunwoo Kim \u003cv4bel@theori.io\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nLink: https://lore.kernel.org/r/20230125105944.GA133314@ubuntu\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ffffd2454a7a1bc9f7242b12c4cc0b05c12692b4", "tree": "36ccd3a898b23b878f3b2f78e9e8580bc68c6ace", "parents": [ "0548c5f26a0fefa721b29be2bfff1c44f15b6d73" ], "author": { "name": "Íñigo Huguet", "email": "ihuguet@redhat.com", "time": "Wed Jan 25 15:35:13 2023 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sat Jan 28 00:19:48 2023 -0800" }, "message": "sfc: correctly advertise tunneled IPv6 segmentation\n\nRecent sfc NICs are TSO capable for some tunnel protocols. However, it\nwas not working properly because the feature was not advertised in\nhw_enc_features, but in hw_features only.\n\nSetting up a GENEVE tunnel and using iperf3 to send IPv4 and IPv6 traffic\nto the tunnel show, with tcpdump, that the IPv4 packets still had ~64k\nsize but the IPv6 ones had only ~1500 bytes (they had been segmented by\nsoftware, not offloaded). With this patch segmentation is offloaded as\nexpected and the traffic is correctly received at the other end.\n\nFixes: 24b2c3751aa3 (\"sfc: advertise encapsulated offloads on EF10\")\nReported-by: Tianhao Zhao \u003ctizhao@redhat.com\u003e\nSigned-off-by: Íñigo Huguet \u003cihuguet@redhat.com\u003e\nAcked-by: Martin Habets \u003chabetsm.xilinx@gmail.com\u003e\nLink: https://lore.kernel.org/r/20230125143513.25841-1-ihuguet@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0548c5f26a0fefa721b29be2bfff1c44f15b6d73", "tree": "21149a8ae3545dea23fe0bb86ca84d22acf6c50d", "parents": [ "7d2c89b325874a35564db5630a459966afab04cc", "5416c9aea8323583e8696f0500b6142dfae80821" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jan 27 23:32:02 2023 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jan 27 23:32:03 2023 -0800" }, "message": "Merge tag \u0027for-netdev\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nDaniel Borkmann says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf 2023-01-27\n\nWe\u0027ve added 10 non-merge commits during the last 9 day(s) which contain\na total of 10 files changed, 170 insertions(+), 59 deletions(-).\n\nThe main changes are:\n\n1) Fix preservation of register\u0027s parent/live fields when copying\n range-info, from Eduard Zingerman.\n\n2) Fix an off-by-one bug in bpf_mem_cache_idx() to select the right\n cache, from Hou Tao.\n\n3) Fix stack overflow from infinite recursion in sock_map_close(),\n from Jakub Sitnicki.\n\n4) Fix missing btf_put() in register_btf_id_dtor_kfuncs()\u0027s error path,\n from Jiri Olsa.\n\n5) Fix a splat from bpf_setsockopt() via lsm_cgroup/socket_sock_rcv_skb,\n from Kui-Feng Lee.\n\n6) Fix bpf_send_signal[_thread]() helpers to hold a reference on the task,\n from Yonghong Song.\n\n* tag \u0027for-netdev\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n bpf: Fix the kernel crash caused by bpf_setsockopt().\n selftests/bpf: Cover listener cloning with progs attached to sockmap\n selftests/bpf: Pass BPF skeleton to sockmap_listen ops tests\n bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener\n bpf, sockmap: Don\u0027t let sock_map_{close,destroy,unhash} call itself\n bpf: Add missing btf_put to register_btf_id_dtor_kfuncs\n selftests/bpf: Verify copy_register_state() preserves parent/live fields\n bpf: Fix to preserve reg parent/live fields when copying range info\n bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers\n bpf: Fix off-by-one error in bpf_mem_cache_idx()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20230127215820.4993-1-daniel@iogearbox.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7d2c89b325874a35564db5630a459966afab04cc", "tree": "6793f020138a2ec4230c1e124b163d45ae36bf25", "parents": [ "ff445b8397745ea94675162faa0e9b0079ca521d" ], "author": { "name": "Alexander Duyck", "email": "alexanderduyck@fb.com", "time": "Thu Jan 26 11:06:59 2023 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jan 27 23:21:27 2023 -0800" }, "message": "skb: Do mix page pool and page referenced frags in GRO\n\nGSO should not merge page pool recycled frames with standard reference\ncounted frames. Traditionally this didn\u0027t occur, at least not often.\nHowever as we start looking at adding support for wireless adapters there\nbecomes the potential to mix the two due to A-MSDU repartitioning frames in\nthe receive path. There are possibly other places where this may have\noccurred however I suspect they must be few and far between as we have not\nseen this issue until now.\n\nFixes: 53e0961da1c7 (\"page_pool: add frag page recycling support in page pool\")\nReported-by: Felix Fietkau \u003cnbd@nbd.name\u003e\nSigned-off-by: Alexander Duyck \u003calexanderduyck@fb.com\u003e\nAcked-by: Ilias Apalodimas \u003cilias.apalodimas@linaro.org\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://lore.kernel.org/r/167475990764.1934330.11960904198087757911.stgit@localhost.localdomain\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ff445b8397745ea94675162faa0e9b0079ca521d", "tree": "2ec00b412d123dd7117abd39232e9426ddebe36c", "parents": [ "3ac77ecd9a8356c11754def95d657df026c6c135" ], "author": { "name": "Arınç ÜNAL", "email": "arinc.unal@arinc9.com", "time": "Thu Jan 26 22:01:11 2023 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jan 27 22:33:49 2023 -0800" }, "message": "net: dsa: mt7530: fix tristate and help description\n\nFix description for tristate and help sections which include inaccurate\ninformation.\n\nSigned-off-by: Arınç ÜNAL \u003carinc.unal@arinc9.com\u003e\nLink: https://lore.kernel.org/r/20230126190110.9124-1-arinc.unal@arinc9.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3ac77ecd9a8356c11754def95d657df026c6c135", "tree": "d7d82a577c7cafd77b5d9b6a2e20d3a7cb0089e0", "parents": [ "28b4387f0ec08d48634fcc3e3687c93edc1503f9", "a3191c4d86c5d3bd35b00dfde6910b88391436a0" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jan 27 22:28:01 2023 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jan 27 22:28:03 2023 -0800" }, "message": "Merge branch \u0027net-xdp-execute-xdp_do_flush-before-napi_complete_done\u0027\n\nMagnus Karlsson says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: xdp: execute xdp_do_flush() before napi_complete_done()\n\nMake sure that xdp_do_flush() is always executed before\nnapi_complete_done(). This is important for two reasons. First, a\nredirect to an XSKMAP assumes that a call to xdp_do_redirect() from\nnapi context X on CPU Y will be followed by a xdp_do_flush() from the\nsame napi context and CPU. This is not guaranteed if the\nnapi_complete_done() is executed before xdp_do_flush(), as it tells\nthe napi logic that it is fine to schedule napi context X on another\nCPU. Details from a production system triggering this bug using the\nveth driver can be found in [1].\n\nThe second reason is that the XDP_REDIRECT logic in itself relies on\nbeing inside a single NAPI instance through to the xdp_do_flush() call\nfor RCU protection of all in-kernel data structures. Details can be\nfound in [2].\n\nThe drivers have only been compile-tested since I do not own any of\nthe HW below. So if you are a maintainer, it would be great if you\ncould take a quick look to make sure I did not mess something up.\n\nNote that these were the drivers I found that violated the ordering by\nrunning a simple script and manually checking the ones that came up as\npotential offenders. But the script was not perfect in any way. There\nmight still be offenders out there, since the script can generate\nfalse negatives.\n\n[1] https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com\n[2] https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20230125074901.2737-1-magnus.karlsson@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a3191c4d86c5d3bd35b00dfde6910b88391436a0", "tree": "d7d82a577c7cafd77b5d9b6a2e20d3a7cb0089e0", "parents": [ "b534013798b77f81a36f36dafd59bab9de837619" ], "author": { "name": "Magnus Karlsson", "email": "magnus.karlsson@intel.com", "time": "Wed Jan 25 08:49:01 2023 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jan 27 22:27:59 2023 -0800" }, "message": "dpaa2-eth: execute xdp_do_flush() before napi_complete_done()\n\nMake sure that xdp_do_flush() is always executed before\nnapi_complete_done(). This is important for two reasons. First, a\nredirect to an XSKMAP assumes that a call to xdp_do_redirect() from\nnapi context X on CPU Y will be followed by a xdp_do_flush() from the\nsame napi context and CPU. This is not guaranteed if the\nnapi_complete_done() is executed before xdp_do_flush(), as it tells\nthe napi logic that it is fine to schedule napi context X on another\nCPU. Details from a production system triggering this bug using the\nveth driver can be found following the first link below.\n\nThe second reason is that the XDP_REDIRECT logic in itself relies on\nbeing inside a single NAPI instance through to the xdp_do_flush() call\nfor RCU protection of all in-kernel data structures. Details can be\nfound in the second link below.\n\nFixes: d678be1dc1ec (\"dpaa2-eth: add XDP_REDIRECT support\")\nSigned-off-by: Magnus Karlsson \u003cmagnus.karlsson@intel.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nLink: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com\nLink: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b534013798b77f81a36f36dafd59bab9de837619", "tree": "244650c9b1a47c630f47dc09968a566fa6955bd8", "parents": [ "ad7e615f646c9b5b2cf655cdfb9d91a28db4f25a" ], "author": { "name": "Magnus Karlsson", "email": "magnus.karlsson@intel.com", "time": "Wed Jan 25 08:49:00 2023 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jan 27 22:27:59 2023 -0800" }, "message": "dpaa_eth: execute xdp_do_flush() before napi_complete_done()\n\nMake sure that xdp_do_flush() is always executed before\nnapi_complete_done(). This is important for two reasons. First, a\nredirect to an XSKMAP assumes that a call to xdp_do_redirect() from\nnapi context X on CPU Y will be followed by a xdp_do_flush() from the\nsame napi context and CPU. This is not guaranteed if the\nnapi_complete_done() is executed before xdp_do_flush(), as it tells\nthe napi logic that it is fine to schedule napi context X on another\nCPU. Details from a production system triggering this bug using the\nveth driver can be found following the first link below.\n\nThe second reason is that the XDP_REDIRECT logic in itself relies on\nbeing inside a single NAPI instance through to the xdp_do_flush() call\nfor RCU protection of all in-kernel data structures. Details can be\nfound in the second link below.\n\nFixes: a1e031ffb422 (\"dpaa_eth: add XDP_REDIRECT support\")\nSigned-off-by: Magnus Karlsson \u003cmagnus.karlsson@intel.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nLink: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com\nLink: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/\nAcked-by: Camelia Groza \u003ccamelia.groza@nxp.com\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ad7e615f646c9b5b2cf655cdfb9d91a28db4f25a", "tree": "d82367374b50b302581fb509fa1e4ff554e742f0", "parents": [ "12b5717990c81fc2f6f2aa9d53d960b916478d4f" ], "author": { "name": "Magnus Karlsson", "email": "magnus.karlsson@intel.com", "time": "Wed Jan 25 08:48:59 2023 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jan 27 22:27:59 2023 -0800" }, "message": "virtio-net: execute xdp_do_flush() before napi_complete_done()\n\nMake sure that xdp_do_flush() is always executed before\nnapi_complete_done(). This is important for two reasons. First, a\nredirect to an XSKMAP assumes that a call to xdp_do_redirect() from\nnapi context X on CPU Y will be followed by a xdp_do_flush() from the\nsame napi context and CPU. This is not guaranteed if the\nnapi_complete_done() is executed before xdp_do_flush(), as it tells\nthe napi logic that it is fine to schedule napi context X on another\nCPU. Details from a production system triggering this bug using the\nveth driver can be found following the first link below.\n\nThe second reason is that the XDP_REDIRECT logic in itself relies on\nbeing inside a single NAPI instance through to the xdp_do_flush() call\nfor RCU protection of all in-kernel data structures. Details can be\nfound in the second link below.\n\nFixes: 186b3c998c50 (\"virtio-net: support XDP_REDIRECT\")\nSigned-off-by: Magnus Karlsson \u003cmagnus.karlsson@intel.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nLink: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com\nLink: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "12b5717990c81fc2f6f2aa9d53d960b916478d4f", "tree": "b59aabfb0507f8f797bdc146555661663fa145c6", "parents": [ "2ccce20d51faa0178086163ccb6c84a099a87ab4" ], "author": { "name": "Magnus Karlsson", "email": "magnus.karlsson@intel.com", "time": "Wed Jan 25 08:48:58 2023 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jan 27 22:27:59 2023 -0800" }, "message": "lan966x: execute xdp_do_flush() before napi_complete_done()\n\nMake sure that xdp_do_flush() is always executed before\nnapi_complete_done(). This is important for two reasons. First, a\nredirect to an XSKMAP assumes that a call to xdp_do_redirect() from\nnapi context X on CPU Y will be followed by a xdp_do_flush() from the\nsame napi context and CPU. This is not guaranteed if the\nnapi_complete_done() is executed before xdp_do_flush(), as it tells\nthe napi logic that it is fine to schedule napi context X on another\nCPU. Details from a production system triggering this bug using the\nveth driver can be found following the first link below.\n\nThe second reason is that the XDP_REDIRECT logic in itself relies on\nbeing inside a single NAPI instance through to the xdp_do_flush() call\nfor RCU protection of all in-kernel data structures. Details can be\nfound in the second link below.\n\nFixes: a825b611c7c1 (\"net: lan966x: Add support for XDP_REDIRECT\")\nSigned-off-by: Magnus Karlsson \u003cmagnus.karlsson@intel.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nAcked-by: Steen Hegelund \u003cSteen.Hegelund@microchip.com\u003e\nLink: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com\nLink: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2ccce20d51faa0178086163ccb6c84a099a87ab4", "tree": "1e2b89f0add70cc41d42141bea67a9cd5931a3f9", "parents": [ "28b4387f0ec08d48634fcc3e3687c93edc1503f9" ], "author": { "name": "Magnus Karlsson", "email": "magnus.karlsson@intel.com", "time": "Wed Jan 25 08:48:57 2023 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jan 27 22:27:59 2023 -0800" }, "message": "qede: execute xdp_do_flush() before napi_complete_done()\n\nMake sure that xdp_do_flush() is always executed before\nnapi_complete_done(). This is important for two reasons. First, a\nredirect to an XSKMAP assumes that a call to xdp_do_redirect() from\nnapi context X on CPU Y will be followed by a xdp_do_flush() from the\nsame napi context and CPU. This is not guaranteed if the\nnapi_complete_done() is executed before xdp_do_flush(), as it tells\nthe napi logic that it is fine to schedule napi context X on another\nCPU. Details from a production system triggering this bug using the\nveth driver can be found following the first link below.\n\nThe second reason is that the XDP_REDIRECT logic in itself relies on\nbeing inside a single NAPI instance through to the xdp_do_flush() call\nfor RCU protection of all in-kernel data structures. Details can be\nfound in the second link below.\n\nFixes: d1b25b79e162b (\"qede: add .ndo_xdp_xmit() and XDP_REDIRECT support\")\nSigned-off-by: Magnus Karlsson \u003cmagnus.karlsson@intel.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nLink: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com\nLink: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "53b9b77dcf48dad1c6111b0c0a7310b3f9364776", "tree": "51ef0f02cc26514f03a5229cf196239d5165a317", "parents": [ "a6a0974aae4209d039ba81226ded5246eea14961" ], "author": { "name": "Michal Wilczynski", "email": "michal.wilczynski@intel.com", "time": "Fri Nov 25 14:34:39 2022 +0100" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Fri Jan 27 11:32:18 2023 -0800" }, "message": "ice: Fix broken link in ice NAPI doc\n\nCurrent link for NAPI documentation in ice driver doesn\u0027t work - it\nreturns 404. Update the link to the working one.\n\nSigned-off-by: Michal Wilczynski \u003cmichal.wilczynski@intel.com\u003e\nAcked-by: Jesse Brandeburg \u003cjesse.brandeburg@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "a6a0974aae4209d039ba81226ded5246eea14961", "tree": "12654dd0ff105a2e07acc25c0db0c4e01fc2e932", "parents": [ "7083df59abbc2b7500db312cac706493be0273ff" ], "author": { "name": "Dave Ertman", "email": "david.m.ertman@intel.com", "time": "Tue Jan 24 09:19:43 2023 -0800" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Fri Jan 27 11:32:18 2023 -0800" }, "message": "ice: Prevent set_channel from changing queues while RDMA active\n\nThe PF controls the set of queues that the RDMA auxiliary_driver requests\nresources from. The set_channel command will alter that pool and trigger a\nreconfiguration of the VSI, which breaks RDMA functionality.\n\nPrevent set_channel from executing when RDMA driver bound to auxiliary\ndevice.\n\nAdding a locked variable to pass down the call chain to avoid double\nlocking the device_lock.\n\nFixes: 348048e724a0 (\"ice: Implement iidc operations\")\nSigned-off-by: Dave Ertman \u003cdavid.m.ertman@intel.com\u003e\nTested-by: Gurucharan G \u003cgurucharanx.g@intel.com\u003e (A Contingent worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "5416c9aea8323583e8696f0500b6142dfae80821", "tree": "d5a11ee11600569fb81abefc6611c24180a79e4d", "parents": [ "e8c8fd9b8393d7064152c8806f5ac446d760a23e" ], "author": { "name": "Kui-Feng Lee", "email": "kuifeng@meta.com", "time": "Thu Jan 26 16:17:32 2023 -0800" }, "committer": { "name": "Martin KaFai Lau", "email": "martin.lau@kernel.org", "time": "Thu Jan 26 23:26:40 2023 -0800" }, "message": "bpf: Fix the kernel crash caused by bpf_setsockopt().\n\nThe kernel crash was caused by a BPF program attached to the\n\"lsm_cgroup/socket_sock_rcv_skb\" hook, which performed a call to\n`bpf_setsockopt()` in order to set the TCP_NODELAY flag as an\nexample. Flags like TCP_NODELAY can prompt the kernel to flush a\nsocket\u0027s outgoing queue, and this hook\n\"lsm_cgroup/socket_sock_rcv_skb\" is frequently triggered by\nsoftirqs. The issue was that in certain circumstances, when\n`tcp_write_xmit()` was called to flush the queue, it would also allow\nBH (bottom-half) to run. This could lead to our program attempting to\nflush the same socket recursively, which caused a `skbuff` to be\nunlinked twice.\n\n`security_sock_rcv_skb()` is triggered by `tcp_filter()`. This occurs\nbefore the sock ownership is checked in `tcp_v4_rcv()`. Consequently,\nif a bpf program runs on `security_sock_rcv_skb()` while under softirq\nconditions, it may not possess the lock needed for `bpf_setsockopt()`,\nthus presenting an issue.\n\nThe patch fixes this issue by ensuring that a BPF program attached to\nthe \"lsm_cgroup/socket_sock_rcv_skb\" hook is not allowed to call\n`bpf_setsockopt()`.\n\nThe differences from v1 are\n - changing commit log to explain holding the lock of the sock,\n - emphasizing that TCP_NODELAY is not the only flag, and\n - adding the fixes tag.\n\nv1: https://lore.kernel.org/bpf/20230125000244.1109228-1-kuifeng@meta.com/\n\nSigned-off-by: Kui-Feng Lee \u003ckuifeng@meta.com\u003e\nFixes: 9113d7e48e91 (\"bpf: expose bpf_{g,s}etsockopt to lsm cgroup\")\nLink: https://lore.kernel.org/r/20230127001732.4162630-1-kuifeng@meta.com\nSigned-off-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\n" }, { "commit": "28b4387f0ec08d48634fcc3e3687c93edc1503f9", "tree": "11f506bb20b146307dd6d45439310a3df606a382", "parents": [ "262b42e02d1e0b5ad1b33e9b9842e178c16231de", "7083df59abbc2b7500db312cac706493be0273ff" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 26 10:20:12 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 26 10:20:12 2023 -0800" }, "message": "Merge tag \u0027net-6.2-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from netfilter.\n\n Current release - regressions:\n\n - sched: sch_taprio: do not schedule in taprio_reset()\n\n Previous releases - regressions:\n\n - core: fix UaF in netns ops registration error path\n\n - ipv4: prevent potential spectre v1 gadgets\n\n - ipv6: fix reachability confirmation with proxy_ndp\n\n - netfilter: fix for the set rbtree\n\n - eth: fec: use page_pool_put_full_page when freeing rx buffers\n\n - eth: iavf: fix temporary deadlock and failure to set MAC address\n\n Previous releases - always broken:\n\n - netlink: prevent potential spectre v1 gadgets\n\n - netfilter: fixes for SCTP connection tracking\n\n - mctp: struct sock lifetime fixes\n\n - eth: ravb: fix possible hang if RIS2_QFF1 happen\n\n - eth: tg3: resolve deadlock in tg3_reset_task() during EEH\n\n Misc:\n\n - Mat stepped out as MPTCP co-maintainer\"\n\n* tag \u0027net-6.2-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (40 commits)\n net: mdio-mux-meson-g12a: force internal PHY off on mux switch\n docs: networking: Fix bridge documentation URL\n tsnep: Fix TX queue stop/wake for multiple queues\n net/tg3: resolve deadlock in tg3_reset_task() during EEH\n net: mctp: mark socks as dead on unhash, prevent re-add\n net: mctp: hold key reference when looking up a general key\n net: mctp: move expiry timer delete to unhash\n net: mctp: add an explicit reference from a mctp_sk_key to sock\n net: ravb: Fix possible hang if RIS2_QFF1 happen\n net: ravb: Fix lack of register setting after system resumed for Gen3\n net/x25: Fix to not accept on connected socket\n ice: move devlink port creation/deletion\n sctp: fail if no bound addresses can be used for a given scope\n net/sched: sch_taprio: do not schedule in taprio_reset()\n Revert \"Merge branch \u0027ethtool-mac-merge\u0027\"\n netrom: Fix use-after-free of a listening socket.\n netfilter: conntrack: unify established states for SCTP paths\n Revert \"netfilter: conntrack: add sctp DATA_SENT state\"\n netfilter: conntrack: fix bug in for_each_sctp_chunk\n netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE\n ...\n" }, { "commit": "262b42e02d1e0b5ad1b33e9b9842e178c16231de", "tree": "238ab645b22448148a24eda473c4d8ab8c6b71e5", "parents": [ "7c46948a6e9cf47ed03b0d489fde894ad46f1437" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 26 10:05:39 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 26 10:05:39 2023 -0800" }, "message": "treewide: fix up files incorrectly marked executable\n\nI\u0027m not exactly clear on what strange workflow causes people to do it,\nbut clearly occasionally some files end up being committed as executable\neven though they clearly aren\u0027t.\n\nThis is a reprise of commit 90fda63fa115 (\"treewide: fix up files\nincorrectly marked executable\"), just with a different set of files (but\nwith the same trivial shell scripting).\n\nSo apparently we need to re-do this every five years or so, and Joe\nneeds to just keep reminding me to do so ;)\n\nReported-by: Joe Perches \u003cjoe@perches.com\u003e\nFixes: 523375c943e5 (\"drm/vmwgfx: Port vmwgfx to arm64\")\nFixes: 5c439937775d (\"ASoC: codecs: add support for ES8326\")\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "7083df59abbc2b7500db312cac706493be0273ff", "tree": "3be524d262a71034caea726d3db38773d3f8e06f", "parents": [ "aee2770d199a969b205e7b60125d5af47e3bdee0" ], "author": { "name": "Jerome Brunet", "email": "jbrunet@baylibre.com", "time": "Tue Jan 24 11:11:57 2023 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jan 25 22:46:51 2023 -0800" }, "message": "net: mdio-mux-meson-g12a: force internal PHY off on mux switch\n\nForce the internal PHY off then on when switching to the internal path.\nThis fixes problems where the PHY ID is not properly set.\n\nFixes: 7090425104db (\"net: phy: add amlogic g12a mdio mux support\")\nSuggested-by: Qi Duan \u003cqi.duan@amlogic.com\u003e\nCo-developed-by: Heiner Kallweit \u003chkallweit1@gmail.com\u003e\nSigned-off-by: Heiner Kallweit \u003chkallweit1@gmail.com\u003e\nSigned-off-by: Jerome Brunet \u003cjbrunet@baylibre.com\u003e\nLink: https://lore.kernel.org/r/20230124101157.232234-1-jbrunet@baylibre.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "aee2770d199a969b205e7b60125d5af47e3bdee0", "tree": "37bd3b6ad4fec25632e41c1786a58dbac896b172", "parents": [ "3d53aaef4332245044b2f3688ac0ea10436c719c" ], "author": { "name": "Ivan Vecera", "email": "ivecera@redhat.com", "time": "Tue Jan 24 15:51:26 2023 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jan 25 22:44:27 2023 -0800" }, "message": "docs: networking: Fix bridge documentation URL\n\nCurrent documentation URL [1] is no longer valid.\n\n[1] https://www.linuxfoundation.org/collaborate/workgroups/networking/bridge\n\nSigned-off-by: Ivan Vecera \u003civecera@redhat.com\u003e\nReviewed-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nLink: https://lore.kernel.org/r/20230124145127.189221-1-ivecera@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3d53aaef4332245044b2f3688ac0ea10436c719c", "tree": "c0b038845b36aea0b95bca55dda8e78f0abce926", "parents": [ "6c4ca03bd890566d873e3593b32d034bf2f5a087" ], "author": { "name": "Gerhard Engleder", "email": "gerhard@engleder-embedded.com", "time": "Tue Jan 24 20:14:40 2023 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jan 25 22:41:50 2023 -0800" }, "message": "tsnep: Fix TX queue stop/wake for multiple queues\n\nnetif_stop_queue() and netif_wake_queue() act on TX queue 0. This is ok\nas long as only a single TX queue is supported. But support for multiple\nTX queues was introduced with 762031375d5c and I missed to adapt stop\nand wake of TX queues.\n\nUse netif_stop_subqueue() and netif_tx_wake_queue() to act on specific\nTX queue.\n\nFixes: 762031375d5c (\"tsnep: Support multiple TX/RX queue pairs\")\nSigned-off-by: Gerhard Engleder \u003cgerhard@engleder-embedded.com\u003e\nLink: https://lore.kernel.org/r/20230124191440.56887-1-gerhard@engleder-embedded.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6c4ca03bd890566d873e3593b32d034bf2f5a087", "tree": "718b8784b0bb81de420aee5e4f2db67778bd4f8b", "parents": [ "ac8d986cbf0b0ffdbf2c707fe59cf4a71d933a18" ], "author": { "name": "David Christensen", "email": "drc@linux.vnet.ibm.com", "time": "Tue Jan 24 13:53:39 2023 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jan 25 22:35:42 2023 -0800" }, "message": "net/tg3: resolve deadlock in tg3_reset_task() during EEH\n\nDuring EEH error injection testing, a deadlock was encountered in the tg3\ndriver when tg3_io_error_detected() was attempting to cancel outstanding\nreset tasks:\n\ncrash\u003e foreach UN bt\n...\nPID: 159 TASK: c0000000067c6000 CPU: 8 COMMAND: \"eehd\"\n...\n #5 [c00000000681f990] __cancel_work_timer at c00000000019fd18\n #6 [c00000000681fa30] tg3_io_error_detected at c00800000295f098 [tg3]\n #7 [c00000000681faf0] eeh_report_error at c00000000004e25c\n...\n\nPID: 290 TASK: c000000036e5f800 CPU: 6 COMMAND: \"kworker/6:1\"\n...\n #4 [c00000003721fbc0] rtnl_lock at c000000000c940d8\n #5 [c00000003721fbe0] tg3_reset_task at c008000002969358 [tg3]\n #6 [c00000003721fc60] process_one_work at c00000000019e5c4\n...\n\nPID: 296 TASK: c000000037a65800 CPU: 21 COMMAND: \"kworker/21:1\"\n...\n #4 [c000000037247bc0] rtnl_lock at c000000000c940d8\n #5 [c000000037247be0] tg3_reset_task at c008000002969358 [tg3]\n #6 [c000000037247c60] process_one_work at c00000000019e5c4\n...\n\nPID: 655 TASK: c000000036f49000 CPU: 16 COMMAND: \"kworker/16:2\"\n...:1\n\n #4 [c0000000373ebbc0] rtnl_lock at c000000000c940d8\n #5 [c0000000373ebbe0] tg3_reset_task at c008000002969358 [tg3]\n #6 [c0000000373ebc60] process_one_work at c00000000019e5c4\n...\n\nCode inspection shows that both tg3_io_error_detected() and\ntg3_reset_task() attempt to acquire the RTNL lock at the beginning of\ntheir code blocks. If tg3_reset_task() should happen to execute between\nthe times when tg3_io_error_deteced() acquires the RTNL lock and\ntg3_reset_task_cancel() is called, a deadlock will occur.\n\nMoving tg3_reset_task_cancel() call earlier within the code block, prior\nto acquiring RTNL, prevents this from happening, but also exposes another\ndeadlock issue where tg3_reset_task() may execute AFTER\ntg3_io_error_detected() has executed:\n\ncrash\u003e foreach UN bt\nPID: 159 TASK: c0000000067d2000 CPU: 9 COMMAND: \"eehd\"\n...\n #4 [c000000006867a60] rtnl_lock at c000000000c940d8\n #5 [c000000006867a80] tg3_io_slot_reset at c0080000026c2ea8 [tg3]\n #6 [c000000006867b00] eeh_report_reset at c00000000004de88\n...\nPID: 363 TASK: c000000037564000 CPU: 6 COMMAND: \"kworker/6:1\"\n...\n #3 [c000000036c1bb70] msleep at c000000000259e6c\n #4 [c000000036c1bba0] napi_disable at c000000000c6b848\n #5 [c000000036c1bbe0] tg3_reset_task at c0080000026d942c [tg3]\n #6 [c000000036c1bc60] process_one_work at c00000000019e5c4\n...\n\nThis issue can be avoided by aborting tg3_reset_task() if EEH error\nrecovery is already in progress.\n\nFixes: db84bf43ef23 (\"tg3: tg3_reset_task() needs to use rtnl_lock to synchronize\")\nSigned-off-by: David Christensen \u003cdrc@linux.vnet.ibm.com\u003e\nReviewed-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nLink: https://lore.kernel.org/r/20230124185339.225806-1-drc@linux.vnet.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7c46948a6e9cf47ed03b0d489fde894ad46f1437", "tree": "326920f286b3929648145e83500e384186b69877", "parents": [ "948ef7bb70c4acaf74d87420ea3a1190862d4548", "facd61053cff100973921d4d45d47cf53c747ec6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jan 25 09:15:15 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jan 25 09:15:15 2023 -0800" }, "message": "Merge tag \u0027fs.fuse.acl.v6.2-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping\n\nPull fuse ACL fix from Christian Brauner:\n \"The new posix acl API doesn\u0027t depend on the xattr handler\n infrastructure anymore and instead only relies on the posix acl inode\n operations. As a result daemons without FUSE_POSIX_ACL are unable to\n use posix acls like they used to.\n\n Fix this by copying what we did for overlayfs during the posix acl api\n conversion. Make fuse implement a dedicated -\u003eget_inode_acl() method\n as does overlayfs. Fuse can then also uses this to express different\n needs for vfs permission checking during lookup and acl based\n retrieval via the regular system call path.\n\n This allows fuse to continue to refuse retrieving posix acls for\n daemons that don\u0027t set FUSE_POSXI_ACL for permission checking while\n also allowing a fuse server to retrieve it via the usual system calls\"\n\n* tag \u0027fs.fuse.acl.v6.2-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping:\n fuse: fixes after adapting to new posix acl api\n" }, { "commit": "ac8d986cbf0b0ffdbf2c707fe59cf4a71d933a18", "tree": "0c957d35d98a69293a151f68eae03ed6380bc104", "parents": [ "a9e9b78d53b91e6e52a2580aafece542655685b7", "b98e1a04e27fddfdc808bf46fe78eca30db89ab3" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 25 13:07:38 2023 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 25 13:07:38 2023 +0000" }, "message": "Merge branch \u0027mptcp-fixes\u0027\n\nJeremy Kerr says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: mctp: struct sock lifetime fixes\n\nThis series is a set of fixes for the sock lifetime handling in the\nAF_MCTP code, fixing a uaf reported by Noam Rathaus\n\u003cnoamr@ssd-disclosure.com\u003e.\n\nThe Fixes: tags indicate the original patches affected, but some\ntweaking to backport to those commits may be needed; I have a separate\nbranch with backports to 5.15 if that helps with stable trees.\n\nOf course, any comments/queries most welcome.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b98e1a04e27fddfdc808bf46fe78eca30db89ab3", "tree": "0c957d35d98a69293a151f68eae03ed6380bc104", "parents": [ "6e54ea37e344f145665c2dc3cc534b92529e8de5" ], "author": { "name": "Jeremy Kerr", "email": "jk@codeconstruct.com.au", "time": "Tue Jan 24 10:01:06 2023 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 25 13:07:37 2023 +0000" }, "message": "net: mctp: mark socks as dead on unhash, prevent re-add\n\nOnce a socket has been unhashed, we want to prevent it from being\nre-used in a sk_key entry as part of a routing operation.\n\nThis change marks the sk as SOCK_DEAD on unhash, which prevents addition\ninto the net\u0027s key list.\n\nWe need to do this during the key add path, rather than key lookup, as\nwe release the net keys_lock between those operations.\n\nFixes: 4a992bbd3650 (\"mctp: Implement message fragmentation \u0026 reassembly\")\nSigned-off-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "6e54ea37e344f145665c2dc3cc534b92529e8de5", "tree": "182e9dc75015c995d9cf8ea89c6a75ae959a3eab", "parents": [ "5f41ae6fca9d40ab3cb9b0507931ef7a9b3ea50b" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jan 24 10:01:05 2023 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 25 13:07:37 2023 +0000" }, "message": "net: mctp: hold key reference when looking up a general key\n\nCurrently, we have a race where we look up a sock through a \"general\"\n(ie, not directly associated with the (src,dest,tag) tuple) key, then\ndrop the key reference while still holding the key\u0027s sock.\n\nThis change expands the key reference until we\u0027ve finished using the\nsock, and hence the sock reference too.\n\nCommit message changes from Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e.\n\nReported-by: Noam Rathaus \u003cnoamr@ssd-disclosure.com\u003e\nFixes: 73c618456dc5 (\"mctp: locking, lifetime and validity changes for sk_keys\")\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5f41ae6fca9d40ab3cb9b0507931ef7a9b3ea50b", "tree": "d777040a8d5f80fe385b12bcd360032a52dc6b0a", "parents": [ "de8a6b15d9654c3e4f672d76da9d9df8ee06331d" ], "author": { "name": "Jeremy Kerr", "email": "jk@codeconstruct.com.au", "time": "Tue Jan 24 10:01:04 2023 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 25 13:07:37 2023 +0000" }, "message": "net: mctp: move expiry timer delete to unhash\n\nCurrently, we delete the key expiry timer (in sk-\u003eclose) before\nunhashing the sk. This means that another thread may find the sk through\nits presence on the key list, and re-queue the timer.\n\nThis change moves the timer deletion to the unhash, after we have made\nthe key no longer observable, so the timer cannot be re-queued.\n\nFixes: 7b14e15ae6f4 (\"mctp: Implement a timeout for tags\")\nSigned-off-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "de8a6b15d9654c3e4f672d76da9d9df8ee06331d", "tree": "abcadce54cd7abc941e2d25e56c8524956c2187b", "parents": [ "a9e9b78d53b91e6e52a2580aafece542655685b7" ], "author": { "name": "Jeremy Kerr", "email": "jk@codeconstruct.com.au", "time": "Tue Jan 24 10:01:03 2023 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 25 13:07:37 2023 +0000" }, "message": "net: mctp: add an explicit reference from a mctp_sk_key to sock\n\nCurrently, we correlate the mctp_sk_key lifetime to the sock lifetime\nthrough the sock hash/unhash operations, but this is pretty tenuous, and\nthere are cases where we may have a temporary reference to an unhashed\nsk.\n\nThis change makes the reference more explicit, by adding a hold on the\nsock when it\u0027s associated with a mctp_sk_key, released on final key\nunref.\n\nFixes: 73c618456dc5 (\"mctp: locking, lifetime and validity changes for sk_keys\")\nSigned-off-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a9e9b78d53b91e6e52a2580aafece542655685b7", "tree": "3c5cb83b570454e4a910d65ddda4322f3aaea0b7", "parents": [ "f2b0b5210f67c56a3bcdf92ff665fb285d6e0067", "f3c07758c9007a6bfff5290d9e19d3c41930c897" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 25 13:00:27 2023 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 25 13:00:27 2023 +0000" }, "message": "Merge branch \u0027ravb-fixes\u0027\n\nYoshihiro Shimoda says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: ravb: Fix potential issues\n\nFix potentiall issues on the ravb driver.\n\nChanges from v2:\nhttps://lore.kernel.org/all/20230123131331.1425648-1-yoshihiro.shimoda.uh@renesas.com/\n - Add Reviewed-by in the patch [2/2].\n - Add a commit description in the patch [2/2].\n\nChanges from v1:\nhttps://lore.kernel.org/all/20230119043920.875280-1-yoshihiro.shimoda.uh@renesas.com/\n - Fix typo in the patch [1/2].\n - Add Reviewed-by in the patch [1/2].\n - Fix \"Fixed\" tag in the patch [2/2].\n - Fix a comment indentation of the code in the patch [2/2].\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f3c07758c9007a6bfff5290d9e19d3c41930c897", "tree": "3c5cb83b570454e4a910d65ddda4322f3aaea0b7", "parents": [ "c2b6cdee1d13ffbb24baca3c9b8a572d6b541e4e" ], "author": { "name": "Yoshihiro Shimoda", "email": "yoshihiro.shimoda.uh@renesas.com", "time": "Tue Jan 24 09:02:11 2023 +0900" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 25 13:00:27 2023 +0000" }, "message": "net: ravb: Fix possible hang if RIS2_QFF1 happen\n\nSince this driver enables the interrupt by RIC2_QFE1, this driver\nshould clear the interrupt flag if it happens. Otherwise, the interrupt\ncauses to hang the system.\n\nNote that this also fix a minor coding style (a comment indentation)\naround the fixed code.\n\nFixes: c156633f1353 (\"Renesas Ethernet AVB driver proper\")\nSigned-off-by: Yoshihiro Shimoda \u003cyoshihiro.shimoda.uh@renesas.com\u003e\nReviewed-by: Sergey Shtylyov \u003cs.shtylyov@omp.ru\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c2b6cdee1d13ffbb24baca3c9b8a572d6b541e4e", "tree": "9c54258953f4b577b602c4a3f2a0662aa7a87121", "parents": [ "f2b0b5210f67c56a3bcdf92ff665fb285d6e0067" ], "author": { "name": "Yoshihiro Shimoda", "email": "yoshihiro.shimoda.uh@renesas.com", "time": "Tue Jan 24 09:02:10 2023 +0900" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 25 13:00:27 2023 +0000" }, "message": "net: ravb: Fix lack of register setting after system resumed for Gen3\n\nAfter system entered Suspend to RAM, registers setting of this\nhardware is reset because the SoC will be turned off. On R-Car Gen3\n(info-\u003eccc_gac), ravb_ptp_init() is called in ravb_probe() only. So,\nafter system resumed, it lacks of the initial settings for ptp. So,\nadd ravb_ptp_{init,stop}() into ravb_{resume,suspend}().\n\nFixes: f5d7837f96e5 (\"ravb: ptp: Add CONFIG mode support\")\nSigned-off-by: Yoshihiro Shimoda \u003cyoshihiro.shimoda.uh@renesas.com\u003e\nReviewed-by: Sergey Shtylyov \u003cs.shtylyov@omp.ru\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f2b0b5210f67c56a3bcdf92ff665fb285d6e0067", "tree": "6011f2b3ac88b3e1e2d0c6dc5a57b5fe88e33afa", "parents": [ "2a48216cff7a2e3964fbed16f84d33f68b3e5e42" ], "author": { "name": "Hyunwoo Kim", "email": "v4bel@theori.io", "time": "Mon Jan 23 11:43:23 2023 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 25 09:51:04 2023 +0000" }, "message": "net/x25: Fix to not accept on connected socket\n\nWhen listen() and accept() are called on an x25 socket\nthat connect() succeeds, accept() succeeds immediately.\nThis is because x25_connect() queues the skb to\nsk-\u003esk_receive_queue, and x25_accept() dequeues it.\n\nThis creates a child socket with the sk of the parent\nx25 socket, which can cause confusion.\n\nFix x25_listen() to return -EINVAL if the socket has\nalready been successfully connect()ed to avoid this issue.\n\nSigned-off-by: Hyunwoo Kim \u003cv4bel@theori.io\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e8c8fd9b8393d7064152c8806f5ac446d760a23e", "tree": "16556640aaa91c3da3674977e4519f224d758e4d", "parents": [ "74bc3a5acc82f020d2e126f56c535d02d1e74e37", "c88ea16a8f892bce3bfb3f6a0d91b2bb27df8f59" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Tue Jan 24 21:32:55 2023 -0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Tue Jan 24 21:32:55 2023 -0800" }, "message": "Merge branch \u0027bpf, sockmap: Fix infinite recursion in sock_map_close\u0027\n\nJakub Sitnicki says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nThis patch set addresses the syzbot report in [1].\n\nPatch #1 has been suggested by Eric [2]. I extended it to cover the rest of\nsock_map proto callbacks. Otherwise we would still overflow the stack.\n\nPatch #2 contains the actual fix and bug analysis.\nPatches #3 \u0026 #4 add coverage to selftests to trigger the bug.\n\n[1] https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/\n[2] https://lore.kernel.org/all/CANn89iK2UN1FmdUcH12fv_xiZkv2G+Nskvmq7fG6aA_6VKRf6g@mail.gmail.com/\n---\nv1 -\u003e v2:\nv1: https://lore.kernel.org/r/20230113-sockmap-fix-v1-0-d3cad092ee10@cloudflare.com\n[v1 didn\u0027t hit bpf@ ML by mistake]\n\n * pull in Eric\u0027s patch to protect against recursion loop bugs (Eric)\n * add a macro helper to check if pointer is inside a memory range (Eric)\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "c88ea16a8f892bce3bfb3f6a0d91b2bb27df8f59", "tree": "16556640aaa91c3da3674977e4519f224d758e4d", "parents": [ "b4ea530d024ca6095fc80290075893a5b7136516" ], "author": { "name": "Jakub Sitnicki", "email": "jakub@cloudflare.com", "time": "Sat Jan 21 13:41:46 2023 +0100" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Tue Jan 24 21:32:55 2023 -0800" }, "message": "selftests/bpf: Cover listener cloning with progs attached to sockmap\n\nToday we test if a child socket is cloned properly from a listening socket\ninside a sockmap only when there are no BPF programs attached to the map.\n\nA bug has been reported [1] for the case when sockmap has a verdict program\nattached. So cover this case as well to prevent regressions.\n\n[1]: https://lore.kernel.org/r/00000000000073b14905ef2e7401@google.com\n\nSigned-off-by: Jakub Sitnicki \u003cjakub@cloudflare.com\u003e\nAcked-by: John Fastabend \u003cjohn.fastabend@gmail.com\u003e\nLink: https://lore.kernel.org/r/20230113-sockmap-fix-v2-4-1e0ee7ac2f90@cloudflare.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "b4ea530d024ca6095fc80290075893a5b7136516", "tree": "a0b305df2cb5e692762f584111564536eb9c5829", "parents": [ "ddce1e091757d0259107c6c0c7262df201de2b66" ], "author": { "name": "Jakub Sitnicki", "email": "jakub@cloudflare.com", "time": "Sat Jan 21 13:41:45 2023 +0100" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Tue Jan 24 21:32:55 2023 -0800" }, "message": "selftests/bpf: Pass BPF skeleton to sockmap_listen ops tests\n\nFollowing patch extends the sockmap ops tests to cover the scenario when a\nsockmap with attached programs holds listening sockets.\n\nPass the BPF skeleton to sockmap ops test so that the can access and attach\nthe BPF programs.\n\nSigned-off-by: Jakub Sitnicki \u003cjakub@cloudflare.com\u003e\nAcked-by: John Fastabend \u003cjohn.fastabend@gmail.com\u003e\nLink: https://lore.kernel.org/r/20230113-sockmap-fix-v2-3-1e0ee7ac2f90@cloudflare.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "ddce1e091757d0259107c6c0c7262df201de2b66", "tree": "e9ee36ac268a80df9bc6343b318e1510b47377d5", "parents": [ "5b4a79ba65a1ab479903fff2e604865d229b70a9" ], "author": { "name": "Jakub Sitnicki", "email": "jakub@cloudflare.com", "time": "Sat Jan 21 13:41:44 2023 +0100" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Tue Jan 24 21:32:55 2023 -0800" }, "message": "bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener\n\nA listening socket linked to a sockmap has its sk_prot overridden. It\npoints to one of the struct proto variants in tcp_bpf_prots. The variant\ndepends on the socket\u0027s family and which sockmap programs are attached.\n\nA child socket cloned from a TCP listener initially inherits their sk_prot.\nBut before cloning is finished, we restore the child\u0027s proto to the\nlistener\u0027s original non-tcp_bpf_prots one. This happens in\ntcp_create_openreq_child -\u003e tcp_bpf_clone.\n\nToday, in tcp_bpf_clone we detect if the child\u0027s proto should be restored\nby checking only for the TCP_BPF_BASE proto variant. This is not\ncorrect. The sk_prot of listening socket linked to a sockmap can point to\nto any variant in tcp_bpf_prots.\n\nIf the listeners sk_prot happens to be not the TCP_BPF_BASE variant, then\nthe child socket unintentionally is left if the inherited sk_prot by\ntcp_bpf_clone.\n\nThis leads to issues like infinite recursion on close [1], because the\nchild state is otherwise not set up for use with tcp_bpf_prot operations.\n\nAdjust the check in tcp_bpf_clone to detect all of tcp_bpf_prots variants.\n\nNote that it wouldn\u0027t be sufficient to check the socket state when\noverriding the sk_prot in tcp_bpf_update_proto in order to always use the\nTCP_BPF_BASE variant for listening sockets. Since commit\nb8b8315e39ff (\"bpf, sockmap: Remove unhash handler for BPF sockmap usage\")\nit is possible for a socket to transition to TCP_LISTEN state while already\nlinked to a sockmap, e.g. connect() -\u003e insert into map -\u003e\nconnect(AF_UNSPEC) -\u003e listen().\n\n[1]: https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/\n\nFixes: e80251555f0b (\"tcp_bpf: Don\u0027t let child socket inherit parent protocol ops on copy\")\nReported-by: syzbot+04c21ed96d861dccc5cd@syzkaller.appspotmail.com\nSigned-off-by: Jakub Sitnicki \u003cjakub@cloudflare.com\u003e\nAcked-by: John Fastabend \u003cjohn.fastabend@gmail.com\u003e\nLink: https://lore.kernel.org/r/20230113-sockmap-fix-v2-2-1e0ee7ac2f90@cloudflare.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "5b4a79ba65a1ab479903fff2e604865d229b70a9", "tree": "a66f61b356c2708795f7a336ac4a5dfe5dc1239c", "parents": [ "74bc3a5acc82f020d2e126f56c535d02d1e74e37" ], "author": { "name": "Jakub Sitnicki", "email": "jakub@cloudflare.com", "time": "Sat Jan 21 13:41:43 2023 +0100" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Tue Jan 24 21:32:55 2023 -0800" }, "message": "bpf, sockmap: Don\u0027t let sock_map_{close,destroy,unhash} call itself\n\nsock_map proto callbacks should never call themselves by design. Protect\nagainst bugs like [1] and break out of the recursive loop to avoid a stack\noverflow in favor of a resource leak.\n\n[1] https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/\n\nSuggested-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Jakub Sitnicki \u003cjakub@cloudflare.com\u003e\nAcked-by: John Fastabend \u003cjohn.fastabend@gmail.com\u003e\nLink: https://lore.kernel.org/r/20230113-sockmap-fix-v2-1-1e0ee7ac2f90@cloudflare.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "2a48216cff7a2e3964fbed16f84d33f68b3e5e42", "tree": "4cbd003a4dc37202c5705fe2ab5f622743bdd8a6", "parents": [ "418e53401e478a743cf33b1c32ea0728f0afef66", "a44b7651489f26271ac784b70895e8a85d0cebf4" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jan 24 18:59:37 2023 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jan 24 18:59:37 2023 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter fixes for net\n\n1) Perform SCTP vtag verification for ABORT/SHUTDOWN_COMPLETE according\n to RFC 9260, Sect 8.5.1.\n\n2) Fix infinite loop if SCTP chunk size is zero in for_each_sctp_chunk().\n And remove useless check in this macro too.\n\n3) Revert DATA_SENT state in the SCTP tracker, this was applied in the\n previous merge window. Next patch in this series provides a more\n simple approach to multihoming support.\n\n4) Unify HEARTBEAT_ACKED and ESTABLISHED states for SCTP multihoming\n support, use default ESTABLISHED of 210 seconds based on\n heartbeat timeout * maximum number of retransmission + round-trip timeout.\n Otherwise, SCTP conntrack entry that represents secondary paths\n remain stale in the table for up to 5 days.\n\nThis is a slightly large batch with fixes for the SCTP connection\ntracking helper, all patches from Sriram Yagnaraman.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: conntrack: unify established states for SCTP paths\n Revert \"netfilter: conntrack: add sctp DATA_SENT state\"\n netfilter: conntrack: fix bug in for_each_sctp_chunk\n netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20230124183933.4752-1-pablo@netfilter.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "418e53401e478a743cf33b1c32ea0728f0afef66", "tree": "88a488184ee0d9927865ddfd6d68286c6ebd8371", "parents": [ "458e279f861d3f61796894cd158b780765a1569f" ], "author": { "name": "Paul M Stillwell Jr", "email": "paul.m.stillwell.jr@intel.com", "time": "Mon Jan 23 16:57:14 2023 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jan 24 18:52:15 2023 -0800" }, "message": "ice: move devlink port creation/deletion\n\nCommit a286ba738714 (\"ice: reorder PF/representor devlink\nport register/unregister flows\") moved the code to create\nand destroy the devlink PF port. This was fine, but created\na corner case issue in the case of ice_register_netdev()\nfailing. In that case, the driver would end up calling\nice_devlink_destroy_pf_port() twice.\n\nAdditionally, it makes no sense to tie creation of the devlink\nPF port to the creation of the netdev so separate out the\ncode to create/destroy the devlink PF port from the netdev\ncode. This makes it a cleaner interface.\n\nFixes: a286ba738714 (\"ice: reorder PF/representor devlink port register/unregister flows\")\nSigned-off-by: Paul M Stillwell Jr \u003cpaul.m.stillwell.jr@intel.com\u003e\nTested-by: Gurucharan G \u003cgurucharanx.g@intel.com\u003e (A Contingent worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nReviewed-by: Leon Romanovsky \u003cleonro@nvidia.com\u003e\nLink: https://lore.kernel.org/r/20230124005714.3996270-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "458e279f861d3f61796894cd158b780765a1569f", "tree": "fbadfaa46ca1f4662b26eb3d92aaa81b22ecb1d1", "parents": [ "ea4fdbaa2f7798cb25adbe4fd52ffc6356f097bb" ], "author": { "name": "Marcelo Ricardo Leitner", "email": "marcelo.leitner@gmail.com", "time": "Mon Jan 23 14:59:33 2023 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jan 24 18:32:33 2023 -0800" }, "message": "sctp: fail if no bound addresses can be used for a given scope\n\nCurrently, if you bind the socket to something like:\n servaddr.sin6_family \u003d AF_INET6;\n servaddr.sin6_port \u003d htons(0);\n servaddr.sin6_scope_id \u003d 0;\n inet_pton(AF_INET6, \"::1\", \u0026servaddr.sin6_addr);\n\nAnd then request a connect to:\n connaddr.sin6_family \u003d AF_INET6;\n connaddr.sin6_port \u003d htons(20000);\n connaddr.sin6_scope_id \u003d if_nametoindex(\"lo\");\n inet_pton(AF_INET6, \"fe88::1\", \u0026connaddr.sin6_addr);\n\nWhat the stack does is:\n - bind the socket\n - create a new asoc\n - to handle the connect\n - copy the addresses that can be used for the given scope\n - try to connect\n\nBut the copy returns 0 addresses, and the effect is that it ends up\ntrying to connect as if the socket wasn\u0027t bound, which is not the\ndesired behavior. This unexpected behavior also allows KASLR leaks\nthrough SCTP diag interface.\n\nThe fix here then is, if when trying to copy the addresses that can\nbe used for the scope used in connect() it returns 0 addresses, bail\nout. This is what TCP does with a similar reproducer.\n\nReported-by: Pietro Borrello \u003cborrello@diag.uniroma1.it\u003e\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Marcelo Ricardo Leitner \u003cmarcelo.leitner@gmail.com\u003e\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://lore.kernel.org/r/9fcd182f1099f86c6661f3717f63712ddd1c676c.1674496737.git.marcelo.leitner@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "948ef7bb70c4acaf74d87420ea3a1190862d4548", "tree": "d76ade0ae7660af0a6eb022b30b8e69e130463b8", "parents": [ "246dc53fb2461dbcd66d4d1d914246a581edad29", "0254127ab977e70798707a7a2b757c9f3c971210" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 18:19:44 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 18:19:44 2023 -0800" }, "message": "Merge tag \u0027modules-6.2-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux\n\nPull module fix from Luis Chamberlain:\n \"Theis is a fix we have been delaying for v6.2 due to lack of early\n testing on linux-next.\n\n The commit has been sitting in linux-next since December and testing\n has also been now a bit extensive by a few developers. Since this is a\n fix which definitely will go to v6.3 it should also apply to v6.2 so\n if there are any issues we pick them up earlier rather than later. The\n fix fixes a regression since v5.3, prior to me helping with module\n maintenance, however, the issue is real in that in the worst case now\n can prevent boot.\n\n We\u0027ve discussed all possible corner cases [0] and at last do feel this\n is ready for v6.2-rc6\"\n\nLink https://lore.kernel.org/all/Y9A4fiobL6IHp%2F%2FP@bombadil.infradead.org/ [0]\n\n* tag \u0027modules-6.2-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux:\n module: Don\u0027t wait for GOING modules\n" }, { "commit": "ea4fdbaa2f7798cb25adbe4fd52ffc6356f097bb", "tree": "91622faa1f9c86dd64ecbaae0172734c4172162f", "parents": [ "d968117a7e8e5572762eacbdbca13bc96710e9a3" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Jan 23 08:45:52 2023 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jan 24 18:17:29 2023 -0800" }, "message": "net/sched: sch_taprio: do not schedule in taprio_reset()\n\nAs reported by syzbot and hinted by Vinicius, I should not have added\na qdisc_synchronize() call in taprio_reset()\n\ntaprio_reset() can be called with qdisc spinlock held (and BH disabled)\nas shown in included syzbot report [1].\n\nOnly taprio_destroy() needed this synchronization, as explained\nin the blamed commit changelog.\n\n[1]\n\nBUG: scheduling while atomic: syz-executor150/5091/0x00000202\n2 locks held by syz-executor150/5091:\nModules linked in:\nPreemption disabled at:\n[\u003c0000000000000000\u003e] 0x0\nKernel panic - not syncing: scheduling while atomic: panic_on_warn set ...\nCPU: 1 PID: 5091 Comm: syz-executor150 Not tainted 6.2.0-rc3-syzkaller-00219-g010a74f52203 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023\nCall Trace:\n\u003cTASK\u003e\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106\npanic+0x2cc/0x626 kernel/panic.c:318\ncheck_panic_on_warn.cold+0x19/0x35 kernel/panic.c:238\n__schedule_bug.cold+0xd5/0xfe kernel/sched/core.c:5836\nschedule_debug kernel/sched/core.c:5865 [inline]\n__schedule+0x34e4/0x5450 kernel/sched/core.c:6500\nschedule+0xde/0x1b0 kernel/sched/core.c:6682\nschedule_timeout+0x14e/0x2a0 kernel/time/timer.c:2167\nschedule_timeout_uninterruptible kernel/time/timer.c:2201 [inline]\nmsleep+0xb6/0x100 kernel/time/timer.c:2322\nqdisc_synchronize include/net/sch_generic.h:1295 [inline]\ntaprio_reset+0x93/0x270 net/sched/sch_taprio.c:1703\nqdisc_reset+0x10c/0x770 net/sched/sch_generic.c:1022\ndev_reset_queue+0x92/0x130 net/sched/sch_generic.c:1285\nnetdev_for_each_tx_queue include/linux/netdevice.h:2464 [inline]\ndev_deactivate_many+0x36d/0x9f0 net/sched/sch_generic.c:1351\ndev_deactivate+0xed/0x1b0 net/sched/sch_generic.c:1374\nqdisc_graft+0xe4a/0x1380 net/sched/sch_api.c:1080\ntc_modify_qdisc+0xb6b/0x19a0 net/sched/sch_api.c:1689\nrtnetlink_rcv_msg+0x43e/0xca0 net/core/rtnetlink.c:6141\nnetlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2564\nnetlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline]\nnetlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1356\nnetlink_sendmsg+0x91b/0xe10 net/netlink/af_netlink.c:1932\nsock_sendmsg_nosec net/socket.c:714 [inline]\nsock_sendmsg+0xd3/0x120 net/socket.c:734\n____sys_sendmsg+0x712/0x8c0 net/socket.c:2476\n___sys_sendmsg+0x110/0x1b0 net/socket.c:2530\n__sys_sendmsg+0xf7/0x1c0 net/socket.c:2559\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\n\nFixes: 3a415d59c1db (\"net/sched: sch_taprio: fix possible use-after-free\")\nLink: https://lore.kernel.org/netdev/167387581653.2747.13878941339893288655.git-patchwork-notify@kernel.org/T/\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Vinicius Costa Gomes \u003cvinicius.gomes@intel.com\u003e\nLink: https://lore.kernel.org/r/20230123084552.574396-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "246dc53fb2461dbcd66d4d1d914246a581edad29", "tree": "a3948ccc6c66d499bb1e2dde3ec4ed06c10f0ca2", "parents": [ "b2f317173ed5f00a00aedba71cc67454d9cde90f", "6618d69aa129a8fc613e64775d5019524c6f231b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 17:54:25 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 17:54:25 2023 -0800" }, "message": "Merge tag \u0027rust-fixes-6.2\u0027 of https://github.com/Rust-for-Linux/linux\n\nPull rust fix from Miguel Ojeda:\n\n - Avoid evaluating arguments in \u0027pr_*\u0027 macros in \u0027unsafe\u0027 blocks\n\n* tag \u0027rust-fixes-6.2\u0027 of https://github.com/Rust-for-Linux/linux:\n rust: print: avoid evaluating arguments in `pr_*` macros in `unsafe` blocks\n" }, { "commit": "b2f317173ed5f00a00aedba71cc67454d9cde90f", "tree": "7007d5fe29154560c0b7cc938852acba458e1cf2", "parents": [ "02db81a787e304e5afaa31dc66522d39d3f89f1a", "c2c46b10d52624376322b01654095a84611c7e09" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 17:48:09 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 17:48:09 2023 -0800" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"ARM64:\n\n - Pass the correct address to mte_clear_page_tags() on initialising a\n tagged page\n\n - Plug a race against a GICv4.1 doorbell interrupt while saving the\n vgic-v3 pending state.\n\n x86:\n\n - A command line parsing fix and a clang compilation fix for\n selftests\n\n - A fix for a longstanding VMX issue, that surprisingly was only\n found now to affect real world guests\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n KVM: selftests: Make reclaim_period_ms input always be positive\n KVM: x86/vmx: Do not skip segment attributes if unusable bit is set\n selftests: kvm: move declaration at the beginning of main()\n KVM: arm64: GICv4.1: Fix race with doorbell on VPE activation/deactivation\n KVM: arm64: Pass the actual page address to mte_clear_page_tags()\n" }, { "commit": "02db81a787e304e5afaa31dc66522d39d3f89f1a", "tree": "ed57f567e800075713df490ffb1b7f0c2e3810ae", "parents": [ "fb6e71db53f3d4351dada7c130fb652eecf994d6", "0bfe63d075789456e9589457b29d6f9c279e3252" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 17:42:53 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 17:42:53 2023 -0800" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Six fixes, all in drivers.\n\n The biggest are the UFS devfreq fixes which address a lock inversion\n and the two iscsi_tcp fixes which try to prevent a use after free from\n userspace still accessing an area which the kernel has released (seen\n by KASAN)\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: device_handler: alua: Remove a might_sleep() annotation\n scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress\n scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress\n scsi: ufs: core: Fix devfreq deadlocks\n scsi: hpsa: Fix allocation size for scsi_host_alloc()\n scsi: target: core: Fix warning on RT kernels\n" }, { "commit": "fb6e71db53f3d4351dada7c130fb652eecf994d6", "tree": "f2c156ea6c94a74c278479e7d4be2f7032a8441c", "parents": [ "50306df38ac4edbeb1eac29d68128f84630405d8", "4bdbba54e9b1c769da8ded9abd209d765715e1d6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 12:58:47 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 12:58:47 2023 -0800" }, "message": "Merge tag \u0027nfsd-6.2-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux\n\nPull nfsd fix from Chuck Lever:\n\n - Nail another UAF in NFSD\u0027s filecache\n\n* tag \u0027nfsd-6.2-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:\n nfsd: don\u0027t free files unconditionally in __nfsd_file_cache_purge\n" }, { "commit": "50306df38ac4edbeb1eac29d68128f84630405d8", "tree": "6f16329a9aec34b8882822f9db777fcc8215e058", "parents": [ "5149394c899808667e0f8444d3d39cba1dfb42f7", "31e1be62abdebc28bd51d0999a25f0eea535b5af" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 12:53:26 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 12:53:26 2023 -0800" }, "message": "Merge tag \u0027fscrypt-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fscrypt/linux\n\nPull fscrypt MAINTAINERS entry update from Eric Biggers:\n \"Update the MAINTAINERS file entry for fscrypt\"\n\n* tag \u0027fscrypt-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fscrypt/linux:\n MAINTAINERS: update fscrypt git repo\n" }, { "commit": "0254127ab977e70798707a7a2b757c9f3c971210", "tree": "4cd9489f1cecdea718850aee320d4bb3024e7ab0", "parents": [ "7bf70dbb18820b37406fdfa2aaf14c2f5c71a11a" ], "author": { "name": "Petr Pavlu", "email": "petr.pavlu@suse.com", "time": "Mon Dec 05 11:35:57 2022 +0100" }, "committer": { "name": "Luis Chamberlain", "email": "mcgrof@kernel.org", "time": "Tue Jan 24 12:52:52 2023 -0800" }, "message": "module: Don\u0027t wait for GOING modules\n\nDuring a system boot, it can happen that the kernel receives a burst of\nrequests to insert the same module but loading it eventually fails\nduring its init call. For instance, udev can make a request to insert\na frequency module for each individual CPU when another frequency module\nis already loaded which causes the init function of the new module to\nreturn an error.\n\nSince commit 6e6de3dee51a (\"kernel/module.c: Only return -EEXIST for\nmodules that have finished loading\"), the kernel waits for modules in\nMODULE_STATE_GOING state to finish unloading before making another\nattempt to load the same module.\n\nThis creates unnecessary work in the described scenario and delays the\nboot. In the worst case, it can prevent udev from loading drivers for\nother devices and might cause timeouts of services waiting on them and\nsubsequently a failed boot.\n\nThis patch attempts a different solution for the problem 6e6de3dee51a\nwas trying to solve. Rather than waiting for the unloading to complete,\nit returns a different error code (-EBUSY) for modules in the GOING\nstate. This should avoid the error situation that was described in\n6e6de3dee51a (user space attempting to load a dependent module because\nthe -EEXIST error code would suggest to user space that the first module\nhad been loaded successfully), while avoiding the delay situation too.\n\nThis has been tested on linux-next since December 2022 and passes\nall kmod selftests except test 0009 with module compression enabled\nbut it has been confirmed that this issue has existed and has gone\nunnoticed since prior to this commit and can also be reproduced without\nmodule compression with a simple usleep(5000000) on tools/modprobe.c [0].\nThese failures are caused by hitting the kernel mod_concurrent_max and can\nhappen either due to a self inflicted kernel module auto-loead DoS somehow\nor on a system with large CPU count and each CPU count incorrectly triggering\nmany module auto-loads. Both of those issues need to be fixed in-kernel.\n\n[0] https://lore.kernel.org/all/Y9A4fiobL6IHp%2F%2FP@bombadil.infradead.org/\n\nFixes: 6e6de3dee51a (\"kernel/module.c: Only return -EEXIST for modules that have finished loading\")\nCo-developed-by: Martin Wilck \u003cmwilck@suse.com\u003e\nSigned-off-by: Martin Wilck \u003cmwilck@suse.com\u003e\nSigned-off-by: Petr Pavlu \u003cpetr.pavlu@suse.com\u003e\nCc: stable@vger.kernel.org\nReviewed-by: Petr Mladek \u003cpmladek@suse.com\u003e\n[mcgrof: enhance commit log with testing and kmod test result interpretation ]\nSigned-off-by: Luis Chamberlain \u003cmcgrof@kernel.org\u003e\n" }, { "commit": "5149394c899808667e0f8444d3d39cba1dfb42f7", "tree": "b6a20d0a0b7dae8e7a6ffab1a9d2a4703c162f26", "parents": [ "854f0912f813c3b7a4d35517658ca7f1511a69e2", "ef7592e466ef7b2595fdfdfd23559a779f4b211a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 12:51:49 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 12:51:49 2023 -0800" }, "message": "Merge tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux\n\nPull fsverity MAINTAINERS entry update from Eric Biggers:\n \"Update the MAINTAINERS file entry for fsverity\"\n\n* tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux:\n MAINTAINERS: update fsverity git repo, list, and patchwork\n" }, { "commit": "854f0912f813c3b7a4d35517658ca7f1511a69e2", "tree": "f82e4ce85e882ac840240b4ee3901f3b0cd56174", "parents": [ "7bf70dbb18820b37406fdfa2aaf14c2f5c71a11a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 09:23:56 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 24 12:38:45 2023 -0800" }, "message": "ext4: make xattr char unsignedness in hash explicit\n\nCommit f3bbac32475b (\"ext4: deal with legacy signed xattr name hash\nvalues\") added a hashing function for the legacy case of having the\nxattr hash calculated using a signed \u0027char\u0027 type. It left the unsigned\ncase alone, since it\u0027s all implicitly handled by the \u0027-funsigned-char\u0027\ncompiler option.\n\nHowever, there\u0027s been some noise about back-porting it all into stable\nkernels that lack the \u0027-funsigned-char\u0027, so let\u0027s just make that at\nleast possible by making the whole \u0027this uses unsigned char\u0027 very\nexplicit in the code itself. Whether such a back-port is really\nwarranted or not, I\u0027ll leave to others, but at least together with this\nchange it is technically sensible.\n\nAlso, add a \u0027pr_warn_once()\u0027 for reporting the \"hey, signedness for this\nhash calculation has changed\" issue. Hopefully it never triggers except\nfor that xfstests generic/454 test-case, but even if it does it\u0027s just\ngood information to have.\n\nIf for no other reason than \"we can remove the legacy signed hash code\nentirely if nobody ever sees the message any more\".\n\nCc: Sasha Levin \u003csashal@kernel.org\u003e\nCc: Eric Biggers \u003cebiggers@kernel.org\u003e\nCc: Andreas Dilger \u003cadilger@dilger.ca\u003e\nCc: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e,\nCc: Jason Donenfeld \u003cJason@zx2c4.com\u003e\nCc: Masahiro Yamada \u003cmasahiroy@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d968117a7e8e5572762eacbdbca13bc96710e9a3", "tree": "5d3e80cad20b80f19147b57ed86236e1680566b8", "parents": [ "409db27e3a2eb5e8ef7226ca33be33361b3ed1c9" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jan 24 17:44:14 2023 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jan 24 17:44:14 2023 +0100" }, "message": "Revert \"Merge branch \u0027ethtool-mac-merge\u0027\"\n\nThis reverts commit 0ad999c1eec879f06cc52ef7df4d0dbee4a2d7eb, reversing\nchanges made to e38553bdc377e3e7a6caa9dd9770d8b644d8dac3.\n\nIt was not intended for net.\n\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "facd61053cff100973921d4d45d47cf53c747ec6", "tree": "266bb9677f51408ddd7638e4ce41c2d3b8c7bab9", "parents": [ "1b929c02afd37871d5afb9d498426f83432e71c2" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Jan 20 12:55:04 2023 +0100" }, "committer": { "name": "Christian Brauner (Microsoft)", "email": "brauner@kernel.org", "time": "Tue Jan 24 16:33:37 2023 +0100" }, "message": "fuse: fixes after adapting to new posix acl api\n\nThis cycle we ported all filesystems to the new posix acl api. While\nlooking at further simplifications in this area to remove the last\nremnants of the generic dummy posix acl handlers we realized that we\nregressed fuse daemons that don\u0027t set FUSE_POSIX_ACL but still make use\nof posix acls.\n\nWith the change to a dedicated posix acl api interacting with posix acls\ndoesn\u0027t go through the old xattr codepaths anymore and instead only\nrelies the get acl and set acl inode operations.\n\nBefore this change fuse daemons that don\u0027t set FUSE_POSIX_ACL were able\nto get and set posix acl albeit with two caveats. First, that posix acls\naren\u0027t cached. And second, that they aren\u0027t used for permission checking\nin the vfs.\n\nWe regressed that use-case as we currently refuse to retrieve any posix\nacls if they aren\u0027t enabled via FUSE_POSIX_ACL. So older fuse daemons\nwould see a change in behavior.\n\nWe can restore the old behavior in multiple ways. We could change the\nnew posix acl api and look for a dedicated xattr handler and if we find\none prefer that over the dedicated posix acl api. That would break the\nconsistency of the new posix acl api so we would very much prefer not to\ndo that.\n\nWe could introduce a new ACL_*_CACHE sentinel that would instruct the\nvfs permission checking codepath to not call into the filesystem and\nignore acls.\n\nBut a more straightforward fix for v6.2 is to do the same thing that\nOverlayfs does and give fuse a separate get acl method for permission\nchecking. Overlayfs uses this to express different needs for vfs\npermission lookup and acl based retrieval via the regular system call\npath as well. Let fuse do the same for now. This way fuse can continue\nto refuse to retrieve posix acls for daemons that don\u0027t set\nFUSE_POSXI_ACL for permission checking while allowing a fuse server to\nretrieve it via the usual system calls.\n\nIn the future, we could extend the get acl inode operation to not just\npass a simple boolean to indicate rcu lookup but instead make it a flag\nargument. Then in addition to passing the information that this is an\nrcu lookup to the filesystem we could also introduce a flag that tells\nthe filesystem that this is a request from the vfs to use these acls for\npermission checking. Then fuse could refuse the get acl request for\npermission checking when the daemon doesn\u0027t have FUSE_POSIX_ACL set in\nthe same get acl method. This would also help Overlayfs and allow us to\nremove the second method for it as well.\n\nBut since that change is more invasive as we need to update the get acl\ninode operation for multiple filesystems we should not do this as a fix\nfor v6.2. Instead we will do this for the v6.3 merge window.\n\nFwiw, since posix acls are now always correctly translated in the new\nposix acl api we could also allow them to be used for daemons without\nFUSE_POSIX_ACL that are not mounted on the host. But this is behavioral\nchange and again if dones should be done for v6.3. For now, let\u0027s just\nrestore the original behavior.\n\nA nice side-effect of this change is that for fuse daemons with and\nwithout FUSE_POSIX_ACL the same code is used for posix acls in a\nbackwards compatible way. This also means we can remove the legacy xattr\nhandlers completely. We\u0027ve also added comments to explain the expected\nbehavior for daemons without FUSE_POSIX_ACL into the code.\n\nFixes: 318e66856dde (\"xattr: use posix acl api\")\nSigned-off-by: Seth Forshee (Digital Ocean) \u003csforshee@kernel.org\u003e\nReviewed-by: Miklos Szeredi \u003cmszeredi@redhat.com\u003e\nSigned-off-by: Christian Brauner (Microsoft) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "409db27e3a2eb5e8ef7226ca33be33361b3ed1c9", "tree": "82f9061515debf51e18565b172d8b1742b11ba59", "parents": [ "208a21107ef0ae86c92078caf84ce80053e73f7a" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@amazon.com", "time": "Fri Jan 20 15:19:27 2023 -0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jan 24 11:54:01 2023 +0100" }, "message": "netrom: Fix use-after-free of a listening socket.\n\nsyzbot reported a use-after-free in do_accept(), precisely nr_accept()\nas sk_prot_alloc() allocated the memory and sock_put() frees it. [0]\n\nThe issue could happen if the heartbeat timer is fired and\nnr_heartbeat_expiry() calls nr_destroy_socket(), where a socket\nhas SOCK_DESTROY or a listening socket has SOCK_DEAD.\n\nIn this case, the first condition cannot be true. SOCK_DESTROY is\nflagged in nr_release() only when the file descriptor is close()d,\nbut accept() is being called for the listening socket, so the second\ncondition must be true.\n\nUsually, the AF_NETROM listener neither starts timers nor sets\nSOCK_DEAD. However, the condition is met if connect() fails before\nlisten(). connect() starts the t1 timer and heartbeat timer, and\nt1timer calls nr_disconnect() when timeout happens. Then, SOCK_DEAD\nis set, and if we call listen(), the heartbeat timer calls\nnr_destroy_socket().\n\n nr_connect\n nr_establish_data_link(sk)\n nr_start_t1timer(sk)\n nr_start_heartbeat(sk)\n nr_t1timer_expiry\n nr_disconnect(sk, ETIMEDOUT)\n nr_sk(sk)-\u003estate \u003d NR_STATE_0\n sk-\u003esk_state \u003d TCP_CLOSE\n sock_set_flag(sk, SOCK_DEAD)\nnr_listen\n if (sk-\u003esk_state !\u003d TCP_LISTEN)\n sk-\u003esk_state \u003d TCP_LISTEN\n nr_heartbeat_expiry\n switch (nr-\u003estate)\n case NR_STATE_0\n if (sk-\u003esk_state \u003d\u003d TCP_LISTEN \u0026\u0026\n sock_flag(sk, SOCK_DEAD))\n nr_destroy_socket(sk)\n\nThis path seems expected, and nr_destroy_socket() is called to clean\nup resources. Initially, there was sock_hold() before nr_destroy_socket()\nso that the socket would not be freed, but the commit 517a16b1a88b\n(\"netrom: Decrease sock refcount when sock timers expire\") accidentally\nremoved it.\n\nTo fix use-after-free, let\u0027s add sock_hold().\n\n[0]:\nBUG: KASAN: use-after-free in do_accept+0x483/0x510 net/socket.c:1848\nRead of size 8 at addr ffff88807978d398 by task syz-executor.3/5315\n\nCPU: 0 PID: 5315 Comm: syz-executor.3 Not tainted 6.2.0-rc3-syzkaller-00165-gd9fc1511728c #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:306 [inline]\n print_report+0x15e/0x461 mm/kasan/report.c:417\n kasan_report+0xbf/0x1f0 mm/kasan/report.c:517\n do_accept+0x483/0x510 net/socket.c:1848\n __sys_accept4_file net/socket.c:1897 [inline]\n __sys_accept4+0x9a/0x120 net/socket.c:1927\n __do_sys_accept net/socket.c:1944 [inline]\n __se_sys_accept net/socket.c:1941 [inline]\n __x64_sys_accept+0x75/0xb0 net/socket.c:1941\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7fa436a8c0c9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fa437784168 EFLAGS: 00000246 ORIG_RAX: 000000000000002b\nRAX: ffffffffffffffda RBX: 00007fa436bac050 RCX: 00007fa436a8c0c9\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005\nRBP: 00007fa436ae7ae9 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007ffebc6700df R14: 00007fa437784300 R15: 0000000000022000\n \u003c/TASK\u003e\n\nAllocated by task 5294:\n kasan_save_stack+0x22/0x40 mm/kasan/common.c:45\n kasan_set_track+0x25/0x30 mm/kasan/common.c:52\n ____kasan_kmalloc mm/kasan/common.c:371 [inline]\n ____kasan_kmalloc mm/kasan/common.c:330 [inline]\n __kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:380\n kasan_kmalloc include/linux/kasan.h:211 [inline]\n __do_kmalloc_node mm/slab_common.c:968 [inline]\n __kmalloc+0x5a/0xd0 mm/slab_common.c:981\n kmalloc include/linux/slab.h:584 [inline]\n sk_prot_alloc+0x140/0x290 net/core/sock.c:2038\n sk_alloc+0x3a/0x7a0 net/core/sock.c:2091\n nr_create+0xb6/0x5f0 net/netrom/af_netrom.c:433\n __sock_create+0x359/0x790 net/socket.c:1515\n sock_create net/socket.c:1566 [inline]\n __sys_socket_create net/socket.c:1603 [inline]\n __sys_socket_create net/socket.c:1588 [inline]\n __sys_socket+0x133/0x250 net/socket.c:1636\n __do_sys_socket net/socket.c:1649 [inline]\n __se_sys_socket net/socket.c:1647 [inline]\n __x64_sys_socket+0x73/0xb0 net/socket.c:1647\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nFreed by task 14:\n kasan_save_stack+0x22/0x40 mm/kasan/common.c:45\n kasan_set_track+0x25/0x30 mm/kasan/common.c:52\n kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:518\n ____kasan_slab_free mm/kasan/common.c:236 [inline]\n ____kasan_slab_free+0x13b/0x1a0 mm/kasan/common.c:200\n kasan_slab_free include/linux/kasan.h:177 [inline]\n __cache_free mm/slab.c:3394 [inline]\n __do_kmem_cache_free mm/slab.c:3580 [inline]\n __kmem_cache_free+0xcd/0x3b0 mm/slab.c:3587\n sk_prot_free net/core/sock.c:2074 [inline]\n __sk_destruct+0x5df/0x750 net/core/sock.c:2166\n sk_destruct net/core/sock.c:2181 [inline]\n __sk_free+0x175/0x460 net/core/sock.c:2192\n sk_free+0x7c/0xa0 net/core/sock.c:2203\n sock_put include/net/sock.h:1991 [inline]\n nr_heartbeat_expiry+0x1d7/0x460 net/netrom/nr_timer.c:148\n call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1700\n expire_timers+0x2c6/0x5c0 kernel/time/timer.c:1751\n __run_timers kernel/time/timer.c:2022 [inline]\n __run_timers kernel/time/timer.c:1995 [inline]\n run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035\n __do_softirq+0x1fb/0xadc kernel/softirq.c:571\n\nFixes: 517a16b1a88b (\"netrom: Decrease sock refcount when sock timers expire\")\nReported-by: syzbot+5fafd5cfe1fc91f6b352@syzkaller.appspotmail.com\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nLink: https://lore.kernel.org/r/20230120231927.51711-1-kuniyu@amazon.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a44b7651489f26271ac784b70895e8a85d0cebf4", "tree": "8cd6efe32431f8ddd2650825d1bab2634d1cd13b", "parents": [ "13bd9b31a969b03c8ec1d4eb0f2b9aebd30ebfd8" ], "author": { "name": "Sriram Yagnaraman", "email": "sriram.yagnaraman@est.tech", "time": "Tue Jan 24 02:47:21 2023 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Jan 24 09:52:52 2023 +0100" }, "message": "netfilter: conntrack: unify established states for SCTP paths\n\nAn SCTP endpoint can start an association through a path and tear it\ndown over another one. That means the initial path will not see the\nshutdown sequence, and the conntrack entry will remain in ESTABLISHED\nstate for 5 days.\n\nBy merging the HEARTBEAT_ACKED and ESTABLISHED states into one\nESTABLISHED state, there remains no difference between a primary or\nsecondary path. The timeout for the merged ESTABLISHED state is set to\n210 seconds (hb_interval * max_path_retrans + rto_max). So, even if a\npath doesn\u0027t see the shutdown sequence, it will expire in a reasonable\namount of time.\n\nWith this change in place, there is now more than one state from which\nwe can transition to ESTABLISHED, COOKIE_ECHOED and HEARTBEAT_SENT, so\nhandle the setting of ASSURED bit whenever a state change has happened\nand the new state is ESTABLISHED. Removed the check for dir\u003d\u003dREPLY since\nthe transition to ESTABLISHED can happen only in the reply direction.\n\nFixes: 9fb9cbb1082d (\"[NETFILTER]: Add nf_conntrack subsystem.\")\nSigned-off-by: Sriram Yagnaraman \u003csriram.yagnaraman@est.tech\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "13bd9b31a969b03c8ec1d4eb0f2b9aebd30ebfd8", "tree": "561c88e1acd1757b19195d48050d521e222e468b", "parents": [ "98ee0077452527f971567db01386de3c3d97ce13" ], "author": { "name": "Sriram Yagnaraman", "email": "sriram.yagnaraman@est.tech", "time": "Tue Jan 24 02:47:20 2023 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Jan 24 09:52:32 2023 +0100" }, "message": "Revert \"netfilter: conntrack: add sctp DATA_SENT state\"\n\nThis reverts commit (bff3d0534804: \"netfilter: conntrack: add sctp\nDATA_SENT state\")\n\nUsing DATA/SACK to detect a new connection on secondary/alternate paths\nworks only on new connections, while a HEARTBEAT is required on\nconnection re-use. It is probably consistent to wait for HEARTBEAT to\ncreate a secondary connection in conntrack.\n\nSigned-off-by: Sriram Yagnaraman \u003csriram.yagnaraman@est.tech\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "98ee0077452527f971567db01386de3c3d97ce13", "tree": "91074667060b4febeede75b74d4691da5b5d45c2", "parents": [ "a9993591fa94246b16b444eea55d84c54608282a" ], "author": { "name": "Sriram Yagnaraman", "email": "sriram.yagnaraman@est.tech", "time": "Tue Jan 24 02:47:19 2023 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Jan 24 09:52:31 2023 +0100" }, "message": "netfilter: conntrack: fix bug in for_each_sctp_chunk\n\nskb_header_pointer() will return NULL if offset + sizeof(_sch) exceeds\nskb-\u003elen, so this offset \u003c skb-\u003elen test is redundant.\n\nif sch-\u003elength \u003d\u003d 0, this will end up in an infinite loop, add a check\nfor sch-\u003elength \u003e 0\n\nFixes: 9fb9cbb1082d (\"[NETFILTER]: Add nf_conntrack subsystem.\")\nSuggested-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Sriram Yagnaraman \u003csriram.yagnaraman@est.tech\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "a9993591fa94246b16b444eea55d84c54608282a", "tree": "f099ac977d8dce63b56788dbd1abc2c40fe4f53e", "parents": [ "208a21107ef0ae86c92078caf84ce80053e73f7a" ], "author": { "name": "Sriram Yagnaraman", "email": "sriram.yagnaraman@est.tech", "time": "Tue Jan 24 02:47:18 2023 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Jan 24 09:52:31 2023 +0100" }, "message": "netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE\n\nRFC 9260, Sec 8.5.1 states that for ABORT/SHUTDOWN_COMPLETE, the chunk\nMUST be accepted if the vtag of the packet matches its own tag and the\nT bit is not set OR if it is set to its peer\u0027s vtag and the T bit is set\nin chunk flags. Otherwise the packet MUST be silently dropped.\n\nUpdate vtag verification for ABORT/SHUTDOWN_COMPLETE based on the above\ndescription.\n\nFixes: 9fb9cbb1082d (\"[NETFILTER]: Add nf_conntrack subsystem.\")\nSigned-off-by: Sriram Yagnaraman \u003csriram.yagnaraman@est.tech\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "208a21107ef0ae86c92078caf84ce80053e73f7a", "tree": "d80cbb803b10fe3f7e2f41aae6696e8fdaedbf4c", "parents": [ "571cca79df0a6c0ae9f14be7381e13dad4078fbf", "e2b53ea5a7c1fb484277ad12cd075f502cf03b04" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 22:36:58 2023 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 22:36:59 2023 -0800" }, "message": "Merge branch \u002740GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2023-01-20 (iavf)\n\nThis series contains updates to iavf driver only.\n\nMichal Schmidt converts single iavf workqueue to per adapter to avoid\ndeadlock issues.\n\nMarcin moves setting of VLAN related netdev features to watchdog task to\navoid RTNL deadlock.\n\nStefan Assmann schedules immediate watchdog task execution on changing\nprimary MAC to avoid excessive delay.\n\n* \u002740GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n iavf: schedule watchdog immediately when changing primary MAC\n iavf: Move netdev_update_features() into watchdog task\n iavf: fix temporary deadlock and failure to set MAC address\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20230120211036.430946-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "571cca79df0a6c0ae9f14be7381e13dad4078fbf", "tree": "dec77408ce87dda90ad0731ad194a7aa980e6044", "parents": [ "bce4affe30b297bfa3092bb53e879c0bd86901ab", "5d235d6ce75c12a7fdee375eb211e4116f7ab01b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 21:50:58 2023 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 21:50:58 2023 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter fixes for net\n\n1) Fix overlap detection in rbtree set backend: Detect overlap by going\n through the ordered list of valid tree nodes. To shorten the number of\n visited nodes in the list, this algorithm descends the tree to search\n for an existing element greater than the key value to insert that is\n greater than the new element.\n\n2) Fix for the rbtree set garbage collector: Skip inactive and busy\n elements when checking for expired elements to avoid interference\n with an ongoing transaction from control plane.\n\nThis is a rather large fix coming at this stage of the 6.2-rc. Since\n33c7aba0b4ff (\"netfilter: nf_tables: do not set up extensions for end\ninterval\"), bogus overlap errors in the rbtree set occur more frequently.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: nft_set_rbtree: skip elements in transaction from garbage collection\n netfilter: nft_set_rbtree: Switch to node list walk for overlap detection\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20230123211601.292930-1-pablo@netfilter.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bce4affe30b297bfa3092bb53e879c0bd86901ab", "tree": "0e13f839f56e6f4b8f744154842deaff5ad1bc0f", "parents": [ "8a4f6d023221c4b052ddfa1db48b27871bad6e96" ], "author": { "name": "Mat Martineau", "email": "mathew.j.martineau@linux.intel.com", "time": "Fri Jan 20 15:11:21 2023 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 21:42:13 2023 -0800" }, "message": "MAINTAINERS: Update MPTCP maintainer list and CREDITS\n\nMy responsibilities at Intel have changed, so I\u0027m handing off exclusive\nMPTCP subsystem maintainer duties to Matthieu. It has been a privilege\nto see MPTCP through its initial upstreaming and first few years in the\nupstream kernel!\n\nAcked-by: Matthieu Baerts \u003cmatthieu.baerts@tessares.net\u003e\nSigned-off-by: Mat Martineau \u003cmathew.j.martineau@linux.intel.com\u003e\nLink: https://lore.kernel.org/r/20230120231121.36121-1-mathew.j.martineau@linux.intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8a4f6d023221c4b052ddfa1db48b27871bad6e96", "tree": "c7ad72d3dc280260f5302602c635619c3ece880c", "parents": [ "360fdc999d92db4a4adbba0db8641396dc9f1b13" ], "author": { "name": "Alexandru Tachici", "email": "alexandru.tachici@analog.com", "time": "Fri Jan 20 11:08:46 2023 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 21:41:33 2023 -0800" }, "message": "net: ethernet: adi: adin1110: Fix multicast offloading\n\nDriver marked broadcast/multicast frames as offloaded incorrectly.\nMark them as offloaded only when HW offloading has been enabled.\nThis should happen only for ADIN2111 when both ports are bridged\nby the software.\n\nFixes: bc93e19d088b (\"net: ethernet: adi: Add ADIN1110 support\")\nSigned-off-by: Alexandru Tachici \u003calexandru.tachici@analog.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://lore.kernel.org/r/20230120090846.18172-1-alexandru.tachici@analog.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "360fdc999d92db4a4adbba0db8641396dc9f1b13", "tree": "3cebd9b9de5bc4d09751975c1831a752b444776a", "parents": [ "5e9398a26a92fc402d82ce1f97cc67d832527da0" ], "author": { "name": "Ahmad Fatoum", "email": "a.fatoum@pengutronix.de", "time": "Fri Jan 20 12:09:32 2023 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 21:40:54 2023 -0800" }, "message": "net: dsa: microchip: fix probe of I2C-connected KSZ8563\n\nStarting with commit eee16b147121 (\"net: dsa: microchip: perform the\ncompatibility check for dev probed\"), the KSZ switch driver now bails\nout if it thinks the DT compatible doesn\u0027t match the actual chip ID\nread back from the hardware:\n\n ksz9477-switch 1-005f: Device tree specifies chip KSZ9893 but found\n KSZ8563, please fix it!\n\nFor the KSZ8563, which used ksz_switch_chips[KSZ9893], this was fine\nat first, because it indeed shares the same chip id as the KSZ9893.\n\nCommit b44908095612 (\"net: dsa: microchip: add separate struct\nksz_chip_data for KSZ8563 chip\") started differentiating KSZ9893\ncompatible chips by consulting the 0x1F register. The resulting breakage\nwas fixed for the SPI driver in the same commit by introducing the\nappropriate ksz_switch_chips[KSZ8563], but not for the I2C driver.\n\nFix this for I2C-connected KSZ8563 now to get it probing again.\n\nFixes: b44908095612 (\"net: dsa: microchip: add separate struct ksz_chip_data for KSZ8563 chip\").\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: Ahmad Fatoum \u003ca.fatoum@pengutronix.de\u003e\nAcked-by: Arun Ramadoss \u003carun.ramadoss@microchip.com\u003e\nReviewed-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nLink: https://lore.kernel.org/r/20230120110933.1151054-1-a.fatoum@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5e9398a26a92fc402d82ce1f97cc67d832527da0", "tree": "306205c5751a295601e5889e5ae3fb9d0bb385eb", "parents": [ "1d1d63b612801b3f0a39b7d4467cad0abd60e5c8" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Jan 20 13:31:40 2023 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 21:37:39 2023 -0800" }, "message": "ipv4: prevent potential spectre v1 gadget in fib_metrics_match()\n\nif (!type)\n continue;\n if (type \u003e RTAX_MAX)\n return false;\n ...\n fi_val \u003d fi-\u003efib_metrics-\u003emetrics[type - 1];\n\n@type being used as an array index, we need to prevent\ncpu speculation or risk leaking kernel memory content.\n\nFixes: 5f9ae3d9e7e4 (\"ipv4: do metrics match when looking up and deleting a route\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://lore.kernel.org/r/20230120133140.3624204-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1d1d63b612801b3f0a39b7d4467cad0abd60e5c8", "tree": "87f21e16483d19ff80e3de39b4be7246afe530fc", "parents": [ "d6ab640c21ed3b471e42ea783223c396e102c02d" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Jan 20 13:30:40 2023 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 21:37:25 2023 -0800" }, "message": "ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()\n\nif (!type)\n\t\tcontinue;\n\tif (type \u003e RTAX_MAX)\n\t\treturn -EINVAL;\n\t...\n\tmetrics[type - 1] \u003d val;\n\n@type being used as an array index, we need to prevent\ncpu speculation or risk leaking kernel memory content.\n\nFixes: 6cf9dfd3bd62 (\"net: fib: move metrics parsing to a helper\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://lore.kernel.org/r/20230120133040.3623463-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d6ab640c21ed3b471e42ea783223c396e102c02d", "tree": "d5dd28e7a9bb8b9fb52c64c19979a6256ba0954c", "parents": [ "9f535c870e493841ac7be390610ff2edec755762", "9b663b5cbb15b494ef132a3c937641c90646eb73" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 21:35:55 2023 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 21:35:56 2023 -0800" }, "message": "Merge branch \u0027netlink-annotate-various-data-races\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetlink: annotate various data races\n\nA recent syzbot report came to my attention.\n\nAfter addressing it, I also fixed other related races.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20230120125955.3453768-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9b663b5cbb15b494ef132a3c937641c90646eb73", "tree": "d5dd28e7a9bb8b9fb52c64c19979a6256ba0954c", "parents": [ "004db64d185a5f23dfb891d7701e23713b2420ee" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Jan 20 12:59:55 2023 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 21:35:53 2023 -0800" }, "message": "netlink: annotate data races around sk_state\n\nnetlink_getsockbyportid() reads sk_state while a concurrent\nnetlink_connect() can change its value.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "004db64d185a5f23dfb891d7701e23713b2420ee", "tree": "18367904d8bc5f54706633c4d783374b5bba3bc6", "parents": [ "c1bb9484e3b05166880da8574504156ccbd0549e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Jan 20 12:59:54 2023 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 21:35:53 2023 -0800" }, "message": "netlink: annotate data races around dst_portid and dst_group\n\nnetlink_getname(), netlink_sendmsg() and netlink_getsockbyportid()\ncan read nlk-\u003edst_portid and nlk-\u003edst_group while another\nthread is changing them.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c1bb9484e3b05166880da8574504156ccbd0549e", "tree": "f10462378b48ae1f238eaf3c755853cfd4c7b1e7", "parents": [ "9f535c870e493841ac7be390610ff2edec755762" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Jan 20 12:59:53 2023 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 23 21:35:53 2023 -0800" }, "message": "netlink: annotate data races around nlk-\u003eportid\n\nsyzbot reminds us netlink_getname() runs locklessly [1]\n\nThis first patch annotates the race against nlk-\u003eportid.\n\nFollowing patches take care of the remaining races.\n\n[1]\nBUG: KCSAN: data-race in netlink_getname / netlink_insert\n\nwrite to 0xffff88814176d310 of 4 bytes by task 2315 on cpu 1:\nnetlink_insert+0xf1/0x9a0 net/netlink/af_netlink.c:583\nnetlink_autobind+0xae/0x180 net/netlink/af_netlink.c:856\nnetlink_sendmsg+0x444/0x760 net/netlink/af_netlink.c:1895\nsock_sendmsg_nosec net/socket.c:714 [inline]\nsock_sendmsg net/socket.c:734 [inline]\n____sys_sendmsg+0x38f/0x500 net/socket.c:2476\n___sys_sendmsg net/socket.c:2530 [inline]\n__sys_sendmsg+0x19a/0x230 net/socket.c:2559\n__do_sys_sendmsg net/socket.c:2568 [inline]\n__se_sys_sendmsg net/socket.c:2566 [inline]\n__x64_sys_sendmsg+0x42/0x50 net/socket.c:2566\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nread to 0xffff88814176d310 of 4 bytes by task 2316 on cpu 0:\nnetlink_getname+0xcd/0x1a0 net/netlink/af_netlink.c:1144\n__sys_getsockname+0x11d/0x1b0 net/socket.c:2026\n__do_sys_getsockname net/socket.c:2041 [inline]\n__se_sys_getsockname net/socket.c:2038 [inline]\n__x64_sys_getsockname+0x3e/0x50 net/socket.c:2038\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nvalue changed: 0x00000000 -\u003e 0xc9a49780\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 PID: 2316 Comm: syz-executor.2 Not tainted 6.2.0-rc3-syzkaller-00030-ge8f60cd7db24-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5d235d6ce75c12a7fdee375eb211e4116f7ab01b", "tree": "8b5aadbc9be93d2be211d9e3254d46338d324d0e", "parents": [ "c9e6978e2725a7d4b6cd23b2facd3f11422c0643" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Sat Jan 14 23:49:46 2023 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Mon Jan 23 21:38:33 2023 +0100" }, "message": "netfilter: nft_set_rbtree: skip elements in transaction from garbage collection\n\nSkip interference with an ongoing transaction, do not perform garbage\ncollection on inactive elements. Reset annotated previous end interval\nif the expired element is marked as busy (control plane removed the\nelement right before expiration).\n\nFixes: 8d8540c4f5e0 (\"netfilter: nft_set_rbtree: add timeout support\")\nReviewed-by: Stefano Brivio \u003csbrivio@redhat.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "c9e6978e2725a7d4b6cd23b2facd3f11422c0643", "tree": "f08e1334f56aaa238eb62132126fbedf52e7ff81", "parents": [ "71ab9c3e2253619136c31c89dbb2c69305cc89b1" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Sat Jan 14 23:38:32 2023 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Mon Jan 23 21:36:38 2023 +0100" }, "message": "netfilter: nft_set_rbtree: Switch to node list walk for overlap detection\n\n...instead of a tree descent, which became overly complicated in an\nattempt to cover cases where expired or inactive elements would affect\ncomparisons with the new element being inserted.\n\nFurther, it turned out that it\u0027s probably impossible to cover all those\ncases, as inactive nodes might entirely hide subtrees consisting of a\ncomplete interval plus a node that makes the current insertion not\noverlap.\n\nTo speed up the overlap check, descent the tree to find a greater\nelement that is closer to the key value to insert. Then walk down the\nnode list for overlap detection. Starting the overlap check from\nrb_first() unconditionally is slow, it takes 10 times longer due to the\nfull linear traversal of the list.\n\nMoreover, perform garbage collection of expired elements when walking\ndown the node list to avoid bogus overlap reports.\n\nFor the insertion operation itself, this essentially reverts back to the\nimplementation before commit 7c84d41416d8 (\"netfilter: nft_set_rbtree:\nDetect partial overlaps on insertion\"), except that cases of complete\noverlap are already handled in the overlap detection phase itself, which\nslightly simplifies the loop to find the insertion point.\n\nBased on initial patch from Stefano Brivio, including text from the\noriginal patch description too.\n\nFixes: 7c84d41416d8 (\"netfilter: nft_set_rbtree: Detect partial overlaps on insertion\")\nReviewed-by: Stefano Brivio \u003csbrivio@redhat.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "7bf70dbb18820b37406fdfa2aaf14c2f5c71a11a", "tree": "c42e7df4fba9ba66e9135dedec0c26b93b4cbd64", "parents": [ "9946f0981ff8698848ee79d739f432a2a3e68eed", "51cdc8bc120ef6e42f6fb758341f5d91bc955952" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jan 23 11:56:07 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jan 23 11:56:07 2023 -0800" }, "message": "Merge tag \u0027vfio-v6.2-rc6\u0027 of https://github.com/awilliam/linux-vfio\n\nPull VFIO fixes from Alex Williamson:\n\n - Honor reserved regions when testing for IOMMU find grained super page\n support, avoiding a regression on s390 for a firmware device where\n the existence of the mapping, even if unused can trigger an error\n state. (Niklas Schnelle)\n\n - Fix a deadlock in releasing KVM references by using the alternate\n .release() rather than .destroy() callback for the kvm-vfio device.\n (Yi Liu)\n\n* tag \u0027vfio-v6.2-rc6\u0027 of https://github.com/awilliam/linux-vfio:\n kvm/vfio: Fix potential deadlock on vfio group_lock\n vfio/type1: Respect IOMMU reserved regions in vfio_test_domain_fgsp()\n" }, { "commit": "9946f0981ff8698848ee79d739f432a2a3e68eed", "tree": "993b08569f46b2bd1a478b5beee510ae21ffa1a6", "parents": [ "2475bf0250dee99b477e0c56d7dc9d7ac3f04117", "e1fabbc83cb1dd4ba63932faa86c9cacb8bf791e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jan 23 11:46:19 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jan 23 11:46:19 2023 -0800" }, "message": "Merge tag \u0027efi-fixes-for-v6.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi\n\nPull EFI fixes from Ard Biesheuvel:\n \"Another couple of EFI fixes, of which the first two were already in\n -next when I sent out the previous PR, but they caused some issues on\n non-EFI boots so I let them simmer for a bit longer.\n\n - ensure the EFI ResetSystem and ACPI PRM calls are recognized as\n users of the EFI runtime, and therefore protected against\n exceptions\n\n - account for the EFI runtime stack in the stacktrace code\n\n - remove Matthew Garrett\u0027s MAINTAINERS entry for efivarfs\"\n\n* tag \u0027efi-fixes-for-v6.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:\n efi: Remove Matthew Garrett as efivarfs maintainer\n arm64: efi: Account for the EFI runtime stack in stack unwinder\n arm64: efi: Avoid workqueue to check whether EFI runtime is live\n" }, { "commit": "4bdbba54e9b1c769da8ded9abd209d765715e1d6", "tree": "5dc3af2ca14cef52d2d784375062ed04acc6d21d", "parents": [ "7c24fa225081f31bc6da6a355c1ba801889ab29a" ], "author": { "name": "Jeff Layton", "email": "jlayton@kernel.org", "time": "Fri Jan 20 14:52:14 2023 -0500" }, "committer": { "name": "Chuck Lever", "email": "chuck.lever@oracle.com", "time": "Mon Jan 23 09:51:17 2023 -0500" }, "message": "nfsd: don\u0027t free files unconditionally in __nfsd_file_cache_purge\n\nnfsd_file_cache_purge is called when the server is shutting down, in\nwhich case, tearing things down is generally fine, but it also gets\ncalled when the exports cache is flushed.\n\nInstead of walking the cache and freeing everything unconditionally,\nhandle it the same as when we have a notification of conflicting access.\n\nFixes: ac3a2585f018 (\"nfsd: rework refcounting in filecache\")\nReported-by: Ruben Vestergaard \u003crubenv@drcmr.dk\u003e\nReported-by: Torkil Svensgaard \u003ctorkil@drcmr.dk\u003e\nReported-by: Shachar Kagan \u003cskagan@nvidia.com\u003e\nSigned-off-by: Jeff Layton \u003cjlayton@kernel.org\u003e\nTested-by: Shachar Kagan \u003cskagan@nvidia.com\u003e\nSigned-off-by: Chuck Lever \u003cchuck.lever@oracle.com\u003e\n" }, { "commit": "9f535c870e493841ac7be390610ff2edec755762", "tree": "00a7ffc83e46c93bd89d3217ddeeafd1885eb075", "parents": [ "0ad999c1eec879f06cc52ef7df4d0dbee4a2d7eb" ], "author": { "name": "Gergely Risko", "email": "gergely.risko@gmail.com", "time": "Thu Jan 19 14:40:41 2023 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 23 11:17:37 2023 +0000" }, "message": "ipv6: fix reachability confirmation with proxy_ndp\n\nWhen proxying IPv6 NDP requests, the adverts to the initial multicast\nsolicits are correct and working. On the other hand, when later a\nreachability confirmation is requested (on unicast), no reply is sent.\n\nThis causes the neighbor entry expiring on the sending node, which is\nmostly a non-issue, as a new multicast request is sent. There are\nrouters, where the multicast requests are intentionally delayed, and in\nthese environments the current implementation causes periodic packet\nloss for the proxied endpoints.\n\nThe root cause is the erroneous decrease of the hop limit, as this\nis checked in ndisc.c and no answer is generated when it\u0027s 254 instead\nof the correct 255.\n\nCc: stable@vger.kernel.org\nFixes: 46c7655f0b56 (\"ipv6: decrease hop limit counter in ip6_forward()\")\nSigned-off-by: Gergely Risko \u003cgergely.risko@gmail.com\u003e\nTested-by: Gergely Risko \u003cgergely.risko@gmail.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0ad999c1eec879f06cc52ef7df4d0dbee4a2d7eb", "tree": "b23f87fbe3023f82188481b1a393a9e5c6b6df90", "parents": [ "e38553bdc377e3e7a6caa9dd9770d8b644d8dac3", "7c494a7749a7d6ee95cfae6a8c109c5d63103d88" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 23 10:58:12 2023 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 23 10:58:12 2023 +0000" }, "message": "Merge branch \u0027ethtool-mac-merge\u0027\n\nVladimir Oltean say:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nethtool support for IEEE 802.3 MAC Merge layer\n\nChange log\n----------\n\nv3-\u003ev4:\n- add missing opening bracket in ocelot_port_mm_irq()\n- moved cfg.verify_time range checking so that it actually takes place\n for the updated rather than old value\nv3 at:\nhttps://patchwork.kernel.org/project/netdevbpf/cover/20230117085947.2176464-1-vladimir.oltean@nxp.com/\n\nv2-\u003ev3:\n- made get_mm return int instead of void\n- deleted ETHTOOL_A_MM_SUPPORTED\n- renamed ETHTOOL_A_MM_ADD_FRAG_SIZE to ETHTOOL_A_MM_TX_MIN_FRAG_SIZE\n- introduced ETHTOOL_A_MM_RX_MIN_FRAG_SIZE\n- cleaned up documentation\n- rebased on top of PLCA changes\n- renamed ETHTOOL_STATS_SRC_* to ETHTOOL_MAC_STATS_SRC_*\nv2 at:\nhttps://patchwork.kernel.org/project/netdevbpf/cover/20230111161706.1465242-1-vladimir.oltean@nxp.com/\n\nv1-\u003ev2:\nI\u0027ve decided to focus just on the MAC Merge layer for now, which is why\nI am able to submit this patch set as non-RFC.\nv1 (RFC) at:\nhttps://patchwork.kernel.org/project/netdevbpf/cover/20220816222920.1952936-1-vladimir.oltean@nxp.com/\n\nWhat is being introduced\n------------------------\n\nTL;DR: a MAC Merge layer as defined by IEEE 802.3-2018, clause 99\n(interspersing of express traffic). This is controlled through ethtool\nnetlink (ETHTOOL_MSG_MM_GET, ETHTOOL_MSG_MM_SET). The raw ethtool\ncommands are posted here:\nhttps://patchwork.kernel.org/project/netdevbpf/cover/20230111153638.1454687-1-vladimir.oltean@nxp.com/\n\nThe MAC Merge layer has its own statistics counters\n(ethtool --include-statistics --show-mm swp0) as well as two member\nMACs, the statistics of which can be queried individually, through a new\nethtool netlink attribute, corresponding to:\n\n$ ethtool -I --show-pause eno2 --src aggregate\n$ ethtool -S eno2 --groups eth-mac eth-phy eth-ctrl rmon -- --src pmac\n\nThe core properties of the MAC Merge layer are described in great detail\nin patches 02/12 and 03/12. They can be viewed in \"make htmldocs\" format.\n\nDevices for which the API is supported\n--------------------------------------\n\nI decided to start with the Ethernet switch on NXP LS1028A (Felix)\nbecause of the smaller patch set. I also have support for the ENETC\ncontroller pending.\n\nI would like to get confirmation that the UAPI being proposed here will\nnot restrict any use cases known by other hardware vendors.\n\nWhy is support for preemptible traffic classes not here?\n--------------------------------------------------------\n\nThere is legitimate concern whether the 802.1Q portion of the standard\n(which traffic classes go to the eMAC and which to the pMAC) should be\nmodeled in Linux using tc or using another UAPI. I think that is\nstalling the entire series, but should be discussed separately instead.\nRemoving FP adminStatus support makes me confident enough to submit this\npatch set without an RFC tag (meaning: I wouldn\u0027t mind if it was merged\nas is).\n\nWhat is submitted here is sufficient for an LLDP daemon to do its job.\nI\u0027ve patched openlldp to advertise and configure frame preemption:\nhttps://github.com/vladimiroltean/openlldp/tree/frame-preemption-v3\n\nIn case someone wants to try it out, here are some commands I\u0027ve used.\n\n # Configure the interfaces to receive and transmit LLDP Data Units\n lldptool -L -i eno0 adminStatus\u003drxtx\n lldptool -L -i swp0 adminStatus\u003drxtx\n # Enable the transmission of certain TLVs on switch\u0027s interface\n lldptool -T -i eno0 -V addEthCap enableTx\u003dyes\n lldptool -T -i swp0 -V addEthCap enableTx\u003dyes\n # Query LLDP statistics on switch\u0027s interface\n lldptool -S -i swp0\n # Query the received neighbor TLVs\n lldptool -i swp0 -t -n -V addEthCap\n Additional Ethernet Capabilities TLV\n Preemption capability supported\n Preemption capability enabled\n Preemption capability active\n Additional fragment size: 60 octets\n\nSo using this patch set, lldpad will be able to advertise and configure\nframe preemption, but still, no data packet will be sent as preemptible\nover the link, because there is no UAPI to control which traffic classes\nare sent as preemptible and which as express.\n\nPreemptable or preemptible?\n---------------------------\n\nIEEE 802.3 uses \"preemptable\" throughout. IEEE 802.1Q uses \"preemptible\"\nthroughout. Because the definition of \"preemptible\" falls under 802.1Q\u0027s\njurisdiction and 802.3 just references it, I went with the 802.1Q naming\neven where supporting an 802.3 feature. Also, checkpatch agrees with this.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7c494a7749a7d6ee95cfae6a8c109c5d63103d88", "tree": "b23f87fbe3023f82188481b1a393a9e5c6b6df90", "parents": [ "e38553bdc377e3e7a6caa9dd9770d8b644d8dac3" ], "author": { "name": "Vladimir Oltean", "email": "vladimir.oltean@nxp.com", "time": "Thu Jan 19 14:26:53 2023 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 23 10:58:12 2023 +0000" }, "message": "net: ethtool: netlink: introduce ethnl_update_bool()\n\nDue to the fact that the kernel-side data structures have been carried\nover from the ioctl-based ethtool, we are now in the situation where we\nhave an ethnl_update_bool32() function, but the plain function that\noperates on a boolean value kept in an actual u8 netlink attribute\ndoesn\u0027t exist.\n\nWith new ethtool features that are exposed solely over netlink, the\nkernel data structures will use the \"bool\" type, so we will need this\nkind of helper. Introduce it now; it\u0027s needed for things like\nverify-disabled for the MAC merge configuration.\n\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e38553bdc377e3e7a6caa9dd9770d8b644d8dac3", "tree": "4c0edeb2c38a8b857d96a8c956d450c826fea28f", "parents": [ "71ab9c3e2253619136c31c89dbb2c69305cc89b1" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Thu Jan 19 12:37:47 2023 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 23 10:45:20 2023 +0000" }, "message": "net: fec: Use page_pool_put_full_page when freeing rx buffers\n\nThe page_pool_release_page was used when freeing rx buffers, and this\nfunction just unmaps the page (if mapped) and does not recycle the page.\nSo after hundreds of down/up the eth0, the system will out of memory.\nFor more details, please refer to the following reproduce steps and\nbug logs. To solve this issue and refer to the doc of page pool, the\npage_pool_put_full_page should be used to replace page_pool_release_page.\nBecause this API will try to recycle the page if the page refcnt equal to\n1. After testing 20000 times, the issue can not be reproduced anymore\n(about testing 391 times the issue will occur on i.MX8MN-EVK before).\n\nReproduce steps:\nCreate the test script and run the script. The script content is as\nfollows:\nLOOPS\u003d20000\ni\u003d1\nwhile [ $i -le $LOOPS ]\ndo\n echo \"TINFO:ENET $curface up and down test $i times\"\n org_macaddr\u003d$(cat /sys/class/net/eth0/address)\n ifconfig eth0 down\n ifconfig eth0 hw ether $org_macaddr up\n i\u003d$(expr $i + 1)\ndone\nsleep 5\nif cat /sys/class/net/eth0/operstate | grep \u0027up\u0027;then\n echo \"TEST PASS\"\nelse\n echo \"TEST FAIL\"\nfi\n\nBug detail logs:\nTINFO:ENET up and down test 391 times\n[ 850.471205] Qualcomm Atheros AR8031/AR8033 30be0000.ethernet-1:00: attached PHY driver (mii_bus:phy_addr\u003d30be0000.ethernet-1:00, irq\u003dPOLL)\n[ 853.535318] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready\n[ 853.541694] fec 30be0000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx\n[ 870.590531] page_pool_release_retry() stalled pool shutdown 199 inflight 60 sec\n[ 931.006557] page_pool_release_retry() stalled pool shutdown 199 inflight 120 sec\nTINFO:ENET up and down test 392 times\n[ 991.426544] page_pool_release_retry() stalled pool shutdown 192 inflight 181 sec\n[ 1051.838531] page_pool_release_retry() stalled pool shutdown 170 inflight 241 sec\n[ 1093.751217] Qualcomm Atheros AR8031/AR8033 30be0000.ethernet-1:00: attached PHY driver (mii_bus:phy_addr\u003d30be0000.ethernet-1:00, irq\u003dPOLL)\n[ 1096.446520] page_pool_release_retry() stalled pool shutdown 308 inflight 60 sec\n[ 1096.831245] fec 30be0000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx\n[ 1096.839092] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready\n[ 1112.254526] page_pool_release_retry() stalled pool shutdown 103 inflight 302 sec\n[ 1156.862533] page_pool_release_retry() stalled pool shutdown 308 inflight 120 sec\n[ 1172.674516] page_pool_release_retry() stalled pool shutdown 103 inflight 362 sec\n[ 1217.278532] page_pool_release_retry() stalled pool shutdown 308 inflight 181 sec\nTINFO:ENET up and down test 393 times\n[ 1233.086535] page_pool_release_retry() stalled pool shutdown 103 inflight 422 sec\n[ 1277.698513] page_pool_release_retry() stalled pool shutdown 308 inflight 241 sec\n[ 1293.502525] page_pool_release_retry() stalled pool shutdown 86 inflight 483 sec\n[ 1338.110518] page_pool_release_retry() stalled pool shutdown 308 inflight 302 sec\n[ 1353.918540] page_pool_release_retry() stalled pool shutdown 32 inflight 543 sec\n[ 1361.179205] Qualcomm Atheros AR8031/AR8033 30be0000.ethernet-1:00: attached PHY driver (mii_bus:phy_addr\u003d30be0000.ethernet-1:00, irq\u003dPOLL)\n[ 1364.255298] fec 30be0000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx\n[ 1364.263189] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready\n[ 1371.998532] page_pool_release_retry() stalled pool shutdown 310 inflight 60 sec\n[ 1398.530542] page_pool_release_retry() stalled pool shutdown 308 inflight 362 sec\n[ 1414.334539] page_pool_release_retry() stalled pool shutdown 16 inflight 604 sec\n[ 1432.414520] page_pool_release_retry() stalled pool shutdown 310 inflight 120 sec\n[ 1458.942523] page_pool_release_retry() stalled pool shutdown 308 inflight 422 sec\n[ 1474.750521] page_pool_release_retry() stalled pool shutdown 16 inflight 664 sec\nTINFO:ENET up and down test 394 times\n[ 1492.830522] page_pool_release_retry() stalled pool shutdown 310 inflight 181 sec\n[ 1519.358519] page_pool_release_retry() stalled pool shutdown 308 inflight 483 sec\n[ 1535.166545] page_pool_release_retry() stalled pool shutdown 2 inflight 724 sec\n[ 1537.090278] eth_test2.sh invoked oom-killer: gfp_mask\u003d0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order\u003d0, oom_score_adj\u003d0\n[ 1537.101192] CPU: 3 PID: 2379 Comm: eth_test2.sh Tainted: G C 6.1.1+g56321e101aca #1\n[ 1537.110249] Hardware name: NXP i.MX8MNano EVK board (DT)\n[ 1537.115561] Call trace:\n[ 1537.118005] dump_backtrace.part.0+0xe0/0xf0\n[ 1537.122289] show_stack+0x18/0x40\n[ 1537.125608] dump_stack_lvl+0x64/0x80\n[ 1537.129276] dump_stack+0x18/0x34\n[ 1537.132592] dump_header+0x44/0x208\n[ 1537.136083] oom_kill_process+0x2b4/0x2c0\n[ 1537.140097] out_of_memory+0xe4/0x594\n[ 1537.143766] __alloc_pages+0xb68/0xd00\n[ 1537.147521] alloc_pages+0xac/0x160\n[ 1537.151013] __get_free_pages+0x14/0x40\n[ 1537.154851] pgd_alloc+0x1c/0x30\n[ 1537.158082] mm_init+0xf8/0x1d0\n[ 1537.161228] mm_alloc+0x48/0x60\n[ 1537.164368] alloc_bprm+0x7c/0x240\n[ 1537.167777] do_execveat_common.isra.0+0x70/0x240\n[ 1537.172486] __arm64_sys_execve+0x40/0x54\n[ 1537.176502] invoke_syscall+0x48/0x114\n[ 1537.180255] el0_svc_common.constprop.0+0xcc/0xec\n[ 1537.184964] do_el0_svc+0x2c/0xd0\n[ 1537.188280] el0_svc+0x2c/0x84\n[ 1537.191340] el0t_64_sync_handler+0xf4/0x120\n[ 1537.195613] el0t_64_sync+0x18c/0x190\n[ 1537.199334] Mem-Info:\n[ 1537.201620] active_anon:342 inactive_anon:10343 isolated_anon:0\n[ 1537.201620] active_file:54 inactive_file:112 isolated_file:0\n[ 1537.201620] unevictable:0 dirty:0 writeback:0\n[ 1537.201620] slab_reclaimable:2620 slab_unreclaimable:7076\n[ 1537.201620] mapped:1489 shmem:2473 pagetables:466\n[ 1537.201620] sec_pagetables:0 bounce:0\n[ 1537.201620] kernel_misc_reclaimable:0\n[ 1537.201620] free:136672 free_pcp:96 free_cma:129241\n[ 1537.240419] Node 0 active_anon:1368kB inactive_anon:41372kB active_file:216kB inactive_file:5052kB unevictable:0kB isolated(anon):0kB isolated(file):0kB s\n[ 1537.271422] Node 0 DMA free:541636kB boost:0kB min:30000kB low:37500kB high:45000kB reserved_highatomic:0KB active_anon:1368kB inactive_anon:41372kB actiB\n[ 1537.300219] lowmem_reserve[]: 0 0 0 0\n[ 1537.303929] Node 0 DMA: 1015*4kB (UMEC) 743*8kB (UMEC) 417*16kB (UMEC) 235*32kB (UMEC) 116*64kB (UMEC) 25*128kB (UMEC) 4*256kB (UC) 2*512kB (UC) 0*1024kBB\n[ 1537.323938] Node 0 hugepages_total\u003d0 hugepages_free\u003d0 hugepages_surp\u003d0 hugepages_size\u003d1048576kB\n[ 1537.332708] Node 0 hugepages_total\u003d0 hugepages_free\u003d0 hugepages_surp\u003d0 hugepages_size\u003d32768kB\n[ 1537.341292] Node 0 hugepages_total\u003d0 hugepages_free\u003d0 hugepages_surp\u003d0 hugepages_size\u003d2048kB\n[ 1537.349776] Node 0 hugepages_total\u003d0 hugepages_free\u003d0 hugepages_surp\u003d0 hugepages_size\u003d64kB\n[ 1537.358087] 2939 total pagecache pages\n[ 1537.361876] 0 pages in swap cache\n[ 1537.365229] Free swap \u003d 0kB\n[ 1537.368147] Total swap \u003d 0kB\n[ 1537.371065] 516096 pages RAM\n[ 1537.373959] 0 pages HighMem/MovableOnly\n[ 1537.377834] 17302 pages reserved\n[ 1537.381103] 163840 pages cma reserved\n[ 1537.384809] 0 pages hwpoisoned\n[ 1537.387902] Tasks state (memory values in pages):\n[ 1537.392652] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name\n[ 1537.401356] [ 201] 993 201 1130 72 45056 0 0 rpcbind\n[ 1537.409772] [ 202] 0 202 4529 1640 77824 0 -250 systemd-journal\n[ 1537.418861] [ 222] 0 222 4691 801 69632 0 -1000 systemd-udevd\n[ 1537.427787] [ 248] 994 248 20914 130 65536 0 0 systemd-timesyn\n[ 1537.436884] [ 497] 0 497 620 31 49152 0 0 atd\n[ 1537.444938] [ 500] 0 500 854 77 53248 0 0 crond\n[ 1537.453165] [ 503] 997 503 1470 160 49152 0 -900 dbus-daemon\n[ 1537.461908] [ 505] 0 505 633 24 40960 0 0 firmwared\n[ 1537.470491] [ 513] 0 513 2507 180 61440 0 0 ofonod\n[ 1537.478800] [ 514] 990 514 69640 137 81920 0 0 parsec\n[ 1537.487120] [ 533] 0 533 599 39 40960 0 0 syslogd\n[ 1537.495518] [ 534] 0 534 4546 148 65536 0 0 systemd-logind\n[ 1537.504560] [ 535] 0 535 690 24 45056 0 0 tee-supplicant\n[ 1537.513564] [ 540] 996 540 2769 168 61440 0 0 systemd-network\n[ 1537.522680] [ 566] 0 566 3878 228 77824 0 0 connmand\n[ 1537.531168] [ 645] 998 645 1538 133 57344 0 0 avahi-daemon\n[ 1537.540004] [ 646] 998 646 1461 64 57344 0 0 avahi-daemon\n[ 1537.548846] [ 648] 992 648 781 41 45056 0 0 rpc.statd\n[ 1537.557415] [ 650] 64371 650 590 23 45056 0 0 ninfod\n[ 1537.565754] [ 653] 61563 653 555 24 45056 0 0 rdisc\n[ 1537.573971] [ 655] 0 655 374569 2999 290816 0 -999 containerd\n[ 1537.582621] [ 658] 0 658 1311 20 49152 0 0 agetty\n[ 1537.590922] [ 663] 0 663 1529 97 49152 0 0 login\n[ 1537.599138] [ 666] 0 666 3430 202 69632 0 0 wpa_supplicant\n[ 1537.608147] [ 667] 0 667 2344 96 61440 0 0 systemd-userdbd\n[ 1537.617240] [ 677] 0 677 2964 314 65536 0 100 systemd\n[ 1537.625651] [ 679] 0 679 3720 646 73728 0 100 (sd-pam)\n[ 1537.634138] [ 687] 0 687 1289 403 45056 0 0 sh\n[ 1537.642108] [ 789] 0 789 970 93 45056 0 0 eth_test2.sh\n[ 1537.650955] [ 2355] 0 2355 2346 94 61440 0 0 systemd-userwor\n[ 1537.660046] [ 2356] 0 2356 2346 94 61440 0 0 systemd-userwor\n[ 1537.669137] [ 2358] 0 2358 2346 95 57344 0 0 systemd-userwor\n[ 1537.678258] [ 2379] 0 2379 970 93 45056 0 0 eth_test2.sh\n[ 1537.687098] oom-kill:constraint\u003dCONSTRAINT_NONE,nodemask\u003d(null),cpuset\u003d/,mems_allowed\u003d0,global_oom,task_memcg\u003d/user.slice/user-0.slice/user@0.service,tas0\n[ 1537.703009] Out of memory: Killed process 679 ((sd-pam)) total-vm:14880kB, anon-rss:2584kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:72kB oom_score_ad0\n[ 1553.246526] page_pool_release_retry() stalled pool shutdown 310 inflight 241 sec\n\nFixes: 95698ff6177b (\"net: fec: using page pool to manage RX buffers\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: shenwei wang \u003cShenwei.wang@nxp.com\u003e\nReviewed-by: Jesse Brandeburg \u003cjesse.brandeburg@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2475bf0250dee99b477e0c56d7dc9d7ac3f04117", "tree": "23106bd527b33cc987d634040bb5c6d06c4c3312", "parents": [ "ab2f408731cc7e03ef2e5dc7dada649220e4dcd2", "5f5cc9ed992cbab6361f198966f0edba5fc52688" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 22 12:14:58 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 22 12:14:58 2023 -0800" }, "message": "Merge tag \u0027sched_urgent_for_v6.2_rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Borislav Petkov:\n\n - Make sure the scheduler doesn\u0027t use stale frequency scaling values\n when latter get disabled due to a value error\n\n - Fix a NULL pointer access on UP configs\n\n - Use the proper locking when updating CPU capacity\n\n* tag \u0027sched_urgent_for_v6.2_rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/aperfmperf: Erase stale arch_freq_scale values when disabling frequency invariance readings\n sched/core: Fix NULL pointer access fault in sched_setaffinity() with non-SMP configs\n sched/fair: Fixes for capacity inversion detection\n sched/uclamp: Fix a uninitialized variable warnings\n" }, { "commit": "ab2f408731cc7e03ef2e5dc7dada649220e4dcd2", "tree": "203bf351972d0fbcfbd376ac97ad6026900f1dfb", "parents": [ "2b299a1cd43271ffb582342a2a3c227aea0f32ac", "977c6ba624f24ae20cf0faee871257a39348d4a9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 22 12:10:47 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 22 12:10:47 2023 -0800" }, "message": "Merge tag \u0027edac_urgent_for_v6.2_rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras\n\nPull EDAC fixes from Borislav Petkov:\n\n - Respect user-supplied polling value in the EDAC device code\n\n - Fix a use-after-free issue in qcom_edac\n\n* tag \u0027edac_urgent_for_v6.2_rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:\n EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info\u0027s pvt_info\n EDAC/device: Respect any driver-supplied workqueue polling value\n" }, { "commit": "2b299a1cd43271ffb582342a2a3c227aea0f32ac", "tree": "df1c8cb22519bf80ab5a8e833ba54d01706836e4", "parents": [ "3c006ad74d68be45ee36ca68fd9c053974fb6b0f", "5a8a05f165fb18d37526062419774d9088c2a9b9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 22 12:06:18 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 22 12:06:18 2023 -0800" }, "message": "Merge tag \u0027perf_urgent_for_v6.2_rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf fix from Borislav Petkov:\n\n - Add Emerald Rapids model support to more perf machinery\n\n* tag \u0027perf_urgent_for_v6.2_rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/x86/intel/cstate: Add Emerald Rapids\n perf/x86/intel: Add Emerald Rapids\n" }, { "commit": "3c006ad74d68be45ee36ca68fd9c053974fb6b0f", "tree": "a117cd264b77cedb384e7c910e3384cc2f717d20", "parents": [ "2241ab53cbb5cdb08a6b2d4688feb13971058f65", "95ecbd0f162fc06ef4c4045a66f653f47b62a2d3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 22 11:56:33 2023 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 22 11:56:33 2023 -0800" }, "message": "Merge tag \u0027gfs2-v6.2-rc4-fix\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2\n\nPull gfs2 writepage fix from Andreas Gruenbacher:\n\n - Fix a regression introduced by commit \"gfs2: stop using\n generic_writepages in gfs2_ail1_start_one\".\n\n* tag \u0027gfs2-v6.2-rc4-fix\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2:\n Revert \"gfs2: stop using generic_writepages in gfs2_ail1_start_one\"\n" }, { "commit": "c2c46b10d52624376322b01654095a84611c7e09", "tree": "b8c2b46498de59ec690488d6e203d561c94357be", "parents": [ "a44b331614e6f7e63902ed7dff7adc8c85edd8bc" ], "author": { "name": "Vipin Sharma", "email": "vipinsh@google.com", "time": "Wed Jan 11 10:34:08 2023 -0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sun Jan 22 04:10:24 2023 -0500" }, "message": "KVM: selftests: Make reclaim_period_ms input always be positive\n\nreclaim_period_ms used to be positive only but the commit 0001725d0f9b\n(\"KVM: selftests: Add atoi_positive() and atoi_non_negative() for input\nvalidation\") incorrectly changed it to non-negative validation.\n\nChange validation to allow only positive input.\n\nFixes: 0001725d0f9b (\"KVM: selftests: Add atoi_positive() and atoi_non_negative() for input validation\")\nSigned-off-by: Vipin Sharma \u003cvipinsh@google.com\u003e\nReported-by: Ben Gardon \u003cbgardon@google.com\u003e\nReviewed-by: Ben Gardon \u003cbgardon@google.com\u003e\nReviewed-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-Id: \u003c20230111183408.104491-1-vipinsh@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "a44b331614e6f7e63902ed7dff7adc8c85edd8bc", "tree": "2f9fcb257b40dfcc7b07fce97bae20a5b57b101b", "parents": [ "50aa870ba2f7735f556e52d15f61cd0f359c4c0b" ], "author": { "name": "Hendrik Borghorst", "email": "hborghor@amazon.de", "time": "Mon Nov 14 16:48:23 2022 +0000" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sun Jan 22 04:09:28 2023 -0500" }, "message": "KVM: x86/vmx: Do not skip segment attributes if unusable bit is set\n\nWhen serializing and deserializing kvm_sregs, attributes of the segment\ndescriptors are stored by user space. For unusable segments,\nvmx_segment_access_rights skips all attributes and sets them to 0.\n\nThis means we zero out the DPL (Descriptor Privilege Level) for unusable\nentries.\n\nUnusable segments are - contrary to their name - usable in 64bit mode and\nare used by guests to for example create a linear map through the\nNULL selector.\n\nVMENTER checks if SS.DPL is correct depending on the CS segment type.\nFor types 9 (Execute Only) and 11 (Execute Read), CS.DPL must be equal to\nSS.DPL [1].\n\nWe have seen real world guests setting CS to a usable segment with DPL\u003d3\nand SS to an unusable segment with DPL\u003d3. Once we go through an sregs\nget/set cycle, SS.DPL turns to 0. This causes the virtual machine to crash\nreproducibly.\n\nThis commit changes the attribute logic to always preserve attributes for\nunusable segments. According to [2] SS.DPL is always saved on VM exits,\nregardless of the unusable bit so user space applications should have saved\nthe information on serialization correctly.\n\n[3] specifies that besides SS.DPL the rest of the attributes of the\ndescriptors are undefined after VM entry if unusable bit is set. So, there\nshould be no harm in setting them all to the previous state.\n\n[1] Intel SDM Vol 3C 26.3.1.2 Checks on Guest Segment Registers\n[2] Intel SDM Vol 3C 27.3.2 Saving Segment Registers and Descriptor-Table\nRegisters\n[3] Intel SDM Vol 3C 26.3.2.2 Loading Guest Segment Registers and\nDescriptor-Table Registers\n\nCc: Alexander Graf \u003cgraf@amazon.de\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Hendrik Borghorst \u003chborghor@amazon.de\u003e\nReviewed-by: Jim Mattson \u003cjmattson@google.com\u003e\nReviewed-by: Alexander Graf \u003cgraf@amazon.com\u003e\nMessage-Id: \u003c20221114164823.69555-1-hborghor@amazon.de\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "50aa870ba2f7735f556e52d15f61cd0f359c4c0b", "tree": "5b1084ead51913f0f04b8fdaa6ba6f54f6c63754", "parents": [ "d732cbf78d616c0b63201eb9e5e4af3fe9b90dc4" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sun Jan 22 04:04:50 2023 -0500" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sun Jan 22 04:08:33 2023 -0500" }, "message": "selftests: kvm: move declaration at the beginning of main()\n\nPlacing a declaration of evt_reset is pedantically invalid\naccording to the C standard. While GCC does not really care\nand only warns with -Wpedantic, clang ignores the declaration\naltogether with an error:\n\nx86_64/xen_shinfo_test.c:965:2: error: expected expression\n struct kvm_xen_hvm_attr evt_reset \u003d {\n ^\nx86_64/xen_shinfo_test.c:969:38: error: use of undeclared identifier evt_reset\n vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, \u0026evt_reset);\n ^\n\nReported-by: Yu Zhang \u003cyu.c.zhang@linux.intel.com\u003e\nReported-by: Sean Christopherson \u003cseanjc@google.com\u003e\nFixes: a79b53aaaab5 (\"KVM: x86: fix deadlock for KVM_XEN_EVTCHN_RESET\", 2022-12-28)\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "95ecbd0f162fc06ef4c4045a66f653f47b62a2d3", "tree": "b9f25c38265bb65d0ca8493c1d8741a69c1c2982", "parents": [ "5dc4c995db9eb45f6373a956eb1f69460e69e6d4" ], "author": { "name": "Andreas Gruenbacher", "email": "agruenba@redhat.com", "time": "Thu Jan 19 20:14:42 2023 +0100" }, "committer": { "name": "Andreas Gruenbacher", "email": "agruenba@redhat.com", "time": "Sun Jan 22 09:46:14 2023 +0100" }, "message": "Revert \"gfs2: stop using generic_writepages in gfs2_ail1_start_one\"\n\nCommit b2b0a5e97855 switched from generic_writepages() to\nfilemap_fdatawrite_wbc() in gfs2_ail1_start_one() on the path to\nreplacing -\u003ewritepage() with -\u003ewritepages() and eventually eliminating\nthe former. Function gfs2_ail1_start_one() is called from\ngfs2_log_flush(), our main function for flushing the filesystem log.\n\nUnfortunately, at least as implemented today, -\u003ewritepage() and\n-\u003ewritepages() are entirely different operations for journaled data\ninodes: while the former creates and submits transactions covering the\ndata to be written, the latter flushes dirty buffers out to disk.\n\nWith gfs2_ail1_start_one() now calling -\u003ewritepages(), we end up\ncreating filesystem transactions while we are in the course of a log\nflush, which immediately deadlocks on the sdp-\u003esd_log_flush_lock\nsemaphore.\n\nWork around that by going back to how things used to work before commit\nb2b0a5e97855 for now; figuring out a superior solution will take time we\ndon\u0027t have available right now. However ...\n\nSince the removal of generic_writepages() is imminent, open-code it\nhere. We\u0027re already inside a blk_start_plug() ... blk_finish_plug()\nsection here, so skip that part of the original generic_writepages().\n\nThis reverts commit b2b0a5e978552e348f85ad9c7568b630a5ede659.\n\nSigned-off-by: Andreas Gruenbacher \u003cagruenba@redhat.com\u003e\nAcked-by: Christoph Hellwig \u003chch@lst.de\u003e\n" }, { "commit": "d732cbf78d616c0b63201eb9e5e4af3fe9b90dc4", "tree": "c65e768d69f389a6493fdbc64826eb23e6fb6950", "parents": [ "2241ab53cbb5cdb08a6b2d4688feb13971058f65", "ef3691683d7bfd0a2acf48812e4ffe894f10bfa8" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sun Jan 22 03:46:14 2023 -0500" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sun Jan 22 03:46:14 2023 -0500" }, "message": "Merge tag \u0027kvmarm-fixes-6.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD\n\nKVM/arm64 fixes for 6.2, take #2\n\n- Pass the correct address to mte_clear_page_tags() on initialising\n a tagged page\n\n- Plug a race against a GICv4.1 doorbell interrupt while saving\n the vgic-v3 pending state.\n" } ], "next": "2241ab53cbb5cdb08a6b2d4688feb13971058f65" }