1. Jun 11, 2023
  2. Jun 10, 2023
  3. Jun 09, 2023
    • Lee Jones's avatar
      net/sched: cls_u32: Fix reference counter leak leading to overflow · 04c55383
      Lee Jones authored
      In the event of a failure in tcf_change_indev(), u32_set_parms() will
      immediately return without decrementing the recently incremented
      reference counter.  If this happens enough times, the counter will
      rollover and the reference freed, leading to a double free which can be
      used to do 'bad things'.
      
      In order to prevent this, move the point of possible failure above the
      point where the reference counter is incremented.  Also save any
      meaningful return values to be applied to the return data at the
      appropriate point in time.
      
      This issue was caught with KASAN.
      
      Fixes: 705c7091
      
       ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct")
      Suggested-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarLee Jones <lee@kernel.org>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      04c55383
    • Zhengchao Shao's avatar
      net/sched: taprio: fix slab-out-of-bounds Read in taprio_dequeue_from_txq · be3618d9
      Zhengchao Shao authored
      As shown in [1], out-of-bounds access occurs in two cases:
      1)when the qdisc of the taprio type is used to replace the previously
      configured taprio, count and offset in tc_to_txq can be set to 0. In this
      case, the value of *txq in taprio_next_tc_txq() will increases
      continuously. When the number of accessed queues exceeds the number of
      queues on the device, out-of-bounds access occurs.
      2)When packets are dequeued, taprio can be deleted. In this case, the tc
      rule of dev is cleared. The count and offset values are also set to 0. In
      this case, out-of-bounds access is also caused.
      
      Now the restriction on the queue number is added.
      
      [1] https://groups.google.com/g/syzkaller-bugs/c/_lYOKgkBVMg
      Fixes: 2f530df7
      
       ("net/sched: taprio: give higher priority to higher TCs in software dequeue mode")
      Reported-by: default avatar <syzbot+04afcb3d2c840447559a@syzkaller.appspotmail.com>
      Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
      Tested-by: default avatarPedro Tammela <pctammela@mojatatu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      be3618d9
    • Ratheesh Kannoth's avatar
      octeontx2-af: Fix promiscuous mode · c0e48937
      Ratheesh Kannoth authored
      CN10KB silicon introduced a new exact match feature,
      which is used for DMAC filtering. The state of installed
      DMAC filters in this exact match table is getting corrupted
      when promiscuous mode is toggled. Fix this by not touching
      Exact match related config when promiscuous mode is toggled.
      
      Fixes: 2dba9459
      
       ("octeontx2-af: Wrapper functions for MAC addr add/del/update/reset")
      Signed-off-by: default avatarRatheesh Kannoth <rkannoth@marvell.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c0e48937
    • Yoshihiro Shimoda's avatar
      net: renesas: rswitch: Fix timestamp feature after all descriptors are used · 0ad4982c
      Yoshihiro Shimoda authored
      
      
      The timestamp descriptors were intended to act cyclically. Descriptors
      from index 0 through gq->ring_size - 1 contain actual information, and
      the last index (gq->ring_size) should have LINKFIX to indicate
      the first index 0 descriptor. However, the LINKFIX value is missing,
      causing the timestamp feature to stop after all descriptors are used.
      To resolve this issue, set the LINKFIX to the timestamp descritors.
      
      Reported-by: default avatarPhong Hoang <phong.hoang.wz@renesas.com>
      Fixes: 33f5d733
      
       ("net: renesas: rswitch: Improve TX timestamp accuracy")
      Signed-off-by: default avatarYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
      Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0ad4982c
    • Max Tottenham's avatar
      net/sched: act_pedit: Parse L3 Header for L4 offset · 6c02568f
      Max Tottenham authored
      Instead of relying on skb->transport_header being set correctly, opt
      instead to parse the L3 header length out of the L3 headers for both
      IPv4/IPv6 when the Extended Layer Op for tcp/udp is used. This fixes a
      bug if GRO is disabled, when GRO is disabled skb->transport_header is
      set by __netif_receive_skb_core() to point to the L3 header, it's later
      fixed by the upper protocol layers, but act_pedit will receive the SKB
      before the fixups are completed. The existing behavior causes the
      following to edit the L3 header if GRO is disabled instead of the UDP
      header:
      
          tc filter add dev eth0 ingress protocol ip flower ip_proto udp \
       dst_ip 192.168.1.3 action pedit ex munge udp set dport 18053
      
      Also re-introduce a rate-limited warning if we were unable to extract
      the header offset when using the 'ex' interface.
      
      Fixes: 71d0ed70
      
       ("net/act_pedit: Support using offset relative to
      the conventional network headers")
      Signed-off-by: default avatarMax Tottenham <mtottenh@akamai.com>
      Reviewed-by: default avatarJosh Hunt <johunt@akamai.com>
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Closes: https://lore.kernel.org/oe-kbuild-all/202305261541.N165u9TZ-lkp@intel.com/
      
      
      Reviewed-by: default avatarPedro Tammela <pctammela@mojatatu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6c02568f
    • Wes Huang's avatar
      net: usb: qmi_wwan: add support for Compal RXM-G1 · 86319919
      Wes Huang authored
      
      
      Add support for Compal RXM-G1 which is based on Qualcomm SDX55 chip.
      This patch adds support for two compositions:
      
      0x9091: DIAG + MODEM + QMI_RMNET + ADB
      0x90db: DIAG + DUN + RMNET + DPL + QDSS(Trace) + ADB
      
      T:  Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=5000 MxCh= 0
      D:  Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
      P:  Vendor=05c6 ProdID=9091 Rev= 4.14
      S:  Manufacturer=QCOM
      S:  Product=SDXPRAIRIE-MTP _SN:719AB680
      S:  SerialNumber=719ab680
      C:* #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=896mA
      I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none)
      E:  Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
      E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
      E:  Ad=84(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
      E:  Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
      E:  Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      
      T:  Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=5000 MxCh= 0
      D:  Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
      P:  Vendor=05c6 ProdID=90db Rev= 4.14
      S:  Manufacturer=QCOM
      S:  Product=SDXPRAIRIE-MTP _SN:719AB680
      S:  SerialNumber=719ab680
      C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=896mA
      I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none)
      E:  Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
      E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
      E:  Ad=84(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
      E:  Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      I:* If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
      E:  Ad=8f(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      I:* If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
      E:  Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
      E:  Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      E:  Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarWes Huang <wes.huang@moxa.com>
      Acked-by: default avatarBjørn Mork <bjorn@mork.no>
      Link: https://lore.kernel.org/r/20230608030141.3546-1-wes.huang@moxa.com
      
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      86319919
    • Yuezhen Luan's avatar
      igb: Fix extts capture value format for 82580/i354/i350 · 6292d743
      Yuezhen Luan authored
      82580/i354/i350 features circle-counter-like timestamp registers
      that are different with newer i210. The EXTTS capture value in
      AUXTSMPx should be converted from raw circle counter value to
      timestamp value in resolution of 1 nanosec by the driver.
      
      This issue can be reproduced on i350 nics, connecting an 1PPS
      signal to a SDP pin, and run 'ts2phc' command to read external
      1PPS timestamp value. On i210 this works fine, but on i350 the
      extts is not correctly converted.
      
      The i350/i354/82580's SYSTIM and other timestamp registers are
      40bit counters, presenting time range of 2^40 ns, that means these
      registers overflows every about 1099s. This causes all these regs
      can't be used directly in contrast to the newer i210/i211s.
      
      The igb driver needs to convert these raw register values to
      valid time stamp format by using kernel timecounter apis for i350s
      families. Here the igb_extts() just forgot to do the convert.
      
      Fixes: 38970eac
      
       ("igb: support EXTTS on 82580/i354/i350")
      Signed-off-by: default avatarYuezhen Luan <eggcar.luan@gmail.com>
      Reviewed-by: default avatarJacob Keller <jacob.e.keller@intel.com>
      Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
      Link: https://lore.kernel.org/r/20230607164116.3768175-1-anthony.l.nguyen@intel.com
      
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      6292d743
    • Guillaume Nault's avatar
      ping6: Fix send to link-local addresses with VRF. · 91ffd1ba
      Guillaume Nault authored
      
      
      Ping sockets can't send packets when they're bound to a VRF master
      device and the output interface is set to a slave device.
      
      For example, when net.ipv4.ping_group_range is properly set, so that
      ping6 can use ping sockets, the following kind of commands fails:
        $ ip vrf exec red ping6 fe80::854:e7ff:fe88:4bf1%eth1
      
      What happens is that sk->sk_bound_dev_if is set to the VRF master
      device, but 'oif' is set to the real output device. Since both are set
      but different, ping_v6_sendmsg() sees their value as inconsistent and
      fails.
      
      Fix this by allowing 'oif' to be a slave device of ->sk_bound_dev_if.
      
      This fixes the following kselftest failure:
        $ ./fcnal-test.sh -t ipv6_ping
        [...]
        TEST: ping out, vrf device+address bind - ns-B IPv6 LLA        [FAIL]
      
      Reported-by: default avatarMirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
      Closes: https://lore.kernel.org/netdev/b6191f90-ffca-dbca-7d06-88a9788def9c@alu.unizg.hr/
      
      
      Tested-by: default avatarMirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
      Fixes: 5e457896
      
       ("net: ipv6: Fix ping to link-local addresses.")
      Signed-off-by: default avatarGuillaume Nault <gnault@redhat.com>
      Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
      Link: https://lore.kernel.org/r/6c8b53108816a8d0d5705ae37bdc5a8322b5e3d9.1686153846.git.gnault@redhat.com
      
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      91ffd1ba
    • Wei Fang's avatar
      net: enetc: correct the indexes of highest and 2nd highest TCs · 21225873
      Wei Fang authored
      For ENETC hardware, the TCs are numbered from 0 to N-1, where N
      is the number of TCs. Numerically higher TC has higher priority.
      It's obvious that the highest priority TC index should be N-1 and
      the 2nd highest priority TC index should be N-2.
      
      However, the previous logic uses netdev_get_prio_tc_map() to get
      the indexes of highest priority and 2nd highest priority TCs, it
      does not make sense and is incorrect to give a "tc" argument to
      netdev_get_prio_tc_map(). So the driver may get the wrong indexes
      of the two highest priotiry TCs which would lead to failed to set
      the CBS for the two highest priotiry TCs.
      
      e.g.
      $ tc qdisc add dev eno0 parent root handle 100: mqprio num_tc 6 \
      	map 0 0 1 1 2 3 4 5 queues 1@0 1@1 1@2 1@3 2@4 2@6 hw 1
      $ tc qdisc replace dev eno0 parent 100:6 cbs idleslope 100000 \
      	sendslope -900000 hicredit 12 locredit -113 offload 1
      $ Error: Specified device failed to setup cbs hardware offload.
        ^^^^^
      
      In this example, the previous logic deems the indexes of the two
      highest priotiry TCs should be 3 and 2. Actually, the indexes are
      5 and 4, because the number of TCs is 6. So it would be failed to
      configure the CBS for the two highest priority TCs.
      
      Fixes: c431047c
      
       ("enetc: add support Credit Based Shaper(CBS) for hardware offload")
      Signed-off-by: default avatarWei Fang <wei.fang@nxp.com>
      Reviewed-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Reviewed-by: default avatarMaciej Fijalkowski <maciej.fijalkowski@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      21225873
    • Kamil Maziarz's avatar
      ice: Fix XDP memory leak when NIC is brought up and down · 78c50d69
      Kamil Maziarz authored
      Fix the buffer leak that occurs while switching
      the port up and down with traffic and XDP by
      checking for an active XDP program and freeing all empty TX buffers.
      
      Fixes: efc2214b
      
       ("ice: Add support for XDP")
      Signed-off-by: default avatarKamil Maziarz <kamil.maziarz@intel.com>
      Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> (A Contingent Worker at Intel)
      Acked-by: default avatarMaciej Fijalkowski <maciej.fijalkowski@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      78c50d69
    • Linus Torvalds's avatar
      Merge tag 'net-6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 25041a4c
      Linus Torvalds authored
      Pull networking fixes from Paolo Abeni:
       "Including fixes from can, wifi, netfilter, bluetooth and ebpf.
      
        Current release - regressions:
      
         - bpf: sockmap: avoid potential NULL dereference in
           sk_psock_verdict_data_ready()
      
         - wifi: iwlwifi: fix -Warray-bounds bug in iwl_mvm_wait_d3_notif()
      
         - phylink: actually fix ksettings_set() ethtool call
      
         - eth: dwmac-qcom-ethqos: fix a regression on EMAC < 3
      
        Current release - new code bugs:
      
         - wifi: mt76: fix possible NULL pointer dereference in
           mt7996_mac_write_txwi()
      
        Previous releases - regressions:
      
         - netfilter: fix NULL pointer dereference in nf_confirm_cthelper
      
         - wifi: rtw88/rtw89: correct PS calculation for SUPPORTS_DYNAMIC_PS
      
         - openvswitch: fix upcall counter access before allocation
      
         - bluetooth:
            - fix use-after-free in hci_remove_ltk/hci_remove_irk
            - fix l2cap_disconnect_req deadlock
      
         - nic: bnxt_en: prevent kernel panic when receiving unexpected
           PHC_UPDATE event
      
        Previous releases - always broken:
      
         - core: annotate rfs lockless accesses
      
         - sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values
      
         - netfilter: add null check for nla_nest_start_noflag() in
           nft_dump_basechain_hook()
      
         - bpf: fix UAF in task local storage
      
         - ipv4: ping_group_range: allow GID from 2147483648 to 4294967294
      
         - ipv6: rpl: fix route of death.
      
         - tcp: gso: really support BIG TCP
      
         - mptcp: fixes for user-space PM address advertisement
      
         - smc: avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT
      
         - can: avoid possible use-after-free when j1939_can_rx_register fails
      
         - batman-adv: fix UaF while rescheduling delayed work
      
         - eth: qede: fix scheduling while atomic
      
         - eth: ice: make writes to /dev/gnssX synchronous"
      
      * tag 'net-6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits)
        bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
        bnxt_en: Prevent kernel panic when receiving unexpected PHC_UPDATE event
        bnxt_en: Skip firmware fatal error recovery if chip is not accessible
        bnxt_en: Query default VLAN before VNIC setup on a VF
        bnxt_en: Don't issue AP reset during ethtool's reset operation
        bnxt_en: Fix bnxt_hwrm_update_rss_hash_cfg()
        net: bcmgenet: Fix EEE implementation
        eth: ixgbe: fix the wake condition
        eth: bnxt: fix the wake condition
        lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()
        bpf: Add extra path pointer check to d_path helper
        net: sched: fix possible refcount leak in tc_chain_tmplt_add()
        net: sched: act_police: fix sparse errors in tcf_police_dump()
        net: openvswitch: fix upcall counter access before allocation
        net: sched: move rtm_tca_policy declaration to include file
        ice: make writes to /dev/gnssX synchronous
        net: sched: add rcu annotations around qdisc->qdisc_sleeping
        rfs: annotate lockless accesses to RFS sock flow table
        rfs: annotate lockless accesses to sk->sk_rxhash
        virtio_net: use control_buf for coalesce params
        ...
      25041a4c
  4. Jun 08, 2023