From: Sebastian Reichel sebastian.reichel@collabora.com

[ Upstream commit 17b57beafccb4569accbfc8c11390744cf59c021 ]

Fix the node name for hym8563 in all arm rockchip devicetrees.

Signed-off-by: Sebastian Reichel sebastian.reichel@collabora.com Link: https://lore.kernel.org/r/20221024165549.74574-4-sebastian.reichel@collabora... Signed-off-by: Heiko Stuebner heiko@sntech.de Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/boot/dts/rk3036-evb.dts | 2 +- arch/arm/boot/dts/rk3288-evb-act8846.dts | 2 +- arch/arm/boot/dts/rk3288-firefly.dtsi | 2 +- arch/arm/boot/dts/rk3288-miqi.dts | 2 +- arch/arm/boot/dts/rk3288-rock2-square.dts | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/arm/boot/dts/rk3036-evb.dts b/arch/arm/boot/dts/rk3036-evb.dts index 2a7e6624efb9..ea23ba98625e 100644 --- a/arch/arm/boot/dts/rk3036-evb.dts +++ b/arch/arm/boot/dts/rk3036-evb.dts @@ -31,7 +31,7 @@ &i2c1 { status = "okay";

- hym8563: hym8563@51 { + hym8563: rtc@51 { compatible = "haoyu,hym8563"; reg = <0x51>; #clock-cells = <0>; diff --git a/arch/arm/boot/dts/rk3288-evb-act8846.dts b/arch/arm/boot/dts/rk3288-evb-act8846.dts index 80080767c365..9ac40c100e3f 100644 --- a/arch/arm/boot/dts/rk3288-evb-act8846.dts +++ b/arch/arm/boot/dts/rk3288-evb-act8846.dts @@ -53,7 +53,7 @@ vin-supply = <&vcc_sys>; };

- hym8563@51 { + rtc@51 { compatible = "haoyu,hym8563"; reg = <0x51>;

diff --git a/arch/arm/boot/dts/rk3288-firefly.dtsi b/arch/arm/boot/dts/rk3288-firefly.dtsi index 5e0a19004e46..8d418881166f 100644 --- a/arch/arm/boot/dts/rk3288-firefly.dtsi +++ b/arch/arm/boot/dts/rk3288-firefly.dtsi @@ -233,7 +233,7 @@ vin-supply = <&vcc_sys>; };

- hym8563: hym8563@51 { + hym8563: rtc@51 { compatible = "haoyu,hym8563"; reg = <0x51>; #clock-cells = <0>; diff --git a/arch/arm/boot/dts/rk3288-miqi.dts b/arch/arm/boot/dts/rk3288-miqi.dts index c41d012c8850..bf8f3f9bb4d5 100644 --- a/arch/arm/boot/dts/rk3288-miqi.dts +++ b/arch/arm/boot/dts/rk3288-miqi.dts @@ -145,7 +145,7 @@ vin-supply = <&vcc_sys>; };

- hym8563: hym8563@51 { + hym8563: rtc@51 { compatible = "haoyu,hym8563"; reg = <0x51>; #clock-cells = <0>; diff --git a/arch/arm/boot/dts/rk3288-rock2-square.dts b/arch/arm/boot/dts/rk3288-rock2-square.dts index cdcdc921ee09..7220de126635 100644 --- a/arch/arm/boot/dts/rk3288-rock2-square.dts +++ b/arch/arm/boot/dts/rk3288-rock2-square.dts @@ -165,7 +165,7 @@ };

&i2c0 { - hym8563: hym8563@51 { + hym8563: rtc@51 { compatible = "haoyu,hym8563"; reg = <0x51>; #clock-cells = <0>;

From: Johan Jonker jbx6244@gmail.com

[ Upstream commit 11871e20bcb23c00966e785a124fb72bc8340af4 ]

The lcdc1-rgb24 node name is out of line with the rest of the rk3188 lcdc1 node, so fix it.

Signed-off-by: Johan Jonker jbx6244@gmail.com Link: https://lore.kernel.org/r/7b9c0a6f-626b-07e8-ae74-7e0f08b8d241@gmail.com Signed-off-by: Heiko Stuebner heiko@sntech.de Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/boot/dts/rk3188.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/rk3188.dtsi b/arch/arm/boot/dts/rk3188.dtsi index ee8a24a0e3cb..95d558dc163c 100644 --- a/arch/arm/boot/dts/rk3188.dtsi +++ b/arch/arm/boot/dts/rk3188.dtsi @@ -404,7 +404,7 @@ rockchip,pins = <2 RK_PD3 1 &pcfg_pull_none>; };

- lcdc1_rgb24: ldcd1-rgb24 { + lcdc1_rgb24: lcdc1-rgb24 { rockchip,pins = <2 RK_PA0 1 &pcfg_pull_none>, <2 RK_PA1 1 &pcfg_pull_none>, <2 RK_PA2 1 &pcfg_pull_none>,

From: Giulio Benetti giulio.benetti@benettiengineering.com

[ Upstream commit 340a982825f76f1cff0daa605970fe47321b5ee7 ]

Actually in no-MMU SoCs(i.e. i.MXRT) ZERO_PAGE(vaddr) expands to ``` virt_to_page(0) ``` that in order expands to: ``` pfn_to_page(virt_to_pfn(0)) ``` and then virt_to_pfn(0) to: ``` ((((unsigned long)(0) - PAGE_OFFSET) >> PAGE_SHIFT) + PHYS_PFN_OFFSET) ``` where PAGE_OFFSET and PHYS_PFN_OFFSET are the DRAM offset(0x80000000) and PAGE_SHIFT is 12. This way we obtain 16MB(0x01000000) summed to the base of DRAM(0x80000000). When ZERO_PAGE(0) is then used, for example in bio_add_page(), the page gets an address that is out of DRAM bounds. So instead of using fake virtual page 0 let's allocate a dedicated zero_page during paging_init() and assign it to a global 'struct page * empty_zero_page' the same way mmu.c does and it's the same approach used in m68k with commit dc068f462179 as discussed here[0]. Then let's move ZERO_PAGE() definition to the top of pgtable.h to be in common between mmu.c and nommu.c.

[0]: https://lore.kernel.org/linux-m68k/2a462b23-5b8e-bbf4-ec7d-778434a3b9d7@goog... ad140743174d6b3070364d3c9a5179b

Signed-off-by: Giulio Benetti giulio.benetti@benettiengineering.com Reviewed-by: Arnd Bergmann arnd@arndb.de Signed-off-by: Russell King (Oracle) rmk+kernel@armlinux.org.uk Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/include/asm/pgtable-nommu.h | 6 ------ arch/arm/include/asm/pgtable.h | 16 +++++++++------- arch/arm/mm/nommu.c | 19 +++++++++++++++++++ 3 files changed, 28 insertions(+), 13 deletions(-)

diff --git a/arch/arm/include/asm/pgtable-nommu.h b/arch/arm/include/asm/pgtable-nommu.h index 010fa1a35a68..e8ac2f95fb37 100644 --- a/arch/arm/include/asm/pgtable-nommu.h +++ b/arch/arm/include/asm/pgtable-nommu.h @@ -51,12 +51,6 @@

typedef pte_t *pte_addr_t;

-/* - * ZERO_PAGE is a global shared page that is always zero: used - * for zero-mapped memory areas etc.. - */ -#define ZERO_PAGE(vaddr) (virt_to_page(0)) - /* * Mark the prot value as uncacheable and unbufferable. */ diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h index 3ae120cd1715..ecfd6e7e128f 100644 --- a/arch/arm/include/asm/pgtable.h +++ b/arch/arm/include/asm/pgtable.h @@ -10,6 +10,15 @@ #include <linux/const.h> #include <asm/proc-fns.h>

+#ifndef __ASSEMBLY__ +/* + * ZERO_PAGE is a global shared page that is always zero: used + * for zero-mapped memory areas etc.. + */ +extern struct page *empty_zero_page; +#define ZERO_PAGE(vaddr) (empty_zero_page) +#endif + #ifndef CONFIG_MMU

#include <asm-generic/4level-fixup.h> @@ -166,13 +175,6 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn, #define __S111 __PAGE_SHARED_EXEC

#ifndef __ASSEMBLY__ -/* - * ZERO_PAGE is a global shared page that is always zero: used - * for zero-mapped memory areas etc.. - */ -extern struct page *empty_zero_page; -#define ZERO_PAGE(vaddr) (empty_zero_page) -

extern pgd_t swapper_pg_dir[PTRS_PER_PGD];

diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c index 24ecf8d30a1e..a3ad8a1b0e07 100644 --- a/arch/arm/mm/nommu.c +++ b/arch/arm/mm/nommu.c @@ -26,6 +26,13 @@

unsigned long vectors_base;

+/* + * empty_zero_page is a special page that is used for + * zero-initialized data and COW. + */ +struct page *empty_zero_page; +EXPORT_SYMBOL(empty_zero_page); + #ifdef CONFIG_ARM_MPU struct mpu_rgn_info mpu_rgn_info; #endif @@ -148,9 +155,21 @@ void __init adjust_lowmem_bounds(void) */ void __init paging_init(const struct machine_desc *mdesc) { + void *zero_page; + early_trap_init((void *)vectors_base); mpu_setup(); + + /* allocate the zero page. */ + zero_page = memblock_alloc(PAGE_SIZE, PAGE_SIZE); + if (!zero_page) + panic("%s: Failed to allocate %lu bytes align=0x%lx\n", + __func__, PAGE_SIZE, PAGE_SIZE); + bootmem_init(); + + empty_zero_page = virt_to_page(zero_page); + flush_dcache_page(empty_zero_page); }

/*

From: GUO Zihua guozihua@huawei.com

[ Upstream commit 6854fadbeee10891ed74246bdc05031906b6c8cf ]

Cleanup hardcoded header sizes to use P9_HDRSZ instead of '7'

Link: https://lkml.kernel.org/r/20221117091159.31533-4-guozihua@huawei.com Signed-off-by: GUO Zihua guozihua@huawei.com Reviewed-by: Christian Schoenebeck linux_oss@crudebyte.com [Dominique: commit message adjusted to make sense after offset size adjustment got removed] Signed-off-by: Dominique Martinet asmadeus@codewreck.org Signed-off-by: Sasha Levin sashal@kernel.org --- net/9p/trans_fd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index 23c1d78ab1e4..872568cca926 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -118,7 +118,7 @@ struct p9_conn { struct list_head unsent_req_list; struct p9_req_t *rreq; struct p9_req_t *wreq; - char tmp_buf[7]; + char tmp_buf[P9_HDRSZ]; struct p9_fcall rc; int wpos; int wsize; @@ -291,7 +291,7 @@ static void p9_read_work(struct work_struct *work) if (!m->rc.sdata) { m->rc.sdata = m->tmp_buf; m->rc.offset = 0; - m->rc.capacity = 7; /* start by reading header */ + m->rc.capacity = P9_HDRSZ; /* start by reading header */ }

clear_bit(Rpending, &m->wsched); @@ -314,7 +314,7 @@ static void p9_read_work(struct work_struct *work) p9_debug(P9_DEBUG_TRANS, "got new header\n");

/* Header size */ - m->rc.size = 7; + m->rc.size = P9_HDRSZ; err = p9_parse_header(&m->rc, &m->rc.size, NULL, NULL, 0); if (err) { p9_debug(P9_DEBUG_ERROR,

From: Kees Cook keescook@chromium.org

[ Upstream commit 05530ef7cf7c7d700f6753f058999b1b5099a026 ]

With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed.

seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes matching snd_seq_dump_func_t. Adjust this and remove the casts. There are not resulting binary output differences.

This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches.

Reported-by: kernel test robot lkp@intel.com Link: https://lore.kernel.org/lkml/202211041527.HD8TLSE1-lkp@intel.com Cc: Jaroslav Kysela perex@perex.cz Cc: Takashi Iwai tiwai@suse.com Cc: "Gustavo A. R. Silva" gustavoars@kernel.org Cc: alsa-devel@alsa-project.org Signed-off-by: Kees Cook keescook@chromium.org Link: https://lore.kernel.org/r/20221118232346.never.380-kees@kernel.org Signed-off-by: Takashi Iwai tiwai@suse.de Signed-off-by: Sasha Levin sashal@kernel.org --- sound/core/seq/seq_memory.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c index 65db1a7c77b7..bb76a2dd0a2f 100644 --- a/sound/core/seq/seq_memory.c +++ b/sound/core/seq/seq_memory.c @@ -112,15 +112,19 @@ EXPORT_SYMBOL(snd_seq_dump_var_event); * expand the variable length event to linear buffer space. */

-static int seq_copy_in_kernel(char **bufptr, const void *src, int size) +static int seq_copy_in_kernel(void *ptr, void *src, int size) { + char **bufptr = ptr; + memcpy(*bufptr, src, size); *bufptr += size; return 0; }

-static int seq_copy_in_user(char __user **bufptr, const void *src, int size) +static int seq_copy_in_user(void *ptr, void *src, int size) { + char __user **bufptr = ptr; + if (copy_to_user(*bufptr, src, size)) return -EFAULT; *bufptr += size; @@ -149,8 +153,7 @@ int snd_seq_expand_var_event(const struct snd_seq_event *event, int count, char return newlen; } err = snd_seq_dump_var_event(event, - in_kernel ? (snd_seq_dump_func_t)seq_copy_in_kernel : - (snd_seq_dump_func_t)seq_copy_in_user, + in_kernel ? seq_copy_in_kernel : seq_copy_in_user, &buf); return err < 0 ? err : newlen; }

From: Srinivasa Rao Mandadapu quic_srivasam@quicinc.com

[ Upstream commit db8f91d424fe0ea6db337aca8bc05908bbce1498 ]

Add NULL check in dpcm_be_reparent API, to handle kernel NULL pointer dereference error. The issue occurred in fuzzing test.

Signed-off-by: Srinivasa Rao Mandadapu quic_srivasam@quicinc.com Link: https://lore.kernel.org/r/1669098673-29703-1-git-send-email-quic_srivasam@qu... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/soc-pcm.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 1196167364d4..2f1ab70a68fc 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -1201,6 +1201,8 @@ static void dpcm_be_reparent(struct snd_soc_pcm_runtime *fe, return;

be_substream = snd_soc_dpcm_get_substream(be, stream); + if (!be_substream) + return;

for_each_dpcm_fe(be, stream, dpcm) { if (dpcm->fe == fe)

From: Tetsuo Handa penguin-kernel@I-love.SAKURA.ne.jp

[ Upstream commit a6a00d7e8ffd78d1cdb7a43f1278f081038c638f ]

A kernel built with syzbot's config file reported that

scr_memcpyw(q, save, array3_size(logo_lines, new_cols, 2))

causes uninitialized "save" to be copied.

---------- [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0 [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1 Console: switching to colour frame buffer device 128x48 ===================================================== BUG: KMSAN: uninit-value in do_update_region+0x4b8/0xba0 do_update_region+0x4b8/0xba0 update_region+0x40d/0x840 fbcon_switch+0x3364/0x35e0 redraw_screen+0xae3/0x18a0 do_bind_con_driver+0x1cb3/0x1df0 do_take_over_console+0x11cb/0x13f0 fbcon_fb_registered+0xacc/0xfd0 register_framebuffer+0x1179/0x1320 __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40 drm_fbdev_client_hotplug+0xbea/0xda0 drm_fbdev_generic_setup+0x65e/0x9d0 vkms_init+0x9f3/0xc76 (...snipped...)

Uninit was stored to memory at: fbcon_prepare_logo+0x143b/0x1940 fbcon_init+0x2c1b/0x31c0 visual_init+0x3e7/0x820 do_bind_con_driver+0x14a4/0x1df0 do_take_over_console+0x11cb/0x13f0 fbcon_fb_registered+0xacc/0xfd0 register_framebuffer+0x1179/0x1320 __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40 drm_fbdev_client_hotplug+0xbea/0xda0 drm_fbdev_generic_setup+0x65e/0x9d0 vkms_init+0x9f3/0xc76 (...snipped...)

Uninit was created at: __kmem_cache_alloc_node+0xb69/0x1020 __kmalloc+0x379/0x680 fbcon_prepare_logo+0x704/0x1940 fbcon_init+0x2c1b/0x31c0 visual_init+0x3e7/0x820 do_bind_con_driver+0x14a4/0x1df0 do_take_over_console+0x11cb/0x13f0 fbcon_fb_registered+0xacc/0xfd0 register_framebuffer+0x1179/0x1320 __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40 drm_fbdev_client_hotplug+0xbea/0xda0 drm_fbdev_generic_setup+0x65e/0x9d0 vkms_init+0x9f3/0xc76 (...snipped...)

CPU: 2 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc4-00356-g8f2975c2bb4c #924 Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 ----------

Signed-off-by: Tetsuo Handa penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Daniel Vetter daniel.vetter@ffwll.ch Link: https://patchwork.freedesktop.org/patch/msgid/cad03d25-0ea0-32c4-8173-fd1895... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/video/fbdev/core/fbcon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 4a544e1e2038..673af5937489 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -604,7 +604,7 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info, if (scr_readw(r) != vc->vc_video_erase_char) break; if (r != q && new_rows >= rows + logo_lines) { - save = kmalloc(array3_size(logo_lines, new_cols, 2), + save = kzalloc(array3_size(logo_lines, new_cols, 2), GFP_KERNEL); if (save) { int i = cols < new_cols ? cols : new_cols;

From: Davide Tronchin davide.tronchin.94@gmail.com

[ Upstream commit a487069e11b6527373f7c6f435d8998051d0b5d9 ]

Add RmNet support for LARA-L6.

LARA-L6 module can be configured (by AT interface) in three different USB modes: * Default mode (Vendor ID: 0x1546 Product ID: 0x1341) with 4 serial interfaces * RmNet mode (Vendor ID: 0x1546 Product ID: 0x1342) with 4 serial interfaces and 1 RmNet virtual network interface * CDC-ECM mode (Vendor ID: 0x1546 Product ID: 0x1343) with 4 serial interface and 1 CDC-ECM virtual network interface

In RmNet mode LARA-L6 exposes the following interfaces: If 0: Diagnostic If 1: AT parser If 2: AT parser If 3: AT parset/alternative functions If 4: RMNET interface

Signed-off-by: Davide Tronchin davide.tronchin.94@gmail.com Acked-by: Bjørn Mork bjorn@mork.no Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c index 7f0e3b09f776..c310cdbfd583 100644 --- a/drivers/net/usb/qmi_wwan.c +++ b/drivers/net/usb/qmi_wwan.c @@ -1374,6 +1374,7 @@ static const struct usb_device_id products[] = { {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */ {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/ {QMI_FIXED_INTF(0x2692, 0x9025, 4)}, /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */ + {QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)}, /* u-blox LARA-L6 */

/* 4. Gobi 1000 devices */ {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */

From: Jann Horn jannh@google.com

commit 2ba99c5e08812494bc57f319fb562f527d9bacd8 upstream.

Since commit 70cbc3cc78a99 ("mm: gup: fix the fast GUP race against THP collapse"), the lockless_pages_from_mm() fastpath rechecks the pmd_t to ensure that the page table was not removed by khugepaged in between.

However, lockless_pages_from_mm() still requires that the page table is not concurrently freed. Fix it by sending IPIs (if the architecture uses semi-RCU-style page table freeing) before freeing/reusing page tables.

Link: https://lkml.kernel.org/r/20221129154730.2274278-2-jannh@google.com Link: https://lkml.kernel.org/r/20221128180252.1684965-2-jannh@google.com Link: https://lkml.kernel.org/r/20221125213714.4115729-2-jannh@google.com Fixes: ba76149f47d8 ("thp: khugepaged") Signed-off-by: Jann Horn jannh@google.com Reviewed-by: Yang Shi shy828301@gmail.com Acked-by: David Hildenbrand david@redhat.com Cc: John Hubbard jhubbard@nvidia.com Cc: Peter Xu peterx@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org [manual backport: two of the three places in khugepaged that can free ptes were refactored into a common helper between 5.15 and 6.0; TLB flushing was refactored between 5.4 and 5.10] Signed-off-by: Jann Horn jannh@google.com Signed-off-by: Sasha Levin sashal@kernel.org --- include/asm-generic/tlb.h | 4 ++++ mm/khugepaged.c | 3 +++ mm/mmu_gather.c | 5 +++++ 3 files changed, 12 insertions(+)

diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h index 268674c1d568..b06240b67199 100644 --- a/include/asm-generic/tlb.h +++ b/include/asm-generic/tlb.h @@ -190,12 +190,16 @@ extern void tlb_remove_table(struct mmu_gather *tlb, void *table); #define tlb_needs_table_invalidate() (true) #endif

+void tlb_remove_table_sync_one(void); + #else

#ifdef tlb_needs_table_invalidate #error tlb_needs_table_invalidate() requires HAVE_RCU_TABLE_FREE #endif

+static inline void tlb_remove_table_sync_one(void) { } + #endif /* CONFIG_HAVE_RCU_TABLE_FREE */

diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 55631cd73939..a8f2605cbd0d 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -1060,6 +1060,7 @@ static void collapse_huge_page(struct mm_struct *mm, _pmd = pmdp_collapse_flush(vma, address, pmd); spin_unlock(pmd_ptl); mmu_notifier_invalidate_range_end(&range); + tlb_remove_table_sync_one();

spin_lock(pte_ptl); isolated = __collapse_huge_page_isolate(vma, address, pte); @@ -1407,6 +1408,7 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr) /* step 4: collapse pmd */ _pmd = pmdp_collapse_flush(vma, haddr, pmd); mm_dec_nr_ptes(mm); + tlb_remove_table_sync_one(); pte_free(mm, pmd_pgtable(_pmd));

i_mmap_unlock_write(vma->vm_file->f_mapping); @@ -1494,6 +1496,7 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) /* assume page table is clear */ _pmd = pmdp_collapse_flush(vma, addr, pmd); mm_dec_nr_ptes(mm); + tlb_remove_table_sync_one(); pte_free(mm, pmd_pgtable(_pmd)); } up_write(&mm->mmap_sem); diff --git a/mm/mmu_gather.c b/mm/mmu_gather.c index 7c1b8f67af7b..341aa036b03c 100644 --- a/mm/mmu_gather.c +++ b/mm/mmu_gather.c @@ -117,6 +117,11 @@ static void tlb_remove_table_smp_sync(void *arg) /* Simply deliver the interrupt */ }

+void tlb_remove_table_sync_one(void) +{ + smp_call_function(tlb_remove_table_smp_sync, NULL, 1); +} + static void tlb_remove_table_one(void *table) { /*

From: Ross Lagerwall ross.lagerwall@citrix.com

[ Upstream commit ad7f402ae4f466647c3a669b8a6f3e5d4271c84a ]

In some cases, the frontend may send a packet where the protocol headers are spread across multiple slots. This would result in netback creating an skb where the protocol headers spill over into the non-linear area. Some drivers and NICs don't handle this properly resulting in an interface reset or worse.

This issue was introduced by the removal of an unconditional skb pull in the tx path to improve performance. Fix this without reintroducing the pull by setting up grant copy ops for as many slots as needed to reach the XEN_NETBACK_TX_COPY_LEN size. Adjust the rest of the code to handle multiple copy operations per skb.

This is XSA-423 / CVE-2022-3643.

Fixes: 7e5d7753956b ("xen-netback: remove unconditional __pskb_pull_tail() in guest Tx path") Signed-off-by: Ross Lagerwall ross.lagerwall@citrix.com Reviewed-by: Paul Durrant paul@xen.org Signed-off-by: Juergen Gross jgross@suse.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/xen-netback/netback.c | 223 ++++++++++++++++-------------- 1 file changed, 123 insertions(+), 100 deletions(-)

diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c index 995566a2785f..5706a1694c9c 100644 --- a/drivers/net/xen-netback/netback.c +++ b/drivers/net/xen-netback/netback.c @@ -323,10 +323,13 @@ static int xenvif_count_requests(struct xenvif_queue *queue,

struct xenvif_tx_cb { - u16 pending_idx; + u16 copy_pending_idx[XEN_NETBK_LEGACY_SLOTS_MAX + 1]; + u8 copy_count; };

#define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb) +#define copy_pending_idx(skb, i) (XENVIF_TX_CB(skb)->copy_pending_idx[i]) +#define copy_count(skb) (XENVIF_TX_CB(skb)->copy_count)

static inline void xenvif_tx_create_map_op(struct xenvif_queue *queue, u16 pending_idx, @@ -361,31 +364,93 @@ static inline struct sk_buff *xenvif_alloc_skb(unsigned int size) return skb; }

-static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif_queue *queue, - struct sk_buff *skb, - struct xen_netif_tx_request *txp, - struct gnttab_map_grant_ref *gop, - unsigned int frag_overflow, - struct sk_buff *nskb) +static void xenvif_get_requests(struct xenvif_queue *queue, + struct sk_buff *skb, + struct xen_netif_tx_request *first, + struct xen_netif_tx_request *txfrags, + unsigned *copy_ops, + unsigned *map_ops, + unsigned int frag_overflow, + struct sk_buff *nskb, + unsigned int extra_count, + unsigned int data_len) { struct skb_shared_info *shinfo = skb_shinfo(skb); skb_frag_t *frags = shinfo->frags; - u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx; - int start; + u16 pending_idx; pending_ring_idx_t index; unsigned int nr_slots; + struct gnttab_copy *cop = queue->tx_copy_ops + *copy_ops; + struct gnttab_map_grant_ref *gop = queue->tx_map_ops + *map_ops; + struct xen_netif_tx_request *txp = first; + + nr_slots = shinfo->nr_frags + 1; + + copy_count(skb) = 0; + + /* Create copy ops for exactly data_len bytes into the skb head. */ + __skb_put(skb, data_len); + while (data_len > 0) { + int amount = data_len > txp->size ? txp->size : data_len; + + cop->source.u.ref = txp->gref; + cop->source.domid = queue->vif->domid; + cop->source.offset = txp->offset; + + cop->dest.domid = DOMID_SELF; + cop->dest.offset = (offset_in_page(skb->data + + skb_headlen(skb) - + data_len)) & ~XEN_PAGE_MASK; + cop->dest.u.gmfn = virt_to_gfn(skb->data + skb_headlen(skb) + - data_len); + + cop->len = amount; + cop->flags = GNTCOPY_source_gref;

- nr_slots = shinfo->nr_frags; + index = pending_index(queue->pending_cons); + pending_idx = queue->pending_ring[index]; + callback_param(queue, pending_idx).ctx = NULL; + copy_pending_idx(skb, copy_count(skb)) = pending_idx; + copy_count(skb)++; + + cop++; + data_len -= amount;

- /* Skip first skb fragment if it is on same page as header fragment. */ - start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx); + if (amount == txp->size) { + /* The copy op covered the full tx_request */ + + memcpy(&queue->pending_tx_info[pending_idx].req, + txp, sizeof(*txp)); + queue->pending_tx_info[pending_idx].extra_count = + (txp == first) ? extra_count : 0; + + if (txp == first) + txp = txfrags; + else + txp++; + queue->pending_cons++; + nr_slots--; + } else { + /* The copy op partially covered the tx_request. + * The remainder will be mapped. + */ + txp->offset += amount; + txp->size -= amount; + } + }

- for (shinfo->nr_frags = start; shinfo->nr_frags < nr_slots; - shinfo->nr_frags++, txp++, gop++) { + for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots; + shinfo->nr_frags++, gop++) { index = pending_index(queue->pending_cons++); pending_idx = queue->pending_ring[index]; - xenvif_tx_create_map_op(queue, pending_idx, txp, 0, gop); + xenvif_tx_create_map_op(queue, pending_idx, txp, + txp == first ? extra_count : 0, gop); frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx); + + if (txp == first) + txp = txfrags; + else + txp++; }

if (frag_overflow) { @@ -406,7 +471,8 @@ static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif_queue *que skb_shinfo(skb)->frag_list = nskb; }

- return gop; + (*copy_ops) = cop - queue->tx_copy_ops; + (*map_ops) = gop - queue->tx_map_ops; }

static inline void xenvif_grant_handle_set(struct xenvif_queue *queue, @@ -442,7 +508,7 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue, struct gnttab_copy **gopp_copy) { struct gnttab_map_grant_ref *gop_map = *gopp_map; - u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx; + u16 pending_idx; /* This always points to the shinfo of the skb being checked, which * could be either the first or the one on the frag_list */ @@ -453,24 +519,37 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue, struct skb_shared_info *first_shinfo = NULL; int nr_frags = shinfo->nr_frags; const bool sharedslot = nr_frags && - frag_get_pending_idx(&shinfo->frags[0]) == pending_idx; + frag_get_pending_idx(&shinfo->frags[0]) == + copy_pending_idx(skb, copy_count(skb) - 1); int i, err;

- /* Check status of header. */ - err = (*gopp_copy)->status; - if (unlikely(err)) { - if (net_ratelimit()) - netdev_dbg(queue->vif->dev, - "Grant copy of header failed! status: %d pending_idx: %u ref: %u\n", - (*gopp_copy)->status, - pending_idx, - (*gopp_copy)->source.u.ref); - /* The first frag might still have this slot mapped */ - if (!sharedslot) - xenvif_idx_release(queue, pending_idx, - XEN_NETIF_RSP_ERROR); + for (i = 0; i < copy_count(skb); i++) { + int newerr; + + /* Check status of header. */ + pending_idx = copy_pending_idx(skb, i); + + newerr = (*gopp_copy)->status; + if (likely(!newerr)) { + /* The first frag might still have this slot mapped */ + if (i < copy_count(skb) - 1 || !sharedslot) + xenvif_idx_release(queue, pending_idx, + XEN_NETIF_RSP_OKAY); + } else { + err = newerr; + if (net_ratelimit()) + netdev_dbg(queue->vif->dev, + "Grant copy of header failed! status: %d pending_idx: %u ref: %u\n", + (*gopp_copy)->status, + pending_idx, + (*gopp_copy)->source.u.ref); + /* The first frag might still have this slot mapped */ + if (i < copy_count(skb) - 1 || !sharedslot) + xenvif_idx_release(queue, pending_idx, + XEN_NETIF_RSP_ERROR); + } + (*gopp_copy)++; } - (*gopp_copy)++;

check_frags: for (i = 0; i < nr_frags; i++, gop_map++) { @@ -517,14 +596,6 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue, if (err) continue;

- /* First error: if the header haven't shared a slot with the - * first frag, release it as well. - */ - if (!sharedslot) - xenvif_idx_release(queue, - XENVIF_TX_CB(skb)->pending_idx, - XEN_NETIF_RSP_OKAY); - /* Invalidate preceding fragments of this skb. */ for (j = 0; j < i; j++) { pending_idx = frag_get_pending_idx(&shinfo->frags[j]); @@ -794,7 +865,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, unsigned *copy_ops, unsigned *map_ops) { - struct gnttab_map_grant_ref *gop = queue->tx_map_ops; struct sk_buff *skb, *nskb; int ret; unsigned int frag_overflow; @@ -876,8 +946,12 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, continue; }

+ data_len = (txreq.size > XEN_NETBACK_TX_COPY_LEN) ? + XEN_NETBACK_TX_COPY_LEN : txreq.size; + ret = xenvif_count_requests(queue, &txreq, extra_count, txfrags, work_to_do); + if (unlikely(ret < 0)) break;

@@ -903,9 +977,8 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, index = pending_index(queue->pending_cons); pending_idx = queue->pending_ring[index];

- data_len = (txreq.size > XEN_NETBACK_TX_COPY_LEN && - ret < XEN_NETBK_LEGACY_SLOTS_MAX) ? - XEN_NETBACK_TX_COPY_LEN : txreq.size; + if (ret >= XEN_NETBK_LEGACY_SLOTS_MAX - 1 && data_len < txreq.size) + data_len = txreq.size;

skb = xenvif_alloc_skb(data_len); if (unlikely(skb == NULL)) { @@ -916,8 +989,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, }

skb_shinfo(skb)->nr_frags = ret; - if (data_len < txreq.size) - skb_shinfo(skb)->nr_frags++; /* At this point shinfo->nr_frags is in fact the number of * slots, which can be as large as XEN_NETBK_LEGACY_SLOTS_MAX. */ @@ -979,54 +1050,19 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, type); }

- XENVIF_TX_CB(skb)->pending_idx = pending_idx; - - __skb_put(skb, data_len); - queue->tx_copy_ops[*copy_ops].source.u.ref = txreq.gref; - queue->tx_copy_ops[*copy_ops].source.domid = queue->vif->domid; - queue->tx_copy_ops[*copy_ops].source.offset = txreq.offset; - - queue->tx_copy_ops[*copy_ops].dest.u.gmfn = - virt_to_gfn(skb->data); - queue->tx_copy_ops[*copy_ops].dest.domid = DOMID_SELF; - queue->tx_copy_ops[*copy_ops].dest.offset = - offset_in_page(skb->data) & ~XEN_PAGE_MASK; - - queue->tx_copy_ops[*copy_ops].len = data_len; - queue->tx_copy_ops[*copy_ops].flags = GNTCOPY_source_gref; - - (*copy_ops)++; - - if (data_len < txreq.size) { - frag_set_pending_idx(&skb_shinfo(skb)->frags[0], - pending_idx); - xenvif_tx_create_map_op(queue, pending_idx, &txreq, - extra_count, gop); - gop++; - } else { - frag_set_pending_idx(&skb_shinfo(skb)->frags[0], - INVALID_PENDING_IDX); - memcpy(&queue->pending_tx_info[pending_idx].req, - &txreq, sizeof(txreq)); - queue->pending_tx_info[pending_idx].extra_count = - extra_count; - } - - queue->pending_cons++; - - gop = xenvif_get_requests(queue, skb, txfrags, gop, - frag_overflow, nskb); + xenvif_get_requests(queue, skb, &txreq, txfrags, copy_ops, + map_ops, frag_overflow, nskb, extra_count, + data_len);

__skb_queue_tail(&queue->tx_queue, skb);

queue->tx.req_cons = idx;

- if (((gop-queue->tx_map_ops) >= ARRAY_SIZE(queue->tx_map_ops)) || + if ((*map_ops >= ARRAY_SIZE(queue->tx_map_ops)) || (*copy_ops >= ARRAY_SIZE(queue->tx_copy_ops))) break; }

- (*map_ops) = gop - queue->tx_map_ops; return; }

@@ -1105,9 +1141,8 @@ static int xenvif_tx_submit(struct xenvif_queue *queue) while ((skb = __skb_dequeue(&queue->tx_queue)) != NULL) { struct xen_netif_tx_request *txp; u16 pending_idx; - unsigned data_len;

- pending_idx = XENVIF_TX_CB(skb)->pending_idx; + pending_idx = copy_pending_idx(skb, 0); txp = &queue->pending_tx_info[pending_idx].req;

/* Check the remap error code. */ @@ -1126,18 +1161,6 @@ static int xenvif_tx_submit(struct xenvif_queue *queue) continue; }

- data_len = skb->len; - callback_param(queue, pending_idx).ctx = NULL; - if (data_len < txp->size) { - /* Append the packet payload as a fragment. */ - txp->offset += data_len; - txp->size -= data_len; - } else { - /* Schedule a response immediately. */ - xenvif_idx_release(queue, pending_idx, - XEN_NETIF_RSP_OKAY); - } - if (txp->flags & XEN_NETTXF_csum_blank) skb->ip_summed = CHECKSUM_PARTIAL; else if (txp->flags & XEN_NETTXF_data_validated) @@ -1323,7 +1346,7 @@ static inline void xenvif_tx_dealloc_action(struct xenvif_queue *queue) /* Called after netfront has transmitted */ int xenvif_tx_action(struct xenvif_queue *queue, int budget) { - unsigned nr_mops, nr_cops = 0; + unsigned nr_mops = 0, nr_cops = 0; int work_done, ret;

if (unlikely(!tx_work_todo(queue)))

From: Juergen Gross jgross@suse.com

[ Upstream commit 74e7e1efdad45580cc3839f2a155174cf158f9b5 ]

It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So remove kfree_skb() from the spin_lock_irqsave() section and use the already existing "drop" label in xenvif_start_xmit() for dropping the SKB. At the same time replace the dev_kfree_skb() call there with a call of dev_kfree_skb_any(), as xenvif_start_xmit() can be called with disabled interrupts.

This is XSA-424 / CVE-2022-42328 / CVE-2022-42329.

Fixes: be81992f9086 ("xen/netback: don't queue unlimited number of packages") Reported-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: Juergen Gross jgross@suse.com Reviewed-by: Jan Beulich jbeulich@suse.com Signed-off-by: Juergen Gross jgross@suse.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/xen-netback/common.h | 2 +- drivers/net/xen-netback/interface.c | 6 ++++-- drivers/net/xen-netback/rx.c | 8 +++++--- 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h index fa52d5ffca72..ced413d394cd 100644 --- a/drivers/net/xen-netback/common.h +++ b/drivers/net/xen-netback/common.h @@ -383,7 +383,7 @@ int xenvif_dealloc_kthread(void *data); irqreturn_t xenvif_ctrl_irq_fn(int irq, void *data);

bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread); -void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb); +bool xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb);

void xenvif_carrier_on(struct xenvif *vif);

diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c index 5efe86b3ba06..6432f6e7fd54 100644 --- a/drivers/net/xen-netback/interface.c +++ b/drivers/net/xen-netback/interface.c @@ -255,14 +255,16 @@ xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev) if (vif->hash.alg == XEN_NETIF_CTRL_HASH_ALGORITHM_NONE) skb_clear_hash(skb);

- xenvif_rx_queue_tail(queue, skb); + if (!xenvif_rx_queue_tail(queue, skb)) + goto drop; + xenvif_kick_thread(queue);

return NETDEV_TX_OK;

drop: vif->dev->stats.tx_dropped++; - dev_kfree_skb(skb); + dev_kfree_skb_any(skb); return NETDEV_TX_OK; }

diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c index 6f940a32dcb8..ab216970137c 100644 --- a/drivers/net/xen-netback/rx.c +++ b/drivers/net/xen-netback/rx.c @@ -82,9 +82,10 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue) return false; }

-void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb) +bool xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb) { unsigned long flags; + bool ret = true;

spin_lock_irqsave(&queue->rx_queue.lock, flags);

@@ -92,8 +93,7 @@ void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb) struct net_device *dev = queue->vif->dev;

netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id)); - kfree_skb(skb); - queue->vif->dev->stats.rx_dropped++; + ret = false; } else { if (skb_queue_empty(&queue->rx_queue)) xenvif_update_needed_slots(queue, skb); @@ -104,6 +104,8 @@ void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb) }

spin_unlock_irqrestore(&queue->rx_queue.lock, flags); + + return ret; }

static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue)

From: Hans Verkuil hverkuil-cisco@xs4all.nl

commit 5eef2141776da02772c44ec406d6871a790761ee upstream.

Sanity checks were added to verify the v4l2_bt_timings blanking fields in order to avoid integer overflows when userspace passes weird values.

But that assumed that userspace would correctly fill in the front porch, backporch and sync values, but sometimes all you know is the total blanking, which is then assigned to just one of these fields.

And that can fail with these checks.

So instead set a maximum for the total horizontal and vertical blanking and check that each field remains below that.

That is still sufficient to avoid integer overflows, but it also allows for more flexibility in how userspace fills in these fields.

Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Fixes: 4b6d66a45ed3 ("media: v4l2-dv-timings: add sanity checks for blanking values") Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/media/v4l2-core/v4l2-dv-timings.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)

--- a/drivers/media/v4l2-core/v4l2-dv-timings.c +++ b/drivers/media/v4l2-core/v4l2-dv-timings.c @@ -145,6 +145,8 @@ bool v4l2_valid_dv_timings(const struct const struct v4l2_bt_timings *bt = &t->bt; const struct v4l2_bt_timings_cap *cap = &dvcap->bt; u32 caps = cap->capabilities; + const u32 max_vert = 10240; + u32 max_hor = 3 * bt->width;

if (t->type != V4L2_DV_BT_656_1120) return false; @@ -166,14 +168,20 @@ bool v4l2_valid_dv_timings(const struct if (!bt->interlaced && (bt->il_vbackporch || bt->il_vsync || bt->il_vfrontporch)) return false; - if (bt->hfrontporch > 2 * bt->width || - bt->hsync > 1024 || bt->hbackporch > 1024) + /* + * Some video receivers cannot properly separate the frontporch, + * backporch and sync values, and instead they only have the total + * blanking. That can be assigned to any of these three fields. + * So just check that none of these are way out of range. + */ + if (bt->hfrontporch > max_hor || + bt->hsync > max_hor || bt->hbackporch > max_hor) return false; - if (bt->vfrontporch > 4096 || - bt->vsync > 128 || bt->vbackporch > 4096) + if (bt->vfrontporch > max_vert || + bt->vsync > max_vert || bt->vbackporch > max_vert) return false; - if (bt->interlaced && (bt->il_vfrontporch > 4096 || - bt->il_vsync > 128 || bt->il_vbackporch > 4096)) + if (bt->interlaced && (bt->il_vfrontporch > max_vert || + bt->il_vsync > max_vert || bt->il_vbackporch > max_vert)) return false; return fnc == NULL || fnc(t, fnc_handle); }

From: John Starks jostarks@microsoft.com

commit fcd0ccd836ffad73d98a66f6fea7b16f735ea920 upstream.

For dax pud, pud_huge() returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 ("mm/gup: fix gup_pmd_range() for dax") fixed devmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as well.

This fixes the below kernel panic:

general protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP < snip > Call Trace: <TASK> get_user_pages_fast+0x1f/0x40 iov_iter_get_pages+0xc6/0x3b0 ? mempool_alloc+0x5d/0x170 bio_iov_iter_get_pages+0x82/0x4e0 ? bvec_alloc+0x91/0xc0 ? bio_alloc_bioset+0x19a/0x2a0 blkdev_direct_IO+0x282/0x480 ? __io_complete_rw_common+0xc0/0xc0 ? filemap_range_has_page+0x82/0xc0 generic_file_direct_write+0x9d/0x1a0 ? inode_update_time+0x24/0x30 __generic_file_write_iter+0xbd/0x1e0 blkdev_write_iter+0xb4/0x150 ? io_import_iovec+0x8d/0x340 io_write+0xf9/0x300 io_issue_sqe+0x3c3/0x1d30 ? sysvec_reschedule_ipi+0x6c/0x80 __io_queue_sqe+0x33/0x240 ? fget+0x76/0xa0 io_submit_sqes+0xe6a/0x18d0 ? __fget_light+0xd1/0x100 __x64_sys_io_uring_enter+0x199/0x880 ? __context_tracking_enter+0x1f/0x70 ? irqentry_exit_to_user_mode+0x24/0x30 ? irqentry_exit+0x1d/0x30 ? __context_tracking_exit+0xe/0x70 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fc97c11a7be < snip > </TASK> ---[ end trace 48b2e0e67debcaeb ]--- RIP: 0010:internal_get_user_pages_fast+0x340/0x990 < snip > Kernel panic - not syncing: Fatal exception Kernel Offset: disabled

Link: https://lkml.kernel.org/r/1670392853-28252-1-git-send-email-ssengar@linux.mi... Fixes: 414fd080d125 ("mm/gup: fix gup_pmd_range() for dax") Signed-off-by: John Starks jostarks@microsoft.com Signed-off-by: Saurabh Sengar ssengar@linux.microsoft.com Cc: Jan Kara jack@suse.cz Cc: Yu Zhao yuzhao@google.com Cc: Jason Gunthorpe jgg@nvidia.com Cc: John Hubbard jhubbard@nvidia.com Cc: David Hildenbrand david@redhat.com Cc: Dan Williams dan.j.williams@intel.com Cc: Alistair Popple apopple@nvidia.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- mm/gup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/mm/gup.c +++ b/mm/gup.c @@ -2240,7 +2240,7 @@ static int gup_pud_range(p4d_t *p4dp, p4 next = pud_addr_end(addr, end); if (pud_none(pud)) return 0; - if (unlikely(pud_huge(pud))) { + if (unlikely(pud_huge(pud) || pud_devmap(pud))) { if (!gup_huge_pud(pud, pudp, addr, next, flags, pages, nr)) return 0;

From: Rob Clark robdclark@chromium.org

commit 24013314be6ee4ee456114a671e9fa3461323de8 upstream.

drm_gem_shmem_mmap() doesn't own this reference, resulting in the GEM object getting prematurely freed leading to a later use-after-free.

Link: https://syzkaller.appspot.com/bug?extid=c8ae65286134dd1b800d Reported-by: syzbot+c8ae65286134dd1b800d@syzkaller.appspotmail.com Fixes: 2194a63a818d ("drm: Add library for shmem backed GEM objects") Cc: stable@vger.kernel.org Signed-off-by: Rob Clark robdclark@chromium.org Reviewed-by: Daniel Vetter daniel.vetter@ffwll.ch Signed-off-by: Javier Martinez Canillas javierm@redhat.com Link: https://patchwork.freedesktop.org/patch/msgid/20221130185748.357410-2-robdcl... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/gpu/drm/drm_gem_shmem_helper.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -554,10 +554,8 @@ int drm_gem_shmem_mmap(struct file *filp shmem = to_drm_gem_shmem_obj(vma->vm_private_data);

ret = drm_gem_shmem_get_pages(shmem); - if (ret) { - drm_gem_vm_close(vma); + if (ret) return ret; - }

/* VM_PFNMAP was set by drm_gem_mmap() */ vma->vm_flags &= ~VM_PFNMAP;

From: Anastasia Belova abelova@astralinux.ru

commit d180b6496143cd360c5d5f58ae4b9a8229c1f344 upstream.

If an empty buf is received, lbuf is also empty. So lbuf is accessed by index -1.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: f31a2de3fe36 ("HID: hid-lg4ff: Allow switching of Logitech gaming wheels between compatibility modes") Signed-off-by: Anastasia Belova abelova@astralinux.ru Signed-off-by: Jiri Kosina jkosina@suse.cz Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/hid/hid-lg4ff.c | 6 ++++++ 1 file changed, 6 insertions(+)

--- a/drivers/hid/hid-lg4ff.c +++ b/drivers/hid/hid-lg4ff.c @@ -872,6 +872,12 @@ static ssize_t lg4ff_alternate_modes_sto return -ENOMEM;

i = strlen(lbuf); + + if (i == 0) { + kfree(lbuf); + return -EINVAL; + } + if (lbuf[i-1] == '\n') { if (i == 1) { kfree(lbuf);

From: Oliver Hartkopp socketcan@hartkopp.net

commit 0acc442309a0a1b01bcdaa135e56e6398a49439c upstream.

Analogue to commit 8aa59e355949 ("can: af_can: fix NULL pointer dereference in can_rx_register()") we need to check for a missing initialization of ml_priv in the receive path of CAN frames.

Since commit 4e096a18867a ("net: introduce CAN specific pointer in the struct net_device") the check for dev->type to be ARPHRD_CAN is not sufficient anymore since bonding or tun netdevices claim to be CAN devices but do not initialize ml_priv accordingly.

Fixes: 4e096a18867a ("net: introduce CAN specific pointer in the struct net_device") Reported-by: syzbot+2d7f58292cb5b29eb5ad@syzkaller.appspotmail.com Reported-by: Wei Chen harperchen1110@gmail.com Signed-off-by: Oliver Hartkopp socketcan@hartkopp.net Link: https://lore.kernel.org/all/20221206201259.3028-1-socketcan@hartkopp.net Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde mkl@pengutronix.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- net/can/af_can.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/can/af_can.c +++ b/net/can/af_can.c @@ -678,7 +678,7 @@ static int can_rcv(struct sk_buff *skb, { struct canfd_frame *cfd = (struct canfd_frame *)skb->data;

- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU)) { + if (unlikely(dev->type != ARPHRD_CAN || !can_get_ml_priv(dev) || skb->len != CAN_MTU)) { pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d\n", dev->type, skb->len); goto free_skb; @@ -704,7 +704,7 @@ static int canfd_rcv(struct sk_buff *skb { struct canfd_frame *cfd = (struct canfd_frame *)skb->data;

- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU)) { + if (unlikely(dev->type != ARPHRD_CAN || !can_get_ml_priv(dev) || skb->len != CANFD_MTU)) { pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n", dev->type, skb->len); goto free_skb;

From: Ziyang Xuan william.xuanziyang@huawei.com

[ Upstream commit 4d002d6a2a00ac1c433899bd7625c6400a74cfba ]

In cc2520_hw_init(), if oscillator start failed, the error code should be returned.

Fixes: 0da6bc8cc341 ("ieee802154: cc2520: adds driver for TI CC2520 radio") Signed-off-by: Ziyang Xuan william.xuanziyang@huawei.com Link: https://lore.kernel.org/r/20221120075046.2213633-1-william.xuanziyang@huawei... Signed-off-by: Stefan Schmidt stefan@datenfreihafen.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ieee802154/cc2520.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ieee802154/cc2520.c b/drivers/net/ieee802154/cc2520.c index 0432a4f829a9..9739a6ed91ad 100644 --- a/drivers/net/ieee802154/cc2520.c +++ b/drivers/net/ieee802154/cc2520.c @@ -973,7 +973,7 @@ static int cc2520_hw_init(struct cc2520_private *priv)

if (timeout-- <= 0) { dev_err(&priv->spi->dev, "oscillator start failed!\n"); - return ret; + return -ETIMEDOUT; } udelay(1); } while (!(status & CC2520_STATUS_XOSC32M_STABLE));

From: Qiqi Zhang eddy.zhang@rock-chips.com

[ Upstream commit 8c115864501fc09932cdfec53d9ec1cde82b4a28 ]

According to the description in ti-sn65dsi86's datasheet:

CHA_HSYNC_POLARITY: 0 = Active High Pulse. Synchronization signal is high for the sync pulse width. (default) 1 = Active Low Pulse. Synchronization signal is low for the sync pulse width.

CHA_VSYNC_POLARITY: 0 = Active High Pulse. Synchronization signal is high for the sync pulse width. (Default) 1 = Active Low Pulse. Synchronization signal is low for the sync pulse width.

We should only set these bits when the polarity is negative.

Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver") Signed-off-by: Qiqi Zhang eddy.zhang@rock-chips.com Reviewed-by: Douglas Anderson dianders@chromium.org Tested-by: Douglas Anderson dianders@chromium.org Reviewed-by: Tomi Valkeinen tomi.valkeinen@ideasonboard.com Signed-off-by: Douglas Anderson dianders@chromium.org Link: https://patchwork.freedesktop.org/patch/msgid/20221125104558.84616-1-eddy.zh... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c index dbb4a374cb64..20ea1c6bc8bb 100644 --- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c +++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c @@ -460,9 +460,9 @@ static void ti_sn_bridge_set_video_timings(struct ti_sn_bridge *pdata) &pdata->bridge.encoder->crtc->state->adjusted_mode; u8 hsync_polarity = 0, vsync_polarity = 0;

- if (mode->flags & DRM_MODE_FLAG_PHSYNC) + if (mode->flags & DRM_MODE_FLAG_NHSYNC) hsync_polarity = CHA_HSYNC_POLARITY; - if (mode->flags & DRM_MODE_FLAG_PVSYNC) + if (mode->flags & DRM_MODE_FLAG_NVSYNC) vsync_polarity = CHA_VSYNC_POLARITY;

ti_sn_bridge_write_u16(pdata, SN_CHA_ACTIVE_LINE_LENGTH_LOW_REG,

From: Akihiko Odaki akihiko.odaki@daynix.com

[ Upstream commit eed913f6919e253f35d454b2f115f2a4db2b741a ]

e1000_xmit_frame is expected to stop the queue and dispatch frames to hardware if there is not sufficient space for the next frame in the buffer, but sometimes it failed to do so because the estimated maximum size of frame was wrong. As the consequence, the later invocation of e1000_xmit_frame failed with NETDEV_TX_BUSY, and the frame in the buffer remained forever, resulting in a watchdog failure.

This change fixes the estimated size by making it match with the condition for NETDEV_TX_BUSY. Apparently, the old estimation failed to account for the following lines which determines the space requirement for not causing NETDEV_TX_BUSY: ``` /* reserve a descriptor for the offload context */ if ((mss) || (skb->ip_summed == CHECKSUM_PARTIAL)) count++; count++;

count += DIV_ROUND_UP(len, adapter->tx_fifo_limit); ```

This issue was found when running http-stress02 test included in Linux Test Project 20220930 on QEMU with the following commandline: ``` qemu-system-x86_64 -M q35,accel=kvm -m 8G -smp 8 -drive if=virtio,format=raw,file=root.img,file.locking=on -device e1000e,netdev=netdev -netdev tap,script=ifup,downscript=no,id=netdev ```

Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)") Signed-off-by: Akihiko Odaki akihiko.odaki@daynix.com Tested-by: Gurucharan G gurucharanx.g@intel.com (A Contingent worker at Intel) Tested-by: Naama Meir naamax.meir@linux.intel.com Signed-off-by: Tony Nguyen anthony.l.nguyen@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/intel/e1000e/netdev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c index cbd83bb5c1ac..b0d43985724d 100644 --- a/drivers/net/ethernet/intel/e1000e/netdev.c +++ b/drivers/net/ethernet/intel/e1000e/netdev.c @@ -5916,9 +5916,9 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb, e1000_tx_queue(tx_ring, tx_flags, count); /* Make sure there is space in the ring for the next send. */ e1000_maybe_stop_tx(tx_ring, - (MAX_SKB_FRAGS * + ((MAX_SKB_FRAGS + 1) * DIV_ROUND_UP(PAGE_SIZE, - adapter->tx_fifo_limit) + 2)); + adapter->tx_fifo_limit) + 4));

if (!netdev_xmit_more() || netif_xmit_stopped(netdev_get_tx_queue(netdev, 0))) {

From: Kuniyuki Iwashima kuniyu@amazon.com

[ Upstream commit b3abe42e94900bdd045c472f9c9be620ba5ce553 ]

Wei Chen reported a NULL deref in sk_user_ns() [0][1], and Paolo diagnosed the root cause: in unix_diag_get_exact(), the newly allocated skb does not have sk. [2]

We must get the user_ns from the NETLINK_CB(in_skb).sk and pass it to sk_diag_fill().

[0]: BUG: kernel NULL pointer dereference, address: 0000000000000270 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 12bbce067 P4D 12bbce067 PUD 12bc40067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 0 PID: 27942 Comm: syz-executor.0 Not tainted 6.1.0-rc5-next-20221118 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014 RIP: 0010:sk_user_ns include/net/sock.h:920 [inline] RIP: 0010:sk_diag_dump_uid net/unix/diag.c:119 [inline] RIP: 0010:sk_diag_fill+0x77d/0x890 net/unix/diag.c:170 Code: 89 ef e8 66 d4 2d fd c7 44 24 40 00 00 00 00 49 8d 7c 24 18 e8 54 d7 2d fd 49 8b 5c 24 18 48 8d bb 70 02 00 00 e8 43 d7 2d fd <48> 8b 9b 70 02 00 00 48 8d 7b 10 e8 33 d7 2d fd 48 8b 5b 10 48 8d RSP: 0018:ffffc90000d67968 EFLAGS: 00010246 RAX: ffff88812badaa48 RBX: 0000000000000000 RCX: ffffffff840d481d RDX: 0000000000000465 RSI: 0000000000000000 RDI: 0000000000000270 RBP: ffffc90000d679a8 R08: 0000000000000277 R09: 0000000000000000 R10: 0001ffffffffffff R11: 0001c90000d679a8 R12: ffff88812ac03800 R13: ffff88812c87c400 R14: ffff88812ae42210 R15: ffff888103026940 FS: 00007f08b4e6f700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000270 CR3: 000000012c58b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> unix_diag_get_exact net/unix/diag.c:285 [inline] unix_diag_handler_dump+0x3f9/0x500 net/unix/diag.c:317 __sock_diag_cmd net/core/sock_diag.c:235 [inline] sock_diag_rcv_msg+0x237/0x250 net/core/sock_diag.c:266 netlink_rcv_skb+0x13e/0x250 net/netlink/af_netlink.c:2564 sock_diag_rcv+0x24/0x40 net/core/sock_diag.c:277 netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline] netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1356 netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1932 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x38f/0x500 net/socket.c:2476 ___sys_sendmsg net/socket.c:2530 [inline] __sys_sendmsg+0x197/0x230 net/socket.c:2559 __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x4697f9 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f08b4e6ec48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000077bf80 RCX: 00000000004697f9 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 RBP: 00000000004d29e9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000077bf80 R13: 0000000000000000 R14: 000000000077bf80 R15: 00007ffdb36bc6c0 </TASK> Modules linked in: CR2: 0000000000000270

[1]: https://lore.kernel.org/netdev/CAO4mrfdvyjFpokhNsiwZiP-wpdSD0AStcJwfKcKQdAAL... [2]: https://lore.kernel.org/netdev/e04315e7c90d9a75613f3993c2baf2d344eef7eb.came...

Fixes: cae9910e7344 ("net: Add UNIX_DIAG_UID to Netlink UNIX socket diagnostics.") Reported-by: syzbot syzkaller@googlegroups.com Reported-by: Wei Chen harperchen1110@gmail.com Diagnosed-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Kuniyuki Iwashima kuniyu@amazon.com Signed-off-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/unix/diag.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/net/unix/diag.c b/net/unix/diag.c index 9ff64f9df1f3..951b33fa8f5c 100644 --- a/net/unix/diag.c +++ b/net/unix/diag.c @@ -113,14 +113,16 @@ static int sk_diag_show_rqlen(struct sock *sk, struct sk_buff *nlskb) return nla_put(nlskb, UNIX_DIAG_RQLEN, sizeof(rql), &rql); }

-static int sk_diag_dump_uid(struct sock *sk, struct sk_buff *nlskb) +static int sk_diag_dump_uid(struct sock *sk, struct sk_buff *nlskb, + struct user_namespace *user_ns) { - uid_t uid = from_kuid_munged(sk_user_ns(nlskb->sk), sock_i_uid(sk)); + uid_t uid = from_kuid_munged(user_ns, sock_i_uid(sk)); return nla_put(nlskb, UNIX_DIAG_UID, sizeof(uid_t), &uid); }

static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_req *req, - u32 portid, u32 seq, u32 flags, int sk_ino) + struct user_namespace *user_ns, + u32 portid, u32 seq, u32 flags, int sk_ino) { struct nlmsghdr *nlh; struct unix_diag_msg *rep; @@ -166,7 +168,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r goto out_nlmsg_trim;

if ((req->udiag_show & UDIAG_SHOW_UID) && - sk_diag_dump_uid(sk, skb)) + sk_diag_dump_uid(sk, skb, user_ns)) goto out_nlmsg_trim;

nlmsg_end(skb, nlh); @@ -178,7 +180,8 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r }

static int sk_diag_dump(struct sock *sk, struct sk_buff *skb, struct unix_diag_req *req, - u32 portid, u32 seq, u32 flags) + struct user_namespace *user_ns, + u32 portid, u32 seq, u32 flags) { int sk_ino;

@@ -189,7 +192,7 @@ static int sk_diag_dump(struct sock *sk, struct sk_buff *skb, struct unix_diag_r if (!sk_ino) return 0;

- return sk_diag_fill(sk, skb, req, portid, seq, flags, sk_ino); + return sk_diag_fill(sk, skb, req, user_ns, portid, seq, flags, sk_ino); }

static int unix_diag_dump(struct sk_buff *skb, struct netlink_callback *cb) @@ -217,7 +220,7 @@ static int unix_diag_dump(struct sk_buff *skb, struct netlink_callback *cb) goto next; if (!(req->udiag_states & (1 << sk->sk_state))) goto next; - if (sk_diag_dump(sk, skb, req, + if (sk_diag_dump(sk, skb, req, sk_user_ns(skb->sk), NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, NLM_F_MULTI) < 0) @@ -285,7 +288,8 @@ static int unix_diag_get_exact(struct sk_buff *in_skb, if (!rep) goto out;

- err = sk_diag_fill(sk, rep, req, NETLINK_CB(in_skb).portid, + err = sk_diag_fill(sk, rep, req, sk_user_ns(NETLINK_CB(in_skb).sk), + NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, 0, req->udiag_ino); if (err < 0) { nlmsg_free(rep);

From: Chen Zhongjin chenzhongjin@huawei.com

[ Upstream commit 2f3957c7eb4e07df944169a3e50a4d6790e1c744 ]

bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it.

This can cause panic if the argument "bluetooth-power" in text is freed and then another led_trigger_register() tries to access it:

BUG: unable to handle page fault for address: ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: <TASK> led_trigger_register+0x10d/0x4f0 led_trigger_register_simple+0x7d/0x100 bt_init+0x39/0xf7 [bluetooth] do_one_initcall+0xd0/0x4e0

Fixes: e64c97b53bc6 ("Bluetooth: Add combined LED trigger for controller power") Signed-off-by: Chen Zhongjin chenzhongjin@huawei.com Signed-off-by: Luiz Augusto von Dentz luiz.von.dentz@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/bluetooth/af_bluetooth.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c index 5f508c50649d..8031526eeeee 100644 --- a/net/bluetooth/af_bluetooth.c +++ b/net/bluetooth/af_bluetooth.c @@ -735,7 +735,7 @@ static int __init bt_init(void)

err = bt_sysfs_init(); if (err < 0) - return err; + goto cleanup_led;

err = sock_register(&bt_sock_family_ops); if (err) @@ -771,6 +771,8 @@ static int __init bt_init(void) sock_unregister(PF_BLUETOOTH); cleanup_sysfs: bt_sysfs_cleanup(); +cleanup_led: + bt_leds_cleanup(); return err; }

From: Zhengchao Shao shaozhengchao@huawei.com

[ Upstream commit 85a0506c073332a3057f5a9635fa0d4db5a8e03b ]

When testing in kci_test_ipsec_offload, srcip is configured as $dstip, it should add xfrm policy rule in instead of out. The test result of this patch is as follows: PASS: ipsec_offload

Fixes: 2766a11161cc ("selftests: rtnetlink: add ipsec offload API test") Signed-off-by: Zhengchao Shao shaozhengchao@huawei.com Acked-by: Hangbin Liu liuhangbin@gmail.com Link: https://lore.kernel.org/r/20221201082246.14131-1-shaozhengchao@huawei.com Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/net/rtnetlink.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh index 28ea3753da20..911c549f186f 100755 --- a/tools/testing/selftests/net/rtnetlink.sh +++ b/tools/testing/selftests/net/rtnetlink.sh @@ -780,7 +780,7 @@ kci_test_ipsec_offload() tmpl proto esp src $srcip dst $dstip spi 9 \ mode transport reqid 42 check_err $? - ip x p add dir out src $dstip/24 dst $srcip/24 \ + ip x p add dir in src $dstip/24 dst $srcip/24 \ tmpl proto esp src $dstip dst $srcip spi 9 \ mode transport reqid 42 check_err $?

From: Valentina Goncharenko goncharenko.vp@ispras.ru

[ Upstream commit 167b3f2dcc62c271f3555b33df17e361bb1fa0ee ]

In functions regmap_encx24j600_phy_reg_read() and regmap_encx24j600_phy_reg_write() in the conditions of the waiting cycles for filling the variable 'ret' it is necessary to add parentheses to prevent wrong assignment due to logical operations precedence.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: d70e53262f5c ("net: Microchip encx24j600 driver") Signed-off-by: Valentina Goncharenko goncharenko.vp@ispras.ru Reviewed-by: Pavan Chebbi pavan.chebbi@broadcom.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/microchip/encx24j600-regmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/microchip/encx24j600-regmap.c b/drivers/net/ethernet/microchip/encx24j600-regmap.c index e2528633c09a..8c07c3c3c00c 100644 --- a/drivers/net/ethernet/microchip/encx24j600-regmap.c +++ b/drivers/net/ethernet/microchip/encx24j600-regmap.c @@ -364,7 +364,7 @@ static int regmap_encx24j600_phy_reg_read(void *context, unsigned int reg, goto err_out;

usleep_range(26, 100); - while ((ret = regmap_read(ctx->regmap, MISTAT, &mistat) != 0) && + while (((ret = regmap_read(ctx->regmap, MISTAT, &mistat)) != 0) && (mistat & BUSY)) cpu_relax();

@@ -402,7 +402,7 @@ static int regmap_encx24j600_phy_reg_write(void *context, unsigned int reg, goto err_out;

usleep_range(26, 100); - while ((ret = regmap_read(ctx->regmap, MISTAT, &mistat) != 0) && + while (((ret = regmap_read(ctx->regmap, MISTAT, &mistat)) != 0) && (mistat & BUSY)) cpu_relax();

From: Lin Liu lin.liu@citrix.com

[ Upstream commit d50b7914fae04d840ce36491d22133070b18cca9 ]

A NAPI is setup for each network sring to poll data to kernel The sring with source host is destroyed before live migration and new sring with target host is setup after live migration. The NAPI for the old sring is not deleted until setup new sring with target host after migration. With busy_poll/busy_read enabled, the NAPI can be polled before got deleted when resume VM.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: xennet_poll+0xae/0xd20 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI Call Trace: finish_task_switch+0x71/0x230 timerqueue_del+0x1d/0x40 hrtimer_try_to_cancel+0xb5/0x110 xennet_alloc_rx_buffers+0x2a0/0x2a0 napi_busy_loop+0xdb/0x270 sock_poll+0x87/0x90 do_sys_poll+0x26f/0x580 tracing_map_insert+0x1d4/0x2f0 event_hist_trigger+0x14a/0x260

finish_task_switch+0x71/0x230 __schedule+0x256/0x890 recalc_sigpending+0x1b/0x50 xen_sched_clock+0x15/0x20 __rb_reserve_next+0x12d/0x140 ring_buffer_lock_reserve+0x123/0x3d0 event_triggers_call+0x87/0xb0 trace_event_buffer_commit+0x1c4/0x210 xen_clocksource_get_cycles+0x15/0x20 ktime_get_ts64+0x51/0xf0 SyS_ppoll+0x160/0x1a0 SyS_ppoll+0x160/0x1a0 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x41/0xa6 ... RIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900 CR2: 0000000000000008 ---[ end trace f8601785b354351c ]---

xen frontend should remove the NAPIs for the old srings before live migration as the bond srings are destroyed

There is a tiny window between the srings are set to NULL and the NAPIs are disabled, It is safe as the NAPI threads are still frozen at that time

Signed-off-by: Lin Liu lin.liu@citrix.com Fixes: 4ec2411980d0 ([NET]: Do not check netif_running() and carrier state in ->poll()) Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/xen-netfront.c | 6 ++++++ 1 file changed, 6 insertions(+)

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index 810fa9968be7..9ae0903bc225 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -1621,6 +1621,12 @@ static int netfront_resume(struct xenbus_device *dev) netif_tx_unlock_bh(info->netdev);

xennet_disconnect_backend(info); + + rtnl_lock(); + if (info->queues) + xennet_destroy_queues(info); + rtnl_unlock(); + return 0; }

From: Michal Jaron michalx.jaron@intel.com

[ Upstream commit 82e0572b23029b380464fa9fdc125db9c1506d0a ]

During tx rings configuration default XPS queue config is set and __I40E_TX_XPS_INIT_DONE is locked. __I40E_TX_XPS_INIT_DONE state is cleared and set again with default mapping only during queues build, it means after first setup or reset with queues rebuild. (i.e. ethtool -L <interface> combined <number>) After other resets (i.e. ethtool -t <interface>) XPS_INIT_DONE is not cleared and those default maps cannot be set again. It results in cleared xps_cpus mapping until queues are not rebuild or mapping is not set by user.

Add clearing __I40E_TX_XPS_INIT_DONE state during reset to let the driver set xps_cpus to defaults again after it was cleared.

Fixes: 6f853d4f8e93 ("i40e: allow XPS with QoS enabled") Signed-off-by: Michal Jaron michalx.jaron@intel.com Signed-off-by: Kamil Maziarz kamil.maziarz@intel.com Tested-by: Gurucharan gurucharanx.g@intel.com (A Contingent worker at Intel) Signed-off-by: Tony Nguyen anthony.l.nguyen@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/intel/i40e/i40e_main.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c index 15f177185d71..d612b23c2e3f 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -9953,6 +9953,21 @@ static int i40e_rebuild_channels(struct i40e_vsi *vsi) return 0; }

+/** + * i40e_clean_xps_state - clean xps state for every tx_ring + * @vsi: ptr to the VSI + **/ +static void i40e_clean_xps_state(struct i40e_vsi *vsi) +{ + int i; + + if (vsi->tx_rings) + for (i = 0; i < vsi->num_queue_pairs; i++) + if (vsi->tx_rings[i]) + clear_bit(__I40E_TX_XPS_INIT_DONE, + vsi->tx_rings[i]->state); +} + /** * i40e_prep_for_reset - prep for the core to reset * @pf: board private structure @@ -9984,8 +9999,10 @@ static void i40e_prep_for_reset(struct i40e_pf *pf, bool lock_acquired) rtnl_unlock();

for (v = 0; v < pf->num_alloc_vsi; v++) { - if (pf->vsi[v]) + if (pf->vsi[v]) { + i40e_clean_xps_state(pf->vsi[v]); pf->vsi[v]->seid = 0; + } }

i40e_shutdown_adminq(&pf->hw);

From: Przemyslaw Patynowski przemyslawx.patynowski@intel.com

[ Upstream commit d64aaf3f7869f915fd120763d75f11d6b116424d ]

Return -EOPNOTSUPP, when user requests l4_4_bytes for raw IP4 or IP6 flow director filters. Flow director does not support filtering on l4 bytes for PCTYPEs used by IP4 and IP6 filters. Without this patch, user could create filters with l4_4_bytes fields, which did not do any filtering on L4, but only on L3 fields.

Fixes: 36777d9fa24c ("i40e: check current configured input set when adding ntuple filters") Signed-off-by: Przemyslaw Patynowski przemyslawx.patynowski@intel.com Signed-off-by: Kamil Maziarz kamil.maziarz@intel.com Reviewed-by: Jacob Keller jacob.e.keller@intel.com Tested-by: Gurucharan G gurucharanx.g@intel.com (A Contingent worker at Intel) Signed-off-by: Tony Nguyen anthony.l.nguyen@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c index 7059ced24739..95a6f8689b6f 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c @@ -4233,11 +4233,7 @@ static int i40e_check_fdir_input_set(struct i40e_vsi *vsi, return -EOPNOTSUPP;

/* First 4 bytes of L4 header */ - if (usr_ip4_spec->l4_4_bytes == htonl(0xFFFFFFFF)) - new_mask |= I40E_L4_SRC_MASK | I40E_L4_DST_MASK; - else if (!usr_ip4_spec->l4_4_bytes) - new_mask &= ~(I40E_L4_SRC_MASK | I40E_L4_DST_MASK); - else + if (usr_ip4_spec->l4_4_bytes) return -EOPNOTSUPP;

/* Filtering on Type of Service is not supported. */

From: Pankaj Raghav p.raghav@samsung.com

[ Upstream commit 6f2d71524bcfdeb1fcbd22a4a92a5b7b161ab224 ]

A device might have a core quirk for NVME_QUIRK_IGNORE_DEV_SUBNQN (such as Samsung X5) but it would still give a:

"missing or invalid SUBNQN field"

warning as core quirks are filled after calling nvme_init_subnqn. Fill ctrl->quirks from struct core_quirks before calling nvme_init_subsystem to fix this.

Tested on a Samsung X5.

Fixes: ab9e00cc72fa ("nvme: track subsystems") Signed-off-by: Pankaj Raghav p.raghav@samsung.com Signed-off-by: Christoph Hellwig hch@lst.de Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/nvme/host/core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 3b5e5fb158be..029a89aead53 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -2806,10 +2806,6 @@ int nvme_init_identify(struct nvme_ctrl *ctrl) if (!ctrl->identified) { int i;

- ret = nvme_init_subsystem(ctrl, id); - if (ret) - goto out_free; - /* * Check for quirks. Quirk can depend on firmware version, * so, in principle, the set of quirks present can change @@ -2822,6 +2818,10 @@ int nvme_init_identify(struct nvme_ctrl *ctrl) if (quirk_matches(id, &core_quirks[i])) ctrl->quirks |= core_quirks[i].quirks; } + + ret = nvme_init_subsystem(ctrl, id); + if (ret) + goto out_free; } memcpy(ctrl->subsys->firmware_rev, id->fr, sizeof(ctrl->subsys->firmware_rev));

From: Yongqiang Liu liuyongqiang13@huawei.com

[ Upstream commit 42330a32933fb42180c52022804dcf09f47a2f99 ]

The nicvf_probe() won't destroy workqueue when register_netdev() failed. Add destroy_workqueue err handle case to fix this issue.

Fixes: 2ecbe4f4a027 ("net: thunderx: replace global nicvf_rx_mode_wq work queue for all VFs to private for each of them.") Signed-off-by: Yongqiang Liu liuyongqiang13@huawei.com Reviewed-by: Pavan Chebbi pavan.chebbi@broadcom.com Link: https://lore.kernel.org/r/20221203094125.602812-1-liuyongqiang13@huawei.com Signed-off-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c index 27ea528ef448..e861567b2c49 100644 --- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c +++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c @@ -2268,7 +2268,7 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) err = register_netdev(netdev); if (err) { dev_err(dev, "Failed to register netdevice\n"); - goto err_unregister_interrupts; + goto err_destroy_workqueue; }

nic->msg_enable = debug; @@ -2277,6 +2277,8 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)

return 0;

+err_destroy_workqueue: + destroy_workqueue(nic->nicvf_rx_mode_wq); err_unregister_interrupts: nicvf_unregister_interrupts(nic); err_free_netdev:

From: Liu Jian liujian56@huawei.com

[ Upstream commit 433c07a13f59856e4585e89e86b7d4cc59348fab ]

The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free.

Fixes: 57c5bc9ad7d7 ("net: hisilicon: add hix5hd2 mac driver") Signed-off-by: Liu Jian liujian56@huawei.com Link: https://lore.kernel.org/r/20221203094240.1240211-2-liujian56@huawei.com Signed-off-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c index c41b19c760f8..645cae590dc4 100644 --- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c +++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c @@ -550,7 +550,7 @@ static int hix5hd2_rx(struct net_device *dev, int limit) skb->protocol = eth_type_trans(skb, dev); napi_gro_receive(&priv->napi, skb); dev->stats.rx_packets++; - dev->stats.rx_bytes += skb->len; + dev->stats.rx_bytes += len; next: pos = dma_ring_incr(pos, RX_DESC_NUM); }

From: Ido Schimmel idosch@nvidia.com

[ Upstream commit f96a3d74554df537b6db5c99c27c80e7afadc8d1 ]

Cited commit added the table ID to the FIB info structure, but did not prevent structures with different table IDs from being consolidated. This can lead to routes being flushed from a VRF when an address is deleted from a different VRF.

Fix by taking the table ID into account when looking for a matching FIB info. This is already done for FIB info structures backed by a nexthop object in fib_find_info_nh().

Add test cases that fail before the fix:

# ./fib_tests.sh -t ipv4_del_addr

IPv4 delete address route tests Regular FIB info TEST: Route removed from VRF when source address deleted [ OK ] TEST: Route in default VRF not removed [ OK ] TEST: Route removed in default VRF when source address deleted [ OK ] TEST: Route in VRF is not removed by address delete [ OK ] Identical FIB info with different table ID TEST: Route removed from VRF when source address deleted [FAIL] TEST: Route in default VRF not removed [ OK ] RTNETLINK answers: File exists TEST: Route removed in default VRF when source address deleted [ OK ] TEST: Route in VRF is not removed by address delete [FAIL]

Tests passed: 6 Tests failed: 2

And pass after:

# ./fib_tests.sh -t ipv4_del_addr

IPv4 delete address route tests Regular FIB info TEST: Route removed from VRF when source address deleted [ OK ] TEST: Route in default VRF not removed [ OK ] TEST: Route removed in default VRF when source address deleted [ OK ] TEST: Route in VRF is not removed by address delete [ OK ] Identical FIB info with different table ID TEST: Route removed from VRF when source address deleted [ OK ] TEST: Route in default VRF not removed [ OK ] TEST: Route removed in default VRF when source address deleted [ OK ] TEST: Route in VRF is not removed by address delete [ OK ]

Tests passed: 8 Tests failed: 0

Fixes: 5a56a0b3a45d ("net: Don't delete routes in different VRFs") Signed-off-by: Ido Schimmel idosch@nvidia.com Reviewed-by: David Ahern dsahern@kernel.org Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- net/ipv4/fib_semantics.c | 1 + tools/testing/selftests/net/fib_tests.sh | 1727 ---------------------- 2 files changed, 1 insertion(+), 1727 deletions(-) delete mode 100755 tools/testing/selftests/net/fib_tests.sh

diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c index 908913d75847..f45b9daf62cf 100644 --- a/net/ipv4/fib_semantics.c +++ b/net/ipv4/fib_semantics.c @@ -420,6 +420,7 @@ static struct fib_info *fib_find_info(struct fib_info *nfi) nfi->fib_prefsrc == fi->fib_prefsrc && nfi->fib_priority == fi->fib_priority && nfi->fib_type == fi->fib_type && + nfi->fib_tb_id == fi->fib_tb_id && memcmp(nfi->fib_metrics, fi->fib_metrics, sizeof(u32) * RTAX_MAX) == 0 && !((nfi->fib_flags ^ fi->fib_flags) & ~RTNH_COMPARE_MASK) && diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh deleted file mode 100755 index 6986086035d6..000000000000 --- a/tools/testing/selftests/net/fib_tests.sh +++ /dev/null @@ -1,1727 +0,0 @@ -#!/bin/bash -# SPDX-License-Identifier: GPL-2.0 - -# This test is for checking IPv4 and IPv6 FIB behavior in response to -# different events. - -ret=0 -# Kselftest framework requirement - SKIP code is 4. -ksft_skip=4 - -# all tests in this script. Can be overridden with -t option -TESTS="unregister down carrier nexthop suppress ipv6_rt ipv4_rt ipv6_addr_metric ipv4_addr_metric ipv6_route_metrics ipv4_route_metrics ipv4_route_v6_gw rp_filter" - -VERBOSE=0 -PAUSE_ON_FAIL=no -PAUSE=no -IP="ip -netns ns1" -NS_EXEC="ip netns exec ns1" - -which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping) - -log_test() -{ - local rc=$1 - local expected=$2 - local msg="$3" - - if [ ${rc} -eq ${expected} ]; then - printf " TEST: %-60s [ OK ]\n" "${msg}" - nsuccess=$((nsuccess+1)) - else - ret=1 - nfail=$((nfail+1)) - printf " TEST: %-60s [FAIL]\n" "${msg}" - if [ "${PAUSE_ON_FAIL}" = "yes" ]; then - echo - echo "hit enter to continue, 'q' to quit" - read a - [ "$a" = "q" ] && exit 1 - fi - fi - - if [ "${PAUSE}" = "yes" ]; then - echo - echo "hit enter to continue, 'q' to quit" - read a - [ "$a" = "q" ] && exit 1 - fi -} - -setup() -{ - set -e - ip netns add ns1 - ip netns set ns1 auto - $IP link set dev lo up - ip netns exec ns1 sysctl -qw net.ipv4.ip_forward=1 - ip netns exec ns1 sysctl -qw net.ipv6.conf.all.forwarding=1 - - $IP link add dummy0 type dummy - $IP link set dev dummy0 up - $IP address add 198.51.100.1/24 dev dummy0 - $IP -6 address add 2001:db8:1::1/64 dev dummy0 - set +e - -} - -cleanup() -{ - $IP link del dev dummy0 &> /dev/null - ip netns del ns1 - ip netns del ns2 &> /dev/null -} - -get_linklocal() -{ - local dev=$1 - local addr - - addr=$($IP -6 -br addr show dev ${dev} | \ - awk '{ - for (i = 3; i <= NF; ++i) { - if ($i ~ /^fe80/) - print $i - } - }' - ) - addr=${addr//*} - - [ -z "$addr" ] && return 1 - - echo $addr - - return 0 -} - -fib_unreg_unicast_test() -{ - echo - echo "Single path route test" - - setup - - echo " Start point" - $IP route get fibmatch 198.51.100.2 &> /dev/null - log_test $? 0 "IPv4 fibmatch" - $IP -6 route get fibmatch 2001:db8:1::2 &> /dev/null - log_test $? 0 "IPv6 fibmatch" - - set -e - $IP link del dev dummy0 - set +e - - echo " Nexthop device deleted" - $IP route get fibmatch 198.51.100.2 &> /dev/null - log_test $? 2 "IPv4 fibmatch - no route" - $IP -6 route get fibmatch 2001:db8:1::2 &> /dev/null - log_test $? 2 "IPv6 fibmatch - no route" - - cleanup -} - -fib_unreg_multipath_test() -{ - - echo - echo "Multipath route test" - - setup - - set -e - $IP link add dummy1 type dummy - $IP link set dev dummy1 up - $IP address add 192.0.2.1/24 dev dummy1 - $IP -6 address add 2001:db8:2::1/64 dev dummy1 - - $IP route add 203.0.113.0/24 \ - nexthop via 198.51.100.2 dev dummy0 \ - nexthop via 192.0.2.2 dev dummy1 - $IP -6 route add 2001:db8:3::/64 \ - nexthop via 2001:db8:1::2 dev dummy0 \ - nexthop via 2001:db8:2::2 dev dummy1 - set +e - - echo " Start point" - $IP route get fibmatch 203.0.113.1 &> /dev/null - log_test $? 0 "IPv4 fibmatch" - $IP -6 route get fibmatch 2001:db8:3::1 &> /dev/null - log_test $? 0 "IPv6 fibmatch" - - set -e - $IP link del dev dummy0 - set +e - - echo " One nexthop device deleted" - $IP route get fibmatch 203.0.113.1 &> /dev/null - log_test $? 2 "IPv4 - multipath route removed on delete" - - $IP -6 route get fibmatch 2001:db8:3::1 &> /dev/null - # In IPv6 we do not flush the entire multipath route. - log_test $? 0 "IPv6 - multipath down to single path" - - set -e - $IP link del dev dummy1 - set +e - - echo " Second nexthop device deleted" - $IP -6 route get fibmatch 2001:db8:3::1 &> /dev/null - log_test $? 2 "IPv6 - no route" - - cleanup -} - -fib_unreg_test() -{ - fib_unreg_unicast_test - fib_unreg_multipath_test -} - -fib_down_unicast_test() -{ - echo - echo "Single path, admin down" - - setup - - echo " Start point" - $IP route get fibmatch 198.51.100.2 &> /dev/null - log_test $? 0 "IPv4 fibmatch" - $IP -6 route get fibmatch 2001:db8:1::2 &> /dev/null - log_test $? 0 "IPv6 fibmatch" - - set -e - $IP link set dev dummy0 down - set +e - - echo " Route deleted on down" - $IP route get fibmatch 198.51.100.2 &> /dev/null - log_test $? 2 "IPv4 fibmatch" - $IP -6 route get fibmatch 2001:db8:1::2 &> /dev/null - log_test $? 2 "IPv6 fibmatch" - - cleanup -} - -fib_down_multipath_test_do() -{ - local down_dev=$1 - local up_dev=$2 - - $IP route get fibmatch 203.0.113.1 \ - oif $down_dev &> /dev/null - log_test $? 2 "IPv4 fibmatch on down device" - $IP -6 route get fibmatch 2001:db8:3::1 \ - oif $down_dev &> /dev/null - log_test $? 2 "IPv6 fibmatch on down device" - - $IP route get fibmatch 203.0.113.1 \ - oif $up_dev &> /dev/null - log_test $? 0 "IPv4 fibmatch on up device" - $IP -6 route get fibmatch 2001:db8:3::1 \ - oif $up_dev &> /dev/null - log_test $? 0 "IPv6 fibmatch on up device" - - $IP route get fibmatch 203.0.113.1 | \ - grep $down_dev | grep -q "dead linkdown" - log_test $? 0 "IPv4 flags on down device" - $IP -6 route get fibmatch 2001:db8:3::1 | \ - grep $down_dev | grep -q "dead linkdown" - log_test $? 0 "IPv6 flags on down device" - - $IP route get fibmatch 203.0.113.1 | \ - grep $up_dev | grep -q "dead linkdown" - log_test $? 1 "IPv4 flags on up device" - $IP -6 route get fibmatch 2001:db8:3::1 | \ - grep $up_dev | grep -q "dead linkdown" - log_test $? 1 "IPv6 flags on up device" -} - -fib_down_multipath_test() -{ - echo - echo "Admin down multipath" - - setup - - set -e - $IP link add dummy1 type dummy - $IP link set dev dummy1 up - - $IP address add 192.0.2.1/24 dev dummy1 - $IP -6 address add 2001:db8:2::1/64 dev dummy1 - - $IP route add 203.0.113.0/24 \ - nexthop via 198.51.100.2 dev dummy0 \ - nexthop via 192.0.2.2 dev dummy1 - $IP -6 route add 2001:db8:3::/64 \ - nexthop via 2001:db8:1::2 dev dummy0 \ - nexthop via 2001:db8:2::2 dev dummy1 - set +e - - echo " Verify start point" - $IP route get fibmatch 203.0.113.1 &> /dev/null - log_test $? 0 "IPv4 fibmatch" - - $IP -6 route get fibmatch 2001:db8:3::1 &> /dev/null - log_test $? 0 "IPv6 fibmatch" - - set -e - $IP link set dev dummy0 down - set +e - - echo " One device down, one up" - fib_down_multipath_test_do "dummy0" "dummy1" - - set -e - $IP link set dev dummy0 up - $IP link set dev dummy1 down - set +e - - echo " Other device down and up" - fib_down_multipath_test_do "dummy1" "dummy0" - - set -e - $IP link set dev dummy0 down - set +e - - echo " Both devices down" - $IP route get fibmatch 203.0.113.1 &> /dev/null - log_test $? 2 "IPv4 fibmatch" - $IP -6 route get fibmatch 2001:db8:3::1 &> /dev/null - log_test $? 2 "IPv6 fibmatch" - - $IP link del dev dummy1 - cleanup -} - -fib_down_test() -{ - fib_down_unicast_test - fib_down_multipath_test -} - -# Local routes should not be affected when carrier changes. -fib_carrier_local_test() -{ - echo - echo "Local carrier tests - single path" - - setup - - set -e - $IP link set dev dummy0 carrier on - set +e - - echo " Start point" - $IP route get fibmatch 198.51.100.1 &> /dev/null - log_test $? 0 "IPv4 fibmatch" - $IP -6 route get fibmatch 2001:db8:1::1 &> /dev/null - log_test $? 0 "IPv6 fibmatch" - - $IP route get fibmatch 198.51.100.1 | \ - grep -q "linkdown" - log_test $? 1 "IPv4 - no linkdown flag" - $IP -6 route get fibmatch 2001:db8:1::1 | \ - grep -q "linkdown" - log_test $? 1 "IPv6 - no linkdown flag" - - set -e - $IP link set dev dummy0 carrier off - sleep 1 - set +e - - echo " Carrier off on nexthop" - $IP route get fibmatch 198.51.100.1 &> /dev/null - log_test $? 0 "IPv4 fibmatch" - $IP -6 route get fibmatch 2001:db8:1::1 &> /dev/null - log_test $? 0 "IPv6 fibmatch" - - $IP route get fibmatch 198.51.100.1 | \ - grep -q "linkdown" - log_test $? 1 "IPv4 - linkdown flag set" - $IP -6 route get fibmatch 2001:db8:1::1 | \ - grep -q "linkdown" - log_test $? 1 "IPv6 - linkdown flag set" - - set -e - $IP address add 192.0.2.1/24 dev dummy0 - $IP -6 address add 2001:db8:2::1/64 dev dummy0 - set +e - - echo " Route to local address with carrier down" - $IP route get fibmatch 192.0.2.1 &> /dev/null - log_test $? 0 "IPv4 fibmatch" - $IP -6 route get fibmatch 2001:db8:2::1 &> /dev/null - log_test $? 0 "IPv6 fibmatch" - - $IP route get fibmatch 192.0.2.1 | \ - grep -q "linkdown" - log_test $? 1 "IPv4 linkdown flag set" - $IP -6 route get fibmatch 2001:db8:2::1 | \ - grep -q "linkdown" - log_test $? 1 "IPv6 linkdown flag set" - - cleanup -} - -fib_carrier_unicast_test() -{ - ret=0 - - echo - echo "Single path route carrier test" - - setup - - set -e - $IP link set dev dummy0 carrier on - set +e - - echo " Start point" - $IP route get fibmatch 198.51.100.2 &> /dev/null - log_test $? 0 "IPv4 fibmatch" - $IP -6 route get fibmatch 2001:db8:1::2 &> /dev/null - log_test $? 0 "IPv6 fibmatch" - - $IP route get fibmatch 198.51.100.2 | \ - grep -q "linkdown" - log_test $? 1 "IPv4 no linkdown flag" - $IP -6 route get fibmatch 2001:db8:1::2 | \ - grep -q "linkdown" - log_test $? 1 "IPv6 no linkdown flag" - - set -e - $IP link set dev dummy0 carrier off - sleep 1 - set +e - - echo " Carrier down" - $IP route get fibmatch 198.51.100.2 &> /dev/null - log_test $? 0 "IPv4 fibmatch" - $IP -6 route get fibmatch 2001:db8:1::2 &> /dev/null - log_test $? 0 "IPv6 fibmatch" - - $IP route get fibmatch 198.51.100.2 | \ - grep -q "linkdown" - log_test $? 0 "IPv4 linkdown flag set" - $IP -6 route get fibmatch 2001:db8:1::2 | \ - grep -q "linkdown" - log_test $? 0 "IPv6 linkdown flag set" - - set -e - $IP address add 192.0.2.1/24 dev dummy0 - $IP -6 address add 2001:db8:2::1/64 dev dummy0 - set +e - - echo " Second address added with carrier down" - $IP route get fibmatch 192.0.2.2 &> /dev/null - log_test $? 0 "IPv4 fibmatch" - $IP -6 route get fibmatch 2001:db8:2::2 &> /dev/null - log_test $? 0 "IPv6 fibmatch" - - $IP route get fibmatch 192.0.2.2 | \ - grep -q "linkdown" - log_test $? 0 "IPv4 linkdown flag set" - $IP -6 route get fibmatch 2001:db8:2::2 | \ - grep -q "linkdown" - log_test $? 0 "IPv6 linkdown flag set" - - cleanup -} - -fib_carrier_test() -{ - fib_carrier_local_test - fib_carrier_unicast_test -} - -fib_rp_filter_test() -{ - echo - echo "IPv4 rp_filter tests" - - setup - - set -e - ip netns add ns2 - ip netns set ns2 auto - - ip -netns ns2 link set dev lo up - - $IP link add name veth1 type veth peer name veth2 - $IP link set dev veth2 netns ns2 - $IP address add 192.0.2.1/24 dev veth1 - ip -netns ns2 address add 192.0.2.1/24 dev veth2 - $IP link set dev veth1 up - ip -netns ns2 link set dev veth2 up - - $IP link set dev lo address 52:54:00:6a:c7:5e - $IP link set dev veth1 address 52:54:00:6a:c7:5e - ip -netns ns2 link set dev lo address 52:54:00:6a:c7:5e - ip -netns ns2 link set dev veth2 address 52:54:00:6a:c7:5e - - # 1. (ns2) redirect lo's egress to veth2's egress - ip netns exec ns2 tc qdisc add dev lo parent root handle 1: fq_codel - ip netns exec ns2 tc filter add dev lo parent 1: protocol arp basic \ - action mirred egress redirect dev veth2 - ip netns exec ns2 tc filter add dev lo parent 1: protocol ip basic \ - action mirred egress redirect dev veth2 - - # 2. (ns1) redirect veth1's ingress to lo's ingress - $NS_EXEC tc qdisc add dev veth1 ingress - $NS_EXEC tc filter add dev veth1 ingress protocol arp basic \ - action mirred ingress redirect dev lo - $NS_EXEC tc filter add dev veth1 ingress protocol ip basic \ - action mirred ingress redirect dev lo - - # 3. (ns1) redirect lo's egress to veth1's egress - $NS_EXEC tc qdisc add dev lo parent root handle 1: fq_codel - $NS_EXEC tc filter add dev lo parent 1: protocol arp basic \ - action mirred egress redirect dev veth1 - $NS_EXEC tc filter add dev lo parent 1: protocol ip basic \ - action mirred egress redirect dev veth1 - - # 4. (ns2) redirect veth2's ingress to lo's ingress - ip netns exec ns2 tc qdisc add dev veth2 ingress - ip netns exec ns2 tc filter add dev veth2 ingress protocol arp basic \ - action mirred ingress redirect dev lo - ip netns exec ns2 tc filter add dev veth2 ingress protocol ip basic \ - action mirred ingress redirect dev lo - - $NS_EXEC sysctl -qw net.ipv4.conf.all.rp_filter=1 - $NS_EXEC sysctl -qw net.ipv4.conf.all.accept_local=1 - $NS_EXEC sysctl -qw net.ipv4.conf.all.route_localnet=1 - ip netns exec ns2 sysctl -qw net.ipv4.conf.all.rp_filter=1 - ip netns exec ns2 sysctl -qw net.ipv4.conf.all.accept_local=1 - ip netns exec ns2 sysctl -qw net.ipv4.conf.all.route_localnet=1 - set +e - - run_cmd "ip netns exec ns2 ping -w1 -c1 192.0.2.1" - log_test $? 0 "rp_filter passes local packets" - - run_cmd "ip netns exec ns2 ping -w1 -c1 127.0.0.1" - log_test $? 0 "rp_filter passes loopback packets" - - cleanup -} - -################################################################################ -# Tests on nexthop spec - -# run 'ip route add' with given spec -add_rt() -{ - local desc="$1" - local erc=$2 - local vrf=$3 - local pfx=$4 - local gw=$5 - local dev=$6 - local cmd out rc - - [ "$vrf" = "-" ] && vrf="default" - [ -n "$gw" ] && gw="via $gw" - [ -n "$dev" ] && dev="dev $dev" - - cmd="$IP route add vrf $vrf $pfx $gw $dev" - if [ "$VERBOSE" = "1" ]; then - printf "\n COMMAND: $cmd\n" - fi - - out=$(eval $cmd 2>&1) - rc=$? - if [ "$VERBOSE" = "1" -a -n "$out" ]; then - echo " $out" - fi - log_test $rc $erc "$desc" -} - -fib4_nexthop() -{ - echo - echo "IPv4 nexthop tests" - - echo "<<< write me >>>" -} - -fib6_nexthop() -{ - local lldummy=$(get_linklocal dummy0) - local llv1=$(get_linklocal dummy0) - - if [ -z "$lldummy" ]; then - echo "Failed to get linklocal address for dummy0" - return 1 - fi - if [ -z "$llv1" ]; then - echo "Failed to get linklocal address for veth1" - return 1 - fi - - echo - echo "IPv6 nexthop tests" - - add_rt "Directly connected nexthop, unicast address" 0 \ - - 2001:db8:101::/64 2001:db8:1::2 - add_rt "Directly connected nexthop, unicast address with device" 0 \ - - 2001:db8:102::/64 2001:db8:1::2 "dummy0" - add_rt "Gateway is linklocal address" 0 \ - - 2001:db8:103::1/64 $llv1 "veth0" - - # fails because LL address requires a device - add_rt "Gateway is linklocal address, no device" 2 \ - - 2001:db8:104::1/64 $llv1 - - # local address can not be a gateway - add_rt "Gateway can not be local unicast address" 2 \ - - 2001:db8:105::/64 2001:db8:1::1 - add_rt "Gateway can not be local unicast address, with device" 2 \ - - 2001:db8:106::/64 2001:db8:1::1 "dummy0" - add_rt "Gateway can not be a local linklocal address" 2 \ - - 2001:db8:107::1/64 $lldummy "dummy0" - - # VRF tests - add_rt "Gateway can be local address in a VRF" 0 \ - - 2001:db8:108::/64 2001:db8:51::2 - add_rt "Gateway can be local address in a VRF, with device" 0 \ - - 2001:db8:109::/64 2001:db8:51::2 "veth0" - add_rt "Gateway can be local linklocal address in a VRF" 0 \ - - 2001:db8:110::1/64 $llv1 "veth0" - - add_rt "Redirect to VRF lookup" 0 \ - - 2001:db8:111::/64 "" "red" - - add_rt "VRF route, gateway can be local address in default VRF" 0 \ - red 2001:db8:112::/64 2001:db8:51::1 - - # local address in same VRF fails - add_rt "VRF route, gateway can not be a local address" 2 \ - red 2001:db8:113::1/64 2001:db8:2::1 - add_rt "VRF route, gateway can not be a local addr with device" 2 \ - red 2001:db8:114::1/64 2001:db8:2::1 "dummy1" -} - -# Default VRF: -# dummy0 - 198.51.100.1/24 2001:db8:1::1/64 -# veth0 - 192.0.2.1/24 2001:db8:51::1/64 -# -# VRF red: -# dummy1 - 192.168.2.1/24 2001:db8:2::1/64 -# veth1 - 192.0.2.2/24 2001:db8:51::2/64 -# -# [ dummy0 veth0 ]--[ veth1 dummy1 ] - -fib_nexthop_test() -{ - setup - - set -e - - $IP -4 rule add pref 32765 table local - $IP -4 rule del pref 0 - $IP -6 rule add pref 32765 table local - $IP -6 rule del pref 0 - - $IP link add red type vrf table 1 - $IP link set red up - $IP -4 route add vrf red unreachable default metric 4278198272 - $IP -6 route add vrf red unreachable default metric 4278198272 - - $IP link add veth0 type veth peer name veth1 - $IP link set dev veth0 up - $IP address add 192.0.2.1/24 dev veth0 - $IP -6 address add 2001:db8:51::1/64 dev veth0 - - $IP link set dev veth1 vrf red up - $IP address add 192.0.2.2/24 dev veth1 - $IP -6 address add 2001:db8:51::2/64 dev veth1 - - $IP link add dummy1 type dummy - $IP link set dev dummy1 vrf red up - $IP address add 192.168.2.1/24 dev dummy1 - $IP -6 address add 2001:db8:2::1/64 dev dummy1 - set +e - - sleep 1 - fib4_nexthop - fib6_nexthop - - ( - $IP link del dev dummy1 - $IP link del veth0 - $IP link del red - ) 2>/dev/null - cleanup -} - -fib_suppress_test() -{ - echo - echo "FIB rule with suppress_prefixlength" - setup - - $IP link add dummy1 type dummy - $IP link set dummy1 up - $IP -6 route add default dev dummy1 - $IP -6 rule add table main suppress_prefixlength 0 - ping -f -c 1000 -W 1 1234::1 >/dev/null 2>&1 - $IP -6 rule del table main suppress_prefixlength 0 - $IP link del dummy1 - - # If we got here without crashing, we're good. - log_test 0 0 "FIB rule suppress test" - - cleanup -} - -################################################################################ -# Tests on route add and replace - -run_cmd() -{ - local cmd="$1" - local out - local stderr="2>/dev/null" - - if [ "$VERBOSE" = "1" ]; then - printf " COMMAND: $cmd\n" - stderr= - fi - - out=$(eval $cmd $stderr) - rc=$? - if [ "$VERBOSE" = "1" -a -n "$out" ]; then - echo " $out" - fi - - [ "$VERBOSE" = "1" ] && echo - - return $rc -} - -check_expected() -{ - local out="$1" - local expected="$2" - local rc=0 - - [ "${out}" = "${expected}" ] && return 0 - - if [ -z "${out}" ]; then - if [ "$VERBOSE" = "1" ]; then - printf "\nNo route entry found\n" - printf "Expected:\n" - printf " ${expected}\n" - fi - return 1 - fi - - # tricky way to convert output to 1-line without ip's - # messy ''; this drops all extra white space - out=$(echo ${out}) - if [ "${out}" != "${expected}" ]; then - rc=1 - if [ "${VERBOSE}" = "1" ]; then - printf " Unexpected route entry. Have:\n" - printf " ${out}\n" - printf " Expected:\n" - printf " ${expected}\n\n" - fi - fi - - return $rc -} - -# add route for a prefix, flushing any existing routes first -# expected to be the first step of a test -add_route6() -{ - local pfx="$1" - local nh="$2" - local out - - if [ "$VERBOSE" = "1" ]; then - echo - echo " ##################################################" - echo - fi - - run_cmd "$IP -6 ro flush ${pfx}" - [ $? -ne 0 ] && exit 1 - - out=$($IP -6 ro ls match ${pfx}) - if [ -n "$out" ]; then - echo "Failed to flush routes for prefix used for tests." - exit 1 - fi - - run_cmd "$IP -6 ro add ${pfx} ${nh}" - if [ $? -ne 0 ]; then - echo "Failed to add initial route for test." - exit 1 - fi -} - -# add initial route - used in replace route tests -add_initial_route6() -{ - add_route6 "2001:db8:104::/64" "$1" -} - -check_route6() -{ - local pfx - local expected="$1" - local out - local rc=0 - - set -- $expected - pfx=$1 - - out=$($IP -6 ro ls match ${pfx} | sed -e 's/ pref medium//') - check_expected "${out}" "${expected}" -} - -route_cleanup() -{ - $IP li del red 2>/dev/null - $IP li del dummy1 2>/dev/null - $IP li del veth1 2>/dev/null - $IP li del veth3 2>/dev/null - - cleanup &> /dev/null -} - -route_setup() -{ - route_cleanup - setup - - [ "${VERBOSE}" = "1" ] && set -x - set -e - - ip netns add ns2 - ip netns set ns2 auto - ip -netns ns2 link set dev lo up - ip netns exec ns2 sysctl -qw net.ipv4.ip_forward=1 - ip netns exec ns2 sysctl -qw net.ipv6.conf.all.forwarding=1 - - $IP li add veth1 type veth peer name veth2 - $IP li add veth3 type veth peer name veth4 - - $IP li set veth1 up - $IP li set veth3 up - $IP li set veth2 netns ns2 up - $IP li set veth4 netns ns2 up - ip -netns ns2 li add dummy1 type dummy - ip -netns ns2 li set dummy1 up - - $IP -6 addr add 2001:db8:101::1/64 dev veth1 nodad - $IP -6 addr add 2001:db8:103::1/64 dev veth3 nodad - $IP addr add 172.16.101.1/24 dev veth1 - $IP addr add 172.16.103.1/24 dev veth3 - - ip -netns ns2 -6 addr add 2001:db8:101::2/64 dev veth2 nodad - ip -netns ns2 -6 addr add 2001:db8:103::2/64 dev veth4 nodad - ip -netns ns2 -6 addr add 2001:db8:104::1/64 dev dummy1 nodad - - ip -netns ns2 addr add 172.16.101.2/24 dev veth2 - ip -netns ns2 addr add 172.16.103.2/24 dev veth4 - ip -netns ns2 addr add 172.16.104.1/24 dev dummy1 - - set +e -} - -# assumption is that basic add of a single path route works -# otherwise just adding an address on an interface is broken -ipv6_rt_add() -{ - local rc - - echo - echo "IPv6 route add / append tests" - - # route add same prefix - fails with EEXISTS b/c ip adds NLM_F_EXCL - add_route6 "2001:db8:104::/64" "via 2001:db8:101::2" - run_cmd "$IP -6 ro add 2001:db8:104::/64 via 2001:db8:103::2" - log_test $? 2 "Attempt to add duplicate route - gw" - - # route add same prefix - fails with EEXISTS b/c ip adds NLM_F_EXCL - add_route6 "2001:db8:104::/64" "via 2001:db8:101::2" - run_cmd "$IP -6 ro add 2001:db8:104::/64 dev veth3" - log_test $? 2 "Attempt to add duplicate route - dev only" - - # route add same prefix - fails with EEXISTS b/c ip adds NLM_F_EXCL - add_route6 "2001:db8:104::/64" "via 2001:db8:101::2" - run_cmd "$IP -6 ro add unreachable 2001:db8:104::/64" - log_test $? 2 "Attempt to add duplicate route - reject route" - - # route append with same prefix adds a new route - # - iproute2 sets NLM_F_CREATE | NLM_F_APPEND - add_route6 "2001:db8:104::/64" "via 2001:db8:101::2" - run_cmd "$IP -6 ro append 2001:db8:104::/64 via 2001:db8:103::2" - check_route6 "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::2 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1" - log_test $? 0 "Append nexthop to existing route - gw" - - # insert mpath directly - add_route6 "2001:db8:104::/64" "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2" - check_route6 "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::2 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1" - log_test $? 0 "Add multipath route" - - add_route6 "2001:db8:104::/64" "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2" - run_cmd "$IP -6 ro add 2001:db8:104::/64 nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2" - log_test $? 2 "Attempt to add duplicate multipath route" - - # insert of a second route without append but different metric - add_route6 "2001:db8:104::/64" "via 2001:db8:101::2" - run_cmd "$IP -6 ro add 2001:db8:104::/64 via 2001:db8:103::2 metric 512" - rc=$? - if [ $rc -eq 0 ]; then - run_cmd "$IP -6 ro add 2001:db8:104::/64 via 2001:db8:103::3 metric 256" - rc=$? - fi - log_test $rc 0 "Route add with different metrics" - - run_cmd "$IP -6 ro del 2001:db8:104::/64 metric 512" - rc=$? - if [ $rc -eq 0 ]; then - check_route6 "2001:db8:104::/64 via 2001:db8:103::3 dev veth3 metric 256 2001:db8:104::/64 via 2001:db8:101::2 dev veth1 metric 1024" - rc=$? - fi - log_test $rc 0 "Route delete with metric" -} - -ipv6_rt_replace_single() -{ - # single path with single path - # - add_initial_route6 "via 2001:db8:101::2" - run_cmd "$IP -6 ro replace 2001:db8:104::/64 via 2001:db8:103::2" - check_route6 "2001:db8:104::/64 via 2001:db8:103::2 dev veth3 metric 1024" - log_test $? 0 "Single path with single path" - - # single path with multipath - # - add_initial_route6 "nexthop via 2001:db8:101::2" - run_cmd "$IP -6 ro replace 2001:db8:104::/64 nexthop via 2001:db8:101::3 nexthop via 2001:db8:103::2" - check_route6 "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::3 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1" - log_test $? 0 "Single path with multipath" - - # single path with single path using MULTIPATH attribute - # - add_initial_route6 "via 2001:db8:101::2" - run_cmd "$IP -6 ro replace 2001:db8:104::/64 nexthop via 2001:db8:103::2" - check_route6 "2001:db8:104::/64 via 2001:db8:103::2 dev veth3 metric 1024" - log_test $? 0 "Single path with single path via multipath attribute" - - # route replace fails - invalid nexthop - add_initial_route6 "via 2001:db8:101::2" - run_cmd "$IP -6 ro replace 2001:db8:104::/64 via 2001:db8:104::2" - if [ $? -eq 0 ]; then - # previous command is expected to fail so if it returns 0 - # that means the test failed. - log_test 0 1 "Invalid nexthop" - else - check_route6 "2001:db8:104::/64 via 2001:db8:101::2 dev veth1 metric 1024" - log_test $? 0 "Invalid nexthop" - fi - - # replace non-existent route - # - note use of change versus replace since ip adds NLM_F_CREATE - # for replace - add_initial_route6 "via 2001:db8:101::2" - run_cmd "$IP -6 ro change 2001:db8:105::/64 via 2001:db8:101::2" - log_test $? 2 "Single path - replace of non-existent route" -} - -ipv6_rt_replace_mpath() -{ - # multipath with multipath - add_initial_route6 "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2" - run_cmd "$IP -6 ro replace 2001:db8:104::/64 nexthop via 2001:db8:101::3 nexthop via 2001:db8:103::3" - check_route6 "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::3 dev veth1 weight 1 nexthop via 2001:db8:103::3 dev veth3 weight 1" - log_test $? 0 "Multipath with multipath" - - # multipath with single - add_initial_route6 "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2" - run_cmd "$IP -6 ro replace 2001:db8:104::/64 via 2001:db8:101::3" - check_route6 "2001:db8:104::/64 via 2001:db8:101::3 dev veth1 metric 1024" - log_test $? 0 "Multipath with single path" - - # multipath with single - add_initial_route6 "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2" - run_cmd "$IP -6 ro replace 2001:db8:104::/64 nexthop via 2001:db8:101::3" - check_route6 "2001:db8:104::/64 via 2001:db8:101::3 dev veth1 metric 1024" - log_test $? 0 "Multipath with single path via multipath attribute" - - # multipath with dev-only - add_initial_route6 "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2" - run_cmd "$IP -6 ro replace 2001:db8:104::/64 dev veth1" - check_route6 "2001:db8:104::/64 dev veth1 metric 1024" - log_test $? 0 "Multipath with dev-only" - - # route replace fails - invalid nexthop 1 - add_initial_route6 "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2" - run_cmd "$IP -6 ro replace 2001:db8:104::/64 nexthop via 2001:db8:111::3 nexthop via 2001:db8:103::3" - check_route6 "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::2 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1" - log_test $? 0 "Multipath - invalid first nexthop" - - # route replace fails - invalid nexthop 2 - add_initial_route6 "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2" - run_cmd "$IP -6 ro replace 2001:db8:104::/64 nexthop via 2001:db8:101::3 nexthop via 2001:db8:113::3" - check_route6 "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::2 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1" - log_test $? 0 "Multipath - invalid second nexthop" - - # multipath non-existent route - add_initial_route6 "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2" - run_cmd "$IP -6 ro change 2001:db8:105::/64 nexthop via 2001:db8:101::3 nexthop via 2001:db8:103::3" - log_test $? 2 "Multipath - replace of non-existent route" -} - -ipv6_rt_replace() -{ - echo - echo "IPv6 route replace tests" - - ipv6_rt_replace_single - ipv6_rt_replace_mpath -} - -ipv6_route_test() -{ - route_setup - - ipv6_rt_add - ipv6_rt_replace - - route_cleanup -} - -ip_addr_metric_check() -{ - ip addr help 2>&1 | grep -q metric - if [ $? -ne 0 ]; then - echo "iproute2 command does not support metric for addresses. Skipping test" - return 1 - fi - - return 0 -} - -ipv6_addr_metric_test() -{ - local rc - - echo - echo "IPv6 prefix route tests" - - ip_addr_metric_check || return 1 - - setup - - set -e - $IP li add dummy1 type dummy - $IP li add dummy2 type dummy - $IP li set dummy1 up - $IP li set dummy2 up - - # default entry is metric 256 - run_cmd "$IP -6 addr add dev dummy1 2001:db8:104::1/64" - run_cmd "$IP -6 addr add dev dummy2 2001:db8:104::2/64" - set +e - - check_route6 "2001:db8:104::/64 dev dummy1 proto kernel metric 256 2001:db8:104::/64 dev dummy2 proto kernel metric 256" - log_test $? 0 "Default metric" - - set -e - run_cmd "$IP -6 addr flush dev dummy1" - run_cmd "$IP -6 addr add dev dummy1 2001:db8:104::1/64 metric 257" - set +e - - check_route6 "2001:db8:104::/64 dev dummy2 proto kernel metric 256 2001:db8:104::/64 dev dummy1 proto kernel metric 257" - log_test $? 0 "User specified metric on first device" - - set -e - run_cmd "$IP -6 addr flush dev dummy2" - run_cmd "$IP -6 addr add dev dummy2 2001:db8:104::2/64 metric 258" - set +e - - check_route6 "2001:db8:104::/64 dev dummy1 proto kernel metric 257 2001:db8:104::/64 dev dummy2 proto kernel metric 258" - log_test $? 0 "User specified metric on second device" - - run_cmd "$IP -6 addr del dev dummy1 2001:db8:104::1/64 metric 257" - rc=$? - if [ $rc -eq 0 ]; then - check_route6 "2001:db8:104::/64 dev dummy2 proto kernel metric 258" - rc=$? - fi - log_test $rc 0 "Delete of address on first device" - - run_cmd "$IP -6 addr change dev dummy2 2001:db8:104::2/64 metric 259" - rc=$? - if [ $rc -eq 0 ]; then - check_route6 "2001:db8:104::/64 dev dummy2 proto kernel metric 259" - rc=$? - fi - log_test $rc 0 "Modify metric of address" - - # verify prefix route removed on down - run_cmd "ip netns exec ns1 sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1" - run_cmd "$IP li set dev dummy2 down" - rc=$? - if [ $rc -eq 0 ]; then - out=$($IP -6 ro ls match 2001:db8:104::/64) - check_expected "${out}" "" - rc=$? - fi - log_test $rc 0 "Prefix route removed on link down" - - # verify prefix route re-inserted with assigned metric - run_cmd "$IP li set dev dummy2 up" - rc=$? - if [ $rc -eq 0 ]; then - check_route6 "2001:db8:104::/64 dev dummy2 proto kernel metric 259" - rc=$? - fi - log_test $rc 0 "Prefix route with metric on link up" - - # verify peer metric added correctly - set -e - run_cmd "$IP -6 addr flush dev dummy2" - run_cmd "$IP -6 addr add dev dummy2 2001:db8:104::1 peer 2001:db8:104::2 metric 260" - set +e - - check_route6 "2001:db8:104::1 dev dummy2 proto kernel metric 260" - log_test $? 0 "Set metric with peer route on local side" - check_route6 "2001:db8:104::2 dev dummy2 proto kernel metric 260" - log_test $? 0 "Set metric with peer route on peer side" - - set -e - run_cmd "$IP -6 addr change dev dummy2 2001:db8:104::1 peer 2001:db8:104::3 metric 261" - set +e - - check_route6 "2001:db8:104::1 dev dummy2 proto kernel metric 261" - log_test $? 0 "Modify metric and peer address on local side" - check_route6 "2001:db8:104::3 dev dummy2 proto kernel metric 261" - log_test $? 0 "Modify metric and peer address on peer side" - - $IP li del dummy1 - $IP li del dummy2 - cleanup -} - -ipv6_route_metrics_test() -{ - local rc - - echo - echo "IPv6 routes with metrics" - - route_setup - - # - # single path with metrics - # - run_cmd "$IP -6 ro add 2001:db8:111::/64 via 2001:db8:101::2 mtu 1400" - rc=$? - if [ $rc -eq 0 ]; then - check_route6 "2001:db8:111::/64 via 2001:db8:101::2 dev veth1 metric 1024 mtu 1400" - rc=$? - fi - log_test $rc 0 "Single path route with mtu metric" - - - # - # multipath via separate routes with metrics - # - run_cmd "$IP -6 ro add 2001:db8:112::/64 via 2001:db8:101::2 mtu 1400" - run_cmd "$IP -6 ro append 2001:db8:112::/64 via 2001:db8:103::2" - rc=$? - if [ $rc -eq 0 ]; then - check_route6 "2001:db8:112::/64 metric 1024 mtu 1400 nexthop via 2001:db8:101::2 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1" - rc=$? - fi - log_test $rc 0 "Multipath route via 2 single routes with mtu metric on first" - - # second route is coalesced to first to make a multipath route. - # MTU of the second path is hidden from display! - run_cmd "$IP -6 ro add 2001:db8:113::/64 via 2001:db8:101::2" - run_cmd "$IP -6 ro append 2001:db8:113::/64 via 2001:db8:103::2 mtu 1400" - rc=$? - if [ $rc -eq 0 ]; then - check_route6 "2001:db8:113::/64 metric 1024 nexthop via 2001:db8:101::2 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1" - rc=$? - fi - log_test $rc 0 "Multipath route via 2 single routes with mtu metric on 2nd" - - run_cmd "$IP -6 ro del 2001:db8:113::/64 via 2001:db8:101::2" - if [ $? -eq 0 ]; then - check_route6 "2001:db8:113::/64 via 2001:db8:103::2 dev veth3 metric 1024 mtu 1400" - log_test $? 0 " MTU of second leg" - fi - - # - # multipath with metrics - # - run_cmd "$IP -6 ro add 2001:db8:115::/64 mtu 1400 nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2" - rc=$? - if [ $rc -eq 0 ]; then - check_route6 "2001:db8:115::/64 metric 1024 mtu 1400 nexthop via 2001:db8:101::2 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1" - rc=$? - fi - log_test $rc 0 "Multipath route with mtu metric" - - $IP -6 ro add 2001:db8:104::/64 via 2001:db8:101::2 mtu 1300 - run_cmd "ip netns exec ns1 ${ping6} -w1 -c1 -s 1500 2001:db8:104::1" - log_test $? 0 "Using route with mtu metric" - - run_cmd "$IP -6 ro add 2001:db8:114::/64 via 2001:db8:101::2 congctl lock foo" - log_test $? 2 "Invalid metric (fails metric_convert)" - - route_cleanup -} - -# add route for a prefix, flushing any existing routes first -# expected to be the first step of a test -add_route() -{ - local pfx="$1" - local nh="$2" - local out - - if [ "$VERBOSE" = "1" ]; then - echo - echo " ##################################################" - echo - fi - - run_cmd "$IP ro flush ${pfx}" - [ $? -ne 0 ] && exit 1 - - out=$($IP ro ls match ${pfx}) - if [ -n "$out" ]; then - echo "Failed to flush routes for prefix used for tests." - exit 1 - fi - - run_cmd "$IP ro add ${pfx} ${nh}" - if [ $? -ne 0 ]; then - echo "Failed to add initial route for test." - exit 1 - fi -} - -# add initial route - used in replace route tests -add_initial_route() -{ - add_route "172.16.104.0/24" "$1" -} - -check_route() -{ - local pfx - local expected="$1" - local out - - set -- $expected - pfx=$1 - [ "${pfx}" = "unreachable" ] && pfx=$2 - - out=$($IP ro ls match ${pfx}) - check_expected "${out}" "${expected}" -} - -# assumption is that basic add of a single path route works -# otherwise just adding an address on an interface is broken -ipv4_rt_add() -{ - local rc - - echo - echo "IPv4 route add / append tests" - - # route add same prefix - fails with EEXISTS b/c ip adds NLM_F_EXCL - add_route "172.16.104.0/24" "via 172.16.101.2" - run_cmd "$IP ro add 172.16.104.0/24 via 172.16.103.2" - log_test $? 2 "Attempt to add duplicate route - gw" - - # route add same prefix - fails with EEXISTS b/c ip adds NLM_F_EXCL - add_route "172.16.104.0/24" "via 172.16.101.2" - run_cmd "$IP ro add 172.16.104.0/24 dev veth3" - log_test $? 2 "Attempt to add duplicate route - dev only" - - # route add same prefix - fails with EEXISTS b/c ip adds NLM_F_EXCL - add_route "172.16.104.0/24" "via 172.16.101.2" - run_cmd "$IP ro add unreachable 172.16.104.0/24" - log_test $? 2 "Attempt to add duplicate route - reject route" - - # iproute2 prepend only sets NLM_F_CREATE - # - adds a new route; does NOT convert existing route to ECMP - add_route "172.16.104.0/24" "via 172.16.101.2" - run_cmd "$IP ro prepend 172.16.104.0/24 via 172.16.103.2" - check_route "172.16.104.0/24 via 172.16.103.2 dev veth3 172.16.104.0/24 via 172.16.101.2 dev veth1" - log_test $? 0 "Add new nexthop for existing prefix" - - # route append with same prefix adds a new route - # - iproute2 sets NLM_F_CREATE | NLM_F_APPEND - add_route "172.16.104.0/24" "via 172.16.101.2" - run_cmd "$IP ro append 172.16.104.0/24 via 172.16.103.2" - check_route "172.16.104.0/24 via 172.16.101.2 dev veth1 172.16.104.0/24 via 172.16.103.2 dev veth3" - log_test $? 0 "Append nexthop to existing route - gw" - - add_route "172.16.104.0/24" "via 172.16.101.2" - run_cmd "$IP ro append 172.16.104.0/24 dev veth3" - check_route "172.16.104.0/24 via 172.16.101.2 dev veth1 172.16.104.0/24 dev veth3 scope link" - log_test $? 0 "Append nexthop to existing route - dev only" - - add_route "172.16.104.0/24" "via 172.16.101.2" - run_cmd "$IP ro append unreachable 172.16.104.0/24" - check_route "172.16.104.0/24 via 172.16.101.2 dev veth1 unreachable 172.16.104.0/24" - log_test $? 0 "Append nexthop to existing route - reject route" - - run_cmd "$IP ro flush 172.16.104.0/24" - run_cmd "$IP ro add unreachable 172.16.104.0/24" - run_cmd "$IP ro append 172.16.104.0/24 via 172.16.103.2" - check_route "unreachable 172.16.104.0/24 172.16.104.0/24 via 172.16.103.2 dev veth3" - log_test $? 0 "Append nexthop to existing reject route - gw" - - run_cmd "$IP ro flush 172.16.104.0/24" - run_cmd "$IP ro add unreachable 172.16.104.0/24" - run_cmd "$IP ro append 172.16.104.0/24 dev veth3" - check_route "unreachable 172.16.104.0/24 172.16.104.0/24 dev veth3 scope link" - log_test $? 0 "Append nexthop to existing reject route - dev only" - - # insert mpath directly - add_route "172.16.104.0/24" "nexthop via 172.16.101.2 nexthop via 172.16.103.2" - check_route "172.16.104.0/24 nexthop via 172.16.101.2 dev veth1 weight 1 nexthop via 172.16.103.2 dev veth3 weight 1" - log_test $? 0 "add multipath route" - - add_route "172.16.104.0/24" "nexthop via 172.16.101.2 nexthop via 172.16.103.2" - run_cmd "$IP ro add 172.16.104.0/24 nexthop via 172.16.101.2 nexthop via 172.16.103.2" - log_test $? 2 "Attempt to add duplicate multipath route" - - # insert of a second route without append but different metric - add_route "172.16.104.0/24" "via 172.16.101.2" - run_cmd "$IP ro add 172.16.104.0/24 via 172.16.103.2 metric 512" - rc=$? - if [ $rc -eq 0 ]; then - run_cmd "$IP ro add 172.16.104.0/24 via 172.16.103.3 metric 256" - rc=$? - fi - log_test $rc 0 "Route add with different metrics" - - run_cmd "$IP ro del 172.16.104.0/24 metric 512" - rc=$? - if [ $rc -eq 0 ]; then - check_route "172.16.104.0/24 via 172.16.101.2 dev veth1 172.16.104.0/24 via 172.16.103.3 dev veth3 metric 256" - rc=$? - fi - log_test $rc 0 "Route delete with metric" -} - -ipv4_rt_replace_single() -{ - # single path with single path - # - add_initial_route "via 172.16.101.2" - run_cmd "$IP ro replace 172.16.104.0/24 via 172.16.103.2" - check_route "172.16.104.0/24 via 172.16.103.2 dev veth3" - log_test $? 0 "Single path with single path" - - # single path with multipath - # - add_initial_route "nexthop via 172.16.101.2" - run_cmd "$IP ro replace 172.16.104.0/24 nexthop via 172.16.101.3 nexthop via 172.16.103.2" - check_route "172.16.104.0/24 nexthop via 172.16.101.3 dev veth1 weight 1 nexthop via 172.16.103.2 dev veth3 weight 1" - log_test $? 0 "Single path with multipath" - - # single path with reject - # - add_initial_route "nexthop via 172.16.101.2" - run_cmd "$IP ro replace unreachable 172.16.104.0/24" - check_route "unreachable 172.16.104.0/24" - log_test $? 0 "Single path with reject route" - - # single path with single path using MULTIPATH attribute - # - add_initial_route "via 172.16.101.2" - run_cmd "$IP ro replace 172.16.104.0/24 nexthop via 172.16.103.2" - check_route "172.16.104.0/24 via 172.16.103.2 dev veth3" - log_test $? 0 "Single path with single path via multipath attribute" - - # route replace fails - invalid nexthop - add_initial_route "via 172.16.101.2" - run_cmd "$IP ro replace 172.16.104.0/24 via 2001:db8:104::2" - if [ $? -eq 0 ]; then - # previous command is expected to fail so if it returns 0 - # that means the test failed. - log_test 0 1 "Invalid nexthop" - else - check_route "172.16.104.0/24 via 172.16.101.2 dev veth1" - log_test $? 0 "Invalid nexthop" - fi - - # replace non-existent route - # - note use of change versus replace since ip adds NLM_F_CREATE - # for replace - add_initial_route "via 172.16.101.2" - run_cmd "$IP ro change 172.16.105.0/24 via 172.16.101.2" - log_test $? 2 "Single path - replace of non-existent route" -} - -ipv4_rt_replace_mpath() -{ - # multipath with multipath - add_initial_route "nexthop via 172.16.101.2 nexthop via 172.16.103.2" - run_cmd "$IP ro replace 172.16.104.0/24 nexthop via 172.16.101.3 nexthop via 172.16.103.3" - check_route "172.16.104.0/24 nexthop via 172.16.101.3 dev veth1 weight 1 nexthop via 172.16.103.3 dev veth3 weight 1" - log_test $? 0 "Multipath with multipath" - - # multipath with single - add_initial_route "nexthop via 172.16.101.2 nexthop via 172.16.103.2" - run_cmd "$IP ro replace 172.16.104.0/24 via 172.16.101.3" - check_route "172.16.104.0/24 via 172.16.101.3 dev veth1" - log_test $? 0 "Multipath with single path" - - # multipath with single - add_initial_route "nexthop via 172.16.101.2 nexthop via 172.16.103.2" - run_cmd "$IP ro replace 172.16.104.0/24 nexthop via 172.16.101.3" - check_route "172.16.104.0/24 via 172.16.101.3 dev veth1" - log_test $? 0 "Multipath with single path via multipath attribute" - - # multipath with reject - add_initial_route "nexthop via 172.16.101.2 nexthop via 172.16.103.2" - run_cmd "$IP ro replace unreachable 172.16.104.0/24" - check_route "unreachable 172.16.104.0/24" - log_test $? 0 "Multipath with reject route" - - # route replace fails - invalid nexthop 1 - add_initial_route "nexthop via 172.16.101.2 nexthop via 172.16.103.2" - run_cmd "$IP ro replace 172.16.104.0/24 nexthop via 172.16.111.3 nexthop via 172.16.103.3" - check_route "172.16.104.0/24 nexthop via 172.16.101.2 dev veth1 weight 1 nexthop via 172.16.103.2 dev veth3 weight 1" - log_test $? 0 "Multipath - invalid first nexthop" - - # route replace fails - invalid nexthop 2 - add_initial_route "nexthop via 172.16.101.2 nexthop via 172.16.103.2" - run_cmd "$IP ro replace 172.16.104.0/24 nexthop via 172.16.101.3 nexthop via 172.16.113.3" - check_route "172.16.104.0/24 nexthop via 172.16.101.2 dev veth1 weight 1 nexthop via 172.16.103.2 dev veth3 weight 1" - log_test $? 0 "Multipath - invalid second nexthop" - - # multipath non-existent route - add_initial_route "nexthop via 172.16.101.2 nexthop via 172.16.103.2" - run_cmd "$IP ro change 172.16.105.0/24 nexthop via 172.16.101.3 nexthop via 172.16.103.3" - log_test $? 2 "Multipath - replace of non-existent route" -} - -ipv4_rt_replace() -{ - echo - echo "IPv4 route replace tests" - - ipv4_rt_replace_single - ipv4_rt_replace_mpath -} - -ipv4_route_test() -{ - route_setup - - ipv4_rt_add - ipv4_rt_replace - - route_cleanup -} - -ipv4_addr_metric_test() -{ - local rc - - echo - echo "IPv4 prefix route tests" - - ip_addr_metric_check || return 1 - - setup - - set -e - $IP li add dummy1 type dummy - $IP li add dummy2 type dummy - $IP li set dummy1 up - $IP li set dummy2 up - - # default entry is metric 256 - run_cmd "$IP addr add dev dummy1 172.16.104.1/24" - run_cmd "$IP addr add dev dummy2 172.16.104.2/24" - set +e - - check_route "172.16.104.0/24 dev dummy1 proto kernel scope link src 172.16.104.1 172.16.104.0/24 dev dummy2 proto kernel scope link src 172.16.104.2" - log_test $? 0 "Default metric" - - set -e - run_cmd "$IP addr flush dev dummy1" - run_cmd "$IP addr add dev dummy1 172.16.104.1/24 metric 257" - set +e - - check_route "172.16.104.0/24 dev dummy2 proto kernel scope link src 172.16.104.2 172.16.104.0/24 dev dummy1 proto kernel scope link src 172.16.104.1 metric 257" - log_test $? 0 "User specified metric on first device" - - set -e - run_cmd "$IP addr flush dev dummy2" - run_cmd "$IP addr add dev dummy2 172.16.104.2/24 metric 258" - set +e - - check_route "172.16.104.0/24 dev dummy1 proto kernel scope link src 172.16.104.1 metric 257 172.16.104.0/24 dev dummy2 proto kernel scope link src 172.16.104.2 metric 258" - log_test $? 0 "User specified metric on second device" - - run_cmd "$IP addr del dev dummy1 172.16.104.1/24 metric 257" - rc=$? - if [ $rc -eq 0 ]; then - check_route "172.16.104.0/24 dev dummy2 proto kernel scope link src 172.16.104.2 metric 258" - rc=$? - fi - log_test $rc 0 "Delete of address on first device" - - run_cmd "$IP addr change dev dummy2 172.16.104.2/24 metric 259" - rc=$? - if [ $rc -eq 0 ]; then - check_route "172.16.104.0/24 dev dummy2 proto kernel scope link src 172.16.104.2 metric 259" - rc=$? - fi - log_test $rc 0 "Modify metric of address" - - # verify prefix route removed on down - run_cmd "$IP li set dev dummy2 down" - rc=$? - if [ $rc -eq 0 ]; then - out=$($IP ro ls match 172.16.104.0/24) - check_expected "${out}" "" - rc=$? - fi - log_test $rc 0 "Prefix route removed on link down" - - # verify prefix route re-inserted with assigned metric - run_cmd "$IP li set dev dummy2 up" - rc=$? - if [ $rc -eq 0 ]; then - check_route "172.16.104.0/24 dev dummy2 proto kernel scope link src 172.16.104.2 metric 259" - rc=$? - fi - log_test $rc 0 "Prefix route with metric on link up" - - # explicitly check for metric changes on edge scenarios - run_cmd "$IP addr flush dev dummy2" - run_cmd "$IP addr add dev dummy2 172.16.104.0/24 metric 259" - run_cmd "$IP addr change dev dummy2 172.16.104.0/24 metric 260" - rc=$? - if [ $rc -eq 0 ]; then - check_route "172.16.104.0/24 dev dummy2 proto kernel scope link src 172.16.104.0 metric 260" - rc=$? - fi - log_test $rc 0 "Modify metric of .0/24 address" - - run_cmd "$IP addr flush dev dummy2" - run_cmd "$IP addr add dev dummy2 172.16.104.1/32 peer 172.16.104.2 metric 260" - rc=$? - if [ $rc -eq 0 ]; then - check_route "172.16.104.2 dev dummy2 proto kernel scope link src 172.16.104.1 metric 260" - rc=$? - fi - log_test $rc 0 "Set metric of address with peer route" - - run_cmd "$IP addr change dev dummy2 172.16.104.1/32 peer 172.16.104.3 metric 261" - rc=$? - if [ $rc -eq 0 ]; then - check_route "172.16.104.3 dev dummy2 proto kernel scope link src 172.16.104.1 metric 261" - rc=$? - fi - log_test $rc 0 "Modify metric and peer address for peer route" - - $IP li del dummy1 - $IP li del dummy2 - cleanup -} - -ipv4_route_metrics_test() -{ - local rc - - echo - echo "IPv4 route add / append tests" - - route_setup - - run_cmd "$IP ro add 172.16.111.0/24 via 172.16.101.2 mtu 1400" - rc=$? - if [ $rc -eq 0 ]; then - check_route "172.16.111.0/24 via 172.16.101.2 dev veth1 mtu 1400" - rc=$? - fi - log_test $rc 0 "Single path route with mtu metric" - - - run_cmd "$IP ro add 172.16.112.0/24 mtu 1400 nexthop via 172.16.101.2 nexthop via 172.16.103.2" - rc=$? - if [ $rc -eq 0 ]; then - check_route "172.16.112.0/24 mtu 1400 nexthop via 172.16.101.2 dev veth1 weight 1 nexthop via 172.16.103.2 dev veth3 weight 1" - rc=$? - fi - log_test $rc 0 "Multipath route with mtu metric" - - $IP ro add 172.16.104.0/24 via 172.16.101.2 mtu 1300 - run_cmd "ip netns exec ns1 ping -w1 -c1 -s 1500 172.16.104.1" - log_test $? 0 "Using route with mtu metric" - - run_cmd "$IP ro add 172.16.111.0/24 via 172.16.101.2 congctl lock foo" - log_test $? 2 "Invalid metric (fails metric_convert)" - - route_cleanup -} - -ipv4_route_v6_gw_test() -{ - local rc - - echo - echo "IPv4 route with IPv6 gateway tests" - - route_setup - sleep 2 - - # - # single path route - # - run_cmd "$IP ro add 172.16.104.0/24 via inet6 2001:db8:101::2" - rc=$? - log_test $rc 0 "Single path route with IPv6 gateway" - if [ $rc -eq 0 ]; then - check_route "172.16.104.0/24 via inet6 2001:db8:101::2 dev veth1" - fi - - run_cmd "ip netns exec ns1 ping -w1 -c1 172.16.104.1" - log_test $rc 0 "Single path route with IPv6 gateway - ping" - - run_cmd "$IP ro del 172.16.104.0/24 via inet6 2001:db8:101::2" - rc=$? - log_test $rc 0 "Single path route delete" - if [ $rc -eq 0 ]; then - check_route "172.16.112.0/24" - fi - - # - # multipath - v6 then v4 - # - run_cmd "$IP ro add 172.16.104.0/24 nexthop via inet6 2001:db8:101::2 dev veth1 nexthop via 172.16.103.2 dev veth3" - rc=$? - log_test $rc 0 "Multipath route add - v6 nexthop then v4" - if [ $rc -eq 0 ]; then - check_route "172.16.104.0/24 nexthop via inet6 2001:db8:101::2 dev veth1 weight 1 nexthop via 172.16.103.2 dev veth3 weight 1" - fi - - run_cmd "$IP ro del 172.16.104.0/24 nexthop via 172.16.103.2 dev veth3 nexthop via inet6 2001:db8:101::2 dev veth1" - log_test $? 2 " Multipath route delete - nexthops in wrong order" - - run_cmd "$IP ro del 172.16.104.0/24 nexthop via inet6 2001:db8:101::2 dev veth1 nexthop via 172.16.103.2 dev veth3" - log_test $? 0 " Multipath route delete exact match" - - # - # multipath - v4 then v6 - # - run_cmd "$IP ro add 172.16.104.0/24 nexthop via 172.16.103.2 dev veth3 nexthop via inet6 2001:db8:101::2 dev veth1" - rc=$? - log_test $rc 0 "Multipath route add - v4 nexthop then v6" - if [ $rc -eq 0 ]; then - check_route "172.16.104.0/24 nexthop via 172.16.103.2 dev veth3 weight 1 nexthop via inet6 2001:db8:101::2 dev veth1 weight 1" - fi - - run_cmd "$IP ro del 172.16.104.0/24 nexthop via inet6 2001:db8:101::2 dev veth1 nexthop via 172.16.103.2 dev veth3" - log_test $? 2 " Multipath route delete - nexthops in wrong order" - - run_cmd "$IP ro del 172.16.104.0/24 nexthop via 172.16.103.2 dev veth3 nexthop via inet6 2001:db8:101::2 dev veth1" - log_test $? 0 " Multipath route delete exact match" - - route_cleanup -} - -################################################################################ -# usage - -usage() -{ - cat <<EOF -usage: ${0##*/} OPTS - - -t <test> Test(s) to run (default: all) - (options: $TESTS) - -p Pause on fail - -P Pause after each test before cleanup - -v verbose mode (show commands and output) -EOF -} - -################################################################################ -# main - -while getopts :t:pPhv o -do - case $o in - t) TESTS=$OPTARG;; - p) PAUSE_ON_FAIL=yes;; - P) PAUSE=yes;; - v) VERBOSE=$(($VERBOSE + 1));; - h) usage; exit 0;; - *) usage; exit 1;; - esac -done - -PEER_CMD="ip netns exec ${PEER_NS}" - -# make sure we don't pause twice -[ "${PAUSE}" = "yes" ] && PAUSE_ON_FAIL=no - -if [ "$(id -u)" -ne 0 ];then - echo "SKIP: Need root privileges" - exit $ksft_skip; -fi - -if [ ! -x "$(command -v ip)" ]; then - echo "SKIP: Could not run test without ip tool" - exit $ksft_skip -fi - -ip route help 2>&1 | grep -q fibmatch -if [ $? -ne 0 ]; then - echo "SKIP: iproute2 too old, missing fibmatch" - exit $ksft_skip -fi - -# start clean -cleanup &> /dev/null - -for t in $TESTS -do - case $t in - fib_unreg_test|unregister) fib_unreg_test;; - fib_down_test|down) fib_down_test;; - fib_carrier_test|carrier) fib_carrier_test;; - fib_rp_filter_test|rp_filter) fib_rp_filter_test;; - fib_nexthop_test|nexthop) fib_nexthop_test;; - fib_suppress_test|suppress) fib_suppress_test;; - ipv6_route_test|ipv6_rt) ipv6_route_test;; - ipv4_route_test|ipv4_rt) ipv4_route_test;; - ipv6_addr_metric) ipv6_addr_metric_test;; - ipv4_addr_metric) ipv4_addr_metric_test;; - ipv6_route_metrics) ipv6_route_metrics_test;; - ipv4_route_metrics) ipv4_route_metrics_test;; - ipv4_route_v6_gw) ipv4_route_v6_gw_test;; - - help) echo "Test names: $TESTS"; exit 0;; - esac -done - -if [ "$TESTS" != "none" ]; then - printf "\nTests passed: %3d\n" ${nsuccess} - printf "Tests failed: %3d\n" ${nfail} -fi - -exit $ret

From: Zhang Changzhong zhangchangzhong@huawei.com

[ Upstream commit 063a932b64db3317ec020c94466fe52923a15f60 ]

The greth_init_rings() function won't free the newly allocated skb when dma_mapping_error() returns error, so add dev_kfree_skb() to fix it.

Compile tested only.

Fixes: d4c41139df6e ("net: Add Aeroflex Gaisler 10/100/1G Ethernet MAC driver") Signed-off-by: Zhang Changzhong zhangchangzhong@huawei.com Reviewed-by: Leon Romanovsky leonro@nvidia.com Link: https://lore.kernel.org/r/1670134149-29516-1-git-send-email-zhangchangzhong@... Signed-off-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/aeroflex/greth.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c index 907904c0a288..19e2b838750c 100644 --- a/drivers/net/ethernet/aeroflex/greth.c +++ b/drivers/net/ethernet/aeroflex/greth.c @@ -258,6 +258,7 @@ static int greth_init_rings(struct greth_private *greth) if (dma_mapping_error(greth->dev, dma_addr)) { if (netif_msg_ifup(greth)) dev_err(greth->dev, "Could not create initial DMA mapping\n"); + dev_kfree_skb(skb); goto cleanup; } greth->rx_skbuff[i] = skb;

From: Yang Yingliang yangyingliang@huawei.com

[ Upstream commit 7d8c19bfc8ff3f78e5337107ca9246327fcb6b45 ]

It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb/dev_kfree_skb() with dev_kfree_skb_irq() and dev_consume_skb_irq() under spin_lock_irq().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Reviewed-by: Jiri Pirko jiri@nvidia.com Link: https://lore.kernel.org/r/20221207015310.2984909-1-yangyingliang@huawei.com Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/plip/plip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/plip/plip.c b/drivers/net/plip/plip.c index e8b7d596d749..4b50c28f01a7 100644 --- a/drivers/net/plip/plip.c +++ b/drivers/net/plip/plip.c @@ -444,12 +444,12 @@ plip_bh_timeout_error(struct net_device *dev, struct net_local *nl, } rcv->state = PLIP_PK_DONE; if (rcv->skb) { - kfree_skb(rcv->skb); + dev_kfree_skb_irq(rcv->skb); rcv->skb = NULL; } snd->state = PLIP_PK_DONE; if (snd->skb) { - dev_kfree_skb(snd->skb); + dev_consume_skb_irq(snd->skb); snd->skb = NULL; } spin_unlock_irq(&nl->lock);

From: Dan Carpenter error27@gmail.com

[ Upstream commit cdd97383e19d4afe29adc3376025a15ae3bab3a3 ]

In an earlier commit, I added a bounds check to prevent an out of bounds read and a WARN(). On further discussion and consideration that check was probably too aggressive. Instead of returning -EINVAL, a better fix would be to just prevent the out of bounds read but continue the process.

Background: The value of "pp->rxq_def" is a number between 0-7 by default, or even higher depending on the value of "rxq_number", which is a module parameter. If the value is more than the number of available CPUs then it will trigger the WARN() in cpu_max_bits_warn().

Fixes: e8b4fc13900b ("net: mvneta: Prevent out of bounds read in mvneta_config_rss()") Signed-off-by: Dan Carpenter error27@gmail.com Reviewed-by: Leon Romanovsky leonro@nvidia.com Link: https://lore.kernel.org/r/Y5A7d1E5ccwHTYPf@kadam Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/marvell/mvneta.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c index 67ba697518d6..2c1ee3268498 100644 --- a/drivers/net/ethernet/marvell/mvneta.c +++ b/drivers/net/ethernet/marvell/mvneta.c @@ -3717,7 +3717,7 @@ static void mvneta_percpu_elect(struct mvneta_port *pp) /* Use the cpu associated to the rxq when it is online, in all * the other cases, use the cpu 0 which can't be offline. */ - if (cpu_online(pp->rxq_def)) + if (pp->rxq_def < nr_cpu_ids && cpu_online(pp->rxq_def)) elected_cpu = pp->rxq_def;

max_cpu = num_present_cpus(); @@ -4235,9 +4235,6 @@ static int mvneta_config_rss(struct mvneta_port *pp) napi_disable(&pp->napi); }

- if (pp->indir[0] >= nr_cpu_ids) - return -EINVAL; - pp->rxq_def = pp->indir[0];

/* Update unicast mapping */