Skip to content

Commit 9cb9c07

Browse files
torvaldstorvalds
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller: 1) Fix TTL offset calculation in mac80211 mesh code, from Peter Oh. 2) Fix races with procfs in ipt_CLUSTERIP, from Cong Wang. 3) Memory leak fix in lpm_trie BPF map code, from Yonghong Song. 4) Need to use GFP_ATOMIC in BPF cpumap allocations, from Jason Wang. 5) Fix potential deadlocks in netfilter getsockopt() code paths, from Paolo Abeni. 6) Netfilter stackpointer size checks really are needed to validate user input, from Florian Westphal. 7) Missing timer init in x_tables, from Paolo Abeni. 8) Don't use WQ_MEM_RECLAIM in mac80211 hwsim, from Johannes Berg. 9) When an ibmvnic device is brought down then back up again, it can be sent queue entries from a previous session, handle this properly instead of crashing. From Thomas Falcon. 10) Fix TCP checksum on LRO buffers in mlx5e, from Gal Pressman. 11) When we are dumping filters in cls_api, the output SKB is empty, and the filter we are dumping is too large for the space in the SKB, we should return -EMSGSIZE like other netlink dump operations do. Otherwise userland has no signal that is needs to increase the size of its read buffer. From Roman Kapl. 12) Several XDP fixes for virtio_net, from Jesper Dangaard Brouer. 13) Module refcount leak in netlink when a dump start fails, from Jason Donenfeld. 14) Handle sub-optimal GSO sizes better in TCP BBR congestion control, from Eric Dumazet. 15) Releasing bpf per-cpu arraymaps can take a long time, add a condtional scheduling point. From Eric Dumazet. 16) Implement retpolines for tail calls in x64 and arm64 bpf JITs. From Daniel Borkmann. 17) Fix page leak in gianfar driver, from Andy Spencer. 18) Missed clearing of estimator scratch buffer, from Eric Dumazet. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (76 commits) net_sched: gen_estimator: fix broken estimators based on percpu stats gianfar: simplify FCS handling and fix memory leak ipv6 sit: work around bogus gcc-8 -Wrestrict warning macvlan: fix use-after-free in macvlan_common_newlink() bpf, arm64: fix out of bounds access in tail call bpf, x64: implement retpoline for tail call rxrpc: Fix send in rxrpc_send_data_packet() net: aquantia: Fix error handling in aq_pci_probe() bpf: fix rcu lockdep warning for lpm_trie map_free callback bpf: add schedule points in percpu arrays management regulatory: add NUL to request alpha2 ibmvnic: Fix early release of login buffer net/smc9194: Remove bogus CONFIG_MAC reference net: ipv4: Set addr_type in hash_keys for forwarded case tcp_bbr: better deal with suboptimal GSO smsc75xx: fix smsc75xx_set_features() netlink: put module reference if dump start fails selftests/bpf/test_maps: exit child process without error in ENOMEM case selftests/bpf: update gitignore with test_libbpf_open selftests/bpf: tcpbpf_kern: use in6_* macros from glibc ..
2 parents 2eb02aa + a5f7add commit 9cb9c07

File tree

108 files changed

+625
-455
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

108 files changed

+625
-455
lines changed

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,3 +127,7 @@ all.config
127127

128128
# Kdevelop4
129129
*.kdev4
130+
131+
#Automatically generated by ASN.1 compiler
132+
net/ipv4/netfilter/nf_nat_snmp_basic-asn1.c
133+
net/ipv4/netfilter/nf_nat_snmp_basic-asn1.h

‎arch/arm64/net/bpf_jit_comp.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -250,16 +250,17 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx)
250250
off = offsetof(struct bpf_array, map.max_entries);
251251
emit_a64_mov_i64(tmp, off, ctx);
252252
emit(A64_LDR32(tmp, r2, tmp), ctx);
253+
emit(A64_MOV(0, r3, r3), ctx);
253254
emit(A64_CMP(0, r3, tmp), ctx);
254-
emit(A64_B_(A64_COND_GE, jmp_offset), ctx);
255+
emit(A64_B_(A64_COND_CS, jmp_offset), ctx);
255256

256257
/* if (tail_call_cnt > MAX_TAIL_CALL_CNT)
257258
* goto out;
258259
* tail_call_cnt++;
259260
*/
260261
emit_a64_mov_i64(tmp, MAX_TAIL_CALL_CNT, ctx);
261262
emit(A64_CMP(1, tcc, tmp), ctx);
262-
emit(A64_B_(A64_COND_GT, jmp_offset), ctx);
263+
emit(A64_B_(A64_COND_HI, jmp_offset), ctx);
263264
emit(A64_ADD_I(1, tcc, tcc, 1), ctx);
264265

265266
/* prog = array->ptrs[index];

‎arch/x86/include/asm/nospec-branch.h

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,4 +177,41 @@ static inline void indirect_branch_prediction_barrier(void)
177177
}
178178

179179
#endif /* __ASSEMBLY__ */
180+
181+
/*
182+
* Below is used in the eBPF JIT compiler and emits the byte sequence
183+
* for the following assembly:
184+
*
185+
* With retpolines configured:
186+
*
187+
* callq do_rop
188+
* spec_trap:
189+
* pause
190+
* lfence
191+
* jmp spec_trap
192+
* do_rop:
193+
* mov %rax,(%rsp)
194+
* retq
195+
*
196+
* Without retpolines configured:
197+
*
198+
* jmp *%rax
199+
*/
200+
#ifdef CONFIG_RETPOLINE
201+
# define RETPOLINE_RAX_BPF_JIT_SIZE 17
202+
# define RETPOLINE_RAX_BPF_JIT() \
203+
EMIT1_off32(0xE8, 7); /* callq do_rop */ \
204+
/* spec_trap: */ \
205+
EMIT2(0xF3, 0x90); /* pause */ \
206+
EMIT3(0x0F, 0xAE, 0xE8); /* lfence */ \
207+
EMIT2(0xEB, 0xF9); /* jmp spec_trap */ \
208+
/* do_rop: */ \
209+
EMIT4(0x48, 0x89, 0x04, 0x24); /* mov %rax,(%rsp) */ \
210+
EMIT1(0xC3); /* retq */
211+
#else
212+
# define RETPOLINE_RAX_BPF_JIT_SIZE 2
213+
# define RETPOLINE_RAX_BPF_JIT() \
214+
EMIT2(0xFF, 0xE0); /* jmp *%rax */
215+
#endif
216+
180217
#endif /* _ASM_X86_NOSPEC_BRANCH_H_ */

‎arch/x86/net/bpf_jit_comp.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
#include <linux/if_vlan.h>
1414
#include <asm/cacheflush.h>
1515
#include <asm/set_memory.h>
16+
#include <asm/nospec-branch.h>
1617
#include <linux/bpf.h>
1718

1819
/*
@@ -290,7 +291,7 @@ static void emit_bpf_tail_call(u8 **pprog)
290291
EMIT2(0x89, 0xD2); /* mov edx, edx */
291292
EMIT3(0x39, 0x56, /* cmp dword ptr [rsi + 16], edx */
292293
offsetof(struct bpf_array, map.max_entries));
293-
#define OFFSET1 43 /* number of bytes to jump */
294+
#define OFFSET1 (41 + RETPOLINE_RAX_BPF_JIT_SIZE) /* number of bytes to jump */
294295
EMIT2(X86_JBE, OFFSET1); /* jbe out */
295296
label1 = cnt;
296297

@@ -299,7 +300,7 @@ static void emit_bpf_tail_call(u8 **pprog)
299300
*/
300301
EMIT2_off32(0x8B, 0x85, 36); /* mov eax, dword ptr [rbp + 36] */
301302
EMIT3(0x83, 0xF8, MAX_TAIL_CALL_CNT); /* cmp eax, MAX_TAIL_CALL_CNT */
302-
#define OFFSET2 32
303+
#define OFFSET2 (30 + RETPOLINE_RAX_BPF_JIT_SIZE)
303304
EMIT2(X86_JA, OFFSET2); /* ja out */
304305
label2 = cnt;
305306
EMIT3(0x83, 0xC0, 0x01); /* add eax, 1 */
@@ -313,7 +314,7 @@ static void emit_bpf_tail_call(u8 **pprog)
313314
* goto out;
314315
*/
315316
EMIT3(0x48, 0x85, 0xC0); /* test rax,rax */
316-
#define OFFSET3 10
317+
#define OFFSET3 (8 + RETPOLINE_RAX_BPF_JIT_SIZE)
317318
EMIT2(X86_JE, OFFSET3); /* je out */
318319
label3 = cnt;
319320

@@ -326,7 +327,7 @@ static void emit_bpf_tail_call(u8 **pprog)
326327
* rdi == ctx (1st arg)
327328
* rax == prog->bpf_func + prologue_size
328329
*/
329-
EMIT2(0xFF, 0xE0); /* jmp rax */
330+
RETPOLINE_RAX_BPF_JIT();
330331

331332
/* out: */
332333
BUILD_BUG_ON(cnt - label1 != OFFSET1);

‎drivers/net/ethernet/amd/xgbe/xgbe-pci.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -426,6 +426,8 @@ static int xgbe_pci_resume(struct pci_dev *pdev)
426426
struct net_device *netdev = pdata->netdev;
427427
int ret = 0;
428428

429+
XP_IOWRITE(pdata, XP_INT_EN, 0x1fffff);
430+
429431
pdata->lpm_ctrl &= ~MDIO_CTRL1_LPOWER;
430432
XMDIO_WRITE(pdata, MDIO_MMD_PCS, MDIO_CTRL1, pdata->lpm_ctrl);
431433

‎drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -226,6 +226,10 @@ static int aq_pci_probe(struct pci_dev *pdev,
226226
goto err_ioremap;
227227

228228
self->aq_hw = kzalloc(sizeof(*self->aq_hw), GFP_KERNEL);
229+
if (!self->aq_hw) {
230+
err = -ENOMEM;
231+
goto err_ioremap;
232+
}
229233
self->aq_hw->aq_nic_cfg = aq_nic_get_cfg(self);
230234

231235
for (bar = 0; bar < 4; ++bar) {
@@ -235,27 +239,27 @@ static int aq_pci_probe(struct pci_dev *pdev,
235239
mmio_pa = pci_resource_start(pdev, bar);
236240
if (mmio_pa == 0U) {
237241
err = -EIO;
238-
goto err_ioremap;
242+
goto err_free_aq_hw;
239243
}
240244

241245
reg_sz = pci_resource_len(pdev, bar);
242246
if ((reg_sz <= 24 /*ATL_REGS_SIZE*/)) {
243247
err = -EIO;
244-
goto err_ioremap;
248+
goto err_free_aq_hw;
245249
}
246250

247251
self->aq_hw->mmio = ioremap_nocache(mmio_pa, reg_sz);
248252
if (!self->aq_hw->mmio) {
249253
err = -EIO;
250-
goto err_ioremap;
254+
goto err_free_aq_hw;
251255
}
252256
break;
253257
}
254258
}
255259

256260
if (bar == 4) {
257261
err = -EIO;
258-
goto err_ioremap;
262+
goto err_free_aq_hw;
259263
}
260264

261265
numvecs = min((u8)AQ_CFG_VECS_DEF,
@@ -290,6 +294,8 @@ static int aq_pci_probe(struct pci_dev *pdev,
290294
aq_pci_free_irq_vectors(self);
291295
err_hwinit:
292296
iounmap(self->aq_hw->mmio);
297+
err_free_aq_hw:
298+
kfree(self->aq_hw);
293299
err_ioremap:
294300
free_netdev(ndev);
295301
err_pci_func:

‎drivers/net/ethernet/freescale/gianfar.c

Lines changed: 7 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2934,29 +2934,17 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
29342934
{
29352935
int size = lstatus & BD_LENGTH_MASK;
29362936
struct page *page = rxb->page;
2937-
bool last = !!(lstatus & BD_LFLAG(RXBD_LAST));
2938-
2939-
/* Remove the FCS from the packet length */
2940-
if (last)
2941-
size -= ETH_FCS_LEN;
29422937

29432938
if (likely(first)) {
29442939
skb_put(skb, size);
29452940
} else {
29462941
/* the last fragments' length contains the full frame length */
2947-
if (last)
2942+
if (lstatus & BD_LFLAG(RXBD_LAST))
29482943
size -= skb->len;
29492944

2950-
/* Add the last fragment if it contains something other than
2951-
* the FCS, otherwise drop it and trim off any part of the FCS
2952-
* that was already received.
2953-
*/
2954-
if (size > 0)
2955-
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
2956-
rxb->page_offset + RXBUF_ALIGNMENT,
2957-
size, GFAR_RXB_TRUESIZE);
2958-
else if (size < 0)
2959-
pskb_trim(skb, skb->len + size);
2945+
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
2946+
rxb->page_offset + RXBUF_ALIGNMENT,
2947+
size, GFAR_RXB_TRUESIZE);
29602948
}
29612949

29622950
/* try reuse page */
@@ -3069,6 +3057,9 @@ static void gfar_process_frame(struct net_device *ndev, struct sk_buff *skb)
30693057
if (priv->padding)
30703058
skb_pull(skb, priv->padding);
30713059

3060+
/* Trim off the FCS */
3061+
pskb_trim(skb, skb->len - ETH_FCS_LEN);
3062+
30723063
if (ndev->features & NETIF_F_RXCSUM)
30733064
gfar_rx_checksum(skb, fcb);
30743065

‎drivers/net/ethernet/ibm/ibmvnic.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1901,6 +1901,11 @@ static int ibmvnic_poll(struct napi_struct *napi, int budget)
19011901
dev_kfree_skb_any(rx_buff->skb);
19021902
remove_buff_from_pool(adapter, rx_buff);
19031903
continue;
1904+
} else if (!rx_buff->skb) {
1905+
/* free the entry */
1906+
next->rx_comp.first = 0;
1907+
remove_buff_from_pool(adapter, rx_buff);
1908+
continue;
19041909
}
19051910

19061911
length = be32_to_cpu(next->rx_comp.len);
@@ -3755,7 +3760,6 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq,
37553760

37563761
dma_unmap_single(dev, adapter->login_buf_token, adapter->login_buf_sz,
37573762
DMA_BIDIRECTIONAL);
3758-
release_login_buffer(adapter);
37593763
dma_unmap_single(dev, adapter->login_rsp_buf_token,
37603764
adapter->login_rsp_buf_sz, DMA_BIDIRECTIONAL);
37613765

@@ -3786,6 +3790,7 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq,
37863790
ibmvnic_remove(adapter->vdev);
37873791
return -EIO;
37883792
}
3793+
release_login_buffer(adapter);
37893794
complete(&adapter->init_done);
37903795

37913796
return 0;

‎drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -96,10 +96,10 @@ static void print_lyr_2_4_hdrs(struct trace_seq *p,
9696
"%pI4");
9797
} else if (ethertype.v == ETH_P_IPV6) {
9898
static const struct in6_addr full_ones = {
99-
.in6_u.u6_addr32 = {htonl(0xffffffff),
100-
htonl(0xffffffff),
101-
htonl(0xffffffff),
102-
htonl(0xffffffff)},
99+
.in6_u.u6_addr32 = {__constant_htonl(0xffffffff),
100+
__constant_htonl(0xffffffff),
101+
__constant_htonl(0xffffffff),
102+
__constant_htonl(0xffffffff)},
103103
};
104104
DECLARE_MASK_VAL(struct in6_addr, src_ipv6);
105105
DECLARE_MASK_VAL(struct in6_addr, dst_ipv6);

‎drivers/net/ethernet/mellanox/mlx5/core/en_main.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1768,13 +1768,16 @@ static void mlx5e_build_rq_param(struct mlx5e_priv *priv,
17681768
param->wq.linear = 1;
17691769
}
17701770

1771-
static void mlx5e_build_drop_rq_param(struct mlx5e_rq_param *param)
1771+
static void mlx5e_build_drop_rq_param(struct mlx5_core_dev *mdev,
1772+
struct mlx5e_rq_param *param)
17721773
{
17731774
void *rqc = param->rqc;
17741775
void *wq = MLX5_ADDR_OF(rqc, rqc, wq);
17751776

17761777
MLX5_SET(wq, wq, wq_type, MLX5_WQ_TYPE_LINKED_LIST);
17771778
MLX5_SET(wq, wq, log_wq_stride, ilog2(sizeof(struct mlx5e_rx_wqe)));
1779+
1780+
param->wq.buf_numa_node = dev_to_node(&mdev->pdev->dev);
17781781
}
17791782

17801783
static void mlx5e_build_sq_param_common(struct mlx5e_priv *priv,
@@ -2634,6 +2637,9 @@ static int mlx5e_alloc_drop_cq(struct mlx5_core_dev *mdev,
26342637
struct mlx5e_cq *cq,
26352638
struct mlx5e_cq_param *param)
26362639
{
2640+
param->wq.buf_numa_node = dev_to_node(&mdev->pdev->dev);
2641+
param->wq.db_numa_node = dev_to_node(&mdev->pdev->dev);
2642+
26372643
return mlx5e_alloc_cq_common(mdev, param, cq);
26382644
}
26392645

@@ -2645,7 +2651,7 @@ static int mlx5e_open_drop_rq(struct mlx5_core_dev *mdev,
26452651
struct mlx5e_cq *cq = &drop_rq->cq;
26462652
int err;
26472653

2648-
mlx5e_build_drop_rq_param(&rq_param);
2654+
mlx5e_build_drop_rq_param(mdev, &rq_param);
26492655

26502656
err = mlx5e_alloc_drop_cq(mdev, cq, &cq_param);
26512657
if (err)
@@ -2994,8 +3000,8 @@ static int mlx5e_setup_tc_block(struct net_device *dev,
29943000
}
29953001
#endif
29963002

2997-
int mlx5e_setup_tc(struct net_device *dev, enum tc_setup_type type,
2998-
void *type_data)
3003+
static int mlx5e_setup_tc(struct net_device *dev, enum tc_setup_type type,
3004+
void *type_data)
29993005
{
30003006
switch (type) {
30013007
#ifdef CONFIG_MLX5_ESWITCH

‎drivers/net/ethernet/mellanox/mlx5/core/en_rx.c

Lines changed: 35 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
#include <linux/tcp.h>
3737
#include <linux/bpf_trace.h>
3838
#include <net/busy_poll.h>
39+
#include <net/ip6_checksum.h>
3940
#include "en.h"
4041
#include "en_tc.h"
4142
#include "eswitch.h"
@@ -546,20 +547,33 @@ bool mlx5e_post_rx_mpwqes(struct mlx5e_rq *rq)
546547
return true;
547548
}
548549

550+
static void mlx5e_lro_update_tcp_hdr(struct mlx5_cqe64 *cqe, struct tcphdr *tcp)
551+
{
552+
u8 l4_hdr_type = get_cqe_l4_hdr_type(cqe);
553+
u8 tcp_ack = (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_NO_DATA) ||
554+
(l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_AND_DATA);
555+
556+
tcp->check = 0;
557+
tcp->psh = get_cqe_lro_tcppsh(cqe);
558+
559+
if (tcp_ack) {
560+
tcp->ack = 1;
561+
tcp->ack_seq = cqe->lro_ack_seq_num;
562+
tcp->window = cqe->lro_tcp_win;
563+
}
564+
}
565+
549566
static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe,
550567
u32 cqe_bcnt)
551568
{
552569
struct ethhdr *eth = (struct ethhdr *)(skb->data);
553570
struct tcphdr *tcp;
554571
int network_depth = 0;
572+
__wsum check;
555573
__be16 proto;
556574
u16 tot_len;
557575
void *ip_p;
558576

559-
u8 l4_hdr_type = get_cqe_l4_hdr_type(cqe);
560-
u8 tcp_ack = (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_NO_DATA) ||
561-
(l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_AND_DATA);
562-
563577
proto = __vlan_get_protocol(skb, eth->h_proto, &network_depth);
564578

565579
tot_len = cqe_bcnt - network_depth;
@@ -576,23 +590,30 @@ static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe,
576590
ipv4->check = 0;
577591
ipv4->check = ip_fast_csum((unsigned char *)ipv4,
578592
ipv4->ihl);
593+
594+
mlx5e_lro_update_tcp_hdr(cqe, tcp);
595+
check = csum_partial(tcp, tcp->doff * 4,
596+
csum_unfold((__force __sum16)cqe->check_sum));
597+
/* Almost done, don't forget the pseudo header */
598+
tcp->check = csum_tcpudp_magic(ipv4->saddr, ipv4->daddr,
599+
tot_len - sizeof(struct iphdr),
600+
IPPROTO_TCP, check);
579601
} else {
602+
u16 payload_len = tot_len - sizeof(struct ipv6hdr);
580603
struct ipv6hdr *ipv6 = ip_p;
581604

582605
tcp = ip_p + sizeof(struct ipv6hdr);
583606
skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
584607

585608
ipv6->hop_limit = cqe->lro_min_ttl;
586-
ipv6->payload_len = cpu_to_be16(tot_len -
587-
sizeof(struct ipv6hdr));
588-
}
589-
590-
tcp->psh = get_cqe_lro_tcppsh(cqe);
591-
592-
if (tcp_ack) {
593-
tcp->ack = 1;
594-
tcp->ack_seq = cqe->lro_ack_seq_num;
595-
tcp->window = cqe->lro_tcp_win;
609+
ipv6->payload_len = cpu_to_be16(payload_len);
610+
611+
mlx5e_lro_update_tcp_hdr(cqe, tcp);
612+
check = csum_partial(tcp, tcp->doff * 4,
613+
csum_unfold((__force __sum16)cqe->check_sum));
614+
/* Almost done, don't forget the pseudo header */
615+
tcp->check = csum_ipv6_magic(&ipv6->saddr, &ipv6->daddr, payload_len,
616+
IPPROTO_TCP, check);
596617
}
597618
}
598619

0 commit comments

Comments
 (0)