summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2021-07-27net: socket: return changed ifreq from SIOCDEVPRIVATEArnd Bergmann2-4/+2
Some drivers that use SIOCDEVPRIVATE ioctl commands modify the ifreq structure and expect it to be passed back to user space, which has never really happened for compat mode because the calling these drivers through ndo_do_ioctl requires overwriting the ifr_data pointer. Now that all drivers are converted to ndo_siocdevprivate, change it to handle this correctly in both compat and native mode. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27net: split out ndo_siowandev ioctlArnd Bergmann28-258/+211
In order to further reduce the scope of ndo_do_ioctl(), move out the SIOCWANDEV handling into a new network device operation function. Adjust the prototype to only pass the if_settings sub-structure in place of the ifreq, and remove the redundant 'cmd' argument in the process. Cc: Krzysztof Halasa <khc@pm.waw.pl> Cc: "Jan \"Yenya\" Kasprzak" <kas@fi.muni.cz> Cc: Kevin Curtis <kevin.curtis@farsite.co.uk> Cc: Zhao Qiang <qiang.zhao@nxp.com> Cc: Martin Schiller <ms@dev.tdt.de> Cc: Jiri Slaby <jirislaby@kernel.org> Cc: linux-x25@vger.kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27dev_ioctl: split out ndo_eth_ioctlArnd Bergmann172-231/+273
Most users of ndo_do_ioctl are ethernet drivers that implement the MII commands SIOCGMIIPHY/SIOCGMIIREG/SIOCSMIIREG, or hardware timestamping with SIOCSHWTSTAMP/SIOCGHWTSTAMP. Separate these from the few drivers that use ndo_do_ioctl to implement SIOCBOND, SIOCBR and SIOCWANDEV commands. This is a purely cosmetic change intended to help readers find their way through the implementation. Cc: Doug Ledford <dledford@redhat.com> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: Jay Vosburgh <j.vosburgh@gmail.com> Cc: Veaceslav Falico <vfalico@gmail.com> Cc: Andy Gospodarek <andy@greyhouse.net> Cc: Andrew Lunn <andrew@lunn.ch> Cc: Vivien Didelot <vivien.didelot@gmail.com> Cc: Florian Fainelli <f.fainelli@gmail.com> Cc: Vladimir Oltean <olteanv@gmail.com> Cc: Leon Romanovsky <leon@kernel.org> Cc: linux-rdma@vger.kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27dev_ioctl: pass SIOCDEVPRIVATE data separatelyArnd Bergmann4-56/+28
The compat handlers for SIOCDEVPRIVATE are incorrect for any driver that passes data as part of struct ifreq rather than as an ifr_data pointer, or that passes data back this way, since the compat_ifr_data_ioctl() helper overwrites the ifr_data pointer and does not copy anything back out. Since all drivers using devprivate commands are now converted to the new .ndo_siocdevprivate callback, fix this by adding the missing piece and passing the pointer separately the whole way. This further unifies the native and compat logic for socket ioctls, as the new code now passes the correct pointer as well as the correct data for both native and compat ioctls. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27wan: cosa: remove dead cosa_net_ioctl() functionArnd Bergmann1-14/+1
The ndo_do_ioctl callback is never called with the COSAIO* commands, so this is never used. Call the hdlc_ioctl function directly instead. Any user space code that relied on this function working as intended has never worked in a mainline kernel since before linux-1.0. Cc: "Jan \"Yenya\" Kasprzak" <kas@fi.muni.cz> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27wan: use ndo_siocdevprivateArnd Bergmann8-56/+117
The wan drivers each support some custom SIOCDEVPRIVATE ioctls, plus the common SIOCWANDEV command. Split these so the ioctl callback only deals with SIOCWANDEV and the rest is handled by ndo_siocdevprivate. It might make sense to also split out SIOCWANDEV into a separate callback in order to eventually remove ndo_do_ioctl entirely. Cc: Krzysztof Halasa <khc@pm.waw.pl> Cc: Kevin Curtis <kevin.curtis@farsite.co.uk> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27ppp: use ndo_siocdevprivateArnd Bergmann1-3/+3
ppp has a custom statistics interface using SIOCDEVPRIVATE ioctl commands that works correctly in compat mode. Convert it to use ndo_siocdevprivate as a cleanup. Cc: Paul Mackerras <paulus@samba.org> Cc: linux-ppp@vger.kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27sb1000: use ndo_siocdevprivateArnd Bergmann1-9/+11
The private sb1000 ioctl commands all work correctly in compat mode. Change the to ndo_siocdevprivate as a cleanup. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27hippi: use ndo_siocdevprivateArnd Bergmann2-6/+8
The rr_ioctl uses private ioctl commands that correctly pass all data through ifr_data, which works fine in compat mode. Change it to use ndo_siocdevprivate as a cleanup. Cc: Jes Sorensen <jes@trained-monkey.org> Cc: linux-hippi@sunsite.dk Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27ip_tunnel: use ndo_siocdevprivateArnd Bergmann9-53/+59
The various ipv4 and ipv6 tunnel drivers each implement a set of 12 SIOCDEVPRIVATE commands for managing tunnels. These all work correctly in compat mode. Move them over to the new .ndo_siocdevprivate operation. Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org> Cc: David Ahern <dsahern@kernel.org> Cc: Steffen Klassert <steffen.klassert@secunet.com> Cc: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27airo: use ndo_siocdevprivateArnd Bergmann1-7/+8
The airo driver overloads SIOCDEVPRIVATE ioctls with another set based on SIOCIWFIRSTPRIV. Only the first ones actually work (also in compat mode) as the others do not get passed down any more. Change it over to ndo_siocdevprivate for clarification. Cc: Kalle Valo <kvalo@codeaurora.org> Cc: linux-wireless@vger.kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27hamradio: use ndo_siocdevprivateArnd Bergmann10-61/+65
hamradio uses a set of private ioctls that do seem to work correctly in compat mode, as they only rely on the ifr_data pointer. Move them over to the ndo_siocdevprivate callback as a cleanup. Cc: Thomas Sailer <t.sailer@alumni.ethz.ch> Cc: Joerg Reuter <jreuter@yaina.de> Cc: Jean-Paul Roubelat <jpr@f6fbb.org> Cc: linux-hams@vger.kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27cxgb3: use ndo_siocdevprivateArnd Bergmann1-4/+8
cxgb3 has a private multiplexor that works correctly in compat mode, split out the siocdevprivate callback from do_ioctl for simplification. Cc: Raju Rangoju <rajur@chelsio.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27qeth: use ndo_siocdevprivateArnd Bergmann4-14/+35
qeth has both standard MII ioctls and custom SIOCDEVPRIVATE ones, all of which work correctly with compat user space. Move the private ones over to the new ndo_siocdevprivate callback. Cc: Julian Wiedmann <jwi@linux.ibm.com> Cc: Karsten Graul <kgraul@linux.ibm.com> Cc: Heiko Carstens <hca@linux.ibm.com> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Christian Borntraeger <borntraeger@de.ibm.com> Cc: linux-s390@vger.kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27slip/plip: use ndo_siocdevprivateArnd Bergmann2-7/+18
slip and plip both use a couple of SIOCDEVPRIVATE ioctl commands that overload the ifreq layout in a way that is incompatible with compat mode. Convert to use ndo_siocdevprivate to allow passing the data this way, but return an error in compat mode anyway because the private structure is still incompatible. This could be fixed as well to make compat work properly. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27net: usb: use ndo_siocdevprivateArnd Bergmann2-4/+6
The pegasus and rtl8150 drivers use SIOCDEVPRIVATE ioctls to access their MII registers, in place of the normal commands. This is broken for all compat ioctls today. Change to ndo_siocdevprivate to fix it. Cc: Petko Manolov <petkan@nucleusys.com> Cc: linux-usb@vger.kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27fddi: use ndo_siocdevprivateArnd Bergmann1-7/+12
The skfddi driver has a private ioctl and passes the data correctly through ifr_data, but the use of a pointer in s_skfp_ioctl is broken in compat mode. Change the driver to use ndo_siocdevprivate and disallow calling it in compat mode until a conversion handler is added. Cc: "Maciej W. Rozycki" <macro@orcam.me.uk> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27eql: use ndo_siocdevprivateArnd Bergmann1-9/+15
The private ioctls in eql pass the arguments correctly through ifr_data, but the slaving_request_t and slave_config_t structures are incompatible with compat mode and need special conversion code in the driver. Convert to siocdevprivate for now, and return an error when called in compat mode. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27tehuti: use ndo_siocdevprivateArnd Bergmann1-13/+5
Tehuti only implements private ioctl commands, and implements them by overriding the ifreq layout, which is broken in compat mode. Move it to the ndo_siocdevprivate callback in order to fix this. Cc: Andy Gospodarek <andy@greyhouse.net> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27hamachi: use ndo_siocdevprivateArnd Bergmann1-25/+38
hamachi has one command that overloads the ifreq argument and requires a conversion to ndo_siocdevprivate in order to make compat mode work, so split it from ndo_ioctl. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27appletalk: use ndo_siocdevprivateArnd Bergmann1-6/+10
appletalk has three SIOCDEVPRIVATE ioctl commands that are broken in compat mode because the passed structure contains a pointer. Change it over to ndo_siocdevprivate for consistency and make it return an error when called in compat mode. This could be fixed if there are still users. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27bonding: use siocdevprivateArnd Bergmann1-6/+24
The bonding driver supports two command codes for each operation: one in the SIOCDEVPRIVATE range and another one with the same definition but a unique command code. Only the second set currently works in compat mode, as the ifr_data expansion overwrites part of the ifr_slave field. Move the private ones into ndo_siocdevprivate and change the implementation to call the other function. This makes both version work correctly. Cc: Jay Vosburgh <j.vosburgh@gmail.com> Cc: Veaceslav Falico <vfalico@gmail.com> Cc: Andy Gospodarek <andy@greyhouse.net> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27tulip: use ndo_siocdevprivateArnd Bergmann1-3/+8
The tulip driver has a debugging method over ioctl built-in, but it does not actually check the command type, which may end up leading to random behavior when trying to run other ioctls on it. Change the driver to use ndo_siocdevprivate and limit the execution further to the first private command code. If anyone still has tools to run these debugging commands, they might have to be patched for it if they pass different ioctl command. The function has existed in this form since the driver was merged in Linux-1.1.86. Cc: linux-parisc@vger.kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27phonet: use siocdevprivateArnd Bergmann2-5/+6
phonet has a single private ioctl that is broken in compat mode on big-endian machines today because the data returned from it is never copied back to user space. Move it over to the ndo_siocdevprivate callback, which also fixes the compat issue. Cc: Remi Denis-Courmont <courmisch@gmail.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Rémi Denis-Courmont <courmisch@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27bridge: use ndo_siocdevprivateArnd Bergmann3-12/+28
The bridge driver has an old set of ioctls using the SIOCDEVPRIVATE namespace that have never worked in compat mode and are explicitly forbidden already. Move them over to ndo_siocdevprivate and fix compat mode for these, because we can. Cc: Roopa Prabhu <roopa@nvidia.com> Cc: Nikolay Aleksandrov <nikolay@nvidia.com> Cc: bridge@lists.linux-foundation.org Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27hostap: use ndo_siocdevprivateArnd Bergmann3-7/+29
hostap has a combination of iwpriv ioctls that do not work at all, and two SIOCDEVPRIVATE commands that work natively but lack a compat conversion handler. For the moment, move them over to the new ndo_siocdevprivate interface and return an error for compat mode. Cc: Jouni Malinen <j@w1.fi> Cc: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27staging: wlan-ng: use siocdevprivateArnd Bergmann1-65/+11
wlan-ng has two private ioctls that correctly work in compat mode. Move these over to the new ndo_siocdevprivate mechanism. The p80211netdev_ethtool() function is commented out and has no use here, so this can be removed Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27staging: rtlwifi: use siocdevprivateArnd Bergmann8-10/+34
rtl8188eu has an "android private" ioctl command multiplexer that is not currently safe for use in compat mode because of its triple-indirect pointer. rtl8723bs uses a different interface on the SIOCDEVPRIVATE command, based on the iwpriv data structure Both also have normal unreachable iwpriv commands, and all of the above should probably just get removed. For the moment, just switch over to the new interface. Cc: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27net: split out SIOCDEVPRIVATE handling from dev_ioctlArnd Bergmann3-3/+32
SIOCDEVPRIVATE ioctl commands are mainly used in really old drivers, and they have a number of problems: - They hide behind the normal .ndo_do_ioctl function that is also used for other things in modern drivers, so it's hard to spot a driver that actually uses one of these - Since drivers use a number different calling conventions, it is impossible to support compat mode for them in a generic way. - With all drivers using the same 16 commands codes, there is no way to introspect the data being passed through things like strace. Add a new net_device_ops callback pointer, to address the first two of these. Separating them from .ndo_do_ioctl makes it easy to grep for drivers with a .ndo_siocdevprivate callback, and the unwieldy name hopefully makes it easier to spot in code review. By passing the ifreq structure and the ifr_data pointer separately, it is no longer necessary to overload these, and the driver can use either one for a given command. Cc: Cong Wang <cong.wang@bytedance.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27Merge branch 'tcp-rack'David S. Miller2-3/+14
Neal Cardwell says: ==================== more accurate DSACK processing for RACK-TLP This patch series includes two minor improvements to tighten up the accuracy of the processing of incoming DSACK information, so that RACK-TLP behavior is faster and more precise: first, to ensure we detect packet loss in some extra corner cases; and second, to avoid growing the RACK reordering window (and delaying fast recovery) in cases where it seems clear we don't need to. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27tcp: more accurately check DSACKs to grow RACK reordering windowNeal Cardwell2-2/+10
Previously, a DSACK could expand the RACK reordering window when no reordering has been seen, and/or when the DSACK was due to an unnecessary TLP retransmit (rather than a spurious fast recovery due to reordering). This could result in unnecessarily growing the RACK reordering window and thus unnecessarily delaying RACK-based fast recovery episodes. To avoid these issues, this commit tightens the conditions under which a DSACK triggers the RACK reordering window to grow, so that a connection only expands its RACK reordering window if: (a) reordering has been seen in the connection (b) a DSACKed range does not match the most recent TLP retransmit Signed-off-by: Neal Cardwell <ncardwell@google.com> Acked-by: Yuchung Cheng <ycheng@google.com> Acked-by: Priyaranjan Jha <priyarjha@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27tcp: more accurately detect spurious TLP probesYuchung Cheng1-1/+4
Previously TLP is considered spurious if the sender receives any DSACK during a TLP episode. This patch further checks the DSACK sequences match the TLP's to improve accuracy. Signed-off-by: Yuchung Cheng <ycheng@google.com> Acked-by: Neal Cardwell <ncardwell@google.com> Acked-by: Priyaranjan Jha <priyarjha@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27qdisc: add new field for qdisc_enqueue tracepointTonghao Zhang1-0/+2
qdisc_enqueue tracepoint can work with qdisc:qdisc_dequeue to measure packets latency in qdisc queues. Add a new field txq for it, then we can retrieve more info. Signed-off-by: Tonghao Zhang <xiangxia.m.yue@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27net: qed: remove unneeded return variablesJason Wang1-4/+2
Some return variables are never changed until function returned. These variables are unneeded for their functions. Therefore, the unneeded return variables can be removed safely by returning their initial values. Signed-off-by: Jason Wang <wangborong@cdjrlc.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27docs: networking: dpaa2: add documentation for the switch driverIoana Ciornei3-0/+176
Add a documentation entry for the DPAA2 switch listing its requirements, features and some examples to go along them. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27Merge branch 'ovs-upcall-issues'David S. Miller3-12/+18
Mark Gray says: ==================== openvswitch: per-cpu upcall patchwork issues Some issues were raised by patchwork at: https://patchwork.kernel.org/project/netdevbpf/patch/20210630095350.817785-1-mark.d.gray@redhat.com/#24285159 ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27openvswitch: fix sparse warning incorrect typeMark Gray1-1/+1
fix incorrect type in argument 1 (different address spaces) ../net/openvswitch/datapath.c:169:17: warning: incorrect type in argument 1 (different address spaces) ../net/openvswitch/datapath.c:169:17: expected void const * ../net/openvswitch/datapath.c:169:17: got struct dp_nlsk_pids [noderef] __rcu *upcall_portids Found at: https://patchwork.kernel.org/project/netdevbpf/patch/20210630095350.817785-1-mark.d.gray@redhat.com/#24285159 Signed-off-by: Mark Gray <mark.d.gray@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27openvswitch: fix alignment issuesMark Gray3-10/+16
Signed-off-by: Mark Gray <mark.d.gray@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27openvswitch: update kdoc OVS_DP_ATTR_PER_CPU_PIDSMark Gray1-1/+1
Signed-off-by: Mark Gray <mark.d.gray@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27net: netlink: add the case when nlh is NULLYajun Deng3-11/+6
Add the case when nlh is NULL in nlmsg_report(), so that the caller doesn't need to deal with this case. Signed-off-by: Yajun Deng <yajun.deng@linux.dev> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27net: build all switchdev drivers as modules when the bridge is a moduleVladimir Oltean2-0/+3
Currently, all drivers depend on the bool CONFIG_NET_SWITCHDEV, but only the drivers that call some sort of function exported by the bridge, like br_vlan_enabled() or whatever, have an extra dependency on CONFIG_BRIDGE. Since the blamed commit, all switchdev drivers have a functional dependency upon switchdev_bridge_port_{,un}offload(), which is a pair of functions exported by the bridge module and not by the bridge-independent part of CONFIG_NET_SWITCHDEV. Problems appear when we have: CONFIG_BRIDGE=m CONFIG_NET_SWITCHDEV=y CONFIG_TI_CPSW_SWITCHDEV=y because cpsw, am65_cpsw and sparx5 will then be built-in but they will call a symbol exported by a loadable module. This is not possible and will result in the following build error: drivers/net/ethernet/ti/cpsw_new.o: in function `cpsw_netdevice_event': drivers/net/ethernet/ti/cpsw_new.c:1520: undefined reference to `switchdev_bridge_port_offload' drivers/net/ethernet/ti/cpsw_new.c:1537: undefined reference to `switchdev_bridge_port_unoffload' As mentioned, the other switchdev drivers don't suffer from this because switchdev_bridge_port_offload() is not the first symbol exported by the bridge that they are calling, so they already needed to deal with this in the same way. Fixes: 2f5dc00f7a3e ("net: bridge: switchdev: let drivers inform which bridge ports are offloaded") Reported-by: Linux Kernel Functional Testing <lkft@linaro.org> Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27ethtool: Fix rxnfc copy to user buffer overflowSaeed Mahameed1-1/+1
In the cited commit, copy_to_user() got called with the wrong pointer, instead of passing the actual buffer ptr to copy from, a pointer to the pointer got passed, which causes a buffer overflow calltrace to pop up when executing "ethtool -x ethX". Fix ethtool_rxnfc_copy_to_user() to use the rxnfc pointer as passed to the function, instead of a pointer to it. This fixes below call trace: [ 15.533533] ------------[ cut here ]------------ [ 15.539007] Buffer overflow detected (8 < 192)! [ 15.544110] WARNING: CPU: 3 PID: 1801 at include/linux/thread_info.h:200 copy_overflow+0x15/0x20 [ 15.549308] Modules linked in: [ 15.551449] CPU: 3 PID: 1801 Comm: ethtool Not tainted 5.14.0-rc2+ #1058 [ 15.553919] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 15.558378] RIP: 0010:copy_overflow+0x15/0x20 [ 15.560648] Code: e9 7c ff ff ff b8 a1 ff ff ff eb c4 66 0f 1f 84 00 00 00 00 00 55 48 89 f2 89 fe 48 c7 c7 88 55 78 8a 48 89 e5 e8 06 5c 1e 00 <0f> 0b 5d c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 55 [ 15.565114] RSP: 0018:ffffad49c0523bd0 EFLAGS: 00010286 [ 15.566231] RAX: 0000000000000000 RBX: 00000000000000c0 RCX: 0000000000000000 [ 15.567616] RDX: 0000000000000001 RSI: ffffffff8a7912e7 RDI: 00000000ffffffff [ 15.569050] RBP: ffffad49c0523bd0 R08: ffffffff8ab2ae28 R09: 00000000ffffdfff [ 15.570534] R10: ffffffff8aa4ae40 R11: ffffffff8aa4ae40 R12: 0000000000000000 [ 15.571899] R13: 00007ffd4cc2a230 R14: ffffad49c0523c00 R15: 0000000000000000 [ 15.573584] FS: 00007f538112f740(0000) GS:ffff96d5bdd80000(0000) knlGS:0000000000000000 [ 15.575639] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 15.577092] CR2: 00007f5381226d40 CR3: 0000000013542000 CR4: 00000000001506e0 [ 15.578929] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 15.580695] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 15.582441] Call Trace: [ 15.582970] ethtool_rxnfc_copy_to_user+0x30/0x46 [ 15.583815] ethtool_get_rxnfc.cold+0x23/0x2b [ 15.584584] dev_ethtool+0x29c/0x25f0 [ 15.585286] ? security_netlbl_sid_to_secattr+0x77/0xd0 [ 15.586728] ? do_set_pte+0xc4/0x110 [ 15.587349] ? _raw_spin_unlock+0x18/0x30 [ 15.588118] ? __might_sleep+0x49/0x80 [ 15.588956] dev_ioctl+0x2c1/0x490 [ 15.589616] sock_ioctl+0x18e/0x330 [ 15.591143] __x64_sys_ioctl+0x41c/0x990 [ 15.591823] ? irqentry_exit_to_user_mode+0x9/0x20 [ 15.592657] ? irqentry_exit+0x33/0x40 [ 15.593308] ? exc_page_fault+0x32f/0x770 [ 15.593877] ? exit_to_user_mode_prepare+0x3c/0x130 [ 15.594775] do_syscall_64+0x35/0x80 [ 15.595397] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 15.596037] RIP: 0033:0x7f5381226d4b [ 15.596492] Code: 0f 1e fa 48 8b 05 3d b1 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 0d b1 0c 00 f7 d8 64 89 01 48 [ 15.598743] RSP: 002b:00007ffd4cc2a1f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 15.599804] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5381226d4b [ 15.600795] RDX: 00007ffd4cc2a350 RSI: 0000000000008946 RDI: 0000000000000003 [ 15.601712] RBP: 00007ffd4cc2a340 R08: 00007ffd4cc2a350 R09: 0000000000000001 [ 15.602751] R10: 00007f538128a990 R11: 0000000000000246 R12: 0000000000000000 [ 15.603882] R13: 00007ffd4cc2a350 R14: 00007ffd4cc2a4b0 R15: 0000000000000000 [ 15.605042] ---[ end trace 325cf185e2795048 ]--- Fixes: dd98d2895de6 ("ethtool: improve compat ioctl handling") Reported-by: Shannon Nelson <snelson@pensando.io> CC: Arnd Bergmann <arnd@arndb.de> CC: Christoph Hellwig <hch@lst.de> Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> Tested-by: Shannon Nelson <snelson@pensando.io> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27Merge branch 'ipa-clock'David S. Miller10-75/+110
Alex Elder says: ==================== net: ipa: defer taking uC proxy clock This series rearranges some of the IPA initialization code. The first patch gets rid of two trivial setup and teardown functions, open-coding them in their callers instead. The second patch has memory regions get configured before endpoints. IPA interrupts do not depend on GSI being initialized. Therefore they can be initialized in the config phase rather than waiting for setup. The third patch moves this initialization earlier; memory regions must already be defined, so it's done after memory config. The microcontroller also has no dependency on GSI, though it does require IPA interrupts to be configured. The fourth patch moves microcontroller initialization so it too happens during the config phase rather than setup. Finally, we currently take a "proxy clock" for the microcontroller during the config phase, dropping it only after we learn the microcontroller is initialized. But microcontroller initialization is started by the modem, so there's no point in taking that clock reference before we know the modem has booted. So the last patch arranges to wait to take the "proxy clock" for the microcontroller until we know the modem is about to boot. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27net: ipa: introduce ipa_uc_clock()Alex Elder4-17/+45
The first time it's booted, the modem loads and starts the IPA-resident microcontroller. Once the microcontroller has completed its initialization, it notifies the AP it's "ready" by sending an INIT_COMPLETED response message. Until it receives that microcontroller message, the AP must ensure the IPA core clock remains operational. Currently, a "proxy" clock reference is taken in ipa_uc_config(), dropping it again once the message is received. However there could be a long delay between when ipa_config() completes and when modem actually starts. And because the microcontroller gets loaded by the modem, there's no need to get the modem "proxy clock" until the first time it starts. Create a new function ipa_uc_clock() which takes the "proxy" clock reference for the microcontroller. Call it when we get remoteproc SSR notification that the modem is about to start. Keep an additional flag to record whether this proxy clock reference needs to be dropped at shutdown time, and issue a warning if we get the microcontroller message either before the clock reference is taken, or after it has already been dropped. Drop the nearby use of "hh" length modifiers, which are no longer encouraged in the kernel. Signed-off-by: Alex Elder <elder@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27net: ipa: set up the microcontroller earlierAlex Elder3-14/+14
Initializing up the IPA-resident microcontroller requires the IPA clock, and sets up two IPA interrupt handlers, but this does not require GSI access. The interrupt handlers also require the clock to be enabled, and require the IPA memory regions to be configured, but neither requires GSI access. As a result, the microcontroller can be initialized during the "config" rather than "setup" phase of IPA initialization. Initialize the microcontroller in ipa_config() rather than ipa_setup(), and rename the called function ipa_uc_config(). Do the inverse in ipa_deconfig() rather than ipa_teardown(), and rename the function for that case ipa_uc_deconfig(). Signed-off-by: Alex Elder <elder@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27net: ipa: set up IPA interrupts earlierAlex Elder3-17/+21
Initialization of the IPA driver has several phases: - "init" phase can be done without any access to IPA hardware - "config" phase requires the IPA hardware to be clocked - "setup" phase requires the GSI layer to be functional Currently, initialization for the IPA interrupt handling code occurs in the setup phase. It requires access to the IPA hardware but does not need GSI, so it can be moved to the config phase instead. Call the interrupt configuration function early in ipa_config() rather than from ipa_setup(). Rename ipa_interrupt_setup() to be ipa_interrupt_config(), and ipa_interrupt_teardown() to be ipa_interupt_deconfig(), so their names properly indicate when they get called. Signed-off-by: Alex Elder <elder@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27net: ipa: configure memory regions earlyAlex Elder1-8/+8
IPA-resident memory is one of the most primitive resources that needs initialization, so call init_mem_config() early in ipa_config(). This is in preparation for initializing the IPA-resident microcontroller earlier. Signed-off-by: Alex Elder <elder@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27net: ipa: kill ipa_modem_setup()Alex Elder5-20/+23
The functions ipa_modem_setup() and ipa_modem_teardown() are trivial wrappers that call ipa_qmi_setup() and ipa_qmi_teardown(). Just call the QMI functions directly, and get rid of the wrappers. Improve the documentation of what setting up QMI does. Signed-off-by: Alex Elder <elder@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27flow_dissector: Fix out-of-bounds warningsGustavo A. R. Silva1-4/+8
Fix the following out-of-bounds warnings: net/core/flow_dissector.c: In function '__skb_flow_dissect': >> net/core/flow_dissector.c:1104:4: warning: 'memcpy' offset [24, 39] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'struct in6_addr' at offset 8 [-Warray-bounds] 1104 | memcpy(&key_addrs->v6addrs, &iph->saddr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1105 | sizeof(key_addrs->v6addrs)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/ipv6.h:5, from net/core/flow_dissector.c:6: include/uapi/linux/ipv6.h:133:18: note: subobject 'saddr' declared here 133 | struct in6_addr saddr; | ^~~~~ >> net/core/flow_dissector.c:1059:4: warning: 'memcpy' offset [16, 19] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'unsigned int' at offset 12 [-Warray-bounds] 1059 | memcpy(&key_addrs->v4addrs, &iph->saddr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1060 | sizeof(key_addrs->v4addrs)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/ip.h:17, from net/core/flow_dissector.c:5: include/uapi/linux/ip.h:103:9: note: subobject 'saddr' declared here 103 | __be32 saddr; | ^~~~~ The problem is that the original code is trying to copy data into a couple of struct members adjacent to each other in a single call to memcpy(). So, the compiler legitimately complains about it. As these are just a couple of members, fix this by copying each one of them in separate calls to memcpy(). This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy(). Link: https://github.com/KSPP/linux/issues/109 Reported-by: kernel test robot <lkp@intel.com> Link: https://lore.kernel.org/lkml/d5ae2e65-1f18-2577-246f-bada7eee6ccd@intel.com/ Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-27ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()Gustavo A. R. Silva1-2/+3
Fix the following out-of-bounds warning: In function 'ip_copy_addrs', inlined from '__ip_queue_xmit' at net/ipv4/ip_output.c:517:2: net/ipv4/ip_output.c:449:2: warning: 'memcpy' offset [40, 43] from the object at 'fl' is out of the bounds of referenced subobject 'saddr' with type 'unsigned int' at offset 36 [-Warray-bounds] 449 | memcpy(&iph->saddr, &fl4->saddr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 450 | sizeof(fl4->saddr) + sizeof(fl4->daddr)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The problem is that the original code is trying to copy data into a couple of struct members adjacent to each other in a single call to memcpy(). This causes a legitimate compiler warning because memcpy() overruns the length of &iph->saddr and &fl4->saddr. As these are just a couple of struct members, fix this by using direct assignments, instead of memcpy(). This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy(). Link: https://github.com/KSPP/linux/issues/109 Reported-by: kernel test robot <lkp@intel.com> Link: https://lore.kernel.org/lkml/d5ae2e65-1f18-2577-246f-bada7eee6ccd@intel.com/ Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.39.0) at 2024-12-23 17:32:33 +0300