Including fixes from BPF and netfilter.
Current release - regressions:
- core: fix undefined behavior in netdev name allocation
- bpf: do not allocate percpu memory at init stage
- netfilter: nf_tables: split async and sync catchall in two functions
- mptcp: fix possible NULL pointer dereference on close
Current release - new code bugs:
- eth: ice: dpll: fix initial lock status of dpll
Previous releases - regressions:
- bpf: fix precision backtracking instruction iteration
- af_unix: fix use-after-free in unix_stream_read_actor()
- tipc: fix kernel-infoleak due to uninitialized TLV value
- eth: bonding: stop the device in bond_setup_by_slave()
- eth: mlx5:
- fix double free of encap_header
- avoid referencing skb after free-ing in drop path
- eth: hns3: fix VF reset
- eth: mvneta: fix calls to page_pool_get_stats
Previous releases - always broken:
- core: set SOCK_RCU_FREE before inserting socket into hashtable
- bpf: fix control-flow graph checking in privileged mode
- eth: ppp: limit MRU to 64K
- eth: stmmac: avoid rx queue overrun
- eth: icssg-prueth: fix error cleanup on failing initialization
- eth: hns3: fix out-of-bounds access may occur when coalesce info is
read via debugfs
- eth: cortina: handle large frames
Misc:
- selftests: gso: support CONFIG_MAX_SKB_FRAGS up to 45
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQJGBAABCAAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmVV9akSHHBhYmVuaUBy
ZWRoYXQuY29tAAoJECkkeY3MjxOkICMP/1+QHUaD4JG1mW9oYc2zINPfQl3dqQt3
2CGSE2yrtbQvyQl39BDa0WFzV5X6So6/U50twhTNM+UAJsCaOvxCUDvUP9eY9Dcm
z2H4oITZimyP4CEb3l7JpL2PImvfImL7D/fCPPMUZVzNY6dkEFznaQrnawbJz4gg
mZXDnjwIXq7OchoJy3dHzyOn4ZQj2Df5VcfBzkVMdMcwV55Sd5JezbhwJ6NOmnKA
uoXlq4pFYj3ahAhEQfLWUwXmF3e6esHs/WUCMe5FR9YkanJlu4oHUmY3RLzfcdQA
PPIPDRxOzthcXyymqvqs7gnZ3ruMUll4B7tGTVFpJch8ts+DwGdUyBIIoDd/1BUT
gmjipP5HPia3Qdtk3Jc4vMkcf5AwoGo0hXku7YYJ1K7+4+t8ep3/hDbQc0PLWX6J
afiQgqpnNXHSTqBO5zl91vSwhGr/AAtAkDlPnsQL/RDAxY4teIwxHuoMvwPWaHZJ
sMo5ZcHXvNnBbGhpozFtmrnbf1nduUrQmW5LkJViCLf25Sj6pDYbo8WnhMuOKSnZ
7an2YqniCgBtrX4MEVn2jsWgavI+SxndVIQR04u0uwqmP+dn8s9LUfjKKDtPWHsK
+zMFtk+Op03TW5ur9w3+dgrGH0cLogPO3BJkho7xXKBfZ6/tN/pOef3/nV9xY6g8
JjnBUdpZRTWI
=VjWw
-----END PGP SIGNATURE-----
Merge tag 'net-6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from BPF and netfilter.
Current release - regressions:
- core: fix undefined behavior in netdev name allocation
- bpf: do not allocate percpu memory at init stage
- netfilter: nf_tables: split async and sync catchall in two
functions
- mptcp: fix possible NULL pointer dereference on close
Current release - new code bugs:
- eth: ice: dpll: fix initial lock status of dpll
Previous releases - regressions:
- bpf: fix precision backtracking instruction iteration
- af_unix: fix use-after-free in unix_stream_read_actor()
- tipc: fix kernel-infoleak due to uninitialized TLV value
- eth: bonding: stop the device in bond_setup_by_slave()
- eth: mlx5:
- fix double free of encap_header
- avoid referencing skb after free-ing in drop path
- eth: hns3: fix VF reset
- eth: mvneta: fix calls to page_pool_get_stats
Previous releases - always broken:
- core: set SOCK_RCU_FREE before inserting socket into hashtable
- bpf: fix control-flow graph checking in privileged mode
- eth: ppp: limit MRU to 64K
- eth: stmmac: avoid rx queue overrun
- eth: icssg-prueth: fix error cleanup on failing initialization
- eth: hns3: fix out-of-bounds access may occur when coalesce info is
read via debugfs
- eth: cortina: handle large frames
Misc:
- selftests: gso: support CONFIG_MAX_SKB_FRAGS up to 45"
* tag 'net-6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (78 commits)
macvlan: Don't propagate promisc change to lower dev in passthru
net: sched: do not offload flows with a helper in act_ct
net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors
net/mlx5e: Check return value of snprintf writing to fw_version buffer
net/mlx5e: Reduce the size of icosq_str
net/mlx5: Increase size of irq name buffer
net/mlx5e: Update doorbell for port timestamping CQ before the software counter
net/mlx5e: Track xmit submission to PTP WQ after populating metadata map
net/mlx5e: Avoid referencing skb after free-ing in drop path of mlx5e_sq_xmit_wqe
net/mlx5e: Don't modify the peer sent-to-vport rules for IPSec offload
net/mlx5e: Fix pedit endianness
net/mlx5e: fix double free of encap_header in update funcs
net/mlx5e: fix double free of encap_header
net/mlx5: Decouple PHC .adjtime and .adjphase implementations
net/mlx5: DR, Allow old devices to use multi destination FTE
net/mlx5: Free used cpus mask when an IRQ is released
Revert "net/mlx5: DR, Supporting inline WQE when possible"
bpf: Do not allocate percpu memory at init stage
net: Fix undefined behavior in netdev name allocation
dt-bindings: net: ethernet-controller: Fix formatting error
...
This commit is contained in:
Linus Torvalds
commit
7475e51b87
80 changed files with 860 additions and 457 deletions
|
|
@ -97,4 +97,66 @@ l0_%=: r2 = r0; \
|
|||
" ::: __clobber_all);
|
||||
}
|
||||
|
||||
SEC("socket")
|
||||
__description("conditional loop (2)")
|
||||
__success
|
||||
__failure_unpriv __msg_unpriv("back-edge from insn 10 to 11")
|
||||
__naked void conditional_loop2(void)
|
||||
{
|
||||
asm volatile (" \
|
||||
r9 = 2 ll; \
|
||||
r3 = 0x20 ll; \
|
||||
r4 = 0x35 ll; \
|
||||
r8 = r4; \
|
||||
goto l1_%=; \
|
||||
l0_%=: r9 -= r3; \
|
||||
r9 -= r4; \
|
||||
r9 -= r8; \
|
||||
l1_%=: r8 += r4; \
|
||||
if r8 < 0x64 goto l0_%=; \
|
||||
r0 = r9; \
|
||||
exit; \
|
||||
" ::: __clobber_all);
|
||||
}
|
||||
|
||||
SEC("socket")
|
||||
__description("unconditional loop after conditional jump")
|
||||
__failure __msg("infinite loop detected")
|
||||
__failure_unpriv __msg_unpriv("back-edge from insn 3 to 2")
|
||||
__naked void uncond_loop_after_cond_jmp(void)
|
||||
{
|
||||
asm volatile (" \
|
||||
r0 = 0; \
|
||||
if r0 > 0 goto l1_%=; \
|
||||
l0_%=: r0 = 1; \
|
||||
goto l0_%=; \
|
||||
l1_%=: exit; \
|
||||
" ::: __clobber_all);
|
||||
}
|
||||
|
||||
|
||||
__naked __noinline __used
|
||||
static unsigned long never_ending_subprog()
|
||||
{
|
||||
asm volatile (" \
|
||||
r0 = r1; \
|
||||
goto -1; \
|
||||
" ::: __clobber_all);
|
||||
}
|
||||
|
||||
SEC("socket")
|
||||
__description("unconditional loop after conditional jump")
|
||||
/* infinite loop is detected *after* check_cfg() */
|
||||
__failure __msg("infinite loop detected")
|
||||
__naked void uncond_loop_in_subprog_after_cond_jmp(void)
|
||||
{
|
||||
asm volatile (" \
|
||||
r0 = 0; \
|
||||
if r0 > 0 goto l1_%=; \
|
||||
l0_%=: r0 += 1; \
|
||||
call never_ending_subprog; \
|
||||
l1_%=: exit; \
|
||||
" ::: __clobber_all);
|
||||
}
|
||||
|
||||
char _license[] SEC("license") = "GPL";
|
||||
|
|
|
|||
|
|
@ -75,9 +75,10 @@ l0_%=: r0 += 1; \
|
|||
" ::: __clobber_all);
|
||||
}
|
||||
|
||||
SEC("tracepoint")
|
||||
SEC("socket")
|
||||
__description("bounded loop, start in the middle")
|
||||
__failure __msg("back-edge")
|
||||
__success
|
||||
__failure_unpriv __msg_unpriv("back-edge")
|
||||
__naked void loop_start_in_the_middle(void)
|
||||
{
|
||||
asm volatile (" \
|
||||
|
|
@ -136,7 +137,9 @@ l0_%=: exit; \
|
|||
|
||||
SEC("tracepoint")
|
||||
__description("bounded recursion")
|
||||
__failure __msg("back-edge")
|
||||
__failure
|
||||
/* verifier limitation in detecting max stack depth */
|
||||
__msg("the call stack of 8 frames is too deep !")
|
||||
__naked void bounded_recursion(void)
|
||||
{
|
||||
asm volatile (" \
|
||||
|
|
|
|||
|
|
@ -91,3 +91,43 @@ __naked int bpf_end_bswap(void)
|
|||
}
|
||||
|
||||
#endif /* v4 instruction */
|
||||
|
||||
SEC("?raw_tp")
|
||||
__success __log_level(2)
|
||||
/*
|
||||
* Without the bug fix there will be no history between "last_idx 3 first_idx 3"
|
||||
* and "parent state regs=" lines. "R0_w=6" parts are here to help anchor
|
||||
* expected log messages to the one specific mark_chain_precision operation.
|
||||
*
|
||||
* This is quite fragile: if verifier checkpointing heuristic changes, this
|
||||
* might need adjusting.
|
||||
*/
|
||||
__msg("2: (07) r0 += 1 ; R0_w=6")
|
||||
__msg("3: (35) if r0 >= 0xa goto pc+1")
|
||||
__msg("mark_precise: frame0: last_idx 3 first_idx 3 subseq_idx -1")
|
||||
__msg("mark_precise: frame0: regs=r0 stack= before 2: (07) r0 += 1")
|
||||
__msg("mark_precise: frame0: regs=r0 stack= before 1: (07) r0 += 1")
|
||||
__msg("mark_precise: frame0: regs=r0 stack= before 4: (05) goto pc-4")
|
||||
__msg("mark_precise: frame0: regs=r0 stack= before 3: (35) if r0 >= 0xa goto pc+1")
|
||||
__msg("mark_precise: frame0: parent state regs= stack=: R0_rw=P4")
|
||||
__msg("3: R0_w=6")
|
||||
__naked int state_loop_first_last_equal(void)
|
||||
{
|
||||
asm volatile (
|
||||
"r0 = 0;"
|
||||
"l0_%=:"
|
||||
"r0 += 1;"
|
||||
"r0 += 1;"
|
||||
/* every few iterations we'll have a checkpoint here with
|
||||
* first_idx == last_idx, potentially confusing precision
|
||||
* backtracking logic
|
||||
*/
|
||||
"if r0 >= 10 goto l1_%=;" /* checkpoint + mark_precise */
|
||||
"goto l0_%=;"
|
||||
"l1_%=:"
|
||||
"exit;"
|
||||
::: __clobber_common
|
||||
);
|
||||
}
|
||||
|
||||
char _license[] SEC("license") = "GPL";
|
||||
|
|
|
|||
|
|
@ -442,7 +442,7 @@
|
|||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
||||
.errstr = "back-edge from insn 0 to 0",
|
||||
.errstr = "the call stack of 9 frames is too deep",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
|
|
@ -799,7 +799,7 @@
|
|||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
||||
.errstr = "back-edge",
|
||||
.errstr = "the call stack of 9 frames is too deep",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
|
|
@ -811,7 +811,7 @@
|
|||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
||||
.errstr = "back-edge",
|
||||
.errstr = "the call stack of 9 frames is too deep",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
|
|
|
|||
|
|
@ -9,8 +9,8 @@
|
|||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "invalid BPF_LD_IMM insn",
|
||||
.errstr_unpriv = "R1 pointer comparison",
|
||||
.errstr = "jump into the middle of ldimm64 insn 1",
|
||||
.errstr_unpriv = "jump into the middle of ldimm64 insn 1",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
|
|
@ -23,8 +23,8 @@
|
|||
BPF_LD_IMM64(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "invalid BPF_LD_IMM insn",
|
||||
.errstr_unpriv = "R1 pointer comparison",
|
||||
.errstr = "jump into the middle of ldimm64 insn 1",
|
||||
.errstr_unpriv = "jump into the middle of ldimm64 insn 1",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
|
|
|
|||
|
|
@ -908,8 +908,9 @@ static bool is_metadata_correct(struct pkt *pkt, void *buffer, u64 addr)
|
|||
struct xdp_info *meta = data - sizeof(struct xdp_info);
|
||||
|
||||
if (meta->count != pkt->pkt_nb) {
|
||||
ksft_print_msg("[%s] expected meta_count [%d], got meta_count [%d]\n",
|
||||
__func__, pkt->pkt_nb, meta->count);
|
||||
ksft_print_msg("[%s] expected meta_count [%d], got meta_count [%llu]\n",
|
||||
__func__, pkt->pkt_nb,
|
||||
(unsigned long long)meta->count);
|
||||
return false;
|
||||
}
|
||||
|
||||
|
|
@ -926,11 +927,13 @@ static bool is_frag_valid(struct xsk_umem_info *umem, u64 addr, u32 len, u32 exp
|
|||
|
||||
if (addr >= umem->num_frames * umem->frame_size ||
|
||||
addr + len > umem->num_frames * umem->frame_size) {
|
||||
ksft_print_msg("Frag invalid addr: %llx len: %u\n", addr, len);
|
||||
ksft_print_msg("Frag invalid addr: %llx len: %u\n",
|
||||
(unsigned long long)addr, len);
|
||||
return false;
|
||||
}
|
||||
if (!umem->unaligned_mode && addr % umem->frame_size + len > umem->frame_size) {
|
||||
ksft_print_msg("Frag crosses frame boundary addr: %llx len: %u\n", addr, len);
|
||||
ksft_print_msg("Frag crosses frame boundary addr: %llx len: %u\n",
|
||||
(unsigned long long)addr, len);
|
||||
return false;
|
||||
}
|
||||
|
||||
|
|
@ -1029,7 +1032,8 @@ static int complete_pkts(struct xsk_socket_info *xsk, int batch_size)
|
|||
u64 addr = *xsk_ring_cons__comp_addr(&xsk->umem->cq, idx + rcvd - 1);
|
||||
|
||||
ksft_print_msg("[%s] Too many packets completed\n", __func__);
|
||||
ksft_print_msg("Last completion address: %llx\n", addr);
|
||||
ksft_print_msg("Last completion address: %llx\n",
|
||||
(unsigned long long)addr);
|
||||
return TEST_FAILURE;
|
||||
}
|
||||
|
||||
|
|
@ -1513,8 +1517,9 @@ static int validate_tx_invalid_descs(struct ifobject *ifobject)
|
|||
}
|
||||
|
||||
if (stats.tx_invalid_descs != ifobject->xsk->pkt_stream->nb_pkts / 2) {
|
||||
ksft_print_msg("[%s] tx_invalid_descs incorrect. Got [%u] expected [%u]\n",
|
||||
__func__, stats.tx_invalid_descs,
|
||||
ksft_print_msg("[%s] tx_invalid_descs incorrect. Got [%llu] expected [%u]\n",
|
||||
__func__,
|
||||
(unsigned long long)stats.tx_invalid_descs,
|
||||
ifobject->xsk->pkt_stream->nb_pkts);
|
||||
return TEST_FAILURE;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3240,7 +3240,7 @@ fastclose_tests()
|
|||
if reset_check_counter "fastclose server test" "MPTcpExtMPFastcloseRx"; then
|
||||
test_linkfail=1024 fastclose=server \
|
||||
run_tests $ns1 $ns2 10.0.1.1
|
||||
chk_join_nr 0 0 0
|
||||
chk_join_nr 0 0 0 0 0 0 1
|
||||
chk_fclose_nr 1 1 invert
|
||||
chk_rst_nr 1 1
|
||||
fi
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue