linux-stable.git/drivers/net/wan, branch v6.4

net: lapbether: only support ethernet devices

2023-06-15T07:55:22+00:00

It probbaly makes no sense to support arbitrary network devices
for lapbether.

syzbot reported:

skbuff: skb_under_panic: text:ffff80008934c100 len:44 put:40 head:ffff0000d18dd200 data:ffff0000d18dd1ea tail:0x16 end:0x140 dev:bond1
kernel BUG at net/core/skbuff.c:200 !
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 5643 Comm: dhcpcd Not tainted 6.4.0-rc5-syzkaller-g4641cff8e810 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : skb_panic net/core/skbuff.c:196 [inline]
pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:210
lr : skb_panic net/core/skbuff.c:196 [inline]
lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:210
sp : ffff8000973b7260
x29: ffff8000973b7270 x28: ffff8000973b7360 x27: dfff800000000000
x26: ffff0000d85d8150 x25: 0000000000000016 x24: ffff0000d18dd1ea
x23: ffff0000d18dd200 x22: 000000000000002c x21: 0000000000000140
x20: 0000000000000028 x19: ffff80008934c100 x18: ffff8000973b68a0
x17: 0000000000000000 x16: ffff80008a43bfbc x15: 0000000000000202
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001
x11: 0000000000000201 x10: 0000000000000000 x9 : f22f7eb937cced00
x8 : f22f7eb937cced00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000973b6b78 x4 : ffff80008df9ee80 x3 : ffff8000805974f4
x2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086
Call trace:
skb_panic net/core/skbuff.c:196 [inline]
skb_under_panic+0x13c/0x140 net/core/skbuff.c:210
skb_push+0xf0/0x108 net/core/skbuff.c:2409
ip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1383
dev_hard_header include/linux/netdevice.h:3137 [inline]
lapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257
lapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447
lapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149
lapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251
lapb_establish_data_link+0x94/0xec
lapb_device_event+0x348/0x4e0
notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461
__dev_notify_flags+0x2bc/0x544
dev_change_flags+0xd0/0x15c net/core/dev.c:8643
devinet_ioctl+0x858/0x17e4 net/ipv4/devinet.c:1150
inet_ioctl+0x2ac/0x4d8 net/ipv4/af_inet.c:979
sock_do_ioctl+0x134/0x2dc net/socket.c:1201
sock_ioctl+0x4ec/0x858 net/socket.c:1318
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:191
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
Code: aa1803e6 aa1903e7 a90023f5 947730f5 (d4210000)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot 
Signed-off-by: Eric Dumazet 
Cc: Martin Schiller 
Signed-off-by: David S. Miller

Merge tag 'spi-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

2023-04-27T18:02:26+00:00

Pull spi updates from Mark Brown:
 "A fairly standard release for SPI with the exception of a change to
  the API for specifying chip selects done in preparation for supporting
  devices with more than one chip select, this required some mechanical
  changes throughout the tree which have been cooking in -next happily
  for a while.

  There's also a new API to allow us to support TPM chips on half duplex
  controllers.

  Summary:

   - Refactoring in preparation for supporting multiple chip selects for
     a single device, needed by some flash devices, which required a
     change in the SPI device API visible throughout the tree

   - Support for hardware assisted interaction with SPI TPMs on half
     duplex controllers, implemented on nVidia Tedra210 QuadSPI

   - Optimisation for large transfers on fsl-cpm devices

   - Cleanups around device property use which fix some sisues with
     fwnode

   - Use of both void remove() and devm_platform_.*ioremap_resource()

   - Support for AMD Pensando Elba, Amlogic A1, Cadence device mode,
     Intel MetorLake-S and StarFive J7110 QuadSPI"

* tag 'spi-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (185 commits)
  spi: bcm63xx: use macro DEFINE_SIMPLE_DEV_PM_OPS
  spi: tegra210-quad: Enable TPM wait polling
  spi: Add TPM HW flow flag
  spi: bcm63xx: remove PM_SLEEP based conditional compilation
  spi: cadence-quadspi: use macro DEFINE_SIMPLE_DEV_PM_OPS
  spi: spi-cadence: Add support for Slave mode
  spi: spi-cadence: Switch to spi_controller structure
  spi: cadence-quadspi: fix suspend-resume implementations
  spi: dw: Add support for AMD Pensando Elba SoC
  spi: dw: Add AMD Pensando Elba SoC SPI Controller
  spi: cadence-quadspi: Disable the SPI before reconfiguring
  spi: cadence-quadspi: Update the read timeout based on the length
  spi: spi-loopback-test: Add module param for iteration length
  spi: add support for Amlogic A1 SPI Flash Controller
  dt-bindings: spi: add Amlogic A1 SPI controller
  spi: fsl-spi: No need to check transfer length versus word size
  spi: fsl-spi: Change mspi_apply_cpu_mode_quirks() to void
  spi: fsl-cpm: Use 16 bit mode for large transfers with even size
  spi: fsl-spi: Re-organise transfer bits_per_word adaptation
  spi: fsl-spi: Fix CPM/QE mode Litte Endian
  ...

net: Use of_property_read_bool() for boolean properties

2023-03-16T17:41:28+00:00

It is preferred to use typed property access functions (i.e.
of_property_read_ functions) rather than low-level
of_get_property/of_find_property functions for reading properties.
Convert reading boolean properties to of_property_read_bool().

Reviewed-by: Simon Horman 
Acked-by: Marc Kleine-Budde  # for net/can
Acked-by: Kalle Valo 
Acked-by: Nicolas Ferre 
Acked-by: Francois Romieu 
Reviewed-by: Wei Fang 
Signed-off-by: Rob Herring 
Signed-off-by: David S. Miller

net: Replace all spi->chip_select and spi->cs_gpiod references with function call

2023-03-11T12:34:02+00:00

Supporting multi-cs in spi drivers would require the chip_select & cs_gpiod
members of struct spi_device to be an array. But changing the type of these
members to array would break the spi driver functionality. To make the
transition smoother introduced four new APIs to get/set the
spi->chip_select & spi->cs_gpiod and replaced all spi->chip_select and
spi->cs_gpiod references with get or set API calls.
While adding multi-cs support in further patches the chip_select & cs_gpiod
members of the spi_device structure would be converted to arrays & the
"idx" parameter of the APIs would be used as array index i.e.,
spi->chip_select[idx] & spi->cs_gpiod[idx] respectively.

Signed-off-by: Amit Kumar Mahapatra 
Reviewed-by: Michal Simek 
Link: https://lore.kernel.org/r/20230310173217.3429788-3-amit.kumar-mahapatra@amd.com
Signed-off-by: Mark Brown

net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs

2023-01-14T05:34:31+00:00

If uhdlc_priv_tsa != 1 then utdm is not initialized.
And if ret != NULL then goto undo_uhdlc_init, where
utdm is dereferenced. Same if dev == NULL.

Found by Astra Linux on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: 8d68100ab4ad ("soc/fsl/qe: fix err handling of ucc_of_parse_tdm")
Signed-off-by: Esina Ekaterina 
Link: https://lore.kernel.org/r/20230112074703.13558-1-eesina@astralinux.ru
Signed-off-by: Jakub Kicinski

net: farsync: Fix kmemleak when rmmods farsync

2022-12-12T09:42:45+00:00

There are two memory leaks reported by kmemleak:

  unreferenced object 0xffff888114b20200 (size 128):
    comm "modprobe", pid 4846, jiffies 4295146524 (age 401.345s)
    hex dump (first 32 bytes):
      e0 62 57 09 81 88 ff ff e0 62 57 09 81 88 ff ff  .bW......bW.....
      01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    backtrace:
      [] kmalloc_trace+0x22/0x60
      [] __hw_addr_add_ex+0x198/0x6c0
      [] dev_addr_init+0x13d/0x230
      [] alloc_netdev_mqs+0x10d/0xe50
      [] alloc_hdlcdev+0x2e/0x80
      [] fst_add_one+0x601/0x10e0 [farsync]
      ...

  unreferenced object 0xffff88810b85b000 (size 1024):
    comm "modprobe", pid 4846, jiffies 4295146523 (age 401.346s)
    hex dump (first 32 bytes):
      00 00 b0 02 00 c9 ff ff 00 70 0a 00 00 c9 ff ff  .........p......
      00 00 00 f2 00 00 00 f3 0a 00 00 00 02 00 00 00  ................
    backtrace:
      [] kmalloc_trace+0x22/0x60
      [] fst_add_one+0x154/0x10e0 [farsync]
      [] local_pci_probe+0xd3/0x170
      ...

The root cause is traced to the netdev and fst_card_info are not freed
when removes one fst in fst_remove_one(), which may trigger oom if
repeated insmod and rmmod module.

Fix it by adding free_netdev() and kfree() in fst_remove_one(), just as
the operations on the error handling path in fst_add_one().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Li Zetao 
Reviewed-by: Jiri Pirko 
Signed-off-by: David S. Miller

net: lapbether: fix issue of invalid opcode in lapbeth_open()

2022-11-08T11:47:36+00:00

If lapb_register() failed when lapb device goes to up for the first time,
the NAPI is not disabled. As a result, the invalid opcode issue is
reported when the lapb device goes to up for the second time.

The stack info is as follows:
[ 1958.311422][T11356] kernel BUG at net/core/dev.c:6442!
[ 1958.312206][T11356] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[ 1958.315979][T11356] RIP: 0010:napi_enable+0x16a/0x1f0
[ 1958.332310][T11356] Call Trace:
[ 1958.332817][T11356]  
[ 1958.336135][T11356]  lapbeth_open+0x18/0x90
[ 1958.337446][T11356]  __dev_open+0x258/0x490
[ 1958.341672][T11356]  __dev_change_flags+0x4d4/0x6a0
[ 1958.345325][T11356]  dev_change_flags+0x93/0x160
[ 1958.346027][T11356]  devinet_ioctl+0x1276/0x1bf0
[ 1958.346738][T11356]  inet_ioctl+0x1c8/0x2d0
[ 1958.349638][T11356]  sock_ioctl+0x5d1/0x750
[ 1958.356059][T11356]  __x64_sys_ioctl+0x3ec/0x1790
[ 1958.365594][T11356]  do_syscall_64+0x35/0x80
[ 1958.366239][T11356]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 1958.377381][T11356]  

Fixes: 514e1150da9c ("net: x25: Queue received packets in the drivers instead of per-CPU queues")
Signed-off-by: Zhengchao Shao 
Link: https://lore.kernel.org/r/20221107011445.207372-1-shaozhengchao@huawei.com
Signed-off-by: Paolo Abeni

net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event()

2022-11-07T09:31:26+00:00

When following tests are performed, it will cause dev reference counting
leakage.
a)ip link add bond2 type bond mode balance-rr
b)ip link set bond2 up
c)ifenslave -f bond2 rose1
d)ip link del bond2

When new bond device is created, the default type of the bond device is
ether. And the bond device is up, lapbeth_device_event() receives the
message and creates a new lapbeth device. In this case, the reference
count value of dev is hold once. But after "ifenslave -f bond2 rose1"
command is executed, the type of the bond device is changed to rose. When
the bond device is unregistered, lapbeth_device_event() will not put the
dev reference count.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao 
Signed-off-by: David S. Miller

WAN: Fix syntax errors in comments

2022-06-07T08:45:25+00:00

Delete the redundant word 'the'.

Signed-off-by: Xiang wangx 
Link: https://lore.kernel.org/r/20220604040917.8926-1-wangxiang@cdjrlc.com
Signed-off-by: Paolo Abeni

net: wan: switch to netif_napi_add_weight()

2022-05-08T10:33:57+00:00

A handful of WAN drivers use custom napi weights,
switch them to the new API.

Signed-off-by: Jakub Kicinski 
Signed-off-by: David S. Miller