Commit Graph

579 Commits

Author SHA1 Message Date
Jared Kangas 8ed4b8bf87 net: tun: call napi_schedule_prep() to ensure we own a napi
JIRA: https://issues.redhat.com/browse/RHEL-76236

commit 07d120aa33cc9d9115753d159f64d20c94458781
Author: Eric Dumazet <edumazet@google.com>
Date:   Mon Nov 7 18:00:11 2022 +0000

    net: tun: call napi_schedule_prep() to ensure we own a napi

    A recent patch exposed another issue in napi_get_frags()
    caught by syzbot [1]

    Before feeding packets to GRO, and calling napi_complete()
    we must first grab NAPI_STATE_SCHED.

    [1]
    WARNING: CPU: 0 PID: 3612 at net/core/dev.c:6076 napi_complete_done+0x45b/0x880 net/core/dev.c:6076
    Modules linked in:
    CPU: 0 PID: 3612 Comm: syz-executor408 Not tainted 6.1.0-rc3-syzkaller-00175-g1118b2049d77 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
    RIP: 0010:napi_complete_done+0x45b/0x880 net/core/dev.c:6076
    Code: c1 ea 03 0f b6 14 02 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 24 04 00 00 41 89 5d 1c e9 73 fc ff ff e8 b5 53 22 fa <0f> 0b e9 82 fe ff ff e8 a9 53 22 fa 48 8b 5c 24 08 31 ff 48 89 de
    RSP: 0018:ffffc90003c4f920 EFLAGS: 00010293
    RAX: 0000000000000000 RBX: 0000000000000030 RCX: 0000000000000000
    RDX: ffff8880251c0000 RSI: ffffffff875a58db RDI: 0000000000000007
    RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000
    R10: 0000000000000001 R11: 0000000000000001 R12: ffff888072d02628
    R13: ffff888072d02618 R14: ffff888072d02634 R15: 0000000000000000
    FS: 0000555555f13300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000055c44d3892b8 CR3: 00000000172d2000 CR4: 00000000003506f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
    <TASK>
    napi_complete include/linux/netdevice.h:510 [inline]
    tun_get_user+0x206d/0x3a60 drivers/net/tun.c:1980
    tun_chr_write_iter+0xdb/0x200 drivers/net/tun.c:2027
    call_write_iter include/linux/fs.h:2191 [inline]
    do_iter_readv_writev+0x20b/0x3b0 fs/read_write.c:735
    do_iter_write+0x182/0x700 fs/read_write.c:861
    vfs_writev+0x1aa/0x630 fs/read_write.c:934
    do_writev+0x133/0x2f0 fs/read_write.c:977
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    RIP: 0033:0x7f37021a3c19

    Fixes: 1118b2049d77 ("net: tun: Fix memory leaks of napi_get_frags")
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Wang Yufen <wangyufen@huawei.com>
    Link: https://lore.kernel.org/r/20221107180011.188437-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Jared Kangas <jkangas@redhat.com>
2025-01-27 06:00:32 -08:00
Jared Kangas be5c9e1052 net: tun: Fix memory leaks of napi_get_frags
JIRA: https://issues.redhat.com/browse/RHEL-76236

commit 1118b2049d77ca0b505775fc1a8d1909cf19a7ec
Author: Wang Yufen <wangyufen@huawei.com>
Date:   Wed Nov 2 17:41:19 2022 +0800

    net: tun: Fix memory leaks of napi_get_frags

    kmemleak reports after running test_progs:

    unreferenced object 0xffff8881b1672dc0 (size 232):
      comm "test_progs", pid 394388, jiffies 4354712116 (age 841.975s)
      hex dump (first 32 bytes):
        e0 84 d7 a8 81 88 ff ff 80 2c 67 b1 81 88 ff ff  .........,g.....
        00 40 c5 9b 81 88 ff ff 00 00 00 00 00 00 00 00  .@..............
      backtrace:
        [<00000000c8f01748>] napi_skb_cache_get+0xd4/0x150
        [<0000000041c7fc09>] __napi_build_skb+0x15/0x50
        [<00000000431c7079>] __napi_alloc_skb+0x26e/0x540
        [<000000003ecfa30e>] napi_get_frags+0x59/0x140
        [<0000000099b2199e>] tun_get_user+0x183d/0x3bb0 [tun]
        [<000000008a5adef0>] tun_chr_write_iter+0xc0/0x1b1 [tun]
        [<0000000049993ff4>] do_iter_readv_writev+0x19f/0x320
        [<000000008f338ea2>] do_iter_write+0x135/0x630
        [<000000008a3377a4>] vfs_writev+0x12e/0x440
        [<00000000a6b5639a>] do_writev+0x104/0x280
        [<00000000ccf065d8>] do_syscall_64+0x3b/0x90
        [<00000000d776e329>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

    The issue occurs in the following scenarios:
    tun_get_user()
      napi_gro_frags()
        napi_frags_finish()
          case GRO_NORMAL:
            gro_normal_one()
              list_add_tail(&skb->list, &napi->rx_list);
              <-- While napi->rx_count < READ_ONCE(gro_normal_batch),
              <-- gro_normal_list() is not called, napi->rx_list is not empty
      <-- not ask to complete the gro work, will cause memory leaks in
      <-- following tun_napi_del()
    ...
    tun_napi_del()
      netif_napi_del()
        __netif_napi_del()
        <-- &napi->rx_list is not empty, which caused memory leaks

    To fix, add napi_complete() after napi_gro_frags().

    Fixes: 90e33d4594 ("tun: enable napi_gro_frags() for TUN/TAP driver")
    Signed-off-by: Wang Yufen <wangyufen@huawei.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Jared Kangas <jkangas@redhat.com>
2025-01-24 14:18:55 -08:00
Rado Vrbovsky 624b7a26be Merge: net: tun: Fix use-after-free in tun_detach()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/5984

net: tun: Fix use-after-free in tun_detach()

JIRA: https://issues.redhat.com/browse/RHEL-63736
CVE: CVE-2022-49014
Upstream: Merged

    commit 5daadc86f27ea4d691e2131c04310d0418c6cd12
    Author: Shigeru Yoshida <syoshida@redhat.com>
    Date:   Fri Nov 25 02:51:34 2022 +0900

        net: tun: Fix use-after-free in tun_detach()

        syzbot reported use-after-free in tun_detach() [1].  This causes call
        trace like below:

        ==================================================================
        BUG: KASAN: use-after-free in notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75
        Read of size 8 at addr ffff88807324e2a8 by task syz-executor.0/3673

        CPU: 0 PID: 3673 Comm: syz-executor.0 Not tainted 6.1.0-rc5-syzkaller-00044-gcc675d22e422 #0
        Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
        Call Trace:
         <TASK>
         __dump_stack lib/dump_stack.c:88 [inline]
         dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
         print_address_description mm/kasan/report.c:284 [inline]
         print_report+0x15e/0x461 mm/kasan/report.c:395
         kasan_report+0xbf/0x1f0 mm/kasan/report.c:495
         notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75
         call_netdevice_notifiers_info+0x86/0x130 net/core/dev.c:1942
         call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]
         call_netdevice_notifiers net/core/dev.c:1997 [inline]
         netdev_wait_allrefs_any net/core/dev.c:10237 [inline]
         netdev_run_todo+0xbc6/0x1100 net/core/dev.c:10351
         tun_detach drivers/net/tun.c:704 [inline]
         tun_chr_close+0xe4/0x190 drivers/net/tun.c:3467
         __fput+0x27c/0xa90 fs/file_table.c:320
         task_work_run+0x16f/0x270 kernel/task_work.c:179
         exit_task_work include/linux/task_work.h:38 [inline]
         do_exit+0xb3d/0x2a30 kernel/exit.c:820
         do_group_exit+0xd4/0x2a0 kernel/exit.c:950
         get_signal+0x21b1/0x2440 kernel/signal.c:2858
         arch_do_signal_or_restart+0x86/0x2300 arch/x86/kernel/signal.c:869
         exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
         exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203
         __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
         syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296
         do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
         entry_SYSCALL_64_after_hwframe+0x63/0xcd

        The cause of the issue is that sock_put() from __tun_detach() drops
        last reference count for struct net, and then notifier_call_chain()
        from netdev_state_change() accesses that struct net.

        This patch fixes the issue by calling sock_put() from tun_detach()
        after all necessary accesses for the struct net has done.

        Fixes: 83c1f36f98 ("tun: send netlink notification when the device is modified")
        Reported-by: syzbot+106f9b687cd64ee70cd1@syzkaller.appspotmail.com
        Link: https://syzkaller.appspot.com/bug?id=96eb7f1ce75ef933697f24eeab928c4a716edefe [1]
        Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
        Link: https://lore.kernel.org/r/20221124175134.1589053-1-syoshida@redhat.com
        Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Signed-off-by: Jon Maloy <jmaloy@redhat.com>

Approved-by: Paolo Abeni <pabeni@redhat.com>
Approved-by: Laurent Vivier <lvivier@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: Rado Vrbovsky <rvrbovsk@redhat.com>
2025-01-23 13:15:08 +00:00
Jon Maloy b5cf5bc6d7 net: tun: Fix use-after-free in tun_detach()
JIRA: https://issues.redhat.com/browse/RHEL-63736
CVE: CVE-2022-49014
Upstream: Merged

commit 5daadc86f27ea4d691e2131c04310d0418c6cd12
Author: Shigeru Yoshida <syoshida@redhat.com>
Date:   Fri Nov 25 02:51:34 2022 +0900

    net: tun: Fix use-after-free in tun_detach()

    syzbot reported use-after-free in tun_detach() [1].  This causes call
    trace like below:

    ==================================================================
    BUG: KASAN: use-after-free in notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75
    Read of size 8 at addr ffff88807324e2a8 by task syz-executor.0/3673

    CPU: 0 PID: 3673 Comm: syz-executor.0 Not tainted 6.1.0-rc5-syzkaller-00044-gcc675d22e422 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]
     dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
     print_address_description mm/kasan/report.c:284 [inline]
     print_report+0x15e/0x461 mm/kasan/report.c:395
     kasan_report+0xbf/0x1f0 mm/kasan/report.c:495
     notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75
     call_netdevice_notifiers_info+0x86/0x130 net/core/dev.c:1942
     call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]
     call_netdevice_notifiers net/core/dev.c:1997 [inline]
     netdev_wait_allrefs_any net/core/dev.c:10237 [inline]
     netdev_run_todo+0xbc6/0x1100 net/core/dev.c:10351
     tun_detach drivers/net/tun.c:704 [inline]
     tun_chr_close+0xe4/0x190 drivers/net/tun.c:3467
     __fput+0x27c/0xa90 fs/file_table.c:320
     task_work_run+0x16f/0x270 kernel/task_work.c:179
     exit_task_work include/linux/task_work.h:38 [inline]
     do_exit+0xb3d/0x2a30 kernel/exit.c:820
     do_group_exit+0xd4/0x2a0 kernel/exit.c:950
     get_signal+0x21b1/0x2440 kernel/signal.c:2858
     arch_do_signal_or_restart+0x86/0x2300 arch/x86/kernel/signal.c:869
     exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
     exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203
     __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
     syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296
     do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
     entry_SYSCALL_64_after_hwframe+0x63/0xcd

    The cause of the issue is that sock_put() from __tun_detach() drops
    last reference count for struct net, and then notifier_call_chain()
    from netdev_state_change() accesses that struct net.

    This patch fixes the issue by calling sock_put() from tun_detach()
    after all necessary accesses for the struct net has done.

    Fixes: 83c1f36f98 ("tun: send netlink notification when the device is modified")
    Reported-by: syzbot+106f9b687cd64ee70cd1@syzkaller.appspotmail.com
    Link: https://syzkaller.appspot.com/bug?id=96eb7f1ce75ef933697f24eeab928c4a716edefe [1]
    Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
    Link: https://lore.kernel.org/r/20221124175134.1589053-1-syoshida@redhat.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Signed-off-by: Jon Maloy <jmaloy@redhat.com>
2024-12-09 16:05:12 -05:00
Jeff Moyer 97718db85e net: extend ubuf_info callback to ops structure
JIRA: https://issues.redhat.com/browse/RHEL-64867
Conflicts: The conflicts here existed upstream, and were resolved by
merge commit 3830fff39941 ("Merge branch 'for-uring-ubufops' of
git://git.kernel.org/pub/scm/linux/kernel/git/kuba/linux into
for-6.10/io_uring").  This patch incorporates the fixes from that
merge commit.

commit 7ab4f16f9e2440e797eae88812f800458e5879d2
Author: Pavel Begunkov <asml.silence@gmail.com>
Date:   Fri Apr 19 12:08:39 2024 +0100

    net: extend ubuf_info callback to ops structure
    
    We'll need to associate additional callbacks with ubuf_info, introduce
    a structure holding ubuf_info callbacks. Apart from a more smarter
    io_uring notification management introduced in next patches, it can be
    used to generalise msg_zerocopy_put_abort() and also store
    ->sg_from_iter, which is currently passed in struct msghdr.
    
    Reviewed-by: Jens Axboe <axboe@kernel.dk>
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
    Reviewed-by: Willem de Bruijn <willemb@google.com>
    Link: https://lore.kernel.org/all/a62015541de49c0e2a8a0377a1d5d0a5aeb07016.1713369317.git.asml.silence@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
2024-11-28 17:38:44 -05:00
Michal Schmidt 555cb3d84d netdev_features: convert NETIF_F_LLTX to dev->lltx
JIRA: https://issues.redhat.com/browse/RHEL-59091

commit 00d066a4d4edbe559ba6c35153da71d4b2b8a383
Author: Alexander Lobakin <aleksander.lobakin@intel.com>
Date:   Thu Aug 29 14:33:37 2024 +0200

    netdev_features: convert NETIF_F_LLTX to dev->lltx

    NETIF_F_LLTX can't be changed via Ethtool and is not a feature,
    rather an attribute, very similar to IFF_NO_QUEUE (and hot).
    Free one netdev_features_t bit and make it a "hot" private flag.

    Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Conflicts:
	drivers/net/macsec.c
	drivers/net/veth.c
	net/ipv6/ip6_tunnel.c
	- Context.

	drivers/net/amt.c
	drivers/net/netkit.c
	- Non-existent in RHEL 9.

	drivers/net/ethernet/chelsio/cxgb/cxgb2.c
	drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
	- Drivers disabled in RHEL 9. Skipped.

	net/dsa/user.c
	- This is slave.c in RHEL 9, but CONFIG_NET_DSA is disabled,
	  so skipped the hunk.

	net/core/net-sysfs.c
	- Code not present because of missing commit 74293ea1c4db
	  ("net: sysfs: Do not create sysfs for non BQL device")

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
2024-10-03 17:59:44 +02:00
Lucas Zampieri 10b4c31446 Merge: tun: limit printing rate when illegal packet received by tun dev
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/4652

JIRA: https://issues.redhat.com/browse/RHEL-35048
CVE: CVE-2024-27013
Upstream: Merged

Signed-off-by: Jon Maloy <jmaloy@redhat.com>

Approved-by: Marc Milgram <mmilgram@redhat.com>
Approved-by: Jason Wang <jasowang@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: Lucas Zampieri <lzampier@redhat.com>
2024-08-09 17:53:38 +00:00
Patrick Talbert fcfad23917 tun: add missing verification for short frame
JIRA: https://issues.redhat.com/browse/RHEL-50203
CVE: CVE-2024-41091
Upstream Status: Posted https://lore.kernel.org/r/20240724170452.16837-3-dongli.zhang@oracle.com/

Author: Dongli Zhang <dongli.zhang@oracle.com>
Date:   Wed Jul 24 10:04:52 2024 -0700

    tun: add missing verification for short frame

    The cited commit missed to check against the validity of the frame length
    in the tun_xdp_one() path, which could cause a corrupted skb to be sent
    downstack. Even before the skb is transmitted, the
    tun_xdp_one-->eth_type_trans() may access the Ethernet header although it
    can be less than ETH_HLEN. Once transmitted, this could either cause
    out-of-bound access beyond the actual length, or confuse the underlayer
    with incorrect or inconsistent header length in the skb metadata.

    In the alternative path, tun_get_user() already prohibits short frame which
    has the length less than Ethernet header size from being transmitted for
    IFF_TAP.

    This is to drop any frame shorter than the Ethernet header size just like
    how tun_get_user() does.

    CVE: CVE-2024-41091
    Inspired-by: https://lore.kernel.org/netdev/1717026141-25716-1-git-send-email-si-wei.liu@oracle.com/
    Fixes: 043d222f93 ("tuntap: accept an array of XDP buffs through sendmsg()")
    Cc: Si-Wei Liu <si-wei.liu@oracle.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
    Reviewed-by: Willem de Bruijn <willemb@google.com>
    Reviewed-by: Paolo Abeni <pabeni@redhat.com>
    Reviewed-by: Jason Wang <jasowang@redhat.com>

Signed-off-by: Patrick Talbert <ptalbert@redhat.com>
2024-07-25 10:41:47 +02:00
Jon Maloy 4e933e7852 tun: limit printing rate when illegal packet received by tun dev
JIRA: https://issues.redhat.com/browse/RHEL-35048
CVE: CVE-2024-27013
Upstream: Merged

commit f8bbc07ac535593139c875ffa19af924b1084540
Author: Lei Chen <lei.chen@smartx.com>
Date:   Sun Apr 14 22:02:46 2024 -0400

    tun: limit printing rate when illegal packet received by tun dev

    vhost_worker will call tun call backs to receive packets. If too many
    illegal packets arrives, tun_do_read will keep dumping packet contents.
    When console is enabled, it will costs much more cpu time to dump
    packet and soft lockup will be detected.

    net_ratelimit mechanism can be used to limit the dumping rate.

    PID: 33036    TASK: ffff949da6f20000  CPU: 23   COMMAND: "vhost-32980"
     #0 [fffffe00003fce50] crash_nmi_callback at ffffffff89249253
     #1 [fffffe00003fce58] nmi_handle at ffffffff89225fa3
     #2 [fffffe00003fceb0] default_do_nmi at ffffffff8922642e
     #3 [fffffe00003fced0] do_nmi at ffffffff8922660d
     #4 [fffffe00003fcef0] end_repeat_nmi at ffffffff89c01663
        [exception RIP: io_serial_in+20]
        RIP: ffffffff89792594  RSP: ffffa655314979e8  RFLAGS: 00000002
        RAX: ffffffff89792500  RBX: ffffffff8af428a0  RCX: 0000000000000000
        RDX: 00000000000003fd  RSI: 0000000000000005  RDI: ffffffff8af428a0
        RBP: 0000000000002710   R8: 0000000000000004   R9: 000000000000000f
        R10: 0000000000000000  R11: ffffffff8acbf64f  R12: 0000000000000020
        R13: ffffffff8acbf698  R14: 0000000000000058  R15: 0000000000000000
        ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
     #5 [ffffa655314979e8] io_serial_in at ffffffff89792594
     #6 [ffffa655314979e8] wait_for_xmitr at ffffffff89793470
     #7 [ffffa65531497a08] serial8250_console_putchar at ffffffff897934f6
     #8 [ffffa65531497a20] uart_console_write at ffffffff8978b605
     #9 [ffffa65531497a48] serial8250_console_write at ffffffff89796558
     #10 [ffffa65531497ac8] console_unlock at ffffffff89316124
     #11 [ffffa65531497b10] vprintk_emit at ffffffff89317c07
     #12 [ffffa65531497b68] printk at ffffffff89318306
     #13 [ffffa65531497bc8] print_hex_dump at ffffffff89650765
     #14 [ffffa65531497ca8] tun_do_read at ffffffffc0b06c27 [tun]
     #15 [ffffa65531497d38] tun_recvmsg at ffffffffc0b06e34 [tun]
     #16 [ffffa65531497d68] handle_rx at ffffffffc0c5d682 [vhost_net]
     #17 [ffffa65531497ed0] vhost_worker at ffffffffc0c644dc [vhost]
     #18 [ffffa65531497f10] kthread at ffffffff892d2e72
     #19 [ffffa65531497f50] ret_from_fork at ffffffff89c0022f

    Fixes: ef3db4a595 ("tun: avoid BUG, dump packet on GSO errors")
    Signed-off-by: Lei Chen <lei.chen@smartx.com>
    Reviewed-by: Willem de Bruijn <willemb@google.com>
    Acked-by: Jason Wang <jasowang@redhat.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Link: https://lore.kernel.org/r/20240415020247.2207781-1-lei.chen@smartx.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Jon Maloy <jmaloy@redhat.com>
2024-07-03 18:52:57 -04:00
Ivan Vecera 4ee448db07 net: introduce include/net/rps.h
JIRA: https://issues.redhat.com/browse/RHEL-31916

Conflicts:
* net/core/dev.c
  context conflict due to missing commit 2b0cfa6e49566 ("net: add
  generic percpu page_pool allocator")
* net/core/sysctl_net_core.c
  context conflict due to missing commit 2658b5a8a4eee ("net: introduce
  struct net_hotdata")

commit 490a79faf95e705ba0ffd9ebf04a624b379e53c9
Author: Eric Dumazet <edumazet@google.com>
Date:   Wed Mar 6 16:00:30 2024 +0000

    net: introduce include/net/rps.h

    Move RPS related structures and helpers from include/linux/netdevice.h
    and include/net/sock.h to a new include file.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Link: https://lore.kernel.org/r/20240306160031.874438-18-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Ivan Vecera <ivecera@redhat.com>
2024-04-05 16:03:32 +02:00
Scott Weaver 8d95883db0 Merge: io_uring: update to upstream v6.6
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/3318

Update io_uring and its dependencies to upstream kernel version 6.6.

JIRA: https://issues.redhat.com/browse/RHEL-12076
JIRA: https://issues.redhat.com/browse/RHEL-14998
JIRA: https://issues.redhat.com/browse/RHEL-4447
CVE: CVE-2023-46862

Omitted-Fix: ab69838e7c75 ("io_uring/kbuf: Fix check of BID wrapping in provided buffers")
Omitted-Fix: f74c746e476b ("io_uring/kbuf: Allow the full buffer id space for provided buffers")

This is the list of new features available (includes upstream kernel versions 6.3-6.6):

    User-specified ring buffer
    Provided Buffers allocated by the kernel
    Ability to register the ring fd
    Multi-shot timeouts
    ability to pass custom flags to the completion queue entry for ring messages

All of these features are covered by the liburing tests.

In my testing, no-mmap-inval.t failed because of a broken test.  socket-uring-cmd.t also failed because of a missing selinux policy rule.  Try running audit2allow if you see a failure in that test.

Signed-off-by: Jeff Moyer <jmoyer@redhat.com>

Approved-by: Wander Lairson Costa <wander@redhat.com>
Approved-by: Donald Dutile <ddutile@redhat.com>
Approved-by: Chris von Recklinghausen <crecklin@redhat.com>
Approved-by: Jiri Benc <jbenc@redhat.com>
Approved-by: Ming Lei <ming.lei@redhat.com>

Signed-off-by: Scott Weaver <scweaver@redhat.com>
2023-12-16 14:38:47 -05:00
Jeff Moyer cc3954e1d4 iov_iter: add iter_iovec() helper
JIRA: https://issues.redhat.com/browse/RHEL-12076

commit de4f5fed3f231a8ff4790bf52975f847b95b85ea
Author: Jens Axboe <axboe@kernel.dk>
Date:   Wed Mar 29 08:52:15 2023 -0600

    iov_iter: add iter_iovec() helper
    
    This returns a pointer to the current iovec entry in the iterator. Only
    useful with ITER_IOVEC right now, but it prepares us to treat ITER_UBUF
    and ITER_IOVEC identically for the first segment.
    
    Rename struct iov_iter->iov to iov_iter->__iov to find any potentially
    troublesome spots, and also to prevent anyone from adding new code that
    accesses iter->iov directly.
    
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
2023-11-02 15:31:27 -04:00
Ricardo Robaina 3eb34f2e37 net: tun: fix bugs for oversize packet when napi frags enabled
JIRA: https://issues.redhat.com/browse/RHEL-7186
JIRA: https://issues.redhat.com/browse/RHEL-7264
CVE: CVE-2023-3812

This patch is a backport of the following upstream commit:
commit 363a5328f4b0517e59572118ccfb7c626d81dca9
Author: Ziyang Xuan <william.xuanziyang@huawei.com>
Date:   Sat Oct 29 17:41:01 2022 +0800

    net: tun: fix bugs for oversize packet when napi frags enabled

    Recently, we got two syzkaller problems because of oversize packet
    when napi frags enabled.

    One of the problems is because the first seg size of the iov_iter
    from user space is very big, it is 2147479538 which is bigger than
    the threshold value for bail out early in __alloc_pages(). And
    skb->pfmemalloc is true, __kmalloc_reserve() would use pfmemalloc
    reserves without __GFP_NOWARN flag. Thus we got a warning as following:

    ========================================================
    WARNING: CPU: 1 PID: 17965 at mm/page_alloc.c:5295 __alloc_pages+0x1308/0x16c4 mm/page_alloc.c:5295
    ...
    Call trace:
     __alloc_pages+0x1308/0x16c4 mm/page_alloc.c:5295
     __alloc_pages_node include/linux/gfp.h:550 [inline]
     alloc_pages_node include/linux/gfp.h:564 [inline]
     kmalloc_large_node+0x94/0x350 mm/slub.c:4038
     __kmalloc_node_track_caller+0x620/0x8e4 mm/slub.c:4545
     __kmalloc_reserve.constprop.0+0x1e4/0x2b0 net/core/skbuff.c:151
     pskb_expand_head+0x130/0x8b0 net/core/skbuff.c:1654
     __skb_grow include/linux/skbuff.h:2779 [inline]
     tun_napi_alloc_frags+0x144/0x610 drivers/net/tun.c:1477
     tun_get_user+0x31c/0x2010 drivers/net/tun.c:1835
     tun_chr_write_iter+0x98/0x100 drivers/net/tun.c:2036

    The other problem is because odd IPv6 packets without NEXTHDR_NONE
    extension header and have big packet length, it is 2127925 which is
    bigger than ETH_MAX_MTU(65535). After ipv6_gso_pull_exthdrs() in
    ipv6_gro_receive(), network_header offset and transport_header offset
    are all bigger than U16_MAX. That would trigger skb->network_header
    and skb->transport_header overflow error, because they are all '__u16'
    type. Eventually, it would affect the value for __skb_push(skb, value),
    and make it be a big value. After __skb_push() in ipv6_gro_receive(),
    skb->data would less than skb->head, an out of bounds memory bug occurred.
    That would trigger the problem as following:

    ==================================================================
    BUG: KASAN: use-after-free in eth_type_trans+0x100/0x260
    ...
    Call trace:
     dump_backtrace+0xd8/0x130
     show_stack+0x1c/0x50
     dump_stack_lvl+0x64/0x7c
     print_address_description.constprop.0+0xbc/0x2e8
     print_report+0x100/0x1e4
     kasan_report+0x80/0x120
     __asan_load8+0x78/0xa0
     eth_type_trans+0x100/0x260
     napi_gro_frags+0x164/0x550
     tun_get_user+0xda4/0x1270
     tun_chr_write_iter+0x74/0x130
     do_iter_readv_writev+0x130/0x1ec
     do_iter_write+0xbc/0x1e0
     vfs_writev+0x13c/0x26c

    To fix the problems, restrict the packet size less than
    (ETH_MAX_MTU - NET_SKB_PAD - NET_IP_ALIGN) which has considered reserved
    skb space in napi_alloc_skb() because transport_header is an offset from
    skb->head. Add len check in tun_napi_alloc_frags() simply.

    Fixes: 90e33d4594 ("tun: enable napi_gro_frags() for TUN/TAP driver")
    Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Link: https://lore.kernel.org/r/20221029094101.1653855-1-william.xuanziyang@huawei.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
2023-09-29 12:32:40 -03:00
Laszlo Ersek e4188325a1 net: tun_chr_open(): set sk_uid from current_fsuid()
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2229506
CVE: CVE-2023-4194

commit 9bc3047374d5bec163e83e743709e23753376f0c
Author: Laszlo Ersek <lersek@redhat.com>
Date:   Mon Jul 31 18:42:36 2023 +0200

    net: tun_chr_open(): set sk_uid from current_fsuid()

    Commit a096ccca6e50 initializes the "sk_uid" field in the protocol socket
    (struct sock) from the "/dev/net/tun" device node's owner UID. Per
    original commit 86741ec254 ("net: core: Add a UID field to struct
    sock.", 2016-11-04), that's wrong: the idea is to cache the UID of the
    userspace process that creates the socket. Commit 86741ec254 mentions
    socket() and accept(); with "tun", the action that creates the socket is
    open("/dev/net/tun").

    Therefore the device node's owner UID is irrelevant. In most cases,
    "/dev/net/tun" will be owned by root, so in practice, commit a096ccca6e50
    has no observable effect:

    - before, "sk_uid" would be zero, due to undefined behavior
      (CVE-2023-1076),

    - after, "sk_uid" would be zero, due to "/dev/net/tun" being owned by root.

    What matters is the (fs)UID of the process performing the open(), so cache
    that in "sk_uid".

    Cc: Eric Dumazet <edumazet@google.com>
    Cc: Lorenzo Colitti <lorenzo@google.com>
    Cc: Paolo Abeni <pabeni@redhat.com>
    Cc: Pietro Borrello <borrello@diag.uniroma1.it>
    Cc: netdev@vger.kernel.org
    Cc: stable@vger.kernel.org
    Fixes: a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid")
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2173435
    Signed-off-by: Laszlo Ersek <lersek@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Laszlo Ersek <lersek@redhat.com>
2023-08-07 17:30:49 +02:00
Jan Stancek e341c7e709 Merge: bpf, xdp: update to 6.3
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/2583

Rebase bpf and xdp to 6.3.

Bugzilla: https://bugzilla.redhat.com/2178930

Signed-off-by: Viktor Malik <vmalik@redhat.com>

Approved-by: Rafael Aquini <aquini@redhat.com>
Approved-by: Artem Savkov <asavkov@redhat.com>
Approved-by: Jason Wang <jasowang@redhat.com>
Approved-by: Jiri Benc <jbenc@redhat.com>
Approved-by: Jan Stancek <jstancek@redhat.com>
Approved-by: Baoquan He <5820488-baoquan_he@users.noreply.gitlab.com>

Signed-off-by: Jan Stancek <jstancek@redhat.com>
2023-06-28 07:52:45 +02:00
Felix Maurer d892a11ed2 drivers: net: turn on XDP features
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2178930
Conflicts:
- drivers/net/ethernet/engleder/tsnep_main.c: We don't have this driver
- drivers/net/ethernet/fungible/funeth/funeth_main.c: We don't have this
  driver
- drivers/net/ethernet/aquantia/atlantic/aq_nic.c: left out because it
  does not have XDP support
- drivers/net/ethernet/mediatek/mtk_eth_soc.c: left out because mtk_eth_soc
  does not have XDP support
- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c: left out because driver
  is not enabled
- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c: left out because driver
  is not enabled
- drivers/net/ethernet/freescale/enetc/enetc_pf.c: left out because driver
  is not enabled
- drivers/net/ethernet/marvell/mvneta.c: left out because driver is not
  enabled
- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c: left out because driver
  is not enabled
- drivers/net/ethernet/socionext/netsec.c: left out because driver is not
  enabled
- drivers/net/ethernet/ti/cpsw.c: left out because driver is not enabled
- drivers/net/ethernet/ti/cpsw_new.c: left out because driver is not
  enabled
- drivers/net/ethernet/netronome/nfp/nfp_net_common.c: Context difference
  due to missing 67d2656b48f1 ("nfp: support RX VLAN ctag/stag strip") and
  7de8b691615f ("nfp: enable TSO by default for nfp netdev")
- drivers/net/ethernet/intel/ice/ice_main.c: Merge conflict upstream
  between 5b246e533d01 ("ice: split probe into smaller functions") and this
  commit. Resolved the same way as upstream in de4287336794 (pull-request:
  bpf-next 2023-02-11): only add the XDP features to the existing
  ice_cfg_netdev() function.
- drivers/net/ethernet/intel/i40e/i40e_main.c: Code difference because the
  driver does not have support for frags/multi-buff. The last parameter of
  xdp_features_set_redirect_target indicates if frags are supported for Tx,
  we change the code to set it to false.

Omitted-fix: 1dc55923296d ("net: mvneta: do not set xdp_features for hw
buffer devices")
mvneta is not enabled and hunks in this commit are skipped
Omitted-fix: 481e96fc1307 ("mvpp2: take care of xdp_features when
reconfiguring queues")
mvpp2 is not enabled and hunks in this commit are skipped
Omitted-fix: e4ac7cc6e5a4 ("net: fec: turn on XDP features")
fec does not have XDP support

commit 66c0e13ad236c74ea88c7c1518f3cef7f372e3da
Author: Marek Majtyka <alardam@gmail.com>
Date:   Wed Feb 1 11:24:18 2023 +0100

    drivers: net: turn on XDP features

    A summary of the flags being set for various drivers is given below.
    Note that XDP_F_REDIRECT_TARGET and XDP_F_FRAG_TARGET are features
    that can be turned off and on at runtime. This means that these flags
    may be set and unset under RTNL lock protection by the driver. Hence,
    READ_ONCE must be used by code loading the flag value.

    Also, these flags are not used for synchronization against the availability
    of XDP resources on a device. It is merely a hint, and hence the read
    may race with the actual teardown of XDP resources on the device. This
    may change in the future, e.g. operations taking a reference on the XDP
    resources of the driver, and in turn inhibiting turning off this flag.
    However, for now, it can only be used as a hint to check whether device
    supports becoming a redirection target.

    Turn 'hw-offload' feature flag on for:
     - netronome (nfp)
     - netdevsim.

    Turn 'native' and 'zerocopy' features flags on for:
     - intel (i40e, ice, ixgbe, igc)
     - mellanox (mlx5).
     - stmmac
     - netronome (nfp)

    Turn 'native' features flags on for:
     - amazon (ena)
     - broadcom (bnxt)
     - freescale (dpaa, dpaa2, enetc)
     - funeth
     - intel (igb)
     - marvell (mvneta, mvpp2, octeontx2)
     - mellanox (mlx4)
     - mtk_eth_soc
     - qlogic (qede)
     - sfc
     - socionext (netsec)
     - ti (cpsw)
     - tap
     - tsnep
     - veth
     - xen
     - virtio_net.

    Turn 'basic' (tx, pass, aborted and drop) features flags on for:
     - netronome (nfp)
     - cavium (thunder)
     - hyperv.

    Turn 'redirect_target' feature flag on for:
     - amanzon (ena)
     - broadcom (bnxt)
     - freescale (dpaa, dpaa2)
     - intel (i40e, ice, igb, ixgbe)
     - ti (cpsw)
     - marvell (mvneta, mvpp2)
     - sfc
     - socionext (netsec)
     - qlogic (qede)
     - mellanox (mlx5)
     - tap
     - veth
     - virtio_net
     - xen

    Reviewed-by: Gerhard Engleder <gerhard@engleder-embedded.com>
    Reviewed-by: Simon Horman <simon.horman@corigine.com>
    Acked-by: Stanislav Fomichev <sdf@google.com>
    Acked-by: Jakub Kicinski <kuba@kernel.org>
    Co-developed-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
    Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
    Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
    Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
    Signed-off-by: Marek Majtyka <alardam@gmail.com>
    Link: https://lore.kernel.org/r/3eca9fafb308462f7edb1f58e451d59209aa07eb.1675245258.git.lorenzo@kernel.org
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Signed-off-by: Felix Maurer <fmaurer@redhat.com>
2023-06-14 10:33:43 +02:00
Antoine Tenart 5add198a4d net: tun: rebuild error handling in tun_get_user
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2184073
Upstream Status: linux.git

commit ab00af85d2f886a8e4ace1342d9cc2b232eab6a8
Author: Chuang Wang <nashuiliang@gmail.com>
Date:   Thu Nov 10 15:31:25 2022 +0800

    net: tun: rebuild error handling in tun_get_user

    The error handling in tun_get_user is very scattered.
    This patch unifies error handling, reduces duplication of code, and
    makes the logic clearer.

    Signed-off-by: Chuang Wang <nashuiliang@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Antoine Tenart <atenart@redhat.com>
2023-06-02 14:52:02 +02:00
Paolo Abeni c7063c2776 tun: tun_chr_open(): correctly initialize socket uid
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2188560
Tested: LNST, Tier1

Upstream commit:
commit a096ccca6e503a5c575717ff8a36ace27510ab0a
Author: Pietro Borrello <borrello@diag.uniroma1.it>
Date:   Sat Feb 4 17:39:21 2023 +0000

    tun: tun_chr_open(): correctly initialize socket uid

    sock_init_data() assumes that the `struct socket` passed in input is
    contained in a `struct socket_alloc` allocated with sock_alloc().
    However, tun_chr_open() passes a `struct socket` embedded in a `struct
    tun_file` allocated with sk_alloc().
    This causes a type confusion when issuing a container_of() with
    SOCK_INODE() in sock_init_data() which results in assigning a wrong
    sk_uid to the `struct sock` in input.
    On default configuration, the type confused field overlaps with the
    high 4 bytes of `struct tun_struct __rcu *tun` of `struct tun_file`,
    NULL at the time of call, which makes the uid of all tun sockets 0,
    i.e., the root one.
    Fix the assignment by using sock_init_data_uid().

    Fixes: 86741ec254 ("net: core: Add a UID field to struct sock.")
    Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2023-05-02 19:07:41 +02:00
Herton R. Krzesinski b41e114a5f Merge tag 'kernel-5.14.0-284.6.1.el9_2' from 9.2
Bring in changes from 9.2 tag kernel-5.14.0-284.6.1.el9_2.

The change to Makefile.rhelver was dropped since it is not applicable to
centos stream 9.

Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
2023-03-29 15:13:33 -03:00
Ivan Vecera d1e58e3d4c net: move from strlcpy with unused retval to strscpy
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2175236

Conflicts:
- hunk for vmxnet3 was omitted as it is already applied

commit fb3ceec187e8bca474340e361a18163a2e79c0a2
Author: Wolfram Sang <wsa+renesas@sang-engineering.com>
Date:   Tue Aug 30 22:14:52 2022 +0200

    net: move from strlcpy with unused retval to strscpy

    Follow the advice of the below link and prefer 'strscpy' in this
    subsystem. Conversion is 1:1 because the return value is not used.
    Generated by a coccinelle script.

    Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/
    Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
    Acked-by: Marc Kleine-Budde <mkl@pengutronix.de> # for CAN
    Link: https://lore.kernel.org/r/20220830201457.7984-1-wsa+renesas@sang-engineering.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Ivan Vecera <ivecera@redhat.com>
2023-03-14 14:32:35 +01:00
Jon Maloy 83adef6bd5 tun: avoid double free in tun_free_netdev
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2156374
Upstream: Merged
CVE: CVE-2022-4744

commit 158b515f703e75e7d68289bf4d98c664e1d632df
Author: George Kennedy <george.kennedy@oracle.com>
Date:   Thu Dec 16 13:25:32 2021 -0500

    tun: avoid double free in tun_free_netdev

    Avoid double free in tun_free_netdev() by moving the
    dev->tstats and tun->security allocs to a new ndo_init routine
    (tun_net_init()) that will be called by register_netdevice().
    ndo_init is paired with the desctructor (tun_free_netdev()),
    so if there's an error in register_netdevice() the destructor
    will handle the frees.

    BUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605

    CPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1
    Hardware name: Red Hat KVM, BIOS
    Call Trace:
    <TASK>
    __dump_stack lib/dump_stack.c:88 [inline]
    dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106
    print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:247
    kasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372
    ____kasan_slab_free mm/kasan/common.c:346 [inline]
    __kasan_slab_free+0x107/0x120 mm/kasan/common.c:374
    kasan_slab_free include/linux/kasan.h:235 [inline]
    slab_free_hook mm/slub.c:1723 [inline]
    slab_free_freelist_hook mm/slub.c:1749 [inline]
    slab_free mm/slub.c:3513 [inline]
    kfree+0xac/0x2d0 mm/slub.c:4561
    selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605
    security_tun_dev_free_security+0x4f/0x90 security/security.c:2342
    tun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215
    netdev_run_todo+0x4df/0x840 net/core/dev.c:10627
    rtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112
    __tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302
    tun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:874 [inline]
    __se_sys_ioctl fs/ioctl.c:860 [inline]
    __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x44/0xae

    Reported-by: syzkaller <syzkaller@googlegroups.com>
    Signed-off-by: George Kennedy <george.kennedy@oracle.com>
    Suggested-by: Jakub Kicinski <kuba@kernel.org>
    Link: https://lore.kernel.org/r/1639679132-19884-1-git-send-email-george.kennedy@oracle.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Jon Maloy <jmaloy@redhat.com>
2023-03-10 15:10:34 -05:00
Felix Maurer a320271336 net: add per-cpu storage and net->core_stats
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2130850
Conflicts:
- drivers/net/vxlan.c: file is not moved to drivers/net/vxlan/vxlan_core.c
  due to missing 6765393614ea8 ("vxlan: move to its own directory");
  context difference due to missing 4095e0e1328a3 ("drivers: vxlan:
  vnifilter: per vni stats")
- net/core/dev.c: code difference in __netif_receive_skb_core due to
  already applied 9f8ed577c2881 ("net: skb: rename
  SKB_DROP_REASON_PTYPE_ABSENT"). Result is like upstream now.
- net/core/gro_cells.c: context difference due to already applied
  5dcd08cd1991 ("net: Fix data-races around netdev_max_backlog.")

commit 625788b5844511cf4c30cffa7fa0bc3a69cebc82
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Mar 10 21:14:20 2022 -0800

    net: add per-cpu storage and net->core_stats

    Before adding yet another possibly contended atomic_long_t,
    it is time to add per-cpu storage for existing ones:
     dev->tx_dropped, dev->rx_dropped, and dev->rx_nohandler

    Because many devices do not have to increment such counters,
    allocate the per-cpu storage on demand, so that dev_get_stats()
    does not have to spend considerable time folding zero counters.

    Note that some drivers have abused these counters which
    were supposed to be only used by core networking stack.

    v4: should use per_cpu_ptr() in dev_get_stats() (Jakub)
    v3: added a READ_ONCE() in netdev_core_stats_alloc() (Paolo)
    v2: add a missing include (reported by kernel test robot <lkp@intel.com>)
        Change in netdev_core_stats_alloc() (Jakub)

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: jeffreyji <jeffreyji@google.com>
    Reviewed-by: Brian Vazquez <brianvv@google.com>
    Reviewed-by: Jakub Kicinski <kuba@kernel.org>
    Acked-by: Paolo Abeni <pabeni@redhat.com>
    Link: https://lore.kernel.org/r/20220311051420.2608812-1-eric.dumazet@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Felix Maurer <fmaurer@redhat.com>
2022-11-30 12:47:10 +02:00
Íñigo Huguet a1786575ab net: switch to netif_napi_add_tx()
Bugzilla: https://bugzilla.redhat.com/2139498

Conflicts:
 - removed hunks from missing drivers: fungible/funeth
 - removed hunks from unsupported driver/devices: lantiq, all from TI

commit 16d083e28f1a4f6deef82be92d6a0f5aa2fe7e08
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Wed May 4 09:37:24 2022 -0700

    net: switch to netif_napi_add_tx()
    
    Switch net callers to the new API not requiring
    the NAPI_POLL_WEIGHT argument.
    
    Acked-by: Florian Fainelli <f.fainelli@gmail.com>
    Reviewed-by: Alex Elder <elder@linaro.org>
    Acked-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
    Acked-by: Alexandra Winter <wintera@linux.ibm.com>
    Link: https://lore.kernel.org/r/20220504163725.550782-1-kuba@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
2022-11-04 16:46:34 +01:00
Antoine Tenart 05597ff98d net: tun: track dropped skb via kfree_skb_reason()
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2059161
Upstream Status: linux.git

commit 4b4f052e2d89c2eb7e13ee28ba9e85f8097aef3d
Author: Dongli Zhang <dongli.zhang@oracle.com>
Date:   Fri Mar 4 06:55:07 2022 -0800

    net: tun: track dropped skb via kfree_skb_reason()

    The TUN can be used as vhost-net backend. E.g, the tun_net_xmit() is the
    interface to forward the skb from TUN to vhost-net/virtio-net.

    However, there are many "goto drop" in the TUN driver. Therefore, the
    kfree_skb_reason() is involved at each "goto drop" to help userspace
    ftrace/ebpf to track the reason for the loss of packets.

    The below reasons are introduced:

    - SKB_DROP_REASON_DEV_READY
    - SKB_DROP_REASON_NOMEM
    - SKB_DROP_REASON_HDR_TRUNC
    - SKB_DROP_REASON_TAP_FILTER
    - SKB_DROP_REASON_TAP_TXFILTER

    Cc: Joao Martins <joao.m.martins@oracle.com>
    Cc: Joe Jin <joe.jin@oracle.com>
    Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Antoine Tenart <atenart@redhat.com>
2022-10-13 14:53:24 +02:00
Antoine Tenart f2b6f74262 net: tun: split run_ebpf_filter() and pskb_trim() into different "if statement"
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2059161
Upstream Status: linux.git

commit 45a15d89fbcd280571eba8e5ca309e14ba6afa8f
Author: Dongli Zhang <dongli.zhang@oracle.com>
Date:   Fri Mar 4 06:55:06 2022 -0800

    net: tun: split run_ebpf_filter() and pskb_trim() into different "if statement"

    No functional change.

    Just to split the if statement into different conditions to use
    kfree_skb_reason() to trace the reason later.

    Cc: Joao Martins <joao.m.martins@oracle.com>
    Cc: Joe Jin <joe.jin@oracle.com>
    Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Antoine Tenart <atenart@redhat.com>
2022-10-13 14:53:23 +02:00
Ivan Vecera ca7c7d9c0c bpf: Let bpf_warn_invalid_xdp_action() report more info
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2073454

Conflicts:
- N/A hunk for unsupported octeontx2 driver omitted

commit c8064e5b4adac5e1255cf4f3b374e75b5376e7ca
Author: Paolo Abeni <pabeni@redhat.com>
Date:   Tue Nov 30 11:08:07 2021 +0100

    bpf: Let bpf_warn_invalid_xdp_action() report more info

    In non trivial scenarios, the action id alone is not sufficient to
    identify the program causing the warning. Before the previous patch,
    the generated stack-trace pointed out at least the involved device
    driver.

    Let's additionally include the program name and id, and the relevant
    device name.

    If the user needs additional infos, he can fetch them via a kernel
    probe, leveraging the arguments added here.

    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
    Link: https://lore.kernel.org/bpf/ddb96bb975cbfddb1546cf5da60e77d5100b533c.1638189075.git.pabeni@redhat.com

Signed-off-by: Ivan Vecera <ivecera@redhat.com>
2022-06-28 16:13:14 +02:00
Petr Oros 4e79867c2b tun: vxlan: Use netif_rx().
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2089703

Conflicts:
- adjusted context conflict due to missing 4095e0e1328a3c ("drivers:
  vxlan: vnifilter: per vni stats")

Upstream commit(s):
commit 3d391f6518fddcd44367d463aa20a50145f3ea3f
Author: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date:   Sun Mar 6 22:57:46 2022 +0100

    tun: vxlan: Use netif_rx().

    Since commit
       baebdf48c3600 ("net: dev: Makes sure netif_rx() can be invoked in any context.")

    the function netif_rx() can be used in preemptible/thread context as
    well as in interrupt context.

    Use netif_rx().

    Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Petr Oros <poros@redhat.com>
2022-06-06 11:54:25 +02:00
Ivan Vecera d538653dc4 tun: annotate access to queue->trans_start
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2073453

commit 968a1a5d6541cd24e37dadc1926eab9c10aeb09b
Author: Antoine Tenart <atenart@kernel.org>
Date:   Tue Apr 12 15:58:52 2022 +0200

    tun: annotate access to queue->trans_start

    Commit 5337824f4dc4 ("net: annotate accesses to queue->trans_start")
    introduced a new helper, txq_trans_cond_update, to update
    queue->trans_start using WRITE_ONCE. One snippet in drivers/net/tun.c
    was missed, as it was introduced roughly at the same time.

    Fixes: 5337824f4dc4 ("net: annotate accesses to queue->trans_start")
    Cc: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Antoine Tenart <atenart@kernel.org>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Link: https://lore.kernel.org/r/20220412135852.466386-1-atenart@kernel.org
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Signed-off-by: Ivan Vecera <ivecera@redhat.com>
2022-04-14 15:07:26 +02:00
Patrick Talbert 51077118a2 Merge: CNB: ethtool: update ethtool core to upstream v5.16
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/446

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2047636  
Tested: Manually - ethtool tasks (link config, coalesce params, etc) using mlxsw and ixgbe drivers  

This series updates ethtool core to upstream 5.16 + follow-ups.

Signed-off-by: Ivan Vecera <ivecera@redhat.com>

Approved-by: Petr Oros <poros@redhat.com>
Approved-by: Corinna Vinschen <vinschen@redhat.com>
Approved-by: Jarod Wilson <jarod@redhat.com>
Approved-by: Kamal Heib <kheib@redhat.com>
Approved-by: John W. Linville <linville@redhat.com>
Approved-by: Tony Camuso <tcamuso@redhat.com>

Signed-off-by: Patrick Talbert <ptalbert@redhat.com>
2022-04-04 09:15:27 +00:00
Jonathan Toppins 340add15df tun: fix bonding active backup with arp monitoring
As stated in the bonding doc, trans_start must be set manually for drivers
using NETIF_F_LLTX:
 Drivers that use NETIF_F_LLTX flag must also update
 netdev_queue->trans_start. If they do not, then the ARP monitor will
 immediately fail any slaves using that driver, and those slaves will stay
 down.

Link: https://www.kernel.org/doc/html/v5.15/networking/bonding.html#arp-monitor-operation
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit a31d27fbed5d518734cb60956303eb15089a7634)
Signed-off-by: Jonathan Toppins <jtoppins@redhat.com>
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2050837
Tested: compile only
2022-02-04 13:32:53 -05:00
Ivan Vecera 7654a263b3 ethtool: extend coalesce setting uAPI with CQE mode
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2047636

commit f3ccfda1931977b80267ba54070a1aeafa18f6ca
Author: Yufeng Mo <moyufeng@huawei.com>
Date:   Fri Aug 20 15:35:18 2021 +0800

    ethtool: extend coalesce setting uAPI with CQE mode

    In order to support more coalesce parameters through netlink,
    add two new parameter kernel_coal and extack for .set_coalesce
    and .get_coalesce, then some extra info can return to user with
    the netlink API.

    Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
    Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Ivan Vecera <ivecera@redhat.com>
2022-01-28 15:55:55 +01:00
YueHaibing bc6d076daa tun: use DEVICE_ATTR_RO macro
Use DEVICE_ATTR_RO helper instead of plain DEVICE_ATTR,
which makes the code a bit shorter and easier to read.

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-05-19 12:01:44 -07:00
Yang Li 808337bec7 net: tun: Remove redundant assignment to ret
Variable 'ret' is set to zero but this value is never read as it is
overwritten with a new value later on, hence it is a redundant
assignment and can be removed.

Cleans up the following clang-analyzer warning:

drivers/net/tun.c:3008:2: warning: Value stored to 'ret' is never read
[clang-analyzer-deadcode.DeadStores]

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
Link: https://lore.kernel.org/r/1619603852-114996-1-git-send-email-yang.lee@linux.alibaba.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-04-28 13:58:58 -07:00
Jakub Kicinski 8859a44ea0 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Conflicts:

MAINTAINERS
 - keep Chandrasekar
drivers/net/ethernet/mellanox/mlx5/core/en_main.c
 - simple fix + trust the code re-added to param.c in -next is fine
include/linux/bpf.h
 - trivial
include/linux/ethtool.h
 - trivial, fix kdoc while at it
include/linux/skmsg.h
 - move to relevant place in tcp.c, comment re-wrapped
net/core/skmsg.c
 - add the sk = sk // sk = NULL around calls
net/tipc/crypto.c
 - trivial

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-04-09 20:48:35 -07:00
Phillip Potter cca8ea3b05 net: tun: set tun->dev->addr_len during TUNSETLINK processing
When changing type with TUNSETLINK ioctl command, set tun->dev->addr_len
to match the appropriate type, using new tun_get_addr_len utility function
which returns appropriate address length for given type. Fixes a
KMSAN-found uninit-value bug reported by syzbot at:
https://syzkaller.appspot.com/bug?id=0766d38c656abeace60621896d705743aeefed51

Reported-by: syzbot+001516d86dbe88862cec@syzkaller.appspotmail.com
Diagnosed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-04-06 16:52:21 -07:00
Lorenzo Bianconi fdc13979f9 bpf, devmap: Move drop error path to devmap for XDP_REDIRECT
We want to change the current ndo_xdp_xmit drop semantics because it will
allow us to implement better queue overflow handling. This is working
towards the larger goal of a XDP TX queue-hook. Move XDP_REDIRECT error
path handling from each XDP ethernet driver to devmap code. According to
the new APIs, the driver running the ndo_xdp_xmit pointer, will break tx
loop whenever the hw reports a tx error and it will just return to devmap
caller the number of successfully transmitted frames. It will be devmap
responsibility to free dropped frames.

Move each XDP ndo_xdp_xmit capable driver to the new APIs:

- veth
- virtio-net
- mvneta
- mvpp2
- socionext
- amazon ena
- bnxt
- freescale (dpaa2, dpaa)
- xen-frontend
- qede
- ice
- igb
- ixgbe
- i40e
- mlx5
- ti (cpsw, cpsw-new)
- tun
- sfc

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Camelia Groza <camelia.groza@nxp.com>
Acked-by: Edward Cree <ecree.xilinx@gmail.com>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: Shay Agroskin <shayagr@amazon.com>
Link: https://lore.kernel.org/bpf/ed670de24f951cfd77590decf0229a0ad7fd12f6.1615201152.git.lorenzo@kernel.org
2021-03-18 16:38:51 +01:00
Cong Wang 3b23a32a63 net: fix dev_ifsioc_locked() race condition
dev_ifsioc_locked() is called with only RCU read lock, so when
there is a parallel writer changing the mac address, it could
get a partially updated mac address, as shown below:

Thread 1			Thread 2
// eth_commit_mac_addr_change()
memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
				// dev_ifsioc_locked()
				memcpy(ifr->ifr_hwaddr.sa_data,
					dev->dev_addr,...);

Close this race condition by guarding them with a RW semaphore,
like netdev_get_name(). We can not use seqlock here as it does not
allow blocking. The writers already take RTNL anyway, so this does
not affect the slow path. To avoid bothering existing
dev_set_mac_address() callers in drivers, introduce a new wrapper
just for user-facing callers on ioctl and rtnetlink paths.

Note, bonding also changes slave mac addresses but that requires
a separate patch due to the complexity of bonding code.

Fixes: 3710becf8a ("net: RCU locking for simple ioctl()")
Reported-by: "Gong, Sishuai" <sishuai@purdue.edu>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-02-11 18:14:19 -08:00
Menglong Dong c2e315b8c3 net: tun: fix misspellings using codespell tool
Some typos are found out by codespell tool:

$ codespell -w -i 3 ./drivers/net/tun.c
aovid  ==> avoid

Fix typos found by codespell.

Signed-off-by: Menglong Dong <dong.menglong@zte.com.cn>
Link: https://lore.kernel.org/r/20210118111539.35886-1-dong.menglong@zte.com.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-01-19 17:43:56 -08:00
Lorenzo Bianconi be9df4aff6 net, xdp: Introduce xdp_prepare_buff utility routine
Introduce xdp_prepare_buff utility routine to initialize per-descriptor
xdp_buff fields (e.g. xdp_buff pointers). Rely on xdp_prepare_buff() in
all XDP capable drivers.

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Shay Agroskin <shayagr@amazon.com>
Acked-by: Martin Habets <habetsm.xilinx@gmail.com>
Acked-by: Camelia Groza <camelia.groza@nxp.com>
Acked-by: Marcin Wojtas <mw@semihalf.com>
Link: https://lore.kernel.org/bpf/45f46f12295972a97da8ca01990b3e71501e9d89.1608670965.git.lorenzo@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2021-01-08 13:39:24 -08:00
Lorenzo Bianconi 43b5169d83 net, xdp: Introduce xdp_init_buff utility routine
Introduce xdp_init_buff utility routine to initialize xdp_buff fields
const over NAPI iterations (e.g. frame_sz or rxq pointer). Rely on
xdp_init_buff in all XDP capable drivers.

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Shay Agroskin <shayagr@amazon.com>
Acked-by: Martin Habets <habetsm.xilinx@gmail.com>
Acked-by: Camelia Groza <camelia.groza@nxp.com>
Acked-by: Marcin Wojtas <mw@semihalf.com>
Link: https://lore.kernel.org/bpf/7f8329b6da1434dc2b05a77f2e800b29628a8913.1608670965.git.lorenzo@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2021-01-08 13:39:24 -08:00
Jonathan Lemon 9ee5e5ade0 tap/tun: add skb_zcopy_init() helper for initialization.
Replace direct assignments with skb_zcopy_init() for zerocopy
cases where a new skb is initialized, without changing the
reference counts.

Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-01-07 16:08:37 -08:00
Jonathan Lemon 06b4feb37e net: group skb_shinfo zerocopy related bits together.
In preparation for expanded zerocopy (TX and RX), move
the zerocopy related bits out of tx_flags into their own
flag word.

Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-01-07 16:08:37 -08:00
Jonathan Lemon 36177832f4 skbuff: Add skb parameter to the ubuf zerocopy callback
Add an optional skb parameter to the zerocopy callback parameter,
which is passed down from skb_zcopy_clear().  This gives access
to the original skb, which is needed for upcoming RX zero-copy
error handling.

Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-01-07 16:06:37 -08:00
Yunjian Wang 950271d7cc tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS
Currently the tun_napi_alloc_frags() function returns -ENOMEM when the
number of iovs exceeds MAX_SKB_FRAGS + 1. However this is inappropriate,
we should use -EMSGSIZE instead of -ENOMEM.

The following distinctions are matters:
1. the caller need to drop the bad packet when -EMSGSIZE is returned,
   which means meeting a persistent failure.
2. the caller can try again when -ENOMEM is returned, which means
   meeting a transient failure.

Fixes: 90e33d4594 ("tun: enable napi_gro_frags() for TUN/TAP driver")
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://lore.kernel.org/r/1608864736-24332-1-git-send-email-wangyunjian@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-12-28 13:34:36 -08:00
Jakub Kicinski a1dd1d8697 Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
Alexei Starovoitov says:

====================
pull-request: bpf-next 2020-12-03

The main changes are:

1) Support BTF in kernel modules, from Andrii.

2) Introduce preferred busy-polling, from Björn.

3) bpf_ima_inode_hash() and bpf_bprm_opts_set() helpers, from KP Singh.

4) Memcg-based memory accounting for bpf objects, from Roman.

5) Allow bpf_{s,g}etsockopt from cgroup bind{4,6} hooks, from Stanislav.

* https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (118 commits)
  selftests/bpf: Fix invalid use of strncat in test_sockmap
  libbpf: Use memcpy instead of strncpy to please GCC
  selftests/bpf: Add fentry/fexit/fmod_ret selftest for kernel module
  selftests/bpf: Add tp_btf CO-RE reloc test for modules
  libbpf: Support attachment of BPF tracing programs to kernel modules
  libbpf: Factor out low-level BPF program loading helper
  bpf: Allow to specify kernel module BTFs when attaching BPF programs
  bpf: Remove hard-coded btf_vmlinux assumption from BPF verifier
  selftests/bpf: Add CO-RE relocs selftest relying on kernel module BTF
  selftests/bpf: Add support for marking sub-tests as skipped
  selftests/bpf: Add bpf_testmod kernel module for testing
  libbpf: Add kernel module BTF support for CO-RE relocations
  libbpf: Refactor CO-RE relocs to not assume a single BTF object
  libbpf: Add internal helper to load BTF data by FD
  bpf: Keep module's btf_data_size intact after load
  bpf: Fix bpf_put_raw_tracepoint()'s use of __module_address()
  selftests/bpf: Add Userspace tests for TCP_WINDOW_CLAMP
  bpf: Adds support for setting window clamp
  samples/bpf: Fix spelling mistake "recieving" -> "receiving"
  bpf: Fix cold build of test_progs-no_alu32
  ...
====================

Link: https://lore.kernel.org/r/20201204021936.85653-1-alexei.starovoitov@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-12-04 07:48:12 -08:00
Björn Töpel b02e5a0ebb xsk: Propagate napi_id to XDP socket Rx path
Add napi_id to the xdp_rxq_info structure, and make sure the XDP
socket pick up the napi_id in the Rx path. The napi_id is used to find
the corresponding NAPI structure for socket busy polling.

Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://lore.kernel.org/bpf/20201130185205.196029-7-bjorn.topel@gmail.com
2020-12-01 00:09:25 +01:00
Jakub Kicinski 5c39f26e67 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Trivial conflict in CAN, keep the net-next + the byteswap wrapper.

Conflicts:
	drivers/net/can/usb/gs_usb.c

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-11-27 18:25:27 -08:00
Martin Schiller 8e1e33ffa6 net/tun: Call type change netdev notifiers
Call netdev notifiers before and after changing the device type.

Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Link: https://lore.kernel.org/r/20201118063919.29485-1-ms@dev.tdt.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-11-23 10:32:39 -08:00
Jens Axboe 5aac0390a6 tun: honor IOCB_NOWAIT flag
tun only checks the file O_NONBLOCK flag, but it should also be checking
the iocb IOCB_NOWAIT flag. Any fops using ->read/write_iter() should check
both, otherwise it breaks users that correctly expect O_NONBLOCK semantics
if IOCB_NOWAIT is set.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
Link: https://lore.kernel.org/r/e9451860-96cc-c7c7-47b8-fe42cadd5f4c@kernel.dk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-11-21 15:19:08 -08:00
Heiner Kallweit 497a5757ce tun: switch to net core provided statistics counters
Switch tun to the standard statistics pattern:
- use netdev->stats for the less frequently accessed counters
- use netdev->tstats for the frequently accessed per-cpu counters

v3:
- add atomic_long_t member rx_frame_errors for making counter updates
  atomic

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-11-09 17:50:28 -08:00