1. 28 10月, 2021 2 次提交
  2. 23 10月, 2021 4 次提交
  3. 19 10月, 2021 1 次提交
    • L
      devlink: Remove extra device_lock assert checks · cb3dc890
      Leon Romanovsky 提交于
      PCI core code in the pci_call_probe() has a path that doesn't hold
      device_lock. It happens because the ->probe() is called through the
      workqueue mechanism.
      
         349 static int pci_call_probe(struct pci_driver *drv, struct pci_dev *dev,
         350                           const struct pci_device_id *id)
         351 {
         352
      ....
         377         if (cpu < nr_cpu_ids)
         378                 error = work_on_cpu(cpu, local_pci_probe, &ddi);
      
      Luckily enough, the core still ensures that only single flow is executed,
      so it safe to remove the assert checks that anyway were added for annotations
      purposes.
      
      Fixes: b88f7b12 ("devlink: Annotate devlink API calls")
      Reported-by: NAmit Cohen <amcohen@nvidia.com>
      Signed-off-by: NLeon Romanovsky <leonro@nvidia.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      cb3dc890
  4. 13 10月, 2021 5 次提交
  5. 01 10月, 2021 1 次提交
    • J
      devlink: report maximum number of snapshots with regions · a70e3f02
      Jacob Keller 提交于
      Each region has an independently configurable number of maximum
      snapshots. This information is not reported to userspace, making it not
      very discoverable. Fix this by adding a new
      DEVLINK_ATTR_REGION_MAX_SNAPSHOST attribute which is used to report this
      maximum.
      
      Ex:
      
        $devlink region
        pci/0000:af:00.0/nvm-flash: size 10485760 snapshot [] max 1
        pci/0000:af:00.0/device-caps: size 4096 snapshot [] max 10
        pci/0000:af:00.1/nvm-flash: size 10485760 snapshot [] max 1
        pci/0000:af:00.1/device-caps: size 4096 snapshot [] max 10
      
      This information enables users to understand why a new region command
      may fail due to having too many existing snapshots.
      
      Reported-by: Gurucharan G <gurucharanx.g@intel.com> (A Contingent worker at Intel)
      Signed-off-by: NJacob Keller <jacob.e.keller@intel.com>
      Acked-by: NJakub Kicinski <kuba@kernel.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      a70e3f02
  6. 30 9月, 2021 1 次提交
    • L
      devlink: Add missed notifications iterators · ef91abfb
      Leon Romanovsky 提交于
      The commit mentioned in Fixes line missed a couple of notifications that
      were registered before devlink_register() and should be delayed too.
      
      As such, the too early placed WARN_ON() check spotted it.
      
      WARNING: CPU: 1 PID: 6540 at net/core/devlink.c:5158 devlink_nl_region_notify+0x184/0x1e0 net/core/devlink.c:5158
      Modules linked in:
      CPU: 1 PID: 6540 Comm: syz-executor.0 Not tainted 5.15.0-rc2-syzkaller #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      RIP: 0010:devlink_nl_region_notify+0x184/0x1e0 net/core/devlink.c:5158
      Code: 38 41 b8 c0 0c 00 00 31 d2 48 89 ee 4c 89 e7 e8 72 1a 26 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e e9 01 bd 41 fa
      e8 fc bc 41 fa <0f> 0b e9 f7 fe ff ff e8 f0 bc 41 fa 0f 0b eb da 4c 89 e7 e8 c4 18
      RSP: 0018:ffffc90002d6f658 EFLAGS: 00010293
      RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
      RDX: ffff88801f08d580 RSI: ffffffff87344e94 RDI: 0000000000000003
      RBP: ffff88801ee42100 R08: 0000000000000000 R09: 0000000000000000
      R10: ffffffff87344d8a R11: 0000000000000000 R12: ffff88801c1dc000
      R13: 0000000000000000 R14: 000000000000002c R15: ffff88801c1dc070
      FS:  0000555555e8e400(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 000055dd7c590310 CR3: 0000000069a09000 CR4: 00000000003506e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       devlink_region_create+0x39f/0x4c0 net/core/devlink.c:10327
       nsim_dev_dummy_region_init drivers/net/netdevsim/dev.c:481 [inline]
       nsim_dev_probe+0x5f6/0x1150 drivers/net/netdevsim/dev.c:1479
       call_driver_probe drivers/base/dd.c:517 [inline]
       really_probe+0x245/0xcc0 drivers/base/dd.c:596
       __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:751
       driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:781
       __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:898
       bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
       __device_attach+0x228/0x4a0 drivers/base/dd.c:969
       bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
       device_add+0xc35/0x21b0 drivers/base/core.c:3359
       nsim_bus_dev_new drivers/net/netdevsim/bus.c:435 [inline]
       new_device_store+0x48b/0x770 drivers/net/netdevsim/bus.c:302
       bus_attr_store+0x72/0xa0 drivers/base/bus.c:122
       sysfs_kf_write+0x110/0x160 fs/sysfs/file.c:139
       kernfs_fop_write_iter+0x342/0x500 fs/kernfs/file.c:296
       call_write_iter include/linux/fs.h:2163 [inline]
       new_sync_write+0x429/0x660 fs/read_write.c:507
       vfs_write+0x7cf/0xae0 fs/read_write.c:594
       ksys_write+0x12d/0x250 fs/read_write.c:647
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      RIP: 0033:0x7f328409d3ef
      Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01
      00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48
      RSP: 002b:00007ffdc6851140 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
      RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f328409d3ef
      RDX: 0000000000000003 RSI: 00007ffdc6851190 RDI: 0000000000000004
      RBP: 0000000000000004 R08: 0000000000000000 R09: 00007ffdc68510e0
      R10: 0000000000000000 R11: 0000000000000293 R12: 00007f3284144971
      R13: 00007ffdc6851190 R14: 0000000000000000 R15: 00007ffdc6851860
      
      Fixes: cf530217 ("devlink: Notify users when objects are accessible")
      Reported-by: NEric Dumazet <eric.dumazet@gmail.com>
      Tested-by: NVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: NLeon Romanovsky <leonro@nvidia.com>
      Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
      Link: https://lore.kernel.org/r/2ed1159291f2a589b013914f2b60d8172fc525c1.1632925030.git.leonro@nvidia.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
      ef91abfb
  7. 27 9月, 2021 1 次提交
  8. 24 9月, 2021 2 次提交
  9. 22 9月, 2021 1 次提交
  10. 17 9月, 2021 1 次提交
  11. 15 9月, 2021 1 次提交
  12. 14 8月, 2021 5 次提交
  13. 11 8月, 2021 6 次提交
  14. 09 8月, 2021 2 次提交
  15. 08 8月, 2021 1 次提交
  16. 31 7月, 2021 2 次提交
    • L
      devlink: Allocate devlink directly in requested net namespace · 26713455
      Leon Romanovsky 提交于
      There is no need in extra call indirection and check from impossible
      flow where someone tries to set namespace without prior call
      to devlink_alloc().
      
      Instead of this extra logic and additional EXPORT_SYMBOL, use specialized
      devlink allocation function that receives net namespace as an argument.
      
      Such specialized API allows clear view when devlink initialized in wrong
      net namespace and/or kernel users don't try to change devlink namespace
      under the hood.
      Reviewed-by: NJiri Pirko <jiri@nvidia.com>
      Signed-off-by: NLeon Romanovsky <leonro@nvidia.com>
      Signed-off-by: NJakub Kicinski <kuba@kernel.org>
      26713455
    • L
      devlink: Break parameter notification sequence to be before/after unload/load driver · 05a7f4a8
      Leon Romanovsky 提交于
      The change of namespaces during devlink reload calls to driver unload
      before it accesses devlink parameters. The commands below causes to
      use-after-free bug when trying to get flow steering mode.
      
       * ip netns add n1
       * devlink dev reload pci/0000:00:09.0 netns n1
      
       ==================================================================
       BUG: KASAN: use-after-free in mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
       Read of size 4 at addr ffff888009d04308 by task devlink/275
      
       CPU: 6 PID: 275 Comm: devlink Not tainted 5.12.0-rc2+ #2853
       Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
       Call Trace:
        dump_stack+0x93/0xc2
        print_address_description.constprop.0+0x18/0x140
        ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
        ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
        kasan_report.cold+0x7c/0xd8
        ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
        mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
        devlink_nl_param_fill+0x1c8/0xe80
        ? __free_pages_ok+0x37a/0x8a0
        ? devlink_flash_update_timeout_notify+0xd0/0xd0
        ? lock_acquire+0x1a9/0x6d0
        ? fs_reclaim_acquire+0xb7/0x160
        ? lock_is_held_type+0x98/0x110
        ? 0xffffffff81000000
        ? lock_release+0x1f9/0x6c0
        ? fs_reclaim_release+0xa1/0xf0
        ? lock_downgrade+0x6d0/0x6d0
        ? lock_is_held_type+0x98/0x110
        ? lock_is_held_type+0x98/0x110
        ? memset+0x20/0x40
        ? __build_skb_around+0x1f8/0x2b0
        devlink_param_notify+0x6d/0x180
        devlink_reload+0x1c3/0x520
        ? devlink_remote_reload_actions_performed+0x30/0x30
        ? mutex_trylock+0x24b/0x2d0
        ? devlink_nl_cmd_reload+0x62b/0x1070
        devlink_nl_cmd_reload+0x66d/0x1070
        ? devlink_reload+0x520/0x520
        ? devlink_get_from_attrs+0x1bc/0x260
        ? devlink_nl_pre_doit+0x64/0x4d0
        genl_family_rcv_msg_doit+0x1e9/0x2f0
        ? mutex_lock_io_nested+0x1130/0x1130
        ? genl_family_rcv_msg_attrs_parse.constprop.0+0x240/0x240
        ? security_capable+0x51/0x90
        genl_rcv_msg+0x27f/0x4a0
        ? genl_get_cmd+0x3c0/0x3c0
        ? lock_acquire+0x1a9/0x6d0
        ? devlink_reload+0x520/0x520
        ? lock_release+0x6c0/0x6c0
        netlink_rcv_skb+0x11d/0x340
        ? genl_get_cmd+0x3c0/0x3c0
        ? netlink_ack+0x9f0/0x9f0
        ? lock_release+0x1f9/0x6c0
        genl_rcv+0x24/0x40
        netlink_unicast+0x433/0x700
        ? netlink_attachskb+0x730/0x730
        ? _copy_from_iter_full+0x178/0x650
        ? __alloc_skb+0x113/0x2b0
        netlink_sendmsg+0x6f1/0xbd0
        ? netlink_unicast+0x700/0x700
        ? lock_is_held_type+0x98/0x110
        ? netlink_unicast+0x700/0x700
        sock_sendmsg+0xb0/0xe0
        __sys_sendto+0x193/0x240
        ? __x64_sys_getpeername+0xb0/0xb0
        ? do_sys_openat2+0x10b/0x370
        ? __up_read+0x1a1/0x7b0
        ? do_user_addr_fault+0x219/0xdc0
        ? __x64_sys_openat+0x120/0x1d0
        ? __x64_sys_open+0x1a0/0x1a0
        __x64_sys_sendto+0xdd/0x1b0
        ? syscall_enter_from_user_mode+0x1d/0x50
        do_syscall_64+0x2d/0x40
        entry_SYSCALL_64_after_hwframe+0x44/0xae
       RIP: 0033:0x7fc69d0af14a
       Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 c3 0f 1f 44 00 00 55 48 83 ec 30 44 89 4c
       RSP: 002b:00007ffc1d8292f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
       RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fc69d0af14a
       RDX: 0000000000000038 RSI: 0000555f57c56440 RDI: 0000000000000003
       RBP: 0000555f57c56410 R08: 00007fc69d17b200 R09: 000000000000000c
       R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
       R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
      
       Allocated by task 146:
        kasan_save_stack+0x1b/0x40
        __kasan_kmalloc+0x99/0xc0
        mlx5_init_fs+0xf0/0x1c50 [mlx5_core]
        mlx5_load+0xd2/0x180 [mlx5_core]
        mlx5_init_one+0x2f6/0x450 [mlx5_core]
        probe_one+0x47d/0x6e0 [mlx5_core]
        pci_device_probe+0x2a0/0x4a0
        really_probe+0x20a/0xc90
        driver_probe_device+0xd8/0x380
        device_driver_attach+0x1df/0x250
        __driver_attach+0xff/0x240
        bus_for_each_dev+0x11e/0x1a0
        bus_add_driver+0x309/0x570
        driver_register+0x1ee/0x380
        0xffffffffa06b8062
        do_one_initcall+0xd5/0x410
        do_init_module+0x1c8/0x760
        load_module+0x6d8b/0x9650
        __do_sys_finit_module+0x118/0x1b0
        do_syscall_64+0x2d/0x40
        entry_SYSCALL_64_after_hwframe+0x44/0xae
      
       Freed by task 275:
        kasan_save_stack+0x1b/0x40
        kasan_set_track+0x1c/0x30
        kasan_set_free_info+0x20/0x30
        __kasan_slab_free+0x102/0x140
        slab_free_freelist_hook+0x74/0x1b0
        kfree+0xd7/0x2a0
        mlx5_unload+0x16/0xb0 [mlx5_core]
        mlx5_unload_one+0xae/0x120 [mlx5_core]
        mlx5_devlink_reload_down+0x1bc/0x380 [mlx5_core]
        devlink_reload+0x141/0x520
        devlink_nl_cmd_reload+0x66d/0x1070
        genl_family_rcv_msg_doit+0x1e9/0x2f0
        genl_rcv_msg+0x27f/0x4a0
        netlink_rcv_skb+0x11d/0x340
        genl_rcv+0x24/0x40
        netlink_unicast+0x433/0x700
        netlink_sendmsg+0x6f1/0xbd0
        sock_sendmsg+0xb0/0xe0
        __sys_sendto+0x193/0x240
        __x64_sys_sendto+0xdd/0x1b0
        do_syscall_64+0x2d/0x40
        entry_SYSCALL_64_after_hwframe+0x44/0xae
      
       The buggy address belongs to the object at ffff888009d04300
        which belongs to the cache kmalloc-128 of size 128
       The buggy address is located 8 bytes inside of
        128-byte region [ffff888009d04300, ffff888009d04380)
       The buggy address belongs to the page:
       page:0000000086a64ecc refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888009d04000 pfn:0x9d04
       head:0000000086a64ecc order:1 compound_mapcount:0
       flags: 0x4000000000010200(slab|head)
       raw: 4000000000010200 ffffea0000203980 0000000200000002 ffff8880050428c0
       raw: ffff888009d04000 000000008020001d 00000001ffffffff 0000000000000000
       page dumped because: kasan: bad access detected
      
       Memory state around the buggy address:
        ffff888009d04200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
        ffff888009d04280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
       >ffff888009d04300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                             ^
        ffff888009d04380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
        ffff888009d04400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
       ==================================================================
      
      The right solution to devlink reload is to notify about deletion of
      parameters, unload driver, change net namespaces, load driver and notify
      about addition of parameters.
      
      Fixes: 070c63f2 ("net: devlink: allow to change namespaces during reload")
      Reviewed-by: NParav Pandit <parav@nvidia.com>
      Signed-off-by: NLeon Romanovsky <leonro@nvidia.com>
      Signed-off-by: NJakub Kicinski <kuba@kernel.org>
      05a7f4a8
  17. 28 7月, 2021 1 次提交
  18. 25 7月, 2021 1 次提交
  19. 24 6月, 2021 2 次提交