netdev CI testing #6666

kuba-moo · 2024-03-27T20:02:33Z

Reusable PR for hooking netdev CI to BPF testing.

Add a fixup to the stmmac driver to keep the preamble before the SFD (Start Frame Delimiter) on the Micrel KSZ9131 PHY when the driver is used on an NXP i.MX8MP SoC. This allows to workaround errata ERR050694 of the NXP i.MX8MP that states: ENET_QOS: MAC incorrectly discards the received packets when Preamble Byte does not precede SFD or SMD. The bit which disables this feature is not documented in the datasheet from Micrel, but has been found by NXP and Micrel following this discussion: https://community.nxp.com/t5/i-MX-Processors/iMX8MP-eqos-not-working-for-10base-t/m-p/2151032 It has been tested on Verdin iMX8MP from Toradex by forcing the PHY to 10MBit. Without bit 2 being set in the remote loopback register, no packets are received. With the bit set, reception works fine. Signed-off-by: Stefan Eichenberger <stefan.eichenberger@toradex.com> Signed-off-by: NipaLocal <nipa@local>

__build_id_parse() only works on page-backed storage. Its helper paths eventually call mapping->a_ops->read_folio(), so explicitly reject VMAs that do not map a regular file or lack valid address_space operations. Reported-by: syzbot+e008db2ac01e282550ee@syzkaller.appspotmail.com Signed-off-by: Jinchao Wang <wangjinchao600@gmail.com> Tested-by: <syzbot+e008db2ac01e282550ee@syzkaller.appspotmail.com> Signed-off-by: Jinchao Wang <wangjinchao600@gmail.com> Reported-by: <syzbot+e008db2ac01e282550ee@syzkaller.appspotmail.com> Tested-by: <syzbot+e008db2ac01e282550ee@syzkaller.appspotmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: NipaLocal <nipa@local>

Implement soft_reset, suspend, and resume callbacks using genphy_soft_reset(), genphy_suspend(), and genphy_resume() to fix PHY initialization and power management issues. The soft_reset callback is needed to properly recover the PHY after an ifconfig down/up cycle. Without it, the PHY can remain in power-down state, causing MDIO register access failures during config_init(). The soft reset ensures the PHY is operational before configuration. The suspend/resume callbacks enable proper power management during system suspend/resume cycles. Fixes: b2908a9 ("net: phy: add driver for MaxLinear MxL86110 PHY") Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Signed-off-by: NipaLocal <nipa@local>

Convert the devicetree bindings for the Micrel PHYs and switches to DT schema. Signed-off-by: Stefan Eichenberger <stefan.eichenberger@toradex.com> Signed-off-by: NipaLocal <nipa@local>

Convert the micrel-ksz90x1.txt to DT schema. Create a separate YAML file for this PHY series. The old naming of ksz90x1 would be misleading in this case, so rename it to gigabit, as it contains ksz9xx1 and lan8xxx gigabit PHYs. Signed-off-by: Stefan Eichenberger <stefan.eichenberger@toradex.com> Signed-off-by: NipaLocal <nipa@local>

Currently, the refill work is a global delayed work for all the receive queues. This commit makes the refill work a per receive queue so that we can manage them separately and avoid further mistakes. It also helps the successfully refilled queue avoid the napi_disable in the global delayed refill work like before. Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com> Signed-off-by: NipaLocal <nipa@local>

Calling napi_disable() on an already disabled napi can cause the deadlock. Because the delayed refill work will call napi_disable(), we must ensure that refill work is only enabled and scheduled after we have enabled the rx queue's NAPI. Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com> Signed-off-by: NipaLocal <nipa@local>

As we need to move the enable_delayed_refill after napi_enable, it's possible that a refill work needs to be scheduled in virtnet_receive but it cannot. This can make the receive side stuck because if we don't have any receive buffers, there will be nothing trigger the refill logic. So in case it happens, in virtnet_receive, set the rx queue's refill_pending, then when the refill work is enabled again, a refill work will be scheduled. Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com> Signed-off-by: NipaLocal <nipa@local>

If the last test fails, the other side still completes correctly, which could lead to false positives. Let's add a final barrier that ensures that the last test has finished correctly on both sides, but also that the two sides agree on the number of tests to be performed. Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: NipaLocal <nipa@local>

Add additional machines that requires communication to the SC firmware to set the GPR bit required for stop mode support. NXP i.MX8DX (fsl,imx8dx) is a low end version of i.MX8QXP (fsl,imx8qxp), while NXP i.MX8QP (fsl,imx8qp) is a low end version of i.MX8QM (fsl,imx8qp). Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Signed-off-by: NipaLocal <nipa@local>

skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[] field. [2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is enabled and the kernel attempts to copy sk_buff.cb data to userspace via sock_recv_errqueue() -> put_cmsg(). The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone() (from skbuff_fclone_cache) [1] 2. The skb is cloned via skb_clone() using the pre-allocated fclone [3] 3. The cloned skb is queued to sk_error_queue for timestamp reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE) 5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb [4] 6. __check_heap_object() fails because skbuff_fclone_cache has no usercopy whitelist [5] When cloned skbs allocated from skbuff_fclone_cache are used in the socket error queue, accessing the sock_exterr_skb structure in skb->cb via put_cmsg() triggers a usercopy hardening violation: [ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 296, size 16)! [ 5.382796] kernel BUG at mm/usercopy.c:102! [ 5.383923] Oops: invalid opcode: 0000 [kernel-patches#1] SMP KASAN NOPTI [ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 kernel-patches#7 [ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80 [ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff <0f> 0b 490 [ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246 [ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74 [ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0 [ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74 [ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001 [ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00 [ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000 [ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0 [ 5.384903] PKRU: 55555554 [ 5.384903] Call Trace: [ 5.384903] <TASK> [ 5.384903] __check_heap_object+0x9a/0xd0 [ 5.384903] __check_object_size+0x46c/0x690 [ 5.384903] put_cmsg+0x129/0x5e0 [ 5.384903] sock_recv_errqueue+0x22f/0x380 [ 5.384903] tls_sw_recvmsg+0x7ed/0x1960 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5.384903] ? schedule+0x6d/0x270 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5.384903] ? mutex_unlock+0x81/0xd0 [ 5.384903] ? __pfx_mutex_unlock+0x10/0x10 [ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10 [ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0 [ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 The crash offset 296 corresponds to skb2->cb within skbuff_fclones: - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 - offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 = 272 + 24 (inside sock_exterr_skb.ee) This patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure. [1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885 [2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104 [3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566 [4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491 [5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719 Fixes: 6d07d1c ("usercopy: Restrict non-usercopy caches to size 0") Reported-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Weiming Shi <bestswngs@gmail.com> Signed-off-by: NipaLocal <nipa@local>

Rely on rcu_replace_pointer in airoha_ppe_deinit routine in order to fix schedule while atomic issue. Fixes: 00a7678 ("net: airoha: Introduce flowtable offload support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: NipaLocal <nipa@local>

Directly increment the TSO features incurs a side effect: it will also directly clear the flags in NETIF_F_ALL_FOR_ALL on the master device, which can cause issues such as the inability to enable the nocache copy feature on the bonding driver. The fix is to include NETIF_F_ALL_FOR_ALL in the update mask, thereby preventing it from being cleared. Fixes: b0ce350 ("bonding: allow TSO being set on bonding master") Signed-off-by: Di Zhu <zhud@hygon.cn> Signed-off-by: NipaLocal <nipa@local>