Skip to content
  1. Feb 09, 2024
    • Linus Torvalds's avatar
      Merge tag 'net-6.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 1f719a2f
      Linus Torvalds authored
      Pull networking fixes from Paolo Abeni:
       "Including fixes from WiFi and netfilter.
      
        Current release - regressions:
      
         - nic: intel: fix old compiler regressions
      
         - netfilter: ipset: missing gc cancellations fixed
      
        Current release - new code bugs:
      
         - netfilter: ctnetlink: fix filtering for zone 0
      
        Previous releases - regressions:
      
         - core: fix from address in memcpy_to_iter_csum()
      
         - netfilter: nfnetlink_queue: un-break NF_REPEAT
      
         - af_unix: fix memory leak for dead unix_(sk)->oob_skb in GC.
      
         - devlink: avoid potential loop in devlink_rel_nested_in_notify_work()
      
         - iwlwifi:
             - mvm: fix a battery life regression
             - fix double-free bug
      
         - mac80211: fix waiting for beacons logic
      
         - nic: nfp: flower: prevent re-adding mac index for bonded port
      
        Previous releases - always broken:
      
         - rxrpc: fix generation of serial numbers to skip zero
      
         - tipc: check the bearer type before calling tipc_udp_nl_bearer_add()
      
         - tunnels: fix out of bounds access when building IPv6 PMTU error
      
         - nic: hv_netvsc: register VF in netvsc_probe if NET_DEVICE_REGISTER
           missed
      
         - nic: atlantic: fix DMA mapping for PTP hwts ring
      
        Misc:
      
         - selftests: more fixes to deal with very slow hosts"
      
      * tag 'net-6.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (80 commits)
        netfilter: nft_set_pipapo: remove scratch_aligned pointer
        netfilter: nft_set_pipapo: add helper to release pcpu scratch area
        netfilter: nft_set_pipapo: store index in scratch maps
        netfilter: nft_set_rbtree: skip end interval element from gc
        netfilter: nfnetlink_queue: un-break NF_REPEAT
        netfilter: nf_tables: use timestamp to check for set element timeout
        netfilter: nft_ct: reject direction for ct id
        netfilter: ctnetlink: fix filtering for zone 0
        s390/qeth: Fix potential loss of L3-IP@ in case of network issues
        netfilter: ipset: Missing gc cancellations fixed
        octeontx2-af: Initialize maps.
        net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio
        net: ethernet: ti: cpsw_new: enable mac_managed_pm to fix mdio
        netfilter: nft_set_pipapo: remove static in nft_pipapo_get()
        netfilter: nft_compat: restrict match/target protocol to u16
        netfilter: nft_compat: reject unused compat flag
        netfilter: nft_compat: narrow down revision to unsigned 8-bits
        net: intel: fix old compiler regressions
        MAINTAINERS: Maintainer change for rds
        selftests: cmsg_ipv6: repeat the exact packet
        ...
      1f719a2f
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v6.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · b0d5d0f7
      Linus Torvalds authored
      Pull pinctrl fix from Linus Walleij:
       "A single fix for the AMD driver which affects developer laptops, the
        pinctrl/GPIO driver won't probe on some systems"
      
      * tag 'pinctrl-v6.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: amd: Add IRQF_ONESHOT to the interrupt request
      b0d5d0f7
  2. Feb 08, 2024
  3. Feb 07, 2024
    • Jakub Kicinski's avatar
      selftests: cmsg_ipv6: repeat the exact packet · 4b00d0c5
      Jakub Kicinski authored
      cmsg_ipv6 test requests tcpdump to capture 4 packets,
      and sends until tcpdump quits. Only the first packet
      is "real", however, and the rest are basic UDP packets.
      So if tcpdump doesn't start in time it will miss
      the real packet and only capture the UDP ones.
      
      This makes the test fail on slow machine (no KVM or with
      debug enabled) 100% of the time, while it passes in fast
      environments.
      
      Repeat the "real" / expected packet.
      
      Fixes: 9657ad09 ("selftests: net: test IPV6_TCLASS")
      Fixes: 05ae83d5
      
       ("selftests: net: test IPV6_HOPLIMIT")
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      Reviewed-by: default avatarSimon Horman <horms@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4b00d0c5
    • Petr Tesarik's avatar
      net: stmmac: protect updates of 64-bit statistics counters · 38cc3c6d
      Petr Tesarik authored
      As explained by a comment in <linux/u64_stats_sync.h>, write side of struct
      u64_stats_sync must ensure mutual exclusion, or one seqcount update could
      be lost on 32-bit platforms, thus blocking readers forever. Such lockups
      have been observed in real world after stmmac_xmit() on one CPU raced with
      stmmac_napi_poll_tx() on another CPU.
      
      To fix the issue without introducing a new lock, split the statics into
      three parts:
      
      1. fields updated only under the tx queue lock,
      2. fields updated only during NAPI poll,
      3. fields updated only from interrupt context,
      
      Updates to fields in the first two groups are already serialized through
      other locks. It is sufficient to split the existing struct u64_stats_sync
      so that each group has its own.
      
      Note that tx_set_ic_bit is updated from both contexts. Split this counter
      so that each context gets its own, and calculate their sum to get the total
      value in stmmac_get_ethtool_stats().
      
      For the third group, multiple interrupts may be processed by different CPUs
      at the same time, but interrupts on the same CPU will not nest. Move fields
      from this group to a newly created per-cpu struct stmmac_pcpu_stats.
      
      Fixes: 133466c3 ("net: stmmac: use per-queue 64 bit statistics where necessary")
      Link: https://lore.kernel.org/netdev/Za173PhviYg-1qIn@torres.zugschlus.de/t/
      
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPetr Tesarik <petr@tesarici.cz>
      Reviewed-by: default avatarJisheng Zhang <jszhang@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      38cc3c6d
    • Linus Torvalds's avatar
      Merge tag 'for-6.8-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 6d280f4d
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
      
       - two fixes preventing deletion and manual creation of subvolume qgroup
      
       - unify error code returned for unknown send flags
      
       - fix assertion during subvolume creation when anonymous device could
         be allocated by other thread (e.g. due to backref walk)
      
      * tag 'for-6.8-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: do not ASSERT() if the newly created subvolume already got read
        btrfs: forbid deleting live subvol qgroup
        btrfs: forbid creating subvol qgroups
        btrfs: send: return EOPNOTSUPP on unknown flags
      6d280f4d
    • Eric Dumazet's avatar
      ppp_async: limit MRU to 64K · cb88cb53
      Eric Dumazet authored
      syzbot triggered a warning [1] in __alloc_pages():
      
      WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)
      
      Willem fixed a similar issue in commit c0a2a1b0 ("ppp: limit MRU to 64K")
      
      Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)
      
      [1]:
      
       WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543
      Modules linked in:
      CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
      Workqueue: events_unbound flush_to_ldisc
      pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
       pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543
       lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537
      sp : ffff800093967580
      x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000
      x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0
      x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8
      x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120
      x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005
      x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000
      x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001
      x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f
      x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020
      x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0
      Call trace:
        __alloc_pages+0x308/0x698 mm/page_alloc.c:4543
        __alloc_pages_node include/linux/gfp.h:238 [inline]
        alloc_pages_node include/linux/gfp.h:261 [inline]
        __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926
        __do_kmalloc_node mm/slub.c:3969 [inline]
        __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001
        kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590
        __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651
        __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715
        netdev_alloc_skb include/linux/skbuff.h:3235 [inline]
        dev_alloc_skb include/linux/skbuff.h:3248 [inline]
        ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline]
        ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341
        tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390
        tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37
        receive_buf drivers/tty/tty_buffer.c:444 [inline]
        flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494
        process_one_work+0x694/0x1204 kernel/workqueue.c:2633
        process_scheduled_works kernel/workqueue.c:2706 [inline]
        worker_thread+0x938/0xef4 kernel/workqueue.c:2787
        kthread+0x288/0x310 kernel/kthread.c:388
        ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
      
      Fixes: 1da177e4
      
       ("Linux-2.6.12-rc2")
      Reported-and-tested-by: default avatar <syzbot+c5da1f087c9e4ec6c933@syzkaller.appspotmail.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reviewed-by: default avatarWillem de Bruijn <willemb@google.com>
      Link: https://lore.kernel.org/r/20240205171004.1059724-1-edumazet@google.com
      
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      cb88cb53
    • Jiri Pirko's avatar
      devlink: avoid potential loop in devlink_rel_nested_in_notify_work() · 58086721
      Jiri Pirko authored
      
      
      In case devlink_rel_nested_in_notify_work() can not take the devlink
      lock mutex. Convert the work to delayed work and in case of reschedule
      do it jiffie later and avoid potential looping.
      
      Suggested-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Fixes: c137743b
      
       ("devlink: introduce object and nested devlink relationship infra")
      Signed-off-by: default avatarJiri Pirko <jiri@nvidia.com>
      Link: https://lore.kernel.org/r/20240205171114.338679-1-jiri@resnulli.us
      
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      58086721
    • Kuniyuki Iwashima's avatar
      af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC. · 1279f9d9
      Kuniyuki Iwashima authored
      syzbot reported a warning [0] in __unix_gc() with a repro, which
      creates a socketpair and sends one socket's fd to itself using the
      peer.
      
        socketpair(AF_UNIX, SOCK_STREAM, 0, [3, 4]) = 0
        sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\360", iov_len=1}],
                msg_iovlen=1, msg_control=[{cmsg_len=20, cmsg_level=SOL_SOCKET,
                                            cmsg_type=SCM_RIGHTS, cmsg_data=[3]}],
                msg_controllen=24, msg_flags=0}, MSG_OOB|MSG_PROBE|MSG_DONTWAIT|MSG_ZEROCOPY) = 1
      
      This forms a self-cyclic reference that GC should finally untangle
      but does not due to lack of MSG_OOB handling, resulting in memory
      leak.
      
      Recently, commit 11498715 ("af_unix: Remove io_uring code for
      GC.") removed io_uring's dead code in GC and revealed the problem.
      
      The code was executed at the final stage of GC and unconditionally
      moved all GC candidates from gc_candidates to gc_inflight_list.
      That papered over the reported problem by always making the following
      WARN_ON_ONCE(!list_empty(&gc_candidates)) false.
      
      The problem has been there since commit 2aab4b96
      
       ("af_unix: fix
      struct pid leaks in OOB support") added full scm support for MSG_OOB
      while fixing another bug.
      
      To fix this problem, we must call kfree_skb() for unix_sk(sk)->oob_skb
      if the socket still exists in gc_candidates after purging collected skb.
      
      Then, we need to set NULL to oob_skb before calling kfree_skb() because
      it calls last fput() and triggers unix_release_sock(), where we call
      duplicate kfree_skb(u->oob_skb) if not NULL.
      
      Note that the leaked socket remained being linked to a global list, so
      kmemleak also could not detect it.  We need to check /proc/net/protocol
      to notice the unfreed socket.
      
      [0]:
      WARNING: CPU: 0 PID: 2863 at net/unix/garbage.c:345 __unix_gc+0xc74/0xe80 net/unix/garbage.c:345
      Modules linked in:
      CPU: 0 PID: 2863 Comm: kworker/u4:11 Not tainted 6.8.0-rc1-syzkaller-00583-g1701940b1a02 #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
      Workqueue: events_unbound __unix_gc
      RIP: 0010:__unix_gc+0xc74/0xe80 net/unix/garbage.c:345
      Code: 8b 5c 24 50 e9 86 f8 ff ff e8 f8 e4 22 f8 31 d2 48 c7 c6 30 6a 69 89 4c 89 ef e8 97 ef ff ff e9 80 f9 ff ff e8 dd e4 22 f8 90 <0f> 0b 90 e9 7b fd ff ff 48 89 df e8 5c e7 7c f8 e9 d3 f8 ff ff e8
      RSP: 0018:ffffc9000b03fba0 EFLAGS: 00010293
      RAX: 0000000000000000 RBX: ffffc9000b03fc10 RCX: ffffffff816c493e
      RDX: ffff88802c02d940 RSI: ffffffff896982f3 RDI: ffffc9000b03fb30
      RBP: ffffc9000b03fce0 R08: 0000000000000001 R09: fffff52001607f66
      R10: 0000000000000003 R11: 0000000000000002 R12: dffffc0000000000
      R13: ffffc9000b03fc10 R14: ffffc9000b03fc10 R15: 0000000000000001
      FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00005559c8677a60 CR3: 000000000d57a000 CR4: 00000000003506f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       <TASK>
       process_one_work+0x889/0x15e0 kernel/workqueue.c:2633
       process_scheduled_works kernel/workqueue.c:2706 [inline]
       worker_thread+0x8b9/0x12a0 kernel/workqueue.c:2787
       kthread+0x2c6/0x3b0 kernel/kthread.c:388
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
       </TASK>
      
      Reported-by: default avatar <syzbot+fa3ef895554bdbfd1183@syzkaller.appspotmail.com>
      Closes: https://syzkaller.appspot.com/bug?extid=fa3ef895554bdbfd1183
      Fixes: 2aab4b96
      
       ("af_unix: fix struct pid leaks in OOB support")
      Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Link: https://lore.kernel.org/r/20240203183149.63573-1-kuniyu@amazon.com
      
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      1279f9d9
  4. Feb 06, 2024
    • Furong Xu's avatar
      net: stmmac: xgmac: fix a typo of register name in DPP safety handling · 1ce2654d
      Furong Xu authored
      DDPP is copied from Synopsys Data book:
      
      DDPP: Disable Data path Parity Protection.
          When it is 0x0, Data path Parity Protection is enabled.
          When it is 0x1, Data path Parity Protection is disabled.
      
      The macro name should be XGMAC_DPP_DISABLE.
      
      Fixes: 46eba193
      
       ("net: stmmac: xgmac: fix handling of DPP safety error for DMA channels")
      Signed-off-by: default avatarFurong Xu <0x1207@gmail.com>
      Reviewed-by: default avatarSerge Semin <fancer.lancer@gmail.com>
      Link: https://lore.kernel.org/r/20240203053133.1129236-1-0x1207@gmail.com
      
      
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      1ce2654d
    • Dmitry Safonov's avatar
      selftests/net: Amend per-netns counter checks · b083d24f
      Dmitry Safonov authored
      
      
      Selftests here check not only that connect()/accept() for
      TCP-AO/TCP-MD5/non-signed-TCP combinations do/don't establish
      connections, but also counters: those are per-AO-key, per-socket and
      per-netns.
      
      The counters are checked on the server's side, as the server listener
      has TCP-AO/TCP-MD5/no keys for different peers. All tests run in
      the same namespaces with the same veth pair, created in test_init().
      
      After close() in both client and server, the sides go through
      the regular FIN/ACK + FIN/ACK sequence, which goes in the background.
      If the selftest has already started a new testing scenario, read
      per-netns counters - it may fail in the end iff it doesn't expect
      the TCPAOGood per-netns counters go up during the test.
      
      Let's just kill both TCP-AO sides - that will avoid any asynchronous
      background TCP-AO segments going to either sides.
      
      Reported-by: default avatarJakub Kicinski <kuba@kernel.org>
      Closes: https://lore.kernel.org/all/20240201132153.4d68f45e@kernel.org/T/#u
      Fixes: 6f0c472a
      
       ("selftests/net: Add TCP-AO + TCP-MD5 + no sign listen socket tests")
      Signed-off-by: default avatarDmitry Safonov <dima@arista.com>
      Link: https://lore.kernel.org/r/20240202-unsigned-md5-netns-counters-v1-1-8b90c37c0566@arista.com
      
      
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      b083d24f
    • Nathan Chancellor's avatar
      x86/coco: Define cc_vendor without CONFIG_ARCH_HAS_CC_PLATFORM · e4596477
      Nathan Chancellor authored
      After commit a9ef2774 ("x86/kvm: Fix SEV check in
      sev_map_percpu_data()"), there is a build error when building
      x86_64_defconfig with GCOV using LLVM:
      
        ld.lld: error: undefined symbol: cc_vendor
        >>> referenced by kvm.c
        >>>               arch/x86/kernel/kvm.o:(kvm_smp_prepare_boot_cpu) in archive vmlinux.a
      
      which corresponds to
      
        if (cc_vendor != CC_VENDOR_AMD ||
            !cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT))
                  return;
      
      Without GCOV, clang is able to eliminate the use of cc_vendor because
      cc_platform_has() evaluates to false when CONFIG_ARCH_HAS_CC_PLATFORM is
      not set, meaning that if statement will be true no matter what value
      cc_vendor has.
      
      With GCOV, the instrumentation keeps the use of cc_vendor around for
      code coverage purposes but cc_vendor is only declared, not defined,
      without CONFIG_ARCH_HAS_CC_PLATFORM, leading to the build error above.
      
      Provide a macro definition of cc_vendor when CONFIG_ARCH_HAS_CC_PLATFORM
      is not set with a value of CC_VENDOR_NONE, so that the first condition
      can always be evaluated/eliminated at compile time, avoiding the build
      error altogether. This is very similar to the situation prior to
      commit da86eb96
      
       ("x86/coco: Get rid of accessor functions").
      
      Signed-off-by: default avatarNathan Chancellor <nathan@kernel.org>
      Acked-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
      Message-Id: <20240202-provide-cc_vendor-without-arch_has_cc_platform-v1-1-09ad5f2a3099@kernel.org>
      Fixes: a9ef2774
      
       ("x86/kvm: Fix SEV check in sev_map_percpu_data()", 2024-01-31)
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      e4596477
    • Shigeru Yoshida's avatar
      tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() · 3871aa01
      Shigeru Yoshida authored
      syzbot reported the following general protection fault [1]:
      
      general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN
      KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]
      ...
      RIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291
      ...
      Call Trace:
       <TASK>
       tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646
       tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089
       genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972
       genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]
       genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067
       netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544
       genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
       netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
       netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367
       netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909
       sock_sendmsg_nosec net/socket.c:730 [inline]
       __sock_sendmsg+0xd5/0x180 net/socket.c:745
       ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584
       ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638
       __sys_sendmsg+0x117/0x1e0 net/socket.c:2667
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x63/0x6b
      
      The cause of this issue is that when tipc_nl_bearer_add() is called with
      the TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called
      even if the bearer is not UDP.
      
      tipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that
      the media_ptr field of the tipc_bearer has an udp_bearer type object, so
      the function goes crazy for non-UDP bearers.
      
      This patch fixes the issue by checking the bearer type before calling
      tipc_udp_nl_bearer_add() in tipc_nl_bearer_add().
      
      Fixes: ef20cd4d
      
       ("tipc: introduce UDP replicast")
      Reported-and-tested-by: default avatar <syzbot+5142b87a9abc510e14fa@syzkaller.appspotmail.com>
      Closes: https://syzkaller.appspot.com/bug?extid=5142b87a9abc510e14fa
      
       [1]
      Signed-off-by: default avatarShigeru Yoshida <syoshida@redhat.com>
      Reviewed-by: default avatarTung Nguyen <tung.q.nguyen@dektech.com.au>
      Link: https://lore.kernel.org/r/20240131152310.4089541-1-syoshida@redhat.com
      
      
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      3871aa01
    • Linus Torvalds's avatar
      Merge tag 'bcachefs-2024-02-05' of https://evilpiepirate.org/git/bcachefs · 99bd3cb0
      Linus Torvalds authored
      Pull bcachefs fixes from Kent Overstreet:
       "Two serious ones here that we'll want to backport to stable: a fix for
        a race in the thread_with_file code, and another locking fixup in the
        subvolume deletion path"
      
      * tag 'bcachefs-2024-02-05' of https://evilpiepirate.org/git/bcachefs:
        bcachefs: time_stats: Check for last_event == 0 when updating freq stats
        bcachefs: install fd later to avoid race with close
        bcachefs: unlock parent dir if entry is not found in subvolume deletion
        bcachefs: Fix build on parisc by avoiding __multi3()
      99bd3cb0