From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 15:21:09 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d5bf1d3c55203a021c2067c3df81380b4e9d0a52;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch iio-invensense-fix-odr-switching-to-same-value.patch ipv6-fix-lockdep-splat-in-in6_dump_addrs.patch ipv6-mcast-delay-put-pmc-idev-in-mld_del_delrec.patch ipv6-mcast-fix-data-race-in-ipv6_mc_down-mld_ifc_work.patch ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv6_mc_down.patch ipv6-mcast-use-rcu-safe-version-of-ipv6_get_lladdr.patch mld-change-lockdep-annotation-for-ip6_sf_socklist-and-ipv6_mc_socklist.patch mld-fix-suspicious-rcu-usage-in-__ipv6_dev_mc_dec.patch net-ethernet-rmnet-always-subtract-map-header.patch net-mld-fix-reference-count-leak-in-mld_-query-report-_work.patch --- diff --git a/queue-5.10/iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch b/queue-5.10/iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch new file mode 100644 index 0000000000..2b1df903fa --- /dev/null +++ b/queue-5.10/iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch @@ -0,0 +1,55 @@ +From 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Tue, 23 Jun 2026 16:22:15 +0200 +Subject: iio: imu: inv_icm42600: fix timestamp clock period by using lower value + +From: Jean-Baptiste Maneyrol + +commit 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 upstream. + +Clock period value is used for computing periods of sampling. There is +no need for it to be higher than the maximum odr, otherwise we are +losing precision in the computation for nothing. + +Switch clock period value to maximum odr period (8kHz). + +Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 ++-- + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c +@@ -725,10 +725,10 @@ struct iio_dev *inv_icm42600_accel_init( + return ERR_PTR(-ENOMEM); + + /* +- * clock period is 32kHz (31250ns) ++ * clock period is 8kHz (125000ns) + * jitter is +/- 2% (20 per mille) + */ +- ts_chip.clock_period = 31250; ++ ts_chip.clock_period = 125000; + ts_chip.jitter = 20; + ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr); + ts = iio_priv(indio_dev); +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c +@@ -736,10 +736,10 @@ struct iio_dev *inv_icm42600_gyro_init(s + return ERR_PTR(-ENOMEM); + + /* +- * clock period is 32kHz (31250ns) ++ * clock period is 8kHz (125000ns) + * jitter is +/- 2% (20 per mille) + */ +- ts_chip.clock_period = 31250; ++ ts_chip.clock_period = 125000; + ts_chip.jitter = 20; + ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr); + ts = iio_priv(indio_dev); diff --git a/queue-5.10/iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch b/queue-5.10/iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch new file mode 100644 index 0000000000..46cc5e450d --- /dev/null +++ b/queue-5.10/iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch @@ -0,0 +1,45 @@ +From daec424cc57b33a28f8621eb7ac85f8bd327bd6b Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Mon, 19 Feb 2024 15:47:41 +0000 +Subject: iio: imu: inv_mpu6050: fix frequency setting when chip is off + +From: Jean-Baptiste Maneyrol + +commit daec424cc57b33a28f8621eb7ac85f8bd327bd6b upstream. + +Track correctly FIFO state and apply ODR change before starting +the chip. Without the fix, you cannot change ODR more than 1 time +when data buffering is off. This restriction on a single pending ODR +change should only apply when the FIFO is on. + +Fixes: 111e1abd0045 ("iio: imu: inv_mpu6050: use the common inv_sensors timestamp module") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Link: https://lore.kernel.org/r/20240219154741.90601-1-inv.git-commit@tdk.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c +@@ -112,6 +112,7 @@ int inv_mpu6050_prepare_fifo(struct inv_ + if (enable) { + /* reset timestamping */ + inv_sensors_timestamp_reset(&st->timestamp); ++ inv_sensors_timestamp_apply_odr(&st->timestamp, 0, 0, 0); + /* reset FIFO */ + d = st->chip_config.user_ctrl | INV_MPU6050_BIT_FIFO_RST; + ret = regmap_write(st->map, st->reg->user_ctrl, d); +@@ -187,6 +188,10 @@ static int inv_mpu6050_set_enable(struct + if (result) + goto error_power_off; + } else { ++ st->chip_config.gyro_fifo_enable = 0; ++ st->chip_config.accl_fifo_enable = 0; ++ st->chip_config.temp_fifo_enable = 0; ++ st->chip_config.magn_fifo_enable = 0; + result = inv_mpu6050_prepare_fifo(st, false); + if (result) + goto error_power_off; diff --git a/queue-5.10/iio-invensense-fix-odr-switching-to-same-value.patch b/queue-5.10/iio-invensense-fix-odr-switching-to-same-value.patch new file mode 100644 index 0000000000..cf49075df1 --- /dev/null +++ b/queue-5.10/iio-invensense-fix-odr-switching-to-same-value.patch @@ -0,0 +1,46 @@ +From 95444b9eeb8c5c0330563931d70c61ca3b101548 Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Fri, 24 May 2024 12:48:51 +0000 +Subject: iio: invensense: fix odr switching to same value + +From: Jean-Baptiste Maneyrol + +commit 95444b9eeb8c5c0330563931d70c61ca3b101548 upstream. + +ODR switching happens in 2 steps, update to store the new value and then +apply when the ODR change flag is received in the data. When switching to +the same ODR value, the ODR change flag is never happening, and frequency +switching is blocked waiting for the never coming apply. + +Fix the issue by preventing update to happen when switching to same ODR +value. + +Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Link: https://lore.kernel.org/r/20240524124851.567485-1-inv.git-commit@tdk.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c ++++ b/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c +@@ -60,11 +60,15 @@ EXPORT_SYMBOL_NS_GPL(inv_sensors_timesta + int inv_sensors_timestamp_update_odr(struct inv_sensors_timestamp *ts, + uint32_t period, bool fifo) + { ++ uint32_t mult; ++ + /* when FIFO is on, prevent odr change if one is already pending */ + if (fifo && ts->new_mult != 0) + return -EAGAIN; + +- ts->new_mult = period / ts->chip.clock_period; ++ mult = period / ts->chip.clock_period; ++ if (mult != ts->mult) ++ ts->new_mult = mult; + + return 0; + } diff --git a/queue-5.10/ipv6-fix-lockdep-splat-in-in6_dump_addrs.patch b/queue-5.10/ipv6-fix-lockdep-splat-in-in6_dump_addrs.patch new file mode 100644 index 0000000000..6216ec6daf --- /dev/null +++ b/queue-5.10/ipv6-fix-lockdep-splat-in-in6_dump_addrs.patch @@ -0,0 +1,77 @@ +From 4e43e64d0f1332fcc503babad4dc31aead7131ca Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 28 Jun 2022 12:12:48 +0000 +Subject: ipv6: fix lockdep splat in in6_dump_addrs() + +From: Eric Dumazet + +commit 4e43e64d0f1332fcc503babad4dc31aead7131ca upstream. + +As reported by syzbot, we should not use rcu_dereference() +when rcu_read_lock() is not held. + +WARNING: suspicious RCU usage +5.19.0-rc2-syzkaller #0 Not tainted + +net/ipv6/addrconf.c:5175 suspicious rcu_dereference_check() usage! + +other info that might help us debug this: + +rcu_scheduler_active = 2, debug_locks = 1 +1 lock held by syz-executor326/3617: + #0: ffffffff8d5848e8 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0xae/0xc20 net/netlink/af_netlink.c:2223 + +stack backtrace: +CPU: 0 PID: 3617 Comm: syz-executor326 Not tainted 5.19.0-rc2-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 + in6_dump_addrs+0x12d1/0x1790 net/ipv6/addrconf.c:5175 + inet6_dump_addr+0x9c1/0xb50 net/ipv6/addrconf.c:5300 + netlink_dump+0x541/0xc20 net/netlink/af_netlink.c:2275 + __netlink_dump_start+0x647/0x900 net/netlink/af_netlink.c:2380 + netlink_dump_start include/linux/netlink.h:245 [inline] + rtnetlink_rcv_msg+0x73e/0xc90 net/core/rtnetlink.c:6046 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 + netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] + netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 + netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 + sock_sendmsg_nosec net/socket.c:714 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:734 + ____sys_sendmsg+0x6eb/0x810 net/socket.c:2492 + ___sys_sendmsg+0xf3/0x170 net/socket.c:2546 + __sys_sendmsg net/socket.c:2575 [inline] + __do_sys_sendmsg net/socket.c:2584 [inline] + __se_sys_sendmsg net/socket.c:2582 [inline] + __x64_sys_sendmsg+0x132/0x220 net/socket.c:2582 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Taehee Yoo +Link: https://lore.kernel.org/r/20220628121248.858695-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/addrconf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -5178,9 +5178,9 @@ next: + fillargs->event = RTM_GETMULTICAST; + + /* multicast address */ +- for (ifmca = rcu_dereference(idev->mc_list); ++ for (ifmca = rtnl_dereference(idev->mc_list); + ifmca; +- ifmca = rcu_dereference(ifmca->next), ip_idx++) { ++ ifmca = rtnl_dereference(ifmca->next), ip_idx++) { + if (ip_idx < s_ip_idx) + continue; + err = inet6_fill_ifmcaddr(skb, ifmca, fillargs); diff --git a/queue-5.10/ipv6-mcast-delay-put-pmc-idev-in-mld_del_delrec.patch b/queue-5.10/ipv6-mcast-delay-put-pmc-idev-in-mld_del_delrec.patch new file mode 100644 index 0000000000..cb63e22788 --- /dev/null +++ b/queue-5.10/ipv6-mcast-delay-put-pmc-idev-in-mld_del_delrec.patch @@ -0,0 +1,33 @@ +From ae3264a25a4635531264728859dbe9c659fad554 Mon Sep 17 00:00:00 2001 +From: Yue Haibing +Date: Mon, 14 Jul 2025 22:19:57 +0800 +Subject: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() + +From: Yue Haibing + +commit ae3264a25a4635531264728859dbe9c659fad554 upstream. + +pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() +does, the reference should be put after ip6_mc_clear_src() return. + +Fixes: 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data") +Signed-off-by: Yue Haibing +Link: https://patch.msgid.link/20250714141957.3301871-1-yuehaibing@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/mcast.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -806,8 +806,8 @@ static void mld_del_delrec(struct inet6_ + } else { + im->mca_crcount = idev->mc_qrv; + } +- in6_dev_put(pmc->idev); + ip6_mc_clear_src(pmc); ++ in6_dev_put(pmc->idev); + kfree_rcu(pmc, rcu); + } + } diff --git a/queue-5.10/ipv6-mcast-fix-data-race-in-ipv6_mc_down-mld_ifc_work.patch b/queue-5.10/ipv6-mcast-fix-data-race-in-ipv6_mc_down-mld_ifc_work.patch new file mode 100644 index 0000000000..e8bd8e914c --- /dev/null +++ b/queue-5.10/ipv6-mcast-fix-data-race-in-ipv6_mc_down-mld_ifc_work.patch @@ -0,0 +1,76 @@ +From 2e7ef287f07c74985f1bf2858bedc62bd9ebf155 Mon Sep 17 00:00:00 2001 +From: Nikita Zhandarovich +Date: Wed, 17 Jan 2024 09:21:02 -0800 +Subject: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work + +From: Nikita Zhandarovich + +commit 2e7ef287f07c74985f1bf2858bedc62bd9ebf155 upstream. + +idev->mc_ifc_count can be written over without proper locking. + +Originally found by syzbot [1], fix this issue by encapsulating calls +to mld_ifc_stop_work() (and mld_gq_stop_work() for good measure) with +mutex_lock() and mutex_unlock() accordingly as these functions +should only be called with mc_lock per their declarations. + +[1] +BUG: KCSAN: data-race in ipv6_mc_down / mld_ifc_work + +write to 0xffff88813a80c832 of 1 bytes by task 3771 on cpu 0: + mld_ifc_stop_work net/ipv6/mcast.c:1080 [inline] + ipv6_mc_down+0x10a/0x280 net/ipv6/mcast.c:2725 + addrconf_ifdown+0xe32/0xf10 net/ipv6/addrconf.c:3949 + addrconf_notify+0x310/0x980 + notifier_call_chain kernel/notifier.c:93 [inline] + raw_notifier_call_chain+0x6b/0x1c0 kernel/notifier.c:461 + __dev_notify_flags+0x205/0x3d0 + dev_change_flags+0xab/0xd0 net/core/dev.c:8685 + do_setlink+0x9f6/0x2430 net/core/rtnetlink.c:2916 + rtnl_group_changelink net/core/rtnetlink.c:3458 [inline] + __rtnl_newlink net/core/rtnetlink.c:3717 [inline] + rtnl_newlink+0xbb3/0x1670 net/core/rtnetlink.c:3754 + rtnetlink_rcv_msg+0x807/0x8c0 net/core/rtnetlink.c:6558 + netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2545 + rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6576 + netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] + netlink_unicast+0x589/0x650 net/netlink/af_netlink.c:1368 + netlink_sendmsg+0x66e/0x770 net/netlink/af_netlink.c:1910 + ... + +write to 0xffff88813a80c832 of 1 bytes by task 22 on cpu 1: + mld_ifc_work+0x54c/0x7b0 net/ipv6/mcast.c:2653 + process_one_work kernel/workqueue.c:2627 [inline] + process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2700 + worker_thread+0x525/0x730 kernel/workqueue.c:2781 + ... + +Fixes: 2d9a93b4902b ("mld: convert from timer to delayed work") +Reported-by: syzbot+a9400cabb1d784e49abf@syzkaller.appspotmail.com +Link: https://lore.kernel.org/all/000000000000994e09060ebcdffb@google.com/ +Signed-off-by: Nikita Zhandarovich +Acked-by: Taehee Yoo +Reviewed-by: Eric Dumazet +Reviewed-by: Hangbin Liu +Link: https://lore.kernel.org/r/20240117172102.12001-1-n.zhandarovich@fintech.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/mcast.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -2754,8 +2754,12 @@ void ipv6_mc_down(struct inet6_dev *idev + synchronize_net(); + mld_query_stop_work(idev); + mld_report_stop_work(idev); ++ ++ mutex_lock(&idev->mc_lock); + mld_ifc_stop_work(idev); + mld_gq_stop_work(idev); ++ mutex_unlock(&idev->mc_lock); ++ + mld_dad_stop_work(idev); + } + diff --git a/queue-5.10/ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv6_mc_down.patch b/queue-5.10/ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv6_mc_down.patch new file mode 100644 index 0000000000..615d5d6427 --- /dev/null +++ b/queue-5.10/ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv6_mc_down.patch @@ -0,0 +1,38 @@ +From 17ef8efc00b34918b966388b2af0993811895a8c Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Fri, 9 Feb 2024 15:30:56 +0000 +Subject: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() + +From: Eric Dumazet + +commit 17ef8efc00b34918b966388b2af0993811895a8c upstream. + +As discussed in the past (commit 2d3916f31891 ("ipv6: fix skb drops +in igmp6_event_query() and igmp6_event_report()")) I think the +synchronize_net() call in ipv6_mc_down() is not needed. + +Under load, synchronize_net() can last between 200 usec and 5 ms. + +KASAN seems to agree as well. + +Fixes: f185de28d9ae ("mld: add new workqueues for process mld events") +Signed-off-by: Eric Dumazet +Cc: Taehee Yoo +Cc: Cong Wang +Cc: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/mcast.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -2751,7 +2751,6 @@ void ipv6_mc_down(struct inet6_dev *idev + /* Should stop work after group drop. or we will + * start work again in mld_ifc_event() + */ +- synchronize_net(); + mld_query_stop_work(idev); + mld_report_stop_work(idev); + diff --git a/queue-5.10/ipv6-mcast-use-rcu-safe-version-of-ipv6_get_lladdr.patch b/queue-5.10/ipv6-mcast-use-rcu-safe-version-of-ipv6_get_lladdr.patch new file mode 100644 index 0000000000..c39d6c6f58 --- /dev/null +++ b/queue-5.10/ipv6-mcast-use-rcu-safe-version-of-ipv6_get_lladdr.patch @@ -0,0 +1,97 @@ +From 26394fc118d6115390bd5b3a0fb17096271da227 Mon Sep 17 00:00:00 2001 +From: Ignat Korchagin +Date: Fri, 11 Feb 2022 17:30:42 +0000 +Subject: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() + +From: Ignat Korchagin + +commit 26394fc118d6115390bd5b3a0fb17096271da227 upstream. + +Some time ago 8965779d2c0e ("ipv6,mcast: always hold idev->lock before mca_lock") +switched ipv6_get_lladdr() to __ipv6_get_lladdr(), which is rcu-unsafe +version. That was OK, because idev->lock was held for these codepaths. + +In 88e2ca308094 ("mld: convert ifmcaddr6 to RCU") these external locks were +removed, so we probably need to restore the original rcu-safe call. + +Otherwise, we occasionally get a machine crashed/stalled with the following +in dmesg: + +[ 3405.966610][T230589] general protection fault, probably for non-canonical address 0xdead00000000008c: 0000 [#1] SMP NOPTI +[ 3405.982083][T230589] CPU: 44 PID: 230589 Comm: kworker/44:3 Tainted: G O 5.15.19-cloudflare-2022.2.1 #1 +[ 3405.998061][T230589] Hardware name: SUPA-COOL-SERV +[ 3406.009552][T230589] Workqueue: mld mld_ifc_work +[ 3406.017224][T230589] RIP: 0010:__ipv6_get_lladdr+0x34/0x60 +[ 3406.025780][T230589] Code: 57 10 48 83 c7 08 48 89 e5 48 39 d7 74 3e 48 8d 82 38 ff ff ff eb 13 48 8b 90 d0 00 00 00 48 8d 82 38 ff ff ff 48 39 d7 74 22 <66> 83 78 32 20 77 1b 75 e4 89 ca 23 50 2c 75 dd 48 8b 50 08 48 8b +[ 3406.055748][T230589] RSP: 0018:ffff94e4b3fc3d10 EFLAGS: 00010202 +[ 3406.065617][T230589] RAX: dead00000000005a RBX: ffff94e4b3fc3d30 RCX: 0000000000000040 +[ 3406.077477][T230589] RDX: dead000000000122 RSI: ffff94e4b3fc3d30 RDI: ffff8c3a31431008 +[ 3406.089389][T230589] RBP: ffff94e4b3fc3d10 R08: 0000000000000000 R09: 0000000000000000 +[ 3406.101445][T230589] R10: ffff8c3a31430000 R11: 000000000000000b R12: ffff8c2c37887100 +[ 3406.113553][T230589] R13: ffff8c3a39537000 R14: 00000000000005dc R15: ffff8c3a31431000 +[ 3406.125730][T230589] FS: 0000000000000000(0000) GS:ffff8c3b9fc80000(0000) knlGS:0000000000000000 +[ 3406.138992][T230589] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 3406.149895][T230589] CR2: 00007f0dfea1db60 CR3: 000000387b5f2000 CR4: 0000000000350ee0 +[ 3406.162421][T230589] Call Trace: +[ 3406.170235][T230589] +[ 3406.177736][T230589] mld_newpack+0xfe/0x1a0 +[ 3406.186686][T230589] add_grhead+0x87/0xa0 +[ 3406.195498][T230589] add_grec+0x485/0x4e0 +[ 3406.204310][T230589] ? newidle_balance+0x126/0x3f0 +[ 3406.214024][T230589] mld_ifc_work+0x15d/0x450 +[ 3406.223279][T230589] process_one_work+0x1e6/0x380 +[ 3406.232982][T230589] worker_thread+0x50/0x3a0 +[ 3406.242371][T230589] ? rescuer_thread+0x360/0x360 +[ 3406.252175][T230589] kthread+0x127/0x150 +[ 3406.261197][T230589] ? set_kthread_struct+0x40/0x40 +[ 3406.271287][T230589] ret_from_fork+0x22/0x30 +[ 3406.280812][T230589] +[ 3406.288937][T230589] Modules linked in: ... [last unloaded: kheaders] +[ 3406.476714][T230589] ---[ end trace 3525a7655f2f3b9e ]--- + +Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU") +Reported-by: David Pinilla Caparros +Signed-off-by: Ignat Korchagin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/addrconf.h | 2 -- + net/ipv6/addrconf.c | 4 ++-- + net/ipv6/mcast.c | 2 +- + 3 files changed, 3 insertions(+), 5 deletions(-) + +--- a/include/net/addrconf.h ++++ b/include/net/addrconf.h +@@ -117,8 +117,6 @@ struct inet6_ifaddr *ipv6_get_ifaddr(str + int ipv6_dev_get_saddr(struct net *net, const struct net_device *dev, + const struct in6_addr *daddr, unsigned int srcprefs, + struct in6_addr *saddr); +-int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr, +- u32 banned_flags); + int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr, + u32 banned_flags); + bool inet_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2, +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -1851,8 +1851,8 @@ out: + } + EXPORT_SYMBOL(ipv6_dev_get_saddr); + +-int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr, +- u32 banned_flags) ++static int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr, ++ u32 banned_flags) + { + struct inet6_ifaddr *ifp; + int err = -EADDRNOTAVAIL; +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -1776,7 +1776,7 @@ static struct sk_buff *mld_newpack(struc + skb_reserve(skb, hlen); + skb_tailroom_reserve(skb, mtu, tlen); + +- if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) { ++ if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) { + /* : + * use unspecified address as the source address + * when a valid link-local address is not available. diff --git a/queue-5.10/mld-change-lockdep-annotation-for-ip6_sf_socklist-and-ipv6_mc_socklist.patch b/queue-5.10/mld-change-lockdep-annotation-for-ip6_sf_socklist-and-ipv6_mc_socklist.patch new file mode 100644 index 0000000000..afdc7aba4c --- /dev/null +++ b/queue-5.10/mld-change-lockdep-annotation-for-ip6_sf_socklist-and-ipv6_mc_socklist.patch @@ -0,0 +1,249 @@ +From 4b4b84468aa27d0a18be8cb727f246aa35a3406d Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Sun, 4 Apr 2021 13:38:23 +0000 +Subject: mld: change lockdep annotation for ip6_sf_socklist and ipv6_mc_socklist + +From: Taehee Yoo + +commit 4b4b84468aa27d0a18be8cb727f246aa35a3406d upstream. + +struct ip6_sf_socklist and ipv6_mc_socklist are per-socket MLD data. +These data are protected by rtnl lock, socket lock, and RCU. +So, when these are used, it verifies whether rtnl lock is acquired or not. + +ip6_mc_msfget() is called by do_ipv6_getsockopt(). +But caller doesn't acquire rtnl lock. +So, when these data are used in the ip6_mc_msfget() lockdep warns about it. +But accessing these is actually safe because socket lock was acquired by +do_ipv6_getsockopt(). + +So, it changes lockdep annotation from rtnl lock to socket lock. +(rtnl_dereference -> sock_dereference) + +Locking graph for mld data is like below: + +When writing mld data: +do_ipv6_setsockopt() + rtnl_lock + lock_sock + (mld functions) + idev->mc_lock(if per-interface mld data is modified) + +When reading mld data: +do_ipv6_getsockopt() + lock_sock + ip6_mc_msfget() + +Splat looks like: +============================= +WARNING: suspicious RCU usage +5.12.0-rc4+ #503 Not tainted +----------------------------- +net/ipv6/mcast.c:610 suspicious rcu_dereference_protected() usage! + +other info that might help us debug this: + +rcu_scheduler_active = 2, debug_locks = 1 +1 lock held by mcast-listener-/923: + #0: ffff888007958a70 (sk_lock-AF_INET6){+.+.}-{0:0}, at: +ipv6_get_msfilter+0xaf/0x190 + +stack backtrace: +CPU: 1 PID: 923 Comm: mcast-listener- Not tainted 5.12.0-rc4+ #503 +Call Trace: + dump_stack+0xa4/0xe5 + ip6_mc_msfget+0x553/0x6c0 + ? ipv6_sock_mc_join_ssm+0x10/0x10 + ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 + ? mark_held_locks+0xb7/0x120 + ? lockdep_hardirqs_on_prepare+0x27c/0x3e0 + ? __local_bh_enable_ip+0xa5/0xf0 + ? lock_sock_nested+0x82/0xf0 + ipv6_get_msfilter+0xc3/0x190 + ? compat_ipv6_get_msfilter+0x300/0x300 + ? lock_downgrade+0x690/0x690 + do_ipv6_getsockopt.isra.6.constprop.13+0x1809/0x29e0 + ? do_ipv6_mcast_group_source+0x150/0x150 + ? register_lock_class+0x1750/0x1750 + ? kvm_sched_clock_read+0x14/0x30 + ? sched_clock+0x5/0x10 + ? sched_clock_cpu+0x18/0x170 + ? find_held_lock+0x3a/0x1c0 + ? lock_downgrade+0x690/0x690 + ? ipv6_getsockopt+0xdb/0x1b0 + ipv6_getsockopt+0xdb/0x1b0 +[ ... ] + +Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU") +Reported-by: Eric Dumazet +Signed-off-by: Taehee Yoo +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/mcast.c | 48 +++++++++++++++++++++++------------------------- + net/tipc/udp_media.c | 2 ++ + 2 files changed, 25 insertions(+), 25 deletions(-) + +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -114,10 +114,13 @@ int sysctl_mld_qrv __read_mostly = MLD_Q + #define mc_dereference(e, idev) \ + rcu_dereference_protected(e, lockdep_is_held(&(idev)->mc_lock)) + +-#define for_each_pmc_rtnl(np, pmc) \ +- for (pmc = rtnl_dereference((np)->ipv6_mc_list); \ ++#define sock_dereference(e, sk) \ ++ rcu_dereference_protected(e, lockdep_sock_is_held(sk)) ++ ++#define for_each_pmc_socklock(np, sk, pmc) \ ++ for (pmc = sock_dereference((np)->ipv6_mc_list, sk); \ + pmc; \ +- pmc = rtnl_dereference(pmc->next)) ++ pmc = sock_dereference(pmc->next, sk)) + + #define for_each_pmc_rcu(np, pmc) \ + for (pmc = rcu_dereference((np)->ipv6_mc_list); \ +@@ -183,7 +186,7 @@ static int __ipv6_sock_mc_join(struct so + if (!ipv6_addr_is_multicast(addr)) + return -EINVAL; + +- for_each_pmc_rtnl(np, mc_lst) { ++ for_each_pmc_socklock(np, sk, mc_lst) { + if ((ifindex == 0 || mc_lst->ifindex == ifindex) && + ipv6_addr_equal(&mc_lst->addr, addr)) + return -EADDRINUSE; +@@ -261,7 +264,7 @@ int ipv6_sock_mc_drop(struct sock *sk, i + return -EINVAL; + + for (lnk = &np->ipv6_mc_list; +- (mc_lst = rtnl_dereference(*lnk)) != NULL; ++ (mc_lst = sock_dereference(*lnk, sk)) != NULL; + lnk = &mc_lst->next) { + if ((ifindex == 0 || mc_lst->ifindex == ifindex) && + ipv6_addr_equal(&mc_lst->addr, addr)) { +@@ -326,7 +329,7 @@ void __ipv6_sock_mc_close(struct sock *s + + ASSERT_RTNL(); + +- while ((mc_lst = rtnl_dereference(np->ipv6_mc_list)) != NULL) { ++ while ((mc_lst = sock_dereference(np->ipv6_mc_list, sk)) != NULL) { + struct net_device *dev; + + np->ipv6_mc_list = mc_lst->next; +@@ -353,8 +356,11 @@ void ipv6_sock_mc_close(struct sock *sk) + + if (!rcu_access_pointer(np->ipv6_mc_list)) + return; ++ + rtnl_lock(); ++ lock_sock(sk); + __ipv6_sock_mc_close(sk); ++ release_sock(sk); + rtnl_unlock(); + } + +@@ -384,7 +390,7 @@ int ip6_mc_source(int add, int omode, st + err = -EADDRNOTAVAIL; + + mutex_lock(&idev->mc_lock); +- for_each_pmc_rtnl(inet6, pmc) { ++ for_each_pmc_socklock(inet6, sk, pmc) { + if (pgsr->gsr_interface && pmc->ifindex != pgsr->gsr_interface) + continue; + if (ipv6_addr_equal(&pmc->addr, group)) +@@ -407,7 +413,7 @@ int ip6_mc_source(int add, int omode, st + pmc->sfmode = omode; + } + +- psl = rtnl_dereference(pmc->sflist); ++ psl = sock_dereference(pmc->sflist, sk); + if (!add) { + if (!psl) + goto done; /* err = -EADDRNOTAVAIL */ +@@ -514,7 +520,7 @@ int ip6_mc_msfilter(struct sock *sk, str + goto done; + } + +- for_each_pmc_rtnl(inet6, pmc) { ++ for_each_pmc_socklock(inet6, sk, pmc) { + if (pmc->ifindex != gsf->gf_interface) + continue; + if (ipv6_addr_equal(&pmc->addr, group)) +@@ -555,7 +561,7 @@ int ip6_mc_msfilter(struct sock *sk, str + } + + mutex_lock(&idev->mc_lock); +- psl = rtnl_dereference(pmc->sflist); ++ psl = sock_dereference(pmc->sflist, sk); + if (psl) { + ip6_mc_del_src(idev, group, pmc->sfmode, + psl->sl_count, psl->sl_addr, 0); +@@ -577,40 +583,32 @@ done: + int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf, + struct sockaddr_storage *p) + { +- int err, i, count, copycount; ++ struct ipv6_pinfo *inet6 = inet6_sk(sk); + const struct in6_addr *group; + struct ipv6_mc_socklist *pmc; +- struct inet6_dev *idev; +- struct ipv6_pinfo *inet6 = inet6_sk(sk); + struct ip6_sf_socklist *psl; +- struct net *net = sock_net(sk); ++ int i, count, copycount; + + group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr; + + if (!ipv6_addr_is_multicast(group)) + return -EINVAL; + +- idev = ip6_mc_find_dev_rtnl(net, group, gsf->gf_interface); +- if (!idev) +- return -ENODEV; +- +- err = -EADDRNOTAVAIL; + /* changes to the ipv6_mc_list require the socket lock and +- * rtnl lock. We have the socket lock and rcu read lock, +- * so reading the list is safe. ++ * rtnl lock. We have the socket lock, so reading the list is safe. + */ + +- for_each_pmc_rtnl(inet6, pmc) { ++ for_each_pmc_socklock(inet6, sk, pmc) { + if (pmc->ifindex != gsf->gf_interface) + continue; + if (ipv6_addr_equal(group, &pmc->addr)) + break; + } + if (!pmc) /* must have a prior join */ +- return err; ++ return -EADDRNOTAVAIL; + + gsf->gf_fmode = pmc->sfmode; +- psl = rtnl_dereference(pmc->sflist); ++ psl = sock_dereference(pmc->sflist, sk); + count = psl ? psl->sl_count : 0; + + copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc; +@@ -2620,7 +2618,7 @@ static int ip6_mc_leave_src(struct sock + struct ip6_sf_socklist *psl; + int err; + +- psl = rtnl_dereference(iml->sflist); ++ psl = sock_dereference(iml->sflist, sk); + + if (idev) + mutex_lock(&idev->mc_lock); +--- a/net/tipc/udp_media.c ++++ b/net/tipc/udp_media.c +@@ -411,8 +411,10 @@ static int enable_mcast(struct udp_beare + err = ip_mc_join_group(sk, &mreqn); + #if IS_ENABLED(CONFIG_IPV6) + } else { ++ lock_sock(sk); + err = ipv6_stub->ipv6_sock_mc_join(sk, ub->ifindex, + &remote->ipv6); ++ release_sock(sk); + #endif + } + return err; diff --git a/queue-5.10/mld-fix-suspicious-rcu-usage-in-__ipv6_dev_mc_dec.patch b/queue-5.10/mld-fix-suspicious-rcu-usage-in-__ipv6_dev_mc_dec.patch new file mode 100644 index 0000000000..b3ea2126b9 --- /dev/null +++ b/queue-5.10/mld-fix-suspicious-rcu-usage-in-__ipv6_dev_mc_dec.patch @@ -0,0 +1,108 @@ +From aa8caa767e319bad34a82bfce7da1ed2b9c0ed6f Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Fri, 16 Apr 2021 14:16:06 +0000 +Subject: mld: fix suspicious RCU usage in __ipv6_dev_mc_dec() + +From: Taehee Yoo + +commit aa8caa767e319bad34a82bfce7da1ed2b9c0ed6f upstream. + +__ipv6_dev_mc_dec() internally uses sleepable functions so that caller +must not acquire atomic locks. But caller, which is addrconf_verify_rtnl() +acquires rcu_read_lock_bh(). +So this warning occurs in the __ipv6_dev_mc_dec(). + +Test commands: + ip netns add A + ip link add veth0 type veth peer name veth1 + ip link set veth1 netns A + ip link set veth0 up + ip netns exec A ip link set veth1 up + ip a a 2001:db8::1/64 dev veth0 valid_lft 2 preferred_lft 1 + +Splat looks like: +============================ +WARNING: suspicious RCU usage +5.12.0-rc6+ #515 Not tainted +----------------------------- +kernel/sched/core.c:8294 Illegal context switch in RCU-bh read-side +critical section! + +other info that might help us debug this: + +rcu_scheduler_active = 2, debug_locks = 1 +4 locks held by kworker/4:0/1997: + #0: ffff88810bd72d48 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: +process_one_work+0x761/0x1440 + #1: ffff888105c8fe00 ((addr_chk_work).work){+.+.}-{0:0}, at: +process_one_work+0x795/0x1440 + #2: ffffffffb9279fb0 (rtnl_mutex){+.+.}-{3:3}, at: +addrconf_verify_work+0xa/0x20 + #3: ffffffffb8e30860 (rcu_read_lock_bh){....}-{1:2}, at: +addrconf_verify_rtnl+0x23/0xc60 + +stack backtrace: +CPU: 4 PID: 1997 Comm: kworker/4:0 Not tainted 5.12.0-rc6+ #515 +Workqueue: ipv6_addrconf addrconf_verify_work +Call Trace: + dump_stack+0xa4/0xe5 + ___might_sleep+0x27d/0x2b0 + __mutex_lock+0xc8/0x13f0 + ? lock_downgrade+0x690/0x690 + ? __ipv6_dev_mc_dec+0x49/0x2a0 + ? mark_held_locks+0xb7/0x120 + ? mutex_lock_io_nested+0x1270/0x1270 + ? lockdep_hardirqs_on_prepare+0x12c/0x3e0 + ? _raw_spin_unlock_irqrestore+0x47/0x50 + ? trace_hardirqs_on+0x41/0x120 + ? __wake_up_common_lock+0xc9/0x100 + ? __wake_up_common+0x620/0x620 + ? memset+0x1f/0x40 + ? netlink_broadcast_filtered+0x2c4/0xa70 + ? __ipv6_dev_mc_dec+0x49/0x2a0 + __ipv6_dev_mc_dec+0x49/0x2a0 + ? netlink_broadcast_filtered+0x2f6/0xa70 + addrconf_leave_solict.part.64+0xad/0xf0 + ? addrconf_join_solict.part.63+0xf0/0xf0 + ? nlmsg_notify+0x63/0x1b0 + __ipv6_ifa_notify+0x22c/0x9c0 + ? inet6_fill_ifaddr+0xbe0/0xbe0 + ? lockdep_hardirqs_on_prepare+0x12c/0x3e0 + ? __local_bh_enable_ip+0xa5/0xf0 + ? ipv6_del_addr+0x347/0x870 + ipv6_del_addr+0x3b1/0x870 + ? addrconf_ifdown+0xfe0/0xfe0 + ? rcu_read_lock_any_held.part.27+0x20/0x20 + addrconf_verify_rtnl+0x8a9/0xc60 + addrconf_verify_work+0xf/0x20 + process_one_work+0x84c/0x1440 + +In order to avoid this problem, it uses rcu_read_unlock_bh() for +a short time. RCU is used for avoiding freeing +ifp(struct *inet6_ifaddr) while ifp is being used. But this will +not be released even if rcu_read_unlock_bh() is used. +Because before rcu_read_unlock_bh(), it uses in6_ifa_hold(ifp). +So this is safe. + +Fixes: 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data") +Suggested-by: Eric Dumazet +Reported-by: Eric Dumazet +Signed-off-by: Taehee Yoo +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/addrconf.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -4550,7 +4550,9 @@ restart: + age >= ifp->valid_lft) { + spin_unlock(&ifp->lock); + in6_ifa_hold(ifp); ++ rcu_read_unlock_bh(); + ipv6_del_addr(ifp); ++ rcu_read_lock_bh(); + goto restart; + } else if (ifp->prefered_lft == INFINITY_LIFE_TIME) { + spin_unlock(&ifp->lock); diff --git a/queue-5.10/net-ethernet-rmnet-always-subtract-map-header.patch b/queue-5.10/net-ethernet-rmnet-always-subtract-map-header.patch new file mode 100644 index 0000000000..a2619e8462 --- /dev/null +++ b/queue-5.10/net-ethernet-rmnet-always-subtract-map-header.patch @@ -0,0 +1,41 @@ +From 8b8701d0b4925807a6d4dc4699cb80a1e16218ad Mon Sep 17 00:00:00 2001 +From: Kristian Evensen +Date: Wed, 9 Jun 2021 16:32:49 +0200 +Subject: net: ethernet: rmnet: Always subtract MAP header + +From: Kristian Evensen + +commit 8b8701d0b4925807a6d4dc4699cb80a1e16218ad upstream. + +Commit e1d9a90a9bfd ("net: ethernet: rmnet: Support for ingress MAPv5 +checksum offload") broke ingress handling for devices where +RMNET_FLAGS_INGRESS_MAP_CKSUMV5 or RMNET_FLAGS_INGRESS_MAP_CKSUMV4 are +not set. Unless either of these flags are set, the MAP header is not +removed. This commit restores the original logic by ensuring that the +MAP header is removed for all MAP packets. + +Fixes: e1d9a90a9bfd ("net: ethernet: rmnet: Support for ingress MAPv5 checksum offload") +Signed-off-by: Kristian Evensen +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c ++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c +@@ -88,11 +88,12 @@ __rmnet_map_ingress_handler(struct sk_bu + goto free_skb; + skb_pull(skb, sizeof(*map_header)); + rmnet_set_skb_proto(skb); +- } else if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4) { ++ } else { + /* Subtract MAP header */ + skb_pull(skb, sizeof(*map_header)); + rmnet_set_skb_proto(skb); +- if (!rmnet_map_checksum_downlink_packet(skb, len + pad)) ++ if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4 && ++ !rmnet_map_checksum_downlink_packet(skb, len + pad)) + skb->ip_summed = CHECKSUM_UNNECESSARY; + } + diff --git a/queue-5.10/net-mld-fix-reference-count-leak-in-mld_-query-report-_work.patch b/queue-5.10/net-mld-fix-reference-count-leak-in-mld_-query-report-_work.patch new file mode 100644 index 0000000000..ecae888cd7 --- /dev/null +++ b/queue-5.10/net-mld-fix-reference-count-leak-in-mld_-query-report-_work.patch @@ -0,0 +1,117 @@ +From 3e7d18b9dca388940a19cae30bfc1f76dccd8c28 Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Fri, 22 Jul 2022 17:06:35 +0000 +Subject: net: mld: fix reference count leak in mld_{query | report}_work() + +From: Taehee Yoo + +commit 3e7d18b9dca388940a19cae30bfc1f76dccd8c28 upstream. + +mld_{query | report}_work() processes queued events. +If there are too many events in the queue, it re-queue a work. +And then, it returns without in6_dev_put(). +But if queuing is failed, it should call in6_dev_put(), but it doesn't. +So, a reference count leak would occur. + +THREAD0 THREAD1 +mld_report_work() + spin_lock_bh() + if (!mod_delayed_work()) + in6_dev_hold(); + spin_unlock_bh() + spin_lock_bh() + schedule_delayed_work() + spin_unlock_bh() + +Script to reproduce(by Hangbin Liu): + ip netns add ns1 + ip netns add ns2 + ip netns exec ns1 sysctl -w net.ipv6.conf.all.force_mld_version=1 + ip netns exec ns2 sysctl -w net.ipv6.conf.all.force_mld_version=1 + + ip -n ns1 link add veth0 type veth peer name veth0 netns ns2 + ip -n ns1 link set veth0 up + ip -n ns2 link set veth0 up + + for i in `seq 50`; do + for j in `seq 100`; do + ip -n ns1 addr add 2021:${i}::${j}/64 dev veth0 + ip -n ns2 addr add 2022:${i}::${j}/64 dev veth0 + done + done + modprobe -r veth + ip -a netns del + +splat looks like: + unregister_netdevice: waiting for veth0 to become free. Usage count = 2 + leaked reference. + ipv6_add_dev+0x324/0xec0 + addrconf_notify+0x481/0xd10 + raw_notifier_call_chain+0xe3/0x120 + call_netdevice_notifiers+0x106/0x160 + register_netdevice+0x114c/0x16b0 + veth_newlink+0x48b/0xa50 [veth] + rtnl_newlink+0x11a2/0x1a40 + rtnetlink_rcv_msg+0x63f/0xc00 + netlink_rcv_skb+0x1df/0x3e0 + netlink_unicast+0x5de/0x850 + netlink_sendmsg+0x6c9/0xa90 + ____sys_sendmsg+0x76a/0x780 + __sys_sendmsg+0x27c/0x340 + do_syscall_64+0x43/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Tested-by: Hangbin Liu +Fixes: f185de28d9ae ("mld: add new workqueues for process mld events") +Signed-off-by: Taehee Yoo +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/mcast.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -1545,7 +1545,6 @@ static void mld_query_work(struct work_s + + if (++cnt >= MLD_MAX_QUEUE) { + rework = true; +- schedule_delayed_work(&idev->mc_query_work, 0); + break; + } + } +@@ -1556,8 +1555,10 @@ static void mld_query_work(struct work_s + __mld_query_work(skb); + mutex_unlock(&idev->mc_lock); + +- if (!rework) +- in6_dev_put(idev); ++ if (rework && queue_delayed_work(mld_wq, &idev->mc_query_work, 0)) ++ return; ++ ++ in6_dev_put(idev); + } + + /* called with rcu_read_lock() */ +@@ -1652,7 +1653,6 @@ static void mld_report_work(struct work_ + + if (++cnt >= MLD_MAX_QUEUE) { + rework = true; +- schedule_delayed_work(&idev->mc_report_work, 0); + break; + } + } +@@ -1663,8 +1663,10 @@ static void mld_report_work(struct work_ + __mld_report_work(skb); + mutex_unlock(&idev->mc_lock); + +- if (!rework) +- in6_dev_put(idev); ++ if (rework && queue_delayed_work(mld_wq, &idev->mc_report_work, 0)) ++ return; ++ ++ in6_dev_put(idev); + } + + static bool is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type, diff --git a/queue-5.10/series b/queue-5.10/series index 5bce0e6382..1be44b1724 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -685,3 +685,15 @@ audit-fix-potential-integer-overflow-in-audit_log_n_hex.patch posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch +iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch +iio-invensense-fix-odr-switching-to-same-value.patch +iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch +mld-change-lockdep-annotation-for-ip6_sf_socklist-and-ipv6_mc_socklist.patch +ipv6-mcast-delay-put-pmc-idev-in-mld_del_delrec.patch +net-ethernet-rmnet-always-subtract-map-header.patch +ipv6-mcast-use-rcu-safe-version-of-ipv6_get_lladdr.patch +ipv6-fix-lockdep-splat-in-in6_dump_addrs.patch +net-mld-fix-reference-count-leak-in-mld_-query-report-_work.patch +ipv6-mcast-fix-data-race-in-ipv6_mc_down-mld_ifc_work.patch +ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv6_mc_down.patch +mld-fix-suspicious-rcu-usage-in-__ipv6_dev_mc_dec.patch