Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for AR5BBU22 [0489:e03c] #17

Closed
wants to merge 1 commit into from
Closed

Add support for AR5BBU22 [0489:e03c] #17

wants to merge 1 commit into from

Conversation

reejk
Copy link

@reejk reejk commented May 11, 2012

No description provided.

@reejk reejk closed this May 11, 2012
@torvalds
Copy link
Owner

torvalds commented May 11, 2012

I don't do github pull requests.

github throws away all the relevant information, like having even a
valid email address for the person asking me to pull. The diffstat is
also deficient and useless.

Git comes with a nice pull-request generation module, but github
instead decided to replace it with their own totally inferior version.
As a result, I consider github useless for these kinds of things. It's
fine for hosting, but the pull requests and the online commit
editing, are just pure garbage.

I've told github people about my concerns, they didn't think they
mattered, so I gave up. Feel free to make a bugreport to github.

                Linus

On Fri, May 11, 2012 at 4:27 AM, Roman
reply@reply.github.com
wrote:

You can merge this Pull Request by running:

 git pull https://github.com/WNeZRoS/linux master

Or you can view, comment on it, or merge it online at:

 #17

-- Commit Summary --

  • Add support for AR5BBU22 [0489:e03c]

-- File Changes --

M drivers/bluetooth/btusb.c (3)

-- Patch Links --

 https://github.com/torvalds/linux/pull/17.patch
 https://github.com/torvalds/linux/pull/17.diff


Reply to this email directly or view it on GitHub:
#17

@orblivion
Copy link

orblivion commented May 11, 2012

How do you feel about merging in things that may include commits downstream that have been pull requested with github? Seems hard to stop that.

@jaseemabid
Copy link

jaseemabid commented May 11, 2012

Somebody please look at the diff. Thats a simple 3 line code addition. I agree to you @torvalds but you could have excused this time :)

@jaseemabid
Copy link

jaseemabid commented May 11, 2012

By the way, its quite funny that github is sending instructions to @torvalds on using git.

@torvalds
Copy link
Owner

torvalds commented May 11, 2012

On Fri, May 11, 2012 at 1:03 PM, orblivion
reply@reply.github.com
wrote:

How do you feel about merging in things that may include commits downstream that have been pull requested with github? Seems hard to stop that.

Read my email.

I have no problem with people using github as a hosting site.

But in order for me to pull from github, you need to

(a) make a real pull request, not the braindamaged crap that github
does when you ask it to request a pull: real explanation, proper email
addresses, proper shortlog, and proper diffstat.

(b) since github identities are random, I expect the pull request to
be a signed tag, so that I can verify the identity of the person in
question.

I also refuse to pull commits that have been made with the github web
interface. Again, the reason for that is that the way the github web
interface work, those commits are invariably pure crap. Commits done
on github invariably have totally unreadable descriptions, because the
github commit making thing doesn't do any of the simplest things
that the kernel people expect from a commit message:

  • no "short one-line description in the first line"
  • no sane word-wrap of the long description you type: github commit
    messages tend to be (if they have any description at all) one long
    unreadable line.
  • no sign-offs etc that we require for kernel submissions.

github could make it easy to write good commit messages and enforce
the proper "oneliner for shortlogs and gitk, full explanation for full
logs". But github doesn't. Instead, the github "commit on the web"
interface is one single horrible text-entry field with absolutely no
sane way to write a good-looking message.

Maybe some of this has changed, I haven't checked lately. But in
general, the quality of stuff I have seen from people who use the
github web interfaces has been so low that it's not worth my time.

I'm writing these explanations in the (probably vain) hope that people
who use github will actually take them to heart, and github will
eventually improve. But right now github is a total ghetto of crap
commit messages and unreadable and unusable pull requests.

And the fact that other projects apparently have so low expectations
of commit messages that these things get used is just sad. People
should try to compare the quality of the kernel git logs with some
other projects, and cry themselves to sleep.

               Linus

@torvalds
Copy link
Owner

torvalds commented May 11, 2012

Btw, Joseph, you're a quality example of why I detest the github
interface. For some reason, github has attracted people who have zero
taste, don't care about commit logs, and can't be bothered.

The fact that I have higher standards then makes people like you make
snarky comments, thinking that you are cool.

You're a moron.

               Linus

@skalnik
Copy link

skalnik commented May 11, 2012

@torvalds The GitHub commit UI provides a text area for commit messages. This supports new lines and makes it easy to do nicely formatted commit messages :)

@jedahan
Copy link

jedahan commented May 11, 2012

@skalnik would be nice if it had an 80-character line to help format things nicely.

@anaisbetts
Copy link

anaisbetts commented May 11, 2012

Every time another Pull Request fiasco happens on one of Linus's repos it makes me sad, especially because I want someone whose work I greatly respect, to have a good experience on GitHub - instead he gets dozens of troll comments.

An OS kernel very rightfully demands a very disciplined approach to development that is in many ways not compatible with the goals of GitHub, which is to get as many people of all skill levels involved in Free / Open Source Software. We can certainly make improvements though, and I appreciate that Linus has taken some time to detail exactly why he doesn't use PRs, even if it's a bit harsh.

@tubbo
Copy link

tubbo commented May 11, 2012

 - no sane word-wrap of the long description you type: github commit
messages tend to be (if they have any description at all) one long
unreadable line.

I think this is only because people who are new to Git are using GitHub and not understanding about Git-style committing. Remember, a lot of these newbies are just out of the gate from using SVN for years. I bet a lot of them don't even realize that git commit with the "-m" omitted just opens up COMMIT_EDITMSG in your editor. It isn't even very apparent (to newbies) of the 50-char title rule and 72-char every other line rule with commit messages.

github *could* make it easy to write good commit messages and enforce
the proper "oneliner for shortlogs and gitk, full explanation for full
logs". But github doesn't. Instead, the github "commit on the web"
interface is one single horrible text-entry field with absolutely no
sane way to write a good-looking message.

I have to agree with you there. Commit message viewing on Github sucks and I hope they change it soon.

@torvalds
Copy link
Owner

torvalds commented May 11, 2012

On Fri, May 11, 2012 at 1:29 PM, Mike Skalnik
reply@reply.github.com
wrote:

@torvalds The GitHub commit UI provides a text area for commit messages. This supports new lines and makes it easy to do nicely formatted commit messages :)

No it doesn't.

What it supports is writing long lines that you have not a f*cking
clue how long they are. The text area does not do line breaks for you,
and you have no way to judge where the line breaks would go.

In other words, it makes it very hard indeed to do "nicely formatted
commit messages". It also doesn't enforce the trivial "oneliner for
shortlog" model, so the commit messages often end up looking like
total crap in shortlogs and in gitk.

So the github commit UI should have

  • separate "shortlog" one-liner text window, so that people cannot
    screw that up.
  • some way to actually do sane word-wrap at the standard 72-column mark.
  • reminders about sign-offs etc that some projects need for
    project-specific or even legal reasons.

It didn't do any of those last time I checked.

              Linus

@jedahan
Copy link

jedahan commented May 11, 2012

I always thought of the title of a pull request as the one-liner ...

@jrep
Copy link

jrep commented May 11, 2012

Newbie question I know, but can someone point me to this "nice pull-request generation module" Linus mentions? My google fu, documentation fu, and command-line-help fu all failed.

@torvalds
Copy link
Owner

torvalds commented May 11, 2012

On Fri, May 11, 2012 at 1:40 PM, Tom Scott
reply@reply.github.com
wrote:

  • no sane word-wrap of the long description you type: github commit
       messages tend to be (if they have any description at all) one long
       unreadable line.

I think this is only because people who are new to Git are using GitHub and not understanding about Git-style committing.

The thing is, even if you do understand about git-style committing,
it's actually really hard to do that with the github web interface.

The best way to do it is literally to open up another text editor
for the commit message, and then cut-and-paste the end result into the
web interface text tool.

Yes, commit messages should have proper word-wrap, with empty lines in
between paragraphs, and at the same time sometimes you need a long
line without word-wrap (compiler error messages or other "non-prose"
explanation).

And yes, that would almost require some kind of "markup" format with
quoting markers etc. And yes, it would be a more complex model of
writing commit messages. But if the default is "word-wrap at 72
characters, put empty lines in between paragraphs", then people who
don't know about the markup would still on average get better results
(even if the word-wrap would then occasionally be the wrong thing to
do)

Right now, github simply seems to default to "broken horrible
messages", and make it really really hard to do a good job.

And I think it should default to "nice readable messages" with some
effort needed for special things.

            Linus

@technoweenie
Copy link

technoweenie commented May 11, 2012

@jrep: I believe he's referring to git-request-pull.

@nugend
Copy link

nugend commented May 11, 2012

I'm not sure I understand why the commit message itself should be hard word-wrapped. Naively, it seems like that should be a display property of the editor used to write the commit message or the tool used to display the commit message.

@torvalds
Copy link
Owner

torvalds commented May 11, 2012

On Fri, May 11, 2012 at 1:48 PM, Dominik Dabrowski
reply@reply.github.com
wrote:

You might have fun raging on the internet, but I think your goals would be better served if you expressed your thoughts in a clear (maybe even polite) manner that doesn't embarrass the people whose actions you're trying to influence.

Umm. I think I've been able to reach my goals on the internet better
than most people.

The fact that I'm very clear about my opinions is probably part of it.

If people get offended by accurate portrayals of the current state of
github pull requests, that's their problem.

I hate that whole "victim philosophy". The truth shouldn't be sugarcoated.

                    Linus

@scomma
Copy link

scomma commented May 11, 2012

While I do have great respect for you @torvalds and your work, and it's totally valid for the repository of Linux to have rather rigorous standards, have you considered the possibility there could be a lot of GitHub users who don't really need nor care about any of those "features" you try to portray as objectively superior?

@torvalds
Copy link
Owner

torvalds commented May 11, 2012

On Fri, May 11, 2012 at 1:49 PM, Daniel Nugent
reply@reply.github.com
wrote:

I'm not sure I understand why the commit message itself should be hard word-wrapped. Naively, it seems like that should be a display property of the editor used to write the commit message or the tool used to display the commit message.

No it shouldn't.

Word-wrapping is a property of the text. And the tool you use to
visualize things cannot know. End result: you do word-wrapping at the
only stage where you can do it, namely when writing it. Not when
showing it.

Some things should not be word-wrapped. They may be some kind of
quoted text - long compiler error messages, oops reports, whatever.
Things that have a certain specific format.

The tool displaying the thing can't know. The person writing the
commit message can. End result: you'd better do word-wrapping at
commit time, because that's the only time you know the difference.

Sure, the alternative would be to have commit messages be some
non-pure-textual format (html or similar). But no, that's not how git
does things. Sure, technically it could, but realistically the rule is
simple: we use 72-character columns for word-wrapping, except for
quoted material that has a specific line format.

(And the rule is not 80 characters, because you do want to allow the
standard indentation from git log, and you do want to leave some room
for quoting).

Anyway, you are obviously free to do your commit messages any way you
want. However, these are the rules we try to follow in the kernel, and
in git itself.

And quite frankly, anybody who thinks they have better rules had
better prove their point by showing a project with better commit
messages. Quite frankly, I've seen a lot of open-source projects, and
I have yet to see any project that does a better job of doing good
commit messages than the kernel or git. And I've seen a lot of
projects that do much worse.

So I would suggest taking the cue for good log messages from projects
that have proven that they really can do good log messages. Linux and
git are both good examples of that.

             Linus

@tylermenezes
Copy link

tylermenezes commented May 11, 2012

If you add .patch onto this URL you'll get a git-am style patch.

(Github is very silly for not exposing this in the interface, and for not even really mentioning this feature.)

I agree with you on the messages, I wish the text areas were at least monospaced.

@torvalds
Copy link
Owner

torvalds commented May 11, 2012

On Fri, May 11, 2012 at 2:01 PM, Prathan Thananart
reply@reply.github.com
wrote:

While I do have great respect for you @torvalds and your work, and it's totally valid for the repository of Linux to have rather rigorous standards, have you considered the possibility there could be a lot of GitHub users who don't really need nor care about any of those "features" you try to portray as objectively superior?

Sure.

And when those people with lower standards try to get their commits
included in the kernel, I will ridicule them and point out how broken
their commit messages or pull requests are.

Agreed?

Btw, the commit message rules we use in the kernel really are
objectively better. The fact that some other projects don't care that
much is fine. But just compare kernel message logs to other projects,
and I think you'll find that no, it's not just "my opinion". We do
have standards, and the standards are there to make for better logs.

               Linus

@torvalds
Copy link
Owner

torvalds commented May 11, 2012

On Fri, May 11, 2012 at 2:03 PM, Mahmut Bulut
reply@reply.github.com
wrote:

So, if you can't "impolite" dear @torvalds, we can say 'why the "linux kernel" is here'?

.. because I think github does some things very well.

So sure, you may think I hate github. I don't. I hate very specific
parts of github that I think are done badly.

But other parts are done really really well.

I think github does a stellar job at the actual hosting part. I
really do. There is no question in my mind that github is one of the
absolute best places to host a project. It's fast, it's efficient, it
works, and it's available to anybody.

That's wonderful. I think github is absolutely lovely in many respects.

And that then makes me really annoyed at the places where I think
github does a subpar job: pull requests and committing changes using
the web interface.

            Linus

@mmorris-gc
Copy link

mmorris-gc commented May 11, 2012

Word-wrapping is a property of the text. And the tool you use to
visualize things cannot know. End result: you do word-wrapping at the
only stage where you can do it, namely when writing it. Not when
showing it.

Just curious - why is it that the tool used to visualize things cannot know how to wrap text it displays? And if it is the case, isn't that a problem with the viewer itself, rather than a reason to hard wrap?

@valpackett
Copy link

valpackett commented May 11, 2012

Commit messages must be limited to 140 characters, like tweets. Right in git's core.

(See what I did there? What's “pure garbage” for you is just perfect for a lot of people.)

@vertexclique
Copy link

vertexclique commented May 11, 2012

@torvalds Thank you for your rational and good opinion. I appreciate you.

@brettalton
Copy link

brettalton commented May 11, 2012

Do you guys not understand that this is Linus' blessed repository and he can accept and reject whomever and whichever request he likes? He has specific and pertinent rules when it comes to merging that he's learned over 20 years of maintaining the Linux kernel. He developed git - in case you forgot, he was the initial developer - with features specifically for gpg signoffs, shortlogs, etc. - things he and other intelligent computer scientists find useful for maintaining repositories.

I've maintained small projects with three developers plus myself and as soon as you become loose with your merging criteria, the entire repository goes to hell. If he wants gpg signoffs, then he'll get gpg signoffs. Try maintaining 20 millions lines of code and merges requests from 2,000 developers, and then you can give Linus advise.

@dustalov
Copy link

dustalov commented May 11, 2012

I think @torvalds is a pretty cool guy. eh scolds githubs and doesnt afraid of anything.

@MostAwesomeDude
Copy link
Contributor

MostAwesomeDude commented May 11, 2012

While I do have great respect for you @torvalds and your work, and it's totally valid for the repository of Linux to have rather rigorous standards, have you considered the possibility there could be a lot of GitHub users who don't really need nor care about any of those "features" you try to portray as objectively superior?

"GitHub is the best place to share code with friends, co-workers,
classmates, and complete strangers." As long as GH actually, genuinely
cares about making this statement true, they should be providing these
features.

Roman, in the future, you should follow the kernel's guide for
submitting patches. I believe that drivers/bluetooth is covered by the
list at linux-bluetooth@vger.kernel.org and you can submit your patch
to them, with a proper Signed-off-by tag.

FWIW, Reviewed-by: Corbin Simpson MostAwesomeDude@gmail.com, but
there's no way to confirm that since GH is going to hide my email
address and I can't easily sign this message.

(As an example of broken UI, while writing this message, I split my
screen between Firefox and vim, vertically. Linus' messages, being
wrapped, were perfectly readable, but because Github has a massive
minimum width, I had to scroll back and forth in order to read everybody
else's messages.)

rpardini pushed a commit to rpardini/linux that referenced this pull request Dec 20, 2022
Original-Subject: [ARCHEOLOGY] Add Radxa ROCK Pi 4C Plus (#4129)
> X-Git-Archeology: > recovered message: > * Add Rockpi 4C+
> X-Git-Archeology: > recovered message: > * add newer patches:
> X-Git-Archeology: > recovered message: > - apply patches from RadxaNaoki <noaki@radxa.com>
> X-Git-Archeology: > recovered message: > - ref 5652d6f9c2a4e2c50ac1040c0388859381b0616f: arm64: dts: rockchip: add gmac for ROCK 4C+ (torvalds#17)
> X-Git-Archeology: > recovered message: > - apply latest patches from Marcone <marco.nelissen@gmail.com>
> X-Git-Archeology: > recovered message: > - ref e39da181b099a86f5440ed1c08fc699d4a65aed7: arm64: dts: rockchip: Make Rock Pi 4C+ ethernet actually work
> X-Git-Archeology: > recovered message: > - ref 8c519612eeb852268371b3c596eec4622460e5bf: arm64: dts: rockchip: add Rock Pi 4C+ LEDs
> X-Git-Archeology: > recovered message: > - ref 726441afe687ea6059bac37f145ff204b75430f7: arm64: dts: rockchip: enable Rock Pi 4C+ wifi
> X-Git-Archeology: > recovered message: > - ref caad7bef3b5558e2598480c0a0089e2ac3cedcdd: arm64: dts: rockchip: enable Rock Pi 4C+ nvme
> X-Git-Archeology: > recovered message: > - ref 6cdc3215d1691bcd2a407a30e88efa0cec179eb2: arm64: dts: rockchip: enable Rock Pi 4C+ OTG
> X-Git-Archeology: > recovered message: > * default top USB3 port to host mode
> X-Git-Archeology: > recovered message: > * get 2nd HDMI port to work at least. :)
> X-Git-Archeology: > recovered message: > * revert OTG USB3.1 port back to otg mode
> X-Git-Archeology: > recovered message: > * [rockpi4c+] update board def.  add usb host overlay.
> X-Git-Archeology: > recovered message: > * remove redundant HDMI clocks and voltages
> X-Git-Archeology: > recovered message: > * enable test builds for Rock PI 4 C+
> X-Git-Archeology: > recovered message: > * [rockpi4c+] add USB host overlay
> X-Git-Archeology: > recovered message: > Co-authored-by: Joe Khoobyar <fourheads@gmail.com>
> X-Git-Archeology: - Revision 9780da320eeb45832ddb680959646fcc5a6a38c3: armbian/build@9780da3
> X-Git-Archeology:   Date: Wed, 02 Nov 2022 06:58:31 +0100
> X-Git-Archeology:   From: Igor Pecovnik <igorpecovnik@users.noreply.github.com>
> X-Git-Archeology:   Subject: Add Radxa ROCK Pi 4C Plus (#4129)
> X-Git-Archeology: 
> X-Git-Archeology: - Revision 92f1a22d76b987afa7ba555d5b509adc51d689e7: armbian/build@92f1a22
> X-Git-Archeology:   Date: Fri, 16 Dec 2022 13:38:13 +0100
> X-Git-Archeology:   From: Igor Pecovnik <igorpecovnik@users.noreply.github.com>
> X-Git-Archeology:   Subject: Re-add rockchip64 6.0 patches (#4575)
> X-Git-Archeology: 
X-Armbian: Patch-File: overlays-12-add-rockpi4cplus-usb-host
X-Armbian: Patch-File-Counter: 1
X-Armbian: Patch-Rel-Directory: patch/kernel/archive/rockchip64-6.1
X-Armbian: Patch-Type: kernel
X-Armbian: Patch-Root-Type: core
X-Armbian: Patch-Sub-Type: common
X-Armbian: Original-Subject: [ARCHEOLOGY] Add Radxa ROCK Pi 4C Plus (#4129)
rpardini pushed a commit to rpardini/linux that referenced this pull request Dec 20, 2022
Original-Subject: [ARCHEOLOGY] Add Radxa ROCK Pi 4C Plus (#4129)
> X-Git-Archeology: > recovered message: > * Add Rockpi 4C+
> X-Git-Archeology: > recovered message: > * add newer patches:
> X-Git-Archeology: > recovered message: > - apply patches from RadxaNaoki <noaki@radxa.com>
> X-Git-Archeology: > recovered message: > - ref 5652d6f9c2a4e2c50ac1040c0388859381b0616f: arm64: dts: rockchip: add gmac for ROCK 4C+ (torvalds#17)
> X-Git-Archeology: > recovered message: > - apply latest patches from Marcone <marco.nelissen@gmail.com>
> X-Git-Archeology: > recovered message: > - ref e39da181b099a86f5440ed1c08fc699d4a65aed7: arm64: dts: rockchip: Make Rock Pi 4C+ ethernet actually work
> X-Git-Archeology: > recovered message: > - ref 8c519612eeb852268371b3c596eec4622460e5bf: arm64: dts: rockchip: add Rock Pi 4C+ LEDs
> X-Git-Archeology: > recovered message: > - ref 726441afe687ea6059bac37f145ff204b75430f7: arm64: dts: rockchip: enable Rock Pi 4C+ wifi
> X-Git-Archeology: > recovered message: > - ref caad7bef3b5558e2598480c0a0089e2ac3cedcdd: arm64: dts: rockchip: enable Rock Pi 4C+ nvme
> X-Git-Archeology: > recovered message: > - ref 6cdc3215d1691bcd2a407a30e88efa0cec179eb2: arm64: dts: rockchip: enable Rock Pi 4C+ OTG
> X-Git-Archeology: > recovered message: > * default top USB3 port to host mode
> X-Git-Archeology: > recovered message: > * get 2nd HDMI port to work at least. :)
> X-Git-Archeology: > recovered message: > * revert OTG USB3.1 port back to otg mode
> X-Git-Archeology: > recovered message: > * [rockpi4c+] update board def.  add usb host overlay.
> X-Git-Archeology: > recovered message: > * remove redundant HDMI clocks and voltages
> X-Git-Archeology: > recovered message: > * enable test builds for Rock PI 4 C+
> X-Git-Archeology: > recovered message: > * [rockpi4c+] add USB host overlay
> X-Git-Archeology: > recovered message: > Co-authored-by: Joe Khoobyar <fourheads@gmail.com>
> X-Git-Archeology: - Revision 9780da320eeb45832ddb680959646fcc5a6a38c3: armbian/build@9780da3
> X-Git-Archeology:   Date: Wed, 02 Nov 2022 06:58:31 +0100
> X-Git-Archeology:   From: Igor Pecovnik <igorpecovnik@users.noreply.github.com>
> X-Git-Archeology:   Subject: Add Radxa ROCK Pi 4C Plus (#4129)
> X-Git-Archeology: 
> X-Git-Archeology: - Revision af24261cad8aac0fe13efd57449a82ab1b33e868: armbian/build@af24261
> X-Git-Archeology:   Date: Wed, 02 Nov 2022 10:45:35 -0400
> X-Git-Archeology:   From: Joe Khoobyar <joekhoobyar@users.noreply.github.com>
> X-Git-Archeology:   Subject: AR-1301: add edge and desktop (#4377)
> X-Git-Archeology: 
> X-Git-Archeology: - Revision 92f1a22d76b987afa7ba555d5b509adc51d689e7: armbian/build@92f1a22
> X-Git-Archeology:   Date: Fri, 16 Dec 2022 13:38:13 +0100
> X-Git-Archeology:   From: Igor Pecovnik <igorpecovnik@users.noreply.github.com>
> X-Git-Archeology:   Subject: Re-add rockchip64 6.0 patches (#4575)
> X-Git-Archeology: 
X-Armbian: Patch-File: add-board-rock-pi-4c-plus
X-Armbian: Patch-File-Counter: 1
X-Armbian: Patch-Rel-Directory: patch/kernel/archive/rockchip64-6.1
X-Armbian: Patch-Type: kernel
X-Armbian: Patch-Root-Type: core
X-Armbian: Patch-Sub-Type: common
X-Armbian: Original-Subject: [ARCHEOLOGY] Add Radxa ROCK Pi 4C Plus (#4129)
rpardini pushed a commit to rpardini/linux that referenced this pull request Dec 20, 2022
Original-Subject: [ARCHEOLOGY] Add Radxa ROCK Pi 4C Plus (#4129)
> X-Git-Archeology: > recovered message: > * Add Rockpi 4C+
> X-Git-Archeology: > recovered message: > * add newer patches:
> X-Git-Archeology: > recovered message: > - apply patches from RadxaNaoki <noaki@radxa.com>
> X-Git-Archeology: > recovered message: > - ref 5652d6f9c2a4e2c50ac1040c0388859381b0616f: arm64: dts: rockchip: add gmac for ROCK 4C+ (torvalds#17)
> X-Git-Archeology: > recovered message: > - apply latest patches from Marcone <marco.nelissen@gmail.com>
> X-Git-Archeology: > recovered message: > - ref e39da181b099a86f5440ed1c08fc699d4a65aed7: arm64: dts: rockchip: Make Rock Pi 4C+ ethernet actually work
> X-Git-Archeology: > recovered message: > - ref 8c519612eeb852268371b3c596eec4622460e5bf: arm64: dts: rockchip: add Rock Pi 4C+ LEDs
> X-Git-Archeology: > recovered message: > - ref 726441afe687ea6059bac37f145ff204b75430f7: arm64: dts: rockchip: enable Rock Pi 4C+ wifi
> X-Git-Archeology: > recovered message: > - ref caad7bef3b5558e2598480c0a0089e2ac3cedcdd: arm64: dts: rockchip: enable Rock Pi 4C+ nvme
> X-Git-Archeology: > recovered message: > - ref 6cdc3215d1691bcd2a407a30e88efa0cec179eb2: arm64: dts: rockchip: enable Rock Pi 4C+ OTG
> X-Git-Archeology: > recovered message: > * default top USB3 port to host mode
> X-Git-Archeology: > recovered message: > * get 2nd HDMI port to work at least. :)
> X-Git-Archeology: > recovered message: > * revert OTG USB3.1 port back to otg mode
> X-Git-Archeology: > recovered message: > * [rockpi4c+] update board def.  add usb host overlay.
> X-Git-Archeology: > recovered message: > * remove redundant HDMI clocks and voltages
> X-Git-Archeology: > recovered message: > * enable test builds for Rock PI 4 C+
> X-Git-Archeology: > recovered message: > * [rockpi4c+] add USB host overlay
> X-Git-Archeology: > recovered message: > Co-authored-by: Joe Khoobyar <fourheads@gmail.com>
> X-Git-Archeology: - Revision 9780da320eeb45832ddb680959646fcc5a6a38c3: armbian/build@9780da3
> X-Git-Archeology:   Date: Wed, 02 Nov 2022 06:58:31 +0100
> X-Git-Archeology:   From: Igor Pecovnik <igorpecovnik@users.noreply.github.com>
> X-Git-Archeology:   Subject: Add Radxa ROCK Pi 4C Plus (#4129)
> X-Git-Archeology: 
> X-Git-Archeology: - Revision af24261cad8aac0fe13efd57449a82ab1b33e868: armbian/build@af24261
> X-Git-Archeology:   Date: Wed, 02 Nov 2022 10:45:35 -0400
> X-Git-Archeology:   From: Joe Khoobyar <joekhoobyar@users.noreply.github.com>
> X-Git-Archeology:   Subject: AR-1301: add edge and desktop (#4377)
> X-Git-Archeology: 
> X-Git-Archeology: - Revision 92f1a22d76b987afa7ba555d5b509adc51d689e7: armbian/build@92f1a22
> X-Git-Archeology:   Date: Fri, 16 Dec 2022 13:38:13 +0100
> X-Git-Archeology:   From: Igor Pecovnik <igorpecovnik@users.noreply.github.com>
> X-Git-Archeology:   Subject: Re-add rockchip64 6.0 patches (#4575)
> X-Git-Archeology: 
X-Armbian: Patch-File: overlays-12-add-rockpi4cplus-usb-host
X-Armbian: Patch-File-Counter: 1
X-Armbian: Patch-Rel-Directory: patch/kernel/archive/rockchip64-6.1
X-Armbian: Patch-Type: kernel
X-Armbian: Patch-Root-Type: core
X-Armbian: Patch-Sub-Type: common
X-Armbian: Original-Subject: [ARCHEOLOGY] Add Radxa ROCK Pi 4C Plus (#4129)
rpardini pushed a commit to rpardini/linux that referenced this pull request Dec 22, 2022
Original-Subject: [ARCHEOLOGY] Add Radxa ROCK Pi 4C Plus (#4129)
> X-Git-Archeology: > recovered message: > * Add Rockpi 4C+
> X-Git-Archeology: > recovered message: > * add newer patches:
> X-Git-Archeology: > recovered message: > - apply patches from RadxaNaoki <noaki@radxa.com>
> X-Git-Archeology: > recovered message: > - ref 5652d6f9c2a4e2c50ac1040c0388859381b0616f: arm64: dts: rockchip: add gmac for ROCK 4C+ (torvalds#17)
> X-Git-Archeology: > recovered message: > - apply latest patches from Marcone <marco.nelissen@gmail.com>
> X-Git-Archeology: > recovered message: > - ref e39da181b099a86f5440ed1c08fc699d4a65aed7: arm64: dts: rockchip: Make Rock Pi 4C+ ethernet actually work
> X-Git-Archeology: > recovered message: > - ref 8c519612eeb852268371b3c596eec4622460e5bf: arm64: dts: rockchip: add Rock Pi 4C+ LEDs
> X-Git-Archeology: > recovered message: > - ref 726441afe687ea6059bac37f145ff204b75430f7: arm64: dts: rockchip: enable Rock Pi 4C+ wifi
> X-Git-Archeology: > recovered message: > - ref caad7bef3b5558e2598480c0a0089e2ac3cedcdd: arm64: dts: rockchip: enable Rock Pi 4C+ nvme
> X-Git-Archeology: > recovered message: > - ref 6cdc3215d1691bcd2a407a30e88efa0cec179eb2: arm64: dts: rockchip: enable Rock Pi 4C+ OTG
> X-Git-Archeology: > recovered message: > * default top USB3 port to host mode
> X-Git-Archeology: > recovered message: > * get 2nd HDMI port to work at least. :)
> X-Git-Archeology: > recovered message: > * revert OTG USB3.1 port back to otg mode
> X-Git-Archeology: > recovered message: > * [rockpi4c+] update board def.  add usb host overlay.
> X-Git-Archeology: > recovered message: > * remove redundant HDMI clocks and voltages
> X-Git-Archeology: > recovered message: > * enable test builds for Rock PI 4 C+
> X-Git-Archeology: > recovered message: > * [rockpi4c+] add USB host overlay
> X-Git-Archeology: > recovered message: > Co-authored-by: Joe Khoobyar <fourheads@gmail.com>
> X-Git-Archeology: - Revision 9780da320eeb45832ddb680959646fcc5a6a38c3: armbian/build@9780da3
> X-Git-Archeology:   Date: Wed, 02 Nov 2022 06:58:31 +0100
> X-Git-Archeology:   From: Igor Pecovnik <igorpecovnik@users.noreply.github.com>
> X-Git-Archeology:   Subject: Add Radxa ROCK Pi 4C Plus (#4129)
> X-Git-Archeology: 
> X-Git-Archeology: - Revision af24261cad8aac0fe13efd57449a82ab1b33e868: armbian/build@af24261
> X-Git-Archeology:   Date: Wed, 02 Nov 2022 10:45:35 -0400
> X-Git-Archeology:   From: Joe Khoobyar <joekhoobyar@users.noreply.github.com>
> X-Git-Archeology:   Subject: AR-1301: add edge and desktop (#4377)
> X-Git-Archeology: 
> X-Git-Archeology: - Revision 92f1a22d76b987afa7ba555d5b509adc51d689e7: armbian/build@92f1a22
> X-Git-Archeology:   Date: Fri, 16 Dec 2022 13:38:13 +0100
> X-Git-Archeology:   From: Igor Pecovnik <igorpecovnik@users.noreply.github.com>
> X-Git-Archeology:   Subject: Re-add rockchip64 6.0 patches (#4575)
> X-Git-Archeology: 
X-Armbian: Patch-File: add-board-rock-pi-4c-plus
X-Armbian: Patch-File-Counter: 1
X-Armbian: Patch-Rel-Directory: patch/kernel/archive/rockchip64-6.1
X-Armbian: Patch-Type: kernel
X-Armbian: Patch-Root-Type: core
X-Armbian: Patch-Sub-Type: common
X-Armbian: Original-Subject: [ARCHEOLOGY] Add Radxa ROCK Pi 4C Plus (#4129)
rpardini pushed a commit to rpardini/linux that referenced this pull request Dec 22, 2022
Original-Subject: [ARCHEOLOGY] Add Radxa ROCK Pi 4C Plus (#4129)
> X-Git-Archeology: > recovered message: > * Add Rockpi 4C+
> X-Git-Archeology: > recovered message: > * add newer patches:
> X-Git-Archeology: > recovered message: > - apply patches from RadxaNaoki <noaki@radxa.com>
> X-Git-Archeology: > recovered message: > - ref 5652d6f9c2a4e2c50ac1040c0388859381b0616f: arm64: dts: rockchip: add gmac for ROCK 4C+ (torvalds#17)
> X-Git-Archeology: > recovered message: > - apply latest patches from Marcone <marco.nelissen@gmail.com>
> X-Git-Archeology: > recovered message: > - ref e39da181b099a86f5440ed1c08fc699d4a65aed7: arm64: dts: rockchip: Make Rock Pi 4C+ ethernet actually work
> X-Git-Archeology: > recovered message: > - ref 8c519612eeb852268371b3c596eec4622460e5bf: arm64: dts: rockchip: add Rock Pi 4C+ LEDs
> X-Git-Archeology: > recovered message: > - ref 726441afe687ea6059bac37f145ff204b75430f7: arm64: dts: rockchip: enable Rock Pi 4C+ wifi
> X-Git-Archeology: > recovered message: > - ref caad7bef3b5558e2598480c0a0089e2ac3cedcdd: arm64: dts: rockchip: enable Rock Pi 4C+ nvme
> X-Git-Archeology: > recovered message: > - ref 6cdc3215d1691bcd2a407a30e88efa0cec179eb2: arm64: dts: rockchip: enable Rock Pi 4C+ OTG
> X-Git-Archeology: > recovered message: > * default top USB3 port to host mode
> X-Git-Archeology: > recovered message: > * get 2nd HDMI port to work at least. :)
> X-Git-Archeology: > recovered message: > * revert OTG USB3.1 port back to otg mode
> X-Git-Archeology: > recovered message: > * [rockpi4c+] update board def.  add usb host overlay.
> X-Git-Archeology: > recovered message: > * remove redundant HDMI clocks and voltages
> X-Git-Archeology: > recovered message: > * enable test builds for Rock PI 4 C+
> X-Git-Archeology: > recovered message: > * [rockpi4c+] add USB host overlay
> X-Git-Archeology: > recovered message: > Co-authored-by: Joe Khoobyar <fourheads@gmail.com>
> X-Git-Archeology: - Revision 9780da320eeb45832ddb680959646fcc5a6a38c3: armbian/build@9780da3
> X-Git-Archeology:   Date: Wed, 02 Nov 2022 06:58:31 +0100
> X-Git-Archeology:   From: Igor Pecovnik <igorpecovnik@users.noreply.github.com>
> X-Git-Archeology:   Subject: Add Radxa ROCK Pi 4C Plus (#4129)
> X-Git-Archeology: 
> X-Git-Archeology: - Revision af24261cad8aac0fe13efd57449a82ab1b33e868: armbian/build@af24261
> X-Git-Archeology:   Date: Wed, 02 Nov 2022 10:45:35 -0400
> X-Git-Archeology:   From: Joe Khoobyar <joekhoobyar@users.noreply.github.com>
> X-Git-Archeology:   Subject: AR-1301: add edge and desktop (#4377)
> X-Git-Archeology: 
> X-Git-Archeology: - Revision 92f1a22d76b987afa7ba555d5b509adc51d689e7: armbian/build@92f1a22
> X-Git-Archeology:   Date: Fri, 16 Dec 2022 13:38:13 +0100
> X-Git-Archeology:   From: Igor Pecovnik <igorpecovnik@users.noreply.github.com>
> X-Git-Archeology:   Subject: Re-add rockchip64 6.0 patches (#4575)
> X-Git-Archeology: 
X-Armbian: Patch-File: overlays-12-add-rockpi4cplus-usb-host
X-Armbian: Patch-File-Counter: 1
X-Armbian: Patch-Rel-Directory: patch/kernel/archive/rockchip64-6.1
X-Armbian: Patch-Type: kernel
X-Armbian: Patch-Root-Type: core
X-Armbian: Patch-Sub-Type: common
X-Armbian: Original-Subject: [ARCHEOLOGY] Add Radxa ROCK Pi 4C Plus (#4129)
rpardini pushed a commit to rpardini/linux that referenced this pull request Dec 23, 2022
Original-Subject: [ARCHEOLOGY] Add Radxa ROCK Pi 4C Plus (#4129)
> X-Git-Archeology: > recovered message: > * Add Rockpi 4C+
> X-Git-Archeology: > recovered message: > * add newer patches:
> X-Git-Archeology: > recovered message: > - apply patches from RadxaNaoki <noaki@radxa.com>
> X-Git-Archeology: > recovered message: > - ref 5652d6f9c2a4e2c50ac1040c0388859381b0616f: arm64: dts: rockchip: add gmac for ROCK 4C+ (torvalds#17)
> X-Git-Archeology: > recovered message: > - apply latest patches from Marcone <marco.nelissen@gmail.com>
> X-Git-Archeology: > recovered message: > - ref e39da181b099a86f5440ed1c08fc699d4a65aed7: arm64: dts: rockchip: Make Rock Pi 4C+ ethernet actually work
> X-Git-Archeology: > recovered message: > - ref 8c519612eeb852268371b3c596eec4622460e5bf: arm64: dts: rockchip: add Rock Pi 4C+ LEDs
> X-Git-Archeology: > recovered message: > - ref 726441afe687ea6059bac37f145ff204b75430f7: arm64: dts: rockchip: enable Rock Pi 4C+ wifi
> X-Git-Archeology: > recovered message: > - ref caad7bef3b5558e2598480c0a0089e2ac3cedcdd: arm64: dts: rockchip: enable Rock Pi 4C+ nvme
> X-Git-Archeology: > recovered message: > - ref 6cdc3215d1691bcd2a407a30e88efa0cec179eb2: arm64: dts: rockchip: enable Rock Pi 4C+ OTG
> X-Git-Archeology: > recovered message: > * default top USB3 port to host mode
> X-Git-Archeology: > recovered message: > * get 2nd HDMI port to work at least. :)
> X-Git-Archeology: > recovered message: > * revert OTG USB3.1 port back to otg mode
> X-Git-Archeology: > recovered message: > * [rockpi4c+] update board def.  add usb host overlay.
> X-Git-Archeology: > recovered message: > * remove redundant HDMI clocks and voltages
> X-Git-Archeology: > recovered message: > * enable test builds for Rock PI 4 C+
> X-Git-Archeology: > recovered message: > * [rockpi4c+] add USB host overlay
> X-Git-Archeology: > recovered message: > Co-authored-by: Joe Khoobyar <fourheads@gmail.com>
> X-Git-Archeology: - Revision 9780da320eeb45832ddb680959646fcc5a6a38c3: armbian/build@9780da3
> X-Git-Archeology:   Date: Wed, 02 Nov 2022 06:58:31 +0100
> X-Git-Archeology:   From: Igor Pecovnik <igorpecovnik@users.noreply.github.com>
> X-Git-Archeology:   Subject: Add Radxa ROCK Pi 4C Plus (#4129)
> X-Git-Archeology: 
> X-Git-Archeology: - Revision af24261cad8aac0fe13efd57449a82ab1b33e868: armbian/build@af24261
> X-Git-Archeology:   Date: Wed, 02 Nov 2022 10:45:35 -0400
> X-Git-Archeology:   From: Joe Khoobyar <joekhoobyar@users.noreply.github.com>
> X-Git-Archeology:   Subject: AR-1301: add edge and desktop (#4377)
> X-Git-Archeology: 
> X-Git-Archeology: - Revision 92f1a22d76b987afa7ba555d5b509adc51d689e7: armbian/build@92f1a22
> X-Git-Archeology:   Date: Fri, 16 Dec 2022 13:38:13 +0100
> X-Git-Archeology:   From: Igor Pecovnik <igorpecovnik@users.noreply.github.com>
> X-Git-Archeology:   Subject: Re-add rockchip64 6.0 patches (#4575)
> X-Git-Archeology: 
X-Armbian: Patch-File: overlays-12-add-rockpi4cplus-usb-host
X-Armbian: Patch-File-Counter: 1
X-Armbian: Patch-Rel-Directory: patch/kernel/archive/rockchip64-6.1
X-Armbian: Patch-Type: kernel
X-Armbian: Patch-Root-Type: core
X-Armbian: Patch-Sub-Type: common
X-Armbian: Original-Subject: [ARCHEOLOGY] Add Radxa ROCK Pi 4C Plus (#4129)
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 25, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 25, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 25, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 25, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 25, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 25, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 25, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 25, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ammarfaizi2 pushed a commit to ammarfaizi2/linux-fork that referenced this pull request Dec 26, 2022
…g the sock

[ Upstream commit 3cf7203 ]

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   torvalds#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   torvalds#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   torvalds#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   torvalds#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  torvalds#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  torvalds#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  torvalds#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  torvalds#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  torvalds#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  torvalds#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  torvalds#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  torvalds#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  torvalds#18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.

Reported-by: Jianlin Shi <jishi@redhat.com>
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Fixes: 6a93cc9 ("udp-tunnel: Add a few more UDP tunnel APIs")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment