ctrliq · PlaidCat · Mar 12, 2025 · Mar 11, 2025 · Mar 11, 2025 · Mar 11, 2025
diff --git a/COPYING-5.14.0-503.26.1.el9_5 → COPYING-5.14.0-503.29.1.el9_5 b/COPYING-5.14.0-503.26.1.el9_5 → COPYING-5.14.0-503.29.1.el9_5
diff --git a/Documentation/networking/device_drivers/ethernet/intel/i40e.rst b/Documentation/networking/device_drivers/ethernet/intel/i40e.rst
@@ -299,6 +299,18 @@ Use ethtool to view and set link-down-on-close, as follows::
   ethtool --show-priv-flags ethX
   ethtool --set-priv-flags ethX link-down-on-close [on|off]
 
+Setting the mdd-auto-reset-vf Private Flag
+------------------------------------------
+
+When the mdd-auto-reset-vf private flag is set to "on", the problematic VF will
+be automatically reset if a malformed descriptor is detected. If the flag is
+set to "off", the problematic VF will be disabled.
+
+Use ethtool to view and set mdd-auto-reset-vf, as follows::
+
+  ethtool --show-priv-flags ethX
+  ethtool --set-priv-flags ethX mdd-auto-reset-vf [on|off]
+
 Viewing Link Messages
 ---------------------
 Link messages will not be displayed to the console if the distribution is

diff --git a/Makefile.rhelver b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 5
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 503.26.1
+RHEL_RELEASE = 503.29.1
 
 #
 # ZSTREAM

diff --git a/arch/x86/kernel/cpu/resctrl/core.c b/arch/x86/kernel/cpu/resctrl/core.c
@@ -231,19 +231,17 @@ static bool __get_mem_config_intel(struct rdt_resource *r)
 static bool __rdt_get_mem_config_amd(struct rdt_resource *r)
 {
 	struct rdt_hw_resource *hw_res = resctrl_to_arch_res(r);
-	union cpuid_0x10_3_eax eax;
-	union cpuid_0x10_x_edx edx;
-	u32 ebx, ecx, subleaf;
+	u32 eax, ebx, ecx, edx, subleaf;
 
 	/*
 	 * Query CPUID_Fn80000020_EDX_x01 for MBA and
 	 * CPUID_Fn80000020_EDX_x02 for SMBA
 	 */
 	subleaf = (r->rid == RDT_RESOURCE_SMBA) ? 2 :  1;
 
-	cpuid_count(0x80000020, subleaf, &eax.full, &ebx, &ecx, &edx.full);
-	hw_res->num_closid = edx.split.cos_max + 1;
-	r->default_ctrl = MAX_MBA_BW_AMD;
+	cpuid_count(0x80000020, subleaf, &eax, &ebx, &ecx, &edx);
+	hw_res->num_closid = edx + 1;
+	r->default_ctrl = 1 << eax;
 
 	/* AMD does not use delay */
 	r->membw.delay_linear = false;

diff --git a/arch/x86/kernel/cpu/resctrl/internal.h b/arch/x86/kernel/cpu/resctrl/internal.h
@@ -18,7 +18,6 @@
 #define MBM_OVERFLOW_INTERVAL		1000
 #define MAX_MBA_BW			100u
 #define MBA_IS_LINEAR			0x4
-#define MAX_MBA_BW_AMD			0x800
 #define MBM_CNTR_WIDTH_OFFSET_AMD	20
 
 #define RMID_VAL_ERROR			BIT_ULL(63)
@@ -395,6 +394,8 @@ struct rdt_parse_data {
  * @msr_update:		Function pointer to update QOS MSRs
  * @mon_scale:		cqm counter * mon_scale = occupancy in bytes
  * @mbm_width:		Monitor width, to detect and correct for overflow.
+ * @mbm_cfg_mask:	Bandwidth sources that can be tracked when Bandwidth
+ *			Monitoring Event Configuration (BMEC) is supported.
  * @cdp_enabled:	CDP state of this resource
  *
  * Members of this structure are either private to the architecture
@@ -409,6 +410,7 @@ struct rdt_hw_resource {
 				 struct rdt_resource *r);
 	unsigned int		mon_scale;
 	unsigned int		mbm_width;
+	unsigned int		mbm_cfg_mask;
 	bool			cdp_enabled;
 };
 

diff --git a/arch/x86/kernel/cpu/resctrl/monitor.c b/arch/x86/kernel/cpu/resctrl/monitor.c
@@ -813,6 +813,12 @@ int __init rdt_get_mon_l3_config(struct rdt_resource *r)
 		return ret;
 
 	if (rdt_cpu_has(X86_FEATURE_BMEC)) {
+		u32 eax, ebx, ecx, edx;
+
+		/* Detect list of bandwidth sources that can be tracked */
+		cpuid_count(0x80000020, 3, &eax, &ebx, &ecx, &edx);
+		hw_res->mbm_cfg_mask = ecx & MAX_EVT_CONFIG_BITS;
+
 		if (rdt_cpu_has(X86_FEATURE_CQM_MBM_TOTAL)) {
 			mbm_total_event.configurable = true;
 			mbm_config_rftype_init("mbm_total_bytes_config");

diff --git a/arch/x86/kernel/cpu/resctrl/rdtgroup.c b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
@@ -1614,17 +1614,10 @@ static void mon_event_config_write(void *info)
 	wrmsr(MSR_IA32_EVT_CFG_BASE + index, mon_info->mon_config, 0);
 }
 
-static int mbm_config_write_domain(struct rdt_resource *r,
-				   struct rdt_domain *d, u32 evtid, u32 val)
+static void mbm_config_write_domain(struct rdt_resource *r,
+				    struct rdt_domain *d, u32 evtid, u32 val)
 {
 	struct mon_config_info mon_info = {0};
-	int ret = 0;
-
-	/* mon_config cannot be more than the supported set of events */
-	if (val > MAX_EVT_CONFIG_BITS) {
-		rdt_last_cmd_puts("Invalid event configuration\n");
-		return -EINVAL;
-	}
 
 	/*
 	 * Read the current config value first. If both are the same then
@@ -1633,7 +1626,7 @@ static int mbm_config_write_domain(struct rdt_resource *r,
 	mon_info.evtid = evtid;
 	mondata_config_read(d, &mon_info);
 	if (mon_info.mon_config == val)
-		goto out;
+		return;
 
 	mon_info.mon_config = val;
 
@@ -1656,17 +1649,14 @@ static int mbm_config_write_domain(struct rdt_resource *r,
 	 * mbm_local and mbm_total counts for all the RMIDs.
 	 */
 	resctrl_arch_reset_rmid_all(r, d);
-
-out:
-	return ret;
 }
 
 static int mon_config_write(struct rdt_resource *r, char *tok, u32 evtid)
 {
+	struct rdt_hw_resource *hw_res = resctrl_to_arch_res(r);
 	char *dom_str = NULL, *id_str;
 	unsigned long dom_id, val;
 	struct rdt_domain *d;
-	int ret = 0;
 
 next:
 	if (!tok || tok[0] == '\0')
@@ -1686,11 +1676,16 @@ static int mon_config_write(struct rdt_resource *r, char *tok, u32 evtid)
 		return -EINVAL;
 	}
 
+	/* Value from user cannot be more than the supported set of events */
+	if ((val & hw_res->mbm_cfg_mask) != val) {
+		rdt_last_cmd_printf("Invalid event configuration: max valid mask is 0x%02x\n",
+				    hw_res->mbm_cfg_mask);
+		return -EINVAL;
+	}
+
 	list_for_each_entry(d, &r->domains, list) {
 		if (d->id == dom_id) {
-			ret = mbm_config_write_domain(r, d, evtid, val);
-			if (ret)
-				return -EINVAL;
+			mbm_config_write_domain(r, d, evtid, val);
 			goto next;
 		}
 	}

diff --git a/ciq/ciq_backports/kernel-5.14.0-503.29.1.el9_5/4dabcdf5.failed b/ciq/ciq_backports/kernel-5.14.0-503.29.1.el9_5/4dabcdf5.failed
@@ -0,0 +1,142 @@
+tcp: fix mptcp DSS corruption due to large pmtu xmit
+
+jira LE-2522
+Rebuild_History Non-Buildable kernel-5.14.0-503.29.1.el9_5
+commit-author Paolo Abeni <[email protected]>
+commit 4dabcdf581217e60690467a37c956a5b8dbc6bd9
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-5.14.0-503.29.1.el9_5/4dabcdf5.failed
+
+Syzkaller was able to trigger a DSS corruption:
+
+  TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies.
+  ------------[ cut here ]------------
+  WARNING: CPU: 0 PID: 5227 at net/mptcp/protocol.c:695 __mptcp_move_skbs_from_subflow+0x20a9/0x21f0 net/mptcp/protocol.c:695
+  Modules linked in:
+  CPU: 0 UID: 0 PID: 5227 Comm: syz-executor350 Not tainted 6.11.0-syzkaller-08829-gaf9c191ac2a0 #0
+  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
+  RIP: 0010:__mptcp_move_skbs_from_subflow+0x20a9/0x21f0 net/mptcp/protocol.c:695
+  Code: 0f b6 dc 31 ff 89 de e8 b5 dd ea f5 89 d8 48 81 c4 50 01 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 98 da ea f5 90 <0f> 0b 90 e9 47 ff ff ff e8 8a da ea f5 90 0f 0b 90 e9 99 e0 ff ff
+  RSP: 0018:ffffc90000006db8 EFLAGS: 00010246
+  RAX: ffffffff8ba9df18 RBX: 00000000000055f0 RCX: ffff888030023c00
+  RDX: 0000000000000100 RSI: 00000000000081e5 RDI: 00000000000055f0
+  RBP: 1ffff110062bf1ae R08: ffffffff8ba9cf12 R09: 1ffff110062bf1b8
+  R10: dffffc0000000000 R11: ffffed10062bf1b9 R12: 0000000000000000
+  R13: dffffc0000000000 R14: 00000000700cec61 R15: 00000000000081e5
+  FS:  000055556679c380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
+  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+  CR2: 0000000020287000 CR3: 0000000077892000 CR4: 00000000003506f0
+  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+  Call Trace:
+   <IRQ>
+   move_skbs_to_msk net/mptcp/protocol.c:811 [inline]
+   mptcp_data_ready+0x29c/0xa90 net/mptcp/protocol.c:854
+   subflow_data_ready+0x34a/0x920 net/mptcp/subflow.c:1490
+   tcp_data_queue+0x20fd/0x76c0 net/ipv4/tcp_input.c:5283
+   tcp_rcv_established+0xfba/0x2020 net/ipv4/tcp_input.c:6237
+   tcp_v4_do_rcv+0x96d/0xc70 net/ipv4/tcp_ipv4.c:1915
+   tcp_v4_rcv+0x2dc0/0x37f0 net/ipv4/tcp_ipv4.c:2350
+   ip_protocol_deliver_rcu+0x22e/0x440 net/ipv4/ip_input.c:205
+   ip_local_deliver_finish+0x341/0x5f0 net/ipv4/ip_input.c:233
+   NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314
+   NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314
+   __netif_receive_skb_one_core net/core/dev.c:5662 [inline]
+   __netif_receive_skb+0x2bf/0x650 net/core/dev.c:5775
+   process_backlog+0x662/0x15b0 net/core/dev.c:6107
+   __napi_poll+0xcb/0x490 net/core/dev.c:6771
+   napi_poll net/core/dev.c:6840 [inline]
+   net_rx_action+0x89b/0x1240 net/core/dev.c:6962
+   handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
+   do_softirq+0x11b/0x1e0 kernel/softirq.c:455
+   </IRQ>
+   <TASK>
+   __local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382
+   local_bh_enable include/linux/bottom_half.h:33 [inline]
+   rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]
+   __dev_queue_xmit+0x1764/0x3e80 net/core/dev.c:4451
+   dev_queue_xmit include/linux/netdevice.h:3094 [inline]
+   neigh_hh_output include/net/neighbour.h:526 [inline]
+   neigh_output include/net/neighbour.h:540 [inline]
+   ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236
+   ip_local_out net/ipv4/ip_output.c:130 [inline]
+   __ip_queue_xmit+0x118c/0x1b80 net/ipv4/ip_output.c:536
+   __tcp_transmit_skb+0x2544/0x3b30 net/ipv4/tcp_output.c:1466
+   tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline]
+   tcp_mtu_probe net/ipv4/tcp_output.c:2547 [inline]
+   tcp_write_xmit+0x641d/0x6bf0 net/ipv4/tcp_output.c:2752
+   __tcp_push_pending_frames+0x9b/0x360 net/ipv4/tcp_output.c:3015
+   tcp_push_pending_frames include/net/tcp.h:2107 [inline]
+   tcp_data_snd_check net/ipv4/tcp_input.c:5714 [inline]
+   tcp_rcv_established+0x1026/0x2020 net/ipv4/tcp_input.c:6239
+   tcp_v4_do_rcv+0x96d/0xc70 net/ipv4/tcp_ipv4.c:1915
+   sk_backlog_rcv include/net/sock.h:1113 [inline]
+   __release_sock+0x214/0x350 net/core/sock.c:3072
+   release_sock+0x61/0x1f0 net/core/sock.c:3626
+   mptcp_push_release net/mptcp/protocol.c:1486 [inline]
+   __mptcp_push_pending+0x6b5/0x9f0 net/mptcp/protocol.c:1625
+   mptcp_sendmsg+0x10bb/0x1b10 net/mptcp/protocol.c:1903
+   sock_sendmsg_nosec net/socket.c:730 [inline]
+   __sock_sendmsg+0x1a6/0x270 net/socket.c:745
+   ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2603
+   ___sys_sendmsg net/socket.c:2657 [inline]
+   __sys_sendmsg+0x2aa/0x390 net/socket.c:2686
+   do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
+   entry_SYSCALL_64_after_hwframe+0x77/0x7f
+  RIP: 0033:0x7fb06e9317f9
+  Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
+  RSP: 002b:00007ffe2cfd4f98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+  RAX: ffffffffffffffda RBX: 00007fb06e97f468 RCX: 00007fb06e9317f9
+  RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000005
+  RBP: 00007fb06e97f446 R08: 0000555500000000 R09: 0000555500000000
+  R10: 0000555500000000 R11: 0000000000000246 R12: 00007fb06e97f406
+  R13: 0000000000000001 R14: 00007ffe2cfd4fe0 R15: 0000000000000003
+   </TASK>
+
+Additionally syzkaller provided a nice reproducer. The repro enables
+pmtu on the loopback device, leading to tcp_mtu_probe() generating
+very large probe packets.
+
+tcp_can_coalesce_send_queue_head() currently does not check for
+mptcp-level invariants, and allowed the creation of cross-DSS probes,
+leading to the mentioned corruption.
+
+Address the issue teaching tcp_can_coalesce_send_queue_head() about
+mptcp using the tcp_skb_can_collapse(), also reducing the code
+duplication.
+
+Fixes: 85712484110d ("tcp: coalesce/collapse must respect MPTCP extensions")
+	Cc: [email protected]
+	Reported-by: [email protected]
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/513
+	Signed-off-by: Paolo Abeni <[email protected]>
+	Acked-by: Matthieu Baerts (NGI0) <[email protected]>
+	Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>
+Link: https://patch.msgid.link/[email protected]
+	Signed-off-by: Jakub Kicinski <[email protected]>
+(cherry picked from commit 4dabcdf581217e60690467a37c956a5b8dbc6bd9)
+	Signed-off-by: Jonathan Maple <[email protected]>
+
+# Conflicts:
+#	net/ipv4/tcp_output.c
+diff --cc net/ipv4/tcp_output.c
+index 26207b4fe4ff,68804fd01daf..000000000000
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@@ -2310,9 -2342,7 +2310,13 @@@ static bool tcp_can_coalesce_send_queue
+  		if (len <= skb->len)
+  			break;
+
+++<<<<<<< HEAD
+ +		if (unlikely(TCP_SKB_CB(skb)->eor) ||
+ +		    tcp_has_tx_tstamp(skb) ||
+ +		    !skb_pure_zcopy_same(skb, next))
+++=======
++ 		if (tcp_has_tx_tstamp(skb) || !tcp_skb_can_collapse(skb, next))
+++>>>>>>> 4dabcdf58121 (tcp: fix mptcp DSS corruption due to large pmtu xmit)
+  			return false;
+
+  		len -= skb->len;
+* Unmerged path net/ipv4/tcp_output.c
diff --git a/ciq/ciq_backports/kernel-5.14.0-503.29.1.el9_5/d7c31cbd.failed b/ciq/ciq_backports/kernel-5.14.0-503.29.1.el9_5/d7c31cbd.failed
@@ -0,0 +1,45 @@
+net: ip6mr: add RTM_GETROUTE netlink op
+
+jira LE-2522
+Rebuild_History Non-Buildable kernel-5.14.0-503.29.1.el9_5
+commit-author David Lamparter <[email protected]>
+commit d7c31cbde4bc6756d1a11747d2b99bc627001c86
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-5.14.0-503.29.1.el9_5/d7c31cbd.failed
+
+The IPv6 multicast routing code previously implemented only the dump
+variant of RTM_GETROUTE.  Implement single MFC item retrieval by copying
+and adapting the respective IPv4 code.
+
+Tested against FRRouting's IPv6 PIM stack.
+
+	Signed-off-by: David Lamparter <[email protected]>
+	Reviewed-by: Nikolay Aleksandrov <[email protected]>
+	Reviewed-by: David Ahern <[email protected]>
+	Cc: Jakub Kicinski <[email protected]>
+	Signed-off-by: David S. Miller <[email protected]>
+(cherry picked from commit d7c31cbde4bc6756d1a11747d2b99bc627001c86)
+	Signed-off-by: Jonathan Maple <[email protected]>
+
+# Conflicts:
+#	net/ipv6/ip6mr.c
+diff --cc net/ipv6/ip6mr.c
+index 82ffa9515d31,d546fc09d803..000000000000
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@@ -89,7 -94,9 +89,13 @@@ static int ip6mr_cache_report(struct mr
+  			      mifi_t mifi, int assert);
+  static void mr6_netlink_event(struct mr_table *mrt, struct mfc6_cache *mfc,
+  			      int cmd);
+++<<<<<<< HEAD
+ +static void mrt6msg_netlink_event(struct mr_table *mrt, struct sk_buff *pkt);
+++=======
++ static void mrt6msg_netlink_event(const struct mr_table *mrt, struct sk_buff *pkt);
++ static int ip6mr_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
++ 			      struct netlink_ext_ack *extack);
+++>>>>>>> d7c31cbde4bc (net: ip6mr: add RTM_GETROUTE netlink op)
+  static int ip6mr_rtm_dumproute(struct sk_buff *skb,
+  			       struct netlink_callback *cb);
+  static void mroute_clean_tables(struct mr_table *mrt, int flags);
+* Unmerged path net/ipv6/ip6mr.c