1. 19 Jan, 2018 2 commits
    • Alexey Kodanev's avatar
      ip6_gre: init dev->mtu and dev->hard_header_len correctly · 128bb975
      Alexey Kodanev authored
      Commit b05229f4 ("gre6: Cleanup GREv6 transmit path,
      call common GRE functions") moved dev->mtu initialization
      from ip6gre_tunnel_setup() to ip6gre_tunnel_init(), as a
      result, the previously set values, before ndo_init(), are
      reset in the following cases:
      * rtnl_create_link() can update dev->mtu from IFLA_MTU
      * ip6gre_tnl_link_config() is invoked before ndo_init() in
        netlink and ioctl setup, so ndo_init() can reset MTU
        adjustments with the lower device MTU as well, dev->mtu
        and dev->hard_header_len.
        Not applicable for ip6gretap because it has one more call
        to ip6gre_tnl_link_config(tunnel, 1) in ip6gre_tap_init().
      Fix the first case by updating dev->mtu with 'tb[IFLA_MTU]'
      parameter if a user sets it manually on a device creation,
      and fix the second one by moving ip6gre_tnl_link_config()
      call after register_netdevice().
      Fixes: b05229f4 ("gre6: Cleanup GREv6 transmit path, call common GRE functions")
      Fixes: db2ec95d ("ip6_gre: Fix MTU setting")
      Signed-off-by: default avatarAlexey Kodanev <alexey.kodanev@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Ido Schimmel's avatar
      mlxsw: spectrum_router: Free LPM tree upon failure · ed604c5d
      Ido Schimmel authored
      When a new LPM tree is created, we try to replace the trees in the
      existing virtual routers with it. If we fail, the tree needs to be
      Currently, this does not happen in the unlikely case where we fail to
      bind the tree to the first virtual router, since its reference count
      never transitions from 1 to 0.
      Fix that by taking a reference before binding the tree.
      Fixes: fc922bb0 ("mlxsw: spectrum_router: Use one LPM tree for all virtual routers")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
  2. 18 Jan, 2018 7 commits
    • Eric Dumazet's avatar
      flow_dissector: properly cap thoff field · d0c081b4
      Eric Dumazet authored
      syzbot reported yet another crash [1] that is caused by
      insufficient validation of DODGY packets.
      Two bugs are happening here to trigger the crash.
      1) Flow dissection leaves with incorrect thoff field.
      2) skb_probe_transport_header() sets transport header to this invalid
      thoff, even if pointing after skb valid data.
      3) qdisc_pkt_len_init() reads out-of-bound data because it
      trusts tcp_hdrlen(skb)
      Possible fixes :
      - Full flow dissector validation before injecting bad DODGY packets in
      the stack.
       This approach was attempted here : https://patchwork.ozlabs.org/patch/
      - Have more robust functions in the core.
        This might be needed anyway for stable versions.
      This patch fixes the flow dissection issue.
      CPU: 1 PID: 3144 Comm: syzkaller271204 Not tainted 4.15.0-rc4-mm1+ #49
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:17 [inline]
       dump_stack+0x194/0x257 lib/dump_stack.c:53
       print_address_description+0x73/0x250 mm/kasan/report.c:256
       kasan_report_error mm/kasan/report.c:355 [inline]
       kasan_report+0x23b/0x360 mm/kasan/report.c:413
       __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:432
       __tcp_hdrlen include/linux/tcp.h:35 [inline]
       tcp_hdrlen include/linux/tcp.h:40 [inline]
       qdisc_pkt_len_init net/core/dev.c:3160 [inline]
       __dev_queue_xmit+0x20d3/0x2200 net/core/dev.c:3465
       dev_queue_xmit+0x17/0x20 net/core/dev.c:3554
       packet_snd net/packet/af_packet.c:2943 [inline]
       packet_sendmsg+0x3ad5/0x60a0 net/packet/af_packet.c:2968
       sock_sendmsg_nosec net/socket.c:628 [inline]
       sock_sendmsg+0xca/0x110 net/socket.c:638
       sock_write_iter+0x31a/0x5d0 net/socket.c:907
       call_write_iter include/linux/fs.h:1776 [inline]
       new_sync_write fs/read_write.c:469 [inline]
       __vfs_write+0x684/0x970 fs/read_write.c:482
       vfs_write+0x189/0x510 fs/read_write.c:544
       SYSC_write fs/read_write.c:589 [inline]
       SyS_write+0xef/0x220 fs/read_write.c:581
      Fixes: 34fad54c ("net: __skb_flow_dissect() must cap its return value")
      Fixes: a6e544b0 ("flow_dissector: Jump to exit code in __skb_flow_dissect")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Willem de Bruijn <willemb@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • David S. Miller's avatar
      Merge tag 'wireless-drivers-for-davem-2018-01-17' of... · 9d383fbb
      David S. Miller authored
      Merge tag 'wireless-drivers-for-davem-2018-01-17' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
      Kalle Valo says:
      wireless-drivers fixes for 4.15
      One last set of fixes for regression submitted during the last few days.
      bcma & ssb
      * fix older build problems which (apparently) recently became more
        frequent in certain MIPS configurations
      * continue driver initialisation even if CLM blob (firmware) file is
        not found
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Arnd Bergmann's avatar
      fm10k: mark PM functions as __maybe_unused · b200bfd6
      Arnd Bergmann authored
      A cleanup of the PM code left an incorrect #ifdef in place, leading
      to a harmless build warning:
      drivers/net/ethernet/intel/fm10k/fm10k_pci.c:2502:12: error: 'fm10k_suspend' defined but not used [-Werror=unused-function]
      drivers/net/ethernet/intel/fm10k/fm10k_pci.c:2475:12: error: 'fm10k_resume' defined but not used [-Werror=unused-function]
      It's easier to use __maybe_unused attributes here, since you
      can't pick the wrong one.
      Fixes: 8249c47c ("fm10k: use generic PM hooks instead of legacy PCIe power hooks")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarJacob Keller <jacob.e.keller@intel.com>
      Tested-by: default avatarKrishneil Singh <krishneil.k.singh@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Johannes Berg's avatar
      cfg80211: fix station info handling bugs · 5762d7d3
      Johannes Berg authored
      Fix two places where the structure isn't initialized to zero,
      and thus can't be filled properly by the driver.
      Fixes: 4a4b8169 ("cfg80211: Accept multiple RSSI thresholds for CQM")
      Fixes: 9930380f ("cfg80211: implement IWRATE")
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Xin Long's avatar
      netlink: reset extack earlier in netlink_rcv_skb · cd443f1e
      Xin Long authored
      Move up the extack reset/initialization in netlink_rcv_skb, so that
      those 'goto ack' will not skip it. Otherwise, later on netlink_ack
      may use the uninitialized extack and cause kernel crash.
      Fixes: cbbdf843 ("netlink: extack needs to be reset each time through loop")
      Reported-by: syzbot+03bee3680a37466775e7@syzkaller.appspotmail.com
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf · 7155f8f3
      David S. Miller authored
      Daniel Borkmann says:
      pull-request: bpf 2018-01-18
      The following pull-request contains BPF updates for your *net* tree.
      The main changes are:
      1) Fix a divide by zero due to wrong if (src_reg == 0) check in
         64-bit mode. Properly handle this in interpreter and mask it
         also generically in verifier to guard against similar checks
         in JITs, from Eric and Alexei.
      2) Fix a bug in arm64 JIT when tail calls are involved and progs
         have different stack sizes, from Daniel.
      3) Reject stores into BPF context that are not expected BPF_STX |
         BPF_MEM variant, from Daniel.
      4) Mark dst reg as unknown on {s,u}bounds adjustments when the
         src reg has derived bounds from dead branches, from Daniel.
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Daniel Borkmann's avatar
      bpf: mark dst unknown on inconsistent {s, u}bounds adjustments · 6f16101e
      Daniel Borkmann authored
      syzkaller generated a BPF proglet and triggered a warning with
      the following:
        0: (b7) r0 = 0
        1: (d5) if r0 s<= 0x0 goto pc+0
         R0=inv0 R1=ctx(id=0,off=0,imm=0) R10=fp0
        2: (1f) r0 -= r1
         R0=inv0 R1=ctx(id=0,off=0,imm=0) R10=fp0
        verifier internal error: known but bad sbounds
      What happens is that in the first insn, r0's min/max value
      are both 0 due to the immediate assignment, later in the jsle
      test the bounds are updated for the min value in the false
      path, meaning, they yield smin_val = 1, smax_val = 0, and when
      ctx pointer is subtracted from r0, verifier bails out with the
      internal error and throwing a WARN since smin_val != smax_val
      for the known constant.
      For min_val > max_val scenario it means that reg_set_min_max()
      and reg_set_min_max_inv() (which both refine existing bounds)
      demonstrated that such branch cannot be taken at runtime.
      In above scenario for the case where it will be taken, the
      existing [0, 0] bounds are kept intact. Meaning, the rejection
      is not due to a verifier internal error, and therefore the
      WARN() is not necessary either.
      We could just reject such cases in adjust_{ptr,scalar}_min_max_vals()
      when either known scalars have smin_val != smax_val or
      umin_val != umax_val or any scalar reg with bounds
      smin_val > smax_val or umin_val > umax_val. However, there
      may be a small risk of breakage of buggy programs, so handle
      this more gracefully and in adjust_{ptr,scalar}_min_max_vals()
      just taint the dst reg as unknown scalar when we see ops with
      such kind of src reg.
      Reported-by: syzbot+6d362cadd45dc0a12ba4@syzkaller.appspotmail.com
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
  3. 17 Jan, 2018 11 commits
    • Daniel Borkmann's avatar
      bpf: fix cls_bpf on filter replace · ad9294db
      Daniel Borkmann authored
      Running the following sequence is currently broken:
        # tc qdisc add dev foo clsact
        # tc filter replace dev foo ingress prio 1 handle 1 bpf da obj bar.o
        # tc filter replace dev foo ingress prio 1 handle 1 bpf da obj bar.o
        RTNETLINK answers: Invalid argument
      The normal expectation on kernel side is that the second command
      succeeds replacing the existing program. However, what happens is
      in cls_bpf_change(), we bail out with err in the second run in
      cls_bpf_offload(). The EINVAL comes directly in cls_bpf_offload()
      when comparing prog vs oldprog's gen_flags. In case of above
      replace the new prog's gen_flags are 0, but the old ones are 8,
      which means TCA_CLS_FLAGS_NOT_IN_HW is set (e.g. drivers not having
      cls_bpf offload).
      Fix 102740bd ("cls_bpf: fix offload assumptions after callback
      conversion") in the following way: gen_flags from user space passed
      down via netlink cannot include status flags like TCA_CLS_FLAGS_IN_HW
      or TCA_CLS_FLAGS_NOT_IN_HW as opposed to oldprog that we previously
      loaded. Therefore, it doesn't make any sense to include them in the
      gen_flags comparison with the new prog before we even attempt to
      offload. Thus, lets fix this before 4.15 goes out.
      Fixes: 102740bd ("cls_bpf: fix offload assumptions after callback conversion")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Rex Chang's avatar
      Net: ethernet: ti: netcp: Fix inbound ping crash if MTU size is greater than 1500 · 5a717843
      Rex Chang authored
      In the receive queue for 4096 bytes fragments, the page address
      set in the SW data0 field of the descriptor is not the one we got
      when doing the reassembly in receive. The page structure was retrieved
      from the wrong descriptor into SW data0 which is then causing a
      page fault when UDP checksum is accessing data above 1500.
      Signed-off-by: default avatarRex Chang <rchang@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Sabrina Dubroca's avatar
      tls: reset crypto_info when do_tls_setsockopt_tx fails · 6db959c8
      Sabrina Dubroca authored
      The current code copies directly from userspace to ctx->crypto_send, but
      doesn't always reinitialize it to 0 on failure. This causes any
      subsequent attempt to use this setsockopt to fail because of the
      TLS_CRYPTO_INFO_READY check, eventhough crypto_info is not actually
      This should result in a correctly set up socket after the 3rd call, but
      currently it does not:
          size_t s = sizeof(struct tls12_crypto_info_aes_gcm_128);
          struct tls12_crypto_info_aes_gcm_128 crypto_good = {
              .info.version = TLS_1_2_VERSION,
              .info.cipher_type = TLS_CIPHER_AES_GCM_128,
          struct tls12_crypto_info_aes_gcm_128 crypto_bad_type = crypto_good;
          crypto_bad_type.info.cipher_type = 42;
          setsockopt(sock, SOL_TLS, TLS_TX, &crypto_bad_type, s);
          setsockopt(sock, SOL_TLS, TLS_TX, &crypto_good, s - 1);
          setsockopt(sock, SOL_TLS, TLS_TX, &crypto_good, s);
      Fixes: 3c4d7559 ("tls: kernel TLS support")
      Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Sabrina Dubroca's avatar
      tls: return -EBUSY if crypto_info is already set · 877d17c7
      Sabrina Dubroca authored
      do_tls_setsockopt_tx returns 0 without doing anything when crypto_info
      is already set. Silent failure is confusing for users.
      Fixes: 3c4d7559 ("tls: kernel TLS support")
      Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Sabrina Dubroca's avatar
      tls: fix sw_ctx leak · cf6d43ef
      Sabrina Dubroca authored
      During setsockopt(SOL_TCP, TLS_TX), if initialization of the software
      context fails in tls_set_sw_offload(), we leak sw_ctx. We also don't
      reassign ctx->priv_ctx to NULL, so we can't even do another attempt to
      set it up on the same socket, as it will fail with -EEXIST.
      Fixes: 3c4d7559 ('tls: kernel TLS support')
      Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • David S. Miller's avatar
      Merge tag 'linux-can-fixes-for-4.15-20180116' of... · 6ab6dd9e
      David S. Miller authored
      Merge tag 'linux-can-fixes-for-4.15-20180116' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
      Marc Kleine-Budde says:
      pull-request: can 2018-01-16
      this is a pull reqeust of a single patch for net/master:
      This patch by Stephane Grosjean fixes a potential bug in the packet
      fragmentation in the peak USB driver.
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Ilya Lesokhin's avatar
      net/tls: Only attach to sockets in ESTABLISHED state · d91c3e17
      Ilya Lesokhin authored
      Calling accept on a TCP socket with a TLS ulp attached results
      in two sockets that share the same ulp context.
      The ulp context is freed while a socket is destroyed, so
      after one of the sockets is released, the second second will
      trigger a use after free when it tries to access the ulp context
      attached to it.
      We restrict the TLS ulp to sockets in ESTABLISHED state
      to prevent the scenario above.
      Fixes: 3c4d7559 ("tls: kernel TLS support")
      Reported-by: syzbot+904e7cd6c5c741609228@syzkaller.appspotmail.com
      Signed-off-by: default avatarIlya Lesokhin <ilyal@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Christophe Leroy's avatar
      net: fs_enet: do not call phy_stop() in interrupts · f8b39039
      Christophe Leroy authored
      In case of TX timeout, fs_timeout() calls phy_stop(), which
      triggers the following BUG_ON() as we are in interrupt.
      [92708.199889] kernel BUG at drivers/net/phy/mdio_bus.c:482!
      [92708.204985] Oops: Exception in kernel mode, sig: 5 [#1]
      [92708.210119] PREEMPT
      [92708.212107] CMPC885
      [92708.214216] CPU: 0 PID: 3 Comm: ksoftirqd/0 Tainted: G        W       4.9.61 #39
      [92708.223227] task: c60f0a40 task.stack: c6104000
      [92708.227697] NIP: c02a84bc LR: c02a947c CTR: c02a93d8
      [92708.232614] REGS: c6105c70 TRAP: 0700   Tainted: G        W        (4.9.61)
      [92708.241193] MSR: 00021032 <ME,IR,DR,RI>[92708.244818]   CR: 24000822  XER: 20000000
      GPR00: c02a947c c6105d20 c60f0a40 c62b4c00 00000005 0000001f c069aad8 0001a688
      GPR08: 00000007 00000100 c02a93d8 00000000 000005fc 00000000 c6213240 c06338e4
      GPR16: 00000001 c06330d4 c0633094 00000000 c0680000 c6104000 c6104000 00000000
      GPR24: 00000200 00000000 ffffffff 00000004 00000078 00009032 00000000 c62b4c00
      NIP [c02a84bc] mdiobus_read+0x20/0x74
      [92708.281517] LR [c02a947c] kszphy_config_intr+0xa4/0xc4
      [92708.286547] Call Trace:
      [92708.288980] [c6105d20] [c6104000] 0xc6104000 (unreliable)
      [92708.294339] [c6105d40] [c02a947c] kszphy_config_intr+0xa4/0xc4
      [92708.300098] [c6105d50] [c02a5330] phy_stop+0x60/0x9c
      [92708.305007] [c6105d60] [c02c84d0] fs_timeout+0xdc/0x110
      [92708.310197] [c6105d80] [c035cd48] dev_watchdog+0x268/0x2a0
      [92708.315593] [c6105db0] [c0060288] call_timer_fn+0x34/0x17c
      [92708.321014] [c6105dd0] [c00605f0] run_timer_softirq+0x21c/0x2e4
      [92708.326887] [c6105e50] [c001e19c] __do_softirq+0xf4/0x2f4
      [92708.332207] [c6105eb0] [c001e3c8] run_ksoftirqd+0x2c/0x40
      [92708.337560] [c6105ec0] [c003b420] smpboot_thread_fn+0x1f0/0x258
      [92708.343405] [c6105ef0] [c003745c] kthread+0xbc/0xd0
      [92708.348217] [c6105f40] [c000c400] ret_from_kernel_thread+0x5c/0x64
      [92708.354275] Instruction dump:
      [92708.357207] 7c0803a6 bbc10018 38210020 4e800020 7c0802a6 9421ffe0 54290024 bfc10018
      [92708.364865] 90010024 7c7f1b78 81290008 552902ee <0f090000> 3bc3002c 7fc3f378 90810008
      [92708.372711] ---[ end trace 42b05441616fafd7 ]---
      This patch moves fs_timeout() actions into an async worker.
      Fixes: commit 48257c4f ("Add fs_enet ethernet network driver, for several embedded platforms")
      Signed-off-by: default avatarChristophe Leroy <christophe.leroy@c-s.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Kai-Heng Feng's avatar
      r8152: disable RX aggregation on Dell TB16 dock · 0b165514
      Kai-Heng Feng authored
      r8153 on Dell TB15/16 dock corrupts rx packets.
      This change is suggested by Realtek. They guess that the XHCI controller
      doesn't have enough buffer, and their guesswork is correct, once the RX
      aggregation gets disabled, the issue is gone.
      ASMedia is currently working on a real sulotion for this issue.
      Dell and ODM confirm the bcdDevice and iSerialNumber is unique for TB16.
      Note that TB15 has different bcdDevice and iSerialNumber, which are not
      unique values. If you still have TB15, please contact Dell to replace it
      with TB16.
      BugLink: https://bugs.launchpad.net/bugs/1729674
      Cc: Mario Limonciello <mario.limonciello@dell.com>
      Signed-off-by: default avatarKai-Heng Feng <kai.heng.feng@canonical.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Cong Wang's avatar
      tun: fix a memory leak for tfile->tx_array · 4df0bfc7
      Cong Wang authored
      tfile->tun could be detached before we close the tun fd,
      via tun_detach_all(), so it should not be used to check for
      As Jason suggested, we probably have to clean it up
      unconditionally both in __tun_deatch() and tun_detach_all(),
      but this requires to check if it is initialized or not.
      Currently skb_array_cleanup() doesn't have such a check,
      so I check it in the caller and introduce a helper function,
      it is a bit ugly but we can always improve it in net-next.
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Fixes: 1576d986 ("tun: switch to use skb array for tx")
      Cc: Jason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · 8cbab92d
      Linus Torvalds authored
      Pull rdma fixes from Doug Ledford:
       "We had a few more items creep up over the last week. Given we are in
        -rc8, these are obviously limited to bugs that have a big downside and
        for which we are certain of the fix.
        The first is a straight up oops bug that all you have to do is read
        the code to see it's a guaranteed 100% oops bug.
        The second is a use-after-free issue. We get away lucky if the queue
        we are shutting down is empty, but if it isn't, we can end up oopsing.
        We really need to drain the queue before destroying it.
        The final one is an issue with bad user input causing us to access our
        port array out of bounds. While fixing the array out of bounds issue,
        it was noticed that the original code did the same thing twice (the
        call to rdma_ah_set_port_num()), so its removal is not balanced by a
        readd elsewhere, it was already where it needed to be in addition to
        where it didn't need to be.
         - Oops fix in hfi1 driver
         - use-after-free issue in iser-target
         - use of user supplied array index without proper checking"
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        RDMA/mlx5: Fix out-of-bound access while querying AH
        IB/hfi1: Prevent a NULL dereference
        iser-target: Fix possible use-after-free in connection establishment error
  4. 16 Jan, 2018 18 commits
    • Daniel Borkmann's avatar
      bpf: reject stores into ctx via st and xadd · f37a8cb8
      Daniel Borkmann authored
      Alexei found that verifier does not reject stores into context
      via BPF_ST instead of BPF_STX. And while looking at it, we
      also should not allow XADD variant of BPF_STX.
      The context rewriter is only assuming either BPF_LDX_MEM- or
      BPF_STX_MEM-type operations, thus reject anything other than
      that so that assumptions in the rewriter properly hold. Add
      test cases as well for BPF selftests.
      Fixes: d691f9e8 ("bpf: allow programs to write to certain skb fields")
      Reported-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · b45a53be
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       1) Two read past end of buffer fixes in AF_KEY, from Eric Biggers.
       2) Memory leak in key_notify_policy(), from Steffen Klassert.
       3) Fix overflow with bpf arrays, from Daniel Borkmann.
       4) Fix RDMA regression with mlx5 due to mlx5 no longer using
          pci_irq_get_affinity(), from Saeed Mahameed.
       5) Missing RCU read locking in nl80211_send_iface() when it calls
          ieee80211_bss_get_ie(), from Dominik Brodowski.
       6) cfg80211 should check dev_set_name()'s return value, from Johannes
       7) Missing module license tag in 9p protocol, from Stephen Hemminger.
       8) Fix crash due to too small MTU in udp ipv6 sendmsg, from Mike
       9) Fix endless loop in netlink extack code, from David Ahern.
      10) TLS socket layer sets inverted error codes, resulting in an endless
          loop. From Robert Hering.
      11) Revert openvswitch erspan tunnel support, it's mis-designed and we
          need to kill it before it goes into a real release. From William Tu.
      12) Fix lan78xx failures in full speed USB mode, from Yuiko Oshino.
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (54 commits)
        net, sched: fix panic when updating miniq {b,q}stats
        qed: Fix potential use-after-free in qed_spq_post()
        nfp: use the correct index for link speed table
        lan78xx: Fix failure in USB Full Speed
        sctp: do not allow the v4 socket to bind a v4mapped v6 address
        sctp: return error if the asoc has been peeled off in sctp_wait_for_sndbuf
        sctp: reinit stream if stream outcnt has been change by sinit in sendmsg
        ibmvnic: Fix pending MAC address changes
        netlink: extack: avoid parenthesized string constant warning
        ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY
        net: Allow neigh contructor functions ability to modify the primary_key
        sh_eth: fix dumping ARSTR
        Revert "openvswitch: Add erspan tunnel support."
        net/tls: Fix inverted error codes to avoid endless loop
        ipv6: ip6_make_skb() needs to clear cork.base.dst
        sctp: avoid compiler warning on implicit fallthru
        net: ipv4: Make "ip route get" match iif lo rules again.
        netlink: extack needs to be reset each time through loop
        tipc: fix a memory leak in tipc_nl_node_get_link()
        ipv6: fix udpv6 sendmsg crash caused by too small MTU
    • Linus Torvalds's avatar
      Merge tag 'sound-4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 41aa5e5d
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "A few small last-minute fixes that should sneak into 4.15:
         - remove a spurious WARN_ON() triggered by syzkaller
         - fix for ioctl races in ALSA sequencer
         - two trivial HD-audio fixup entries"
      * tag 'sound-4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: seq: Make ioctls race-free
        ALSA: pcm: Remove yet superfluous WARN_ON()
        ALSA: hda - Apply the existing quirk to iMac 14,1
        ALSA: hda - Apply headphone noise quirk for another Dell XPS 13 variant
    • Linus Torvalds's avatar
      Merge tag 'trace-v4.15-rc4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 921d4f67
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
       - Bring back context level recursive protection in ring buffer.
         The simpler counter protection failed, due to a path when tracing
         with trace_clock_global() as it could not be reentrant and depended
         on the ring buffer recursive protection to keep that from happening.
       - Prevent branch profiling when FORTIFY_SOURCE is enabled.
         It causes 50 - 60 MB in warning messages. Branch profiling should
         never be run on production systems, so there's no reason that it
         needs to be enabled with FORTIFY_SOURCE.
      * tag 'trace-v4.15-rc4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Prevent PROFILE_ALL_BRANCHES when FORTIFY_SOURCE=y
        ring-buffer: Bring back context level recursive checks
    • Daniel Borkmann's avatar
      net, sched: fix panic when updating miniq {b,q}stats · 81d947e2
      Daniel Borkmann authored
      While working on fixing another bug, I ran into the following panic
      on arm64 by simply attaching clsact qdisc, adding a filter and running
      traffic on ingress to it:
        [  178.188591] Unable to handle kernel read from unreadable memory at virtual address 810fb501f000
        [  178.197314] Mem abort info:
        [  178.200121]   ESR = 0x96000004
        [  178.203168]   Exception class = DABT (current EL), IL = 32 bits
        [  178.209095]   SET = 0, FnV = 0
        [  178.212157]   EA = 0, S1PTW = 0
        [  178.215288] Data abort info:
        [  178.218175]   ISV = 0, ISS = 0x00000004
        [  178.222019]   CM = 0, WnR = 0
        [  178.224997] user pgtable: 4k pages, 48-bit VAs, pgd = 0000000023cb3f33
        [  178.231531] [0000810fb501f000] *pgd=0000000000000000
        [  178.236508] Internal error: Oops: 96000004 [#1] SMP
        [  178.311855] CPU: 73 PID: 2497 Comm: ping Tainted: G        W        4.15.0-rc7+ #5
        [  178.319413] Hardware name: FOXCONN R2-1221R-A4/C2U4N_MB, BIOS G31FB18A 03/31/2017
        [  178.326887] pstate: 60400005 (nZCv daif +PAN -UAO)
        [  178.331685] pc : __netif_receive_skb_core+0x49c/0xac8
        [  178.336728] lr : __netif_receive_skb+0x28/0x78
        [  178.341161] sp : ffff00002344b750
        [  178.344465] x29: ffff00002344b750 x28: ffff810fbdfd0580
        [  178.349769] x27: 0000000000000000 x26: ffff000009378000
        [  178.418715] x1 : 0000000000000054 x0 : 0000000000000000
        [  178.424020] Process ping (pid: 2497, stack limit = 0x000000009f0a3ff4)
        [  178.430537] Call trace:
        [  178.432976]  __netif_receive_skb_core+0x49c/0xac8
        [  178.437670]  __netif_receive_skb+0x28/0x78
        [  178.441757]  process_backlog+0x9c/0x160
        [  178.445584]  net_rx_action+0x2f8/0x3f0
      Reason is that sch_ingress and sch_clsact are doing mini_qdisc_pair_init()
      which sets up miniq pointers to cpu_{b,q}stats from the underlying qdisc.
      Problem is that this cannot work since they are actually set up right after
      the qdisc ->init() callback in qdisc_create(), so first packet going into
      sch_handle_ingress() tries to call mini_qdisc_bstats_cpu_update() and we
      therefore panic.
      In order to fix this, allocation of {b,q}stats needs to happen before we
      call into ->init(). In net-next, there's already such option through commit
      d59f5ffa ("net: sched: a dflt qdisc may be used with per cpu stats").
      However, the bug needs to be fixed in net still for 4.15. Thus, include
      these bits to reduce any merge churn and reuse the static_flags field to
      set TCQ_F_CPUSTATS, and remove the allocation from qdisc_create() since
      there is no other user left. Prashant Bhole ran into the same issue but
      for net-next, thus adding him below as well as co-author. Same issue was
      also reported by Sandipan Das when using bcc.
      Fixes: 46209401 ("net: core: introduce mini_Qdisc and eliminate usage of tp->q for clsact fastpath")
      Reference: https://lists.iovisor.org/pipermail/iovisor-dev/2018-January/001190.htmlReported-by: default avatarSandipan Das <sandipan@linux.vnet.ibm.com>
      Co-authored-by: default avatarPrashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>
      Co-authored-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Roland Dreier's avatar
      qed: Fix potential use-after-free in qed_spq_post() · 70eeff66
      Roland Dreier authored
      We need to check if p_ent->comp_mode is QED_SPQ_MODE_EBLOCK before
      calling qed_spq_add_entry().  The test is fine is the mode is EBLOCK,
      but if it isn't then qed_spq_add_entry() might kfree(p_ent).
      Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Jakub Kicinski's avatar
      nfp: use the correct index for link speed table · 0d9c9f0f
      Jakub Kicinski authored
      sts variable is holding link speed as well as state.  We should
      be using ls to index into ls_to_ethtool.
      Fixes: 265aeb51 ("nfp: add support for .get_link_ksettings()")
      Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Yuiko Oshino's avatar
      lan78xx: Fix failure in USB Full Speed · a5b1379a
      Yuiko Oshino authored
      Fix initialize the uninitialized tx_qlen to an appropriate value when USB
      Full Speed is used.
      Fixes: 55d7de9d ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
      Signed-off-by: default avatarYuiko Oshino <yuiko.oshino@microchip.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Daniel Borkmann's avatar
      bpf, arm64: fix stack_depth tracking in combination with tail calls · a2284d91
      Daniel Borkmann authored
      Using dynamic stack_depth tracking in arm64 JIT is currently broken in
      combination with tail calls. In prologue, we cache ctx->stack_size and
      adjust SP reg for setting up function call stack, and tearing it down
      again in epilogue. Problem is that when doing a tail call, the cached
      ctx->stack_size might not be the same.
      One way to fix the problem with minimal overhead is to re-adjust SP in
      emit_bpf_tail_call() and properly adjust it to the current program's
      ctx->stack_size. Tested on Cavium ThunderX ARMv8.
      Fixes: f1c9eed7 ("bpf, arm64: take advantage of stack_depth tracking")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    • David S. Miller's avatar
      Merge tag 'mac80211-for-davem-2018-01-15' of... · 161f72ed
      David S. Miller authored
      Merge tag 'mac80211-for-davem-2018-01-15' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      Johannes Berg says:
      More fixes:
       * hwsim:
          - properly flush deletion works at module unload
          - validate # of channels passed from userspace
       * cfg80211:
          - fix RCU locking regression
          - initialize on-stack channel data for nl80211 event
          - check dev_set_name() return value
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Xin Long's avatar
      sctp: do not allow the v4 socket to bind a v4mapped v6 address · c5006b8a
      Xin Long authored
      The check in sctp_sockaddr_af is not robust enough to forbid binding a
      v4mapped v6 addr on a v4 socket.
      The worse thing is that v4 socket's bind_verify would not convert this
      v4mapped v6 addr to a v4 addr. syzbot even reported a crash as the v4
      socket bound a v6 addr.
      This patch is to fix it by doing the common sa.sa_family check first,
      then AF_INET check for v4mapped v6 addrs.
      Fixes: 7dab83de ("sctp: Support ipv6only AF_INET6 sockets.")
      Reported-by: syzbot+7b7b518b1228d2743963@syzkaller.appspotmail.com
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Xin Long's avatar
      sctp: return error if the asoc has been peeled off in sctp_wait_for_sndbuf · a0ff6600
      Xin Long authored
      After commit cea0cc80 ("sctp: use the right sk after waking up from
      wait_buf sleep"), it may change to lock another sk if the asoc has been
      peeled off in sctp_wait_for_sndbuf.
      However, the asoc's new sk could be already closed elsewhere, as it's in
      the sendmsg context of the old sk that can't avoid the new sk's closing.
      If the sk's last one refcnt is held by this asoc, later on after putting
      this asoc, the new sk will be freed, while under it's own lock.
      This patch is to revert that commit, but fix the old issue by returning
      error under the old sk's lock.
      Fixes: cea0cc80 ("sctp: use the right sk after waking up from wait_buf sleep")
      Reported-by: syzbot+ac6ea7baa4432811eb50@syzkaller.appspotmail.com
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Xin Long's avatar
      sctp: reinit stream if stream outcnt has been change by sinit in sendmsg · 625637bf
      Xin Long authored
      After introducing sctp_stream structure, sctp uses stream->outcnt as the
      out stream nums instead of c.sinit_num_ostreams.
      However when users use sinit in cmsg, it only updates c.sinit_num_ostreams
      in sctp_sendmsg. At that moment, stream->outcnt is still using previous
      value. If it's value is not updated, the sinit_num_ostreams of sinit could
      not really work.
      This patch is to fix it by updating stream->outcnt and reiniting stream
      if stream outcnt has been change by sinit in sendmsg.
      Fixes: a8386317 ("sctp: prepare asoc stream for stream reconf")
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Wright Feng's avatar
      brcmfmac: fix CLM load error for legacy chips when user helper is enabled · cc124d5c
      Wright Feng authored
      For legacy chips without CLM blob files, kernel with user helper function
      returns -EAGAIN when we request_firmware(), and then driver got failed
      when bringing up legacy chips. We expect the CLM blob file for legacy chip
      is not existence in firmware path, but the -ENOENT error is transferred to
      -EAGAIN in firmware_class.c with user helper.
      Because of that, we continue with CLM data currently present in firmware
      if getting error from doing request_firmware().
      Cc: stable@vger.kernel.org # v4.15.y
      Reviewed-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
      Signed-off-by: default avatarWright Feng <wright.feng@cypress.com>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    • James Hogan's avatar
      ssb: Disable PCI host for PCI_DRIVERS_GENERIC · 58eae141
      James Hogan authored
      Since commit d41e6858 ("MIPS: Kconfig: Set default MIPS system type
      as generic") changed the default MIPS platform to the "generic"
      platform, which uses PCI_DRIVERS_GENERIC instead of PCI_DRIVERS_LEGACY,
      various files in drivers/ssb/ have failed to build.
      This is particularly due to the existence of struct pci_controller being
      dependent on PCI_DRIVERS_LEGACY since commit c5611df9 ("MIPS: PCI:
      Introduce CONFIG_PCI_DRIVERS_LEGACY"), so add that dependency to Kconfig
      to prevent these files being built for the "generic" platform including
      all{yes,mod}config builds.
      Fixes: c5611df9 ("MIPS: PCI: Introduce CONFIG_PCI_DRIVERS_LEGACY")
      Signed-off-by: default avatarJames Hogan <jhogan@kernel.org>
      Cc: Michael Buesch <m@bues.ch>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Paul Burton <paul.burton@mips.com>
      Cc: Matt Redfearn <matt.redfearn@imgtec.com>
      Cc: Guenter Roeck <linux@roeck-us.net>
      Cc: linux-wireless@vger.kernel.org
      Cc: linux-mips@linux-mips.org
      Tested-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    • Guenter Roeck's avatar
      bcma: Fix 'allmodconfig' and BCMA builds on MIPS targets · 664eadd6
      Guenter Roeck authored
      Mips builds with BCMA host mode enabled fail in mainline and -next
      In file included from include/linux/bcma/bcma.h:10:0,
                       from drivers/bcma/bcma_private.h:9,
      		 from drivers/bcma/main.c:8:
      include/linux/bcma/bcma_driver_pci.h:218:24: error:
      	field 'pci_controller' has incomplete type
      Bisect points to commit d41e6858 ("MIPS: Kconfig: Set default MIPS
      system type as generic") as the culprit. Analysis shows that the commmit
      changes PCI configuration and enables PCI_DRIVERS_GENERIC. This in turn
      disables PCI_DRIVERS_LEGACY. 'struct pci_controller' is, however, only
      defined if PCI_DRIVERS_LEGACY is enabled.
      Ultimately that means that BCMA_DRIVER_PCI_HOSTMODE depends on
      PCI_DRIVERS_LEGACY. Add the missing dependency.
      Fixes: d41e6858 ("MIPS: Kconfig: Set default MIPS system type as ...")
      Cc: Matt Redfearn <matt.redfearn@imgtec.com>
      Cc: James Hogan <jhogan@kernel.org>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Reviewed-by: default avatarJames Hogan <jhogan@kernel.org>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    • Thomas Falcon's avatar
      ibmvnic: Fix pending MAC address changes · 3d166130
      Thomas Falcon authored
      Due to architecture limitations, the IBM VNIC client driver is unable
      to perform MAC address changes unless the device has "logged in" to
      its backing device. Currently, pending MAC changes are handled before
      login, resulting in an error and failure to change the MAC address.
      Moving that chunk to the end of the ibmvnic_login function, when we are
      sure that it was successful, fixes that.
      The MAC address can be changed when the device is up or down, so
      only check if the device is in a "PROBED" state before setting the
      MAC address.
      Fixes: c26eba03 ("ibmvnic: Update reset infrastructure to support tunable parameters")
      Signed-off-by: default avatarThomas Falcon <tlfalcon@linux.vnet.ibm.com>
      Reviewed-by: default avatarJohn Allen <jallen@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Stephane Grosjean's avatar
      can: peak: fix potential bug in packet fragmentation · d8a243af
      Stephane Grosjean authored
      In some rare conditions when running one PEAK USB-FD interface over
      a non high-speed USB controller, one useless USB fragment might be sent.
      This patch fixes the way a USB command is fragmented when its length is
      greater than 64 bytes and when the underlying USB controller is not a
      high-speed one.
      Signed-off-by: default avatarStephane Grosjean <s.grosjean@peak-system.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
  5. 15 Jan, 2018 2 commits
    • Leon Romanovsky's avatar
      RDMA/mlx5: Fix out-of-bound access while querying AH · ae59c3f0
      Leon Romanovsky authored
      The rdma_ah_find_type() accesses the port array based on an index
      controlled by userspace. The existing bounds check is after the first use
      of the index, so userspace can generate an out of bounds access, as shown
      by the KASN report below.
      BUG: KASAN: slab-out-of-bounds in to_rdma_ah_attr+0xa8/0x3b0
      Read of size 4 at addr ffff880019ae2268 by task ibv_rc_pingpong/409
      CPU: 0 PID: 409 Comm: ibv_rc_pingpong Not tainted 4.15.0-rc2-00031-gb60a3faf5b83-dirty #3
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
      Call Trace:
      RIP: 0033:0x7fe9c7a275a0
      RSP: 002b:00007ffee5498738 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      RAX: ffffffffffffffda RBX: 00007fe9c7ce4b00 RCX: 00007fe9c7a275a0
      RDX: 0000000000000018 RSI: 00007ffee5498800 RDI: 0000000000000003
      RBP: 000055d0c8d3f010 R08: 00007ffee5498800 R09: 0000000000000018
      R10: 00000000000000ba R11: 0000000000000246 R12: 0000000000008000
      R13: 0000000000004fb0 R14: 000055d0c8d3f050 R15: 00007ffee5498560
      Allocated by task 1:
      Freed by task 0:
      (stack is not available)
      The buggy address belongs to the object at ffff880019ae2000
       which belongs to the cache kmalloc-512 of size 512
      The buggy address is located 104 bytes to the right of
       512-byte region [ffff880019ae2000, ffff880019ae2200)
      The buggy address belongs to the page:
      page:000000005d674e18 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
      flags: 0x4000000000008100(slab|head)
      raw: 4000000000008100 0000000000000000 0000000000000000 00000001000c000c
      raw: dead000000000100 dead000000000200 ffff88001a402000 0000000000000000
      page dumped because: kasan: bad access detected
      Memory state around the buggy address:
       ffff880019ae2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
       ffff880019ae2180: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
      >ffff880019ae2200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
       ffff880019ae2280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
       ffff880019ae2300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      Disabling lock debugging due to kernel taint
      Cc: <stable@vger.kernel.org>
      Fixes: 44c58487 ("IB/core: Define 'ib' and 'roce' rdma_ah_attr types")
      Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
    • Johannes Berg's avatar
      netlink: extack: avoid parenthesized string constant warning · 6311b7ce
      Johannes Berg authored
      NL_SET_ERR_MSG() and NL_SET_ERR_MSG_ATTR() lead to the following warning
      in newer versions of gcc:
        warning: array initialized from parenthesized string constant
      Just remove the parentheses, they're not needed in this context since
      anyway since there can be no operator precendence issues or similar.
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>