xfrm: Validate address prefix lengths in the xfrm selector.
Sasha Levin
maintainerPATCH 1/15 xfrm: Validate address prefix lengths in the xfrm selector.
From: Steffen Klassert <[email protected]>
[ Upstream commit 07bf7908950a8b14e81aa1807e3c667eab39287a ]
We don't validate the address prefix lengths in the xfrm selector we got from userspace. This can lead to undefined behaviour in the address matching functions if the prefix is too big for the given address family. Fix this by checking the prefixes and refuse SA/policy insertation when a prefix is invalid.
--- net/xfrm/xfrm_user.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
net/xfrm/xfrm_user.c +12 -0
@@ -150,10 +150,16 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, err = -EINVAL ;switch (p->family) {case AF_INET : +if (p->sel.prefixlen_d >32 || p->sel.prefixlen_s >32 ) + goto out; +break ;case AF_INET6 :#if IS_ENABLED (CONFIG_IPV6 ) +if (p->sel.prefixlen_d >128 || p->sel.prefixlen_s >128 ) + goto out; +break ;#else err = -EAFNOSUPPORT ;
@@ -1285,10 +1291,16 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)switch (p->sel.family) {case AF_INET : +if (p->sel.prefixlen_d >32 || p->sel.prefixlen_s >32 ) +return -EINVAL ; +break ;case AF_INET6 :#if IS_ENABLED (CONFIG_IPV6 ) +if (p->sel.prefixlen_d >128 || p->sel.prefixlen_s >128 ) +return -EINVAL ; +break ;#else return -EAFNOSUPPORT ;
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 2/15 xfrm6: call kfree_skb when skb is toobig
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit 215ab0f021c9fea3c18b75e7d522400ee6a49990 ]
After commit d6990976af7c5d8f55903bfb4289b6fb030bf754 ("vti6: fix PMTU caching and reporting on xmit"), some too big skbs might be potentially passed down to __xfrm6_output, causing it to fail to transmit but not free the skb, causing a leak of skb, and consequentially a leak of dst references.
After running pmtu.sh, that shows as failure to unregister devices in a namespace:
[ 311.397671] unregister_netdevice: waiting for veth_b to become free. Usage count = 1
The fix is to call kfree_skb in case of transmit failures.
--- net/ipv6/xfrm6_output.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv6/xfrm6_output.c +2 -0
@@ -151,9 +151,11 @@ static int __xfrm6_output(struct sk_buff *skb)if (skb->len > mtu &&xfrm6_local_dontfrag (skb)) {xfrm6_local_rxpmtu (skb, mtu); +kfree_skb (skb);return -EMSGSIZE ; }else if (!skb->ignore_df && skb->len > mtu && skb->sk) {xfrm_local_error (skb, mtu); +kfree_skb (skb);return -EMSGSIZE ; }
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 3/15 cfg80211: reg: Init wiphy_idx in regulatory_hint_core()
In reply to Sasha LevinFrom: Andrei Otcheretianski <[email protected]>
[ Upstream commit 24f33e64fcd0d50a4b1a8e5b41bd0257aa66b0e8 ]
Core regulatory hints didn't set wiphy_idx to WIPHY_IDX_INVALID. Since the regulatory request is zeroed, wiphy_idx was always implicitly set to
0. This resulted in updating only phy #0.
Fix that.
--- net/wireless/reg.c | 1 + 1 file changed, 1 insertion(+)
net/wireless/reg.c +1 -0
@@ -2033,6 +2033,7 @@ static int regulatory_hint_core(const char *alpha2) request->alpha2[0 ] = alpha2[0 ]; request->alpha2[1 ] = alpha2[1 ]; request->initiator =NL80211_REGDOM_SET_BY_CORE ; + request->wiphy_idx =WIPHY_IDX_INVALID ;queue_regulatory_request (request);
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 4/15 ARM: 8799/1: mm: fix pci_ioremap_io() offset check
In reply to Sasha LevinFrom: Thomas Petazzoni <[email protected]>
[ Upstream commit 3a58ac65e2d7969bcdf1b6acb70fa4d12a88e53e ]
IO_SPACE_LIMIT is the ending address of the PCI IO space, i.e something like 0xfffff (and not 0x100000).
Therefore, when offset = 0xf0000 is passed as argument, this function fails even though the offset + SZ_64K fits below the IO_SPACE_LIMIT. This makes the last chunk of 64 KB of the I/O space not usable as it cannot be mapped.
This patch fixes that by substracing 1 to offset + SZ_64K, so that we compare the addrss of the last byte of the I/O space against IO_SPACE_LIMIT instead of the address of the first byte of what is after the I/O space.
--- arch/arm/mm/ioremap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mm/ioremap.c +1 -1
@@ -447,7 +447,7 @@ void pci_ioremap_set_mem_type(int mem_type)int pci_ioremap_io (unsigned int offset,phys_addr_t phys_addr) { -BUG_ON (offset +SZ_64K >IO_SPACE_LIMIT ); +BUG_ON (offset +SZ_64K -1 >IO_SPACE_LIMIT ); return ioremap_page_range(PCI_IO_VIRT_BASE + offset, PCI_IO_VIRT_BASE + offset + SZ_64K,
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 5/15 xfrm: validate template mode
In reply to Sasha LevinFrom: Sean Tranchetti <[email protected]>
[ Upstream commit 32bf94fb5c2ec4ec842152d0e5937cd4bb6738fa ]
XFRM mode parameters passed as part of the user templates in the IP_XFRM_POLICY are never properly validated. Passing values other than valid XFRM modes can cause stack-out-of-bounds reads to occur later in the XFRM processing:
[ 140.535608] ================================================================ [ 140.543058] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x17e4/0x1cc4 [ 140.550306] Read of size 4 at addr ffffffc0238a7a58 by task repro/5148 [ 140.557369] [ 140.558927] Call trace: [ 140.558936] dump_backtrace+0x0/0x388 [ 140.558940] show_stack+0x24/0x30 [ 140.558946] __dump_stack+0x24/0x2c [ 140.558949] dump_stack+0x8c/0xd0 [ 140.558956] print_address_description+0x74/0x234 [ 140.558960] kasan_report+0x240/0x264 [ 140.558963] __asan_report_load4_noabort+0x2c/0x38 [ 140.558967] xfrm_state_find+0x17e4/0x1cc4 [ 140.558971] xfrm_resolve_and_create_bundle+0x40c/0x1fb8 [ 140.558975] xfrm_lookup+0x238/0x1444 [ 140.558977] xfrm_lookup_route+0x48/0x11c [ 140.558984] ip_route_output_flow+0x88/0xc4 [ 140.558991] raw_sendmsg+0xa74/0x266c [ 140.558996] inet_sendmsg+0x258/0x3b0 [ 140.559002] sock_sendmsg+0xbc/0xec [ 140.559005] SyS_sendto+0x3a8/0x5a8 [ 140.559008] el0_svc_naked+0x34/0x38 [ 140.559009] [ 140.592245] page dumped because: kasan: bad access detected [ 140.597981] page_owner info is not active (free page?) [ 140.603267] [ 140.653503] ================================================================
--- net/xfrm/xfrm_user.c | 3 +++ 1 file changed, 3 insertions(+)
net/xfrm/xfrm_user.c +3 -0
@@ -1381,6 +1381,9 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family) (ut[i].family != prev_family))return -EINVAL ; +if (ut[i].mode >=XFRM_MODE_MAX ) +return -EINVAL ; + prev_family = ut[i].family;switch (ut[i].family) {
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 6/15 asix: Check for supported Wake-on-LAN modes
In reply to Sasha LevinFrom: Florian Fainelli <[email protected]>
[ Upstream commit c4ce446e33d7a0e978256ac6fea4c80e59d9de5f ]
The driver currently silently accepts unsupported Wake-on-LAN modes (other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user, which is confusing.
--- drivers/net/usb/asix_common.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/usb/asix_common.c +3 -0
@@ -417,6 +417,9 @@ int asix_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)struct usbnet *dev =netdev_priv (net);u8 opt =0 ; +if (wolinfo->wolopts & ~(WAKE_PHY |WAKE_MAGIC )) +return -EINVAL ; +if (wolinfo->wolopts &WAKE_PHY ) opt |=AX_MONITOR_LINK ;if (wolinfo->wolopts &WAKE_MAGIC )
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 7/15 ax88179_178a: Check for supported Wake-on-LAN modes
In reply to Sasha LevinFrom: Florian Fainelli <[email protected]>
[ Upstream commit 5ba6b4aa9a410c5e2c6417df52b5e2118ea9b467 ]
The driver currently silently accepts unsupported Wake-on-LAN modes (other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user, which is confusing.
--- drivers/net/usb/ax88179_178a.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/usb/ax88179_178a.c +3 -0
@@ -566,6 +566,9 @@ ax88179_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)struct usbnet *dev =netdev_priv (net);u8 opt =0 ; +if (wolinfo->wolopts & ~(WAKE_PHY |WAKE_MAGIC )) +return -EINVAL ; +if (wolinfo->wolopts &WAKE_PHY ) opt |=AX_MONITOR_MODE_RWLC ;if (wolinfo->wolopts &WAKE_MAGIC )
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 8/15 sr9800: Check for supported Wake-on-LAN modes
In reply to Sasha LevinFrom: Florian Fainelli <[email protected]>
[ Upstream commit c5cb93e994ffb43b7b3b1ff10b9f928f54574a36 ]
The driver currently silently accepts unsupported Wake-on-LAN modes (other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user, which is confusing.
--- drivers/net/usb/sr9800.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/usb/sr9800.c +3 -0
@@ -421,6 +421,9 @@ sr_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)struct usbnet *dev =netdev_priv (net);u8 opt =0 ; +if (wolinfo->wolopts & ~(WAKE_PHY |WAKE_MAGIC )) +return -EINVAL ; +if (wolinfo->wolopts &WAKE_PHY ) opt |=SR_MONITOR_LINK ;if (wolinfo->wolopts &WAKE_MAGIC )
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 9/15 smsc75xx: Check for Wake-on-LAN modes
In reply to Sasha LevinFrom: Florian Fainelli <[email protected]>
[ Upstream commit 9c734b2769a73eea2e9e9767c0e0bf839ff23679 ]
The driver does not check for Wake-on-LAN modes specified by an user, but will conditionally set the device as wake-up enabled or not based on that, which could be a very confusing user experience.
--- drivers/net/usb/smsc75xx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/usb/smsc75xx.c +3 -0
@@ -728,6 +728,9 @@ static int smsc75xx_ethtool_set_wol(struct net_device *net,struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0 ]);int ret; +if (wolinfo->wolopts & ~SUPPORTED_WAKE ) +return -EINVAL ; + pdata->wolopts = wolinfo->wolopts &SUPPORTED_WAKE ; ret =device_set_wakeup_enable (&dev->udev->dev, pdata->wolopts);
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 10/15 smsc95xx: Check for Wake-on-LAN modes
In reply to Sasha LevinFrom: Florian Fainelli <[email protected]>
[ Upstream commit c530c471ba37bdd9fe1c7185b01455c00ae606fb ]
The driver does not check for Wake-on-LAN modes specified by an user, but will conditionally set the device as wake-up enabled or not based on that, which could be a very confusing user experience.
--- drivers/net/usb/smsc95xx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/usb/smsc95xx.c +3 -0
@@ -727,6 +727,9 @@ static int smsc95xx_ethtool_set_wol(struct net_device *net,struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0 ]);int ret; +if (wolinfo->wolopts & ~SUPPORTED_WAKE ) +return -EINVAL ; + pdata->wolopts = wolinfo->wolopts &SUPPORTED_WAKE ; ret =device_set_wakeup_enable (&dev->udev->dev, pdata->wolopts);
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 11/15 qlcnic: fix Tx descriptor corruption on 82xx devices
In reply to Sasha LevinFrom: Shahed Shaikh <[email protected]>
[ Upstream commit c333fa0c4f220f8f7ea5acd6b0ebf3bf13fd684d ]
In regular NIC transmission flow, driver always configures MAC using Tx queue zero descriptor as a part of MAC learning flow.
But with multi Tx queue supported NIC, regular transmission can occur on any non-zero Tx queue and from that context it uses
Tx queue zero descriptor to configure MAC, at the same time TX queue zero could be used by another CPU for regular transmission which could lead to Tx queue zero descriptor corruption and cause FW abort.
This patch fixes this in such a way that driver always configures learned MAC address from the same Tx queue which is used for regular transmission.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic.h | 8 +++++--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 3 ++- drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h | 3 ++- drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h | 3 ++- drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | 12 ++++++------ 5 files changed, 17 insertions(+), 12 deletions(-)
drivers/net/ethernet/qlogic/qlcnic/qlcnic.h +5 -3
@@ -1796,7 +1796,8 @@ struct qlcnic_hardware_ops {int (*config_loopback) (struct qlcnic_adapter *,u8 );int (*clear_loopback) (struct qlcnic_adapter *,u8 );int (*config_promisc_mode) (struct qlcnic_adapter *,u32 ); -void (*change_l2_filter) (struct qlcnic_adapter *,u64 *,u16 ); +void (*change_l2_filter)(struct qlcnic_adapter *adapter,u64 *addr, +u16 vlan,struct qlcnic_host_tx_ring *tx_ring);int (*get_board_info) (struct qlcnic_adapter *);void (*set_mac_filter_count) (struct qlcnic_adapter *);void (*free_mac_list) (struct qlcnic_adapter *);
@@ -2038,9 +2039,10 @@ static inline int qlcnic_nic_set_promisc(struct qlcnic_adapter *adapter, }static inline void qlcnic_change_filter (struct qlcnic_adapter *adapter, -u64 *addr,u16 id) +u64 *addr,u16 vlan, +struct qlcnic_host_tx_ring *tx_ring) { - adapter->ahw->hw_ops->change_l2_filter (adapter, addr, id); + adapter->ahw->hw_ops->change_l2_filter (adapter, addr, vlan, tx_ring); }static inline int qlcnic_get_board_info (struct qlcnic_adapter *adapter)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +2 -1
@@ -2132,7 +2132,8 @@ int qlcnic_83xx_sre_macaddr_change(struct qlcnic_adapter *adapter, u8 *addr, }void qlcnic_83xx_change_l2_filter (struct qlcnic_adapter *adapter,u64 *addr, -u16 vlan_id) +u16 vlan_id, +struct qlcnic_host_tx_ring *tx_ring) {u8 mac[ETH_ALEN ];memcpy (&mac, addr,ETH_ALEN );
drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h +2 -1
@@ -549,7 +549,8 @@ int qlcnic_83xx_wrt_reg_indirect(struct qlcnic_adapter *, ulong, u32);int qlcnic_83xx_nic_set_promisc (struct qlcnic_adapter *,u32 );int qlcnic_83xx_config_hw_lro (struct qlcnic_adapter *,int );int qlcnic_83xx_config_rss (struct qlcnic_adapter *,int ); -void qlcnic_83xx_change_l2_filter (struct qlcnic_adapter *,u64 *,u16 ); +void qlcnic_83xx_change_l2_filter (struct qlcnic_adapter *adapter,u64 *addr, +u16 vlan,struct qlcnic_host_tx_ring *ring);int qlcnic_83xx_get_pci_info (struct qlcnic_adapter *,struct qlcnic_pci_info *);int qlcnic_83xx_set_nic_info (struct qlcnic_adapter *,struct qlcnic_info *);void qlcnic_83xx_initialize_nic (struct qlcnic_adapter *,int );
drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h +2 -1
@@ -172,7 +172,8 @@ int qlcnic_82xx_napi_add(struct qlcnic_adapter *adapter, struct net_device *netdev);void qlcnic_82xx_get_beacon_state (struct qlcnic_adapter *);void qlcnic_82xx_change_filter (struct qlcnic_adapter *adapter, -u64 *uaddr,u16 vlan_id); +u64 *uaddr,u16 vlan_id, +struct qlcnic_host_tx_ring *tx_ring);int qlcnic_82xx_config_intr_coalesce (struct qlcnic_adapter *,struct ethtool_coalesce *);int qlcnic_82xx_set_rx_coalesce (struct qlcnic_adapter *);
drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c +6 -6
@@ -268,13 +268,12 @@ static void qlcnic_add_lb_filter(struct qlcnic_adapter *adapter, }void qlcnic_82xx_change_filter (struct qlcnic_adapter *adapter,u64 *uaddr, -u16 vlan_id) +u16 vlan_id,struct qlcnic_host_tx_ring *tx_ring) {struct cmd_desc_type0 *hwdesc;struct qlcnic_nic_req *req;struct qlcnic_mac_req *mac_req;struct qlcnic_vlan_req *vlan_req; -struct qlcnic_host_tx_ring *tx_ring = adapter->tx_ring;u32 producer;u64 word;
@@ -301,7 +300,8 @@ void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr,static void qlcnic_send_filter (struct qlcnic_adapter *adapter,struct cmd_desc_type0 *first_desc, -struct sk_buff *skb) +struct sk_buff *skb, +struct qlcnic_host_tx_ring *tx_ring) {struct vlan_ethhdr *vh = (struct vlan_ethhdr *)(skb->data);struct ethhdr *phdr = (struct ethhdr *)(skb->data);
@@ -335,7 +335,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter, tmp_fil->vlan_id == vlan_id) {if (jiffies > (QLCNIC_READD_AGE *HZ + tmp_fil->ftime))qlcnic_change_filter (adapter, &src_addr, - vlan_id); + vlan_id, tx_ring); tmp_fil->ftime = jiffies;return ; }
@@ -350,7 +350,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter,if (!fil)return ; -qlcnic_change_filter (adapter, &src_addr, vlan_id); +qlcnic_change_filter (adapter, &src_addr, vlan_id, tx_ring); fil->ftime = jiffies; fil->vlan_id = vlan_id;memcpy (fil->faddr, &src_addr,ETH_ALEN );
@@ -766,7 +766,7 @@ netdev_tx_t qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev) }if (adapter->drv_mac_learn) -qlcnic_send_filter (adapter, first_desc, skb); +qlcnic_send_filter (adapter, first_desc, skb, tx_ring); tx_ring->tx_stats.tx_bytes += skb->len; tx_ring->tx_stats.xmit_called++;
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 12/15 i2c: i2c-scmi: fix for i2c_smbus_write_block_data
In reply to Sasha LevinFrom: Edgar Cherkasov <[email protected]>
[ Upstream commit 08d9db00fe0e300d6df976e6c294f974988226dd ]
The i2c-scmi driver crashes when the SMBus Write Block transaction is executed:
WARNING: CPU: 9 PID: 2194 at mm/page_alloc.c:3931 __alloc_pages_slowpath+0x9db/0xec0 Call Trace: ? get_page_from_freelist+0x49d/0x11f0 ? alloc_pages_current+0x6a/0xe0 ? new_slab+0x499/0x690 __alloc_pages_nodemask+0x265/0x280 alloc_pages_current+0x6a/0xe0 kmalloc_order+0x18/0x40 kmalloc_order_trace+0x24/0xb0 ? acpi_ut_allocate_object_desc_dbg+0x62/0x10c __kmalloc+0x203/0x220 acpi_os_allocate_zeroed+0x34/0x36 acpi_ut_copy_eobject_to_iobject+0x266/0x31e acpi_evaluate_object+0x166/0x3b2 acpi_smbus_cmi_access+0x144/0x530 [i2c_scmi] i2c_smbus_xfer+0xda/0x370 i2cdev_ioctl_smbus+0x1bd/0x270 i2cdev_ioctl+0xaa/0x250 do_vfs_ioctl+0xa4/0x600 SyS_ioctl+0x79/0x90 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x3d/0xa2
ACPI Error: Evaluating _SBW: 4 (20170831/smbus_cmi-185)
This problem occurs because the length of ACPI Buffer object is not defined/initialized in the code before a corresponding ACPI method is called. The obvious patch below fixes this issue.
--- drivers/i2c/busses/i2c-scmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/i2c/busses/i2c-scmi.c +1 -0
@@ -152,6 +152,7 @@ acpi_smbus_cmi_access(struct i2c_adapter *adap, u16 addr, unsigned short flags, mt_params[3 ].type =ACPI_TYPE_INTEGER ; mt_params[3 ].integer.value = len; mt_params[4 ].type =ACPI_TYPE_BUFFER ; + mt_params[4 ].buffer.length = len; mt_params[4 ].buffer.pointer = data->block +1 ; }break ;
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 13/15 perf/ring_buffer: Prevent concurent ring buffer access
In reply to Sasha LevinFrom: Jiri Olsa <[email protected]>
[ Upstream commit cd6fb677ce7e460c25bdd66f689734102ec7d642 ]
Some of the scheduling tracepoints allow the perf_tp_event code to write to ring buffer under different cpu than the code is running on.
This results in corrupted ring buffer data demonstrated in following perf commands:
# perf record -e 'sched:sched_switch,sched:sched_wakeup' perf bench sched messaging # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run
Total time: 0.383 [sec]
[ perf record: Woken up 8 times to write data ]
0x42b890 [0]: failed to process type: -1765585640
[ perf record: Captured and wrote 4.825 MB perf.data (29669 samples) ]
# perf report --stdio 0x42b890 [0]: failed to process type: -1765585640
The reason for the corruption are some of the scheduling tracepoints, that have __perf_task dfined and thus allow to store data to another cpu ring buffer:
sched_waking
sched_wakeup
sched_wakeup_new
sched_stat_wait
sched_stat_sleep
sched_stat_iowait
sched_stat_blocked
The perf_tp_event function first store samples for current cpu related events defined for tracepoint:
hlist_for_each_entry_rcu(event, head, hlist_entry)
perf_swevent_event(event, count, &data, regs);
And then iterates events of the 'task' and store the sample for any task's event that passes tracepoint checks:
ctx = rcu_dereference(task->perf_event_ctxp[perf_sw_context]);
list_for_each_entry_rcu(event, &ctx->event_list, event_entry) {
if (event->attr.type != PERF_TYPE_TRACEPOINT)
continue;
if (event->attr.config != entry->type)
continue;perf_swevent_event(event, count, &data, regs);
}
Above code can race with same code running on another cpu, ending up with 2 cpus trying to store under the same ring buffer, which is specifically not allowed.
This patch prevents the problem, by allowing only events with the same current cpu to receive the event.
NOTE: this requires the use of (per-task-)per-cpu buffers for this feature to work; perf-record does this.
--- kernel/events/core.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/events/core.c +2 -0
@@ -6351,6 +6351,8 @@ void perf_tp_event(u64 addr, u64 count, void *record, int entry_size, goto unlock;list_for_each_entry_rcu (event, &ctx->event_list, event_entry) { +if (event->cpu !=smp_processor_id ()) +continue ;if (event->attr.type !=PERF_TYPE_TRACEPOINT )continue ;if (event->attr.config != entry->type)
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 14/15 net/usb: cancel pending work when unbinding smsc75xx
In reply to Sasha LevinFrom: Yu Zhao <[email protected]>
[ Upstream commit f7b2a56e1f3dcbdb4cf09b2b63e859ffe0e09df8 ]
Cancel pending work before freeing smsc75xx private data structure during binding. This fixes the following crash in the driver:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 IP: mutex_lock+0x2b/0x3f <snipped> Workqueue: events smsc75xx_deferred_multicast_write [smsc75xx] task: ffff8caa83e85700 task.stack: ffff948b80518000 RIP: 0010:mutex_lock+0x2b/0x3f <snipped> Call Trace: smsc75xx_deferred_multicast_write+0x40/0x1af [smsc75xx] process_one_work+0x18d/0x2fc worker_thread+0x1a2/0x269 ? pr_cont_work+0x58/0x58 kthread+0xfa/0x10a ? pr_cont_work+0x58/0x58 ? rcu_read_unlock_sched_notrace+0x48/0x48 ret_from_fork+0x22/0x40
--- drivers/net/usb/smsc75xx.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/smsc75xx.c +1 -0
@@ -1509,6 +1509,7 @@ static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf) {struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0 ]);if (pdata) { +cancel_work_sync (&pdata->set_multicast);netif_dbg (dev, ifdown, dev->net,"free pdata\n" );kfree (pdata); pdata =NULL ;
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 15/15 net: cxgb3_main: fix a missing-check bug
In reply to Sasha LevinFrom: Wenwen Wang <[email protected]>
[ Upstream commit 2c05d88818ab6571816b93edce4d53703870d7ae ]
In cxgb_extension_ioctl(), the command of the ioctl is firstly copied from the user-space buffer 'useraddr' to 'cmd' and checked through the switch statement. If the command is not as expected, an error code EOPNOTSUPP is returned. In the following execution, i.e., the cases of the switch statement, the whole buffer of 'useraddr' is copied again to a specific data structure, according to what kind of command is requested. However, after the second copy, there is no re-check on the newly-copied command. Given that the buffer 'useraddr' is in the user space, a malicious user can race to change the command between the two copies. By doing so, the attacker can supply malicious data to the kernel and cause undefined behavior.
This patch adds a re-check in each case of the switch statement if there is a second copy in that case, to re-check whether the command obtained in the second copy is the same as the one in the first copy. If not, an error code EINVAL is returned.
--- drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +17 -0
@@ -2146,6 +2146,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)return -EPERM ;if (copy_from_user (&t, useraddr,sizeof (t)))return -EFAULT ; +if (t.cmd !=CHELSIO_SET_QSET_PARAMS ) +return -EINVAL ;if (t.qset_idx >=SGE_QSETS )return -EINVAL ; if (!in_range(t.intr_lat, 0, M_NEWTIMER) ||
@@ -2245,6 +2247,9 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)if (copy_from_user (&t, useraddr,sizeof (t)))return -EFAULT ; +if (t.cmd !=CHELSIO_GET_QSET_PARAMS ) +return -EINVAL ; +/* Display qsets for all ports when offload enabled */ if (test_bit (OFFLOAD_DEVMAP_BIT , &adapter->open_device_map)) { q1 =0 ;
@@ -2289,6 +2294,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)return -EBUSY ;if (copy_from_user (&edata, useraddr,sizeof (edata)))return -EFAULT ; +if (edata.cmd !=CHELSIO_SET_QSET_NUM ) +return -EINVAL ;if (edata.val <1 || (edata.val >1 && !(adapter->flags &USING_MSIX )))return -EINVAL ;
@@ -2329,6 +2336,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)return -EPERM ;if (copy_from_user (&t, useraddr,sizeof (t)))return -EFAULT ; +if (t.cmd !=CHELSIO_LOAD_FW ) +return -EINVAL ;/* Check t.len sanity ? */ fw_data =memdup_user (useraddr +sizeof (t), t.len);if (IS_ERR (fw_data))
@@ -2352,6 +2361,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)return -EBUSY ;if (copy_from_user (&m, useraddr,sizeof (m)))return -EFAULT ; +if (m.cmd !=CHELSIO_SETMTUTAB ) +return -EINVAL ;if (m.nmtus !=NMTUS )return -EINVAL ;if (m.mtus[0 ] <81 )/* accommodate SACK */
@@ -2393,6 +2404,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)return -EBUSY ;if (copy_from_user (&m, useraddr,sizeof (m)))return -EFAULT ; +if (m.cmd !=CHELSIO_SET_PM ) +return -EINVAL ;if (!is_power_of_2 (m.rx_pg_sz) || !is_power_of_2 (m.tx_pg_sz))return -EINVAL ;/* not power of 2 */
@@ -2426,6 +2439,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)return -EIO ;/* need the memory controllers */ if (copy_from_user (&t, useraddr,sizeof (t)))return -EFAULT ; +if (t.cmd !=CHELSIO_GET_MEM ) +return -EINVAL ;if ((t.addr &7 ) || (t.len &7 ))return -EINVAL ;if (t.mem_id ==MEM_CM )
@@ -2478,6 +2493,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)return -EAGAIN ;if (copy_from_user (&t, useraddr,sizeof (t)))return -EFAULT ; +if (t.cmd !=CHELSIO_SET_TRACE_FILTER ) +return -EINVAL ; tp = (const struct trace_params *)&t.sip;if (t.config_tx)
Signature · 1 line
2.17.1