4.14.174-rc1 review
Greg Kroah-Hartman
maintainercover 4.14.174-rc1 review
This is the start of the stable review cycle for the 4.14.174 release. There are 99 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 21 Mar 2020 12:37:04 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.174-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.174-rc1
Matteo Croce <[email protected]>
ipv4: ensure rcu_read_lock() in cipso_v4_error()
Jann Horn <[email protected]>
mm: slub: add missing TID bump in kmem_cache_alloc_bulk()
Kees Cook <[email protected]>
ARM: 8958/1: rename missed uaccess .fixup section
Florian Fainelli <[email protected]>
ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional()
Qian Cai <[email protected]>
jbd2: fix data races at struct journal_head
Taehee Yoo <[email protected]>
net: rmnet: fix NULL pointer dereference in rmnet_newlink()
Luo bin <[email protected]>
hinic: fix a bug of setting hw_ioctxt
yangerkun <[email protected]>
slip: not call free_netdev before rtnl_unlock in slip_open
Linus Torvalds <[email protected]>
signal: avoid double atomic counter increments for user accounting
Madhuparna Bhowmik <[email protected]>
mac80211: rx: avoid RCU list traversal under mutex
Marek Vasut <[email protected]>
net: ks8851-ml: Fix IRQ handling and locking
Daniele Palmas <[email protected]>
net: usb: qmi_wwan: restore mtu min/max values after raw_ip switch
Igor Druzhinin <[email protected]>
scsi: libfc: free response frame from GPN_ID
Johannes Berg <[email protected]>
cfg80211: check reg_rule for NULL in handle_channel_custom()
Kai-Heng Feng <[email protected]>
HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override
Mansour Behabadi <[email protected]>
HID: apple: Add support for recent firmware on Magic Keyboards
Jean Delvare <[email protected]>
ACPI: watchdog: Allow disabling WDAT at boot
Kim Phillips <[email protected]>
perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag
Sven Eckelmann <[email protected]>
batman-adv: Don't schedule OGM for disabled interface
Sven Eckelmann <[email protected]>
batman-adv: Avoid free/alloc race when handling OGM buffer
Sven Eckelmann <[email protected]>
batman-adv: Avoid free/alloc race when handling OGM2 buffer
Sven Eckelmann <[email protected]>
batman-adv: Fix duplicated OGMs on NETDEV_UP
Sven Eckelmann <[email protected]>
batman-adv: Fix debugfs path for renamed softif
Sven Eckelmann <[email protected]>
batman-adv: Fix debugfs path for renamed hardif
Marek Lindner <[email protected]>
batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs
Linus Lüssing <[email protected]>
batman-adv: Fix TT sync flags for intermediate TT responses
Sven Eckelmann <[email protected]>
batman-adv: Avoid race in TT TVLV allocator helper
Matthias Schiffer <[email protected]>
batman-adv: update data pointers after skb_cow()
Sven Eckelmann <[email protected]>
batman-adv: Fix internal interface indices types
Sven Eckelmann <[email protected]>
batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq
Sven Eckelmann <[email protected]>
batman-adv: Fix check of retrieved orig_gw in batadv_v_gw_is_eligible
Sven Eckelmann <[email protected]>
batman-adv: Always initialize fragment header priority
Sven Eckelmann <[email protected]>
batman-adv: Avoid spurious warnings from bat_v neigh_cmp implementation
Vladis Dronov <[email protected]>
efi: Add a sanity check to efivar_store_raw()
Karsten Graul <[email protected]>
net/smc: check for valid ib_client_data
Eric Dumazet <[email protected]>
ipv6: restrict IPV6_ADDRFORM operation
Wolfram Sang <[email protected]>
i2c: acpi: put device when verifying client fails
Daniel Drake <[email protected]>
iommu/vt-d: Ignore devices with out-of-spec domain number
Zhenzhong Duan <[email protected]>
iommu/vt-d: Fix the wrong printing in RHSA parsing
Jakub Kicinski <[email protected]>
netfilter: nft_payload: add missing attribute validation for payload csum flags
Jakub Kicinski <[email protected]>
netfilter: cthelper: add missing attribute validation for cthelper
Jakub Kicinski <[email protected]>
nl80211: add missing attribute validation for channel switch
Jakub Kicinski <[email protected]>
nl80211: add missing attribute validation for beacon report scanning
Jakub Kicinski <[email protected]>
nl80211: add missing attribute validation for critical protocol indication
Charles Keepax <[email protected]>
pinctrl: core: Remove extra kref_get which blocks hogs being freed
Nicolas Belin <[email protected]>
pinctrl: meson-gxl: fix GPIOX sdio pins
Yonghyun Hwang <[email protected]>
iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
Hans de Goede <[email protected]>
iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
Marc Zyngier <[email protected]>
iommu/dma: Fix MSI reservation allocation
Tony Luck <[email protected]>
x86/mce: Fix logic and comments around MSR_PPIN_CTL
Vladis Dronov <[email protected]>
efi: Fix a race and a buffer overflow while reading efivars via sysfs
Eugeniy Paltsev <[email protected]>
ARC: define __ALIGN_STR and __ALIGN symbols for ARC
Vitaly Kuznetsov <[email protected]>
KVM: x86: clear stale x86_emulate_ctxt->intercept value
Al Viro <[email protected]>
gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
Al Viro <[email protected]>
cifs_atomic_open(): fix double-put on late allocation failure
Steven Rostedt (VMware) <[email protected]>
ktest: Add timeout for ssh sync testing
Colin Ian King <[email protected]>
drm/amd/display: remove duplicated assignment to grph_obj_type
Hillf Danton <[email protected]>
workqueue: don't use wq_select_unbound_cpu() for bound works
Hans de Goede <[email protected]>
iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint
Halil Pasic <[email protected]>
virtio-blk: fix hw_queue stopped on arbitrary error
Dan Moulding <[email protected]>
iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices
Michal Koutný <[email protected]>
cgroup: Iterate tasks that did not finish do_exit()
Vasily Averin <[email protected]>
cgroup: cgroup_procs_next should increase position index
Mahesh Bandewar <[email protected]>
ipvlan: don't deref eth hdr before checking it's set
Paolo Abeni <[email protected]>
ipvlan: egress mcast packets are not exceptional
Jiri Wiesner <[email protected]>
ipvlan: do not add hardware address of master to its unicast filter list
Dmitry Yakunin <[email protected]>
inet_diag: return classid for all socket types
Mahesh Bandewar <[email protected]>
macvlan: add cond_resched() during multicast processing
Jakub Kicinski <[email protected]>
net: fec: validate the new settings in fec_enet_set_coalesce()
Eric Dumazet <[email protected]>
slip: make slhc_compress() more robust against malicious packets
Eric Dumazet <[email protected]>
bonding/alb: make sure arp header is pulled before accessing it
Heiner Kallweit <[email protected]>
net: phy: fix MDIO bus PM PHY resuming
Jakub Kicinski <[email protected]>
nfc: add missing attribute validation for vendor subcommand
Jakub Kicinski <[email protected]>
nfc: add missing attribute validation for SE API
Jakub Kicinski <[email protected]>
team: add missing attribute validation for array index
Jakub Kicinski <[email protected]>
team: add missing attribute validation for port ifindex
Jakub Kicinski <[email protected]>
net: fq: add missing attribute validation for orphan mask
Jakub Kicinski <[email protected]>
macsec: add missing attribute validation for port
Jakub Kicinski <[email protected]>
can: add missing attribute validation for termination
Jakub Kicinski <[email protected]>
nl802154: add missing attribute validation for dev_type
Jakub Kicinski <[email protected]>
nl802154: add missing attribute validation
Jakub Kicinski <[email protected]>
fib: add missing attribute validation for tun_id
Eric Dumazet <[email protected]>
net: memcg: fix lockdep splat in inet_csk_accept()
Shakeel Butt <[email protected]>
net: memcg: late association of sock to memcg
Shakeel Butt <[email protected]>
cgroup: memcg: net: do not associate sock with unrelated cgroup
Vasundhara Volam <[email protected]>
bnxt_en: reinitialize IRQs when MTU is modified
Edward Cree <[email protected]>
sfc: detach from cb_page in efx_copy_channel()
You-Sheng Yang <[email protected]>
r8152: check disconnect status after long sleep
Willem de Bruijn <[email protected]>
net/packet: tpacket_rcv: do not increment ring index on drop
Dan Carpenter <[email protected]>
net: nfc: fix bounds checking bugs on "pipe"
Dmitry Bogdanov <[email protected]>
net: macsec: update SCI upon MAC address change.
Pablo Neira Ayuso <[email protected]>
netlink: Use netlink header as base to calculate bad attribute offset
Eric Dumazet <[email protected]>
ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
Mahesh Bandewar <[email protected]>
ipvlan: add cond_resched_rcu() while processing muticast backlog
Hangbin Liu <[email protected]>
ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface
Eric Dumazet <[email protected]>
gre: fix uninit-value in __iptunnel_pull_header
Dmitry Yakunin <[email protected]>
cgroup, netclassid: periodically release file_lock on classid updating
Florian Fainelli <[email protected]>
net: phy: Avoid multiple suspends
David S. Miller <[email protected]>
phy: Revert toggling reset changes.
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 4 + Documentation/filesystems/porting | 7 ++ Makefile | 4 +- arch/arc/include/asm/linkage.h | 2 + arch/arm/kernel/vdso.c | 2 + arch/arm/lib/copy_from_user.S | 2 +- arch/x86/events/amd/uncore.c | 14 ++-- arch/x86/kernel/cpu/mcheck/mce_intel.c | 9 ++- arch/x86/kvm/emulate.c | 1 + drivers/acpi/acpi_watchdog.c | 12 ++- drivers/block/virtio_blk.c | 8 +- drivers/firmware/efi/efivars.c | 32 +++++--- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 3 +- drivers/hid/hid-apple.c | 3 +- drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++ drivers/i2c/i2c-core-acpi.c | 10 ++- drivers/iommu/dma-iommu.c | 16 ++-- drivers/iommu/dmar.c | 21 +++-- drivers/iommu/intel-iommu.c | 13 +-- drivers/net/bonding/bond_alb.c | 20 ++--- drivers/net/can/dev.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- drivers/net/ethernet/freescale/fec_main.c | 6 +- drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c | 1 + drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h | 2 +- drivers/net/ethernet/huawei/hinic/hinic_hw_if.h | 1 + drivers/net/ethernet/micrel/ks8851_mll.c | 14 ++-- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 5 ++ drivers/net/ethernet/sfc/efx.c | 1 + drivers/net/ipvlan/ipvlan_core.c | 19 +++-- drivers/net/ipvlan/ipvlan_main.c | 5 +- drivers/net/macsec.c | 12 +-- drivers/net/macvlan.c | 2 + drivers/net/phy/phy_device.c | 18 +++-- drivers/net/slip/slhc.c | 14 +++- drivers/net/slip/slip.c | 3 + drivers/net/team/team.c | 2 + drivers/net/usb/qmi_wwan.c | 3 + drivers/net/usb/r8152.c | 8 ++ drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | 3 +- drivers/pinctrl/core.c | 1 - drivers/pinctrl/meson/pinctrl-meson-gxl.c | 4 +- drivers/scsi/libfc/fc_disc.c | 2 + fs/cifs/dir.c | 1 - fs/gfs2/inode.c | 2 +- fs/jbd2/transaction.c | 8 +- fs/open.c | 3 - include/linux/cgroup.h | 1 + include/linux/inet_diag.h | 18 +++-- include/linux/phy.h | 2 + include/net/fib_rules.h | 1 + kernel/cgroup/cgroup.c | 37 ++++++--- kernel/signal.c | 23 +++--- kernel/workqueue.c | 14 ++-- mm/memcontrol.c | 14 +--- mm/slub.c | 9 +++ net/batman-adv/bat_iv_ogm.c | 94 +++++++++++++++++----- net/batman-adv/bat_v.c | 11 ++- net/batman-adv/bat_v_ogm.c | 42 ++++++++-- net/batman-adv/debugfs.c | 46 ++++++++++- net/batman-adv/debugfs.h | 11 +++ net/batman-adv/fragmentation.c | 2 + net/batman-adv/hard-interface.c | 51 ++++++++++-- net/batman-adv/originator.c | 4 +- net/batman-adv/originator.h | 4 +- net/batman-adv/routing.c | 10 +-- net/batman-adv/translation-table.c | 84 +++++++++++++++---- net/batman-adv/types.h | 18 +++-- net/core/netclassid_cgroup.c | 47 ++++++++--- net/core/sock.c | 5 +- net/ieee802154/nl_policy.c | 6 ++ net/ipv4/cipso_ipv4.c | 7 +- net/ipv4/gre_demux.c | 12 ++- net/ipv4/inet_connection_sock.c | 20 +++++ net/ipv4/inet_diag.c | 44 +++++----- net/ipv4/raw_diag.c | 5 +- net/ipv4/udp_diag.c | 5 +- net/ipv6/addrconf.c | 4 + net/ipv6/ipv6_sockglue.c | 10 ++- net/mac80211/rx.c | 2 +- net/netfilter/nfnetlink_cthelper.c | 2 + net/netfilter/nft_payload.c | 1 + net/netlink/af_netlink.c | 2 +- net/nfc/hci/core.c | 19 ++++- net/nfc/netlink.c | 3 + net/packet/af_packet.c | 13 +-- net/sched/sch_fq.c | 1 + net/sctp/sctp_diag.c | 8 +- net/smc/smc_ib.c | 2 + net/wireless/nl80211.c | 5 ++ net/wireless/reg.c | 2 +- tools/testing/ktest/ktest.pl | 2 +- 92 files changed, 764 insertions(+), 295 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/99 phy: Revert toggling reset changes.
From: David S. Miller <[email protected]>
commit 7b566f70e1bf65b189b66eb3de6f431c30f7dff2 upstream.
This reverts:
ef1b5bf506b1 ("net: phy: Fix not to call phy_resume() if PHY is not attached") 8c85f4b81296 ("net: phy: micrel: add toggling phy reset if PHY is not attached")
Andrew Lunn informs me that there are alternative efforts underway to fix this more properly.
--- drivers/net/phy/phy_device.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/net/phy/phy_device.c +5 -6
@@ -76,7 +76,7 @@ static LIST_HEAD(phy_fixup_list);static DEFINE_MUTEX (phy_fixup_lock);#ifdef CONFIG_PM -static bool mdio_bus_phy_may_suspend (struct phy_device *phydev,bool suspend) +static bool mdio_bus_phy_may_suspend (struct phy_device *phydev) {struct device_driver *drv = phydev->mdio.dev.driver;struct phy_driver *phydrv =to_phy_driver (drv);
@@ -88,11 +88,10 @@ static bool mdio_bus_phy_may_suspend(str/* PHY not attached? May suspend if the PHY has not already been * suspended as part of a prior call to phy_disconnect() -> * phy_detach() -> phy_suspend() because the parent netdev might be the -* MDIO bus driver and clock gated at this point. Also may resume if -* PHY is not attached. +* MDIO bus driver and clock gated at this point. */ if (!netdev) -return suspend ? !phydev->suspended : phydev->suspended; +return !phydev->suspended;/* Don't suspend PHY if the attached netdev parent may wakeup. * The parent may point to a PCI device, as in tg3 driver.
@@ -122,7 +121,7 @@ static int mdio_bus_phy_suspend(struct dif (phydev->attached_dev && phydev->adjust_link)phy_stop_machine (phydev); -if (!mdio_bus_phy_may_suspend (phydev, true)) +if (!mdio_bus_phy_may_suspend (phydev))return 0 ;return phy_suspend (phydev);
@@ -133,7 +132,7 @@ static int mdio_bus_phy_resume(struct destruct phy_device *phydev =to_phy_device (dev);int ret; -if (!mdio_bus_phy_may_suspend (phydev, false)) +if (!mdio_bus_phy_may_suspend (phydev)) goto no_resume; ret =phy_resume (phydev);
Greg Kroah-Hartman
maintainerPATCH 2/99 net: phy: Avoid multiple suspends
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit 503ba7c6961034ff0047707685644cad9287c226 upstream.
It is currently possible for a PHY device to be suspended as part of a network device driver's suspend call while it is still being attached to that net_device, either via phy_suspend() or implicitly via phy_stop().
Later on, when the MDIO bus controller get suspended, we would attempt to suspend again the PHY because it is still attached to a network device.
This is both a waste of time and creates an opportunity for improper clock/power management bugs to creep in.
--- drivers/net/phy/phy_device.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/phy/phy_device.c +3 -2
@@ -91,7 +91,7 @@ static bool mdio_bus_phy_may_suspend(str* MDIO bus driver and clock gated at this point. */ if (!netdev) -return !phydev->suspended; + goto out;/* Don't suspend PHY if the attached netdev parent may wakeup. * The parent may point to a PCI device, as in tg3 driver.
@@ -106,7 +106,8 @@ static bool mdio_bus_phy_may_suspend(strif (device_may_wakeup (&netdev->dev))return false; -return true; +out: +return !phydev->suspended; }static int mdio_bus_phy_suspend (struct device *dev)
Greg Kroah-Hartman
maintainerPATCH 3/99 cgroup, netclassid: periodically release file_lock on classid updating
In reply to Greg Kroah-HartmanFrom: Dmitry Yakunin <[email protected]>
[ Upstream commit 018d26fcd12a75fb9b5fe233762aa3f2f0854b88 ]
In our production environment we have faced with problem that updating classid in cgroup with heavy tasks cause long freeze of the file tables in this tasks. By heavy tasks we understand tasks with many threads and opened sockets (e.g. balancers). This freeze leads to an increase number of client timeouts.
This patch implements following logic to fix this issue:
аfter iterating 1000 file descriptors file table lock will be released thus providing a time gap for socket creation/deletion.
Now update is non atomic and socket may be skipped using calls:
dup2(oldfd, newfd);
close(oldfd);
But this case is not typical. Moreover before this patch skip is possible too by hiding socket fd in unix socket buffer.
New sockets will be allocated with updated classid because cgroup state is updated before start of the file descriptors iteration.
So in common cases this patch has no side effects.
--- net/core/netclassid_cgroup.c | 47 +++++++++++++++++++++++++++++++++---------- 1 file changed, 37 insertions(+), 10 deletions(-)
net/core/netclassid_cgroup.c +37 -10
@@ -57,30 +57,60 @@ static void cgrp_css_free(struct cgroup_kfree (css_cls_state (css)); } +/* +* To avoid freezing of sockets creation for tasks with big number of threads +* and opened sockets lets release file_lock every 1000 iterated descriptors. +* New sockets will already have been created with new classid. +*/ + +struct update_classid_context { +u32 classid; +unsigned int batch; +}; + +#define UPDATE_CLASSID_BATCH 1000 +static int update_classid_sock (const void *v,struct file *file,unsigned n) {int err; +struct update_classid_context *ctx = (void *)v;struct socket *sock =sock_from_file (file, &err);if (sock) {spin_lock (&cgroup_sk_update_lock); -sock_cgroup_set_classid (&sock->sk->sk_cgrp_data, - (unsigned long )v); +sock_cgroup_set_classid (&sock->sk->sk_cgrp_data, ctx->classid);spin_unlock (&cgroup_sk_update_lock); } +if (--ctx->batch ==0 ) { + ctx->batch =UPDATE_CLASSID_BATCH ; +return n +1 ; + }return 0 ; } +static void update_classid_task (struct task_struct *p,u32 classid) +{ +struct update_classid_context ctx = { + .classid = classid, + .batch =UPDATE_CLASSID_BATCH + }; +unsigned int fd =0 ; + +do { +task_lock (p); + fd =iterate_fd (p->files, fd, update_classid_sock, &ctx); +task_unlock (p); +cond_resched (); + }while (fd); +} +static void cgrp_attach (struct cgroup_taskset *tset) {struct cgroup_subsys_state *css;struct task_struct *p;cgroup_taskset_for_each (p, css, tset) { -task_lock (p); -iterate_fd (p->files,0 , update_classid_sock, - (void *)(unsigned long )css_cls_state (css)->classid); -task_unlock (p); +update_classid_task (p,css_cls_state (css)->classid); } }
@@ -102,10 +132,7 @@ static int write_classid(struct cgroup_scss_task_iter_start (css,0 , &it);while ((p =css_task_iter_next (&it))) { -task_lock (p); -iterate_fd (p->files,0 , update_classid_sock, - (void *)(unsigned long )cs->classid); -task_unlock (p); +update_classid_task (p, cs->classid);cond_resched (); }css_task_iter_end (&it);
Greg Kroah-Hartman
maintainerPATCH 4/99 gre: fix uninit-value in __iptunnel_pull_header
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 17c25cafd4d3e74c83dce56b158843b19c40b414 ]
syzbot found an interesting case of the kernel reading an uninit-value [1]
Problem is in the handling of ETH_P_WCCP in gre_parse_header()
We look at the byte following GRE options to eventually decide if the options are four bytes longer.
Use skb_header_pointer() to not pull bytes if we found that no more bytes were needed.
All callers of gre_parse_header() are properly using pskb_may_pull() anyway before proceeding to next header.
[1]
BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2303 [inline] BUG: KMSAN: uninit-value in __iptunnel_pull_header+0x30c/0xbd0 net/ipv4/ip_tunnel_core.c:94 CPU: 1 PID: 11784 Comm: syz-executor940 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 pskb_may_pull include/linux/skbuff.h:2303 [inline] __iptunnel_pull_header+0x30c/0xbd0 net/ipv4/ip_tunnel_core.c:94 iptunnel_pull_header include/net/ip_tunnels.h:411 [inline] gre_rcv+0x15e/0x19c0 net/ipv6/ip6_gre.c:606 ip6_protocol_deliver_rcu+0x181b/0x22c0 net/ipv6/ip6_input.c:432 ip6_input_finish net/ipv6/ip6_input.c:473 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] ip6_input net/ipv6/ip6_input.c:482 [inline] ip6_mc_input+0xdf2/0x1460 net/ipv6/ip6_input.c:576 dst_input include/net/dst.h:442 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] ipv6_rcv+0x683/0x710 net/ipv6/ip6_input.c:306 __netif_receive_skb_one_core net/core/dev.c:5198 [inline] __netif_receive_skb net/core/dev.c:5312 [inline] netif_receive_skb_internal net/core/dev.c:5402 [inline] netif_receive_skb+0x66b/0xf20 net/core/dev.c:5461 tun_rx_batched include/linux/skbuff.h:4321 [inline] tun_get_user+0x6aef/0x6f60 drivers/net/tun.c:1997 tun_chr_write_iter+0x1f2/0x360 drivers/net/tun.c:2026 call_write_iter include/linux/fs.h:1901 [inline] new_sync_write fs/read_write.c:483 [inline] __vfs_write+0xa5a/0xca0 fs/read_write.c:496 vfs_write+0x44a/0x8f0 fs/read_write.c:558 ksys_write+0x267/0x450 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:620 do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline] do_fast_syscall_32+0x3c7/0x6e0 arch/x86/entry/common.c:410 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7f62d99 Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000fffedb2c EFLAGS: 00000217 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020002580 RDX: 0000000000000fca RSI: 0000000000000036 RDI: 0000000000000004 RBP: 0000000000008914 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82 slab_alloc_node mm/slub.c:2793 [inline] __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4401 __kmalloc_reserve net/core/skbuff.c:142 [inline] __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:210 alloc_skb include/linux/skbuff.h:1051 [inline] alloc_skb_with_frags+0x18c/0xa70 net/core/skbuff.c:5766 sock_alloc_send_pskb+0xada/0xc60 net/core/sock.c:2242 tun_alloc_skb drivers/net/tun.c:1529 [inline] tun_get_user+0x10ae/0x6f60 drivers/net/tun.c:1843 tun_chr_write_iter+0x1f2/0x360 drivers/net/tun.c:2026 call_write_iter include/linux/fs.h:1901 [inline] new_sync_write fs/read_write.c:483 [inline] __vfs_write+0xa5a/0xca0 fs/read_write.c:496 vfs_write+0x44a/0x8f0 fs/read_write.c:558 ksys_write+0x267/0x450 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:620 do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline] do_fast_syscall_32+0x3c7/0x6e0 arch/x86/entry/common.c:410 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139
--- net/ipv4/gre_demux.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
net/ipv4/gre_demux.c +10 -2
@@ -60,7 +60,9 @@ int gre_del_protocol(const struct gre_pr }EXPORT_SYMBOL_GPL (gre_del_protocol); -/* Fills in tpi and returns header length to be pulled. */ +/* Fills in tpi and returns header length to be pulled. +* Note that caller must use pskb_may_pull() before pulling GRE header. +*/ int gre_parse_header (struct sk_buff *skb,struct tnl_ptk_info *tpi,bool *csum_err,__be16 proto,int nhs) {
@@ -114,8 +116,14 @@ int gre_parse_header(struct sk_buff *skb* - When dealing with WCCPv2, Skip extra 4 bytes in GRE header */ if (greh->flags ==0 && tpi->proto ==htons (ETH_P_WCCP )) { +u8 _val, *val; + + val =skb_header_pointer (skb, nhs + hdr_len, +sizeof (_val), &_val); +if (!val) +return -EINVAL ; tpi->proto = proto; -if ((*(u8 *)options &0xF0 ) !=0x40 ) +if ((*val &0xF0 ) !=0x40 ) hdr_len +=4 ; } tpi->hdr_len = hdr_len;
Greg Kroah-Hartman
maintainerPATCH 5/99 ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit 60380488e4e0b95e9e82aa68aa9705baa86de84c ]
Rafał found an issue that for non-Ethernet interface, if we down and up frequently, the memory will be consumed slowly.
The reason is we add allnodes/allrouters addressed in multicast list in ipv6_add_dev(). When link down, we call ipv6_mc_down(), store all multicast addresses via mld_add_delrec(). But when link up, we don't call ipv6_mc_up() for non-Ethernet interface to remove the addresses. This makes idev->mc_tomb getting bigger and bigger. The call stack looks like:
addrconf_notify(NETDEV_REGISTER)
ipv6_add_dev ipv6_dev_mc_inc(ff01::1) ipv6_dev_mc_inc(ff02::1) ipv6_dev_mc_inc(ff02::2)
addrconf_notify(NETDEV_UP)
addrconf_dev_config /* Alas, we support only Ethernet autoconfiguration. */ return;
addrconf_notify(NETDEV_DOWN)
addrconf_ifdown ipv6_mc_down igmp6_group_dropped(ff02::2) mld_add_delrec(ff02::2) igmp6_group_dropped(ff02::1) igmp6_group_dropped(ff01::1)
After investigating, I can't found a rule to disable multicast on non-Ethernet interface. In RFC2460, the link could be Ethernet, PPP, ATM, tunnels, etc. In IPv4, it doesn't check the dev type when calls ip_mc_up() in inetdev_event(). Even for IPv6, we don't check the dev type and call ipv6_add_dev(), ipv6_dev_mc_inc() after register device.
So I think it's OK to fix this memory consumer by calling ipv6_mc_up() for non-Ethernet interface.
v2: Also check IFF_MULTICAST flag to make sure the interface supports
multicast
--- net/ipv6/addrconf.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv6/addrconf.c +4 -0
@@ -3223,6 +3223,10 @@ static void addrconf_dev_config(struct n (dev->type != ARPHRD_TUNNEL) && (dev->type != ARPHRD_NONE)) {/* Alas, we support only Ethernet autoconfiguration. */ + idev =__in6_dev_get (dev); +if (!IS_ERR_OR_NULL (idev) && dev->flags &IFF_UP && + dev->flags &IFF_MULTICAST ) +ipv6_mc_up (idev);return ; }
Greg Kroah-Hartman
maintainerPATCH 6/99 ipvlan: add cond_resched_rcu() while processing muticast backlog
In reply to Greg Kroah-HartmanFrom: Mahesh Bandewar <[email protected]>
[ Upstream commit e18b353f102e371580f3f01dd47567a25acc3c1d ]
If there are substantial number of slaves created as simulated by Syzbot, the backlog processing could take much longer and result into the issue found in the Syzbot report.
INFO: rcu_sched detected stalls on CPUs/tasks:
(detected by 1, t=10502 jiffies, g=5049, c=5048, q=752)
All QSes seen, last rcu_sched kthread activity 10502 (4294965563-4294955061), jiffies_till_next_fqs=1, root ->qsmask 0x0
syz-executor.1 R running task on cpu 1 10984 11210 3866 0x30020008 179034491270
Call Trace:
<IRQ>
[<ffffffff81497163>] _sched_show_task kernel/sched/core.c:8063 [inline]
[<ffffffff81497163>] _sched_show_task.cold+0x2fd/0x392 kernel/sched/core.c:8030
[<ffffffff8146a91b>] sched_show_task+0xb/0x10 kernel/sched/core.c:8073
[<ffffffff815c931b>] print_other_cpu_stall kernel/rcu/tree.c:1577 [inline]
[<ffffffff815c931b>] check_cpu_stall kernel/rcu/tree.c:1695 [inline]
[<ffffffff815c931b>] __rcu_pending kernel/rcu/tree.c:3478 [inline]
[<ffffffff815c931b>] rcu_pending kernel/rcu/tree.c:3540 [inline]
[<ffffffff815c931b>] rcu_check_callbacks.cold+0xbb4/0xc29 kernel/rcu/tree.c:2876
[<ffffffff815e3962>] update_process_times+0x32/0x80 kernel/time/timer.c:1635
[<ffffffff816164f0>] tick_sched_handle+0xa0/0x180 kernel/time/tick-sched.c:161
[<ffffffff81616ae4>] tick_sched_timer+0x44/0x130 kernel/time/tick-sched.c:1193
[<ffffffff815e75f7>] __run_hrtimer kernel/time/hrtimer.c:1393 [inline]
[<ffffffff815e75f7>] __hrtimer_run_queues+0x307/0xd90 kernel/time/hrtimer.c:1455
[<ffffffff815e90ea>] hrtimer_interrupt+0x2ea/0x730 kernel/time/hrtimer.c:1513
[<ffffffff844050f4>] local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1031 [inline]
[<ffffffff844050f4>] smp_apic_timer_interrupt+0x144/0x5e0 arch/x86/kernel/apic/apic.c:1056
[<ffffffff84401cbe>] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:778
RIP: 0010:do_raw_read_lock+0x22/0x80 kernel/locking/spinlock_debug.c:153
RSP: 0018:ffff8801dad07ab8 EFLAGS: 00000a02 ORIG_RAX: ffffffffffffff12
RAX: 0000000000000000 RBX: ffff8801c4135680 RCX: 0000000000000000
RDX: 1ffff10038826afe RSI: ffff88019d816bb8 RDI: ffff8801c41357f0
RBP: ffff8801dad07ac0 R08: 0000000000004b15 R09: 0000000000310273
R10: ffff88019d816bb8 R11: 0000000000000001 R12: ffff8801c41357e8
R13: 0000000000000000 R14: ffff8801cfb19850 R15: ffff8801cfb198b0
[<ffffffff8101460e>] __raw_read_lock_bh include/linux/rwlock_api_smp.h:177 [inline]
[<ffffffff8101460e>] _raw_read_lock_bh+0x3e/0x50 kernel/locking/spinlock.c:240
[<ffffffff840d78ca>] ipv6_chk_mcast_addr+0x11a/0x6f0 net/ipv6/mcast.c:1006
[<ffffffff84023439>] ip6_mc_input+0x319/0x8e0 net/ipv6/ip6_input.c:482
[<ffffffff840211c8>] dst_input include/net/dst.h:449 [inline]
[<ffffffff840211c8>] ip6_rcv_finish+0x408/0x610 net/ipv6/ip6_input.c:78
[<ffffffff840214de>] NF_HOOK include/linux/netfilter.h:292 [inline]
[<ffffffff840214de>] NF_HOOK include/linux/netfilter.h:286 [inline]
[<ffffffff840214de>] ipv6_rcv+0x10e/0x420 net/ipv6/ip6_input.c:278
[<ffffffff83a29efa>] __netif_receive_skb_one_core+0x12a/0x1f0 net/core/dev.c:5303
[<ffffffff83a2a15c>] __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:5417
[<ffffffff83a2f536>] process_backlog+0x216/0x6c0 net/core/dev.c:6243
[<ffffffff83a30d1b>] napi_poll net/core/dev.c:6680 [inline]
[<ffffffff83a30d1b>] net_rx_action+0x47b/0xfb0 net/core/dev.c:6748
[<ffffffff846002c8>] __do_softirq+0x2c8/0x99a kernel/softirq.c:317
[<ffffffff813e656a>] invoke_softirq kernel/softirq.c:399 [inline]
[<ffffffff813e656a>] irq_exit+0x16a/0x1a0 kernel/softirq.c:439
[<ffffffff84405115>] exiting_irq arch/x86/include/asm/apic.h:561 [inline]
[<ffffffff84405115>] smp_apic_timer_interrupt+0x165/0x5e0 arch/x86/kernel/apic/apic.c:1058
[<ffffffff84401cbe>] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:778
</IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0x26/0x50 kernel/kcov.c:102
RSP: 0018:ffff880196033bd8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff12
RAX: ffff88019d8161c0 RBX: 00000000ffffffff RCX: ffffc90003501000
RDX: 0000000000000002 RSI: ffffffff816236d1 RDI: 0000000000000005
RBP: ffff880196033bd8 R08: ffff88019d8161c0 R09: 0000000000000000
R10: 1ffff10032c067f0 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000080 R14: 0000000000000000 R15: 0000000000000000
[<ffffffff816236d1>] do_futex+0x151/0x1d50 kernel/futex.c:3548
[<ffffffff816260f0>] C_SYSC_futex kernel/futex_compat.c:201 [inline]
[<ffffffff816260f0>] compat_SyS_futex+0x270/0x3b0 kernel/futex_compat.c:175
[<ffffffff8101da17>] do_syscall_32_irqs_on arch/x86/entry/common.c:353 [inline]
[<ffffffff8101da17>] do_fast_syscall_32+0x357/0xe1c arch/x86/entry/common.c:415
[<ffffffff84401a9b>] entry_SYSENTER_compat+0x8b/0x9d arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f23c69
RSP: 002b:00000000f5d1f12c EFLAGS: 00000282 ORIG_RAX: 00000000000000f0
RAX: ffffffffffffffda RBX: 000000000816af88 RCX: 0000000000000080
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000816af8c
RBP: 00000000f5d1f228 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_sched kthread starved for 10502 jiffies! g5049 c5048 f0x2 RCU_GP_WAIT_FQS(3) ->state=0x0 ->cpu=1
rcu_sched R running task on cpu 1 13048 8 2 0x90000000 179099587640
Call Trace:
[<ffffffff8147321f>] context_switch+0x60f/0xa60 kernel/sched/core.c:3209
[<ffffffff8100095a>] __schedule+0x5aa/0x1da0 kernel/sched/core.c:3934
[<ffffffff810021df>] schedule+0x8f/0x1b0 kernel/sched/core.c:4011
[<ffffffff8101116d>] schedule_timeout+0x50d/0xee0 kernel/time/timer.c:1803
[<ffffffff815c13f1>] rcu_gp_kthread+0xda1/0x3b50 kernel/rcu/tree.c:2327
[<ffffffff8144b318>] kthread+0x348/0x420 kernel/kthread.c:246
[<ffffffff84400266>] ret_from_fork+0x56/0x70 arch/x86/entry/entry_64.S:393--- drivers/net/ipvlan/ipvlan_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ipvlan/ipvlan_core.c +1 -0
@@ -240,6 +240,7 @@ void ipvlan_process_multicast(struct wor }ipvlan_count_rx (ipvlan, len, ret ==NET_RX_SUCCESS , true);local_bh_enable (); +cond_resched_rcu (); }rcu_read_unlock ();
Greg Kroah-Hartman
maintainerPATCH 7/99 ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit afe207d80a61e4d6e7cfa0611a4af46d0ba95628 ]
Commit e18b353f102e ("ipvlan: add cond_resched_rcu() while processing muticast backlog") added a cond_resched_rcu() in a loop using rcu protection to iterate over slaves.
This is breaking rcu rules, so lets instead use cond_resched() at a point we can reschedule
--- drivers/net/ipvlan/ipvlan_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ipvlan/ipvlan_core.c +1 -1
@@ -240,7 +240,6 @@ void ipvlan_process_multicast(struct wor }ipvlan_count_rx (ipvlan, len, ret ==NET_RX_SUCCESS , true);local_bh_enable (); -cond_resched_rcu (); }rcu_read_unlock ();
@@ -257,6 +256,7 @@ void ipvlan_process_multicast(struct wor }if (dev)dev_put (dev); +cond_resched (); } }
Greg Kroah-Hartman
maintainerPATCH 8/99 netlink: Use netlink header as base to calculate bad attribute offset
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 84b3268027641401bb8ad4427a90a3cce2eb86f5 ]
Userspace might send a batch that is composed of several netlink messages. The netlink_ack() function must use the pointer to the netlink header as base to calculate the bad attribute offset.
--- net/netlink/af_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netlink/af_netlink.c +1 -1
@@ -2389,7 +2389,7 @@ void netlink_ack(struct sk_buff *in_skb, in_skb->len))WARN_ON (nla_put_u32 (skb,NLMSGERR_ATTR_OFFS , (u8 *)extack->bad_attr - - in_skb->data)); + (u8 *)nlh)); }else {if (extack->cookie_len) WARN_ON(nla_put(skb, NLMSGERR_ATTR_COOKIE,
Greg Kroah-Hartman
maintainerPATCH 9/99 net: macsec: update SCI upon MAC address change.
In reply to Greg Kroah-HartmanFrom: Dmitry Bogdanov <[email protected]>
[ Upstream commit 6fc498bc82929ee23aa2f35a828c6178dfd3f823 ]
SCI should be updated, because it contains MAC in its first 6 octets.
--- drivers/net/macsec.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/net/macsec.c +6 -5
@@ -2871,6 +2871,11 @@ static void macsec_dev_set_rx_mode(strucdev_uc_sync (real_dev, dev); } +static sci_t dev_to_sci (struct net_device *dev,__be16 port) +{ +return make_sci (dev->dev_addr, port); +} +static int macsec_set_mac_address (struct net_device *dev,void *p) {struct macsec_dev *macsec =macsec_priv (dev);
@@ -2892,6 +2897,7 @@ static int macsec_set_mac_address(struct out:ether_addr_copy (dev->dev_addr, addr->sa_data); + macsec->secy.sci =dev_to_sci (dev,MACSEC_PORT_ES );return 0 ; }
@@ -3159,11 +3165,6 @@ static bool sci_exists(struct net_devicereturn false; } -static sci_t dev_to_sci (struct net_device *dev,__be16 port) -{ -return make_sci (dev->dev_addr, port); -} -static int macsec_add_dev (struct net_device *dev,sci_t sci,u8 icv_len) {struct macsec_dev *macsec =macsec_priv (dev);
Greg Kroah-Hartman
maintainerPATCH 10/99 net: nfc: fix bounds checking bugs on "pipe"
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit a3aefbfe45751bf7b338c181b97608e276b5bb73 ]
This is similar to commit 674d9de02aa7 ("NFC: Fix possible memory corruption when handling SHDLC I-Frame commands") and commit d7ee81ad09f0 ("NFC: nci: Add some bounds checking in nci_hci_cmd_received()") which added range checks on "pipe".
The "pipe" variable comes skb->data[0] in nfc_hci_msg_rx_work(). It's in the 0-255 range. We're using it as the array index into the hdev->pipes[] array which has NFC_HCI_MAX_PIPES (128) members.
--- net/nfc/hci/core.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
net/nfc/hci/core.c +16 -3
@@ -193,13 +193,20 @@ exit:void nfc_hci_cmd_received (struct nfc_hci_dev *hdev,u8 pipe,u8 cmd,struct sk_buff *skb) { -u8 gate = hdev->pipes[pipe].gate;u8 status =NFC_HCI_ANY_OK ;struct hci_create_pipe_resp *create_info;struct hci_delete_pipe_noti *delete_info;struct hci_all_pipe_cleared_noti *cleared_info; +u8 gate; -pr_debug ("from gate %x pipe %x cmd %x\n" , gate, pipe, cmd); +pr_debug ("from pipe %x cmd %x\n" , pipe, cmd); + +if (pipe >=NFC_HCI_MAX_PIPES ) { + status =NFC_HCI_ANY_E_NOK ; + goto exit; + } + + gate = hdev->pipes[pipe].gate;switch (cmd) {case NFC_HCI_ADM_NOTIFY_PIPE_CREATED :
@@ -387,8 +394,14 @@ void nfc_hci_event_received(struct nfc_h struct sk_buff *skb) {int r =0 ; -u8 gate = hdev->pipes[pipe].gate; +u8 gate; + +if (pipe >=NFC_HCI_MAX_PIPES ) { +pr_err ("Discarded event %x to invalid pipe %x\n" , event, pipe); + goto exit; + } + gate = hdev->pipes[pipe].gate;if (gate ==NFC_HCI_INVALID_GATE ) {pr_err ("Discarded event %x to unopened pipe %x\n" , event, pipe); goto exit;
Greg Kroah-Hartman
maintainerPATCH 11/99 net/packet: tpacket_rcv: do not increment ring index on drop
In reply to Greg Kroah-HartmanFrom: Willem de Bruijn <[email protected]>
[ Upstream commit 46e4c421a053c36bf7a33dda2272481bcaf3eed3 ]
In one error case, tpacket_rcv drops packets after incrementing the ring producer index.
If this happens, it does not update tp_status to TP_STATUS_USER and thus the reader is stalled for an iteration of the ring, causing out of order arrival.
The only such error path is when virtio_net_hdr_from_skb fails due to encountering an unknown GSO type.
--- net/packet/af_packet.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
net/packet/af_packet.c +7 -6
@@ -2299,6 +2299,13 @@ static int tpacket_rcv(struct sk_buff *s TP_STATUS_KERNEL, (macoff+snaplen));if (!h.raw) goto drop_n_account; + +if (do_vnet && +virtio_net_hdr_from_skb (skb, h.raw + macoff - +sizeof (struct virtio_net_hdr ), +vio_le (), true,0 )) + goto drop_n_account; +if (po->tp_version <=TPACKET_V2 ) {packet_increment_rx_head (po, &po->rx_ring);/*
@@ -2311,12 +2318,6 @@ static int tpacket_rcv(struct sk_buff *s status |=TP_STATUS_LOSING ; } -if (do_vnet && -virtio_net_hdr_from_skb (skb, h.raw + macoff - -sizeof (struct virtio_net_hdr ), -vio_le (), true,0 )) - goto drop_n_account; - po->stats.stats1.tp_packets++;if (copy_skb) { status |=TP_STATUS_COPY ;
Greg Kroah-Hartman
maintainerPATCH 12/99 r8152: check disconnect status after long sleep
In reply to Greg Kroah-HartmanFrom: You-Sheng Yang <[email protected]>
[ Upstream commit d64c7a08034b32c285e576208ae44fc3ba3fa7df ]
Dell USB Type C docking WD19/WD19DC attaches additional peripherals as:
/: Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/6p, 5000M
|__ Port 1: Dev 11, If 0, Class=Hub, Driver=hub/4p, 5000M
|__ Port 3: Dev 12, If 0, Class=Hub, Driver=hub/4p, 5000M
|__ Port 4: Dev 13, If 0, Class=Vendor Specific Class,
Driver=r8152, 5000Mwhere usb 2-1-3 is a hub connecting all USB Type-A/C ports on the dock.
When hotplugging such dock with additional usb devices already attached on it, the probing process may reset usb 2.1 port, therefore r8152 ethernet device is also reset. However, during r8152 device init there are several for-loops that, when it's unable to retrieve hardware registers due to being disconnected from USB, may take up to 14 seconds each in practice, and that has to be completed before USB may re-enumerate devices on the bus. As a result, devices attached to the dock will only be available after nearly 1 minute after the dock was plugged in:
[ 216.388290] [250] r8152 2-1.4:1.0: usb_probe_interface [ 216.388292] [250] r8152 2-1.4:1.0: usb_probe_interface - got id [ 258.830410] r8152 2-1.4:1.0 (unnamed net_device) (uninitialized): PHY not ready [ 258.830460] r8152 2-1.4:1.0 (unnamed net_device) (uninitialized): Invalid header when reading pass-thru MAC addr [ 258.830464] r8152 2-1.4:1.0 (unnamed net_device) (uninitialized): Get ether addr fail
This happens in, for example, r8153_init:
static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size,
void *data, u16 type)
{
if (test_bit(RTL8152_UNPLUG, &tp->flags))
return -ENODEV;
...}
static u16 ocp_read_word(struct r8152 *tp, u16 type, u16 index)
{
u32 data;
...
generic_ocp_read(tp, index, sizeof(tmp), &tmp, type | byen); data = __le32_to_cpu(tmp);
...
return (u16)data;}
static void r8153_init(struct r8152 *tp)
{
...
if (test_bit(RTL8152_UNPLUG, &tp->flags))
return; for (i = 0; i < 500; i++) {
if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) &
AUTOLOAD_DONE)
break;
msleep(20);
}
...}
Since ocp_read_word() doesn't check the return status of generic_ocp_read(), and the only exit condition for the loop is to have a match in the returned value, such loops will only ends after exceeding its maximum runs when the device has been marked as disconnected, which takes 500 * 20ms = 10 seconds in theory, 14 in practice.
To solve this long latency another test to RTL8152_UNPLUG flag should be added after those 20ms sleep to skip unnecessary loops, so that the device probe can complete early and proceed to parent port reset/reprobe process.
This can be reproduced on all kernel versions up to latest v5.6-rc2, but after v5.5-rc7 the reproduce rate is dramatically lowered to 1/30 or less while it was around 1/2.
--- drivers/net/usb/r8152.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/usb/r8152.c +8 -0
@@ -2696,6 +2696,8 @@ static u16 r8153_phy_status(struct r8152 }msleep (20 ); +if (test_bit (RTL8152_UNPLUG , &tp->flags)) +break ; }return data;
@@ -4055,7 +4057,10 @@ static void r8153_init(struct r8152 *tp)if (ocp_read_word (tp,MCU_TYPE_PLA ,PLA_BOOT_CTRL ) &AUTOLOAD_DONE )break ; +msleep (20 ); +if (test_bit (RTL8152_UNPLUG , &tp->flags)) +break ; } data =r8153_phy_status (tp,0 );
@@ -4170,7 +4175,10 @@ static void r8153b_init(struct r8152 *tpif (ocp_read_word (tp,MCU_TYPE_PLA ,PLA_BOOT_CTRL ) &AUTOLOAD_DONE )break ; +msleep (20 ); +if (test_bit (RTL8152_UNPLUG , &tp->flags)) +break ; } data =r8153_phy_status (tp,0 );
Greg Kroah-Hartman
maintainerPATCH 13/99 sfc: detach from cb_page in efx_copy_channel()
In reply to Greg Kroah-HartmanFrom: Edward Cree <[email protected]>
[ Upstream commit 4b1bd9db078f7d5332c8601a2f5bd43cf0458fd4 ]
It's a resource, not a parameter, so we can't copy it into the new
channel's TX queues, otherwise aliasing will lead to resource- management bugs if the channel is subsequently torn down without being initialised.
Before the Fixes:-tagged commit there was a similar bug with
tsoh_page, but I'm not sure it's worth doing another fix for such old kernels.
--- drivers/net/ethernet/sfc/efx.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/sfc/efx.c +1 -0
@@ -505,6 +505,7 @@ efx_copy_channel(const struct efx_channeif (tx_queue->channel) tx_queue->channel = channel; tx_queue->buffer =NULL ; + tx_queue->cb_page =NULL ;memset (&tx_queue->txd,0 ,sizeof (tx_queue->txd)); }
Greg Kroah-Hartman
maintainerPATCH 14/99 bnxt_en: reinitialize IRQs when MTU is modified
In reply to Greg Kroah-HartmanFrom: Vasundhara Volam <[email protected]>
[ Upstream commit a9b952d267e59a3b405e644930f46d252cea7122 ]
MTU changes may affect the number of IRQs so we must call bnxt_close_nic()/bnxt_open_nic() with the irq_re_init parameter set to true. The reason is that a larger MTU may require aggregation rings not needed with smaller MTU. We may not be able to allocate the required number of aggregation rings and so we reduce the number of channels which will change the number of IRQs. Without this patch, it may crash eventually in pci_disable_msix() when the IRQs are not properly unwound.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -2
@@ -7310,13 +7310,13 @@ static int bnxt_change_mtu(struct net_destruct bnxt *bp =netdev_priv (dev);if (netif_running (dev)) -bnxt_close_nic (bp, false, false); +bnxt_close_nic (bp, true, false); dev->mtu = new_mtu;bnxt_set_ring_params (bp);if (netif_running (dev)) -return bnxt_open_nic (bp, false, false); +return bnxt_open_nic (bp, true, false);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 15/99 cgroup: memcg: net: do not associate sock with unrelated cgroup
In reply to Greg Kroah-HartmanFrom: Shakeel Butt <[email protected]>
[ Upstream commit e876ecc67db80dfdb8e237f71e5b43bb88ae549c ]
We are testing network memory accounting in our setup and noticed inconsistent network memory usage and often unrelated cgroups network usage correlates with testing workload. On further inspection, it seems like mem_cgroup_sk_alloc() and cgroup_sk_alloc() are broken in irq context specially for cgroup v1.
mem_cgroup_sk_alloc() and cgroup_sk_alloc() can be called in irq context and kind of assumes that this can only happen from sk_clone_lock() and the source sock object has already associated cgroup. However in cgroup v1, where network memory accounting is opt-in, the source sock can be unassociated with any cgroup and the new cloned sock can get associated with unrelated interrupted cgroup.
Cgroup v2 can also suffer if the source sock object was created by process in the root cgroup or if sk_alloc() is called in irq context. The fix is to just do nothing in interrupt.
WARNING: Please note that about half of the TCP sockets are allocated from the IRQ context, so, memory used by such sockets will not be accouted by the memcg.
The stack trace of mem_cgroup_sk_alloc() from IRQ-context:
CPU: 70 PID: 12720 Comm: ssh Tainted: 5.6.0-smp-DEV #1 Hardware name: ... Call Trace: <IRQ> dump_stack+0x57/0x75 mem_cgroup_sk_alloc+0xe9/0xf0 sk_clone_lock+0x2a7/0x420 inet_csk_clone_lock+0x1b/0x110 tcp_create_openreq_child+0x23/0x3b0 tcp_v6_syn_recv_sock+0x88/0x730 tcp_check_req+0x429/0x560 tcp_v6_rcv+0x72d/0xa40 ip6_protocol_deliver_rcu+0xc9/0x400 ip6_input+0x44/0xd0 ? ip6_protocol_deliver_rcu+0x400/0x400 ip6_rcv_finish+0x71/0x80 ipv6_rcv+0x5b/0xe0 ? ip6_sublist_rcv+0x2e0/0x2e0 process_backlog+0x108/0x1e0 net_rx_action+0x26b/0x460 __do_softirq+0x104/0x2a6 do_softirq_own_stack+0x2a/0x40 </IRQ> do_softirq.part.19+0x40/0x50 __local_bh_enable_ip+0x51/0x60 ip6_finish_output2+0x23d/0x520 ? ip6table_mangle_hook+0x55/0x160 __ip6_finish_output+0xa1/0x100 ip6_finish_output+0x30/0xd0 ip6_output+0x73/0x120 ? __ip6_finish_output+0x100/0x100 ip6_xmit+0x2e3/0x600 ? ipv6_anycast_cleanup+0x50/0x50 ? inet6_csk_route_socket+0x136/0x1e0 ? skb_free_head+0x1e/0x30 inet6_csk_xmit+0x95/0xf0 __tcp_transmit_skb+0x5b4/0xb20 __tcp_send_ack.part.60+0xa3/0x110 tcp_send_ack+0x1d/0x20 tcp_rcv_state_process+0xe64/0xe80 ? tcp_v6_connect+0x5d1/0x5f0 tcp_v6_do_rcv+0x1b1/0x3f0 ? tcp_v6_do_rcv+0x1b1/0x3f0 __release_sock+0x7f/0xd0 release_sock+0x30/0xa0 __inet_stream_connect+0x1c3/0x3b0 ? prepare_to_wait+0xb0/0xb0 inet_stream_connect+0x3b/0x60 __sys_connect+0x101/0x120 ? __sys_getsockopt+0x11b/0x140 __x64_sys_connect+0x1a/0x20 do_syscall_64+0x51/0x200 entry_SYSCALL_64_after_hwframe+0x44/0xa9
The stack trace of mem_cgroup_sk_alloc() from IRQ-context:
--- kernel/cgroup/cgroup.c | 4 ++++ mm/memcontrol.c | 4 ++++ 2 files changed, 8 insertions(+)
kernel/cgroup/cgroup.c +4 -0
@@ -5799,6 +5799,10 @@ void cgroup_sk_alloc(struct sock_cgroup_return ; } +/* Don't associate the sock with unrelated interrupted task's cgroup. */ +if (in_interrupt ()) +return ; +rcu_read_lock ();while (true) {
mm/memcontrol.c +4 -0
@@ -5881,6 +5881,10 @@ void mem_cgroup_sk_alloc(struct sock *skreturn ; } +/* Do not associate the sock with unrelated interrupted task's memcg. */ +if (in_interrupt ()) +return ; +rcu_read_lock (); memcg =mem_cgroup_from_task (current);if (memcg == root_mem_cgroup)
Greg Kroah-Hartman
maintainerPATCH 16/99 net: memcg: late association of sock to memcg
In reply to Greg Kroah-HartmanFrom: Shakeel Butt <[email protected]>
[ Upstream commit d752a4986532cb6305dfd5290a614cde8072769d ]
If a TCP socket is allocated in IRQ context or cloned from unassociated (i.e. not associated to a memcg) in IRQ context then it will remain unassociated for its whole life. Almost half of the TCPs created on the system are created in IRQ context, so, memory used by such sockets will not be accounted by the memcg.
This issue is more widespread in cgroup v1 where network memory accounting is opt-in but it can happen in cgroup v2 if the source socket for the cloning was created in root memcg.
To fix the issue, just do the association of the sockets at the accept() time in the process context and then force charge the memory buffer already used and reserved by the socket.
--- mm/memcontrol.c | 14 -------------- net/core/sock.c | 5 ++++- net/ipv4/inet_connection_sock.c | 20 ++++++++++++++++++++ 3 files changed, 24 insertions(+), 15 deletions(-)
mm/memcontrol.c +0 -14
@@ -5867,20 +5867,6 @@ void mem_cgroup_sk_alloc(struct sock *skif (!mem_cgroup_sockets_enabled)return ; -/* -* Socket cloning can throw us here with sk_memcg already -* filled. It won't however, necessarily happen from -* process context. So the test for root memcg given -* the current task's memcg won't help us in this case. -* -* Respecting the original socket's memcg is a better -* decision in this case. -*/ -if (sk->sk_memcg) { -css_get (&sk->sk_memcg->css); -return ; - } -/* Do not associate the sock with unrelated interrupted task's memcg. */ if (in_interrupt ())return ;
net/core/sock.c +4 -1
@@ -1684,7 +1684,10 @@ struct sock *sk_clone_lock(const structatomic_set (&newsk->sk_zckey,0 );sock_reset_flag (newsk,SOCK_DONE ); -mem_cgroup_sk_alloc (newsk); + +/* sk->sk_memcg will be populated at accept() time */ + newsk->sk_memcg =NULL ; +cgroup_sk_alloc (&newsk->sk_cgrp_data);rcu_read_lock ();
net/ipv4/inet_connection_sock.c +20 -0
@@ -475,6 +475,26 @@ struct sock *inet_csk_accept(struct sock }spin_unlock_bh (&queue->fastopenq.lock); } + +if (mem_cgroup_sockets_enabled) { +int amt; + +/* atomically get the memory usage, set and charge the +* sk->sk_memcg. +*/ +lock_sock (newsk); + +/* The sk has not been accepted yet, no need to look at +* sk->sk_wmem_queued. +*/ + amt =sk_mem_pages (newsk->sk_forward_alloc + +atomic_read (&sk->sk_rmem_alloc)); +mem_cgroup_sk_alloc (newsk); +if (newsk->sk_memcg && amt) +mem_cgroup_charge_skmem (newsk->sk_memcg, amt); + +release_sock (newsk); + } out:release_sock (sk);if (req)
Greg Kroah-Hartman
maintainerPATCH 17/99 net: memcg: fix lockdep splat in inet_csk_accept()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 06669ea346e476a5339033d77ef175566a40efbb upstream.
Locking newsk while still holding the listener lock triggered a lockdep splat [1]
We can simply move the memcg code after we release the listener lock, as this can also help if multiple threads are sharing a common listener.
Also fix a typo while reading socket sk_rmem_alloc.
[1]
WARNING: possible recursive locking detected
5.6.0-rc3-syzkaller #0 Not tainted
--------------------------------------------
syz-executor598/9524 is trying to acquire lock:ffff88808b5b8b90 (sk_lock-AF_INET6){+.+.}, at: lock_sock include/net/sock.h:1541 [inline] ffff88808b5b8b90 (sk_lock-AF_INET6){+.+.}, at: inet_csk_accept+0x69f/0xd30 net/ipv4/inet_connection_sock.c:492
but task is already holding lock:ffff88808b5b9590 (sk_lock-AF_INET6){+.+.}, at: lock_sock include/net/sock.h:1541 [inline] ffff88808b5b9590 (sk_lock-AF_INET6){+.+.}, at: inet_csk_accept+0x8d/0xd30 net/ipv4/inet_connection_sock.c:445
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(sk_lock-AF_INET6);
lock(sk_lock-AF_INET6);
*** DEADLOCK ***
May be due to missing lock nesting notation
1 lock held by syz-executor598/9524:
#0: ffff88808b5b9590 (sk_lock-AF_INET6){+.+.}, at: lock_sock include/net/sock.h:1541 [inline] #0: ffff88808b5b9590 (sk_lock-AF_INET6){+.+.}, at: inet_csk_accept+0x8d/0xd30 net/ipv4/inet_connection_sock.c:445
stack backtrace: CPU: 0 PID: 9524 Comm: syz-executor598 Not tainted 5.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_deadlock_bug kernel/locking/lockdep.c:2370 [inline] check_deadlock kernel/locking/lockdep.c:2411 [inline] validate_chain kernel/locking/lockdep.c:2954 [inline] __lock_acquire.cold+0x114/0x288 kernel/locking/lockdep.c:3954 lock_acquire+0x197/0x420 kernel/locking/lockdep.c:4484 lock_sock_nested+0xc5/0x110 net/core/sock.c:2947 lock_sock include/net/sock.h:1541 [inline] inet_csk_accept+0x69f/0xd30 net/ipv4/inet_connection_sock.c:492 inet_accept+0xe9/0x7c0 net/ipv4/af_inet.c:734 __sys_accept4_file+0x3ac/0x5b0 net/socket.c:1758 __sys_accept4+0x53/0x90 net/socket.c:1809 __do_sys_accept4 net/socket.c:1821 [inline] __se_sys_accept4 net/socket.c:1818 [inline] __x64_sys_accept4+0x93/0xf0 net/socket.c:1818 do_syscall_64+0xf6/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4445c9 Code: e8 0c 0d 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffc35b37608 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004445c9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000306777 R09: 0000000000306777 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00000000004053d0 R14: 0000000000000000 R15: 0000000000000000
--- net/ipv4/inet_connection_sock.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
net/ipv4/inet_connection_sock.c +7 -7
@@ -476,27 +476,27 @@ struct sock *inet_csk_accept(struct sockspin_unlock_bh (&queue->fastopenq.lock); } -if (mem_cgroup_sockets_enabled) { +out: +release_sock (sk); +if (newsk && mem_cgroup_sockets_enabled) {int amt;/* atomically get the memory usage, set and charge the -* sk->sk_memcg. +* newsk->sk_memcg. */ lock_sock (newsk); -/* The sk has not been accepted yet, no need to look at -* sk->sk_wmem_queued. +/* The socket has not been accepted yet, no need to look at +* newsk->sk_wmem_queued. */ amt =sk_mem_pages (newsk->sk_forward_alloc + -atomic_read (&sk->sk_rmem_alloc)); +atomic_read (&newsk->sk_rmem_alloc));mem_cgroup_sk_alloc (newsk);if (newsk->sk_memcg && amt)mem_cgroup_charge_skmem (newsk->sk_memcg, amt);release_sock (newsk); } -out: -release_sock (sk);if (req)reqsk_put (req);return newsk;
Greg Kroah-Hartman
maintainerPATCH 18/99 fib: add missing attribute validation for tun_id
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit 4c16d64ea04056f1b1b324ab6916019f6a064114 ]
Add missing netlink policy entry for FRA_TUN_ID.
--- include/net/fib_rules.h | 1 + 1 file changed, 1 insertion(+)
include/net/fib_rules.h +1 -0
@@ -102,6 +102,7 @@ struct fib_rule_notifier_info { [FRA_OIFNAME] = { .type = NLA_STRING, .len = IFNAMSIZ - 1 }, \ [FRA_PRIORITY] = { .type = NLA_U32 }, \ [FRA_FWMARK] = { .type = NLA_U32 }, \ + [FRA_TUN_ID] = { .type = NLA_U64 }, \ [FRA_FWMASK] = { .type = NLA_U32 }, \ [FRA_TABLE] = { .type = NLA_U32 }, \ [FRA_SUPPRESS_PREFIXLEN] = { .type = NLA_U32 }, \
Greg Kroah-Hartman
maintainerPATCH 19/99 nl802154: add missing attribute validation
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit 9322cd7c4af2ccc7fe7c5f01adb53f4f77949e92 ]
Add missing attribute validation for several u8 types.
--- net/ieee802154/nl_policy.c | 5 +++++ 1 file changed, 5 insertions(+)
net/ieee802154/nl_policy.c +5 -0
@@ -30,6 +30,11 @@ const struct nla_policy ieee802154_polic [IEEE802154_ATTR_HW_ADDR] = { .type = NLA_HW_ADDR, }, [IEEE802154_ATTR_PAN_ID] = { .type = NLA_U16, }, [IEEE802154_ATTR_CHANNEL] = { .type = NLA_U8, }, + [IEEE802154_ATTR_BCN_ORD] = { .type = NLA_U8, }, + [IEEE802154_ATTR_SF_ORD] = { .type = NLA_U8, }, + [IEEE802154_ATTR_PAN_COORD] = { .type = NLA_U8, }, + [IEEE802154_ATTR_BAT_EXT] = { .type = NLA_U8, }, + [IEEE802154_ATTR_COORD_REALIGN] = { .type = NLA_U8, }, [IEEE802154_ATTR_PAGE] = { .type = NLA_U8, }, [IEEE802154_ATTR_COORD_SHORT_ADDR] = { .type = NLA_U16, }, [IEEE802154_ATTR_COORD_HW_ADDR] = { .type = NLA_HW_ADDR, },
Greg Kroah-Hartman
maintainerPATCH 20/99 nl802154: add missing attribute validation for dev_type
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit b60673c4c418bef7550d02faf53c34fbfeb366bf ]
Add missing attribute type validation for IEEE802154_ATTR_DEV_TYPE to the netlink policy.
--- net/ieee802154/nl_policy.c | 1 + 1 file changed, 1 insertion(+)
net/ieee802154/nl_policy.c +1 -0
@@ -36,6 +36,7 @@ const struct nla_policy ieee802154_polic [IEEE802154_ATTR_BAT_EXT] = { .type = NLA_U8, }, [IEEE802154_ATTR_COORD_REALIGN] = { .type = NLA_U8, }, [IEEE802154_ATTR_PAGE] = { .type = NLA_U8, }, + [IEEE802154_ATTR_DEV_TYPE] = { .type = NLA_U8, }, [IEEE802154_ATTR_COORD_SHORT_ADDR] = { .type = NLA_U16, }, [IEEE802154_ATTR_COORD_HW_ADDR] = { .type = NLA_HW_ADDR, }, [IEEE802154_ATTR_COORD_PAN_ID] = { .type = NLA_U16, },
Greg Kroah-Hartman
maintainerPATCH 21/99 can: add missing attribute validation for termination
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit ab02ad660586b94f5d08912a3952b939cf4c4430 ]
Add missing attribute validation for IFLA_CAN_TERMINATION to the netlink policy.
--- drivers/net/can/dev.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/can/dev.c +1 -0
@@ -867,6 +867,7 @@ static const struct nla_policy can_polic = { .len = sizeof(struct can_bittiming) }, [IFLA_CAN_DATA_BITTIMING_CONST ] = { .len = sizeof(struct can_bittiming_const) }, + [IFLA_CAN_TERMINATION] = { .type = NLA_U16 }, }; static int can_validate(struct nlattr *tb[], struct nlattr *data[],
Greg Kroah-Hartman
maintainerPATCH 22/99 macsec: add missing attribute validation for port
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit 31d9a1c524964bac77b7f9d0a1ac140dc6b57461 ]
Add missing attribute validation for IFLA_MACSEC_PORT to the netlink policy.
--- drivers/net/macsec.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/macsec.c +1 -0
@@ -2980,6 +2980,7 @@ static const struct device_type macsec_tstatic const struct nla_policy macsec_rtnl_policy[IFLA_MACSEC_MAX +1 ] = { [IFLA_MACSEC_SCI ] = { .type =NLA_U64 }, + [IFLA_MACSEC_PORT ] = { .type =NLA_U16 }, [IFLA_MACSEC_ICV_LEN ] = { .type =NLA_U8 }, [IFLA_MACSEC_CIPHER_SUITE ] = { .type =NLA_U64 }, [IFLA_MACSEC_WINDOW ] = { .type =NLA_U32 },
Greg Kroah-Hartman
maintainerPATCH 23/99 net: fq: add missing attribute validation for orphan mask
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit 7e6dc03eeb023e18427a373522f1d247b916a641 ]
Add missing attribute validation for TCA_FQ_ORPHAN_MASK to the netlink policy.
--- net/sched/sch_fq.c | 1 + 1 file changed, 1 insertion(+)
net/sched/sch_fq.c +1 -0
@@ -695,6 +695,7 @@ static const struct nla_policy fq_policy [TCA_FQ_FLOW_MAX_RATE] = { .type = NLA_U32 }, [TCA_FQ_BUCKETS_LOG] = { .type = NLA_U32 }, [TCA_FQ_FLOW_REFILL_DELAY] = { .type = NLA_U32 }, + [TCA_FQ_ORPHAN_MASK] = { .type = NLA_U32 }, [TCA_FQ_LOW_RATE_THRESHOLD] = { .type = NLA_U32 }, };
Greg Kroah-Hartman
maintainerPATCH 24/99 team: add missing attribute validation for port ifindex
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit dd25cb272ccce4db67dc8509278229099e4f5e99 ]
Add missing attribute validation for TEAM_ATTR_OPTION_PORT_IFINDEX to the netlink policy.
--- drivers/net/team/team.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/team/team.c +1 -0
@@ -2207,6 +2207,7 @@ team_nl_option_policy[TEAM_ATTR_OPTION_M [TEAM_ATTR_OPTION_CHANGED] = { .type = NLA_FLAG }, [TEAM_ATTR_OPTION_TYPE] = { .type = NLA_U8 }, [TEAM_ATTR_OPTION_DATA] = { .type = NLA_BINARY }, + [TEAM_ATTR_OPTION_PORT_IFINDEX] = { .type = NLA_U32 }, };static int team_nl_cmd_noop (struct sk_buff *skb,struct genl_info *info)
Greg Kroah-Hartman
maintainerPATCH 25/99 team: add missing attribute validation for array index
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit 669fcd7795900cd1880237cbbb57a7db66cb9ac8 ]
Add missing attribute validation for TEAM_ATTR_OPTION_ARRAY_INDEX to the netlink policy.
--- drivers/net/team/team.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/team/team.c +1 -0
@@ -2208,6 +2208,7 @@ team_nl_option_policy[TEAM_ATTR_OPTION_M [TEAM_ATTR_OPTION_TYPE] = { .type = NLA_U8 }, [TEAM_ATTR_OPTION_DATA] = { .type = NLA_BINARY }, [TEAM_ATTR_OPTION_PORT_IFINDEX] = { .type = NLA_U32 }, + [TEAM_ATTR_OPTION_ARRAY_INDEX] = { .type = NLA_U32 }, };static int team_nl_cmd_noop (struct sk_buff *skb,struct genl_info *info)
Greg Kroah-Hartman
maintainerPATCH 26/99 nfc: add missing attribute validation for SE API
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit 361d23e41ca6e504033f7e66a03b95788377caae ]
Add missing attribute validation for NFC_ATTR_SE_INDEX to the netlink policy.
--- net/nfc/netlink.c | 1 + 1 file changed, 1 insertion(+)
net/nfc/netlink.c +1 -0
@@ -55,6 +55,7 @@ static const struct nla_policy nfc_genl_ [NFC_ATTR_LLC_SDP] = { .type = NLA_NESTED }, [NFC_ATTR_FIRMWARE_NAME] = { .type = NLA_STRING, .len = NFC_FIRMWARE_NAME_MAXSIZE }, + [NFC_ATTR_SE_INDEX] = { .type = NLA_U32 }, [NFC_ATTR_SE_APDU] = { .type = NLA_BINARY }, [NFC_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
Greg Kroah-Hartman
maintainerPATCH 27/99 nfc: add missing attribute validation for vendor subcommand
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit 6ba3da446551f2150fadbf8c7788edcb977683d3 ]
Add missing attribute validation for vendor subcommand attributes to the netlink policy.
--- net/nfc/netlink.c | 2 ++ 1 file changed, 2 insertions(+)
net/nfc/netlink.c +2 -0
@@ -57,6 +57,8 @@ static const struct nla_policy nfc_genl_ .len = NFC_FIRMWARE_NAME_MAXSIZE }, [NFC_ATTR_SE_INDEX] = { .type = NLA_U32 }, [NFC_ATTR_SE_APDU] = { .type = NLA_BINARY }, + [NFC_ATTR_VENDOR_ID] = { .type = NLA_U32 }, + [NFC_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, [NFC_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, };
Greg Kroah-Hartman
maintainerPATCH 28/99 net: phy: fix MDIO bus PM PHY resuming
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit 611d779af7cad2b87487ff58e4931a90c20b113c ]
So far we have the unfortunate situation that mdio_bus_phy_may_suspend() is called in suspend AND resume path, assuming that function result is the same. After the original change this is no longer the case, resulting in broken resume as reported by Geert.
To fix this call mdio_bus_phy_may_suspend() in the suspend path only, and let the phy_device store the info whether it was suspended by MDIO bus PM.
--- drivers/net/phy/phy_device.c | 6 +++++- include/linux/phy.h | 2 ++ 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/net/phy/phy_device.c +5 -1
@@ -125,6 +125,8 @@ static int mdio_bus_phy_suspend(struct dif (!mdio_bus_phy_may_suspend (phydev))return 0 ; + phydev->suspended_by_mdio_bus = true; +return phy_suspend (phydev); }
@@ -133,9 +135,11 @@ static int mdio_bus_phy_resume(struct destruct phy_device *phydev =to_phy_device (dev);int ret; -if (!mdio_bus_phy_may_suspend (phydev)) +if (!phydev->suspended_by_mdio_bus) goto no_resume; + phydev->suspended_by_mdio_bus = false; + ret =phy_resume (phydev);if (ret <0 )return ret;
include/linux/phy.h +2 -0
@@ -372,6 +372,7 @@ struct phy_c45_device_ids {* is_pseudo_fixed_link: Set to true if this phy is an Ethernet switch, etc. * has_fixups: Set to true if this phy has fixups/quirks. * suspended: Set to true if this phy has been suspended successfully. +* suspended_by_mdio_bus: Set to true if this phy was suspended by MDIO bus. * sysfs_links: Internal boolean tracking sysfs symbolic links setup/removal. * loopback_enabled: Set true if this phy has been loopbacked successfully. * state: state of the PHY for management purposes
@@ -410,6 +411,7 @@ struct phy_device {bool is_pseudo_fixed_link;bool has_fixups;bool suspended; +bool suspended_by_mdio_bus;bool sysfs_links;bool loopback_enabled;
Greg Kroah-Hartman
maintainerPATCH 29/99 bonding/alb: make sure arp header is pulled before accessing it
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit b7469e83d2add567e4e0b063963db185f3167cea upstream.
Similar to commit 38f88c454042 ("bonding/alb: properly access headers in bond_alb_xmit()"), we need to make sure arp header was pulled in skb->head before blindly accessing it in rlb_arp_xmit().
Remove arp_pkt() private helper, since it is more readable/obvious to have the following construct back to back :
if (!pskb_network_may_pull(skb, sizeof(*arp))) return NULL; arp = (struct arp_pkt *)skb_network_header(skb);
syzbot reported :
BUG: KMSAN: uninit-value in bond_slave_has_mac_rx include/net/bonding.h:704 [inline] BUG: KMSAN: uninit-value in rlb_arp_xmit drivers/net/bonding/bond_alb.c:662 [inline] BUG: KMSAN: uninit-value in bond_alb_xmit+0x575/0x25e0 drivers/net/bonding/bond_alb.c:1477 CPU: 0 PID: 12743 Comm: syz-executor.4 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 bond_slave_has_mac_rx include/net/bonding.h:704 [inline] rlb_arp_xmit drivers/net/bonding/bond_alb.c:662 [inline] bond_alb_xmit+0x575/0x25e0 drivers/net/bonding/bond_alb.c:1477 __bond_start_xmit drivers/net/bonding/bond_main.c:4257 [inline] bond_start_xmit+0x85d/0x2f70 drivers/net/bonding/bond_main.c:4282 __netdev_start_xmit include/linux/netdevice.h:4524 [inline] netdev_start_xmit include/linux/netdevice.h:4538 [inline] xmit_one net/core/dev.c:3470 [inline] dev_hard_start_xmit+0x531/0xab0 net/core/dev.c:3486 __dev_queue_xmit+0x37de/0x4220 net/core/dev.c:4063 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4096 packet_snd net/packet/af_packet.c:2967 [inline] packet_sendmsg+0x8347/0x93b0 net/packet/af_packet.c:2992 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg net/socket.c:672 [inline] __sys_sendto+0xc1b/0xc50 net/socket.c:1998 __do_sys_sendto net/socket.c:2010 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:2006 __x64_sys_sendto+0x6e/0x90 net/socket.c:2006 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45c479 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fc77ffbbc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fc77ffbc6d4 RCX: 000000000045c479 RDX: 000000000000000e RSI: 00000000200004c0 RDI: 0000000000000003 RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000a04 R14: 00000000004cc7b0 R15: 000000000076bf2c
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82 slab_alloc_node mm/slub.c:2793 [inline] __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4401 __kmalloc_reserve net/core/skbuff.c:142 [inline] __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:210 alloc_skb include/linux/skbuff.h:1051 [inline] alloc_skb_with_frags+0x18c/0xa70 net/core/skbuff.c:5766 sock_alloc_send_pskb+0xada/0xc60 net/core/sock.c:2242 packet_alloc_skb net/packet/af_packet.c:2815 [inline] packet_snd net/packet/af_packet.c:2910 [inline] packet_sendmsg+0x66a0/0x93b0 net/packet/af_packet.c:2992 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg net/socket.c:672 [inline] __sys_sendto+0xc1b/0xc50 net/socket.c:1998 __do_sys_sendto net/socket.c:2010 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:2006 __x64_sys_sendto+0x6e/0x90 net/socket.c:2006 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- drivers/net/bonding/bond_alb.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/net/bonding/bond_alb.c +10 -10
@@ -71,11 +71,6 @@ struct arp_pkt { };#pragma pack() -static inline struct arp_pkt *arp_pkt (const struct sk_buff *skb) -{ -return (struct arp_pkt *)skb_network_header (skb); -} -/* Forward declaration */ static void alb_send_learning_packets (struct slave *slave,u8 mac_addr[],bool strict_match);
@@ -574,10 +569,11 @@ static void rlb_req_update_subnet_clientspin_unlock (&bond->mode_lock); } -static struct slave *rlb_choose_channel (struct sk_buff *skb,struct bonding *bond) +static struct slave *rlb_choose_channel (struct sk_buff *skb, +struct bonding *bond, +const struct arp_pkt *arp) {struct alb_bond_info *bond_info = &(BOND_ALB_INFO (bond)); -struct arp_pkt *arp =arp_pkt (skb);struct slave *assigned_slave, *curr_active_slave;struct rlb_client_info *client_info;u32 hash_index =0 ;
@@ -674,8 +670,12 @@ static struct slave *rlb_choose_channel(*/ static struct slave *rlb_arp_xmit (struct sk_buff *skb,struct bonding *bond) { -struct arp_pkt *arp =arp_pkt (skb);struct slave *tx_slave =NULL ; +struct arp_pkt *arp; + +if (!pskb_network_may_pull (skb,sizeof (*arp))) +return NULL ; + arp = (struct arp_pkt *)skb_network_header (skb);/* Don't modify or load balance ARPs that do not originate locally * (e.g.,arrive via a bridge).
@@ -685,7 +685,7 @@ static struct slave *rlb_arp_xmit(structif (arp->op_code ==htons (ARPOP_REPLY )) {/* the arp must be sent on the selected rx channel */ - tx_slave =rlb_choose_channel (skb, bond); + tx_slave =rlb_choose_channel (skb, bond, arp);if (tx_slave)bond_hw_addr_copy (arp->mac_src, tx_slave->dev->dev_addr, tx_slave->dev->addr_len);
@@ -696,7 +696,7 @@ static struct slave *rlb_arp_xmit(struct* When the arp reply is received the entry will be updated * with the correct unicast address of the client. */ -rlb_choose_channel (skb, bond); +rlb_choose_channel (skb, bond, arp);/* The ARP reply packets must be delayed so that * they can cancel out the influence of the ARP request.
Greg Kroah-Hartman
maintainerPATCH 30/99 slip: make slhc_compress() more robust against malicious packets
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 110a40dfb708fe940a3f3704d470e431c368d256 ]
Before accessing various fields in IPV4 network header and TCP header, make sure the packet :
- Has IP version 4 (ip->version == 4)
- Has not a silly network length (ip->ihl >= 5)
- Is big enough to hold network and transport headers
- Has not a silly TCP header size (th->doff >= sizeof(struct tcphdr) / 4)
syzbot reported :
BUG: KMSAN: uninit-value in slhc_compress+0x5b9/0x2e60 drivers/net/slip/slhc.c:270 CPU: 0 PID: 11728 Comm: syz-executor231 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 slhc_compress+0x5b9/0x2e60 drivers/net/slip/slhc.c:270 ppp_send_frame drivers/net/ppp/ppp_generic.c:1637 [inline] __ppp_xmit_process+0x1902/0x2970 drivers/net/ppp/ppp_generic.c:1495 ppp_xmit_process+0x147/0x2f0 drivers/net/ppp/ppp_generic.c:1516 ppp_write+0x6bb/0x790 drivers/net/ppp/ppp_generic.c:512 do_loop_readv_writev fs/read_write.c:717 [inline] do_iter_write+0x812/0xdc0 fs/read_write.c:1000 compat_writev+0x2df/0x5a0 fs/read_write.c:1351 do_compat_pwritev64 fs/read_write.c:1400 [inline] __do_compat_sys_pwritev fs/read_write.c:1420 [inline] __se_compat_sys_pwritev fs/read_write.c:1414 [inline] __ia32_compat_sys_pwritev+0x349/0x3f0 fs/read_write.c:1414 do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline] do_fast_syscall_32+0x3c7/0x6e0 arch/x86/entry/common.c:410 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7f7cd99 Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000ffdb84ac EFLAGS: 00000217 ORIG_RAX: 000000000000014e RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200001c0 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000040047459 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82 slab_alloc_node mm/slub.c:2793 [inline] __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4401 __kmalloc_reserve net/core/skbuff.c:142 [inline] __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:210 alloc_skb include/linux/skbuff.h:1051 [inline] ppp_write+0x115/0x790 drivers/net/ppp/ppp_generic.c:500 do_loop_readv_writev fs/read_write.c:717 [inline] do_iter_write+0x812/0xdc0 fs/read_write.c:1000 compat_writev+0x2df/0x5a0 fs/read_write.c:1351 do_compat_pwritev64 fs/read_write.c:1400 [inline] __do_compat_sys_pwritev fs/read_write.c:1420 [inline] __se_compat_sys_pwritev fs/read_write.c:1414 [inline] __ia32_compat_sys_pwritev+0x349/0x3f0 fs/read_write.c:1414 do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline] do_fast_syscall_32+0x3c7/0x6e0 arch/x86/entry/common.c:410 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139
--- drivers/net/slip/slhc.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/net/slip/slhc.c +10 -4
@@ -232,7 +232,7 @@ slhc_compress(struct slcompress *comp, u registerstruct cstate *cs = lcs->next; registerunsigned long deltaS, deltaA; registershort changes =0 ; -int hlen; +int nlen, hlen;unsigned char new_seq[16 ]; registerunsigned char *cp = new_seq;struct iphdr *ip;
@@ -248,6 +248,8 @@ slhc_compress(struct slcompress *comp, ureturn isize; ip = (struct iphdr *) icp; +if (ip->version !=4 || ip->ihl <5 ) +return isize;/* Bail if this packet isn't TCP, or is an IP fragment */ if (ip->protocol !=IPPROTO_TCP || (ntohs (ip->frag_off) &0x3fff )) {
@@ -258,10 +260,14 @@ slhc_compress(struct slcompress *comp, u comp->sls_o_tcp++;return isize; } -/* Extract TCP header */ + nlen = ip->ihl *4 ; +if (isize < nlen +sizeof (*th)) +return isize; - th = (struct tcphdr *)(((unsigned char *)ip) + ip->ihl*4 ); - hlen = ip->ihl*4 + th->doff*4 ; + th = (struct tcphdr *)(icp + nlen); +if (th->doff <sizeof (struct tcphdr ) /4 ) +return isize; + hlen = nlen + th->doff *4 ;/* Bail if the TCP packet isn't `compressible' (i.e., ACK isn't set or * some other control bit is set). Also uncompressible if
Greg Kroah-Hartman
maintainerPATCH 31/99 net: fec: validate the new settings in fec_enet_set_coalesce()
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit ab14961d10d02d20767612c78ce148f6eb85bd58 ]
fec_enet_set_coalesce() validates the previously set params and if they are within range proceeds to apply the new ones. The new ones, however, are not validated. This seems backwards, probably a copy-paste error?
Compile tested only.
--- drivers/net/ethernet/freescale/fec_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/freescale/fec_main.c +3 -3
@@ -2478,15 +2478,15 @@ fec_enet_set_coalesce(struct net_devicereturn -EINVAL ; } - cycle =fec_enet_us_to_itr_clock (ndev, fep->rx_time_itr); + cycle =fec_enet_us_to_itr_clock (ndev, ec->rx_coalesce_usecs);if (cycle >0xFFFF ) {pr_err ("Rx coalesced usec exceed hardware limitation\n" );return -EINVAL ; } - cycle =fec_enet_us_to_itr_clock (ndev, fep->tx_time_itr); + cycle =fec_enet_us_to_itr_clock (ndev, ec->tx_coalesce_usecs);if (cycle >0xFFFF ) { -pr_err ("Rx coalesced usec exceed hardware limitation\n" ); +pr_err ("Tx coalesced usec exceed hardware limitation\n" );return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 32/99 macvlan: add cond_resched() during multicast processing
In reply to Greg Kroah-HartmanFrom: Mahesh Bandewar <[email protected]>
[ Upstream commit ce9a4186f9ac475c415ffd20348176a4ea366670 ]
The Rx bound multicast packets are deferred to a workqueue and macvlan can also suffer from the same attack that was discovered by Syzbot for IPvlan. This solution is not as effective as in IPvlan. IPvlan defers all (Tx and Rx) multicast packet processing to a workqueue while macvlan does this way only for the Rx. This fix should address the Rx codition to certain extent.
Tx is still suseptible. Tx multicast processing happens when .ndo_start_xmit is called, hence we cannot add cond_resched(). However, it's not that severe since the user which is generating
/ flooding will be affected the most.
--- drivers/net/macvlan.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/macvlan.c +2 -0
@@ -338,6 +338,8 @@ static void macvlan_process_broadcast(stif (src)dev_put (src->dev);kfree_skb (skb); + +cond_resched (); } }
Greg Kroah-Hartman
maintainerPATCH 33/99 inet_diag: return classid for all socket types
In reply to Greg Kroah-HartmanFrom: Dmitry Yakunin <[email protected]>
[ Upstream commit 83f73c5bb7b9a9135173f0ba2b1aa00c06664ff9 ]
In commit 1ec17dbd90f8 ("inet_diag: fix reporting cgroup classid and fallback to priority") croup classid reporting was fixed. But this works only for TCP sockets because for other socket types icsk parameter can be NULL and classid code path is skipped. This change moves classid handling to inet_diag_msg_attrs_fill() function.
Also inet_diag_msg_attrs_size() helper was added and addends in nlmsg_new() were reordered to save order from inet_sk_diag_fill().
--- include/linux/inet_diag.h | 18 ++++++++++++------ net/ipv4/inet_diag.c | 44 ++++++++++++++++++++------------------------ net/ipv4/raw_diag.c | 5 +++-- net/ipv4/udp_diag.c | 5 +++-- net/sctp/sctp_diag.c | 8 ++------ 5 files changed, 40 insertions(+), 40 deletions(-)
include/linux/inet_diag.h +12 -6
@@ -2,15 +2,10 @@ #ifndef _INET_DIAG_H_ #define _INET_DIAG_H_ 1 +#include <net/netlink.h> #include <uapi/linux/inet_diag.h> -struct net; -struct sock; struct inet_hashinfo; -struct nlattr; -struct nlmsghdr; -struct sk_buff; -struct netlink_callback; struct inet_diag_handler { void (*dump)(struct sk_buff *skb,
@@ -62,6 +57,17 @@ int inet_diag_bc_sk(const struct nlattrvoid inet_diag_msg_common_fill (struct inet_diag_msg *r,struct sock *sk); +static inline size_t inet_diag_msg_attrs_size (void ) +{ +return nla_total_size (1 )/* INET_DIAG_SHUTDOWN */ + + nla_total_size(1) /* INET_DIAG_TOS */ +#if IS_ENABLED (CONFIG_IPV6 ) + +nla_total_size (1 )/* INET_DIAG_TCLASS */ + + nla_total_size(1) /* INET_DIAG_SKV6ONLY */ +#endif + +nla_total_size (4 )/* INET_DIAG_MARK */ + +nla_total_size (4 );/* INET_DIAG_CLASS_ID */ +}int inet_diag_msg_attrs_fill (struct sock *sk,struct sk_buff *skb,struct inet_diag_msg *r,int ext,struct user_namespace *user_ns,bool net_admin);
net/ipv4/inet_diag.c +20 -24
63 lines not on this page · raw message
net/ipv4/raw_diag.c +3 -2
@@ -99,8 +99,9 @@ static int raw_diag_dump_one(struct sk_bif (IS_ERR (sk))return PTR_ERR (sk); - rep =nlmsg_new (sizeof (struct inet_diag_msg ) + -sizeof (struct inet_diag_meminfo ) +64 , + rep =nlmsg_new (nla_total_size (sizeof (struct inet_diag_msg )) + +inet_diag_msg_attrs_size () + +nla_total_size (sizeof (struct inet_diag_meminfo )) +64 ,GFP_KERNEL );if (!rep) {sock_put (sk);
net/ipv4/udp_diag.c +3 -2
@@ -67,8 +67,9 @@ static int udp_dump_one(struct udp_table goto out; err = -ENOMEM ; - rep =nlmsg_new (sizeof (struct inet_diag_msg ) + -sizeof (struct inet_diag_meminfo ) +64 , + rep =nlmsg_new (nla_total_size (sizeof (struct inet_diag_msg )) + +inet_diag_msg_attrs_size () + +nla_total_size (sizeof (struct inet_diag_meminfo )) +64 ,GFP_KERNEL );if (!rep) goto out;
net/sctp/sctp_diag.c +2 -6
@@ -221,15 +221,11 @@ static size_t inet_assoc_attr_size(struc addrcnt++;return nla_total_size (sizeof (struct sctp_info )) - +nla_total_size (1 )/* INET_DIAG_SHUTDOWN */ - +nla_total_size (1 )/* INET_DIAG_TOS */ - +nla_total_size (1 )/* INET_DIAG_TCLASS */ - +nla_total_size (4 )/* INET_DIAG_MARK */ - +nla_total_size (4 )/* INET_DIAG_CLASS_ID */ +nla_total_size (addrlen * asoc->peer.transport_count) +nla_total_size (addrlen * addrcnt) - +nla_total_size (sizeof (struct inet_diag_meminfo )) +nla_total_size (sizeof (struct inet_diag_msg )) + +inet_diag_msg_attrs_size () + +nla_total_size (sizeof (struct inet_diag_meminfo )) +64 ; }
Greg Kroah-Hartman
maintainerPATCH 34/99 ipvlan: do not add hardware address of master to its unicast filter list
In reply to Greg Kroah-HartmanFrom: Jiri Wiesner <[email protected]>
[ Upstream commit 63aae7b17344d4b08a7d05cb07044de4c0f9dcc6 ]
There is a problem when ipvlan slaves are created on a master device that is a vmxnet3 device (ipvlan in VMware guests). The vmxnet3 driver does not support unicast address filtering. When an ipvlan device is brought up in ipvlan_open(), the ipvlan driver calls dev_uc_add() to add the hardware address of the vmxnet3 master device to the unicast address list of the master device, phy_dev->uc. This inevitably leads to the vmxnet3 master device being forced into promiscuous mode by __dev_set_rx_mode().
Promiscuous mode is switched on the master despite the fact that there is still only one hardware address that the master device should use for filtering in order for the ipvlan device to be able to receive packets. The comment above struct net_device describes the uc_promisc member as a "counter, that indicates, that promiscuous mode has been enabled due to the need to listen to additional unicast addresses in a device that does not implement ndo_set_rx_mode()". Moreover, the design of ipvlan guarantees that only the hardware address of a master device, phy_dev->dev_addr, will be used to transmit and receive all packets from its ipvlan slaves. Thus, the unicast address list of the master device should not be modified by ipvlan_open() and ipvlan_stop() in order to make ipvlan a workable option on masters that do not support unicast address filtering.
--- drivers/net/ipvlan/ipvlan_main.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/ipvlan/ipvlan_main.c +1 -4
@@ -236,7 +236,6 @@ static void ipvlan_uninit(struct net_devstatic int ipvlan_open (struct net_device *dev) {struct ipvl_dev *ipvlan =netdev_priv (dev); -struct net_device *phy_dev = ipvlan->phy_dev;struct ipvl_addr *addr; if (ipvlan->port->mode == IPVLAN_MODE_L3 ||
@@ -248,7 +247,7 @@ static int ipvlan_open(struct net_devicelist_for_each_entry (addr, &ipvlan->addrs, anode)ipvlan_ht_addr_add (ipvlan, addr); -return dev_uc_add (phy_dev, phy_dev->dev_addr); +return 0 ; }static int ipvlan_stop (struct net_device *dev)
@@ -260,8 +259,6 @@ static int ipvlan_stop(struct net_devicedev_uc_unsync (phy_dev, dev);dev_mc_unsync (phy_dev, dev); -dev_uc_del (phy_dev, phy_dev->dev_addr); -list_for_each_entry (addr, &ipvlan->addrs, anode)ipvlan_ht_addr_del (addr);
Greg Kroah-Hartman
maintainerPATCH 35/99 ipvlan: egress mcast packets are not exceptional
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
commit cccc200fcaf04cff4342036a72e51d6adf6c98c1 upstream.
Currently, if IPv6 is enabled on top of an ipvlan device in l3 mode, the following warning message:
Dropped {multi|broad}cast of type= [86dd]
is emitted every time that a RS is generated and dmseg is soon filled with irrelevant messages. Replace pr_warn with pr_debug, to preserve debuggability, without scaring the sysadmin.
--- drivers/net/ipvlan/ipvlan_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ipvlan/ipvlan_core.c +2 -2
@@ -451,8 +451,8 @@ static int ipvlan_process_outbound(struc/* In this mode we dont care about multicast and broadcast traffic */ if (is_multicast_ether_addr (ethh->h_dest)) { -pr_warn_ratelimited ("Dropped {multi|broad}cast of type= [%x]\n" , -ntohs (skb->protocol)); +pr_debug_ratelimited ("Dropped {multi|broad}cast of type=[%x]\n" , +ntohs (skb->protocol));kfree_skb (skb); goto out; }
Greg Kroah-Hartman
maintainerPATCH 36/99 ipvlan: dont deref eth hdr before checking its set
In reply to Greg Kroah-HartmanFrom: Mahesh Bandewar <[email protected]>
[ Upstream commit ad8192767c9f9cf97da57b9ffcea70fb100febef ]
IPvlan in L3 mode discards outbound multicast packets but performs the check before ensuring the ether-header is set or not. This is an error that Eric found through code browsing.
--- drivers/net/ipvlan/ipvlan_core.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/net/ipvlan/ipvlan_core.c +10 -8
@@ -449,19 +449,21 @@ static int ipvlan_process_outbound(strucstruct ethhdr *ethh =eth_hdr (skb);int ret =NET_XMIT_DROP ; -/* In this mode we dont care about multicast and broadcast traffic */ -if (is_multicast_ether_addr (ethh->h_dest)) { -pr_debug_ratelimited ("Dropped {multi|broad}cast of type=[%x]\n" , -ntohs (skb->protocol)); -kfree_skb (skb); - goto out; - } -/* The ipvlan is a pseudo-L2 device, so the packets that we receive * will have L2; which need to discarded and processed further * in the net-ns of the main-device. */ if (skb_mac_header_was_set (skb)) { +/* In this mode we dont care about +* multicast and broadcast traffic */ +if (is_multicast_ether_addr (ethh->h_dest)) { +pr_debug_ratelimited ( +"Dropped {multi|broad}cast of type=[%x]\n" , +ntohs (skb->protocol)); +kfree_skb (skb); + goto out; + } +skb_pull (skb,sizeof (*ethh)); skb->mac_header = (typeof(skb->mac_header))~0U;skb_reset_network_header (skb);
Greg Kroah-Hartman
maintainerPATCH 37/99 cgroup: cgroup_procs_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
commit 2d4ecb030dcc90fb725ecbfc82ce5d6c37906e0e upstream.
If seq_file .next fuction does not change position index, read after some lseek can generate unexpected output:
1) dd bs=1 skip output of each 2nd elements
$ dd if=/sys/fs/cgroup/cgroup.procs bs=8 count=1 2 3 4 5 1+0 records in 1+0 records out 8 bytes copied, 0,000267297 s, 29,9 kB/s [test@localhost ~]$ dd if=/sys/fs/cgroup/cgroup.procs bs=1 count=8 2 4 <<< NB! 3 was skipped 6 <<< ... and 5 too 8 <<< ... and 7 8+0 records in 8+0 records out 8 bytes copied, 5,2123e-05 s, 153 kB/s
This happen because __cgroup_procs_start() makes an extra extra cgroup_procs_next() call
2) read after lseek beyond end of file generates whole last line.
3) read after lseek into middle of last line generates expected rest of last line and unexpected whole line once again.
Additionally patch removes an extra position index changes in __cgroup_procs_start()
Cc: [email protected]
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- kernel/cgroup/cgroup.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
kernel/cgroup/cgroup.c +7 -3
@@ -4249,6 +4249,9 @@ static void *cgroup_procs_next(struct sestruct kernfs_open_file *of = s->private;struct css_task_iter *it = of->priv; +if (pos) + (*pos)++; +return css_task_iter_next (it); }
@@ -4264,7 +4267,7 @@ static void *__cgroup_procs_start(struct* from position 0, so we can simply keep iterating on !0 *pos. */ if (!it) { -if (WARN_ON_ONCE ((*pos)++)) +if (WARN_ON_ONCE ((*pos)))return ERR_PTR (-EINVAL ); it =kzalloc (sizeof (*it),GFP_KERNEL );
@@ -4272,10 +4275,11 @@ static void *__cgroup_procs_start(structreturn ERR_PTR (-ENOMEM ); of->priv = it;css_task_iter_start (&cgrp->self, iter_flags, it); - }else if (!(*pos)++) { + }else if (!(*pos)) {css_task_iter_end (it);css_task_iter_start (&cgrp->self, iter_flags, it); - } + }else +return it->cur_task;return cgroup_procs_next (s,NULL ,NULL ); }
Greg Kroah-Hartman
maintainerPATCH 38/99 cgroup: Iterate tasks that did not finish do_exit()
In reply to Greg Kroah-HartmanFrom: Michal Koutný <[email protected]>
commit 9c974c77246460fa6a92c18554c3311c8c83c160 upstream.
PF_EXITING is set earlier than actual removal from css_set when a task is exitting. This can confuse cgroup.procs readers who see no PF_EXITING tasks, however, rmdir is checking against css_set membership so it can transitionally fail with EBUSY.
Fix this by listing tasks that weren't unlinked from css_set active lists.
It may happen that other users of the task iterator (without CSS_TASK_ITER_PROCS) spot a PF_EXITING task before cgroup_exit(). This is equal to the state before commit c03cd7738a83 ("cgroup: Include dying leaders with live threads in PROCS iterations") but it may be reviewed later.
--- include/linux/cgroup.h | 1 + kernel/cgroup/cgroup.c | 23 ++++++++++++++++------- 2 files changed, 17 insertions(+), 7 deletions(-)
include/linux/cgroup.h +1 -0
@@ -61,6 +61,7 @@ struct css_task_iter {struct list_head *mg_tasks_head;struct list_head *dying_tasks_head; +struct list_head *cur_tasks_head;struct css_set *cur_cset;struct css_set *cur_dcset;struct task_struct *cur_task;
kernel/cgroup/cgroup.c +16 -7
@@ -4051,12 +4051,16 @@ static void css_task_iter_advance_css_se } }while (!css_set_populated (cset) &&list_empty (&cset->dying_tasks)); -if (!list_empty (&cset->tasks)) +if (!list_empty (&cset->tasks)) { it->task_pos = cset->tasks.next; -else if (!list_empty (&cset->mg_tasks)) + it->cur_tasks_head = &cset->tasks; + }else if (!list_empty (&cset->mg_tasks)) { it->task_pos = cset->mg_tasks.next; -else + it->cur_tasks_head = &cset->mg_tasks; + }else { it->task_pos = cset->dying_tasks.next; + it->cur_tasks_head = &cset->dying_tasks; + } it->tasks_head = &cset->tasks; it->mg_tasks_head = &cset->mg_tasks;
@@ -4114,10 +4118,14 @@ repeat:else it->task_pos = it->task_pos->next; -if (it->task_pos == it->tasks_head) +if (it->task_pos == it->tasks_head) { it->task_pos = it->mg_tasks_head->next; -if (it->task_pos == it->mg_tasks_head) + it->cur_tasks_head = it->mg_tasks_head; + } +if (it->task_pos == it->mg_tasks_head) { it->task_pos = it->dying_tasks_head->next; + it->cur_tasks_head = it->dying_tasks_head; + }if (it->task_pos == it->dying_tasks_head)css_task_iter_advance_css_set (it); }else {
@@ -4136,11 +4144,12 @@ repeat: goto repeat;/* and dying leaders w/o live member threads */ -if (!atomic_read (&task->signal->live)) +if (it->cur_tasks_head == it->dying_tasks_head && + !atomic_read (&task->signal->live)) goto repeat; }else {/* skip all dying ones */ -if (task->flags &PF_EXITING ) +if (it->cur_tasks_head == it->dying_tasks_head) goto repeat; } }
Greg Kroah-Hartman
maintainerPATCH 39/99 iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices
In reply to Greg Kroah-HartmanFrom: Dan Moulding <[email protected]>
commit a9149d243f259ad8f02b1e23dfe8ba06128f15e1 upstream.
The logic for checking required NVM sections was recently fixed in commit b3f20e098293 ("iwlwifi: mvm: fix NVM check for 3168 devices"). However, with that fixed the else is now taken for 3168 devices and within the else clause there is a mandatory check for the PHY_SKU section. This causes the parsing to fail for 3168 devices.
The PHY_SKU section is really only mandatory for the IWL_NVM_EXT layout (the phy_sku parameter of iwl_parse_nvm_data is only used when the NVM type is IWL_NVM_EXT). So this changes the PHY_SKU section check so that it's only mandatory for IWL_NVM_EXT.
--- drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/nvm.c +2 -1
@@ -326,7 +326,8 @@ iwl_parse_nvm_sections(struct iwl_mvm *m }/* PHY_SKU section is mandatory in B0 */ -if (!mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU ].data) { +if (mvm->trans->cfg->nvm_type ==IWL_NVM_EXT && + !mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU ].data) {IWL_ERR (mvm,"Can't parse phy_sku in B0, empty sections\n" );return NULL ;
Greg Kroah-Hartman
maintainerPATCH 40/99 virtio-blk: fix hw_queue stopped on arbitrary error
In reply to Greg Kroah-HartmanFrom: Halil Pasic <[email protected]>
commit f5f6b95c72f7f8bb46eace8c5306c752d0133daa upstream.
Since nobody else is going to restart our hw_queue for us, the blk_mq_start_stopped_hw_queues() is in virtblk_done() is not sufficient necessarily sufficient to ensure that the queue will get started again. In case of global resource outage (-ENOMEM because mapping failure, because of swiotlb full) our virtqueue may be empty and we can get stuck with a stopped hw_queue.
Let us not stop the queue on arbitrary errors, but only on -EONSPC which indicates a full virtqueue, where the hw_queue is guaranteed to get started by virtblk_done() before when it makes sense to carry on submitting requests. Let us also remove a stale comment.
--- drivers/block/virtio_blk.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/block/virtio_blk.c +5 -3
@@ -271,10 +271,12 @@ static blk_status_t virtio_queue_rq(stru err =virtblk_add_req (vblk->vqs[qid].vq, vbr, vbr->sg, num);if (err) {virtqueue_kick (vblk->vqs[qid].vq); -blk_mq_stop_hw_queue (hctx); +/* Don't stop the queue if -ENOMEM: we may have failed to +* bounce the buffer due to global resource outage. +*/ +if (err == -ENOSPC ) +blk_mq_stop_hw_queue (hctx);spin_unlock_irqrestore (&vblk->vqs[qid].lock, flags); -/* Out of mem doesn't actually happen, since we fall back -* to direct descriptors */ if (err == -ENOMEM || err == -ENOSPC )return BLK_STS_RESOURCE ;return BLK_STS_IOERR ;
Greg Kroah-Hartman
maintainerPATCH 41/99 iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 81ee85d0462410de8eeeec1b9761941fd6ed8c7b upstream.
Quoting from the comment describing the WARN functions in include/asm-generic/bug.h:
* WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report
* significant kernel issues that need prompt attention if they should ever
* appear at runtime.
*
* Do not use these macros when checking for invalid external inputs
The (buggy) firmware tables which the dmar code was calling WARN_TAINT for really are invalid external inputs. They are not under the kernel's control and the issues in them cannot be fixed by a kernel update. So logging a backtrace, which invites bug reports to be filed about this, is not helpful.
--- drivers/iommu/intel-iommu.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/iommu/intel-iommu.c +4 -3
@@ -3984,10 +3984,11 @@ static void quirk_ioat_snb_local_iommu(s/* we know that the this iommu should be at offset 0xa000 from vtbar */ drhd =dmar_find_matched_drhd_unit (pdev); -if (WARN_TAINT_ONCE (!drhd || drhd->reg_base_addr - vtbar !=0xa000 , -TAINT_FIRMWARE_WORKAROUND , -"BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n" )) +if (!drhd || drhd->reg_base_addr - vtbar !=0xa000 ) { +pr_warn_once (FW_BUG "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n" ); +add_taint (TAINT_FIRMWARE_WORKAROUND ,LOCKDEP_STILL_OK ); pdev->dev.archdata.iommu =DUMMY_DEVICE_DOMAIN_INFO ; + } }DECLARE_PCI_FIXUP_ENABLE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_IOAT_SNB , quirk_ioat_snb_local_iommu);
Greg Kroah-Hartman
maintainerPATCH 42/99 workqueue: dont use wq_select_unbound_cpu() for bound works
In reply to Greg Kroah-HartmanFrom: Hillf Danton <[email protected]>
commit aa202f1f56960c60e7befaa0f49c72b8fa11b0a8 upstream.
wq_select_unbound_cpu() is designed for unbound workqueues only, but it's wrongly called when using a bound workqueue too.
Fixing this ensures work queued to a bound workqueue with cpu=WORK_CPU_UNBOUND always runs on the local CPU.
Before, that would happen only if wq_unbound_cpumask happened to include it (likely almost always the case), or was empty, or we got lucky with forced round-robin placement. So restricting /sys/devices/virtual/workqueue/cpumask to a small subset of a machine's CPUs would cause some bound work items to run unexpectedly there.
--- kernel/workqueue.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
kernel/workqueue.c +8 -6
@@ -1386,14 +1386,16 @@ static void __queue_work(int cpu, struct WARN_ON_ONCE(!is_chained_work(wq)))return ; retry: -if (req_cpu ==WORK_CPU_UNBOUND ) - cpu =wq_select_unbound_cpu (raw_smp_processor_id ()); -/* pwq which will be used unless @work is executing elsewhere */ -if (!(wq->flags &WQ_UNBOUND )) - pwq =per_cpu_ptr (wq->cpu_pwqs, cpu); -else +if (wq->flags &WQ_UNBOUND ) { +if (req_cpu ==WORK_CPU_UNBOUND ) + cpu =wq_select_unbound_cpu (raw_smp_processor_id ()); pwq =unbound_pwq_by_node (wq,cpu_to_node (cpu)); + }else { +if (req_cpu ==WORK_CPU_UNBOUND ) + cpu =raw_smp_processor_id (); + pwq =per_cpu_ptr (wq->cpu_pwqs, cpu); + }/* * If @work was previously on a different pool, it might still be
Greg Kroah-Hartman
maintainerPATCH 43/99 drm/amd/display: remove duplicated assignment to grph_obj_type
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit d785476c608c621b345dd9396e8b21e90375cb0e upstream.
Variable grph_obj_type is being assigned twice, one of these is redundant so remove it.
Addresses-Coverity: ("Evaluation order violation")
--- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +1 -2
@@ -363,8 +363,7 @@ bool amdgpu_atombios_get_connector_info_ router.ddc_valid = false; router.cd_valid = false;for (j =0 ; j < ((le16_to_cpu (path->usSize) -8 ) /2 ); j++) { -uint8_t grph_obj_type= - grph_obj_type = +uint8_t grph_obj_type = (le16_to_cpu (path->usGraphicObjIds[j]) &OBJECT_TYPE_MASK ) >>OBJECT_TYPE_SHIFT ;
Greg Kroah-Hartman
maintainerPATCH 44/99 ktest: Add timeout for ssh sync testing
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 4d00fc477a2ce8b6d2b09fb34ef9fe9918e7d434 upstream.
Before rebooting the box, a "ssh sync" is called to the test machine to see if it is alive or not. But if the test machine is in a partial state, that ssh may never actually finish, and the ktest test hangs.
Add a 10 second timeout to the sync test, which will fail after 10 seconds and then cause the test to reboot the test machine.
--- tools/testing/ktest/ktest.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/ktest/ktest.pl +1 -1
@@ -1345,7 +1345,7 @@ sub reboot { } else { # Make sure everything has been written to disk - run_ssh("sync"); + run_ssh("sync", 10); if (defined($time)) { start_monitor;
Greg Kroah-Hartman
maintainerPATCH 45/99 cifs_atomic_open(): fix double-put on late allocation failure
In reply to Greg Kroah-HartmanFrom: Al Viro <[email protected]>
commit d9a9f4849fe0c9d560851ab22a85a666cddfdd24 upstream.
several iterations of ->atomic_open() calling conventions ago, we used to need fput() if ->atomic_open() failed at some point after successful finish_open(). Now (since 2016) it's not needed - struct file carries enough state to make fput() work regardless of the point in struct file lifecycle and discarding it on failure exits in open() got unified. Unfortunately, I'd missed the fact that we had an instance of ->atomic_open() (cifs one) that used to need that fput(), as well as the stale comment in finish_open() demanding such late failure handling. Trivially fixed...
--- Documentation/filesystems/porting | 7 +++++++ fs/cifs/dir.c | 1 - fs/open.c | 3 --- 3 files changed, 7 insertions(+), 4 deletions(-)
Documentation/filesystems/porting +7 -0
@@ -606,3 +606,10 @@ in your dentry operations instead. dentry separately, and it now has request_mask and query_flags arguments to specify the fields and sync type requested by statx. Filesystems not supporting any statx-specific features may ignore the new arguments. +-- +[mandatory] + + [should've been added in 2016] stale comment in finish_open() + nonwithstanding, failure exits in ->atomic_open() instances should + *NOT* fput() the file, no matter what. Everything is handled by the + caller.
fs/cifs/dir.c +0 -1
@@ -562,7 +562,6 @@ cifs_atomic_open(struct inode *inode, stif (server->ops->close) server->ops->close (xid, tcon, &fid);cifs_del_pending_open (&open); -fput (file); rc = -ENOMEM ; }
fs/open.c +0 -3
@@ -824,9 +824,6 @@ cleanup_file:* the return value of d_splice_alias(), then the caller needs to perform dput() * on it after finish_open(). * -* On successful return @file is a fully instantiated open file. After this, if -* an error occurs in ->atomic_open(), it needs to clean up with fput(). -* * Returns zero on success or -errno if the open failed. */ int finish_open(struct file *file, struct dentry *dentry,
Greg Kroah-Hartman
maintainerPATCH 46/99 gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
In reply to Greg Kroah-HartmanFrom: Al Viro <[email protected]>
commit 21039132650281de06a169cbe8a0f7e5c578fd8b upstream.
with the way fs/namei.c:do_last() had been done, ->atomic_open() instances needed to recognize the case when existing file got found with O_EXCL|O_CREAT, either by falling back to finish_no_open() or failing themselves. gfs2 one didn't.
--- fs/gfs2/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/gfs2/inode.c +1 -1
@@ -1255,7 +1255,7 @@ static int gfs2_atomic_open(struct inodeif (!(*opened &FILE_OPENED ))return finish_no_open (file, d);dput (d); -return 0 ; +return excl && (flags &O_CREAT ) ? -EEXIST :0 ; }BUG_ON (d !=NULL );
Greg Kroah-Hartman
maintainerPATCH 47/99 KVM: x86: clear stale x86_emulate_ctxt->intercept value
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
commit 342993f96ab24d5864ab1216f46c0b199c2baf8e upstream.
After commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode") Hyper-V guests on KVM stopped booting with:
kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181
info2 0 int_info 0 int_info_err 0
kvm_page_fault: address febd0000 error_code 181 kvm_emulate_insn: 0:fffff802987d6169: f3 a5 kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL kvm_inj_exception: #UD (0x0)
"f3 a5" is a "rep movsw" instruction, which should not be intercepted at all. Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache") reduced the number of fields cleared by init_decode_cache() claiming that they are being cleared elsewhere, 'intercept', however, is left uncleared if the instruction does not have any of the "slow path" flags (NotImpl, Stack, Op3264, Sse, Mmx, CheckPerm, NearBranch, No16 and of course Intercept itself).
--- arch/x86/kvm/emulate.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kvm/emulate.c +1 -0
@@ -5062,6 +5062,7 @@ int x86_decode_insn(struct x86_emulate_c ctxt->fetch.ptr = ctxt->fetch.data; ctxt->fetch.end = ctxt->fetch.data + insn_len; ctxt->opcode_len =1 ; + ctxt->intercept = x86_intercept_none;if (insn_len >0 )memcpy (ctxt->fetch.data, insn, insn_len);else {
Greg Kroah-Hartman
maintainerPATCH 48/99 ARC: define __ALIGN_STR and __ALIGN symbols for ARC
In reply to Greg Kroah-HartmanFrom: Eugeniy Paltsev <[email protected]>
commit 8d92e992a785f35d23f845206cf8c6cafbc264e0 upstream.
The default defintions use fill pattern 0x90 for padding which for ARC generates unintended "ldh_s r12,[r0,0x20]" corresponding to opcode 0x9090
So use ".align 4" which insert a "nop_s" instruction instead.
--- arch/arc/include/asm/linkage.h | 2 ++ 1 file changed, 2 insertions(+)
arch/arc/include/asm/linkage.h +2 -0
@@ -14,6 +14,8 @@#ifdef __ASSEMBLY__#define ASM_NL `/* use '`' to mark new line in macro */ +#define __ALIGN .align 4 +#define __ALIGN_STR __stringify(__ALIGN)/* annotation for data we want in DCCM - if enabled in .config */ .macro ARCFP_DATA nm
Greg Kroah-Hartman
maintainerPATCH 49/99 efi: Fix a race and a buffer overflow while reading efivars via sysfs
In reply to Greg Kroah-HartmanFrom: Vladis Dronov <[email protected]>
commit 286d3250c9d6437340203fb64938bea344729a0e upstream.
There is a race and a buffer overflow corrupting a kernel memory while reading an EFI variable with a size more than 1024 bytes via the older sysfs method. This happens because accessing struct efi_variable in efivar_{attr,size,data}_read() and friends is not protected from a concurrent access leading to a kernel memory corruption and, at best, to a crash. The race scenario is the following:
CPU0: CPU1:efivar_attr_read()
var->DataSize = 1024;
efivar_entry_get(... &var->DataSize)
down_interruptible(&efivars_lock)
efivar_attr_read() // same EFI var
var->DataSize = 1024;
efivar_entry_get(... &var->DataSize)
down_interruptible(&efivars_lock)
virt_efi_get_variable()
// returns EFI_BUFFER_TOO_SMALL but
// var->DataSize is set to a real
// var size more than 1024 bytes
up(&efivars_lock)
virt_efi_get_variable()
// called with var->DataSize set
// to a real var size, returns
// successfully and overwrites
// a 1024-bytes kernel buffer
up(&efivars_lock)This can be reproduced by concurrent reading of an EFI variable which size is more than 1024 bytes:
ts# for cpu in $(seq 0 $(nproc --ignore=1)); do ( taskset -c $cpu \ cat /sys/firmware/efi/vars/KEKDefault*/size & ) ; done
Fix this by using a local variable for a var's data buffer size so it does not get overwritten.
--- drivers/firmware/efi/efivars.c | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-)
drivers/firmware/efi/efivars.c +20 -9
@@ -139,13 +139,16 @@ static ssize_t efivar_attr_read(struct efivar_entry *entry, char *buf) { struct efi_variable *var = &entry->var; +unsigned long size =sizeof (var->Data);char *str = buf; +int ret;if (!entry || !buf)return -EINVAL ; - var->DataSize =1024 ; -if (efivar_entry_get (entry, &var->Attributes, &var->DataSize, var->Data)) + ret =efivar_entry_get (entry, &var->Attributes, &size, var->Data); + var->DataSize = size; +if (ret)return -EIO ;if (var->Attributes &EFI_VARIABLE_NON_VOLATILE )
@@ -172,13 +175,16 @@ static ssize_t efivar_size_read(struct efivar_entry *entry, char *buf) { struct efi_variable *var = &entry->var; +unsigned long size =sizeof (var->Data);char *str = buf; +int ret;if (!entry || !buf)return -EINVAL ; - var->DataSize =1024 ; -if (efivar_entry_get (entry, &var->Attributes, &var->DataSize, var->Data)) + ret =efivar_entry_get (entry, &var->Attributes, &size, var->Data); + var->DataSize = size; +if (ret)return -EIO ; str +=sprintf (str,"0x%lx\n" , var->DataSize);
@@ -189,12 +195,15 @@ static ssize_t efivar_data_read(struct efivar_entry *entry, char *buf) { struct efi_variable *var = &entry->var; +unsigned long size =sizeof (var->Data); +int ret;if (!entry || !buf)return -EINVAL ; - var->DataSize =1024 ; -if (efivar_entry_get (entry, &var->Attributes, &var->DataSize, var->Data)) + ret =efivar_entry_get (entry, &var->Attributes, &size, var->Data); + var->DataSize = size; +if (ret)return -EIO ;memcpy (buf, var->Data, var->DataSize);
@@ -314,14 +323,16 @@ efivar_show_raw(struct efivar_entry *ent {struct efi_variable *var = &entry->var;struct compat_efi_variable *compat; +unsigned long datasize =sizeof (var->Data);size_t size; +int ret;if (!entry || !buf)return 0 ; - var->DataSize =1024 ; -if (efivar_entry_get (entry, &entry->var.Attributes, - &entry->var.DataSize, entry->var.Data)) + ret =efivar_entry_get (entry, &var->Attributes, &datasize, var->Data); + var->DataSize = datasize; +if (ret)return -EIO ;if (is_compat ()) {
Greg Kroah-Hartman
maintainerPATCH 50/99 x86/mce: Fix logic and comments around MSR_PPIN_CTL
In reply to Greg Kroah-HartmanFrom: Tony Luck <[email protected]>
commit 59b5809655bdafb0767d3fd00a3e41711aab07e6 upstream.
There are two implemented bits in the PPIN_CTL MSR:
Bit 0: LockOut (R/WO)
Set 1 to prevent further writes to MSR_PPIN_CTL.
Bit 1: Enable_PPIN (R/W)
If 1, enables MSR_PPIN to be accessible using RDMSR. If 0, an attempt to read MSR_PPIN will cause #GP.
So there are four defined values:
0: PPIN is disabled, PPIN_CTL may be updated 1: PPIN is disabled. PPIN_CTL is locked against updates 2: PPIN is enabled. PPIN_CTL may be updated 3: PPIN is enabled. PPIN_CTL is locked against updates
Code would only enable the X86_FEATURE_INTEL_PPIN feature for case "2". When it should have done so for both case "2" and case "3".
Fix the final test to just check for the enable bit. Also fix some of the other comments in this function.
--- arch/x86/kernel/cpu/mcheck/mce_intel.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/x86/kernel/cpu/mcheck/mce_intel.c +5 -4
@@ -489,17 +489,18 @@ static void intel_ppin_init(struct cpuinreturn ;if ((val &3UL ) ==1UL ) { -/* PPIN available but disabled: */ +/* PPIN locked in disabled mode */ return ; } -/* If PPIN is disabled, but not locked, try to enable: */ -if (!(val &3UL )) { +/* If PPIN is disabled, try to enable */ +if (!(val &2UL )) {wrmsrl_safe (MSR_PPIN_CTL , val |2UL );rdmsrl_safe (MSR_PPIN_CTL , &val); } -if ((val &3UL ) ==2UL ) +/* Is the enable bit set? */ +if (val &2UL )set_cpu_cap (c,X86_FEATURE_INTEL_PPIN ); } }
Greg Kroah-Hartman
maintainerPATCH 51/99 iommu/dma: Fix MSI reservation allocation
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit 65ac74f1de3334852fb7d9b1b430fa5a06524276 upstream.
The way cookie_init_hw_msi_region() allocates the iommu_dma_msi_page structures doesn't match the way iommu_put_dma_cookie() frees them.
The former performs a single allocation of all the required structures, while the latter tries to free them one at a time. It doesn't quite work for the main use case (the GICv3 ITS where the range is 64kB) when the base granule size is 4kB.
This leads to a nice slab corruption on teardown, which is easily observable by simply creating a VF on a SRIOV-capable device, and tearing it down immediately (no need to even make use of it). Fortunately, this only affects systems where the ITS isn't translated by the SMMU, which are both rare and non-standard.
Fix it by allocating iommu_dma_msi_page structures one at a time.
--- drivers/iommu/dma-iommu.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/iommu/dma-iommu.c +8 -8
@@ -208,15 +208,15 @@ static int cookie_init_hw_msi_region(str start -=iova_offset (iovad, start); num_pages =iova_align (iovad, end - start) >>iova_shift (iovad); - msi_page =kcalloc (num_pages,sizeof (*msi_page),GFP_KERNEL ); -if (!msi_page) -return -ENOMEM ; -for (i =0 ; i < num_pages; i++) { - msi_page[i].phys = start; - msi_page[i].iova = start; -INIT_LIST_HEAD (&msi_page[i].list); -list_add (&msi_page[i].list, &cookie->msi_page_list); + msi_page =kmalloc (sizeof (*msi_page),GFP_KERNEL ); +if (!msi_page) +return -ENOMEM ; + + msi_page->phys = start; + msi_page->iova = start; +INIT_LIST_HEAD (&msi_page->list); +list_add (&msi_page->list, &cookie->msi_page_list); start += iovad->granule; }
Greg Kroah-Hartman
maintainerPATCH 52/99 iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 59833696442c674acbbd297772ba89e7ad8c753d upstream.
Quoting from the comment describing the WARN functions in include/asm-generic/bug.h:
* WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report
* significant kernel issues that need prompt attention if they should ever
* appear at runtime.
*
* Do not use these macros when checking for invalid external inputs
The (buggy) firmware tables which the dmar code was calling WARN_TAINT for really are invalid external inputs. They are not under the kernel's control and the issues in them cannot be fixed by a kernel update. So logging a backtrace, which invites bug reports to be filed about this, is not helpful.
Some distros, e.g. Fedora, have tools watching for the kernel backtraces logged by the WARN macros and offer the user an option to file a bug for this when these are encountered. The WARN_TAINT in warn_invalid_dmar()
+ another iommu WARN_TAINT, addressed in another patch, have lead to over a 100 bugs being filed this way.
This commit replaces the WARN_TAINT("...") calls, with pr_warn(FW_BUG "...") + add_taint(TAINT_FIRMWARE_WORKAROUND, ...) calls avoiding the backtrace and thus also avoiding bug-reports being filed about this against the kernel.
--- drivers/iommu/dmar.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/iommu/dmar.c +6 -5
@@ -451,12 +451,13 @@ static int __init dmar_parse_one_andd(st/* Check for NUL termination within the designated length */ if (strnlen (andd->device_name, header->length -8 ) == header->length -8 ) { -WARN_TAINT (1 ,TAINT_FIRMWARE_WORKAROUND , +pr_warn (FW_BUG "Your BIOS is broken; ANDD object name is not NUL-terminated\n" "BIOS vendor: %s; Ver: %s; Product Version: %s\n" ,dmi_get_system_info (DMI_BIOS_VENDOR ),dmi_get_system_info (DMI_BIOS_VERSION ),dmi_get_system_info (DMI_PRODUCT_VERSION )); +add_taint (TAINT_FIRMWARE_WORKAROUND ,LOCKDEP_STILL_OK );return -EINVAL ; } pr_info("ANDD device: %x name: %s\n", andd->device_number,
@@ -482,14 +483,14 @@ static int dmar_parse_one_rhsa(struct acreturn 0 ; } } -WARN_TAINT ( -1 ,TAINT_FIRMWARE_WORKAROUND , +pr_warn (FW_BUG "Your BIOS is broken; RHSA refers to non-existent DMAR unit at %llx\n" "BIOS vendor: %s; Ver: %s; Product Version: %s\n" , drhd->reg_base_addr,dmi_get_system_info (DMI_BIOS_VENDOR ),dmi_get_system_info (DMI_BIOS_VERSION ),dmi_get_system_info (DMI_PRODUCT_VERSION )); +add_taint (TAINT_FIRMWARE_WORKAROUND ,LOCKDEP_STILL_OK );return 0 ; }
@@ -835,14 +836,14 @@ int __init dmar_table_init(void)static void warn_invalid_dmar (u64 addr,const char *message) { -WARN_TAINT_ONCE ( -1 ,TAINT_FIRMWARE_WORKAROUND , +pr_warn_once (FW_BUG "Your BIOS is broken; DMAR reported at address %llx%s!\n" "BIOS vendor: %s; Ver: %s; Product Version: %s\n" , addr, message,dmi_get_system_info (DMI_BIOS_VENDOR ),dmi_get_system_info (DMI_BIOS_VERSION ),dmi_get_system_info (DMI_PRODUCT_VERSION )); +add_taint (TAINT_FIRMWARE_WORKAROUND ,LOCKDEP_STILL_OK ); } static int __ref
Greg Kroah-Hartman
maintainerPATCH 53/99 iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
In reply to Greg Kroah-HartmanFrom: Yonghyun Hwang <[email protected]>
commit 77a1bce84bba01f3f143d77127b72e872b573795 upstream.
intel_iommu_iova_to_phys() has a bug when it translates an IOVA for a huge page onto its corresponding physical address. This commit fixes the bug by accomodating the level of page entry for the IOVA and adds IOVA's lower address to the physical address.
--- drivers/iommu/intel-iommu.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/iommu/intel-iommu.c +4 -2
@@ -5124,8 +5124,10 @@ static phys_addr_t intel_iommu_iova_to_pu64 phys =0 ; pte =pfn_to_dma_pte (dmar_domain, iova >>VTD_PAGE_SHIFT , &level); -if (pte) - phys =dma_pte_addr (pte); +if (pte &&dma_pte_present (pte)) + phys =dma_pte_addr (pte) + + (iova & (BIT_MASK (level_to_offset_bits (level) + +VTD_PAGE_SHIFT ) -1 ));return phys; }
Greg Kroah-Hartman
maintainerPATCH 54/99 pinctrl: meson-gxl: fix GPIOX sdio pins
In reply to Greg Kroah-HartmanFrom: Nicolas Belin <[email protected]>
commit dc7a06b0dbbafac8623c2b7657e61362f2f479a7 upstream.
In the gxl driver, the sdio cmd and clk pins are inverted. It has not caused any issue so far because devices using these pins always take both pins so the resulting configuration is OK.
--- drivers/pinctrl/meson/pinctrl-meson-gxl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/meson/pinctrl-meson-gxl.c +2 -2
@@ -158,8 +158,8 @@ static const unsigned int sdio_d0_pins[]static const unsigned int sdio_d1_pins[] = {PIN (GPIOX_1 ,EE_OFF ) };static const unsigned int sdio_d2_pins[] = {PIN (GPIOX_2 ,EE_OFF ) };static const unsigned int sdio_d3_pins[] = {PIN (GPIOX_3 ,EE_OFF ) }; -static const unsigned int sdio_cmd_pins[] = {PIN (GPIOX_4 ,EE_OFF ) }; -static const unsigned int sdio_clk_pins[] = {PIN (GPIOX_5 ,EE_OFF ) }; +static const unsigned int sdio_clk_pins[] = {PIN (GPIOX_4 ,EE_OFF ) }; +static const unsigned int sdio_cmd_pins[] = {PIN (GPIOX_5 ,EE_OFF ) };static const unsigned int sdio_irq_pins[] = {PIN (GPIOX_7 ,EE_OFF ) };static const unsigned int nand_ce0_pins[] = {PIN (BOOT_8 ,EE_OFF ) };
Greg Kroah-Hartman
maintainerPATCH 55/99 pinctrl: core: Remove extra kref_get which blocks hogs being freed
In reply to Greg Kroah-HartmanFrom: Charles Keepax <[email protected]>
commit aafd56fc79041bf36f97712d4b35208cbe07db90 upstream.
kref_init starts with the reference count at 1, which will be balanced by the pinctrl_put in pinctrl_unregister. The additional kref_get in pinctrl_claim_hogs will increase this count to 2 and cause the hogs to not get freed when pinctrl_unregister is called.
--- drivers/pinctrl/core.c | 1 - 1 file changed, 1 deletion(-)
drivers/pinctrl/core.c +0 -1
@@ -2031,7 +2031,6 @@ static int pinctrl_claim_hogs(struct pinreturn PTR_ERR (pctldev->p); } -kref_get (&pctldev->p->users); pctldev->hog_default =pinctrl_lookup_state (pctldev->p,PINCTRL_STATE_DEFAULT );if (IS_ERR (pctldev->hog_default)) {
Greg Kroah-Hartman
maintainerPATCH 56/99 nl80211: add missing attribute validation for critical protocol indication
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
commit 0e1a1d853ecedc99da9d27f9f5c376935547a0e2 upstream.
Add missing attribute validation for critical protocol fields to the netlink policy.
--- net/wireless/nl80211.c | 2 ++ 1 file changed, 2 insertions(+)
net/wireless/nl80211.c +2 -0
@@ -395,6 +395,8 @@ static const struct nla_policy nl80211_p [NL80211_ATTR_MDID] = { .type = NLA_U16 }, [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, .len = IEEE80211_MAX_DATA_LEN }, + [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 }, + [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = { .type = NLA_U16 }, [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 }, [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
Greg Kroah-Hartman
maintainerPATCH 57/99 nl80211: add missing attribute validation for beacon report scanning
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
commit 056e9375e1f3c4bf2fd49b70258c7daf788ecd9d upstream.
Add missing attribute validation for beacon report scanning to the netlink policy.
--- net/wireless/nl80211.c | 2 ++ 1 file changed, 2 insertions(+)
net/wireless/nl80211.c +2 -0
@@ -347,6 +347,8 @@ static const struct nla_policy nl80211_p [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 }, + [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 }, + [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG }, [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
Greg Kroah-Hartman
maintainerPATCH 58/99 nl80211: add missing attribute validation for channel switch
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
commit 5cde05c61cbe13cbb3fa66d52b9ae84f7975e5e6 upstream.
Add missing attribute validation for NL80211_ATTR_OPER_CLASS to the netlink policy.
--- net/wireless/nl80211.c | 1 + 1 file changed, 1 insertion(+)
net/wireless/nl80211.c +1 -0
@@ -424,6 +424,7 @@ static const struct nla_policy nl80211_p [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 }, [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, + [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 }, [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN }, [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
Greg Kroah-Hartman
maintainerPATCH 59/99 netfilter: cthelper: add missing attribute validation for cthelper
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
commit c049b3450072b8e3998053490e025839fecfef31 upstream.
Add missing attribute validation for cthelper
to the netlink policy.
--- net/netfilter/nfnetlink_cthelper.c | 2 ++ 1 file changed, 2 insertions(+)
net/netfilter/nfnetlink_cthelper.c +2 -0
@@ -733,6 +733,8 @@ static const struct nla_policy nfnl_cthe [NFCTH_NAME ] = { .type =NLA_NUL_STRING , .len = NF_CT_HELPER_NAME_LEN-1 }, [NFCTH_QUEUE_NUM] = { .type = NLA_U32, }, + [NFCTH_PRIV_DATA_LEN] = { .type = NLA_U32, }, + [NFCTH_STATUS] = { .type = NLA_U32, }, };static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX ] = {
Greg Kroah-Hartman
maintainerPATCH 60/99 netfilter: nft_payload: add missing attribute validation for payload csum flags
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
commit 9d6effb2f1523eb84516e44213c00f2fd9e6afff upstream.
Add missing attribute validation for NFTA_PAYLOAD_CSUM_FLAGS to the netlink policy.
--- net/netfilter/nft_payload.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nft_payload.c +1 -0
@@ -121,6 +121,7 @@ static const struct nla_policy nft_paylo [NFTA_PAYLOAD_LEN] = { .type = NLA_U32 }, [NFTA_PAYLOAD_CSUM_TYPE] = { .type = NLA_U32 }, [NFTA_PAYLOAD_CSUM_OFFSET] = { .type = NLA_U32 }, + [NFTA_PAYLOAD_CSUM_FLAGS] = { .type = NLA_U32 }, }; static int nft_payload_init(const struct nft_ctx *ctx,
Greg Kroah-Hartman
maintainerPATCH 61/99 iommu/vt-d: Fix the wrong printing in RHSA parsing
In reply to Greg Kroah-HartmanFrom: Zhenzhong Duan <[email protected]>
commit b0bb0c22c4db623f2e7b1a471596fbf1c22c6dc5 upstream.
When base address in RHSA structure doesn't match base address in each DRHD structure, the base address in last DRHD is printed out.
This doesn't make sense when there are multiple DRHD units, fix it by printing the buggy RHSA's base address.
--- drivers/iommu/dmar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/dmar.c +1 -1
@@ -486,7 +486,7 @@ static int dmar_parse_one_rhsa(struct acpr_warn (FW_BUG "Your BIOS is broken; RHSA refers to non-existent DMAR unit at %llx\n" "BIOS vendor: %s; Ver: %s; Product Version: %s\n" , - drhd->reg_base_addr, + rhsa->base_address,dmi_get_system_info (DMI_BIOS_VENDOR ),dmi_get_system_info (DMI_BIOS_VERSION ),dmi_get_system_info (DMI_PRODUCT_VERSION ));
Greg Kroah-Hartman
maintainerPATCH 62/99 iommu/vt-d: Ignore devices with out-of-spec domain number
In reply to Greg Kroah-HartmanFrom: Daniel Drake <[email protected]>
commit da72a379b2ec0bad3eb265787f7008bead0b040c upstream.
VMD subdevices are created with a PCI domain ID of 0x10000 or higher.
These subdevices are also handled like all other PCI devices by dmar_pci_bus_notifier().
However, when dmar_alloc_pci_notify_info() take records of such devices, it will truncate the domain ID to a u16 value (in info->seg). The device at (e.g.) 10000:00:02.0 is then treated by the DMAR code as if it is 0000:00:02.0.
In the unlucky event that a real device also exists at 0000:00:02.0 and also has a device-specific entry in the DMAR table, dmar_insert_dev_scope() will crash on:
BUG_ON(i >= devices_cnt);
That's basically a sanity check that only one PCI device matches a single DMAR entry; in this case we seem to have two matching devices.
Fix this by ignoring devices that have a domain number higher than what can be looked up in the DMAR table.
This problem was carefully diagnosed by Jian-Hong Pan.
--- drivers/iommu/dmar.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/iommu/dmar.c +8 -0
@@ -39,6 +39,7 @@#include <linux/dmi.h> #include <linux/slab.h> #include <linux/iommu.h> +#include <linux/limits.h> #include <asm/irq_remapping.h> #include <asm/iommu_table.h>
@@ -139,6 +140,13 @@ dmar_alloc_pci_notify_info(struct pci_deBUG_ON (dev->is_virtfn); +/* +* Ignore devices that have a domain number higher than what can +* be looked up in DMAR, e.g. VMD subdevices with domain 0x10000 +*/ +if (pci_domain_nr (dev->bus) >U16_MAX ) +return NULL ; +/* Only generate path[] for device addition event */ if (event ==BUS_NOTIFY_ADD_DEVICE )for (tmp = dev; tmp; tmp = tmp->bus->self)
Greg Kroah-Hartman
maintainerPATCH 63/99 i2c: acpi: put device when verifying client fails
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
commit 8daee952b4389729358665fb91949460641659d4 upstream.
i2c_verify_client() can fail, so we need to put the device when that happens.
--- drivers/i2c/i2c-core-acpi.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/i2c/i2c-core-acpi.c +9 -1
@@ -352,10 +352,18 @@ static struct i2c_adapter *i2c_acpi_findstatic struct i2c_client *i2c_acpi_find_client_by_adev (struct acpi_device *adev) {struct device *dev; +struct i2c_client *client; dev =bus_find_device (&i2c_bus_type,NULL , adev, i2c_acpi_find_match_device); -return dev ?i2c_verify_client (dev) :NULL ; +if (!dev) +return NULL ; + + client =i2c_verify_client (dev); +if (!client) +put_device (dev); + +return client; } static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value,
Greg Kroah-Hartman
maintainerPATCH 64/99 ipv6: restrict IPV6_ADDRFORM operation
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit b6f6118901d1e867ac9177bbff3b00b185bd4fdc upstream.
IPV6_ADDRFORM is able to transform IPv6 socket to IPv4 one. While this operation sounds illogical, we have to support it.
One of the things it does for TCP socket is to switch sk->sk_prot to tcp_prot.
We now have other layers playing with sk->sk_prot, so we should make sure to not interfere with them.
This patch makes sure sk_prot is the default pointer for TCP IPv6 socket.
syzbot reported :
BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD a0113067 P4D a0113067 PUD a8771067 PMD 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 0 PID: 10686 Comm: syz-executor.0 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffffc9000281fce0 EFLAGS: 00010246 RAX: 1ffffffff15f48ac RBX: ffffffff8afa4560 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a69a8f40 RBP: ffffc9000281fd10 R08: ffffffff86ed9b0c R09: ffffed1014d351f5 R10: ffffed1014d351f5 R11: 0000000000000000 R12: ffff8880920d3098 R13: 1ffff1101241a613 R14: ffff8880a69a8f40 R15: 0000000000000000 FS: 00007f2ae75db700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000000a3b85000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: inet_release+0x165/0x1c0 net/ipv4/af_inet.c:427 __sock_release net/socket.c:605 [inline] sock_close+0xe1/0x260 net/socket.c:1283 __fput+0x2e4/0x740 fs/file_table.c:280 ____fput+0x15/0x20 fs/file_table.c:313 task_work_run+0x176/0x1b0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop arch/x86/entry/common.c:164 [inline] prepare_exit_to_usermode+0x480/0x5b0 arch/x86/entry/common.c:195 syscall_return_slowpath+0x113/0x4a0 arch/x86/entry/common.c:278 do_syscall_64+0x11f/0x1c0 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45c429 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f2ae75dac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: 0000000000000000 RBX: 00007f2ae75db6d4 RCX: 000000000045c429 RDX: 0000000000000001 RSI: 000000000000011a RDI: 0000000000000004 RBP: 000000000076bf20 R08: 0000000000000038 R09: 0000000000000000 R10: 0000000020000180 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000a9d R14: 00000000004ccfb4 R15: 000000000076bf2c Modules linked in: CR2: 0000000000000000 ---[ end trace 82567b5207e87bae ]--- RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffffc9000281fce0 EFLAGS: 00010246 RAX: 1ffffffff15f48ac RBX: ffffffff8afa4560 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a69a8f40 RBP: ffffc9000281fd10 R08: ffffffff86ed9b0c R09: ffffed1014d351f5 R10: ffffed1014d351f5 R11: 0000000000000000 R12: ffff8880920d3098 R13: 1ffff1101241a613 R14: ffff8880a69a8f40 R15: 0000000000000000 FS: 00007f2ae75db700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000000a3b85000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
--- net/ipv6/ipv6_sockglue.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
net/ipv6/ipv6_sockglue.c +8 -2
@@ -185,9 +185,15 @@ static int do_ipv6_setsockopt(struct soc retv = -EBUSY ;break ; } - }else if (sk->sk_protocol !=IPPROTO_TCP ) + }else if (sk->sk_protocol ==IPPROTO_TCP ) { +if (sk->sk_prot != &tcpv6_prot) { + retv = -EBUSY ; +break ; + } +break ; + }else {break ; - + }if (sk->sk_state !=TCP_ESTABLISHED ) { retv = -ENOTCONN ;break ;
Greg Kroah-Hartman
maintainerPATCH 65/99 net/smc: check for valid ib_client_data
In reply to Greg Kroah-HartmanFrom: Karsten Graul <[email protected]>
commit a2f2ef4a54c0d97aa6a8386f4ff23f36ebb488cf upstream.
In smc_ib_remove_dev() check if the provided ib device was actually initialized for SMC before.
--- net/smc/smc_ib.c | 2 ++ 1 file changed, 2 insertions(+)
net/smc/smc_ib.c +2 -0
@@ -513,6 +513,8 @@ static void smc_ib_remove_dev(struct ib_struct smc_ib_device *smcibdev; smcibdev =ib_get_client_data (ibdev, &smc_ib_client); +if (!smcibdev || smcibdev->ibdev != ibdev) +return ;ib_set_client_data (ibdev, &smc_ib_client,NULL );spin_lock (&smc_ib_devices.lock);list_del_init (&smcibdev->list);/* remove from smc_ib_devices */
Greg Kroah-Hartman
maintainerPATCH 66/99 efi: Add a sanity check to efivar_store_raw()
In reply to Greg Kroah-HartmanFrom: Vladis Dronov <[email protected]>
commit d6c066fda90d578aacdf19771a027ed484a79825 upstream.
Add a sanity check to efivar_store_raw() the same way efivar_{attr,size,data}_read() and efivar_show_raw() have it.
--- drivers/firmware/efi/efivars.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/firmware/efi/efivars.c +3 -0
@@ -272,6 +272,9 @@ efivar_store_raw(struct efivar_entry *enu8 *data;int err; +if (!entry || !buf) +return -EINVAL ; +if (is_compat ()) {struct compat_efi_variable *compat;
Greg Kroah-Hartman
maintainerPATCH 67/99 batman-adv: Avoid spurious warnings from bat_v neigh_cmp implementation
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit 6a4bc44b012cbc29c9d824be2c7ab9eac8ee6b6f upstream.
The neighbor compare API implementation for B.A.T.M.A.N. V checks whether the neigh_ifinfo for this neighbor on a specific interface exists. A warning is printed when it isn't found.
But it is not called inside a lock which would prevent that this information is lost right before batadv_neigh_ifinfo_get. It must therefore be expected that batadv_v_neigh_(cmp|is_sob) might not be able to get the requested neigh_ifinfo.
A WARN_ON for such a situation seems not to be appropriate because this will only flood the kernel logs. The warnings must therefore be removed.
--- net/batman-adv/bat_v.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
net/batman-adv/bat_v.c +4 -5
@@ -19,7 +19,6 @@#include "main.h" #include <linux/atomic.h> -#include <linux/bug.h> #include <linux/cache.h> #include <linux/errno.h> #include <linux/if_ether.h>
@@ -623,11 +622,11 @@ static int batadv_v_neigh_cmp(struct batint ret =0 ; ifinfo1 =batadv_neigh_ifinfo_get (neigh1, if_outgoing1); -if (WARN_ON (!ifinfo1)) +if (!ifinfo1) goto err_ifinfo1; ifinfo2 =batadv_neigh_ifinfo_get (neigh2, if_outgoing2); -if (WARN_ON (!ifinfo2)) +if (!ifinfo2) goto err_ifinfo2; ret = ifinfo1->bat_v.throughput - ifinfo2->bat_v.throughput;
@@ -649,11 +648,11 @@ static bool batadv_v_neigh_is_sob(structbool ret = false; ifinfo1 =batadv_neigh_ifinfo_get (neigh1, if_outgoing1); -if (WARN_ON (!ifinfo1)) +if (!ifinfo1) goto err_ifinfo1; ifinfo2 =batadv_neigh_ifinfo_get (neigh2, if_outgoing2); -if (WARN_ON (!ifinfo2)) +if (!ifinfo2) goto err_ifinfo2; threshold = ifinfo1->bat_v.throughput /4 ;
Greg Kroah-Hartman
maintainerPATCH 68/99 batman-adv: Always initialize fragment header priority
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit fe77d8257c4d838c5976557ddb87bd789f312412 upstream.
The batman-adv unuicast fragment header contains 3 bits for the priority of the packet. These bits will be initialized when the skb->priority contains a value between 256 and 263. But otherwise, the uninitialized bits from the stack will be used.
--- net/batman-adv/fragmentation.c | 2 ++ 1 file changed, 2 insertions(+)
net/batman-adv/fragmentation.c +2 -0
@@ -500,6 +500,8 @@ int batadv_frag_send_packet(struct sk_bu*/ if (skb->priority >=256 && skb->priority <=263 ) frag_header.priority = skb->priority -256 ; +else + frag_header.priority =0 ;ether_addr_copy (frag_header.orig, primary_if->net_dev->dev_addr);ether_addr_copy (frag_header.dest, orig_node->orig);
Greg Kroah-Hartman
maintainerPATCH 69/99 batman-adv: Fix check of retrieved orig_gw in batadv_v_gw_is_eligible
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit 198a62ddffa4a4ffaeb741f642b7b52f2d91ae9b upstream.
The batadv_v_gw_is_eligible function already assumes that orig_node is not NULL. But batadv_gw_node_get may have failed to find the originator. It must therefore be checked whether the batadv_gw_node_get failed and not whether orig_node is NULL to detect this error.
--- net/batman-adv/bat_v.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/batman-adv/bat_v.c +1 -1
@@ -814,7 +814,7 @@ static bool batadv_v_gw_is_eligible(stru } orig_gw =batadv_gw_node_get (bat_priv, orig_node); -if (!orig_node) +if (!orig_gw) goto out;if (batadv_v_gw_throughput_get (orig_gw, &orig_throughput) <0 )
Greg Kroah-Hartman
maintainerPATCH 70/99 batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit 5ba7dcfe77037b67016263ea597a8b431692ecab upstream.
The originator node object orig_neigh_node is used to when accessing the bcast_own(_sum) and real_packet_count information. The access to them has to be protected with the spinlock in orig_neigh_node.
But the function uses the lock in orig_node instead. This is incorrect because they could be two different originator node objects.
--- net/batman-adv/bat_iv_ogm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/batman-adv/bat_iv_ogm.c +2 -2
@@ -1220,7 +1220,7 @@ static bool batadv_iv_ogm_calc_tq(struct orig_node->last_seen = jiffies;/* find packet count of corresponding one hop neighbor */ -spin_lock_bh (&orig_node->bat_iv.ogm_cnt_lock); +spin_lock_bh (&orig_neigh_node->bat_iv.ogm_cnt_lock); if_num = if_incoming->if_num; orig_eq_count = orig_neigh_node->bat_iv.bcast_own_sum[if_num]; neigh_ifinfo =batadv_neigh_ifinfo_new (neigh_node, if_outgoing);
@@ -1230,7 +1230,7 @@ static bool batadv_iv_ogm_calc_tq(struct }else { neigh_rq_count =0 ; } -spin_unlock_bh (&orig_node->bat_iv.ogm_cnt_lock); +spin_unlock_bh (&orig_neigh_node->bat_iv.ogm_cnt_lock);/* pay attention to not get a value bigger than 100 % */ if (orig_eq_count > neigh_rq_count)
Greg Kroah-Hartman
maintainerPATCH 71/99 batman-adv: Fix internal interface indices types
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit f22e08932c2960f29b5e828e745c9f3fb7c1bb86 upstream.
batman-adv uses internal indices for each enabled and active interface. It is currently used by the B.A.T.M.A.N. IV algorithm to identifify the correct position in the ogm_cnt bitmaps.
The type for the number of enabled interfaces (which defines the next interface index) was set to char. This type can be (depending on the architecture) either signed (limiting batman-adv to 127 active slave interfaces) or unsigned (limiting batman-adv to 255 active slave interfaces).
This limit was not correctly checked when an interface was enabled and thus an overflow happened. This was only catched on systems with the signed char type when the B.A.T.M.A.N. IV code tried to resize its counter arrays with a negative size.
The if_num interface index was only a s16 and therefore significantly smaller than the ifindex (int) used by the code net code.
Both &batadv_hard_iface->if_num and &batadv_priv->num_ifaces must be (unsigned) int to support the same number of slave interfaces as the net core code. And the interface activation code must check the number of active slave interfaces to avoid integer overflows.
--- net/batman-adv/bat_iv_ogm.c | 24 ++++++++++++++---------- net/batman-adv/hard-interface.c | 9 +++++++-- net/batman-adv/originator.c | 4 ++-- net/batman-adv/originator.h | 4 ++-- net/batman-adv/types.h | 11 ++++++----- 5 files changed, 31 insertions(+), 21 deletions(-)
net/batman-adv/bat_iv_ogm.c +14 -10
@@ -149,7 +149,7 @@ static void batadv_iv_ogm_orig_free(stru* Return: 0 on success, a negative error code otherwise. */ static int batadv_iv_ogm_orig_add_if (struct batadv_orig_node *orig_node, -int max_if_num) +unsigned int max_if_num) {void *data_ptr;size_t old_size;
@@ -193,7 +193,8 @@ unlock:*/ static void batadv_iv_ogm_drop_bcast_own_entry (struct batadv_orig_node *orig_node, -int max_if_num,int del_if_num) +unsigned int max_if_num, +unsigned int del_if_num) {size_t chunk_size;size_t if_offset;
@@ -231,7 +232,8 @@ batadv_iv_ogm_drop_bcast_own_entry(struc*/ static void batadv_iv_ogm_drop_bcast_own_sum_entry (struct batadv_orig_node *orig_node, -int max_if_num,int del_if_num) +unsigned int max_if_num, +unsigned int del_if_num) {size_t if_offset;void *data_ptr;
@@ -268,7 +270,8 @@ batadv_iv_ogm_drop_bcast_own_sum_entry(s* Return: 0 on success, a negative error code otherwise. */ static int batadv_iv_ogm_orig_del_if (struct batadv_orig_node *orig_node, -int max_if_num,int del_if_num) +unsigned int max_if_num, +unsigned int del_if_num) {spin_lock_bh (&orig_node->bat_iv.ogm_cnt_lock);
@@ -302,7 +305,8 @@ static struct batadv_orig_node * batadv_iv_ogm_orig_get(struct batadv_priv *bat_priv, const u8 *addr) { struct batadv_orig_node *orig_node; -int size, hash_added; +int hash_added; +size_t size; orig_node =batadv_orig_hash_find (bat_priv, addr);if (orig_node)
@@ -890,7 +894,7 @@ batadv_iv_ogm_slide_own_bcast_window(stru32 i;size_t word_index;u8 *w; -int if_num; +unsigned int if_num;for (i =0 ; i < hash->size; i++) { head = &hash->table[i];
@@ -1020,7 +1024,7 @@ batadv_iv_ogm_orig_update(struct batadv_struct batadv_neigh_node *tmp_neigh_node =NULL ;struct batadv_neigh_node *router =NULL ;struct batadv_orig_node *orig_node_tmp; -int if_num; +unsigned int if_num;u8 sum_orig, sum_neigh;u8 *neigh_addr;u8 tq_avg;
@@ -1179,7 +1183,7 @@ static bool batadv_iv_ogm_calc_tq(structu8 total_count;u8 orig_eq_count, neigh_rq_count, neigh_rq_inv, tq_own;unsigned int neigh_rq_inv_cube, neigh_rq_max_cube; -int if_num; +unsigned int if_num;unsigned int tq_asym_penalty, inv_asym_penalty;unsigned int combined_tq;unsigned int tq_iface_penalty;
@@ -1698,9 +1702,9 @@ static void batadv_iv_ogm_process(constif (is_my_orig) {unsigned long *word; -int offset; +size_t offset;s32 bit_pos; -s16 if_num; +unsigned int if_num;u8 *weight; orig_neigh_node = batadv_iv_ogm_orig_get(bat_priv,
net/batman-adv/hard-interface.c +7 -2
@@ -738,6 +738,11 @@ int batadv_hardif_enable_interface(struc hard_iface->soft_iface = soft_iface; bat_priv =netdev_priv (hard_iface->soft_iface); +if (bat_priv->num_ifaces >=UINT_MAX ) { + ret = -ENOSPC ; + goto err_dev; + } + ret =netdev_master_upper_dev_link (hard_iface->net_dev, soft_iface,NULL ,NULL );if (ret)
@@ -845,7 +850,7 @@ void batadv_hardif_disable_interface(strbatadv_hardif_recalc_extra_skbroom (hard_iface->soft_iface);/* nobody uses this interface anymore */ -if (!bat_priv->num_ifaces) { +if (bat_priv->num_ifaces ==0 ) {batadv_gw_check_client_stop (bat_priv);if (autodel ==BATADV_IF_CLEANUP_AUTO )
@@ -881,7 +886,7 @@ batadv_hardif_add_interface(struct net_dif (ret) goto free_if; - hard_iface->if_num =-1 ; + hard_iface->if_num =0 ; hard_iface->net_dev = net_dev; hard_iface->soft_iface =NULL ; hard_iface->if_status =BATADV_IF_NOT_IN_USE ;
net/batman-adv/originator.c +2 -2
@@ -1500,7 +1500,7 @@ int batadv_orig_dump(struct sk_buff *msg }int batadv_orig_hash_add_if (struct batadv_hard_iface *hard_iface, -int max_if_num) +unsigned int max_if_num) {struct batadv_priv *bat_priv =netdev_priv (hard_iface->soft_iface);struct batadv_algo_ops *bao = bat_priv->algo_ops;
@@ -1535,7 +1535,7 @@ err: }int batadv_orig_hash_del_if (struct batadv_hard_iface *hard_iface, -int max_if_num) +unsigned int max_if_num) {struct batadv_priv *bat_priv =netdev_priv (hard_iface->soft_iface);struct batadv_hashtable *hash = bat_priv->orig_hash;
net/batman-adv/originator.h +2 -2
@@ -78,9 +78,9 @@ int batadv_orig_seq_print_text(struct seint batadv_orig_dump (struct sk_buff *msg,struct netlink_callback *cb);int batadv_orig_hardif_seq_print_text (struct seq_file *seq,void *offset);int batadv_orig_hash_add_if (struct batadv_hard_iface *hard_iface, -int max_if_num); +unsigned int max_if_num);int batadv_orig_hash_del_if (struct batadv_hard_iface *hard_iface, -int max_if_num); +unsigned int max_if_num);struct batadv_orig_node_vlan *batadv_orig_node_vlan_new (struct batadv_orig_node *orig_node,unsigned short vid);
net/batman-adv/types.h +6 -5
@@ -155,7 +155,7 @@ enum batadv_hard_iface_wifi_flags {*/ struct batadv_hard_iface {struct list_head list; -s16 if_num; +unsigned int if_num;char if_status;u8 num_bcasts;u32 wifi_flags;
@@ -1081,7 +1081,7 @@ struct batadv_priv {atomic_t bcast_seqno;atomic_t bcast_queue_left;atomic_t batman_queue_left; -char num_ifaces; +unsigned int num_ifaces;struct kobject *mesh_obj;struct dentry *debug_dir;struct hlist_head forw_bat_list;
@@ -1479,9 +1479,10 @@ struct batadv_algo_neigh_ops {*/ struct batadv_algo_orig_ops {void (*free)(struct batadv_orig_node *orig_node); -int (*add_if)(struct batadv_orig_node *orig_node,int max_if_num); -int (*del_if)(struct batadv_orig_node *orig_node,int max_if_num, -int del_if_num); +int (*add_if)(struct batadv_orig_node *orig_node, +unsigned int max_if_num); +int (*del_if)(struct batadv_orig_node *orig_node, +unsigned int max_if_num,unsigned int del_if_num);#ifdef CONFIG_BATMAN_ADV_DEBUGFS void (*print)(struct batadv_priv *priv,struct seq_file *seq,struct batadv_hard_iface *hard_iface);
Greg Kroah-Hartman
maintainerPATCH 72/99 batman-adv: update data pointers after skb_cow()
In reply to Greg Kroah-HartmanFrom: Matthias Schiffer <[email protected]>
commit bc44b78157f621ff2a2618fe287a827bcb094ac4 upstream.
batadv_check_unicast_ttvn() calls skb_cow(), so pointers into the SKB data must be (re)set after calling it. The ethhdr variable is dropped altogether.
--- net/batman-adv/routing.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/batman-adv/routing.c +5 -5
@@ -950,14 +950,10 @@ int batadv_recv_unicast_packet(struct skstruct batadv_orig_node *orig_node =NULL , *orig_node_gw =NULL ;int check, hdr_size =sizeof (*unicast_packet);enum batadv_subtype subtype; -struct ethhdr *ethhdr;int ret =NET_RX_DROP ;bool is4addr, is_gw; unicast_packet = (struct batadv_unicast_packet *)skb->data; - unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data; - ethhdr =eth_hdr (skb); - is4addr = unicast_packet->packet_type ==BATADV_UNICAST_4ADDR ;/* the caller function should have already pulled 2 bytes */ if (is4addr)
@@ -977,12 +973,14 @@ int batadv_recv_unicast_packet(struct skif (!batadv_check_unicast_ttvn (bat_priv, skb, hdr_size)) goto free_skb; + unicast_packet = (struct batadv_unicast_packet *)skb->data; +/* packet for me */ if (batadv_is_my_mac (bat_priv, unicast_packet->dest)) {/* If this is a unicast packet from another backgone gw, * drop it. */ - orig_addr_gw = ethhdr->h_source; + orig_addr_gw =eth_hdr (skb)->h_source; orig_node_gw =batadv_orig_hash_find (bat_priv, orig_addr_gw);if (orig_node_gw) { is_gw = batadv_bla_is_backbone_gw(skb, orig_node_gw,
@@ -997,6 +995,8 @@ int batadv_recv_unicast_packet(struct sk }if (is4addr) { + unicast_4addr_packet = + (struct batadv_unicast_4addr_packet *)skb->data; subtype = unicast_4addr_packet->subtype;batadv_dat_inc_counter (bat_priv, subtype);
Greg Kroah-Hartman
maintainerPATCH 73/99 batman-adv: Avoid race in TT TVLV allocator helper
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit 8ba0f9bd3bdea1058c2b2676bec7905724418e40 upstream.
The functions batadv_tt_prepare_tvlv_local_data and batadv_tt_prepare_tvlv_global_data are responsible for preparing a buffer which can be used to store the TVLV container for TT and add the VLAN information to it.
This will be done in three phases:
1. count the number of VLANs and their entries
2. allocate the buffer using the counters from the previous step and limits from the caller (parameter tt_len)
3. insert the VLAN information to the buffer
The step 1 and 3 operate on a list which contains the VLANs. The access to these lists must be protected with an appropriate lock or otherwise they might operate on on different entries. This could for example happen when another context is adding VLAN entries to this list.
This could lead to a buffer overflow in these functions when enough entries were added between step 1 and 3 to the VLAN lists that the buffer room for the entries (*tt_change) is smaller then the now required extra buffer for new VLAN entries.
--- net/batman-adv/translation-table.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/batman-adv/translation-table.c +4 -4
@@ -872,7 +872,7 @@ batadv_tt_prepare_tvlv_global_data(strucstruct batadv_orig_node_vlan *vlan;u8 *tt_change_ptr; -rcu_read_lock (); +spin_lock_bh (&orig_node->vlan_list_lock);hlist_for_each_entry_rcu (vlan, &orig_node->vlan_list, list) { num_vlan++; num_entries +=atomic_read (&vlan->tt.num_entries);
@@ -910,7 +910,7 @@ batadv_tt_prepare_tvlv_global_data(struc *tt_change = (struct batadv_tvlv_tt_change *)tt_change_ptr; out: -rcu_read_unlock (); +spin_unlock_bh (&orig_node->vlan_list_lock);return tvlv_len; }
@@ -946,7 +946,7 @@ batadv_tt_prepare_tvlv_local_data(structu8 *tt_change_ptr;int change_offset; -rcu_read_lock (); +spin_lock_bh (&bat_priv->softif_vlan_list_lock);hlist_for_each_entry_rcu (vlan, &bat_priv->softif_vlan_list, list) { num_vlan++; num_entries +=atomic_read (&vlan->tt.num_entries);
@@ -984,7 +984,7 @@ batadv_tt_prepare_tvlv_local_data(struct *tt_change = (struct batadv_tvlv_tt_change *)tt_change_ptr; out: -rcu_read_unlock (); +spin_unlock_bh (&bat_priv->softif_vlan_list_lock);return tvlv_len; }
Greg Kroah-Hartman
maintainerPATCH 74/99 batman-adv: Fix TT sync flags for intermediate TT responses
In reply to Greg Kroah-HartmanFrom: Linus L�ssing <[email protected]>
commit 7072337e52b3e9d5460500d8dc9cbc1ba2db084c upstream.
The previous TT sync fix so far only fixed TT responses issued by the target node directly. So far, TT responses issued by intermediate nodes still lead to the wrong flags being added, leading to CRC mismatches.
This behaviour was observed at Freifunk Hannover in a 800 nodes setup where a considerable amount of nodes were still infected with 'WI' TT flags even with (most) nodes having the previous TT sync fix applied.
I was able to reproduce the issue with intermediate TT responses in a four node test setup and this patch fixes this issue by ensuring to use the per originator instead of the summarized, OR'd ones.
--- net/batman-adv/translation-table.c | 61 ++++++++++++++++++++++++++++++------- 1 file changed, 51 insertions(+), 10 deletions(-)
net/batman-adv/translation-table.c +51 -10
@@ -1544,6 +1544,8 @@ batadv_tt_global_orig_entry_find(const s* by a given originator * @entry: the TT global entry to check * @orig_node: the originator to search in the list +* @flags: a pointer to store TT flags for the given @entry received +* from @orig_node * * find out if an orig_node is already in the list of a tt_global_entry. *
@@ -1551,7 +1553,8 @@ batadv_tt_global_orig_entry_find(const s*/ static bool batadv_tt_global_entry_has_orig (const struct batadv_tt_global_entry *entry, -const struct batadv_orig_node *orig_node) +const struct batadv_orig_node *orig_node, +u8 *flags) {struct batadv_tt_orig_list_entry *orig_entry;bool found = false;
@@ -1559,6 +1562,10 @@ batadv_tt_global_entry_has_orig(const st orig_entry =batadv_tt_global_orig_entry_find (entry, orig_node);if (orig_entry) { found = true; + +if (flags) + *flags = orig_entry->flags; +batadv_tt_orig_list_entry_put (orig_entry); }
@@ -1741,7 +1748,7 @@ static bool batadv_tt_global_add(structif (!(common->flags &BATADV_TT_CLIENT_TEMP )) goto out;if (batadv_tt_global_entry_has_orig (tt_global_entry, - orig_node)) + orig_node,NULL )) goto out_remove;batadv_tt_global_del_orig_list (tt_global_entry); goto add_orig_entry;
@@ -2884,23 +2891,46 @@ unlock: }/** -* batadv_tt_local_valid - verify that given tt entry is a valid one +* batadv_tt_local_valid() - verify local tt entry and get flags * @entry_ptr: to be checked local tt entry * @data_ptr: not used but definition required to satisfy the callback prototype +* @flags: a pointer to store TT flags for this client to +* +* Checks the validity of the given local TT entry. If it is, then the provided +* flags pointer is updated. * * Return: true if the entry is a valid, false otherwise. */ -static bool batadv_tt_local_valid (const void *entry_ptr,const void *data_ptr) +static bool batadv_tt_local_valid (const void *entry_ptr, +const void *data_ptr, +u8 *flags) {const struct batadv_tt_common_entry *tt_common_entry = entry_ptr;if (tt_common_entry->flags &BATADV_TT_CLIENT_NEW )return false; + +if (flags) + *flags = tt_common_entry->flags; +return true; } +/** +* batadv_tt_global_valid() - verify global tt entry and get flags +* @entry_ptr: to be checked global tt entry +* @data_ptr: an orig_node object (may be NULL) +* @flags: a pointer to store TT flags for this client to +* +* Checks the validity of the given global TT entry. If it is, then the provided +* flags pointer is updated either with the common (summed) TT flags if data_ptr +* is NULL or the specific, per originator TT flags otherwise. +* +* Return: true if the entry is a valid, false otherwise. +*/ static bool batadv_tt_global_valid (const void *entry_ptr, -const void *data_ptr) +const void *data_ptr, +u8 *flags) {const struct batadv_tt_common_entry *tt_common_entry = entry_ptr;const struct batadv_tt_global_entry *tt_global_entry;
@@ -2914,7 +2944,8 @@ static bool batadv_tt_global_valid(const struct batadv_tt_global_entry, common); -return batadv_tt_global_entry_has_orig (tt_global_entry, orig_node); +return batadv_tt_global_entry_has_orig (tt_global_entry, orig_node, + flags); }/**
@@ -2924,25 +2955,34 @@ static bool batadv_tt_global_valid(const* @hash: hash table containing the tt entries * @tt_len: expected tvlv tt data buffer length in number of bytes * @tvlv_buff: pointer to the buffer to fill with the TT data -* @valid_cb: function to filter tt change entries +* @valid_cb: function to filter tt change entries and to return TT flags * @cb_data: data passed to the filter function as argument +* +* Fills the tvlv buff with the tt entries from the specified hash. If valid_cb +* is not provided then this becomes a no-op. */ static void batadv_tt_tvlv_generate (struct batadv_priv *bat_priv,struct batadv_hashtable *hash,void *tvlv_buff,u16 tt_len,bool (*valid_cb)(const void *, -const void *), +const void *, +u8 *flags),void *cb_data) {struct batadv_tt_common_entry *tt_common_entry;struct batadv_tvlv_tt_change *tt_change;struct hlist_head *head;u16 tt_tot, tt_num_entries =0 ; +u8 flags; +bool ret;u32 i; tt_tot =batadv_tt_entries (tt_len); tt_change = (struct batadv_tvlv_tt_change *)tvlv_buff; +if (!valid_cb) +return ; +rcu_read_lock ();for (i =0 ; i < hash->size; i++) { head = &hash->table[i];
@@ -2952,11 +2992,12 @@ static void batadv_tt_tvlv_generate(struif (tt_tot == tt_num_entries)break ; -if ((valid_cb) && (!valid_cb (tt_common_entry, cb_data))) + ret =valid_cb (tt_common_entry, cb_data, &flags); +if (!ret)continue ;ether_addr_copy (tt_change->addr, tt_common_entry->addr); - tt_change->flags = tt_common_entry->flags; + tt_change->flags = flags; tt_change->vid =htons (tt_common_entry->vid);memset (tt_change->reserved,0 ,sizeof (tt_change->reserved));
Greg Kroah-Hartman
maintainerPATCH 75/99 batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs
In reply to Greg Kroah-HartmanFrom: Marek Lindner <[email protected]>
commit 16116dac23396e73c01eeee97b102e4833a4b205 upstream.
A translation table TVLV changset sent with an OGM consists of a number of headers (one per VLAN) plus the changeset itself (addition and/or deletion of entries).
The per-VLAN headers are used by OGM recipients for consistency checks. Said consistency check might determine that a full translation table request is needed to restore consistency. If the TT sender adds per-VLAN headers of empty VLANs into the OGM, recipients are led to believe to have reached an inconsistent state and thus request a full table update. The full table does not contain empty VLANs (due to missing entries) the cycle restarts when the next OGM is issued.
Consequently, when the translation table TVLV headers are composed, empty VLANs are to be excluded.
--- net/batman-adv/translation-table.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
net/batman-adv/translation-table.c +12 -3
@@ -941,15 +941,20 @@ batadv_tt_prepare_tvlv_local_data(structstruct batadv_tvlv_tt_vlan_data *tt_vlan;struct batadv_softif_vlan *vlan;u16 num_vlan =0 ; -u16 num_entries =0 ; +u16 vlan_entries =0 ; +u16 total_entries =0 ;u16 tvlv_len;u8 *tt_change_ptr;int change_offset;spin_lock_bh (&bat_priv->softif_vlan_list_lock);hlist_for_each_entry_rcu (vlan, &bat_priv->softif_vlan_list, list) { + vlan_entries =atomic_read (&vlan->tt.num_entries); +if (vlan_entries <1 ) +continue ; + num_vlan++; - num_entries +=atomic_read (&vlan->tt.num_entries); + total_entries += vlan_entries; } change_offset =sizeof (**tt_data);
@@ -957,7 +962,7 @@ batadv_tt_prepare_tvlv_local_data(struct/* if tt_len is negative, allocate the space needed by the full table */ if (*tt_len <0 ) - *tt_len =batadv_tt_len (num_entries); + *tt_len =batadv_tt_len (total_entries); tvlv_len = *tt_len; tvlv_len += change_offset;
@@ -974,6 +979,10 @@ batadv_tt_prepare_tvlv_local_data(struct tt_vlan = (struct batadv_tvlv_tt_vlan_data *)(*tt_data +1 );hlist_for_each_entry_rcu (vlan, &bat_priv->softif_vlan_list, list) { + vlan_entries =atomic_read (&vlan->tt.num_entries); +if (vlan_entries <1 ) +continue ; + tt_vlan->vid =htons (vlan->vid); tt_vlan->crc =htonl (vlan->tt.crc);
Greg Kroah-Hartman
maintainerPATCH 76/99 batman-adv: Fix debugfs path for renamed hardif
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit 36dc621ceca1be3ec885aeade5fdafbbcc452a6d upstream.
batman-adv is creating special debugfs directories in the init net_namespace for each valid hard-interface (net_device). But it is possible to rename a net_device to a completely different name then the original one.
It can therefore happen that a user registers a new net_device which gets the name "wlan0" assigned by default. batman-adv is also adding a new directory under $debugfs/batman-adv/ with the name "wlan0".
The user then decides to rename this device to "wl_pri" and registers a different device. The kernel may now decide to use the name "wlan0" again for this new device. batman-adv will detect it as a valid net_device and tries to create a directory with the name "wlan0" under $debugfs/batman-adv/. But there already exists one with this name under this path and thus this fails. batman-adv will detect a problem and rollback the registering of this device.
batman-adv must therefore take care of renaming the debugfs directories for hard-interfaces whenever it detects such a net_device rename.
--- net/batman-adv/debugfs.c | 22 +++++++++++++++++++++- net/batman-adv/debugfs.h | 6 ++++++ net/batman-adv/hard-interface.c | 3 +++ 3 files changed, 30 insertions(+), 1 deletion(-)
net/batman-adv/debugfs.c +21 -1
@@ -18,6 +18,7 @@#include "debugfs.h" #include "main.h" +#include <linux/dcache.h> #include <linux/debugfs.h> #include <linux/err.h> #include <linux/errno.h>
@@ -338,7 +339,26 @@ out: }/** -* batadv_debugfs_del_hardif - delete the base directory for a hard interface +* batadv_debugfs_rename_hardif() - Fix debugfs path for renamed hardif +* @hard_iface: hard interface which was renamed +*/ +void batadv_debugfs_rename_hardif (struct batadv_hard_iface *hard_iface) +{ +const char *name = hard_iface->net_dev->name; +struct dentry *dir; +struct dentry *d; + + dir = hard_iface->debug_dir; +if (!dir) +return ; + + d =debugfs_rename (dir->d_parent, dir, dir->d_parent, name); +if (!d) +pr_err ("Can't rename debugfs dir to %s\n" , name); +} + +/** +* batadv_debugfs_del_hardif() - delete the base directory for a hard interface * in debugfs. * @hard_iface: hard interface which is deleted. */
net/batman-adv/debugfs.h +6 -0
@@ -31,6 +31,7 @@ void batadv_debugfs_destroy(void);int batadv_debugfs_add_meshif (struct net_device *dev);void batadv_debugfs_del_meshif (struct net_device *dev);int batadv_debugfs_add_hardif (struct batadv_hard_iface *hard_iface); +void batadv_debugfs_rename_hardif (struct batadv_hard_iface *hard_iface);void batadv_debugfs_del_hardif (struct batadv_hard_iface *hard_iface);#else
@@ -59,6 +60,11 @@ int batadv_debugfs_add_hardif(struct bat }static inline +void batadv_debugfs_rename_hardif (struct batadv_hard_iface *hard_iface) +{ +} + +static inline void batadv_debugfs_del_hardif (struct batadv_hard_iface *hard_iface) { }
net/batman-adv/hard-interface.c +3 -0
@@ -1017,6 +1017,9 @@ static int batadv_hard_if_event(struct nif (batadv_is_wifi_hardif (hard_iface)) hard_iface->num_bcasts =BATADV_NUM_BCASTS_WIRELESS ;break ; +case NETDEV_CHANGENAME : +batadv_debugfs_rename_hardif (hard_iface); +break ;default :break ; }
Greg Kroah-Hartman
maintainerPATCH 77/99 batman-adv: Fix debugfs path for renamed softif
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit 6da7be7d24b2921f8215473ba7552796dff05fe1 upstream.
batman-adv is creating special debugfs directories in the init net_namespace for each created soft-interface (batadv net_device). But it is possible to rename a net_device to a completely different name then the original one.
It can therefore happen that a user registers a new batadv net_device with the name "bat0". batman-adv is then also adding a new directory under $debugfs/batman-adv/ with the name "wlan0".
The user then decides to rename this device to "bat1" and registers a different batadv device with the name "bat0". batman-adv will then try to create a directory with the name "bat0" under $debugfs/batman-adv/ again. But there already exists one with this name under this path and thus this fails. batman-adv will detect a problem and rollback the registering of this device.
batman-adv must therefore take care of renaming the debugfs directories for soft-interfaces whenever it detects such a net_device rename.
--- net/batman-adv/debugfs.c | 24 ++++++++++++++++++++++++ net/batman-adv/debugfs.h | 5 +++++ net/batman-adv/hard-interface.c | 34 ++++++++++++++++++++++++++++------ 3 files changed, 57 insertions(+), 6 deletions(-)
net/batman-adv/debugfs.c +24 -0
@@ -421,6 +421,30 @@ out:return -ENOMEM ; } +/** +* batadv_debugfs_rename_meshif() - Fix debugfs path for renamed softif +* @dev: net_device which was renamed +*/ +void batadv_debugfs_rename_meshif (struct net_device *dev) +{ +struct batadv_priv *bat_priv =netdev_priv (dev); +const char *name = dev->name; +struct dentry *dir; +struct dentry *d; + + dir = bat_priv->debug_dir; +if (!dir) +return ; + + d =debugfs_rename (dir->d_parent, dir, dir->d_parent, name); +if (!d) +pr_err ("Can't rename debugfs dir to %s\n" , name); +} + +/** +* batadv_debugfs_del_meshif() - Remove interface dependent debugfs entries +* @dev: netdev struct of the soft interface +*/ void batadv_debugfs_del_meshif (struct net_device *dev) {struct batadv_priv *bat_priv =netdev_priv (dev);
net/batman-adv/debugfs.h +5 -0
@@ -29,6 +29,7 @@ struct net_device;void batadv_debugfs_init (void );void batadv_debugfs_destroy (void );int batadv_debugfs_add_meshif (struct net_device *dev); +void batadv_debugfs_rename_meshif (struct net_device *dev);void batadv_debugfs_del_meshif (struct net_device *dev);int batadv_debugfs_add_hardif (struct batadv_hard_iface *hard_iface);void batadv_debugfs_rename_hardif (struct batadv_hard_iface *hard_iface);
@@ -49,6 +50,10 @@ static inline int batadv_debugfs_add_mesreturn 0 ; } +static inline void batadv_debugfs_rename_meshif (struct net_device *dev) +{ +} +static inline void batadv_debugfs_del_meshif (struct net_device *dev) { }
net/batman-adv/hard-interface.c +28 -6
@@ -955,6 +955,32 @@ void batadv_hardif_remove_interfaces(voirtnl_unlock (); } +/** +* batadv_hard_if_event_softif() - Handle events for soft interfaces +* @event: NETDEV_* event to handle +* @net_dev: net_device which generated an event +* +* Return: NOTIFY_* result +*/ +static int batadv_hard_if_event_softif (unsigned long event, +struct net_device *net_dev) +{ +struct batadv_priv *bat_priv; + +switch (event) { +case NETDEV_REGISTER : +batadv_sysfs_add_meshif (net_dev); + bat_priv =netdev_priv (net_dev); +batadv_softif_create_vlan (bat_priv,BATADV_NO_FLAGS ); +break ; +case NETDEV_CHANGENAME : +batadv_debugfs_rename_meshif (net_dev); +break ; + } + +return NOTIFY_DONE ; +} +static int batadv_hard_if_event (struct notifier_block *this,unsigned long event,void *ptr) {
@@ -963,12 +989,8 @@ static int batadv_hard_if_event(struct nstruct batadv_hard_iface *primary_if =NULL ;struct batadv_priv *bat_priv; -if (batadv_softif_is_valid (net_dev) && event ==NETDEV_REGISTER ) { -batadv_sysfs_add_meshif (net_dev); - bat_priv =netdev_priv (net_dev); -batadv_softif_create_vlan (bat_priv,BATADV_NO_FLAGS ); -return NOTIFY_DONE ; - } +if (batadv_softif_is_valid (net_dev)) +return batadv_hard_if_event_softif (event, net_dev); hard_iface =batadv_hardif_get_by_netdev (net_dev); if (!hard_iface && (event == NETDEV_REGISTER ||
Greg Kroah-Hartman
maintainerPATCH 78/99 batman-adv: Fix duplicated OGMs on NETDEV_UP
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit 9e6b5648bbc4cd48fab62cecbb81e9cc3c6e7e88 upstream.
The state of slave interfaces are handled differently depending on whether the interface is up or not. All active interfaces (IFF_UP) will transmit OGMs. But for B.A.T.M.A.N. IV, also non-active interfaces are scheduling (low TTL) OGMs on active interfaces. The code which setups and schedules the OGMs must therefore already be called when the interfaces gets added as slave interface and the transmit function must then check whether it has to send out the OGM or not on the specific slave interface.
But the commit f0d97253fb5f ("batman-adv: remove ogm_emit and ogm_schedule API calls") moved the setup code from the enable function to the activate function. The latter is called either when the added slave was already up when batadv_hardif_enable_interface processed the new interface or when a NETDEV_UP event was received for this slave interfac. As result, each NETDEV_UP would schedule a new OGM worker for the interface and thus OGMs would be send a lot more than expected.
--- net/batman-adv/bat_iv_ogm.c | 4 ++-- net/batman-adv/hard-interface.c | 3 +++ net/batman-adv/types.h | 2 ++ 3 files changed, 7 insertions(+), 2 deletions(-)
net/batman-adv/bat_iv_ogm.c +2 -2
@@ -2481,7 +2481,7 @@ batadv_iv_ogm_neigh_is_sob(struct batadvreturn ret; } -static void batadv_iv_iface_activate (struct batadv_hard_iface *hard_iface) +static void batadv_iv_iface_enabled (struct batadv_hard_iface *hard_iface) {/* begin scheduling originator messages on that interface */ batadv_iv_ogm_schedule (hard_iface);
@@ -2821,8 +2821,8 @@ unlock:static struct batadv_algo_ops batadv_batman_iv__read_mostly = { .name ="BATMAN_IV" , .iface = { - .activate = batadv_iv_iface_activate, .enable = batadv_iv_ogm_iface_enable, + .enabled = batadv_iv_iface_enabled, .disable = batadv_iv_ogm_iface_disable, .update_mac = batadv_iv_ogm_iface_update_mac, .primary_set = batadv_iv_ogm_primary_iface_set,
net/batman-adv/hard-interface.c +3 -0
@@ -795,6 +795,9 @@ int batadv_hardif_enable_interface(strucbatadv_hardif_recalc_extra_skbroom (soft_iface); +if (bat_priv->algo_ops->iface.enabled) + bat_priv->algo_ops->iface.enabled (hard_iface); + out:return 0 ;
net/batman-adv/types.h +2 -0
@@ -1424,6 +1424,7 @@ struct batadv_forw_packet {* @activate: start routing mechanisms when hard-interface is brought up * (optional) * @enable: init routing info when hard-interface is enabled +* @enabled: notification when hard-interface was enabled (optional) * @disable: de-init routing info when hard-interface is disabled * @update_mac: (re-)init mac addresses of the protocol information * belonging to this hard-interface
@@ -1432,6 +1433,7 @@ struct batadv_forw_packet {struct batadv_algo_iface_ops {void (*activate)(struct batadv_hard_iface *hard_iface);int (*enable)(struct batadv_hard_iface *hard_iface); +void (*enabled)(struct batadv_hard_iface *hard_iface);void (*disable)(struct batadv_hard_iface *hard_iface);void (*update_mac)(struct batadv_hard_iface *hard_iface);void (*primary_set)(struct batadv_hard_iface *hard_iface);
Greg Kroah-Hartman
maintainerPATCH 79/99 batman-adv: Avoid free/alloc race when handling OGM2 buffer
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit a8d23cbbf6c9f515ed678204ad2962be7c336344 upstream.
A B.A.T.M.A.N. V virtual interface has an OGM2 packet buffer which is initialized using data from the netdevice notifier and other rtnetlink related hooks. It is sent regularly via various slave interfaces of the batadv virtual interface and in this process also modified (realloced) to integrate additional state information via TVLV containers.
It must be avoided that the worker item is executed without a common lock with the netdevice notifier/rtnetlink helpers. Otherwise it can either happen that half modified data is sent out or the functions modifying the OGM2 buffer try to access already freed memory regions.
--- net/batman-adv/bat_v_ogm.c | 42 ++++++++++++++++++++++++++++++++++-------- net/batman-adv/types.h | 3 +++ 2 files changed, 37 insertions(+), 8 deletions(-)
net/batman-adv/bat_v_ogm.c +34 -8
@@ -28,6 +28,8 @@#include <linux/kernel.h> #include <linux/kref.h> #include <linux/list.h> +#include <linux/lockdep.h> +#include <linux/mutex.h> #include <linux/netdevice.h> #include <linux/random.h> #include <linux/rculist.h>
@@ -127,14 +129,12 @@ static void batadv_v_ogm_send_to_if(stru }/** -* batadv_v_ogm_send - periodic worker broadcasting the own OGM -* @work: work queue item +* batadv_v_ogm_send_softif() - periodic worker broadcasting the own OGM +* @bat_priv: the bat priv with all the soft interface information */ -static void batadv_v_ogm_send (struct work_struct *work) +static void batadv_v_ogm_send_softif (struct batadv_priv *bat_priv) {struct batadv_hard_iface *hard_iface; -struct batadv_priv_bat_v *bat_v; -struct batadv_priv *bat_priv;struct batadv_ogm2_packet *ogm_packet;struct sk_buff *skb, *skb_tmp;unsigned char *ogm_buff;
@@ -142,8 +142,7 @@ static void batadv_v_ogm_send(struct woru16 tvlv_len =0 ;int ret; - bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work); - bat_priv = container_of(bat_v, struct batadv_priv, bat_v); +lockdep_assert_held (&bat_priv->bat_v.ogm_buff_mutex);if (atomic_read (&bat_priv->mesh_state) ==BATADV_MESH_DEACTIVATING ) goto out;
@@ -235,6 +234,23 @@ out: }/** +* batadv_v_ogm_send() - periodic worker broadcasting the own OGM +* @work: work queue item +*/ +static void batadv_v_ogm_send (struct work_struct *work) +{ +struct batadv_priv_bat_v *bat_v; +struct batadv_priv *bat_priv; + + bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work); + bat_priv = container_of(bat_v, struct batadv_priv, bat_v); + +mutex_lock (&bat_priv->bat_v.ogm_buff_mutex); +batadv_v_ogm_send_softif (bat_priv); +mutex_unlock (&bat_priv->bat_v.ogm_buff_mutex); +} + +/** * batadv_v_ogm_iface_enable - prepare an interface for B.A.T.M.A.N. V * @hard_iface: the interface to prepare *
@@ -260,11 +276,15 @@ void batadv_v_ogm_primary_iface_set(strustruct batadv_priv *bat_priv =netdev_priv (primary_iface->soft_iface);struct batadv_ogm2_packet *ogm_packet; +mutex_lock (&bat_priv->bat_v.ogm_buff_mutex);if (!bat_priv->bat_v.ogm_buff) -return ; + goto unlock; ogm_packet = (struct batadv_ogm2_packet *)bat_priv->bat_v.ogm_buff;ether_addr_copy (ogm_packet->orig, primary_iface->net_dev->dev_addr); + +unlock: +mutex_unlock (&bat_priv->bat_v.ogm_buff_mutex); }/**
@@ -886,6 +906,8 @@ int batadv_v_ogm_init(struct batadv_privatomic_set (&bat_priv->bat_v.ogm_seqno, random_seqno);INIT_DELAYED_WORK (&bat_priv->bat_v.ogm_wq, batadv_v_ogm_send); +mutex_init (&bat_priv->bat_v.ogm_buff_mutex); +return 0 ; }
@@ -897,7 +919,11 @@ void batadv_v_ogm_free(struct batadv_pri {cancel_delayed_work_sync (&bat_priv->bat_v.ogm_wq); +mutex_lock (&bat_priv->bat_v.ogm_buff_mutex); +kfree (bat_priv->bat_v.ogm_buff); bat_priv->bat_v.ogm_buff =NULL ; bat_priv->bat_v.ogm_buff_len =0 ; + +mutex_unlock (&bat_priv->bat_v.ogm_buff_mutex); }
net/batman-adv/types.h +3 -0
@@ -27,6 +27,7 @@#include <linux/compiler.h> #include <linux/if_ether.h> #include <linux/kref.h> +#include <linux/mutex.h> #include <linux/netdevice.h> #include <linux/netlink.h> #include <linux/sched.h> /* for linux/wait.h */
@@ -989,12 +990,14 @@ struct batadv_softif_vlan {* @ogm_buff: buffer holding the OGM packet * @ogm_buff_len: length of the OGM packet buffer * @ogm_seqno: OGM sequence number - used to identify each OGM +* @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len * @ogm_wq: workqueue used to schedule OGM transmissions */ struct batadv_priv_bat_v {unsigned char *ogm_buff;int ogm_buff_len;atomic_t ogm_seqno; +struct mutex ogm_buff_mutex;struct delayed_work ogm_wq; };
Greg Kroah-Hartman
maintainerPATCH 80/99 batman-adv: Avoid free/alloc race when handling OGM buffer
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit 40e220b4218bb3d278e5e8cc04ccdfd1c7ff8307 upstream.
Each slave interface of an B.A.T.M.A.N. IV virtual interface has an OGM packet buffer which is initialized using data from netdevice notifier and other rtnetlink related hooks. It is sent regularly via various slave interfaces of the batadv virtual interface and in this process also modified (realloced) to integrate additional state information via TVLV containers.
It must be avoided that the worker item is executed without a common lock with the netdevice notifier/rtnetlink helpers. Otherwise it can either happen that half modified/freed data is sent out or functions modifying the OGM buffer try to access already freed memory regions.
--- net/batman-adv/bat_iv_ogm.c | 60 ++++++++++++++++++++++++++++++++++------ net/batman-adv/hard-interface.c | 2 + net/batman-adv/types.h | 2 + 3 files changed, 55 insertions(+), 9 deletions(-)
net/batman-adv/bat_iv_ogm.c +51 -9
@@ -34,6 +34,7 @@#include <linux/kref.h> #include <linux/list.h> #include <linux/lockdep.h> +#include <linux/mutex.h> #include <linux/netdevice.h> #include <linux/netlink.h> #include <linux/pkt_sched.h>
@@ -370,14 +371,18 @@ static int batadv_iv_ogm_iface_enable(stunsigned char *ogm_buff;u32 random_seqno; +mutex_lock (&hard_iface->bat_iv.ogm_buff_mutex); +/* randomize initial seqno to avoid collision */ get_random_bytes (&random_seqno,sizeof (random_seqno));atomic_set (&hard_iface->bat_iv.ogm_seqno, random_seqno); hard_iface->bat_iv.ogm_buff_len =BATADV_OGM_HLEN ; ogm_buff =kmalloc (hard_iface->bat_iv.ogm_buff_len,GFP_ATOMIC ); -if (!ogm_buff) +if (!ogm_buff) { +mutex_unlock (&hard_iface->bat_iv.ogm_buff_mutex);return -ENOMEM ; + } hard_iface->bat_iv.ogm_buff = ogm_buff;
@@ -389,35 +394,59 @@ static int batadv_iv_ogm_iface_enable(st batadv_ogm_packet->reserved =0 ; batadv_ogm_packet->tq =BATADV_TQ_MAX_VALUE ; +mutex_unlock (&hard_iface->bat_iv.ogm_buff_mutex); +return 0 ; }static void batadv_iv_ogm_iface_disable (struct batadv_hard_iface *hard_iface) { +mutex_lock (&hard_iface->bat_iv.ogm_buff_mutex); +kfree (hard_iface->bat_iv.ogm_buff); hard_iface->bat_iv.ogm_buff =NULL ; + +mutex_unlock (&hard_iface->bat_iv.ogm_buff_mutex); }static void batadv_iv_ogm_iface_update_mac (struct batadv_hard_iface *hard_iface) {struct batadv_ogm_packet *batadv_ogm_packet; -unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff; +void *ogm_buff; - batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff; +mutex_lock (&hard_iface->bat_iv.ogm_buff_mutex); + + ogm_buff = hard_iface->bat_iv.ogm_buff; +if (!ogm_buff) + goto unlock; + + batadv_ogm_packet = ogm_buff;ether_addr_copy (batadv_ogm_packet->orig, hard_iface->net_dev->dev_addr);ether_addr_copy (batadv_ogm_packet->prev_sender, hard_iface->net_dev->dev_addr); + +unlock: +mutex_unlock (&hard_iface->bat_iv.ogm_buff_mutex); }static void batadv_iv_ogm_primary_iface_set (struct batadv_hard_iface *hard_iface) {struct batadv_ogm_packet *batadv_ogm_packet; -unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff; +void *ogm_buff; - batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff; +mutex_lock (&hard_iface->bat_iv.ogm_buff_mutex); + + ogm_buff = hard_iface->bat_iv.ogm_buff; +if (!ogm_buff) + goto unlock; + + batadv_ogm_packet = ogm_buff; batadv_ogm_packet->ttl =BATADV_TTL ; + +unlock: +mutex_unlock (&hard_iface->bat_iv.ogm_buff_mutex); }/* when do we schedule our own ogm to be sent */
@@ -915,7 +944,11 @@ batadv_iv_ogm_slide_own_bcast_window(str } } -static void batadv_iv_ogm_schedule (struct batadv_hard_iface *hard_iface) +/** +* batadv_iv_ogm_schedule_buff() - schedule submission of hardif ogm buffer +* @hard_iface: interface whose ogm buffer should be transmitted +*/ +static void batadv_iv_ogm_schedule_buff (struct batadv_hard_iface *hard_iface) {struct batadv_priv *bat_priv =netdev_priv (hard_iface->soft_iface);unsigned char **ogm_buff = &hard_iface->bat_iv.ogm_buff;
@@ -926,9 +959,7 @@ static void batadv_iv_ogm_schedule(strucu16 tvlv_len =0 ;unsigned long send_time; -if ((hard_iface->if_status ==BATADV_IF_NOT_IN_USE ) || - (hard_iface->if_status ==BATADV_IF_TO_BE_REMOVED )) -return ; +lockdep_assert_held (&hard_iface->bat_iv.ogm_buff_mutex);/* the interface gets activated here to avoid race conditions between * the moment of activating the interface in
@@ -996,6 +1027,17 @@ out:batadv_hardif_put (primary_if); } +static void batadv_iv_ogm_schedule (struct batadv_hard_iface *hard_iface) +{ +if (hard_iface->if_status ==BATADV_IF_NOT_IN_USE || + hard_iface->if_status ==BATADV_IF_TO_BE_REMOVED ) +return ; + +mutex_lock (&hard_iface->bat_iv.ogm_buff_mutex); +batadv_iv_ogm_schedule_buff (hard_iface); +mutex_unlock (&hard_iface->bat_iv.ogm_buff_mutex); +} +/** * batadv_iv_ogm_orig_update - use OGM to update corresponding data in an * originator
net/batman-adv/hard-interface.c +2 -0
@@ -28,6 +28,7 @@#include <linux/kernel.h> #include <linux/kref.h> #include <linux/list.h> +#include <linux/mutex.h> #include <linux/netdevice.h> #include <linux/printk.h> #include <linux/rculist.h>
@@ -901,6 +902,7 @@ batadv_hardif_add_interface(struct net_dINIT_LIST_HEAD (&hard_iface->list);INIT_HLIST_HEAD (&hard_iface->neigh_list); +mutex_init (&hard_iface->bat_iv.ogm_buff_mutex);spin_lock_init (&hard_iface->neigh_list_lock);kref_init (&hard_iface->refcount);
net/batman-adv/types.h +2 -0
@@ -82,11 +82,13 @@ enum batadv_dhcp_recipient {* @ogm_buff: buffer holding the OGM packet * @ogm_buff_len: length of the OGM packet buffer * @ogm_seqno: OGM sequence number - used to identify each OGM +* @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */ struct batadv_hard_iface_bat_iv {unsigned char *ogm_buff;int ogm_buff_len;atomic_t ogm_seqno; +struct mutex ogm_buff_mutex; };/**
Greg Kroah-Hartman
maintainerPATCH 81/99 batman-adv: Dont schedule OGM for disabled interface
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit 8e8ce08198de193e3d21d42e96945216e3d9ac7f upstream.
A transmission scheduling for an interface which is currently dropped by batadv_iv_ogm_iface_disable could still be in progress. The B.A.T.M.A.N. V is simply cancelling the workqueue item in an synchronous way but this is not possible with B.A.T.M.A.N. IV because the OGM submissions are intertwined.
Instead it has to stop submitting the OGM when it detect that the buffer pointer is set to NULL.
--- net/batman-adv/bat_iv_ogm.c | 4 ++++ 1 file changed, 4 insertions(+)
net/batman-adv/bat_iv_ogm.c +4 -0
@@ -961,6 +961,10 @@ static void batadv_iv_ogm_schedule_buff(lockdep_assert_held (&hard_iface->bat_iv.ogm_buff_mutex); +/* interface already disabled by batadv_iv_ogm_iface_disable */ +if (!*ogm_buff) +return ; +/* the interface gets activated here to avoid race conditions between * the moment of activating the interface in * hardif_activate_interface() where the originator mac is set and
Greg Kroah-Hartman
maintainerPATCH 82/99 perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag
In reply to Greg Kroah-HartmanFrom: Kim Phillips <[email protected]>
[ Upstream commit f967140dfb7442e2db0868b03b961f9c59418a1b ]
Enable the sampling check in kernel/events/core.c::perf_event_open(), which returns the more appropriate -EOPNOTSUPP.
BEFORE:
$ sudo perf record -a -e instructions,l3_request_g1.caching_l3_cache_accesses true Error: The sys_perf_event_open() syscall returned with 22 (Invalid argument) for event (l3_request_g1.caching_l3_cache_accesses). /bin/dmesg | grep -i perf may provide additional information.
With nothing relevant in dmesg.
AFTER:
$ sudo perf record -a -e instructions,l3_request_g1.caching_l3_cache_accesses true Error: l3_request_g1.caching_l3_cache_accesses: PMU Hardware doesn't support sampling/overflow-interrupts. Try 'perf stat'
--- arch/x86/events/amd/uncore.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
arch/x86/events/amd/uncore.c +7 -7
@@ -193,20 +193,18 @@ static int amd_uncore_event_init(struct perf_event *event)/* * NB and Last level cache counters (MSRs) are shared across all cores -* that share the same NB / Last level cache. Interrupts can be directed -* to a single target core, however, event counts generated by processes -* running on other cores cannot be masked out. So we do not support -* sampling and per-thread events. +* that share the same NB / Last level cache. On family 16h and below, +* Interrupts can be directed to a single target core, however, event +* counts generated by processes running on other cores cannot be masked +* out. So we do not support sampling and per-thread events via +* CAP_NO_INTERRUPT, and we do not enable counter overflow interrupts: */ -if (is_sampling_event (event) || event->attach_state &PERF_ATTACH_TASK ) -return -EINVAL ;/* NB and Last level cache counters do not have usr/os/guest/host bits */ if (event->attr.exclude_user || event->attr.exclude_kernel || event->attr.exclude_host || event->attr.exclude_guest)return -EINVAL ; -/* and we do not enable counter overflow interrupts */ hwc->config = event->attr.config &AMD64_RAW_EVENT_MASK_NB ; hwc->idx =-1 ;
@@ -314,6 +312,7 @@ static struct pmu amd_nb_pmu = { .start = amd_uncore_start, .stop = amd_uncore_stop, .read = amd_uncore_read, + .capabilities = PERF_PMU_CAP_NO_INTERRUPT, };static struct pmu amd_llc_pmu = {
@@ -324,6 +323,7 @@ static struct pmu amd_llc_pmu = { .start = amd_uncore_start, .stop = amd_uncore_stop, .read = amd_uncore_read, + .capabilities = PERF_PMU_CAP_NO_INTERRUPT, };static struct amd_uncore *amd_uncore_alloc (unsigned int cpu)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 83/99 ACPI: watchdog: Allow disabling WDAT at boot
In reply to Greg Kroah-HartmanFrom: Jean Delvare <[email protected]>
[ Upstream commit 3f9e12e0df012c4a9a7fd7eb0d3ae69b459d6b2c ]
In case the WDAT interface is broken, give the user an option to ignore it to let a native driver bind to the watchdog device instead.
--- Documentation/admin-guide/kernel-parameters.txt | 4 ++++ drivers/acpi/acpi_watchdog.c | 12 +++++++++++- 2 files changed, 15 insertions(+), 1 deletion(-)
Documentation/admin-guide/kernel-parameters.txt +4 -0
@@ -137,6 +137,10 @@ dynamic table installation which will install SSDT tables to /sys/firmware/acpi/tables/dynamic. + acpi_no_watchdog [HW,ACPI,WDT] + Ignore the ACPI-based watchdog interface (WDAT) and let + a native driver control the watchdog device instead. + acpi_rsdp= [ACPI,EFI,KEXEC] Pass the RSDP address to the kernel, mostly used on machines running EFI runtime service to boot the
drivers/acpi/acpi_watchdog.c +11 -1
@@ -58,12 +58,14 @@ static bool acpi_watchdog_uses_rtc(const struct acpi_table_wdat *wdat) }#endif +static bool acpi_no_watchdog; +static const struct acpi_table_wdat *acpi_watchdog_get_wdat (void ) {const struct acpi_table_wdat *wdat =NULL ;acpi_status status; -if (acpi_disabled) +if (acpi_disabled || acpi_no_watchdog)return NULL ; status = acpi_get_table(ACPI_SIG_WDAT, 0,
@@ -91,6 +93,14 @@ bool acpi_has_watchdog(void) }EXPORT_SYMBOL_GPL (acpi_has_watchdog); +/* ACPI watchdog can be disabled on boot command line */ +static int __init disable_acpi_watchdog (char *str) +{ + acpi_no_watchdog = true; +return 1 ; +} +__setup ("acpi_no_watchdog" , disable_acpi_watchdog); +void __init acpi_watchdog_init (void ) {const struct acpi_wdat_entry *entries;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 84/99 HID: apple: Add support for recent firmware on Magic Keyboards
In reply to Greg Kroah-HartmanFrom: Mansour Behabadi <[email protected]>
[ Upstream commit e433be929e63265b7412478eb7ff271467aee2d7 ]
Magic Keyboards with more recent firmware (0x0100) report Fn key differently. Without this patch, Fn key may not behave as expected and may not be configurable via hid_apple fnmode module parameter.
--- drivers/hid/hid-apple.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/hid/hid-apple.c +2 -1
@@ -343,7 +343,8 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi, unsigned long **bit, int *max) {if (usage->hid == (HID_UP_CUSTOM |0x0003 ) || - usage->hid == (HID_UP_MSVENDOR |0x0003 )) { + usage->hid == (HID_UP_MSVENDOR |0x0003 ) || + usage->hid == (HID_UP_HPVENDOR2 |0x0003 )) {/* The fn key on Apple USB keyboards */ set_bit (EV_REP , hi->input->evbit);hid_map_usage_clear (hi, usage, bit, max,EV_KEY ,KEY_FN );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 85/99 HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit be0aba826c4a6ba5929def1962a90d6127871969 ]
The Surfbook E11B uses the SIPODEV SP1064 touchpad, which does not supply descriptors, so it has to be added to the override list.
--- drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +8 -0
@@ -341,6 +341,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { }, .driver_data = (void *)&sipodev_desc }, + { + .ident = "Trekstor SURFBOOK E11B", + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"TREKSTOR" ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SURFBOOK E11B"), + }, + .driver_data = (void *)&sipodev_desc + }, { .ident ="Direkt-Tek DTLAPY116-2" , .matches = {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 86/99 cfg80211: check reg_rule for NULL in handle_channel_custom()
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit a7ee7d44b57c9ae174088e53a668852b7f4f452d ]
We may end up with a NULL reg_rule after the loop in handle_channel_custom() if the bandwidth didn't fit, check if this is the case and bail out if so.
--- net/wireless/reg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/reg.c +1 -1
@@ -1733,7 +1733,7 @@ static void handle_channel_custom(struct wiphy *wiphy,break ; } -if (IS_ERR (reg_rule)) { +if (IS_ERR_OR_NULL (reg_rule)) {pr_debug ("Disabling freq %d MHz as custom regd has no rule that fits it\n" , chan->center_freq);if (wiphy->regulatory_flags ®ULATORY_WIPHY_SELF_MANAGED ) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 87/99 scsi: libfc: free response frame from GPN_ID
In reply to Greg Kroah-HartmanFrom: Igor Druzhinin <[email protected]>
[ Upstream commit ff6993bb79b9f99bdac0b5378169052931b65432 ]
fc_disc_gpn_id_resp() should be the last function using it so free it here to avoid memory leak.
--- drivers/scsi/libfc/fc_disc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/libfc/fc_disc.c +2 -0
@@ -652,6 +652,8 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp, } out:kref_put (&rdata->kref, fc_rport_destroy); +if (!IS_ERR (fp)) +fc_frame_free (fp); }/**
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 88/99 net: usb: qmi_wwan: restore mtu min/max values after raw_ip switch
In reply to Greg Kroah-HartmanFrom: Daniele Palmas <[email protected]>
[ Upstream commit eae7172f8141eb98e64e6e81acc9e9d5b2add127 ]
usbnet creates network interfaces with min_mtu = 0 and max_mtu = ETH_MAX_MTU.
These values are not modified by qmi_wwan when the network interface is created initially, allowing, for example, to set mtu greater than 1500.
When a raw_ip switch is done (raw_ip set to 'Y', then set to 'N') the mtu values for the network interface are set through ether_setup, with min_mtu = ETH_MIN_MTU and max_mtu = ETH_DATA_LEN, not allowing anymore to set mtu greater than 1500 (error: mtu greater than device maximum).
The patch restores the original min/max mtu values set by usbnet after a raw_ip switch.
--- drivers/net/usb/qmi_wwan.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/usb/qmi_wwan.c +3 -0
@@ -274,6 +274,9 @@ static void qmi_wwan_netdev_setup(struct net_device *net)netdev_dbg (net,"mode: raw IP\n" ); }else if (!net->header_ops) {/* don't bother if already set */ ether_setup (net); +/* Restoring min/max mtu values set originally by usbnet */ + net->min_mtu =0 ; + net->max_mtu =ETH_MAX_MTU ;clear_bit (EVENT_NO_IP_ALIGN , &dev->flags);netdev_dbg (net,"mode: Ethernet\n" ); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 89/99 net: ks8851-ml: Fix IRQ handling and locking
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 44343418d0f2f623cb9da6f5000df793131cbe3b ]
The KS8851 requires that packet RX and TX are mutually exclusive. Currently, the driver hopes to achieve this by disabling interrupt from the card by writing the card registers and by disabling the interrupt on the interrupt controller. This however is racy on SMP.
Replace this approach by expanding the spinlock used around the ks_start_xmit() TX path to ks_irq() RX path to assure true mutual exclusion and remove the interrupt enabling/disabling, which is now not needed anymore. Furthermore, disable interrupts also in ks_net_stop(), which was missing before.
Note that a massive improvement here would be to re-use the KS8851 driver approach, which is to move the TX path into a worker thread, interrupt handling to threaded interrupt, and synchronize everything with mutexes, but that would be a much bigger rework, for a separate patch.
--- drivers/net/ethernet/micrel/ks8851_mll.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/ethernet/micrel/ks8851_mll.c +8 -6
@@ -831,14 +831,17 @@ static irqreturn_t ks_irq(int irq, void *pw) {struct net_device *netdev = pw;struct ks_net *ks =netdev_priv (netdev); +unsigned long flags;u16 status; +spin_lock_irqsave (&ks->statelock, flags);/*this should be the first in IRQ handler */ ks_save_cmd_reg (ks); status =ks_rdreg16 (ks,KS_ISR );if (unlikely (!status)) {ks_restore_cmd_reg (ks); +spin_unlock_irqrestore (&ks->statelock, flags);return IRQ_NONE ; }
@@ -864,6 +867,7 @@ static irqreturn_t ks_irq(int irq, void *pw) ks->netdev->stats.rx_over_errors++;/* this should be the last in IRQ handler*/ ks_restore_cmd_reg (ks); +spin_unlock_irqrestore (&ks->statelock, flags);return IRQ_HANDLED ; }
@@ -933,6 +937,7 @@ static int ks_net_stop(struct net_device *netdev)/* shutdown RX/TX QMU */ ks_disable_qmu (ks); +ks_disable_int (ks);/* set powermode to soft power down to save power */ ks_set_powermode (ks,PMECR_PM_SOFTDOWN );
@@ -989,10 +994,9 @@ static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev) {netdev_tx_t retv =NETDEV_TX_OK ;struct ks_net *ks =netdev_priv (netdev); +unsigned long flags; -disable_irq (netdev->irq); -ks_disable_int (ks); -spin_lock (&ks->statelock); +spin_lock_irqsave (&ks->statelock, flags);/* Extra space are required: * 4 byte for alignment, 4 for status/length, 4 for CRC
@@ -1006,9 +1010,7 @@ static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev)dev_kfree_skb (skb); }else retv =NETDEV_TX_BUSY ; -spin_unlock (&ks->statelock); -ks_enable_int (ks); -enable_irq (netdev->irq); +spin_unlock_irqrestore (&ks->statelock, flags);return retv; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 90/99 mac80211: rx: avoid RCU list traversal under mutex
In reply to Greg Kroah-HartmanFrom: Madhuparna Bhowmik <[email protected]>
[ Upstream commit 253216ffb2a002a682c6f68bd3adff5b98b71de8 ]
local->sta_mtx is held in __ieee80211_check_fast_rx_iface(). No need to use list_for_each_entry_rcu() as it also requires a cond argument to avoid false lockdep warnings when not used in RCU read-side section (with CONFIG_PROVE_RCU_LIST). Therefore use list_for_each_entry();
--- net/mac80211/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/rx.c +1 -1
@@ -3862,7 +3862,7 @@ void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)lockdep_assert_held (&local->sta_mtx); -list_for_each_entry_rcu (sta, &local->sta_list, list) { +list_for_each_entry (sta, &local->sta_list, list) {if (sdata != sta->sdata && (!sta->sdata->bss || sta->sdata->bss != sdata->bss))continue ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 91/99 signal: avoid double atomic counter increments for user accounting
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
[ Upstream commit fda31c50292a5062332fa0343c084bd9f46604d9 ]
When queueing a signal, we increment both the users count of pending signals (for RLIMIT_SIGPENDING tracking) and we increment the refcount of the user struct itself (because we keep a reference to the user in the signal structure in order to correctly account for it when freeing).
That turns out to be fairly expensive, because both of them are atomic updates, and particularly under extreme signal handling pressure on big machines, you can get a lot of cache contention on the user struct. That can then cause horrid cacheline ping-pong when you do these multiple accesses.
So change the reference counting to only pin the user for the _first_ pending signal, and to unpin it when the last pending signal is dequeued. That means that when a user sees a lot of concurrent signal queuing - which is the only situation when this matters - the only atomic access needed is generally the 'sigpending' count update.
This was noticed because of a particularly odd timing artifact on a dual-socket 96C/192T Cascade Lake platform: when you get into bad contention, on that machine for some reason seems to be much worse when the contention happens in the upper 32-byte half of the cacheline.
As a result, the kernel test robot will-it-scale 'signal1' benchmark had an odd performance regression simply due to random alignment of the 'struct user_struct' (and pointed to a completely unrelated and apparently nonsensical commit for the regression).
Avoiding the double increments (and decrements on the dequeueing side, of course) makes for much less contention and hugely improved performance on that will-it-scale microbenchmark.
Quoting Feng Tang:
"It makes a big difference, that the performance score is tripled! bump
from original 17000 to 54000. Also the gap between 5.0-rc6 and 5.0-rc6+Jiri's patch is reduced to around 2%"
[ The "2% gap" is the odd cacheline placement difference on that
platform: under the extreme contention case, the effect of which half of the cacheline was hot was 5%, so with the reduced contention the odd timing artifact is reduced too ]
It does help in the non-contended case too, but is not nearly as noticeable.
--- kernel/signal.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
kernel/signal.c +14 -9
@@ -379,27 +379,32 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi {struct sigqueue *q =NULL ;struct user_struct *user; +int sigpending;/* * Protect access to @t credentials. This can go away when all * callers hold rcu read lock. +* +* NOTE! A pending signal will hold on to the user refcount, +* and we get/put the refcount only when the sigpending count +* changes from/to zero. */ rcu_read_lock (); - user =get_uid (__task_cred (t)->user); -atomic_inc (&user->sigpending); + user =__task_cred (t)->user; + sigpending =atomic_inc_return (&user->sigpending); +if (sigpending ==1 ) +get_uid (user);rcu_read_unlock (); -if (override_rlimit || -atomic_read (&user->sigpending) <= -task_rlimit (t,RLIMIT_SIGPENDING )) { +if (override_rlimit ||likely (sigpending <=task_rlimit (t,RLIMIT_SIGPENDING ))) { q =kmem_cache_alloc (sigqueue_cachep, flags); }else {print_dropped_signal (sig); }if (unlikely (q ==NULL )) { -atomic_dec (&user->sigpending); -free_uid (user); +if (atomic_dec_and_test (&user->sigpending)) +free_uid (user); }else {INIT_LIST_HEAD (&q->list); q->flags =0 ;
@@ -413,8 +418,8 @@ static void __sigqueue_free(struct sigqueue *q) {if (q->flags &SIGQUEUE_PREALLOC )return ; -atomic_dec (&q->user->sigpending); -free_uid (q->user); +if (atomic_dec_and_test (&q->user->sigpending)) +free_uid (q->user);kmem_cache_free (sigqueue_cachep, q); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 92/99 slip: not call free_netdev before rtnl_unlock in slip_open
In reply to Greg Kroah-HartmanFrom: yangerkun <[email protected]>
[ Upstream commit f596c87005f7b1baeb7d62d9a9e25d68c3dfae10 ]
As the description before netdev_run_todo, we cannot call free_netdev before rtnl_unlock, fix it by reorder the code.
--- drivers/net/slip/slip.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/slip/slip.c +3 -0
@@ -867,7 +867,10 @@ static int slip_open(struct tty_struct *tty) tty->disc_data =NULL ;clear_bit (SLF_INUSE , &sl->flags);sl_free_netdev (sl->dev); +/* do not call free_netdev before rtnl_unlock */ +rtnl_unlock ();free_netdev (sl->dev); +return err; err_exit:rtnl_unlock ();
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 93/99 hinic: fix a bug of setting hw_ioctxt
In reply to Greg Kroah-HartmanFrom: Luo bin <[email protected]>
[ Upstream commit d2ed69ce9ed3477e2a9527e6b89fe4689d99510e ]
a reserved field is used to signify prime physical function index in the latest firmware version, so we must assign a value to it correctly
--- drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c | 1 + drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h | 2 +- drivers/net/ethernet/huawei/hinic/hinic_hw_if.h | 1 + 3 files changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c +1 -0
@@ -312,6 +312,7 @@ static int set_hw_ioctxt(struct hinic_hwdev *hwdev, unsigned int rq_depth, } hw_ioctxt.func_idx =HINIC_HWIF_FUNC_IDX (hwif); + hw_ioctxt.ppf_idx =HINIC_HWIF_PPF_IDX (hwif); hw_ioctxt.set_cmdq_depth =HW_IOCTXT_SET_CMDQ_DEPTH_DEFAULT ; hw_ioctxt.cmdq_depth =0 ;
drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h +1 -1
@@ -104,8 +104,8 @@ struct hinic_cmd_hw_ioctxt {u8 rsvd2;u8 rsvd3; +u8 ppf_idx;u8 rsvd4; -u8 rsvd5;u16 rq_depth;u16 rx_buf_sz_idx;
drivers/net/ethernet/huawei/hinic/hinic_hw_if.h +1 -0
@@ -146,6 +146,7 @@#define HINIC_HWIF_FUNC_IDX (hwif) ((hwif)->attr.func_idx)#define HINIC_HWIF_PCI_INTF (hwif) ((hwif)->attr.pci_intf_idx)#define HINIC_HWIF_PF_IDX (hwif) ((hwif)->attr.pf_idx) +#define HINIC_HWIF_PPF_IDX (hwif) ((hwif)->attr.ppf_idx)#define HINIC_FUNC_TYPE (hwif) ((hwif)->attr.func_type)#define HINIC_IS_PF (hwif) (HINIC_FUNC_TYPE(hwif) == HINIC_PF)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 94/99 net: rmnet: fix NULL pointer dereference in rmnet_newlink()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 93b5cbfa9636d385126f211dca9efa7e3f683202 ]
rmnet registers IFLA_LINK interface as a lower interface. But, IFLA_LINK could be NULL.
In the current code, rmnet doesn't check IFLA_LINK. So, panic would occur.
Test commands:
modprobe rmnet
ip link add rmnet0 type rmnet mux_id 1
Splat looks like:
[ 36.826109][ T1115] general protection fault, probably for non-canonical address 0xdffffc0000000000I [ 36.838817][ T1115] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 36.839908][ T1115] CPU: 1 PID: 1115 Comm: ip Not tainted 5.6.0-rc1+ #447 [ 36.840569][ T1115] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 36.841408][ T1115] RIP: 0010:rmnet_newlink+0x54/0x510 [rmnet] [ 36.841986][ T1115] Code: 83 ec 18 48 c1 e9 03 80 3c 01 00 0f 85 d4 03 00 00 48 8b 6a 28 48 b8 00 00 00 00 00 c [ 36.843923][ T1115] RSP: 0018:ffff8880b7e0f1c0 EFLAGS: 00010247 [ 36.844756][ T1115] RAX: dffffc0000000000 RBX: ffff8880d14cca00 RCX: 1ffff11016fc1e99 [ 36.845859][ T1115] RDX: 0000000000000000 RSI: ffff8880c3d04000 RDI: 0000000000000004 [ 36.846961][ T1115] RBP: 0000000000000000 R08: ffff8880b7e0f8b0 R09: ffff8880b6ac2d90 [ 36.848020][ T1115] R10: ffffffffc0589a40 R11: ffffed1016d585b7 R12: ffffffff88ceaf80 [ 36.848788][ T1115] R13: ffff8880c3d04000 R14: ffff8880b7e0f8b0 R15: ffff8880c3d04000 [ 36.849546][ T1115] FS: 00007f50ab3360c0(0000) GS:ffff8880da000000(0000) knlGS:0000000000000000 [ 36.851784][ T1115] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.852422][ T1115] CR2: 000055871afe5ab0 CR3: 00000000ae246001 CR4: 00000000000606e0 [ 36.853181][ T1115] Call Trace: [ 36.853514][ T1115] __rtnl_newlink+0xbdb/0x1270 [ 36.853967][ T1115] ? lock_downgrade+0x6e0/0x6e0 [ 36.854420][ T1115] ? rtnl_link_unregister+0x220/0x220 [ 36.854936][ T1115] ? lock_acquire+0x164/0x3b0 [ 36.855376][ T1115] ? is_bpf_image_address+0xff/0x1d0 [ 36.855884][ T1115] ? rtnl_newlink+0x4c/0x90 [ 36.856304][ T1115] ? kernel_text_address+0x111/0x140 [ 36.856857][ T1115] ? __kernel_text_address+0xe/0x30 [ 36.857440][ T1115] ? unwind_get_return_address+0x5f/0xa0 [ 36.858063][ T1115] ? create_prof_cpu_mask+0x20/0x20 [ 36.858644][ T1115] ? arch_stack_walk+0x83/0xb0 [ 36.859171][ T1115] ? stack_trace_save+0x82/0xb0 [ 36.859710][ T1115] ? stack_trace_consume_entry+0x160/0x160 [ 36.860357][ T1115] ? deactivate_slab.isra.78+0x2c5/0x800 [ 36.860928][ T1115] ? kasan_unpoison_shadow+0x30/0x40 [ 36.861520][ T1115] ? kmem_cache_alloc_trace+0x135/0x350 [ 36.862125][ T1115] ? rtnl_newlink+0x4c/0x90 [ 36.864073][ T1115] rtnl_newlink+0x65/0x90
[ ... ]
--- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c +5 -0
@@ -157,6 +157,11 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,int err =0 ;u16 mux_id; +if (!tb[IFLA_LINK ]) { +NL_SET_ERR_MSG_MOD (extack,"link not specified" ); +return -EINVAL ; + } + real_dev =__dev_get_by_index (src_net,nla_get_u32 (tb[IFLA_LINK ]));if (!real_dev || !dev)return -ENODEV ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 95/99 jbd2: fix data races at struct journal_head
In reply to Greg Kroah-HartmanFrom: Qian Cai <[email protected]>
[ Upstream commit 6c5d911249290f41f7b50b43344a7520605b1acb ]
journal_head::b_transaction and journal_head::b_next_transaction could be accessed concurrently as noticed by KCSAN,
LTP: starting fsync04
/dev/zero: Can't open blockdev
EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem EXT4-fs (loop0): mounted filesystem with ordered data mode. Opts: (null)
==================================================================
BUG: KCSAN: data-race in __jbd2_journal_refile_buffer [jbd2] / jbd2_write_access_granted [jbd2]
write to 0xffff99f9b1bd0e30 of 8 bytes by task 25721 on cpu 70:
__jbd2_journal_refile_buffer+0xdd/0x210 [jbd2] __jbd2_journal_refile_buffer at fs/jbd2/transaction.c:2569 jbd2_journal_commit_transaction+0x2d15/0x3f20 [jbd2] (inlined by) jbd2_journal_commit_transaction at fs/jbd2/commit.c:1034 kjournald2+0x13b/0x450 [jbd2] kthread+0x1cd/0x1f0 ret_from_fork+0x27/0x50
read to 0xffff99f9b1bd0e30 of 8 bytes by task 25724 on cpu 68:
jbd2_write_access_granted+0x1b2/0x250 [jbd2] jbd2_write_access_granted at fs/jbd2/transaction.c:1155 jbd2_journal_get_write_access+0x2c/0x60 [jbd2] __ext4_journal_get_write_access+0x50/0x90 [ext4] ext4_mb_mark_diskspace_used+0x158/0x620 [ext4] ext4_mb_new_blocks+0x54f/0xca0 [ext4] ext4_ind_map_blocks+0xc79/0x1b40 [ext4] ext4_map_blocks+0x3b4/0x950 [ext4] _ext4_get_block+0xfc/0x270 [ext4] ext4_get_block+0x3b/0x50 [ext4] __block_write_begin_int+0x22e/0xae0 __block_write_begin+0x39/0x50 ext4_write_begin+0x388/0xb50 [ext4] generic_perform_write+0x15d/0x290 ext4_buffered_write_iter+0x11f/0x210 [ext4] ext4_file_write_iter+0xce/0x9e0 [ext4] new_sync_write+0x29c/0x3b0 __vfs_write+0x92/0xa0 vfs_write+0x103/0x260 ksys_write+0x9d/0x130 __x64_sys_write+0x4c/0x60 do_syscall_64+0x91/0xb05 entry_SYSCALL_64_after_hwframe+0x49/0xbe
5 locks held by fsync04/25724:
#0: ffff99f9911093f8 (sb_writers#13){.+.+}, at: vfs_write+0x21c/0x260
#1: ffff99f9db4c0348 (&sb->s_type->i_mutex_key#15){+.+.}, at: ext4_buffered_write_iter+0x65/0x210 [ext4] #2: ffff99f5e7dfcf58 (jbd2_handle){++++}, at: start_this_handle+0x1c1/0x9d0 [jbd2]
#3: ffff99f9db4c0168 (&ei->i_data_sem){++++}, at: ext4_map_blocks+0x176/0x950 [ext4] #4: ffffffff99086b40 (rcu_read_lock){....}, at: jbd2_write_access_granted+0x4e/0x250 [jbd2]
irq event stamp: 1407125 hardirqs last enabled at (1407125): [<ffffffff980da9b7>] __find_get_block+0x107/0x790 hardirqs last disabled at (1407124): [<ffffffff980da8f9>] __find_get_block+0x49/0x790 softirqs last enabled at (1405528): [<ffffffff98a0034c>] __do_softirq+0x34c/0x57c softirqs last disabled at (1405521): [<ffffffff97cc67a2>] irq_exit+0xa2/0xc0
Reported by Kernel Concurrency Sanitizer on:
CPU: 68 PID: 25724 Comm: fsync04 Tainted: G L 5.6.0-rc2-next-20200221+ #7 Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 07/10/2019
The plain reads are outside of jh->b_state_lock critical section which result in data races. Fix them by adding pairs of READ|WRITE_ONCE().
--- fs/jbd2/transaction.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/jbd2/transaction.c +4 -4
@@ -1050,8 +1050,8 @@ static bool jbd2_write_access_granted(handle_t *handle, struct buffer_head *bh,/* For undo access buffer must have data copied */ if (undo && !jh->b_committed_data) goto out; -if (jh->b_transaction != handle->h_transaction && - jh->b_next_transaction != handle->h_transaction) +if (READ_ONCE (jh->b_transaction) != handle->h_transaction && +READ_ONCE (jh->b_next_transaction) != handle->h_transaction) goto out;/* * There are two reasons for the barrier here:
@@ -2466,8 +2466,8 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)* our jh reference and thus __jbd2_journal_file_buffer() must not * take a new one. */ - jh->b_transaction = jh->b_next_transaction; - jh->b_next_transaction =NULL ; +WRITE_ONCE (jh->b_transaction, jh->b_next_transaction); +WRITE_ONCE (jh->b_next_transaction,NULL );if (buffer_freed (bh)) jlist = BJ_Forget;else if (jh->b_modified)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 96/99 ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional()
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit 45939ce292b4b11159719faaf60aba7d58d5fe33 upstream.
It is possible for a system with an ARMv8 timer to run a 32-bit kernel. When this happens we will unconditionally have the vDSO code remove the __vdso_gettimeofday and __vdso_clock_gettime symbols because cntvct_functional() returns false since it does not match that compatibility string.
--- arch/arm/kernel/vdso.c | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/kernel/vdso.c +2 -0
@@ -104,6 +104,8 @@ static bool __init cntvct_functional(voi*/ np =of_find_compatible_node (NULL ,NULL ,"arm,armv7-timer" );if (!np) + np =of_find_compatible_node (NULL ,NULL ,"arm,armv8-timer" ); +if (!np) goto out_put;if (of_property_read_bool (np,"arm,cpu-registers-not-fw-configured" ))
Greg Kroah-Hartman
maintainerPATCH 97/99 ARM: 8958/1: rename missed uaccess .fixup section
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit f87b1c49bc675da30d8e1e8f4b60b800312c7b90 upstream.
When the uaccess .fixup section was renamed to .text.fixup, one case was missed. Under ld.bfd, the orphaned section was moved close to .text (since they share the "ax" bits), so things would work normally on uaccess faults. Under ld.lld, the orphaned section was placed outside the .text section, making it unreachable.
--- arch/arm/lib/copy_from_user.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/lib/copy_from_user.S +1 -1
@@ -100,7 +100,7 @@ ENTRY(arm_copy_from_user) ENDPROC(arm_copy_from_user) - .pushsection .fixup,"ax" + .pushsection .text.fixup,"ax" .align 0 copy_abort_preamble ldmfd sp!, {r1, r2, r3}
Greg Kroah-Hartman
maintainerPATCH 98/99 mm: slub: add missing TID bump in kmem_cache_alloc_bulk()
In reply to Greg Kroah-HartmanFrom: Jann Horn <[email protected]>
commit fd4d9c7d0c71866ec0c2825189ebd2ce35bd95b8 upstream.
When kmem_cache_alloc_bulk() attempts to allocate N objects from a percpu freelist of length M, and N > M > 0, it will first remove the M elements from the percpu freelist, then call ___slab_alloc() to allocate the next element and repopulate the percpu freelist. ___slab_alloc() can re-enable IRQs via allocate_slab(), so the TID must be bumped before ___slab_alloc() to properly commit the freelist head change.
Fix it by unconditionally bumping c->tid when entering the slowpath.
--- mm/slub.c | 9 +++++++++ 1 file changed, 9 insertions(+)
mm/slub.c +9 -0
@@ -3123,6 +3123,15 @@ int kmem_cache_alloc_bulk(struct kmem_caif (unlikely (!object)) {/* +* We may have removed an object from c->freelist using +* the fastpath in the previous iteration; in that case, +* c->tid has not been bumped yet. +* Since ___slab_alloc() may reenable interrupts while +* allocating memory, we should bump c->tid now. +*/ + c->tid =next_tid (c->tid); + +/* * Invoking slow path likely have side-effect * of re-populating per CPU c->freelist */
Greg Kroah-Hartman
maintainerPATCH 99/99 ipv4: ensure rcu_read_lock() in cipso_v4_error()
In reply to Greg Kroah-HartmanFrom: Matteo Croce <[email protected]>
commit 3e72dfdf8227b052393f71d820ec7599909dddc2 upstream.
Similarly to commit c543cb4a5f07 ("ipv4: ensure rcu_read_lock() in ipv4_link_failure()"), __ip_options_compile() must be called under rcu protection.
--- net/ipv4/cipso_ipv4.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/ipv4/cipso_ipv4.c +6 -1
@@ -1738,6 +1738,7 @@ void cipso_v4_error(struct sk_buff *skb, {unsigned char optbuf[sizeof (struct ip_options ) +40 ];struct ip_options *opt = (struct ip_options *)optbuf; +int res;if (ip_hdr (skb)->protocol ==IPPROTO_ICMP || error != -EACCES )return ;
@@ -1749,7 +1750,11 @@ void cipso_v4_error(struct sk_buff *skb,memset (opt,0 ,sizeof (struct ip_options )); opt->optlen =ip_hdr (skb)->ihl*4 -sizeof (struct iphdr ); -if (__ip_options_compile (dev_net (skb->dev), opt, skb,NULL )) +rcu_read_lock (); + res =__ip_options_compile (dev_net (skb->dev), opt, skb,NULL ); +rcu_read_unlock (); + +if (res)return ;if (gateway)
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.174 release. There are 99 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 21 Mar 2020 12:37:04 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.174-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.14.174-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: 5510299b1b08a51cf5805bd223de3e9453900d9b
git describe: v4.14.173-100-g5510299b1b08
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.14-oe/build/v4.14.173-100-g5510299b1b08
No regressions (compared to build v4.14.173)
No fixes (compared to build v4.14.173)
Ran 22239 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- juno-r2-compat
- juno-r2-kasan
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
- x86-kasan
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* install-android-platform-tools-r2800
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* v4l2-compliance
* ltp-fs-tests
* ltp-hugetlb-tests
* ltp-mm-tests
* ltp-sched-tests
* network-basic-tests
* spectre-meltdown-checker-test
* kvm-unit-tests
* kselftest
* ltp-open-posix-tests
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.174 release. There are 99 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 21 Mar 2020 12:37:04 +0000. Anything received after that time might be too late.
Build results:
total: 156 pass: 156 fail: 0 Qemu test results: total: 418 pass: 418 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.174 release. There are 99 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 21 Mar 2020 12:37:04 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.174-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah