4.14.316-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainerPATCH 1/86 net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit dfd9248c071a3710c24365897459538551cb7167 ]
KCSAN found a data race in sock_recv_cmsgs() where the read access to sk->sk_stamp needs READ_ONCE().
BUG: KCSAN: data-race in packet_recvmsg / packet_recvmsg
write (marked) to 0xffff88803c81f258 of 8 bytes by task 19171 on cpu 0:
sock_write_timestamp include/net/sock.h:2670 [inline] sock_recv_cmsgs include/net/sock.h:2722 [inline] packet_recvmsg+0xb97/0xd00 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:1019 [inline] sock_recvmsg+0x11a/0x130 net/socket.c:1040 sock_read_iter+0x176/0x220 net/socket.c:1118 call_read_iter include/linux/fs.h:1845 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x5e0/0x630 fs/read_write.c:470 ksys_read+0x163/0x1a0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x41/0x50 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc
read to 0xffff88803c81f258 of 8 bytes by task 19183 on cpu 1:
sock_recv_cmsgs include/net/sock.h:2721 [inline] packet_recvmsg+0xb64/0xd00 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:1019 [inline] sock_recvmsg+0x11a/0x130 net/socket.c:1040 sock_read_iter+0x176/0x220 net/socket.c:1118 call_read_iter include/linux/fs.h:1845 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x5e0/0x630 fs/read_write.c:470 ksys_read+0x163/0x1a0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x41/0x50 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc
value changed: 0xffffffffc4653600 -> 0x0000000000000000
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 19183 Comm: syz-executor.5 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
--- include/net/sock.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/sock.h +1 -1
@@ -2317,7 +2317,7 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,__sock_recv_ts_and_drops (msg, sk, skb); else if (unlikely(sock_flag(sk, SOCK_TIMESTAMP))) sock_write_timestamp(sk, skb->tstamp); - else if (unlikely(sk->sk_stamp == SK_DEFAULT_STAMP)) + else if (unlikely(sock_read_timestamp(sk) == SK_DEFAULT_STAMP)) sock_write_timestamp(sk, 0); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 10/86 drm/tegra: Avoid potential 32-bit integer overflow
In reply to Greg Kroah-HartmanFrom: Nur Hussein <[email protected]>
[ Upstream commit 2429b3c529da29d4277d519bd66d034842dcd70c ]
In tegra_sor_compute_config(), the 32-bit value mode->clock is multiplied by 1000, and assigned to the u64 variable pclk. We can avoid a potential 32-bit integer overflow by casting mode->clock to u64 before we do the arithmetic and assignment.
--- drivers/gpu/drm/tegra/sor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/tegra/sor.c +1 -1
@@ -709,7 +709,7 @@ static int tegra_sor_compute_config(struct tegra_sor *sor, struct drm_dp_link *link) {const u64 f =100000 , link_rate = link->rate *1000 ; -const u64 pclk = mode->clock *1000 ; +const u64 pclk = (u64 )mode->clock *1000 ;u64 input, output, watermark, num;struct tegra_sor_params params;u32 num_syms_per_line;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/86 ACPICA: Avoid undefined behavior: applying zero offset to null pointer
In reply to Greg Kroah-HartmanFrom: Tamir Duberstein <[email protected]>
[ Upstream commit 05bb0167c80b8f93c6a4e0451b7da9b96db990c2 ]
ACPICA commit 770653e3ba67c30a629ca7d12e352d83c2541b1e
Before this change we see the following UBSAN stack trace in Fuchsia:
#0 0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 <platform-bus-x86.so>+0x233302 #1.2 0x000020d0f660777f in ubsan_get_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:41 <libclang_rt.asan.so>+0x3d77f #1.1 0x000020d0f660777f in maybe_print_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:51 <libclang_rt.asan.so>+0x3d77f #1 0x000020d0f660777f in ~scoped_report() compiler-rt/lib/ubsan/ubsan_diag.cpp:387 <libclang_rt.asan.so>+0x3d77f #2 0x000020d0f660b96d in handlepointer_overflow_impl() compiler-rt/lib/ubsan/ubsan_handlers.cpp:809 <libclang_rt.asan.so>+0x4196d #3 0x000020d0f660b50d in compiler-rt/lib/ubsan/ubsan_handlers.cpp:815 <libclang_rt.asan.so>+0x4150d #4 0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 <platform-bus-x86.so>+0x233302 #5 0x000021e4213e2369 in acpi_ds_call_control_method(struct acpi_thread_state*, struct acpi_walk_state*, union acpi_parse_object*) ../../third_party/acpica/source/components/dispatcher/dsmethod.c:605 <platform-bus-x86.so>+0x262369 #6 0x000021e421437fac in acpi_ps_parse_aml(struct acpi_walk_state*) ../../third_party/acpica/source/components/parser/psparse.c:550 <platform-bus-x86.so>+0x2b7fac #7 0x000021e4214464d2 in acpi_ps_execute_method(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/parser/psxface.c:244 <platform-bus-x86.so>+0x2c64d2 #8 0x000021e4213aa052 in acpi_ns_evaluate(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/namespace/nseval.c:250 <platform-bus-x86.so>+0x22a052 #9 0x000021e421413dd8 in acpi_ns_init_one_device(acpi_handle, u32, void*, void**) ../../third_party/acpica/source/components/namespace/nsinit.c:735 <platform-bus-x86.so>+0x293dd8 #10 0x000021e421429e98 in acpi_ns_walk_namespace(acpi_object_type, acpi_handle, u32, u32, acpi_walk_callback, acpi_walk_callback, void*, void**) ../../third_party/acpica/source/components/namespace/nswalk.c:298 <platform-bus-x86.so>+0x2a9e98 #11 0x000021e4214131ac in acpi_ns_initialize_devices(u32) ../../third_party/acpica/source/components/namespace/nsinit.c:268 <platform-bus-x86.so>+0x2931ac #12 0x000021e42147c40d in acpi_initialize_objects(u32) ../../third_party/acpica/source/components/utilities/utxfinit.c:304 <platform-bus-x86.so>+0x2fc40d #13 0x000021e42126d603 in acpi::acpi_impl::initialize_acpi(acpi::acpi_impl*) ../../src/devices/board/lib/acpi/acpi-impl.cc:224 <platform-bus-x86.so>+0xed603
Add a simple check that avoids incrementing a pointer by zero, but otherwise behaves as before. Note that our findings are against ACPICA 20221020, but the same code exists on master.
--- drivers/acpi/acpica/dswstate.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/acpi/acpica/dswstate.c +8 -3
@@ -610,9 +610,14 @@ acpi_ds_init_aml_walk(struct acpi_walk_state *walk_state,ACPI_FUNCTION_TRACE (ds_init_aml_walk); walk_state->parser_state.aml = - walk_state->parser_state.aml_start = aml_start; - walk_state->parser_state.aml_end = - walk_state->parser_state.pkg_end = aml_start + aml_length; + walk_state->parser_state.aml_start = + walk_state->parser_state.aml_end = + walk_state->parser_state.pkg_end = aml_start; +/* Avoid undefined behavior: applying zero offset to null pointer */ +if (aml_length !=0 ) { + walk_state->parser_state.aml_end += aml_length; + walk_state->parser_state.pkg_end += aml_length; + }/* The next_op of the next_walk will be the beginning of the method */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 12/86 ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects
In reply to Greg Kroah-HartmanFrom: void0red <[email protected]>
[ Upstream commit ae5a0eccc85fc960834dd66e3befc2728284b86c ]
ACPICA commit 0d5f467d6a0ba852ea3aad68663cbcbd43300fd4
ACPI_ALLOCATE_ZEROED may fails, object_info might be null and will cause null pointer dereference later.
--- drivers/acpi/acpica/dbnames.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/acpica/dbnames.c +3 -0
@@ -600,6 +600,9 @@ acpi_status acpi_db_display_objects(char *obj_type_arg, char *display_count_arg) object_info =ACPI_ALLOCATE_ZEROED (sizeof (struct acpi_object_info )); +if (!object_info) +return (AE_NO_MEMORY ); +/* Walk the namespace from the root */ (void)acpi_walk_namespace(ACPI_TYPE_ANY, ACPI_ROOT_OBJECT,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 13/86 wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
In reply to Greg Kroah-HartmanFrom: Hector Martin <[email protected]>
[ Upstream commit 89b89e52153fda2733562776c7c9d9d3ebf8dd6d ]
Apparently the hex passphrase mechanism does not work on newer chips/firmware (e.g. BCM4387). It seems there was a simple way of passing it in binary all along, so use that and avoid the hexification.
OpenBSD has been doing it like this from the beginning, so this should work on all chips.
Also clear the structure before setting the PMK. This was leaking uninitialized stack contents to the device.
--- .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +7 -6
@@ -1349,13 +1349,14 @@ static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)static int brcmf_set_pmk (struct brcmf_if *ifp,const u8 *pmk_data,u16 pmk_len) {struct brcmf_wsec_pmk_le pmk; -int i, err; +int err; + +memset (&pmk,0 ,sizeof (pmk)); -/* convert to firmware key format */ - pmk.key_len =cpu_to_le16 (pmk_len <<1 ); - pmk.flags =cpu_to_le16 (BRCMF_WSEC_PASSPHRASE ); -for (i =0 ; i < pmk_len; i++) -snprintf (&pmk.key[2 * i],3 ,"%02x" , pmk_data[i]); +/* pass pmk directly */ + pmk.key_len =cpu_to_le16 (pmk_len); + pmk.flags =cpu_to_le16 (0 ); +memcpy (pmk.key, pmk_data, pmk_len);/* store psk in firmware */ err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 14/86 ext2: Check block size validity during mount
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit 62aeb94433fcec80241754b70d0d1836d5926b0a ]
Check that log of block size stored in the superblock has sensible value. Otherwise the shift computing the block size can overflow leading to undefined behavior.
--- fs/ext2/ext2.h | 1 + fs/ext2/super.c | 7 +++++++ 2 files changed, 8 insertions(+)
fs/ext2/ext2.h +1 -0
@@ -177,6 +177,7 @@ static inline struct ext2_sb_info *EXT2_SB(struct super_block *sb)#define EXT2_MIN_BLOCK_SIZE 1024#define EXT2_MAX_BLOCK_SIZE 4096#define EXT2_MIN_BLOCK_LOG_SIZE 10 +#define EXT2_MAX_BLOCK_LOG_SIZE 16#define EXT2_BLOCK_SIZE (s) ((s)->s_blocksize)#define EXT2_ADDR_PER_BLOCK (s) (EXT2_BLOCK_SIZE(s) / sizeof (__u32))#define EXT2_BLOCK_SIZE_BITS (s) ((s)->s_blocksize_bits)
fs/ext2/super.c +7 -0
@@ -965,6 +965,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) goto failed_mount; } +if (le32_to_cpu (es->s_log_block_size) > + (EXT2_MAX_BLOCK_LOG_SIZE -BLOCK_SIZE_BITS )) { +ext2_msg (sb,KERN_ERR , +"Invalid log block size: %u" , +le32_to_cpu (es->s_log_block_size)); + goto failed_mount; + } blocksize =BLOCK_SIZE <<le32_to_cpu (sbi->s_es->s_log_block_size);if (sbi->s_mount_opt &EXT2_MOUNT_DAX ) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 15/86 net: pasemi: Fix return type of pasemi_mac_start_tx()
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit c8384d4a51e7cb0e6587f3143f29099f202c5de1 ]
With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. A warning in clang aims to catch these at compile time, which reveals:
drivers/net/ethernet/pasemi/pasemi_mac.c:1665:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict]
.ndo_start_xmit = pasemi_mac_start_tx,
^~~~~~~~~~~~~~~~~~~
1 error generated.
->ndo_start_xmit() in 'struct net_device_ops' expects a return type of 'netdev_tx_t', not 'int'. Adjust the return type of pasemi_mac_start_tx() to match the prototype's to resolve the warning. While PowerPC does not currently implement support for kCFI, it could in the future, which means this warning becomes a fatal CFI failure at run time.
--- drivers/net/ethernet/pasemi/pasemi_mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/pasemi/pasemi_mac.c +1 -1
@@ -1436,7 +1436,7 @@ static void pasemi_mac_queue_csdesc(const struct sk_buff *skb,write_dma_reg (PAS_DMA_TXCHAN_INCR (txring->chan.chno),2 ); } -static int pasemi_mac_start_tx (struct sk_buff *skb,struct net_device *dev) +static netdev_tx_t pasemi_mac_start_tx (struct sk_buff *skb,struct net_device *dev) {struct pasemi_mac *const mac =netdev_priv (dev);struct pasemi_mac_txring *const txring =tx_ring (mac);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 16/86 net: Catch invalid index in XPS mapping
In reply to Greg Kroah-HartmanFrom: Nick Child <[email protected]>
[ Upstream commit 5dd0dfd55baec0742ba8f5625a0dd064aca7db16 ]
When setting the XPS value of a TX queue, warn the user once if the index of the queue is greater than the number of allocated TX queues.
Previously, this scenario went uncaught. In the best case, it resulted in unnecessary allocations. In the worst case, it resulted in out-of-bounds memory references through calls to netdev_get_tx_queue( dev, index). Therefore, it is important to inform the user but not worth returning an error and risk downing the netdevice.
--- net/core/dev.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/dev.c +2 -0
@@ -2165,6 +2165,8 @@ int netif_set_xps_queue(struct net_device *dev, const struct cpumask *mask,struct xps_map *map, *new_map;bool active = false; +WARN_ON_ONCE (index >= dev->num_tx_queues); +if (dev->num_tc) { num_tc = dev->num_tc; tc =netdev_txq_to_tc (dev, index);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 2/86 netlink: annotate accesses to nlk->cb_running
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit a939d14919b799e6fff8a9c80296ca229ba2f8a4 ]
Both netlink_recvmsg() and netlink_native_seq_show() read nlk->cb_running locklessly. Use READ_ONCE() there.
Add corresponding WRITE_ONCE() to netlink_dump() and __netlink_dump_start()
syzbot reported:
BUG: KCSAN: data-race in __netlink_dump_start / netlink_recvmsg
write to 0xffff88813ea4db59 of 1 bytes by task 28219 on cpu 0:
__netlink_dump_start+0x3af/0x4d0 net/netlink/af_netlink.c:2399 netlink_dump_start include/linux/netlink.h:308 [inline] rtnetlink_rcv_msg+0x70f/0x8c0 net/core/rtnetlink.c:6130 netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2577 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6192 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x56f/0x640 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x665/0x770 net/netlink/af_netlink.c:1942 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] sock_write_iter+0x1aa/0x230 net/socket.c:1138 call_write_iter include/linux/fs.h:1851 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x463/0x760 fs/read_write.c:584 ksys_write+0xeb/0x1a0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x42/0x50 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
read to 0xffff88813ea4db59 of 1 bytes by task 28222 on cpu 1:
netlink_recvmsg+0x3b4/0x730 net/netlink/af_netlink.c:2022 sock_recvmsg_nosec+0x4c/0x80 net/socket.c:1017 ____sys_recvmsg+0x2db/0x310 net/socket.c:2718 ___sys_recvmsg net/socket.c:2762 [inline] do_recvmmsg+0x2e5/0x710 net/socket.c:2856 __sys_recvmmsg net/socket.c:2935 [inline] __do_sys_recvmmsg net/socket.c:2958 [inline] __se_sys_recvmmsg net/socket.c:2951 [inline] __x64_sys_recvmmsg+0xe2/0x160 net/socket.c:2951 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x00 -> 0x01
--- net/netlink/af_netlink.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netlink/af_netlink.c +4 -4
@@ -1977,7 +1977,7 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,skb_free_datagram (sk, skb); -if (nlk->cb_running && +if (READ_ONCE (nlk->cb_running) &&atomic_read (&sk->sk_rmem_alloc) <= sk->sk_rcvbuf /2 ) { ret =netlink_dump (sk);if (ret) {
@@ -2259,7 +2259,7 @@ static int netlink_dump(struct sock *sk)if (cb->done) cb->done (cb); - nlk->cb_running = false; +WRITE_ONCE (nlk->cb_running, false); module = cb->module; skb = cb->skb;mutex_unlock (nlk->cb_mutex);
@@ -2320,7 +2320,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, goto error_put; } - nlk->cb_running = true; +WRITE_ONCE (nlk->cb_running, true); nlk->dump_done_errno =INT_MAX ;mutex_unlock (nlk->cb_mutex);
@@ -2633,7 +2633,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v) nlk->groups ? (u32 )nlk->groups[0 ] :0 ,sk_rmem_alloc_get (s),sk_wmem_alloc_get (s), - nlk->cb_running, +READ_ONCE (nlk->cb_running),refcount_read (&s->sk_refcnt),atomic_read (&s->sk_drops),sock_i_ino (s)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 3/86 net: annotate sk->sk_err write from do_recvmmsg()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit e05a5f510f26607616fecdd4ac136310c8bea56b ]
do_recvmmsg() can write to sk->sk_err from multiple threads.
As said before, many other points reading or writing sk_err need annotations.
--- net/socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/socket.c +1 -1
@@ -2383,7 +2383,7 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,* error to return on the next call or if the * app asks about it using getsockopt(SO_ERROR). */ - sock->sk->sk_err = -err; +WRITE_ONCE (sock->sk->sk_err, -err); } out_put:fput_light (sock->file, fput_needed);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 4/86 ipvlan:Fix out-of-bounds caused by unclear skb->cb
In reply to Greg Kroah-HartmanFrom: t.feng <[email protected]>
[ Upstream commit 90cbed5247439a966b645b34eb0a2e037836ea8e ]
If skb enqueue the qdisc, fq_skb_cb(skb)->time_to_send is changed which is actually skb->cb, and IPCB(skb_in)->opt will be used in __ip_options_echo. It is possible that memcpy is out of bounds and lead to stack overflow.
We should clear skb->cb before ip_local_out or ip6_local_out.
v2:
1. clean the stack info
2. use IPCB/IP6CB instead of skb->cb
crash on stable-5.10(reproduce in kasan kernel).
Stack info:
[ 2203.651571] BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0x589/0x800 [ 2203.653327] Write of size 4 at addr ffff88811a388f27 by task swapper/3/0 [ 2203.655460] CPU: 3 PID: 0 Comm: swapper/3 Kdump: loaded Not tainted 5.10.0-60.18.0.50.h856.kasan.eulerosv2r11.x86_64 #1 [ 2203.655466] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-20181220_000000-szxrtosci10000 04/01/2014 [ 2203.655475] Call Trace: [ 2203.655481] <IRQ> [ 2203.655501] dump_stack+0x9c/0xd3 [ 2203.655514] print_address_description.constprop.0+0x19/0x170 [ 2203.655530] __kasan_report.cold+0x6c/0x84 [ 2203.655586] kasan_report+0x3a/0x50 [ 2203.655594] check_memory_region+0xfd/0x1f0 [ 2203.655601] memcpy+0x39/0x60 [ 2203.655608] __ip_options_echo+0x589/0x800 [ 2203.655654] __icmp_send+0x59a/0x960 [ 2203.655755] nf_send_unreach+0x129/0x3d0 [nf_reject_ipv4] [ 2203.655763] reject_tg+0x77/0x1bf [ipt_REJECT] [ 2203.655772] ipt_do_table+0x691/0xa40 [ip_tables] [ 2203.655821] nf_hook_slow+0x69/0x100 [ 2203.655828] __ip_local_out+0x21e/0x2b0 [ 2203.655857] ip_local_out+0x28/0x90 [ 2203.655868] ipvlan_process_v4_outbound+0x21e/0x260 [ipvlan] [ 2203.655931] ipvlan_xmit_mode_l3+0x3bd/0x400 [ipvlan] [ 2203.655967] ipvlan_queue_xmit+0xb3/0x190 [ipvlan] [ 2203.655977] ipvlan_start_xmit+0x2e/0xb0 [ipvlan] [ 2203.655984] xmit_one.constprop.0+0xe1/0x280 [ 2203.655992] dev_hard_start_xmit+0x62/0x100 [ 2203.656000] sch_direct_xmit+0x215/0x640 [ 2203.656028] __qdisc_run+0x153/0x1f0 [ 2203.656069] __dev_queue_xmit+0x77f/0x1030 [ 2203.656173] ip_finish_output2+0x59b/0xc20 [ 2203.656244] __ip_finish_output.part.0+0x318/0x3d0 [ 2203.656312] ip_finish_output+0x168/0x190 [ 2203.656320] ip_output+0x12d/0x220 [ 2203.656357] __ip_queue_xmit+0x392/0x880 [ 2203.656380] __tcp_transmit_skb+0x1088/0x11c0 [ 2203.656436] __tcp_retransmit_skb+0x475/0xa30 [ 2203.656505] tcp_retransmit_skb+0x2d/0x190 [ 2203.656512] tcp_retransmit_timer+0x3af/0x9a0 [ 2203.656519] tcp_write_timer_handler+0x3ba/0x510 [ 2203.656529] tcp_write_timer+0x55/0x180 [ 2203.656542] call_timer_fn+0x3f/0x1d0 [ 2203.656555] expire_timers+0x160/0x200 [ 2203.656562] run_timer_softirq+0x1f4/0x480 [ 2203.656606] __do_softirq+0xfd/0x402 [ 2203.656613] asm_call_irq_on_stack+0x12/0x20 [ 2203.656617] </IRQ> [ 2203.656623] do_softirq_own_stack+0x37/0x50 [ 2203.656631] irq_exit_rcu+0x134/0x1a0 [ 2203.656639] sysvec_apic_timer_interrupt+0x36/0x80 [ 2203.656646] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 2203.656654] RIP: 0010:default_idle+0x13/0x20 [ 2203.656663] Code: 89 f0 5d 41 5c 41 5d 41 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 0f 1f 44 00 00 0f 1f 44 00 00 0f 00 2d 9f 32 57 00 fb f4 <c3> cc cc cc cc 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 54 be 08 [ 2203.656668] RSP: 0018:ffff88810036fe78 EFLAGS: 00000256 [ 2203.656676] RAX: ffffffffaf2a87f0 RBX: ffff888100360000 RCX: ffffffffaf290191 [ 2203.656681] RDX: 0000000000098b5e RSI: 0000000000000004 RDI: ffff88811a3c4f60 [ 2203.656686] RBP: 0000000000000000 R08: 0000000000000001 R09: ffff88811a3c4f63 [ 2203.656690] R10: ffffed10234789ec R11: 0000000000000001 R12: 0000000000000003 [ 2203.656695] R13: ffff888100360000 R14: 0000000000000000 R15: 0000000000000000 [ 2203.656729] default_idle_call+0x5a/0x150 [ 2203.656735] cpuidle_idle_call+0x1c6/0x220 [ 2203.656780] do_idle+0xab/0x100 [ 2203.656786] cpu_startup_entry+0x19/0x20 [ 2203.656793] secondary_startup_64_no_verify+0xc2/0xcb
[ 2203.657409] The buggy address belongs to the page: [ 2203.658648] page:0000000027a9842f refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a388 [ 2203.658665] flags: 0x17ffffc0001000(reserved|node=0|zone=2|lastcpupid=0x1fffff) [ 2203.658675] raw: 0017ffffc0001000 ffffea000468e208 ffffea000468e208 0000000000000000 [ 2203.658682] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 2203.658686] page dumped because: kasan: bad access detected
To reproduce(ipvlan with IPVLAN_MODE_L3):
Env setting:
=======================================================
modprobe ipvlan ipvlan_default_mode=1
sysctl net.ipv4.conf.eth0.forwarding=1
iptables -t nat -A POSTROUTING -s 20.0.0.0/255.255.255.0 -o eth0 -j MASQUERADE
ip link add gw link eth0 type ipvlan
ip -4 addr add 20.0.0.254/24 dev gw
ip netns add net1
ip link add ipv1 link eth0 type ipvlan
ip link set ipv1 netns net1
ip netns exec net1 ip link set ipv1 up
ip netns exec net1 ip -4 addr add 20.0.0.4/24 dev ipv1
ip netns exec net1 route add default gw 20.0.0.254
ip netns exec net1 tc qdisc add dev ipv1 root netem loss 10% ifconfig gw up
iptables -t filter -A OUTPUT -p tcp --dport 8888 -j REJECT --reject-with icmp-port-unreachable
=======================================================
And then excute the shell(curl any address of eth0 can reach):
for((i=1;i<=100000;i++))
do
ip netns exec net1 curl x.x.x.x:8888
done
=======================================================
--- drivers/net/ipvlan/ipvlan_core.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ipvlan/ipvlan_core.c +6 -0
@@ -394,6 +394,9 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb) goto err; }skb_dst_set (skb, &rt->dst); + +memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); + err =ip_local_out (net, skb->sk, skb);if (unlikely (net_xmit_eval (err))) dev->stats.tx_errors++;
@@ -431,6 +434,9 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb) goto err; }skb_dst_set (skb, dst); + +memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); + err =ip6_local_out (net, skb->sk, skb);if (unlikely (net_xmit_eval (err))) dev->stats.tx_errors++;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 5/86 af_unix: Fix a data race of sk->sk_receive_queue->qlen.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 679ed006d416ea0cecfe24a99d365d1dea69c683 ]
KCSAN found a data race of sk->sk_receive_queue->qlen where recvmsg() updates qlen under the queue lock and sendmsg() checks qlen under unix_state_sock(), not the queue lock, so the reader side needs READ_ONCE().
BUG: KCSAN: data-race in __skb_try_recv_from_queue / unix_wait_for_peer
write (marked) to 0xffff888019fe7c68 of 4 bytes by task 49792 on cpu 0:
__skb_unlink include/linux/skbuff.h:2347 [inline] __skb_try_recv_from_queue+0x3de/0x470 net/core/datagram.c:197 __skb_try_recv_datagram+0xf7/0x390 net/core/datagram.c:263 __unix_dgram_recvmsg+0x109/0x8a0 net/unix/af_unix.c:2452 unix_dgram_recvmsg+0x94/0xa0 net/unix/af_unix.c:2549 sock_recvmsg_nosec net/socket.c:1019 [inline] ____sys_recvmsg+0x3a3/0x3b0 net/socket.c:2720 ___sys_recvmsg+0xc8/0x150 net/socket.c:2764 do_recvmmsg+0x182/0x560 net/socket.c:2858 __sys_recvmmsg net/socket.c:2937 [inline] __do_sys_recvmmsg net/socket.c:2960 [inline] __se_sys_recvmmsg net/socket.c:2953 [inline] __x64_sys_recvmmsg+0x153/0x170 net/socket.c:2953 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc
read to 0xffff888019fe7c68 of 4 bytes by task 49793 on cpu 1:
skb_queue_len include/linux/skbuff.h:2127 [inline] unix_recvq_full net/unix/af_unix.c:229 [inline] unix_wait_for_peer+0x154/0x1a0 net/unix/af_unix.c:1445 unix_dgram_sendmsg+0x13bc/0x14b0 net/unix/af_unix.c:2048 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x148/0x160 net/socket.c:747 ____sys_sendmsg+0x20e/0x620 net/socket.c:2503 ___sys_sendmsg+0xc6/0x140 net/socket.c:2557 __sys_sendmmsg+0x11d/0x370 net/socket.c:2643 __do_sys_sendmmsg net/socket.c:2672 [inline] __se_sys_sendmmsg net/socket.c:2669 [inline] __x64_sys_sendmmsg+0x58/0x70 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc
value changed: 0x0000000b -> 0x00000001
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 49793 Comm: syz-executor.0 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
--- net/unix/af_unix.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/unix/af_unix.c +1 -1
@@ -1236,7 +1236,7 @@ static long unix_wait_for_peer(struct sock *other, long timeo) sched = !sock_flag (other,SOCK_DEAD ) && !(other->sk_shutdown &RCV_SHUTDOWN ) && -unix_recvq_full (other); +unix_recvq_full_lockless (other);unix_state_unlock (other);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/86 fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit 81b21c0f0138ff5a499eafc3eb0578ad2a99622c ]
syzbot is hitting WARN_ON() in hfsplus_cat_{read,write}_inode(), for crafted filesystem image can contain bogus length. There conditions are not kernel bugs that can justify kernel to panic.
Message-Id: <[email protected]>
--- fs/hfsplus/inode.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-)
fs/hfsplus/inode.c +23 -5
@@ -488,7 +488,11 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)if (type ==HFSPLUS_FOLDER ) {struct hfsplus_cat_folder *folder = &entry.folder; -WARN_ON (fd->entrylength <sizeof (struct hfsplus_cat_folder )); +if (fd->entrylength <sizeof (struct hfsplus_cat_folder )) { +pr_err ("bad catalog folder entry\n" ); + res = -EIO ; + goto out; + }hfs_bnode_read (fd->bnode, &entry, fd->entryoffset,sizeof (struct hfsplus_cat_folder ));hfsplus_get_perms (inode, &folder->permissions,1 );
@@ -508,7 +512,11 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd) }else if (type ==HFSPLUS_FILE ) {struct hfsplus_cat_file *file = &entry.file; -WARN_ON (fd->entrylength <sizeof (struct hfsplus_cat_file )); +if (fd->entrylength <sizeof (struct hfsplus_cat_file )) { +pr_err ("bad catalog file entry\n" ); + res = -EIO ; + goto out; + }hfs_bnode_read (fd->bnode, &entry, fd->entryoffset,sizeof (struct hfsplus_cat_file ));
@@ -539,6 +547,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)pr_err ("bad catalog entry used to create inode\n" ); res = -EIO ; } +out:return res; }
@@ -547,6 +556,7 @@ int hfsplus_cat_write_inode(struct inode *inode)struct inode *main_inode = inode;struct hfs_find_data fd;hfsplus_cat_entry entry; +int res =0 ;if (HFSPLUS_IS_RSRC (inode)) main_inode =HFSPLUS_I (inode)->rsrc_inode;
@@ -565,7 +575,11 @@ int hfsplus_cat_write_inode(struct inode *inode)if (S_ISDIR (main_inode->i_mode)) {struct hfsplus_cat_folder *folder = &entry.folder; -WARN_ON (fd.entrylength <sizeof (struct hfsplus_cat_folder )); +if (fd.entrylength <sizeof (struct hfsplus_cat_folder )) { +pr_err ("bad catalog folder entry\n" ); + res = -EIO ; + goto out; + }hfs_bnode_read (fd.bnode, &entry, fd.entryoffset,sizeof (struct hfsplus_cat_folder ));/* simple node checks? */
@@ -590,7 +604,11 @@ int hfsplus_cat_write_inode(struct inode *inode) }else {struct hfsplus_cat_file *file = &entry.file; -WARN_ON (fd.entrylength <sizeof (struct hfsplus_cat_file )); +if (fd.entrylength <sizeof (struct hfsplus_cat_file )) { +pr_err ("bad catalog file entry\n" ); + res = -EIO ; + goto out; + }hfs_bnode_read (fd.bnode, &entry, fd.entryoffset,sizeof (struct hfsplus_cat_file ));hfsplus_inode_write_fork (inode, &file->data_fork);
@@ -611,5 +629,5 @@ int hfsplus_cat_write_inode(struct inode *inode)set_bit (HFSPLUS_I_CAT_DIRTY , &HFSPLUS_I (inode)->flags); out:hfs_find_exit (&fd); -return 0 ; +return res; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 7/86 regmap: cache: Return error in cache sync operations for REGCACHE_NONE
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit fd883d79e4dcd2417c2b80756f22a2ff03b0f6e0 ]
There is no sense in doing a cache sync on REGCACHE_NONE regmaps. Instead of panicking the kernel due to missing cache_ops, return an error to client driver.
--- drivers/base/regmap/regcache.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/base/regmap/regcache.c +6 -0
@@ -347,6 +347,9 @@ int regcache_sync(struct regmap *map)const char *name;bool bypass; +if (WARN_ON (map->cache_type ==REGCACHE_NONE )) +return -EINVAL ; +BUG_ON (!map->cache_ops); map->lock (map->lock_arg);
@@ -416,6 +419,9 @@ int regcache_sync_region(struct regmap *map, unsigned int min,const char *name;bool bypass; +if (WARN_ON (map->cache_type ==REGCACHE_NONE )) +return -EINVAL ; +BUG_ON (!map->cache_ops); map->lock (map->lock_arg);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 8/86 memstick: r592: Fix UAF bug in r592_remove due to race condition
In reply to Greg Kroah-HartmanFrom: Zheng Wang <[email protected]>
[ Upstream commit 63264422785021704c39b38f65a78ab9e4a186d7 ]
In r592_probe, dev->detect_timer was bound with r592_detect_timer. In r592_irq function, the timer function will be invoked by mod_timer.
If we remove the module which will call hantro_release to make cleanup, there may be a unfinished work. The possible sequence is as follows, which will cause a typical UAF bug.
Fix it by canceling the work before cleanup in r592_remove.
CPU0 CPU1
|r592_detect_timer
r592_remove |
memstick_free_host|
put_device; |
kfree(host); |
|
| queue_work
| &host->media_checker //use--- drivers/memstick/host/r592.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/memstick/host/r592.c +1 -1
@@ -832,7 +832,7 @@ static void r592_remove(struct pci_dev *pdev)/* Stop the processing thread. That ensures that we won't take any more requests */ kthread_stop (dev->io_thread); - +del_timer_sync (&dev->detect_timer);r592_enable_device (dev, false);while (!error && dev->req) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 9/86 ACPI: EC: Fix oops when removing custom query handlers
In reply to Greg Kroah-HartmanFrom: Armin Wolf <[email protected]>
[ Upstream commit e5b492c6bb900fcf9722e05f4a10924410e170c1 ]
When removing custom query handlers, the handler might still be used inside the EC query workqueue, causing a kernel oops if the module holding the callback function was already unloaded.
Fix this by flushing the EC query workqueue when removing custom query handlers.
Tested on a Acer Travelmate 4002WLMi
--- drivers/acpi/ec.c | 1 + 1 file changed, 1 insertion(+)
drivers/acpi/ec.c +1 -0
@@ -1135,6 +1135,7 @@ static void acpi_ec_remove_query_handlers(struct acpi_ec *ec,void acpi_ec_remove_query_handler (struct acpi_ec *ec,u8 query_bit) {acpi_ec_remove_query_handlers (ec, false, query_bit); +flush_workqueue (ec_query_wq); }EXPORT_SYMBOL_GPL (acpi_ec_remove_query_handler);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainercover 4.14.316-rc1 review
This is the start of the stable review cycle for the 4.14.316 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 30 May 2023 19:08:13 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.316-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.316-rc1
Christophe JAILLET <[email protected]>
3c589_cs: Fix an error handling path in tc589_probe()
Christophe JAILLET <[email protected]>
forcedeth: Fix an error handling path in nv_probe()
Vernon Lovejoy <[email protected]>
x86/show_trace_log_lvl: Ensure stack pointer is aligned, again
Dan Carpenter <[email protected]>
xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()
Daisuke Nojiri <[email protected]>
power: supply: sbs-charger: Fix INHIBITED bit for Status reg
Hans de Goede <[email protected]>
power: supply: bq27xxx: Fix poll_interval handling and races on remove
Hans de Goede <[email protected]>
power: supply: bq27xxx: Fix I2C IRQ race on remove
Hans de Goede <[email protected]>
power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition
Hans de Goede <[email protected]>
power: supply: leds: Fix blink to LED on transition
Gavrilov Ilia <[email protected]>
ipv6: Fix out-of-bounds access in ipv6_find_tlv()
Pratyush Yadav <[email protected]>
net: fix skb leak in __skb_tstamp_tx()
Alan Stern <[email protected]>
media: radio-shark: Add endpoint checks
Alan Stern <[email protected]>
USB: sisusbvga: Add endpoint checks
Alan Stern <[email protected]>
USB: core: Add routines for endpoint checks in old drivers
Hardik Garg <[email protected]>
selftests/memfd: Fix unknown type name build failure
Dave Hansen <[email protected]>
x86/mm: Avoid incomplete Global INVLPG flushes
Florian Westphal <[email protected]>
netfilter: nf_tables: fix register ordering
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: do not allow SET_ID to refer to another table
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: do not allow RULE_ID to refer to another chain
Pablo Neira Ayuso <[email protected]>
netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: stricter validation of element data
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: allow up to 64 bytes in the set element data area
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: add nft_setelem_parse_key()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: validate registers coming from userspace.
Pablo Neira Ayuso <[email protected]>
netfilter: nftables: statify nft_parse_register()
Pablo Neira Ayuso <[email protected]>
netfilter: nftables: add nft_parse_register_store() and use it
Pablo Neira Ayuso <[email protected]>
netfilter: nftables: add nft_parse_register_load() and use it
Helge Deller <[email protected]>
parisc: Allow to reboot machine after system halt
Finn Thain <[email protected]>
m68k: Move signal frame following exception on 68020/030
Christophe Leroy <[email protected]>
spi: fsl-cpm: Use 16 bit mode for large transfers with even size
Christophe Leroy <[email protected]>
spi: fsl-spi: Re-organise transfer bits_per_word adaptation
Rasmus Villemoes <[email protected]>
spi: spi-fsl-spi: automatically adapt bits-per-word in cpu mode
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: bogus EBUSY in helper removal from transaction
Ryusuke Konishi <[email protected]>
nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
Xiubo Li <[email protected]>
ceph: force updating the msg pointer in non-split case
Vitaliy Tomin <[email protected]>
serial: Add support for Advantech PCI-1611U card
Ilya Leoshkevich <[email protected]>
statfs: enforce statfs[64] structure initialization
Nikhil Mahale <[email protected]>
ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table
Takashi Iwai <[email protected]>
ALSA: hda: Fix Oops by 9.1 surround channel names
Maxime Bizon <[email protected]>
usb-storage: fix deadlock when a scsi command timeouts more than once
Eric Dumazet <[email protected]>
vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
Aleksandr Loktionov <[email protected]>
igb: fix bit_shift to be in [1..8] range
Christophe JAILLET <[email protected]>
cassini: Fix a memory leak in the error handling path of cas_init_one()
Dong Chenchen <[email protected]>
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
Duoming Zhou <[email protected]>
media: netup_unidvb: fix use-after-free at del_timer()
Zhuang Shengen <[email protected]>
vsock: avoid to close connected socket after the timeout
Uwe Kleine-König <[email protected]>
net: fec: Better handle pm_runtime_get() failing in .remove()
Tobias Brunner <[email protected]>
af_key: Reject optional tunnel/BEET mode templates in outbound policies
Wyes Karny <[email protected]>
cpupower: Make TSC read per CPU for Mperf monitor
Qiang Ning <[email protected]>
mfd: dln2: Fix memory leak in dln2_probe()
Alain Volmat <[email protected]>
phy: st: miphy28lp: use _poll_timeout functions for waits
Vicki Pfau <[email protected]>
Input: xpad - add constants for GIP interface numbers
Arnd Bergmann <[email protected]>
clk: tegra20: fix gcc-7 constant overflow warning
Hao Zeng <[email protected]>
recordmcount: Fix memory leaks in the uwrite function
Josh Poimboeuf <[email protected]>
sched: Fix KCSAN noinstr violation
Rodríguez Barbarin, José Javier <[email protected]>
mcb-pci: Reallocate memory region to avoid memory overlapping
Tony Lindgren <[email protected]>
serial: 8250: Reinit port->pm on port specific driver unbind
Jason Gerecke <[email protected]>
HID: wacom: generic: Set battery quirk only when we see battery data
Kevin Groeneveld <[email protected]>
spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3
Bastien Nocera <[email protected]>
HID: logitech-hidpp: Reconcile USB and Unifying serials
Bastien Nocera <[email protected]>
HID: logitech-hidpp: Don't use the USB serial for USB devices
Philipp Hortmann <[email protected]>
staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE
Min Li <[email protected]>
Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
Hans de Goede <[email protected]>
wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
Chaitanya Kulkarni <[email protected]>
null_blk: Always check queue mode setting from configfs
Ojaswin Mujoo <[email protected]>
ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()
Kemeng Shi <[email protected]>
ext4: set goal start correctly in ext4_mb_normalize_request
Andreas Gruenbacher <[email protected]>
gfs2: Fix inode height consistency check
Zheng Wang <[email protected]>
scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition
Eli Cohen <[email protected]>
lib: cpu_rmap: Avoid use after free on rmap->obj array entries
Nick Child <[email protected]>
net: Catch invalid index in XPS mapping
Nathan Chancellor <[email protected]>
net: pasemi: Fix return type of pasemi_mac_start_tx()
Jan Kara <[email protected]>
ext2: Check block size validity during mount
Hector Martin <[email protected]>
wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
void0red <[email protected]>
ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects
Tamir Duberstein <[email protected]>
ACPICA: Avoid undefined behavior: applying zero offset to null pointer
Nur Hussein <[email protected]>
drm/tegra: Avoid potential 32-bit integer overflow
Armin Wolf <[email protected]>
ACPI: EC: Fix oops when removing custom query handlers
Zheng Wang <[email protected]>
memstick: r592: Fix UAF bug in r592_remove due to race condition
Alexander Stein <[email protected]>
regmap: cache: Return error in cache sync operations for REGCACHE_NONE
Tetsuo Handa <[email protected]>
fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
Kuniyuki Iwashima <[email protected]>
af_unix: Fix a data race of sk->sk_receive_queue->qlen.
t.feng <[email protected]>
ipvlan:Fix out-of-bounds caused by unclear skb->cb
Eric Dumazet <[email protected]>
net: annotate sk->sk_err write from do_recvmmsg()
Eric Dumazet <[email protected]>
netlink: annotate accesses to nlk->cb_running
Kuniyuki Iwashima <[email protected]>
net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
-------------
Diffstat:
Makefile | 4 +- arch/m68k/kernel/signal.c | 14 +- arch/parisc/kernel/process.c | 11 +- arch/x86/include/asm/intel-family.h | 5 + arch/x86/kernel/dumpstack.c | 7 +- arch/x86/mm/init.c | 25 +++ drivers/acpi/acpica/dbnames.c | 3 + drivers/acpi/acpica/dswstate.c | 11 +- drivers/acpi/ec.c | 1 + drivers/base/regmap/regcache.c | 6 + drivers/block/null_blk.c | 5 + drivers/clk/tegra/clk-tegra20.c | 28 +-- drivers/gpu/drm/tegra/sor.c | 2 +- drivers/hid/hid-logitech-hidpp.c | 53 ++++- drivers/hid/wacom_wac.c | 33 ++-- drivers/input/joystick/xpad.c | 5 +- drivers/mcb/mcb-pci.c | 27 ++- drivers/media/pci/netup_unidvb/netup_unidvb_core.c | 2 +- drivers/media/radio/radio-shark.c | 10 + drivers/media/radio/radio-shark2.c | 10 + drivers/memstick/host/r592.c | 2 +- drivers/message/fusion/mptlan.c | 2 + drivers/mfd/dln2.c | 1 + drivers/net/ethernet/3com/3c589_cs.c | 11 +- drivers/net/ethernet/freescale/fec_main.c | 13 +- drivers/net/ethernet/intel/igb/e1000_mac.c | 4 +- drivers/net/ethernet/nvidia/forcedeth.c | 1 + drivers/net/ethernet/pasemi/pasemi_mac.c | 2 +- drivers/net/ethernet/sun/cassini.c | 2 + drivers/net/ipvlan/ipvlan_core.c | 6 + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 13 +- drivers/net/wireless/intel/iwlwifi/dvm/sta.c | 5 +- drivers/phy/st/phy-miphy28lp.c | 42 +--- drivers/power/supply/bq27xxx_battery.c | 41 ++-- drivers/power/supply/bq27xxx_battery_i2c.c | 3 +- drivers/power/supply/power_supply_leds.c | 5 +- drivers/power/supply/sbs-charger.c | 2 +- drivers/spi/spi-fsl-cpm.c | 23 +++ drivers/spi/spi-fsl-spi.c | 65 +++--- drivers/spi/spi-imx.c | 24 ++- drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 6 +- drivers/staging/rtl8192e/rtl8192e/rtl_core.h | 5 - drivers/tty/serial/8250/8250_core.c | 1 + drivers/tty/serial/8250/8250_pci.c | 5 + drivers/usb/core/usb.c | 76 +++++++ drivers/usb/misc/sisusbvga/sisusb.c | 14 ++ drivers/usb/storage/scsiglue.c | 28 ++- drivers/xen/pvcalls-back.c | 9 +- fs/ceph/snap.c | 13 ++ fs/ext2/ext2.h | 1 + fs/ext2/super.c | 7 + fs/ext4/mballoc.c | 65 +++--- fs/gfs2/glops.c | 3 +- fs/hfsplus/inode.c | 28 ++- fs/nilfs2/inode.c | 18 ++ fs/statfs.c | 4 +- include/linux/power/bq27xxx_battery.h | 1 + include/linux/sched/task_stack.h | 2 +- include/linux/usb.h | 5 + include/net/netfilter/nf_tables.h | 17 +- include/net/netfilter/nf_tables_core.h | 14 +- include/net/netfilter/nft_fib.h | 2 +- include/net/netfilter/nft_masq.h | 4 +- include/net/netfilter/nft_meta.h | 4 +- include/net/netfilter/nft_redir.h | 4 +- include/net/sock.h | 2 +- include/uapi/linux/netfilter/nf_tables.h | 2 +- lib/cpu_rmap.c | 5 +- net/8021q/vlan_dev.c | 4 +- net/bluetooth/l2cap_core.c | 1 - net/bridge/netfilter/nft_meta_bridge.c | 5 +- net/core/dev.c | 2 + net/core/skbuff.c | 4 +- net/ipv4/netfilter/nft_dup_ipv4.c | 18 +- net/ipv6/exthdrs_core.c | 2 + net/ipv6/netfilter/nft_dup_ipv6.c | 18 +- net/key/af_key.c | 12 +- net/netfilter/nf_tables_api.c | 220 ++++++++++++++------- net/netfilter/nft_bitwise.c | 14 +- net/netfilter/nft_byteorder.c | 14 +- net/netfilter/nft_cmp.c | 8 +- net/netfilter/nft_ct.c | 12 +- net/netfilter/nft_dup_netdev.c | 6 +- net/netfilter/nft_dynset.c | 16 +- net/netfilter/nft_exthdr.c | 14 +- net/netfilter/nft_fib.c | 5 +- net/netfilter/nft_fwd_netdev.c | 6 +- net/netfilter/nft_hash.c | 25 ++- net/netfilter/nft_immediate.c | 8 +- net/netfilter/nft_lookup.c | 14 +- net/netfilter/nft_masq.c | 14 +- net/netfilter/nft_meta.c | 8 +- net/netfilter/nft_nat.c | 35 ++-- net/netfilter/nft_numgen.c | 15 +- net/netfilter/nft_objref.c | 25 ++- net/netfilter/nft_payload.c | 10 +- net/netfilter/nft_queue.c | 12 +- net/netfilter/nft_range.c | 6 +- net/netfilter/nft_redir.c | 14 +- net/netfilter/nft_rt.c | 7 +- net/netlink/af_netlink.c | 8 +- net/nsh/nsh.c | 8 +- net/socket.c | 2 +- net/unix/af_unix.c | 2 +- net/vmw_vsock/af_vsock.c | 2 +- scripts/recordmcount.c | 6 +- sound/pci/hda/hda_generic.c | 7 +- sound/pci/hda/patch_hdmi.c | 5 + .../cpupower/utils/idle_monitor/mperf_monitor.c | 31 ++- tools/testing/selftests/memfd/fuse_test.c | 1 + 110 files changed, 1005 insertions(+), 515 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 18/86 scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition
From: Zheng Wang <[email protected]>
[ Upstream commit f486893288f3e9b171b836f43853a6426515d800 ]
mptlan_probe() calls mpt_register_lan_device() which initializes the &priv->post_buckets_task workqueue. A call to mpt_lan_wake_post_buckets_task() will subsequently start the work.
During driver unload in mptlan_remove() the following race may occur:
CPU0 CPU1
|mpt_lan_post_receive_buckets_work()
mptlan_remove() |
free_netdev() |
kfree(dev); |
|
| dev->mtu
| //useFix this by finishing the work prior to cleaning up in mptlan_remove().
[mkp: we really should remove mptlan instead of attempting to fix it]
--- drivers/message/fusion/mptlan.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/message/fusion/mptlan.c +2 -0
@@ -1429,7 +1429,9 @@ mptlan_remove(struct pci_dev *pdev) {MPT_ADAPTER *ioc =pci_get_drvdata (pdev);struct net_device *dev = ioc->netdev; +struct mpt_lan_priv *priv =netdev_priv (dev); +cancel_delayed_work_sync (&priv->post_buckets_task);if (dev !=NULL ) {unregister_netdev (dev);free_netdev (dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 27/86 HID: logitech-hidpp: Reconcile USB and Unifying serials
In reply to Greg Kroah-HartmanFrom: Bastien Nocera <[email protected]>
[ Upstream commit 5b3691d15e04b6d5a32c915577b8dbc5cfb56382 ]
Now that USB HID++ devices can gather a serial number that matches the one that would be gathered when connected through a Unifying receiver, remove the last difference by dropping the product ID as devices usually have different product IDs when connected through USB or Unifying.
For example, on the serials on a G903 wired/wireless mouse:
- Unifying before patch: 4067-e8-ce-cd-45
- USB before patch: c086-e8-ce-cd-45
- Unifying and USB after patch: e8-ce-cd-45
--- drivers/hid/hid-logitech-hidpp.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/hid/hid-logitech-hidpp.c +2 -4
@@ -675,8 +675,7 @@ static int hidpp_unifying_init(struct hidpp_device *hidpp)if (ret)return ret; -snprintf (hdev->uniq,sizeof (hdev->uniq),"%04x-%4phD" , - hdev->product, &serial); +snprintf (hdev->uniq,sizeof (hdev->uniq),"%4phD" , &serial);dbg_hid ("HID++ Unifying: Got serial: %s\n" , hdev->uniq); name =hidpp_unifying_get_name (hidpp);
@@ -819,8 +818,7 @@ static int hidpp_serial_init(struct hidpp_device *hidpp)if (ret)return ret; -snprintf (hdev->uniq,sizeof (hdev->uniq),"%04x-%4phD" , - hdev->product, &serial); +snprintf (hdev->uniq,sizeof (hdev->uniq),"%4phD" , &serial);dbg_hid ("HID++ DeviceInformation: Got serial: %s\n" , hdev->uniq);return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 28/86 spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3
In reply to Greg Kroah-HartmanFrom: Kevin Groeneveld <[email protected]>
[ Upstream commit 87c614175bbf28d3fd076dc2d166bac759e41427 ]
When using gpio based chip select the cs value can go outside the range 0 – 3. The various MX51_ECSPI_* macros did not take this into consideration resulting in possible corruption of the configuration.
For example for any cs value over 3 the SCLKPHA bits would not be set and other values in the register possibly corrupted.
One way to fix this is to just mask the cs bits to 2 bits. This still allows all 4 native chip selects to work as well as gpio chip selects (which can use any of the 4 chip select configurations).
--- drivers/spi/spi-imx.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
drivers/spi/spi-imx.c +18 -6
@@ -241,6 +241,18 @@ static bool spi_imx_can_dma(struct spi_master *master, struct spi_device *spi,return true; } +/* +* Note the number of natively supported chip selects for MX51 is 4. Some +* devices may have less actual SS pins but the register map supports 4. When +* using gpio chip selects the cs values passed into the macros below can go +* outside the range 0 - 3. We therefore need to limit the cs value to avoid +* corrupting bits outside the allocated locations. +* +* The simplest way to do this is to just mask the cs bits to 2 bits. This +* still allows all 4 native chip selects to work as well as gpio chip selects +* (which can use any of the 4 chip select configurations). +*/ +#define MX51_ECSPI_CTRL 0x08#define MX51_ECSPI_CTRL_ENABLE (1 << 0)#define MX51_ECSPI_CTRL_XCH (1 << 2)
@@ -249,16 +261,16 @@ static bool spi_imx_can_dma(struct spi_master *master, struct spi_device *spi,#define MX51_ECSPI_CTRL_DRCTL (drctl) ((drctl) << 16)#define MX51_ECSPI_CTRL_POSTDIV_OFFSET 8#define MX51_ECSPI_CTRL_PREDIV_OFFSET 12 -#define MX51_ECSPI_CTRL_CS (cs) ((cs) << 18) +#define MX51_ECSPI_CTRL_CS (cs) ((cs & 3) << 18)#define MX51_ECSPI_CTRL_BL_OFFSET 20#define MX51_ECSPI_CTRL_BL_MASK (0xfff << 20)#define MX51_ECSPI_CONFIG 0x0c -#define MX51_ECSPI_CONFIG_SCLKPHA (cs) (1 << ((cs) + 0)) -#define MX51_ECSPI_CONFIG_SCLKPOL (cs) (1 << ((cs) + 4)) -#define MX51_ECSPI_CONFIG_SBBCTRL (cs) (1 << ((cs) + 8)) -#define MX51_ECSPI_CONFIG_SSBPOL (cs) (1 << ((cs) + 12)) -#define MX51_ECSPI_CONFIG_SCLKCTL (cs) (1 << ((cs) + 20)) +#define MX51_ECSPI_CONFIG_SCLKPHA (cs) (1 << ((cs & 3) + 0)) +#define MX51_ECSPI_CONFIG_SCLKPOL (cs) (1 << ((cs & 3) + 4)) +#define MX51_ECSPI_CONFIG_SBBCTRL (cs) (1 << ((cs & 3) + 8)) +#define MX51_ECSPI_CONFIG_SSBPOL (cs) (1 << ((cs & 3) + 12)) +#define MX51_ECSPI_CONFIG_SCLKCTL (cs) (1 << ((cs & 3) + 20))#define MX51_ECSPI_INT 0x10#define MX51_ECSPI_INT_TEEN (1 << 0)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 29/86 HID: wacom: generic: Set battery quirk only when we see battery data
In reply to Greg Kroah-HartmanFrom: Jason Gerecke <[email protected]>
[ Upstream commit bea407a427baa019758f29f4d31b26f008bb8cc6 ]
Some devices will include battery status usages in the HID descriptor but we won't see that battery data for one reason or another. For example, AES sensors won't send battery data unless an AES pen is in proximity. If a user does not have an AES pen but instead only interacts with the AES touchscreen with their fingers then there is no need for us to create a battery object. Similarly, if a family of peripherals shares the same HID descriptor between wired-only and wireless-capable SKUs, users of the former may never see a battery event and will not want a power_supply object created.
--- drivers/hid/wacom_wac.c | 33 +++++++++++---------------------- 1 file changed, 11 insertions(+), 22 deletions(-)
drivers/hid/wacom_wac.c +11 -22
@@ -1782,18 +1782,7 @@ static void wacom_map_usage(struct input_dev *input, struct hid_usage *usage,static void wacom_wac_battery_usage_mapping (struct hid_device *hdev,struct hid_field *field,struct hid_usage *usage) { -struct wacom *wacom =hid_get_drvdata (hdev); -struct wacom_wac *wacom_wac = &wacom->wacom_wac; -struct wacom_features *features = &wacom_wac->features; -unsigned equivalent_usage =wacom_equivalent_usage (usage->hid); - -switch (equivalent_usage) { -case HID_DG_BATTERYSTRENGTH : -case WACOM_HID_WD_BATTERY_LEVEL : -case WACOM_HID_WD_BATTERY_CHARGING : - features->quirks |=WACOM_QUIRK_BATTERY ; -break ; - } +return ; } static void wacom_wac_battery_event(struct hid_device *hdev, struct hid_field *field,
@@ -1814,18 +1803,21 @@ static void wacom_wac_battery_event(struct hid_device *hdev, struct hid_field *f wacom_wac->hid_data.bat_connected =1 ; wacom_wac->hid_data.bat_status =WACOM_POWER_SUPPLY_STATUS_AUTO ; } + wacom_wac->features.quirks |=WACOM_QUIRK_BATTERY ;break ;case WACOM_HID_WD_BATTERY_LEVEL : value = value *100 / (field->logical_maximum - field->logical_minimum); wacom_wac->hid_data.battery_capacity = value; wacom_wac->hid_data.bat_connected =1 ; wacom_wac->hid_data.bat_status =WACOM_POWER_SUPPLY_STATUS_AUTO ; + wacom_wac->features.quirks |=WACOM_QUIRK_BATTERY ;break ;case WACOM_HID_WD_BATTERY_CHARGING : wacom_wac->hid_data.bat_charging = value; wacom_wac->hid_data.ps_connected = value; wacom_wac->hid_data.bat_connected =1 ; wacom_wac->hid_data.bat_status =WACOM_POWER_SUPPLY_STATUS_AUTO ; + wacom_wac->features.quirks |=WACOM_QUIRK_BATTERY ;break ; } }
@@ -1841,18 +1833,15 @@ static void wacom_wac_battery_report(struct hid_device *hdev, {struct wacom *wacom =hid_get_drvdata (hdev);struct wacom_wac *wacom_wac = &wacom->wacom_wac; -struct wacom_features *features = &wacom_wac->features; -if (features->quirks &WACOM_QUIRK_BATTERY ) { -int status = wacom_wac->hid_data.bat_status; -int capacity = wacom_wac->hid_data.battery_capacity; -bool charging = wacom_wac->hid_data.bat_charging; -bool connected = wacom_wac->hid_data.bat_connected; -bool powered = wacom_wac->hid_data.ps_connected; +int status = wacom_wac->hid_data.bat_status; +int capacity = wacom_wac->hid_data.battery_capacity; +bool charging = wacom_wac->hid_data.bat_charging; +bool connected = wacom_wac->hid_data.bat_connected; +bool powered = wacom_wac->hid_data.ps_connected; -wacom_notify_battery (wacom_wac, status, capacity, charging, - connected, powered); - } +wacom_notify_battery (wacom_wac, status, capacity, charging, + connected, powered); } static void wacom_wac_pad_usage_mapping(struct hid_device *hdev,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 30/86 serial: 8250: Reinit port->pm on port specific driver unbind
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit 04e82793f068d2f0ffe62fcea03d007a8cdc16a7 ]
When we unbind a serial port hardware specific 8250 driver, the generic serial8250 driver takes over the port. After that we see an oops about 10 seconds later. This can produce the following at least on some TI SoCs:
Unhandled fault: imprecise external abort (0x1406)
Internal error: : 1406 [#1] SMP ARM
Turns out that we may still have the serial port hardware specific driver port->pm in use, and serial8250_pm() tries to call it after the port specific driver is gone:
serial8250_pm [8250_base] from uart_change_pm+0x54/0x8c [serial_base] uart_change_pm [serial_base] from uart_hangup+0x154/0x198 [serial_base] uart_hangup [serial_base] from __tty_hangup.part.0+0x328/0x37c __tty_hangup.part.0 from disassociate_ctty+0x154/0x20c disassociate_ctty from do_exit+0x744/0xaacdo_exit from do_group_exit+0x40/0x8cdo_group_exit from __wake_up_parent+0x0/0x1c
Let's fix the issue by calling serial8250_set_defaults() in serial8250_unregister_port(). This will set the port back to using the serial8250 default functions, and sets the port->pm to point to serial8250_pm.
--- drivers/tty/serial/8250/8250_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/8250/8250_core.c +1 -0
@@ -1128,6 +1128,7 @@ void serial8250_unregister_port(int line) uart->port.type =PORT_UNKNOWN ; uart->port.dev = &serial8250_isa_devs->dev; uart->capabilities =0 ; +serial8250_init_port (uart);serial8250_apply_quirks (uart);uart_add_one_port (&serial8250_reg, &uart->port); }else {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 31/86 mcb-pci: Reallocate memory region to avoid memory overlapping
In reply to Greg Kroah-HartmanFrom: Rodríguez Barbarin, José Javier <[email protected]>
[ Upstream commit 9be24faadd085c284890c3afcec7a0184642315a ]
mcb-pci requests a fixed-size memory region to parse the chameleon table, however, if the chameleon table is smaller that the allocated region, it could overlap with the IP Cores' memory regions.
After parsing the chameleon table, drop/reallocate the memory region with the actual chameleon table size.
--- drivers/mcb/mcb-pci.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-)
drivers/mcb/mcb-pci.c +25 -2
@@ -34,7 +34,7 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) {struct resource *res;struct priv *priv; -int ret; +int ret, table_size;unsigned long flags; priv =devm_kzalloc (&pdev->dev,sizeof (struct priv ),GFP_KERNEL );
@@ -93,7 +93,30 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)if (ret <0 ) goto out_mcb_bus; -dev_dbg (&pdev->dev,"Found %d cells\n" , ret); + table_size = ret; + +if (table_size <CHAM_HEADER_SIZE ) { +/* Release the previous resources */ +devm_iounmap (&pdev->dev, priv->base); +devm_release_mem_region (&pdev->dev, priv->mapbase,CHAM_HEADER_SIZE ); + +/* Then, allocate it again with the actual chameleon table size */ + res =devm_request_mem_region (&pdev->dev, priv->mapbase, + table_size, +KBUILD_MODNAME ); +if (!res) { +dev_err (&pdev->dev,"Failed to request PCI memory\n" ); + ret = -EBUSY ; + goto out_mcb_bus; + } + + priv->base =devm_ioremap (&pdev->dev, priv->mapbase, table_size); +if (!priv->base) { +dev_err (&pdev->dev,"Cannot ioremap\n" ); + ret = -ENOMEM ; + goto out_mcb_bus; + } + }mcb_bus_add_devices (priv->bus);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 32/86 sched: Fix KCSAN noinstr violation
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
[ Upstream commit e0b081d17a9f4e5c0cbb0e5fbeb1abe3de0f7e4e ]
With KCSAN enabled, end_of_stack() can get out-of-lined. Force it inline.
Fixes the following warnings:
vmlinux.o: warning: objtool: check_stackleak_irqoff+0x2b: call to end_of_stack() leaves .noinstr.text section
--- include/linux/sched/task_stack.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/sched/task_stack.h +1 -1
@@ -23,7 +23,7 @@ static inline void *task_stack_page(const struct task_struct *task)#define setup_thread_stack (new,old) do { } while(0) -static inline unsigned long *end_of_stack (const struct task_struct *task) +static __always_inline unsigned long *end_of_stack (const struct task_struct *task) {#ifdef CONFIG_STACK_GROWSUP return (unsigned long *)((unsigned long )task->stack +THREAD_SIZE ) -1 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 33/86 recordmcount: Fix memory leaks in the uwrite function
In reply to Greg Kroah-HartmanFrom: Hao Zeng <[email protected]>
[ Upstream commit fa359d068574d29e7d2f0fdd0ebe4c6a12b5cfb9 ]
Common realloc mistake: 'file_append' nulled but not freed upon failure
--- scripts/recordmcount.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
scripts/recordmcount.c +5 -1
@@ -146,6 +146,7 @@ uwrite(int const fd, void const *const buf, size_t const count) {size_t cnt = count;off_t idx =0 ; +void *p =NULL ; file_updated =1 ;
@@ -153,7 +154,10 @@ uwrite(int const fd, void const *const buf, size_t const count)off_t aoffset = (file_ptr + count) - file_end;if (aoffset > file_append_size) { - file_append =realloc (file_append, aoffset); + p =realloc (file_append, aoffset); +if (!p) +free (file_append); + file_append = p; file_append_size = aoffset; }if (!file_append) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 34/86 clk: tegra20: fix gcc-7 constant overflow warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit b4a2adbf3586efa12fe78b9dec047423e01f3010 ]
Older gcc versions get confused by comparing a u32 value to a negative constant in a switch()/case block:
drivers/clk/tegra/clk-tegra20.c: In function 'tegra20_clk_measure_input_freq':drivers/clk/tegra/clk-tegra20.c:581:2: error: case label does not reduce to an integer constant
case OSC_CTRL_OSC_FREQ_12MHZ:
^~~~drivers/clk/tegra/clk-tegra20.c:593:2: error: case label does not reduce to an integer constant
case OSC_CTRL_OSC_FREQ_26MHZ:
Make the constants unsigned instead.
--- drivers/clk/tegra/clk-tegra20.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-)
drivers/clk/tegra/clk-tegra20.c +14 -14
@@ -27,24 +27,24 @@#include "clk-id.h" #define OSC_CTRL 0x50 -#define OSC_CTRL_OSC_FREQ_MASK (3<<30) -#define OSC_CTRL_OSC_FREQ_13MHZ (0<<30) -#define OSC_CTRL_OSC_FREQ_19_2MHZ (1<<30) -#define OSC_CTRL_OSC_FREQ_12MHZ (2<<30) -#define OSC_CTRL_OSC_FREQ_26MHZ (3<<30) -#define OSC_CTRL_MASK (0x3f2 | OSC_CTRL_OSC_FREQ_MASK) - -#define OSC_CTRL_PLL_REF_DIV_MASK (3<<28) -#define OSC_CTRL_PLL_REF_DIV_1 (0<<28) -#define OSC_CTRL_PLL_REF_DIV_2 (1<<28) -#define OSC_CTRL_PLL_REF_DIV_4 (2<<28) +#define OSC_CTRL_OSC_FREQ_MASK (3u<<30) +#define OSC_CTRL_OSC_FREQ_13MHZ (0u<<30) +#define OSC_CTRL_OSC_FREQ_19_2MHZ (1u<<30) +#define OSC_CTRL_OSC_FREQ_12MHZ (2u<<30) +#define OSC_CTRL_OSC_FREQ_26MHZ (3u<<30) +#define OSC_CTRL_MASK (0x3f2u | OSC_CTRL_OSC_FREQ_MASK) + +#define OSC_CTRL_PLL_REF_DIV_MASK (3u<<28) +#define OSC_CTRL_PLL_REF_DIV_1 (0u<<28) +#define OSC_CTRL_PLL_REF_DIV_2 (1u<<28) +#define OSC_CTRL_PLL_REF_DIV_4 (2u<<28)#define OSC_FREQ_DET 0x58 -#define OSC_FREQ_DET_TRIG (1<<31) +#define OSC_FREQ_DET_TRIG (1u<<31)#define OSC_FREQ_DET_STATUS 0x5c -#define OSC_FREQ_DET_BUSY (1<<31) -#define OSC_FREQ_DET_CNT_MASK 0xFFFF +#define OSC_FREQ_DET_BUSYu (1<<31) +#define OSC_FREQ_DET_CNT_MASK 0xFFFFu#define TEGRA20_CLK_PERIPH_BANKS 3
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 35/86 Input: xpad - add constants for GIP interface numbers
In reply to Greg Kroah-HartmanFrom: Vicki Pfau <[email protected]>
[ Upstream commit f9b2e603c6216824e34dc9a67205d98ccc9a41ca ]
Wired GIP devices present multiple interfaces with the same USB identification other than the interface number. This adds constants for differentiating two of them and uses them where appropriate
--- drivers/input/joystick/xpad.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/input/joystick/xpad.c +4 -1
@@ -506,6 +506,9 @@ struct xboxone_init_packet { } +#define GIP_WIRED_INTF_DATA 0 +#define GIP_WIRED_INTF_AUDIO 1 +/* * This packet is required for all Xbox One pads with 2015 * or later firmware installed (or present from the factory).
@@ -1830,7 +1833,7 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id }if (xpad->xtype ==XTYPE_XBOXONE && - intf->cur_altsetting->desc.bInterfaceNumber !=0 ) { + intf->cur_altsetting->desc.bInterfaceNumber !=GIP_WIRED_INTF_DATA ) {/* * The Xbox One controller lists three interfaces all with the * same interface class, subclass and protocol. Differentiate by
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 36/86 phy: st: miphy28lp: use _poll_timeout functions for waits
In reply to Greg Kroah-HartmanFrom: Alain Volmat <[email protected]>
[ Upstream commit e3be4dd2c8d8aabfd2c3127d0e2e5754d3ae82d6 ]
This commit introduces _poll_timeout functions usage instead of wait loops waiting for a status bit.
--- drivers/phy/st/phy-miphy28lp.c | 42 ++++++++-------------------------- 1 file changed, 10 insertions(+), 32 deletions(-)
drivers/phy/st/phy-miphy28lp.c +10 -32
@@ -13,6 +13,7 @@#include <linux/platform_device.h> #include <linux/io.h> +#include <linux/iopoll.h> #include <linux/kernel.h> #include <linux/module.h> #include <linux/of.h>
@@ -488,19 +489,11 @@ static inline void miphy28lp_pcie_config_gen(struct miphy28lp_phy *miphy_phy)static inline int miphy28lp_wait_compensation (struct miphy28lp_phy *miphy_phy) { -unsigned long finish = jiffies +5 *HZ ;u8 val;/* Waiting for Compensation to complete */ -do { - val =readb_relaxed (miphy_phy->base +MIPHY_COMP_FSM_6 ); - -if (time_after_eq (jiffies, finish)) -return -EBUSY ; -cpu_relax (); - }while (!(val &COMP_DONE )); - -return 0 ; +return readb_relaxed_poll_timeout (miphy_phy->base +MIPHY_COMP_FSM_6 , + val, val &COMP_DONE ,1 ,5 *USEC_PER_SEC ); }
@@ -809,7 +802,6 @@ static inline void miphy28lp_configure_usb3(struct miphy28lp_phy *miphy_phy)static inline int miphy_is_ready (struct miphy28lp_phy *miphy_phy) { -unsigned long finish = jiffies +5 *HZ ;u8 mask =HFC_PLL |HFC_RDY ;u8 val;
@@ -820,21 +812,14 @@ static inline int miphy_is_ready(struct miphy28lp_phy *miphy_phy)if (miphy_phy->type ==PHY_TYPE_SATA ) mask |=PHY_RDY ; -do { - val =readb_relaxed (miphy_phy->base +MIPHY_STATUS_1 ); -if ((val & mask) != mask) -cpu_relax (); -else -return 0 ; - }while (!time_after_eq (jiffies, finish)); - -return -EBUSY ; +return readb_relaxed_poll_timeout (miphy_phy->base +MIPHY_STATUS_1 , + val, (val & mask) == mask,1 , +5 *USEC_PER_SEC ); }static int miphy_osc_is_ready (struct miphy28lp_phy *miphy_phy) {struct miphy28lp_dev *miphy_dev = miphy_phy->phydev; -unsigned long finish = jiffies +5 *HZ ;u32 val;if (!miphy_phy->osc_rdy)
@@ -843,17 +828,10 @@ static int miphy_osc_is_ready(struct miphy28lp_phy *miphy_phy)if (!miphy_phy->syscfg_reg[SYSCFG_STATUS ])return -EINVAL ; -do { -regmap_read (miphy_dev->regmap, - miphy_phy->syscfg_reg[SYSCFG_STATUS ], &val); - -if ((val &MIPHY_OSC_RDY ) !=MIPHY_OSC_RDY ) -cpu_relax (); -else -return 0 ; - }while (!time_after_eq (jiffies, finish)); - -return -EBUSY ; +return regmap_read_poll_timeout (miphy_dev->regmap, + miphy_phy->syscfg_reg[SYSCFG_STATUS ], + val, val &MIPHY_OSC_RDY ,1 , +5 *USEC_PER_SEC ); } static int miphy28lp_get_resource_byname(struct device_node *child,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 19/86 gfs2: Fix inode height consistency check
In reply to Greg Kroah-HartmanFrom: Andreas Gruenbacher <[email protected]>
[ Upstream commit cfcdb5bad34f600aed7613c3c1a5e618111f77b7 ]
The maximum allowed height of an inode's metadata tree depends on the filesystem block size; it is lower for bigger-block filesystems. When reading in an inode, make sure that the height doesn't exceed the maximum allowed height.
Arrays like sd_heightsize are sized to be big enough for any filesystem block size; they will often be slightly bigger than what's needed for a specific filesystem.
--- fs/gfs2/glops.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/gfs2/glops.c +2 -1
@@ -333,6 +333,7 @@ static int inode_go_demote_ok(const struct gfs2_glock *gl)static int gfs2_dinode_in (struct gfs2_inode *ip,const void *buf) { +struct gfs2_sbd *sdp =GFS2_SB (&ip->i_inode);const struct gfs2_dinode *str = buf;struct timespec atime;u16 height, depth;
@@ -372,7 +373,7 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)/* i_diskflags and i_eattr must be set before gfs2_set_inode_flags() */ gfs2_set_inode_flags (&ip->i_inode); height =be16_to_cpu (str->di_height); -if (unlikely (height >GFS2_MAX_META_HEIGHT )) +if (unlikely (height > sdp->sd_max_height)) goto corrupt; ip->i_height = (u8 )height;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 37/86 mfd: dln2: Fix memory leak in dln2_probe()
In reply to Greg Kroah-HartmanFrom: Qiang Ning <[email protected]>
[ Upstream commit 96da8f148396329ba769246cb8ceaa35f1ddfc48 ]
When dln2_setup_rx_urbs() in dln2_probe() fails, error out_free forgets to call usb_put_dev() to decrease the refcount of dln2->usb_dev.
Fix this by adding usb_put_dev() in the error handling code of dln2_probe().
--- drivers/mfd/dln2.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/dln2.c +1 -0
@@ -804,6 +804,7 @@ static int dln2_probe(struct usb_interface *interface,dln2_stop_rx_urbs (dln2); out_free: +usb_put_dev (dln2->usb_dev);dln2_free (dln2);return ret;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 38/86 cpupower: Make TSC read per CPU for Mperf monitor
In reply to Greg Kroah-HartmanFrom: Wyes Karny <[email protected]>
[ Upstream commit c2adb1877b76fc81ae041e1db1a6ed2078c6746b ]
System-wide TSC read could cause a drift in C0 percentage calculation. Because if first TSC is read and then one by one mperf is read for all cpus, this introduces drift between mperf reading of later CPUs and TSC reading. To lower this drift read TSC per CPU and also just after mperf read. This technique improves C0 percentage calculation in Mperf monitor.
Before fix: (System 100% busy)
| Mperf || RAPL || Idle_Stats PKG|CORE| CPU| C0 | Cx | Freq || pack | core || POLL | C1 | C2 0| 0| 0| 87.15| 12.85| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 0| 256| 84.62| 15.38| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 1| 1| 87.15| 12.85| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 1| 257| 84.08| 15.92| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 2| 2| 86.61| 13.39| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 2| 258| 83.26| 16.74| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 3| 3| 86.61| 13.39| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 3| 259| 83.60| 16.40| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 4| 4| 86.33| 13.67| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 4| 260| 83.33| 16.67| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 5| 5| 86.06| 13.94| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 5| 261| 83.05| 16.95| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 6| 6| 85.51| 14.49| 2695||168659003|3970468|| 0.00| 0.00| 0.00
After fix: (System 100% busy)
| Mperf || RAPL || Idle_Stats PKG|CORE| CPU| C0 | Cx | Freq || pack | core || POLL | C1 | C2 0| 0| 0| 98.03| 1.97| 2415||163295480|3811189|| 0.00| 0.00| 0.00 0| 0| 256| 98.50| 1.50| 2394||163295480|3811189|| 0.00| 0.00| 0.00 0| 1| 1| 99.99| 0.01| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 1| 257| 99.99| 0.01| 2375||163295480|3811189|| 0.00| 0.00| 0.00 0| 2| 2| 99.99| 0.01| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 2| 258|100.00| 0.00| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 3| 3|100.00| 0.00| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 3| 259| 99.99| 0.01| 2435||163295480|3811189|| 0.00| 0.00| 0.00 0| 4| 4|100.00| 0.00| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 4| 260|100.00| 0.00| 2435||163295480|3811189|| 0.00| 0.00| 0.00 0| 5| 5| 99.99| 0.01| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 5| 261|100.00| 0.00| 2435||163295480|3811189|| 0.00| 0.00| 0.00 0| 6| 6|100.00| 0.00| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 6| 262|100.00| 0.00| 2435||163295480|3811189|| 0.00| 0.00| 0.00
--- .../utils/idle_monitor/mperf_monitor.c | 31 +++++++++---------- 1 file changed, 14 insertions(+), 17 deletions(-)
tools/power/cpupower/utils/idle_monitor/mperf_monitor.c +14 -17
@@ -67,8 +67,8 @@ static int max_freq_mode;*/ static unsigned long max_frequency; -static unsigned long long tsc_at_measure_start; -static unsigned long long tsc_at_measure_end; +static unsigned long long *tsc_at_measure_start; +static unsigned long long *tsc_at_measure_end;static unsigned long long *mperf_previous_count;static unsigned long long *aperf_previous_count;static unsigned long long *mperf_current_count;
@@ -131,7 +131,7 @@ static int mperf_get_count_percent(unsigned int id, double *percent, aperf_diff = aperf_current_count[cpu] - aperf_previous_count[cpu];if (max_freq_mode ==MAX_FREQ_TSC_REF ) { - tsc_diff = tsc_at_measure_end - tsc_at_measure_start; + tsc_diff = tsc_at_measure_end[cpu] - tsc_at_measure_start[cpu]; *percent =100.0 * mperf_diff / tsc_diff;dprint ("%s: TSC Ref - mperf_diff: %llu, tsc_diff: %llu\n" , mperf_cstates[id].name, mperf_diff, tsc_diff);
@@ -168,7 +168,7 @@ static int mperf_get_count_freq(unsigned int id, unsigned long long *count,if (max_freq_mode ==MAX_FREQ_TSC_REF ) {/* Calculate max_freq from TSC count */ - tsc_diff = tsc_at_measure_end - tsc_at_measure_start; + tsc_diff = tsc_at_measure_end[cpu] - tsc_at_measure_start[cpu]; time_diff =timespec_diff_us (time_start, time_end); max_frequency = tsc_diff / time_diff; }
@@ -187,33 +187,27 @@ static int mperf_get_count_freq(unsigned int id, unsigned long long *count,static int mperf_start (void ) {int cpu; -unsigned long long dbg;clock_gettime (CLOCK_REALTIME , &time_start); -mperf_get_tsc (&tsc_at_measure_start); -for (cpu =0 ; cpu < cpu_count; cpu++) +for (cpu =0 ; cpu < cpu_count; cpu++) { +mperf_get_tsc (&tsc_at_measure_start[cpu]);mperf_init_stats (cpu); + } -mperf_get_tsc (&dbg); -dprint ("TSC diff: %llu\n" , dbg - tsc_at_measure_start);return 0 ; }static int mperf_stop (void ) { -unsigned long long dbg;int cpu; -for (cpu =0 ; cpu < cpu_count; cpu++) +for (cpu =0 ; cpu < cpu_count; cpu++) {mperf_measure_stats (cpu); +mperf_get_tsc (&tsc_at_measure_end[cpu]); + } -mperf_get_tsc (&tsc_at_measure_end);clock_gettime (CLOCK_REALTIME , &time_end); - -mperf_get_tsc (&dbg); -dprint ("TSC diff: %llu\n" , dbg - tsc_at_measure_end); -return 0 ; }
@@ -311,7 +305,8 @@ struct cpuidle_monitor *mperf_register(void) aperf_previous_count =calloc (cpu_count,sizeof (unsigned long long )); mperf_current_count =calloc (cpu_count,sizeof (unsigned long long )); aperf_current_count =calloc (cpu_count,sizeof (unsigned long long )); - + tsc_at_measure_start =calloc (cpu_count,sizeof (unsigned long long )); + tsc_at_measure_end =calloc (cpu_count,sizeof (unsigned long long )); mperf_monitor.name_len =strlen (mperf_monitor.name);return &mperf_monitor; }
@@ -322,6 +317,8 @@ void mperf_unregister(void)free (aperf_previous_count);free (mperf_current_count);free (aperf_current_count); +free (tsc_at_measure_start); +free (tsc_at_measure_end);free (is_valid); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 39/86 af_key: Reject optional tunnel/BEET mode templates in outbound policies
In reply to Greg Kroah-HartmanFrom: Tobias Brunner <[email protected]>
[ Upstream commit cf3128a7aca55b2eefb68281d44749c683bdc96f ]
xfrm_state_find() uses encap_family of the current template with the passed local and remote addresses to find a matching state. If an optional tunnel or BEET mode template is skipped in a mixed-family scenario, there could be a mismatch causing an out-of-bounds read as the addresses were not replaced to match the family of the next template.
While there are theoretical use cases for optional templates in outbound policies, the only practical one is to skip IPComp states in inbound policies if uncompressed packets are received that are handled by an implicitly created IPIP state instead.
--- net/key/af_key.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/key/af_key.c +8 -4
@@ -1950,7 +1950,8 @@ static u32 gen_reqid(struct net *net) }static int -parse_ipsecrequest (struct xfrm_policy *xp,struct sadb_x_ipsecrequest *rq) +parse_ipsecrequest (struct xfrm_policy *xp,struct sadb_x_policy *pol, +struct sadb_x_ipsecrequest *rq) {struct net *net =xp_net (xp);struct xfrm_tmpl *t = xp->xfrm_vec + xp->xfrm_nr;
@@ -1968,9 +1969,12 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)if ((mode =pfkey_mode_to_xfrm (rq->sadb_x_ipsecrequest_mode)) <0 )return -EINVAL ; t->mode = mode; -if (rq->sadb_x_ipsecrequest_level ==IPSEC_LEVEL_USE ) +if (rq->sadb_x_ipsecrequest_level ==IPSEC_LEVEL_USE ) { +if ((mode ==XFRM_MODE_TUNNEL || mode ==XFRM_MODE_BEET ) && + pol->sadb_x_policy_dir ==IPSEC_DIR_OUTBOUND ) +return -EINVAL ; t->optional =1 ; -else if (rq->sadb_x_ipsecrequest_level ==IPSEC_LEVEL_UNIQUE ) { + }else if (rq->sadb_x_ipsecrequest_level ==IPSEC_LEVEL_UNIQUE ) { t->reqid = rq->sadb_x_ipsecrequest_reqid;if (t->reqid >IPSEC_MANUAL_REQID_MAX ) t->reqid =0 ;
@@ -2012,7 +2016,7 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol) rq->sadb_x_ipsecrequest_len < sizeof(*rq))return -EINVAL ; -if ((err =parse_ipsecrequest (xp, rq)) <0 ) +if ((err =parse_ipsecrequest (xp, pol, rq)) <0 )return err; len -= rq->sadb_x_ipsecrequest_len; rq = (void *)((u8 *)rq + rq->sadb_x_ipsecrequest_len);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 40/86 net: fec: Better handle pm_runtime_get() failing in .remove()
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit f816b9829b19394d318e01953aa3b2721bca040d ]
In the (unlikely) event that pm_runtime_get() (disguised as pm_runtime_resume_and_get()) fails, the remove callback returned an error early. The problem with this is that the driver core ignores the error value and continues removing the device. This results in a resource leak. Worse the devm allocated resources are freed and so if a callback of the driver is called later the register mapping is already gone which probably results in a crash.
--- drivers/net/ethernet/freescale/fec_main.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/net/ethernet/freescale/fec_main.c +10 -3
@@ -3569,7 +3569,9 @@ fec_drv_remove(struct platform_device *pdev) ret =pm_runtime_get_sync (&pdev->dev);if (ret <0 ) -return ret; +dev_err (&pdev->dev, +"Failed to resume device in remove callback (%pe)\n" , +ERR_PTR (ret));cancel_work_sync (&fep->tx_timeout_work);fec_ptp_stop (pdev);
@@ -3582,8 +3584,13 @@ fec_drv_remove(struct platform_device *pdev)of_phy_deregister_fixed_link (np);of_node_put (fep->phy_node); -clk_disable_unprepare (fep->clk_ahb); -clk_disable_unprepare (fep->clk_ipg); +/* After pm_runtime_get_sync() failed, the clks are still off, so skip +* disabling them again. +*/ +if (ret >=0 ) { +clk_disable_unprepare (fep->clk_ahb); +clk_disable_unprepare (fep->clk_ipg); + }pm_runtime_put_noidle (&pdev->dev);pm_runtime_disable (&pdev->dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 41/86 vsock: avoid to close connected socket after the timeout
In reply to Greg Kroah-HartmanFrom: Zhuang Shengen <[email protected]>
[ Upstream commit 6d4486efe9c69626cab423456169e250a5cd3af5 ]
When client and server establish a connection through vsock, the client send a request to the server to initiate the connection, then start a timer to wait for the server's response. When the server's RESPONSE message arrives, the timer also times out and exits. The server's RESPONSE message is processed first, and the connection is established. However, the client's timer also times out, the original processing logic of the client is to directly set the state of this vsock to CLOSE and return ETIMEDOUT. It will not notify the server when the port is released, causing the server port remain.
when client's vsock_connect timeout，it should check sk state is ESTABLISHED or not. if sk state is ESTABLISHED, it means the connection is established, the client should not set the sk state to CLOSE
Note: I encountered this issue on kernel-4.18, which can be fixed by this patch. Then I checked the latest code in the community and found similar issue.
--- net/vmw_vsock/af_vsock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/vmw_vsock/af_vsock.c +1 -1
@@ -1247,7 +1247,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,vsock_transport_cancel_pkt (vsk);vsock_remove_connected (vsk); goto out_wait; - }else if (timeout ==0 ) { + }else if ((sk->sk_state !=TCP_ESTABLISHED ) && (timeout ==0 )) { err = -ETIMEDOUT ; sk->sk_state =TCP_CLOSE ; sock->state =SS_UNCONNECTED ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 42/86 media: netup_unidvb: fix use-after-free at del_timer()
In reply to Greg Kroah-HartmanFrom: Duoming Zhou <[email protected]>
[ Upstream commit 0f5bb36bf9b39a2a96e730bf4455095b50713f63 ]
When Universal DVB card is detaching, netup_unidvb_dma_fini() uses del_timer() to stop dma->timeout timer. But when timer handler netup_unidvb_dma_timeout() is running, del_timer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below:
(cleanup routine) | (timer routine)
| mod_timer(&dev->tx_sim_timer, ..)
netup_unidvb_finidev() | (wait a time)
netup_unidvb_dma_fini() | netup_unidvb_dma_timeout()
del_timer(&dma->timeout); |
| ndev->pci_dev->dev //USEFix by changing del_timer() to del_timer_sync().
--- drivers/media/pci/netup_unidvb/netup_unidvb_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/pci/netup_unidvb/netup_unidvb_core.c +1 -1
@@ -707,7 +707,7 @@ static void netup_unidvb_dma_fini(struct netup_unidvb_dev *ndev, int num)netup_unidvb_dma_enable (dma,0 );msleep (50 );cancel_work_sync (&dma->work); -del_timer (&dma->timeout); +del_timer_sync (&dma->timeout); }static int netup_unidvb_dma_setup (struct netup_unidvb_dev *ndev)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 43/86 net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
In reply to Greg Kroah-HartmanFrom: Dong Chenchen <[email protected]>
[ Upstream commit c83b49383b595be50647f0c764a48c78b5f3c4f8 ]
As the call trace shows, skb_panic was caused by wrong skb->mac_header in nsh_gso_segment():
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 3 PID: 2737 Comm: syz Not tainted 6.3.0-next-20230505 #1 RIP: 0010:skb_panic+0xda/0xe0 call Trace: skb_push+0x91/0xa0 nsh_gso_segment+0x4f3/0x570 skb_mac_gso_segment+0x19e/0x270 __skb_gso_segment+0x1e8/0x3c0 validate_xmit_skb+0x452/0x890 validate_xmit_skb_list+0x99/0xd0 sch_direct_xmit+0x294/0x7c0 __dev_queue_xmit+0x16f0/0x1d70 packet_xmit+0x185/0x210 packet_snd+0xc15/0x1170 packet_sendmsg+0x7b/0xa0 sock_sendmsg+0x14f/0x160
The root cause is:nsh_gso_segment() use skb->network_header - nhoff to reset mac_header in skb_gso_error_unwind() if inner-layer protocol gso fails. However, skb->network_header may be reset by inner-layer protocol gso function e.g. mpls_gso_segment. skb->mac_header reset by the inaccurate network_header will be larger than skb headroom.
nsh_gso_segment
nhoff = skb->network_header - skb->mac_header;
__skb_pull(skb,nsh_len)
skb_mac_gso_segment
mpls_gso_segment
skb_reset_network_header(skb);//skb->network_header+=nsh_len
return -EINVAL;
skb_gso_error_unwind
skb_push(skb, nsh_len);
skb->mac_header = skb->network_header - nhoff;
// skb->mac_header > skb->headroom, cause skb_push panicUse correct mac_offset to restore mac_header and get rid of nhoff.
--- net/nsh/nsh.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
net/nsh/nsh.c +3 -5
@@ -18,13 +18,12 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb, netdev_features_t features) {struct sk_buff *segs =ERR_PTR (-EINVAL ); +u16 mac_offset = skb->mac_header;unsigned int nsh_len, mac_len;__be16 proto; -int nhoff;skb_reset_network_header (skb); - nhoff = skb->network_header - skb->mac_header; mac_len = skb->mac_len;if (unlikely (!pskb_may_pull (skb,NSH_BASE_HDR_LEN )))
@@ -49,15 +48,14 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb, segs =skb_mac_gso_segment (skb, features);if (IS_ERR_OR_NULL (segs)) {skb_gso_error_unwind (skb,htons (ETH_P_NSH ), nsh_len, - skb->network_header - nhoff, - mac_len); + mac_offset, mac_len); goto out; }for (skb = segs; skb; skb = skb->next) { skb->protocol =htons (ETH_P_NSH );__skb_push (skb, nsh_len); -skb_set_mac_header (skb, -nhoff); + skb->mac_header = mac_offset; skb->network_header = skb->mac_header + mac_len; skb->mac_len = mac_len; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 44/86 cassini: Fix a memory leak in the error handling path of cas_init_one()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 412cd77a2c24b191c65ea53025222418db09817c ]
cas_saturn_firmware_init() allocates some memory using vmalloc(). This memory is freed in the .remove() function but not it the error handling path of the probe.
Add the missing vfree() to avoid a memory leak, should an error occur.
--- drivers/net/ethernet/sun/cassini.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/sun/cassini.c +2 -0
@@ -5152,6 +5152,8 @@ static int cas_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)cas_shutdown (cp);mutex_unlock (&cp->pm_mutex); +vfree (cp->fw_data); +pci_iounmap (pdev, cp->regs);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 45/86 igb: fix bit_shift to be in [1..8] range
In reply to Greg Kroah-HartmanFrom: Aleksandr Loktionov <[email protected]>
[ Upstream commit 60d758659f1fb49e0d5b6ac2691ede8c0958795b ]
In igb_hash_mc_addr() the expression:
"mc_addr[4] >> 8 - bit_shift", right shifting "mc_addr[4]"
shift by more than 7 bits always yields zero, so hash becomes not so different. Add initialization with bit_shift = 1 and add a loop condition to ensure bit_shift will be always in [1..8] range.
--- drivers/net/ethernet/intel/igb/e1000_mac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/igb/e1000_mac.c +2 -2
@@ -445,7 +445,7 @@ void igb_mta_set(struct e1000_hw *hw, u32 hash_value)static u32 igb_hash_mc_addr (struct e1000_hw *hw,u8 *mc_addr) {u32 hash_value, hash_mask; -u8 bit_shift =0 ; +u8 bit_shift =1 ;/* Register count multiplied by bits per register */ hash_mask = (hw->mac.mta_reg_count *32 ) -1 ;
@@ -453,7 +453,7 @@ static u32 igb_hash_mc_addr(struct e1000_hw *hw, u8 *mc_addr)/* For a mc_filter_type of 0, bit_shift is the number of left-shifts * where 0xFF would still fall within the hash mask. */ -while (hash_mask >> bit_shift !=0xFF ) +while (hash_mask >> bit_shift !=0xFF && bit_shift <4 ) bit_shift++;/* The portion of the address that is used for the hash table
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 46/86 vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit dacab578c7c6cd06c50c89dfa36b0e0f10decd4e ]
syzbot triggered the following splat [1], sending an empty message through pppoe_sendmsg().
When VLAN_FLAG_REORDER_HDR flag is set, vlan_dev_hard_header() does not push extra bytes for the VLAN header, because vlan is offloaded.
Unfortunately vlan_dev_hard_start_xmit() first reads veth->h_vlan_proto before testing (vlan->flags & VLAN_FLAG_REORDER_HDR).
We need to swap the two conditions.
[1]
BUG: KMSAN: uninit-value in vlan_dev_hard_start_xmit+0x171/0x7f0 net/8021q/vlan_dev.c:111 vlan_dev_hard_start_xmit+0x171/0x7f0 net/8021q/vlan_dev.c:111 __netdev_start_xmit include/linux/netdevice.h:4883 [inline] netdev_start_xmit include/linux/netdevice.h:4897 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x253/0xa20 net/core/dev.c:3596 __dev_queue_xmit+0x3c7f/0x5ac0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3053 [inline] pppoe_sendmsg+0xa93/0xb80 drivers/net/ppp/pppoe.c:900 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555 __sys_sendmmsg+0x411/0xa50 net/socket.c:2641 __do_sys_sendmmsg net/socket.c:2670 [inline] __se_sys_sendmmsg net/socket.c:2667 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at:
slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:774 slab_alloc_node mm/slub.c:3452 [inline] kmem_cache_alloc_node+0x543/0xab0 mm/slub.c:3497 kmalloc_reserve+0x148/0x470 net/core/skbuff.c:520 __alloc_skb+0x3a7/0x850 net/core/skbuff.c:606 alloc_skb include/linux/skbuff.h:1277 [inline] sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2583 pppoe_sendmsg+0x3af/0xb80 drivers/net/ppp/pppoe.c:867 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555 __sys_sendmmsg+0x411/0xa50 net/socket.c:2641 __do_sys_sendmmsg net/socket.c:2670 [inline] __se_sys_sendmmsg net/socket.c:2667 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 29770 Comm: syz-executor.0 Not tainted 6.3.0-rc6-syzkaller-gc478e5b17829 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
--- net/8021q/vlan_dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/8021q/vlan_dev.c +2 -2
@@ -115,8 +115,8 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,* NOTE: THIS ASSUMES DIX ETHERNET, SPECIFICALLY NOT SUPPORTING * OTHER THINGS LIKE FDDI/TokenRing/802.3 SNAPs... */ -if (veth->h_vlan_proto != vlan->vlan_proto || - vlan->flags &VLAN_FLAG_REORDER_HDR ) { +if (vlan->flags &VLAN_FLAG_REORDER_HDR || + veth->h_vlan_proto != vlan->vlan_proto) {u16 vlan_tci; vlan_tci = vlan->vlan_id; vlan_tci |=vlan_dev_get_egress_qos_mask (dev, skb->priority);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 20/86 ext4: set goal start correctly in ext4_mb_normalize_request
In reply to Greg Kroah-HartmanFrom: Kemeng Shi <[email protected]>
[ Upstream commit b07ffe6927c75d99af534d685282ea188d9f71a6 ]
We need to set ac_g_ex to notify the goal start used in ext4_mb_find_by_goal. Set ac_g_ex instead of ac_f_ex in ext4_mb_normalize_request.
Besides we should assure goal start is in range [first_data_block, blocks_count) as ext4_mb_initialize_context does.
[ Added a check to make sure size is less than ar->pright; otherwise
we could end up passing an underflowed value of ar->pright - size to ext4_get_group_no_and_offset(), which will trigger a BUG_ON later on.
- TYT ]
--- fs/ext4/mballoc.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
fs/ext4/mballoc.c +10 -6
@@ -3116,6 +3116,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac, struct ext4_allocation_request *ar) {struct ext4_sb_info *sbi =EXT4_SB (ac->ac_sb); +struct ext4_super_block *es = sbi->s_es;int bsbits, max;ext4_lblk_t end;loff_t size, start_off;
@@ -3296,18 +3297,21 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac, ac->ac_g_ex.fe_len =EXT4_NUM_B2C (sbi, size);/* define goal start in order to merge */ -if (ar->pright && (ar->lright == (start + size))) { +if (ar->pright && (ar->lright == (start + size)) && + ar->pright >= size && + ar->pright - size >=le32_to_cpu (es->s_first_data_block)) {/* merge to the right */ ext4_get_group_no_and_offset (ac->ac_sb, ar->pright - size, - &ac->ac_f_ex.fe_group, - &ac->ac_f_ex.fe_start); + &ac->ac_g_ex.fe_group, + &ac->ac_g_ex.fe_start); ac->ac_flags |=EXT4_MB_HINT_TRY_GOAL ; } -if (ar->pleft && (ar->lleft +1 == start)) { +if (ar->pleft && (ar->lleft +1 == start) && + ar->pleft +1 <ext4_blocks_count (es)) {/* merge to the left */ ext4_get_group_no_and_offset (ac->ac_sb, ar->pleft +1 , - &ac->ac_f_ex.fe_group, - &ac->ac_f_ex.fe_start); + &ac->ac_g_ex.fe_group, + &ac->ac_g_ex.fe_start); ac->ac_flags |=EXT4_MB_HINT_TRY_GOAL ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 21/86 ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()
In reply to Greg Kroah-HartmanFrom: Ojaswin Mujoo <[email protected]>
[ Upstream commit 93cdf49f6eca5e23f6546b8f28457b2e6a6961d9 ]
When the length of best extent found is less than the length of goal extent we need to make sure that the best extent atleast covers the start of the original request. This is done by adjusting the ac_b_ex.fe_logical (logical start) of the extent.
While doing so, the current logic sometimes results in the best extent's logical range overflowing the goal extent. Since this best extent is later added to the inode preallocation list, we have a possibility of introducing overlapping preallocations. This is discussed in detail here [1].
As per Jan's suggestion, to fix this, replace the existing logic with the below logic for adjusting best extent as it keeps fragmentation in check while ensuring logical range of best extent doesn't overflow out of goal extent:
1. Check if best extent can be kept at end of goal range and still cover original start.
2. Else, check if best extent can be kept at start of goal range and still cover original start.
3. Else, keep the best extent at start of original request.
Also, add a few extra BUG_ONs that might help catch errors faster.
[1] https://lore.kernel.org/r/[email protected]
--- fs/ext4/mballoc.c | 49 ++++++++++++++++++++++++++++++----------------- 1 file changed, 31 insertions(+), 18 deletions(-)
fs/ext4/mballoc.c +31 -18
@@ -3403,6 +3403,7 @@ static void ext4_mb_use_inode_pa(struct ext4_allocation_context *ac,BUG_ON (start < pa->pa_pstart);BUG_ON (end > pa->pa_pstart +EXT4_C2B (sbi, pa->pa_len));BUG_ON (pa->pa_free < len); +BUG_ON (ac->ac_b_ex.fe_len <=0 ); pa->pa_free -= len;mb_debug (1 ,"use %llu/%u from inode pa %p\n" , start, len, pa);
@@ -3707,10 +3708,8 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)return -ENOMEM ;if (ac->ac_b_ex.fe_len < ac->ac_g_ex.fe_len) { -int winl; -int wins; -int win; -int offs; +int new_bex_start; +int new_bex_end;/* we can't allocate as much as normalizer wants. * so, found space must get proper lstart
@@ -3718,26 +3717,40 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)BUG_ON (ac->ac_g_ex.fe_logical > ac->ac_o_ex.fe_logical);BUG_ON (ac->ac_g_ex.fe_len < ac->ac_o_ex.fe_len); -/* we're limited by original request in that -* logical block must be covered any way -* winl is window we can move our chunk within */ - winl = ac->ac_o_ex.fe_logical - ac->ac_g_ex.fe_logical; +/* +* Use the below logic for adjusting best extent as it keeps +* fragmentation in check while ensuring logical range of best +* extent doesn't overflow out of goal extent: +* +* 1. Check if best ex can be kept at end of goal and still +* cover original start +* 2. Else, check if best ex can be kept at start of goal and +* still cover original start +* 3. Else, keep the best ex at start of original request. +*/ + new_bex_end = ac->ac_g_ex.fe_logical + +EXT4_C2B (sbi, ac->ac_g_ex.fe_len); + new_bex_start = new_bex_end -EXT4_C2B (sbi, ac->ac_b_ex.fe_len); +if (ac->ac_o_ex.fe_logical >= new_bex_start) + goto adjust_bex; -/* also, we should cover whole original request */ - wins =EXT4_C2B (sbi, ac->ac_b_ex.fe_len - ac->ac_o_ex.fe_len); + new_bex_start = ac->ac_g_ex.fe_logical; + new_bex_end = + new_bex_start +EXT4_C2B (sbi, ac->ac_b_ex.fe_len); +if (ac->ac_o_ex.fe_logical < new_bex_end) + goto adjust_bex; -/* the smallest one defines real window */ - win =min (winl, wins); + new_bex_start = ac->ac_o_ex.fe_logical; + new_bex_end = + new_bex_start +EXT4_C2B (sbi, ac->ac_b_ex.fe_len); - offs = ac->ac_o_ex.fe_logical % -EXT4_C2B (sbi, ac->ac_b_ex.fe_len); -if (offs && offs < win) - win = offs; +adjust_bex: + ac->ac_b_ex.fe_logical = new_bex_start; - ac->ac_b_ex.fe_logical = ac->ac_o_ex.fe_logical - -EXT4_NUM_B2C (sbi, win);BUG_ON (ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical);BUG_ON (ac->ac_o_ex.fe_len > ac->ac_b_ex.fe_len); +BUG_ON (new_bex_end > (ac->ac_g_ex.fe_logical + +EXT4_C2B (sbi, ac->ac_g_ex.fe_len))); }/* preallocation can change ac_b_ex, thus we store actually
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 22/86 null_blk: Always check queue mode setting from configfs
In reply to Greg Kroah-HartmanFrom: Chaitanya Kulkarni <[email protected]>
[ Upstream commit 63f8793ee60513a09f110ea460a6ff2c33811cdb ]
Make sure to check device queue mode in the null_validate_conf() and return error for NULL_Q_RQ as we don't allow legacy I/O path, without this patch we get OOPs when queue mode is set to 1 from configfs, following are repro steps :-
modprobe null_blk nr_devices=0
mkdir config/nullb/nullb0
echo 1 > config/nullb/nullb0/memory_backed
echo 4096 > config/nullb/nullb0/blocksize
echo 20480 > config/nullb/nullb0/size
echo 1 > config/nullb/nullb0/queue_mode
echo 1 > config/nullb/nullb0/power
Entering kdb (current=0xffff88810acdd080, pid 2372) on processor 42 Oops: (null) due to oops @ 0xffffffffc041c329
CPU: 42 PID: 2372 Comm: sh Tainted: G O N 6.3.0-rc5lblk+ #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:null_add_dev.part.0+0xd9/0x720 [null_blk] Code: 01 00 00 85 d2 0f 85 a1 03 00 00 48 83 bb 08 01 00 00 00 0f 85 f7 03 00 00 80 bb 62 01 00 00 00 48 8b 75 20 0f 85 6d 02 00 00 <48> 89 6e 60 48 8b 75 20 bf 06 00 00 00 e8 f5 37 2c c1 48 8b 75 20 RSP: 0018:ffffc900052cbde0 EFLAGS: 00010246 RAX: 0000000000000001 RBX: ffff88811084d800 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888100042e00 RBP: ffff8881053d8200 R08: ffffc900052cbd68 R09: ffff888105db2000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000002 R13: ffff888104765200 R14: ffff88810eec1748 R15: ffff88810eec1740 FS: 00007fd445fd1740(0000) GS:ffff8897dfc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000060 CR3: 0000000166a00000 CR4: 0000000000350ee0 DR0: ffffffff8437a488 DR1: ffffffff8437a489 DR2: ffffffff8437a48a DR3: ffffffff8437a48b DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: <TASK> nullb_device_power_store+0xd1/0x120 [null_blk] configfs_write_iter+0xb4/0x120 vfs_write+0x2ba/0x3c0 ksys_write+0x5f/0xe0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fd4460c57a7 Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007ffd3792a4a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd4460c57a7 RDX: 0000000000000002 RSI: 000055b43c02e4c0 RDI: 0000000000000001 RBP: 000055b43c02e4c0 R08: 000000000000000a R09: 00007fd44615b4e0 R10: 00007fd44615b3e0 R11: 0000000000000246 R12: 0000000000000002 R13: 00007fd446198520 R14: 0000000000000002 R15: 00007fd446198700 </TASK>
--- drivers/block/null_blk.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/block/null_blk.c +5 -0
@@ -1780,6 +1780,11 @@ static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set)static void null_validate_conf (struct nullb_device *dev) { +if (dev->queue_mode ==NULL_Q_RQ ) { +pr_err ("legacy IO path is no longer available\n" ); +return -EINVAL ; + } + dev->blocksize =round_down (dev->blocksize,512 ); dev->blocksize = clamp_t(unsigned int, dev->blocksize, 512, 4096);if (dev->use_lightnvm && dev->blocksize !=4096 )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 23/86 wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit ef16799640865f937719f0771c93be5dca18adc6 ]
A received TKIP key may be up to 32 bytes because it may contain MIC rx/tx keys too. These are not used by iwl and copying these over overflows the iwl_keyinfo.key field.
Add a check to not copy more data to iwl_keyinfo.key then will fit.
This fixes backtraces like this one:
memcpy: detected field-spanning write (size 32) of single field "sta_cmd.key.key" at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 (size 16)
WARNING: CPU: 1 PID: 946 at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 iwlagn_send_sta_key+0x375/0x390 [iwldvm] <snip> Hardware name: Dell Inc. Latitude E6430/0H3MT5, BIOS A21 05/08/2017 RIP: 0010:iwlagn_send_sta_key+0x375/0x390 [iwldvm] <snip> Call Trace: <TASK> iwl_set_dynamic_key+0x1f0/0x220 [iwldvm] iwlagn_mac_set_key+0x1e4/0x280 [iwldvm] drv_set_key+0xa4/0x1b0 [mac80211] ieee80211_key_enable_hw_accel+0xa8/0x2d0 [mac80211] ieee80211_key_replace+0x22d/0x8e0 [mac80211] <snip>
--- drivers/net/wireless/intel/iwlwifi/dvm/sta.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/dvm/sta.c +4 -1
@@ -1101,6 +1101,7 @@ static int iwlagn_send_sta_key(struct iwl_priv *priv, {__le16 key_flags;struct iwl_addsta_cmd sta_cmd; +size_t to_copy;int i;spin_lock_bh (&priv->sta_lock);
@@ -1120,7 +1121,9 @@ static int iwlagn_send_sta_key(struct iwl_priv *priv, sta_cmd.key.tkip_rx_tsc_byte2 = tkip_iv32;for (i =0 ; i <5 ; i++) sta_cmd.key.tkip_rx_ttak[i] =cpu_to_le16 (tkip_p1k[i]); -memcpy (sta_cmd.key.key, keyconf->key, keyconf->keylen); +/* keyconf may contain MIC rx/tx keys which iwl does not use */ + to_copy =min_t (size_t,sizeof (sta_cmd.key.key), keyconf->keylen); +memcpy (sta_cmd.key.key, keyconf->key, to_copy);break ;case WLAN_CIPHER_SUITE_WEP104 : key_flags |=STA_KEY_FLG_KEY_SIZE_MSK ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 24/86 Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
In reply to Greg Kroah-HartmanFrom: Min Li <[email protected]>
[ Upstream commit 25e97f7b1866e6b8503be349eeea44bb52d661ce ]
conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance' is triggered.
--- net/bluetooth/l2cap_core.c | 1 - 1 file changed, 1 deletion(-)
net/bluetooth/l2cap_core.c +0 -1
@@ -4392,7 +4392,6 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, chan =l2cap_get_chan_by_scid (conn, scid);if (!chan) { -mutex_unlock (&conn->chan_lock);return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 25/86 staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE
In reply to Greg Kroah-HartmanFrom: Philipp Hortmann <[email protected]>
[ Upstream commit fda2093860df4812d69052a8cf4997e53853a340 ]
Replace macro RTL_PCI_DEVICE with PCI_DEVICE to get rid of rtl819xp_ops which is empty.
--- drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 6 +++--- drivers/staging/rtl8192e/rtl8192e/rtl_core.h | 5 ----- 2 files changed, 3 insertions(+), 8 deletions(-)
drivers/staging/rtl8192e/rtl8192e/rtl_core.c +3 -3
@@ -61,9 +61,9 @@ static const struct rtl819x_ops rtl819xp_ops = { };static struct pci_device_id rtl8192_pci_id_tbl[] = { - {RTL_PCI_DEVICE (0x10ec ,0x8192 , rtl819xp_ops)}, - {RTL_PCI_DEVICE (0x07aa ,0x0044 , rtl819xp_ops)}, - {RTL_PCI_DEVICE (0x07aa ,0x0047 , rtl819xp_ops)}, + {PCI_DEVICE (0x10ec ,0x8192 )}, + {PCI_DEVICE (0x07aa ,0x0044 )}, + {PCI_DEVICE (0x07aa ,0x0047 )}, {} };
drivers/staging/rtl8192e/rtl8192e/rtl_core.h +0 -5
@@ -67,11 +67,6 @@#define IS_HARDWARE_TYPE_8192SE (_priv) \ (((struct r8192_priv *)rtllib_priv(dev))->card_8192 == NIC_8192SE) -#define RTL_PCI_DEVICE (vend, dev, cfg) \ - .vendor = (vend), .device = (dev), \ - .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, \ - .driver_data = (kernel_ulong_t)&(cfg) -#define TOTAL_CAM_ENTRY 32#define CAM_CONTENT_COUNT 8
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 26/86 HID: logitech-hidpp: Dont use the USB serial for USB devices
In reply to Greg Kroah-HartmanFrom: Bastien Nocera <[email protected]>
[ Upstream commit 7ad1fe0da0fa91bf920b79ab05ae97bfabecc4f4 ]
For devices that support the 0x0003 feature (Device Information) version 4, set the serial based on the output of that feature, rather than relying on the usbhid code setting the USB serial.
This should allow the serial when connected through USB to (nearly) match the one when connected through a unifying receiver.
For example, on the serials on a G903 wired/wireless mouse:
- Unifying: 4067-e8-ce-cd-45
- USB before patch: 017C385C3837
- USB after patch: c086-e8-ce-cd-45
--- drivers/hid/hid-logitech-hidpp.c | 51 ++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+)
drivers/hid/hid-logitech-hidpp.c +51 -0
@@ -777,6 +777,55 @@ static bool hidpp_is_connected(struct hidpp_device *hidpp)return ret ==0 ; } +/* -------------------------------------------------------------------------- */ +/* 0x0003: Device Information */ +/* -------------------------------------------------------------------------- */ + +#define HIDPP_PAGE_DEVICE_INFORMATION 0x0003 + +#define CMD_GET_DEVICE_INFO 0x00 + +static int hidpp_get_serial (struct hidpp_device *hidpp,u32 *serial) +{ +struct hidpp_report response; +u8 feature_type; +u8 feature_index; +int ret; + + ret =hidpp_root_get_feature (hidpp,HIDPP_PAGE_DEVICE_INFORMATION , + &feature_index, + &feature_type); +if (ret) +return ret; + + ret =hidpp_send_fap_command_sync (hidpp, feature_index, +CMD_GET_DEVICE_INFO , +NULL ,0 , &response); +if (ret) +return ret; + +/* See hidpp_unifying_get_serial() */ + *serial = *((u32 *)&response.rap.params[1 ]); +return 0 ; +} + +static int hidpp_serial_init (struct hidpp_device *hidpp) +{ +struct hid_device *hdev = hidpp->hid_dev; +u32 serial; +int ret; + + ret =hidpp_get_serial (hidpp, &serial); +if (ret) +return ret; + +snprintf (hdev->uniq,sizeof (hdev->uniq),"%04x-%4phD" , + hdev->product, &serial); +dbg_hid ("HID++ DeviceInformation: Got serial: %s\n" , hdev->uniq); + +return 0 ; +} +/* -------------------------------------------------------------------------- */ /* 0x0005: GetDeviceNameType */ /* -------------------------------------------------------------------------- */
@@ -3039,6 +3088,8 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)if (hidpp->quirks &HIDPP_QUIRK_UNIFYING )hidpp_unifying_init (hidpp); +else if (hid_is_usb (hidpp->hid_dev)) +hidpp_serial_init (hidpp); connected =hidpp_is_connected (hidpp);atomic_set (&hidpp->connected, connected);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 17/86 lib: cpu_rmap: Avoid use after free on rmap->obj array entries
In reply to Greg Kroah-HartmanFrom: Eli Cohen <[email protected]>
[ Upstream commit 4e0473f1060aa49621d40a113afde24818101d37 ]
When calling irq_set_affinity_notifier() with NULL at the notify argument, it will cause freeing of the glue pointer in the corresponding array entry but will leave the pointer in the array. A subsequent call to free_irq_cpu_rmap() will try to free this entry again leading to possible use after free.
Fix that by setting NULL to the array entry and checking that we have non-zero at the array entry when iterating over the array in free_irq_cpu_rmap().
The current code does not suffer from this since there are no cases where irq_set_affinity_notifier(irq, NULL) (note the NULL passed for the notify arg) is called, followed by a call to free_irq_cpu_rmap() so we don't hit and issue. Subsequent patches in this series excersize this flow, hence the required fix.
--- lib/cpu_rmap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
lib/cpu_rmap.c +4 -1
@@ -235,7 +235,8 @@ void free_irq_cpu_rmap(struct cpu_rmap *rmap)for (index =0 ; index < rmap->used; index++) { glue = rmap->obj[index]; -irq_set_affinity_notifier (glue->notify.irq,NULL ); +if (glue) +irq_set_affinity_notifier (glue->notify.irq,NULL ); }cpu_rmap_put (rmap);
@@ -271,6 +272,7 @@ static void irq_cpu_rmap_release(struct kref *ref) container_of(ref, struct irq_glue, notify.kref);cpu_rmap_put (glue->rmap); + glue->rmap->obj[glue->index] =NULL ;kfree (glue); }
@@ -300,6 +302,7 @@ int irq_cpu_rmap_add(struct cpu_rmap *rmap, int irq) rc =irq_set_affinity_notifier (irq, &glue->notify);if (rc) {cpu_rmap_put (glue->rmap); + rmap->obj[glue->index] =NULL ;kfree (glue); }return rc;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 48/86 ALSA: hda: Fix Oops by 9.1 surround channel names
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 3b44ec8c5c44790a82f07e90db45643c762878c6 upstream.
get_line_out_pfx() may trigger an Oops by overflowing the static array with more than 8 channels. This was reported for MacBookPro 12,1 with Cirrus codec.
As a workaround, extend for the 9.1 channels and also fix the potential Oops by unifying the code paths accessing the same array with the proper size check.
--- sound/pci/hda/hda_generic.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
sound/pci/hda/hda_generic.c +4 -3
@@ -1157,8 +1157,8 @@ static bool path_has_mixer(struct hda_coreturn path && path->ctls[ctl_type]; } -static const char *const channel_name[4 ] = { -"Front" ,"Surround" ,"CLFE" ,"Side" +static const char *const channel_name[] = { +"Front" ,"Surround" ,"CLFE" ,"Side" ,"Back" , };/* give some appropriate ctl name prefix for the given line out channel */
@@ -1184,7 +1184,7 @@ static const char *get_line_out_pfx(stru/* multi-io channels */ if (ch >= cfg->line_outs) -return channel_name[ch]; + goto fixed_name;switch (cfg->line_out_type) {case AUTO_PIN_SPEAKER_OUT :
@@ -1236,6 +1236,7 @@ static const char *get_line_out_pfx(struif (cfg->line_outs ==1 && !spec->multi_ios)return "Line Out" ; + fixed_name:if (ch >=ARRAY_SIZE (channel_name)) {snd_BUG ();return "PCM" ;
Greg Kroah-Hartman
maintainerPATCH 57/86 spi: fsl-cpm: Use 16 bit mode for large transfers with even size
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
(cherry picked from upstream fc96ec826bced75cc6b9c07a4ac44bbf651337ab)
On CPM, the RISC core is a lot more efficiant when doing transfers in 16-bits chunks than in 8-bits chunks, but unfortunately the words need to be byte swapped as seen in a previous commit.
So, for large tranfers with an even size, allocate a temporary tx buffer and byte-swap data before and after transfer.
This change allows setting higher speed for transfer. For instance on an MPC 8xx (CPM1 comms RISC processor), the documentation tells that transfer in byte mode at 1 kbit/s uses 0.200% of CPM load at 25 MHz while a word transfer at the same speed uses 0.032% of CPM load. This means the speed can be 6 times higher in word mode for the same CPM load.
For the time being, only do it on CPM1 as there must be a trade-off between the CPM load reduction and the CPU load required to byte swap the data.
--- drivers/spi/spi-fsl-cpm.c | 23 +++++++++++++++++++++++ drivers/spi/spi-fsl-spi.c | 3 +++ 2 files changed, 26 insertions(+)
drivers/spi/spi-fsl-cpm.c +23 -0
@@ -25,6 +25,7 @@#include <linux/spi/spi.h> #include <linux/types.h> #include <linux/platform_device.h> +#include <linux/byteorder/generic.h> #include "spi-fsl-cpm.h" #include "spi-fsl-lib.h"
@@ -124,6 +125,21 @@ int fsl_spi_cpm_bufs(struct mpc8xxx_spi mspi->rx_dma = mspi->dma_dummy_rx; mspi->map_rx_dma =0 ; } +if (t->bits_per_word ==16 && t->tx_buf) { +const u16 *src = t->tx_buf; +u16 *dst; +int i; + + dst =kmalloc (t->len,GFP_KERNEL ); +if (!dst) +return -ENOMEM ; + +for (i =0 ; i < t->len >>1 ; i++) + dst[i] =cpu_to_le16p (src + i); + + mspi->tx = dst; + mspi->map_tx_dma =1 ; + }if (mspi->map_tx_dma) {void *nonconst_tx = (void *)mspi->tx;/* shut up gcc */
@@ -177,6 +193,13 @@ void fsl_spi_cpm_bufs_complete(struct mpif (mspi->map_rx_dma)dma_unmap_single (dev, mspi->rx_dma, t->len,DMA_FROM_DEVICE ); mspi->xfer_in_progress =NULL ; + +if (t->bits_per_word ==16 && t->rx_buf) { +int i; + +for (i =0 ; i < t->len; i +=2 ) +le16_to_cpus (t->rx_buf + i); + } }EXPORT_SYMBOL_GPL (fsl_spi_cpm_bufs_complete);
drivers/spi/spi-fsl-spi.c +3 -0
@@ -366,6 +366,9 @@ static int fsl_spi_do_one_msg(struct spireturn -EINVAL ;if (t->bits_per_word ==16 || t->bits_per_word ==32 ) t->bits_per_word =8 ;/* pretend its 8 bits */ +if (t->bits_per_word ==8 && t->len >=256 && + (mpc8xxx_spi->flags &SPI_CPM1 )) + t->bits_per_word =16 ; } }
Greg Kroah-Hartman
maintainerPATCH 58/86 m68k: Move signal frame following exception on 68020/030
In reply to Greg Kroah-HartmanFrom: Finn Thain <[email protected]>
commit b845b574f86dcb6a70dfa698aa87a237b0878d2a upstream.
On 68030/020, an instruction such as, moveml %a2-%a3/%a5,%sp@- may cause a stack page fault during instruction execution (i.e. not at an instruction boundary) and produce a format 0xB exception frame.
In this situation, the value of USP will be unreliable. If a signal is to be delivered following the exception, this USP value is used to calculate the location for a signal frame. This can result in a corrupted user stack.
The corruption was detected in dash (actually in glibc) where it showed up as an intermittent "stack smashing detected" message and crash following signal delivery for SIGCHLD.
It was hard to reproduce that failure because delivery of the signal raced with the page fault and because the kernel places an unpredictable gap of up to 7 bytes between the USP and the signal frame.
A format 0xB exception frame can be produced by a bus error or an address error. The 68030 Users Manual says that address errors occur immediately upon detection during instruction prefetch. The instruction pipeline allows prefetch to overlap with other instructions, which means an address error can arise during the execution of a different instruction. So it seems likely that this patch may help in the address error case also.
--- arch/m68k/kernel/signal.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
arch/m68k/kernel/signal.c +10 -4
@@ -819,11 +819,17 @@ static inline int rt_setup_ucontext(stru }static inline void __user * -get_sigframe (struct ksignal *ksig,size_t frame_size) +get_sigframe (struct ksignal *ksig,struct pt_regs *tregs,size_t frame_size) {unsigned long usp =sigsp (rdusp (), ksig); +unsigned long gap =0 ; -return (void __user *)((usp - frame_size) &-8UL ); +if (CPU_IS_020_OR_030 && tregs->format ==0xb ) { +/* USP is unreliable so use worst-case value */ + gap =256 ; + } + +return (void __user *)((usp - gap - frame_size) &-8UL ); } static int setup_frame(struct ksignal *ksig, sigset_t *set,
@@ -841,7 +847,7 @@ static int setup_frame(struct ksignal *kreturn -EFAULT ; } - frame =get_sigframe (ksig,sizeof (*frame) + fsize); + frame =get_sigframe (ksig, tregs,sizeof (*frame) + fsize);if (fsize) err |=copy_to_user (frame +1 , regs +1 , fsize);
@@ -912,7 +918,7 @@ static int setup_rt_frame(struct ksignalreturn -EFAULT ; } - frame =get_sigframe (ksig,sizeof (*frame)); + frame =get_sigframe (ksig, tregs,sizeof (*frame));if (fsize) err |=copy_to_user (&frame->uc.uc_extra, regs +1 , fsize);
Greg Kroah-Hartman
maintainerPATCH 59/86 parisc: Allow to reboot machine after system halt
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 2028315cf59bb899a5ac7e87dc48ecb8fac7ac24 upstream.
In case a machine can't power-off itself on system shutdown, allow the user to reboot it by pressing the RETURN key.
--- arch/parisc/kernel/process.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
arch/parisc/kernel/process.c +8 -3
@@ -142,13 +142,18 @@ void machine_power_off(void)/* It seems we have no way to power the system off via * software. The user has to press the button himself. */ -printk (KERN_EMERG "System shut down completed.\n" -"Please power this system off now." ); +printk ("Power off or press RETURN to reboot.\n" );/* prevent soft lockup/stalled CPU messages for endless loop. */ rcu_sysrq_start ();lockup_detector_soft_poweroff (); -for (;;); +while (1 ) { +/* reboot if user presses RETURN key */ +if (pdc_iodc_getc () ==13 ) { +printk ("Rebooting...\n" ); +machine_restart (NULL ); + } + } }void (*pm_power_off)(void ) = machine_power_off;
Greg Kroah-Hartman
maintainerPATCH 60/86 netfilter: nftables: add nft_parse_register_load() and use it
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ backport of 4f16d25c68ec844299a4df6ecbb0234eaf88a935 ]
This new function combines the netlink register attribute parser and the load validation function.
This update requires to replace:
enum nft_registers sreg:8;
in many of the expression private areas otherwise compiler complains with:
error: cannot take address of bit-field ‘sreg’
when passing the register field as reference.
--- include/net/netfilter/nf_tables.h | 2 - include/net/netfilter/nf_tables_core.h | 12 +++++++++-- include/net/netfilter/nft_masq.h | 4 +-- include/net/netfilter/nft_meta.h | 2 - include/net/netfilter/nft_redir.h | 4 +-- net/ipv4/netfilter/nft_dup_ipv4.c | 18 ++++++++-------- net/ipv6/netfilter/nft_dup_ipv6.c | 18 ++++++++-------- net/netfilter/nf_tables_api.c | 18 +++++++++++++++- net/netfilter/nft_bitwise.c | 6 ++--- net/netfilter/nft_byteorder.c | 6 ++--- net/netfilter/nft_cmp.c | 8 ++----- net/netfilter/nft_ct.c | 5 +--- net/netfilter/nft_dup_netdev.c | 6 ++--- net/netfilter/nft_dynset.c | 12 +++++------ net/netfilter/nft_exthdr.c | 6 ++--- net/netfilter/nft_fwd_netdev.c | 6 ++--- net/netfilter/nft_hash.c | 10 +++++---- net/netfilter/nft_lookup.c | 6 ++--- net/netfilter/nft_masq.c | 14 ++++--------- net/netfilter/nft_meta.c | 3 -- net/netfilter/nft_nat.c | 35 +++++++++++++-------------------- net/netfilter/nft_objref.c | 6 ++--- net/netfilter/nft_payload.c | 4 +-- net/netfilter/nft_queue.c | 12 +++++------ net/netfilter/nft_range.c | 6 ++--- net/netfilter/nft_redir.c | 14 ++++--------- 26 files changed, 124 insertions(+), 119 deletions(-)
include/net/netfilter/nf_tables.h +1 -1
@@ -198,7 +198,7 @@ int nft_parse_u32_check(const struct nlaunsigned int nft_parse_register (const struct nlattr *attr);int nft_dump_register (struct sk_buff *skb,unsigned int attr,unsigned int reg); -int nft_validate_register_load (enum nft_registers reg,unsigned int len); +int nft_parse_register_load (const struct nlattr *attr,u8 *sreg,u32 len); int nft_validate_register_store(const struct nft_ctx *ctx, enum nft_registers reg, const struct nft_data *data,
include/net/netfilter/nf_tables_core.h +10 -2
@@ -14,9 +14,17 @@ extern struct nft_expr_type nft_range_tyint nf_tables_core_module_init (void );void nf_tables_core_module_exit (void ); +struct nft_bitwise_fast_expr { +u32 mask; +u32 xor; +u8 sreg; +enum nft_registers dreg:8 ; +}; +struct nft_cmp_fast_expr {u32 data; -enum nft_registers sreg:8 ; +u32 mask; +u8 sreg;u8 len; };
@@ -43,7 +51,7 @@ struct nft_payload_set { enum nft_payload_bases base:8;u8 offset;u8 len; - enum nft_registers sreg:8; +u8 sreg;u8 csum_type;u8 csum_offset;u8 csum_flags;
include/net/netfilter/nft_masq.h +2 -2
@@ -4,8 +4,8 @@struct nft_masq {u32 flags; -enum nft_registers sreg_proto_min:8 ; -enum nft_registers sreg_proto_max:8 ; +u8 sreg_proto_min; +u8 sreg_proto_max; };extern const struct nla_policy nft_masq_policy[];
include/net/netfilter/nft_meta.h +1 -1
@@ -6,7 +6,7 @@ struct nft_meta { enum nft_meta_keys key:8;union {enum nft_registers dreg:8 ; -enum nft_registers sreg:8 ; +u8 sreg; }; };
include/net/netfilter/nft_redir.h +2 -2
@@ -3,8 +3,8 @@#define _NFT_REDIR_H_struct nft_redir { -enum nft_registers sreg_proto_min:8 ; -enum nft_registers sreg_proto_max:8 ; +u8 sreg_proto_min; +u8 sreg_proto_max;u16 flags; };
net/ipv4/netfilter/nft_dup_ipv4.c +9 -9
@@ -16,8 +16,8 @@#include <net/netfilter/ipv4/nf_dup_ipv4.h> struct nft_dup_ipv4 { -enum nft_registers sreg_addr:8 ; -enum nft_registers sreg_dev:8 ; +u8 sreg_addr; +u8 sreg_dev; }; static void nft_dup_ipv4_eval(const struct nft_expr *expr,
@@ -43,16 +43,16 @@ static int nft_dup_ipv4_init(const strucif (tb[NFTA_DUP_SREG_ADDR ] ==NULL )return -EINVAL ; - priv->sreg_addr =nft_parse_register (tb[NFTA_DUP_SREG_ADDR ]); - err =nft_validate_register_load (priv->sreg_addr,sizeof (struct in_addr )); + err =nft_parse_register_load (tb[NFTA_DUP_SREG_ADDR ], &priv->sreg_addr, +sizeof (struct in_addr ));if (err <0 )return err; -if (tb[NFTA_DUP_SREG_DEV ] !=NULL ) { - priv->sreg_dev =nft_parse_register (tb[NFTA_DUP_SREG_DEV ]); -return nft_validate_register_load (priv->sreg_dev,sizeof (int )); - } -return 0 ; +if (tb[NFTA_DUP_SREG_DEV ]) + err =nft_parse_register_load (tb[NFTA_DUP_SREG_DEV ], + &priv->sreg_dev,sizeof (int )); + +return err; }static int nft_dup_ipv4_dump (struct sk_buff *skb,const struct nft_expr *expr)
net/ipv6/netfilter/nft_dup_ipv6.c +9 -9
@@ -16,8 +16,8 @@#include <net/netfilter/ipv6/nf_dup_ipv6.h> struct nft_dup_ipv6 { -enum nft_registers sreg_addr:8 ; -enum nft_registers sreg_dev:8 ; +u8 sreg_addr; +u8 sreg_dev; }; static void nft_dup_ipv6_eval(const struct nft_expr *expr,
@@ -41,16 +41,16 @@ static int nft_dup_ipv6_init(const strucif (tb[NFTA_DUP_SREG_ADDR ] ==NULL )return -EINVAL ; - priv->sreg_addr =nft_parse_register (tb[NFTA_DUP_SREG_ADDR ]); - err =nft_validate_register_load (priv->sreg_addr,sizeof (struct in6_addr )); + err =nft_parse_register_load (tb[NFTA_DUP_SREG_ADDR ], &priv->sreg_addr, +sizeof (struct in6_addr ));if (err <0 )return err; -if (tb[NFTA_DUP_SREG_DEV ] !=NULL ) { - priv->sreg_dev =nft_parse_register (tb[NFTA_DUP_SREG_DEV ]); -return nft_validate_register_load (priv->sreg_dev,sizeof (int )); - } -return 0 ; +if (tb[NFTA_DUP_SREG_DEV ]) + err =nft_parse_register_load (tb[NFTA_DUP_SREG_DEV ], + &priv->sreg_dev,sizeof (int )); + +return err; }static int nft_dup_ipv6_dump (struct sk_buff *skb,const struct nft_expr *expr)
net/netfilter/nf_tables_api.c +16 -2
@@ -5663,7 +5663,7 @@ EXPORT_SYMBOL_GPL(nft_dump_register);* Validate that the input register is one of the general purpose * registers and that the length of the load is within the bounds. */ -int nft_validate_register_load (enum nft_registers reg,unsigned int len) +static int nft_validate_register_load (enum nft_registers reg,unsigned int len) {if (reg <NFT_REG_1 *NFT_REG_SIZE /NFT_REG32_SIZE )return -EINVAL ;
@@ -5674,7 +5674,21 @@ int nft_validate_register_load(enum nft_return 0 ; } -EXPORT_SYMBOL_GPL (nft_validate_register_load); + +int nft_parse_register_load (const struct nlattr *attr,u8 *sreg,u32 len) +{ +u32 reg; +int err; + + reg =nft_parse_register (attr); + err =nft_validate_register_load (reg, len); +if (err <0 ) +return err; + + *sreg = reg; +return 0 ; +} +EXPORT_SYMBOL_GPL (nft_parse_register_load);/** * nft_validate_register_store - validate an expressions' register store
net/netfilter/nft_bitwise.c +3 -3
@@ -18,7 +18,7 @@#include <net/netfilter/nf_tables.h> struct nft_bitwise { -enum nft_registers sreg:8 ; +u8 sreg;enum nft_registers dreg:8 ;u8 len;struct nft_data mask;
@@ -68,8 +68,8 @@ static int nft_bitwise_init(const struct priv->len = len; - priv->sreg =nft_parse_register (tb[NFTA_BITWISE_SREG ]); - err =nft_validate_register_load (priv->sreg, priv->len); + err =nft_parse_register_load (tb[NFTA_BITWISE_SREG ], &priv->sreg, + priv->len);if (err <0 )return err;
net/netfilter/nft_byteorder.c +3 -3
@@ -19,7 +19,7 @@#include <net/netfilter/nf_tables.h> struct nft_byteorder { -enum nft_registers sreg:8 ; +u8 sreg;enum nft_registers dreg:8 ;enum nft_byteorder_ops op:8 ;u8 len;
@@ -133,14 +133,14 @@ static int nft_byteorder_init(const strureturn -EINVAL ; } - priv->sreg =nft_parse_register (tb[NFTA_BYTEORDER_SREG ]); err =nft_parse_u32_check (tb[NFTA_BYTEORDER_LEN ],U8_MAX , &len);if (err <0 )return err; priv->len = len; - err =nft_validate_register_load (priv->sreg, priv->len); + err =nft_parse_register_load (tb[NFTA_BYTEORDER_SREG ], &priv->sreg, + priv->len);if (err <0 )return err;
net/netfilter/nft_cmp.c +3 -5
@@ -19,7 +19,7 @@struct nft_cmp_expr {struct nft_data data; -enum nft_registers sreg:8 ; +u8 sreg;u8 len;enum nft_cmp_ops op:8 ; };
@@ -79,8 +79,7 @@ static int nft_cmp_init(const struct nft tb[NFTA_CMP_DATA]);BUG_ON (err <0 ); - priv->sreg =nft_parse_register (tb[NFTA_CMP_SREG ]); - err =nft_validate_register_load (priv->sreg, desc.len); + err =nft_parse_register_load (tb[NFTA_CMP_SREG ], &priv->sreg, desc.len);if (err <0 )return err;
@@ -129,8 +128,7 @@ static int nft_cmp_fast_init(const struc tb[NFTA_CMP_DATA]);BUG_ON (err <0 ); - priv->sreg =nft_parse_register (tb[NFTA_CMP_SREG ]); - err =nft_validate_register_load (priv->sreg, desc.len); + err =nft_parse_register_load (tb[NFTA_CMP_SREG ], &priv->sreg, desc.len);if (err <0 )return err;
net/netfilter/nft_ct.c +2 -3
@@ -28,7 +28,7 @@ struct nft_ct { enum ip_conntrack_dir dir:8;union {enum nft_registers dreg:8 ; -enum nft_registers sreg:8 ; +u8 sreg; }; };
@@ -578,8 +578,7 @@ static int nft_ct_set_init(const struct } } - priv->sreg =nft_parse_register (tb[NFTA_CT_SREG ]); - err =nft_validate_register_load (priv->sreg, len); + err =nft_parse_register_load (tb[NFTA_CT_SREG ], &priv->sreg, len);if (err <0 ) goto err1;
net/netfilter/nft_dup_netdev.c +3 -3
@@ -16,7 +16,7 @@#include <net/netfilter/nf_dup_netdev.h> struct nft_dup_netdev { -enum nft_registers sreg_dev:8 ; +u8 sreg_dev; }; static void nft_dup_netdev_eval(const struct nft_expr *expr,
@@ -42,8 +42,8 @@ static int nft_dup_netdev_init(const strif (tb[NFTA_DUP_SREG_DEV ] ==NULL )return -EINVAL ; - priv->sreg_dev =nft_parse_register (tb[NFTA_DUP_SREG_DEV ]); -return nft_validate_register_load (priv->sreg_dev,sizeof (int )); +return nft_parse_register_load (tb[NFTA_DUP_SREG_DEV ], &priv->sreg_dev, +sizeof (int )); }static const struct nft_expr_ops nft_dup_netdev_ingress_ops;
net/netfilter/nft_dynset.c +6 -6
@@ -20,8 +20,8 @@ struct nft_dynset {struct nft_set *set;struct nft_set_ext_tmpl tmpl; enum nft_dynset_ops op:8; - enum nft_registers sreg_key:8; - enum nft_registers sreg_data:8; +u8 sreg_key; +u8 sreg_data;bool invert;u64 timeout;struct nft_expr *expr;
@@ -163,8 +163,8 @@ static int nft_dynset_init(const struct tb[NFTA_DYNSET_TIMEOUT]))); } - priv->sreg_key =nft_parse_register (tb[NFTA_DYNSET_SREG_KEY ]); - err =nft_validate_register_load (priv->sreg_key, set->klen);; + err =nft_parse_register_load (tb[NFTA_DYNSET_SREG_KEY ], &priv->sreg_key, + set->klen);if (err <0 )return err;
@@ -174,8 +174,8 @@ static int nft_dynset_init(const structif (set->dtype ==NFT_DATA_VERDICT )return -EOPNOTSUPP ; - priv->sreg_data =nft_parse_register (tb[NFTA_DYNSET_SREG_DATA ]); - err =nft_validate_register_load (priv->sreg_data, set->dlen); + err =nft_parse_register_load (tb[NFTA_DYNSET_SREG_DATA ], + &priv->sreg_data, set->dlen);if (err <0 )return err; }else if (set->flags &NFT_SET_MAP )
net/netfilter/nft_exthdr.c +3 -3
@@ -24,7 +24,7 @@ struct nft_exthdr {u8 len;u8 op; enum nft_registers dreg:8; - enum nft_registers sreg:8; +u8 sreg;u8 flags; };
@@ -307,11 +307,11 @@ static int nft_exthdr_tcp_set_init(const priv->type =nla_get_u8 (tb[NFTA_EXTHDR_TYPE ]); priv->offset = offset; priv->len = len; - priv->sreg =nft_parse_register (tb[NFTA_EXTHDR_SREG ]); priv->flags = flags; priv->op = op; -return nft_validate_register_load (priv->sreg, priv->len); +return nft_parse_register_load (tb[NFTA_EXTHDR_SREG ], &priv->sreg, + priv->len); }static int nft_exthdr_dump_common (struct sk_buff *skb,const struct nft_exthdr *priv)
net/netfilter/nft_fwd_netdev.c +3 -3
@@ -16,7 +16,7 @@#include <net/netfilter/nf_dup_netdev.h> struct nft_fwd_netdev { -enum nft_registers sreg_dev:8 ; +u8 sreg_dev; }; static void nft_fwd_netdev_eval(const struct nft_expr *expr,
@@ -43,8 +43,8 @@ static int nft_fwd_netdev_init(const strif (tb[NFTA_FWD_SREG_DEV ] ==NULL )return -EINVAL ; - priv->sreg_dev =nft_parse_register (tb[NFTA_FWD_SREG_DEV ]); -return nft_validate_register_load (priv->sreg_dev,sizeof (int )); +return nft_parse_register_load (tb[NFTA_FWD_SREG_DEV ], &priv->sreg_dev, +sizeof (int )); }static const struct nft_expr_ops nft_fwd_netdev_ingress_ops;
net/netfilter/nft_hash.c +6 -4
@@ -18,7 +18,7 @@#include <linux/jhash.h> struct nft_jhash { -enum nft_registers sreg:8 ; +u8 sreg;enum nft_registers dreg:8 ;u8 len;bool autogen_seed:1 ;
@@ -85,7 +85,6 @@ static int nft_jhash_init(const struct nif (tb[NFTA_HASH_OFFSET ]) priv->offset =ntohl (nla_get_be32 (tb[NFTA_HASH_OFFSET ])); - priv->sreg =nft_parse_register (tb[NFTA_HASH_SREG ]); priv->dreg =nft_parse_register (tb[NFTA_HASH_DREG ]); err =nft_parse_u32_check (tb[NFTA_HASH_LEN ],U8_MAX , &len);
@@ -96,6 +95,10 @@ static int nft_jhash_init(const struct n priv->len = len; + err =nft_parse_register_load (tb[NFTA_HASH_SREG ], &priv->sreg, len); +if (err <0 ) +return err; + priv->modulus =ntohl (nla_get_be32 (tb[NFTA_HASH_MODULUS ]));if (priv->modulus <=1 )return -ERANGE ;
@@ -110,8 +113,7 @@ static int nft_jhash_init(const struct nget_random_bytes (&priv->seed,sizeof (priv->seed)); } -return nft_validate_register_load (priv->sreg, len) && -nft_validate_register_store (ctx, priv->dreg,NULL , +return nft_validate_register_store (ctx, priv->dreg,NULL ,NFT_DATA_VALUE ,sizeof (u32)); }
net/netfilter/nft_lookup.c +3 -3
@@ -20,7 +20,7 @@struct nft_lookup {struct nft_set *set; -enum nft_registers sreg:8 ; +u8 sreg;enum nft_registers dreg:8 ;bool invert;struct nft_set_binding binding;
@@ -76,8 +76,8 @@ static int nft_lookup_init(const structif (IS_ERR (set))return PTR_ERR (set); - priv->sreg =nft_parse_register (tb[NFTA_LOOKUP_SREG ]); - err =nft_validate_register_load (priv->sreg, set->klen); + err =nft_parse_register_load (tb[NFTA_LOOKUP_SREG ], &priv->sreg, + set->klen);if (err <0 )return err;
net/netfilter/nft_masq.c +5 -9
@@ -53,19 +53,15 @@ int nft_masq_init(const struct nft_ctx * }if (tb[NFTA_MASQ_REG_PROTO_MIN ]) { - priv->sreg_proto_min = -nft_parse_register (tb[NFTA_MASQ_REG_PROTO_MIN ]); - - err =nft_validate_register_load (priv->sreg_proto_min, plen); + err =nft_parse_register_load (tb[NFTA_MASQ_REG_PROTO_MIN ], + &priv->sreg_proto_min, plen);if (err <0 )return err;if (tb[NFTA_MASQ_REG_PROTO_MAX ]) { - priv->sreg_proto_max = -nft_parse_register (tb[NFTA_MASQ_REG_PROTO_MAX ]); - - err =nft_validate_register_load (priv->sreg_proto_max, - plen); + err =nft_parse_register_load (tb[NFTA_MASQ_REG_PROTO_MAX ], + &priv->sreg_proto_max, + plen);if (err <0 )return err; }else {
net/netfilter/nft_meta.c +1 -2
@@ -374,8 +374,7 @@ int nft_meta_set_init(const struct nft_creturn -EOPNOTSUPP ; } - priv->sreg =nft_parse_register (tb[NFTA_META_SREG ]); - err =nft_validate_register_load (priv->sreg, len); + err =nft_parse_register_load (tb[NFTA_META_SREG ], &priv->sreg, len);if (err <0 )return err;
net/netfilter/nft_nat.c +14 -21
@@ -27,10 +27,10 @@#include <net/ip.h> struct nft_nat { -enum nft_registers sreg_addr_min:8 ; -enum nft_registers sreg_addr_max:8 ; -enum nft_registers sreg_proto_min:8 ; -enum nft_registers sreg_proto_max:8 ; +u8 sreg_addr_min; +u8 sreg_addr_max; +u8 sreg_proto_min; +u8 sreg_proto_max;enum nf_nat_manip_type type:8 ;u8 family;u16 flags;
@@ -160,18 +160,15 @@ static int nft_nat_init(const struct nft priv->family = family;if (tb[NFTA_NAT_REG_ADDR_MIN ]) { - priv->sreg_addr_min = -nft_parse_register (tb[NFTA_NAT_REG_ADDR_MIN ]); - err =nft_validate_register_load (priv->sreg_addr_min, alen); + err =nft_parse_register_load (tb[NFTA_NAT_REG_ADDR_MIN ], + &priv->sreg_addr_min, alen);if (err <0 )return err;if (tb[NFTA_NAT_REG_ADDR_MAX ]) { - priv->sreg_addr_max = -nft_parse_register (tb[NFTA_NAT_REG_ADDR_MAX ]); - - err =nft_validate_register_load (priv->sreg_addr_max, - alen); + err =nft_parse_register_load (tb[NFTA_NAT_REG_ADDR_MAX ], + &priv->sreg_addr_max, + alen);if (err <0 )return err; }else {
@@ -181,19 +178,15 @@ static int nft_nat_init(const struct nft plen = FIELD_SIZEOF(struct nf_nat_range, min_addr.all);if (tb[NFTA_NAT_REG_PROTO_MIN ]) { - priv->sreg_proto_min = -nft_parse_register (tb[NFTA_NAT_REG_PROTO_MIN ]); - - err =nft_validate_register_load (priv->sreg_proto_min, plen); + err =nft_parse_register_load (tb[NFTA_NAT_REG_PROTO_MIN ], + &priv->sreg_proto_min, plen);if (err <0 )return err;if (tb[NFTA_NAT_REG_PROTO_MAX ]) { - priv->sreg_proto_max = -nft_parse_register (tb[NFTA_NAT_REG_PROTO_MAX ]); - - err =nft_validate_register_load (priv->sreg_proto_max, - plen); + err =nft_parse_register_load (tb[NFTA_NAT_REG_PROTO_MAX ], + &priv->sreg_proto_max, + plen);if (err <0 )return err; }else {
net/netfilter/nft_objref.c +3 -3
@@ -97,7 +97,7 @@ static const struct nft_expr_ops nft_objstruct nft_objref_map {struct nft_set *set; -enum nft_registers sreg:8 ; +u8 sreg;struct nft_set_binding binding; };
@@ -138,8 +138,8 @@ static int nft_objref_map_init(const strif (!(set->flags &NFT_SET_OBJECT ))return -EINVAL ; - priv->sreg =nft_parse_register (tb[NFTA_OBJREF_SET_SREG ]); - err =nft_validate_register_load (priv->sreg, set->klen); + err =nft_parse_register_load (tb[NFTA_OBJREF_SET_SREG ], &priv->sreg, + set->klen);if (err <0 )return err;
net/netfilter/nft_payload.c +2 -2
@@ -338,7 +338,6 @@ static int nft_payload_set_init(const st priv->base =ntohl (nla_get_be32 (tb[NFTA_PAYLOAD_BASE ])); priv->offset =ntohl (nla_get_be32 (tb[NFTA_PAYLOAD_OFFSET ])); priv->len =ntohl (nla_get_be32 (tb[NFTA_PAYLOAD_LEN ])); - priv->sreg =nft_parse_register (tb[NFTA_PAYLOAD_SREG ]);if (tb[NFTA_PAYLOAD_CSUM_TYPE ]) csum_type =ntohl (nla_get_be32 (tb[NFTA_PAYLOAD_CSUM_TYPE ]));
@@ -369,7 +368,8 @@ static int nft_payload_set_init(const st } priv->csum_type = csum_type; -return nft_validate_register_load (priv->sreg, priv->len); +return nft_parse_register_load (tb[NFTA_PAYLOAD_SREG ], &priv->sreg, + priv->len); }static int nft_payload_set_dump (struct sk_buff *skb,const struct nft_expr *expr)
net/netfilter/nft_queue.c +6 -6
@@ -22,10 +22,10 @@static u32 jhash_initval__read_mostly ;struct nft_queue { -enum nft_registers sreg_qnum:8 ; -u16 queuenum; -u16 queues_total; -u16 flags; +u8 sreg_qnum; +u16 queuenum; +u16 queues_total; +u16 flags; }; static void nft_queue_eval(const struct nft_expr *expr,
@@ -114,8 +114,8 @@ static int nft_queue_sreg_init(const strstruct nft_queue *priv =nft_expr_priv (expr);int err; - priv->sreg_qnum =nft_parse_register (tb[NFTA_QUEUE_SREG_QNUM ]); - err =nft_validate_register_load (priv->sreg_qnum,sizeof (u32)); + err =nft_parse_register_load (tb[NFTA_QUEUE_SREG_QNUM ], + &priv->sreg_qnum,sizeof (u32));if (err <0 )return err;
net/netfilter/nft_range.c +3 -3
@@ -18,7 +18,7 @@struct nft_range_expr {struct nft_data data_from;struct nft_data data_to; -enum nft_registers sreg:8 ; +u8 sreg;u8 len;enum nft_range_ops op:8 ; };
@@ -80,8 +80,8 @@ static int nft_range_init(const struct n goto err2; } - priv->sreg =nft_parse_register (tb[NFTA_RANGE_SREG ]); - err =nft_validate_register_load (priv->sreg, desc_from.len); + err =nft_parse_register_load (tb[NFTA_RANGE_SREG ], &priv->sreg, + desc_from.len);if (err <0 ) goto err2;
net/netfilter/nft_redir.c +5 -9
@@ -49,19 +49,15 @@ int nft_redir_init(const struct nft_ctx plen = FIELD_SIZEOF(struct nf_nat_range, min_addr.all);if (tb[NFTA_REDIR_REG_PROTO_MIN ]) { - priv->sreg_proto_min = -nft_parse_register (tb[NFTA_REDIR_REG_PROTO_MIN ]); - - err =nft_validate_register_load (priv->sreg_proto_min, plen); + err =nft_parse_register_load (tb[NFTA_REDIR_REG_PROTO_MIN ], + &priv->sreg_proto_min, plen);if (err <0 )return err;if (tb[NFTA_REDIR_REG_PROTO_MAX ]) { - priv->sreg_proto_max = -nft_parse_register (tb[NFTA_REDIR_REG_PROTO_MAX ]); - - err =nft_validate_register_load (priv->sreg_proto_max, - plen); + err =nft_parse_register_load (tb[NFTA_REDIR_REG_PROTO_MAX ], + &priv->sreg_proto_max, + plen);if (err <0 )return err; }else {
Greg Kroah-Hartman
maintainerPATCH 61/86 netfilter: nftables: add nft_parse_register_store() and use it
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ 345023b0db315648ccc3c1a36aee88304a8b4d91 ]
This new function combines the netlink register attribute parser and the store validation function.
This update requires to replace:
enum nft_registers dreg:8;
in many of the expression private areas otherwise compiler complains with:
error: cannot take address of bit-field ‘dreg’
when passing the register field as reference.
--- include/net/netfilter/nf_tables.h | 8 +++---- include/net/netfilter/nf_tables_core.h | 4 +-- include/net/netfilter/nft_fib.h | 2 - include/net/netfilter/nft_meta.h | 2 - net/bridge/netfilter/nft_meta_bridge.c | 5 +--- net/netfilter/nf_tables_api.c | 34 ++++++++++++++++++++++++++++----- net/netfilter/nft_bitwise.c | 8 +++---- net/netfilter/nft_byteorder.c | 8 +++---- net/netfilter/nft_ct.c | 7 ++---- net/netfilter/nft_exthdr.c | 8 +++---- net/netfilter/nft_fib.c | 5 +--- net/netfilter/nft_hash.c | 17 ++++++---------- net/netfilter/nft_immediate.c | 8 +++---- net/netfilter/nft_lookup.c | 8 +++---- net/netfilter/nft_meta.c | 5 +--- net/netfilter/nft_numgen.c | 15 +++++--------- net/netfilter/nft_payload.c | 6 ++--- net/netfilter/nft_rt.c | 7 ++---- 18 files changed, 85 insertions(+), 72 deletions(-)
include/net/netfilter/nf_tables.h +4 -4
@@ -199,10 +199,10 @@ unsigned int nft_parse_register(const stint nft_dump_register (struct sk_buff *skb,unsigned int attr,unsigned int reg);int nft_parse_register_load (const struct nlattr *attr,u8 *sreg,u32 len); -int nft_validate_register_store (const struct nft_ctx *ctx, -enum nft_registers reg, -const struct nft_data *data, -enum nft_data_types type,unsigned int len); +int nft_parse_register_store (const struct nft_ctx *ctx, +const struct nlattr *attr,u8 *dreg, +const struct nft_data *data, +enum nft_data_types type,unsigned int len);/** * struct nft_userdata - user defined data associated with an object
include/net/netfilter/nf_tables_core.h +2 -2
@@ -18,7 +18,7 @@ struct nft_bitwise_fast_expr {u32 mask;u32 xor;u8 sreg; - enum nft_registers dreg:8; +u8 dreg; };struct nft_cmp_fast_expr {
@@ -44,7 +44,7 @@ struct nft_payload { enum nft_payload_bases base:8;u8 offset;u8 len; - enum nft_registers dreg:8; +u8 dreg; };struct nft_payload_set {
include/net/netfilter/nft_fib.h +1 -1
@@ -3,7 +3,7 @@#define _NFT_FIB_H_struct nft_fib { -enum nft_registers dreg:8 ; +u8 dreg;u8 result;u32 flags; };
include/net/netfilter/nft_meta.h +1 -1
@@ -5,7 +5,7 @@struct nft_meta {enum nft_meta_keys key:8 ;union { -enum nft_registers dreg:8 ; +u8 dreg;u8 sreg; }; };
net/bridge/netfilter/nft_meta_bridge.c +2 -3
@@ -65,9 +65,8 @@ static int nft_meta_bridge_get_init(consreturn nft_meta_get_init (ctx, expr, tb); } - priv->dreg =nft_parse_register (tb[NFTA_META_DREG ]); -return nft_validate_register_store (ctx, priv->dreg,NULL , -NFT_DATA_VALUE , len); +return nft_parse_register_store (ctx, tb[NFTA_META_DREG ], &priv->dreg, +NULL ,NFT_DATA_VALUE , len); }static struct nft_expr_type nft_meta_bridge_type;
net/netfilter/nf_tables_api.c +29 -5
@@ -3349,6 +3349,12 @@ static int nf_tables_delset(struct net *return nft_delset (&ctx, set); } +static int nft_validate_register_store (const struct nft_ctx *ctx, +enum nft_registers reg, +const struct nft_data *data, +enum nft_data_types type, +unsigned int len); + static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, struct nft_set *set, const struct nft_set_iter *iter,
@@ -5704,10 +5710,11 @@ EXPORT_SYMBOL_GPL(nft_parse_register_loa* A value of NULL for the data means that its runtime gathered * data. */ -int nft_validate_register_store (const struct nft_ctx *ctx, -enum nft_registers reg, -const struct nft_data *data, -enum nft_data_types type,unsigned int len) +static int nft_validate_register_store (const struct nft_ctx *ctx, +enum nft_registers reg, +const struct nft_data *data, +enum nft_data_types type, +unsigned int len) {int err;
@@ -5746,7 +5753,24 @@ int nft_validate_register_store(const streturn 0 ; } } -EXPORT_SYMBOL_GPL (nft_validate_register_store); + +int nft_parse_register_store (const struct nft_ctx *ctx, +const struct nlattr *attr,u8 *dreg, +const struct nft_data *data, +enum nft_data_types type,unsigned int len) +{ +int err; +u32 reg; + + reg =nft_parse_register (attr); + err =nft_validate_register_store (ctx, reg, data, type, len); +if (err <0 ) +return err; + + *dreg = reg; +return 0 ; +} +EXPORT_SYMBOL_GPL (nft_parse_register_store);static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX +1 ] = { [NFTA_VERDICT_CODE ] = { .type =NLA_U32 },
net/netfilter/nft_bitwise.c +4 -4
@@ -19,7 +19,7 @@struct nft_bitwise {u8 sreg; -enum nft_registers dreg:8 ; +u8 dreg;u8 len;struct nft_data mask;struct nft_data xor;
@@ -73,9 +73,9 @@ static int nft_bitwise_init(const structif (err <0 )return err; - priv->dreg =nft_parse_register (tb[NFTA_BITWISE_DREG ]); - err =nft_validate_register_store (ctx, priv->dreg,NULL , -NFT_DATA_VALUE , priv->len); + err =nft_parse_register_store (ctx, tb[NFTA_BITWISE_DREG ], + &priv->dreg,NULL ,NFT_DATA_VALUE , + priv->len);if (err <0 )return err;
net/netfilter/nft_byteorder.c +4 -4
@@ -20,7 +20,7 @@struct nft_byteorder {u8 sreg; -enum nft_registers dreg:8 ; +u8 dreg;enum nft_byteorder_ops op:8 ;u8 len;u8 size;
@@ -144,9 +144,9 @@ static int nft_byteorder_init(const struif (err <0 )return err; - priv->dreg =nft_parse_register (tb[NFTA_BYTEORDER_DREG ]); -return nft_validate_register_store (ctx, priv->dreg,NULL , -NFT_DATA_VALUE , priv->len); +return nft_parse_register_store (ctx, tb[NFTA_BYTEORDER_DREG ], + &priv->dreg,NULL ,NFT_DATA_VALUE , + priv->len); }static int nft_byteorder_dump (struct sk_buff *skb,const struct nft_expr *expr)
net/netfilter/nft_ct.c +3 -4
@@ -27,7 +27,7 @@ struct nft_ct { enum nft_ct_keys key:8; enum ip_conntrack_dir dir:8;union { -enum nft_registers dreg:8 ; +u8 dreg;u8 sreg; }; };
@@ -483,9 +483,8 @@ static int nft_ct_get_init(const struct } } - priv->dreg =nft_parse_register (tb[NFTA_CT_DREG ]); - err =nft_validate_register_store (ctx, priv->dreg,NULL , -NFT_DATA_VALUE , len); + err =nft_parse_register_store (ctx, tb[NFTA_CT_DREG ], &priv->dreg,NULL , +NFT_DATA_VALUE , len);if (err <0 )return err;
net/netfilter/nft_exthdr.c +4 -4
@@ -23,7 +23,7 @@ struct nft_exthdr {u8 offset;u8 len;u8 op; - enum nft_registers dreg:8; +u8 dreg;u8 sreg;u8 flags; };
@@ -257,12 +257,12 @@ static int nft_exthdr_init(const struct priv->type =nla_get_u8 (tb[NFTA_EXTHDR_TYPE ]); priv->offset = offset; priv->len = len; - priv->dreg =nft_parse_register (tb[NFTA_EXTHDR_DREG ]); priv->flags = flags; priv->op = op; -return nft_validate_register_store (ctx, priv->dreg,NULL , -NFT_DATA_VALUE , priv->len); +return nft_parse_register_store (ctx, tb[NFTA_EXTHDR_DREG ], + &priv->dreg,NULL ,NFT_DATA_VALUE , + priv->len); } static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
net/netfilter/nft_fib.c +2 -3
@@ -88,7 +88,6 @@ int nft_fib_init(const struct nft_ctx *creturn -EINVAL ; priv->result =ntohl (nla_get_be32 (tb[NFTA_FIB_RESULT ])); - priv->dreg =nft_parse_register (tb[NFTA_FIB_DREG ]);switch (priv->result) {case NFT_FIB_RESULT_OIF :
@@ -108,8 +107,8 @@ int nft_fib_init(const struct nft_ctx *creturn -EINVAL ; } - err =nft_validate_register_store (ctx, priv->dreg,NULL , -NFT_DATA_VALUE , len); + err =nft_parse_register_store (ctx, tb[NFTA_FIB_DREG ], &priv->dreg, +NULL ,NFT_DATA_VALUE , len);if (err <0 )return err;
net/netfilter/nft_hash.c +7 -10
@@ -19,7 +19,7 @@struct nft_jhash {u8 sreg; -enum nft_registers dreg:8 ; +u8 dreg;u8 len;bool autogen_seed:1 ;u32 modulus;
@@ -40,7 +40,7 @@ static void nft_jhash_eval(const struct }struct nft_symhash { -enum nft_registers dreg:8 ; +u8 dreg;u32 modulus;u32 offset; };
@@ -85,8 +85,6 @@ static int nft_jhash_init(const struct nif (tb[NFTA_HASH_OFFSET ]) priv->offset =ntohl (nla_get_be32 (tb[NFTA_HASH_OFFSET ])); - priv->dreg =nft_parse_register (tb[NFTA_HASH_DREG ]); - err =nft_parse_u32_check (tb[NFTA_HASH_LEN ],U8_MAX , &len);if (err <0 )return err;
@@ -113,8 +111,8 @@ static int nft_jhash_init(const struct nget_random_bytes (&priv->seed,sizeof (priv->seed)); } -return nft_validate_register_store (ctx, priv->dreg,NULL , -NFT_DATA_VALUE ,sizeof (u32)); +return nft_parse_register_store (ctx, tb[NFTA_HASH_DREG ], &priv->dreg, +NULL ,NFT_DATA_VALUE ,sizeof (u32)); } static int nft_symhash_init(const struct nft_ctx *ctx,
@@ -130,8 +128,6 @@ static int nft_symhash_init(const structif (tb[NFTA_HASH_OFFSET ]) priv->offset =ntohl (nla_get_be32 (tb[NFTA_HASH_OFFSET ])); - priv->dreg =nft_parse_register (tb[NFTA_HASH_DREG ]); - priv->modulus =ntohl (nla_get_be32 (tb[NFTA_HASH_MODULUS ]));if (priv->modulus <1 )return -ERANGE ;
@@ -139,8 +135,9 @@ static int nft_symhash_init(const structif (priv->offset + priv->modulus -1 < priv->offset)return -EOVERFLOW ; -return nft_validate_register_store (ctx, priv->dreg,NULL , -NFT_DATA_VALUE ,sizeof (u32)); +return nft_parse_register_store (ctx, tb[NFTA_HASH_DREG ], + &priv->dreg,NULL ,NFT_DATA_VALUE , +sizeof (u32)); } static int nft_jhash_dump(struct sk_buff *skb,
net/netfilter/nft_immediate.c +4 -4
@@ -19,7 +19,7 @@struct nft_immediate_expr {struct nft_data data; -enum nft_registers dreg:8 ; +u8 dreg;u8 dlen; };
@@ -56,9 +56,9 @@ static int nft_immediate_init(const stru priv->dlen = desc.len; - priv->dreg =nft_parse_register (tb[NFTA_IMMEDIATE_DREG ]); - err =nft_validate_register_store (ctx, priv->dreg, &priv->data, - desc.type, desc.len); + err =nft_parse_register_store (ctx, tb[NFTA_IMMEDIATE_DREG ], + &priv->dreg, &priv->data, desc.type, + desc.len);if (err <0 ) goto err1;
net/netfilter/nft_lookup.c +4 -4
@@ -21,7 +21,7 @@struct nft_lookup {struct nft_set *set;u8 sreg; -enum nft_registers dreg:8 ; +u8 dreg;bool invert;struct nft_set_binding binding; };
@@ -100,9 +100,9 @@ static int nft_lookup_init(const structif (!(set->flags &NFT_SET_MAP ))return -EINVAL ; - priv->dreg =nft_parse_register (tb[NFTA_LOOKUP_DREG ]); - err =nft_validate_register_store (ctx, priv->dreg,NULL , - set->dtype, set->dlen); + err =nft_parse_register_store (ctx, tb[NFTA_LOOKUP_DREG ], + &priv->dreg,NULL , set->dtype, + set->dlen);if (err <0 )return err; }else if (set->flags &NFT_SET_MAP )
net/netfilter/nft_meta.c +2 -3
@@ -314,9 +314,8 @@ int nft_meta_get_init(const struct nft_creturn -EOPNOTSUPP ; } - priv->dreg =nft_parse_register (tb[NFTA_META_DREG ]); -return nft_validate_register_store (ctx, priv->dreg,NULL , -NFT_DATA_VALUE , len); +return nft_parse_register_store (ctx, tb[NFTA_META_DREG ], &priv->dreg, +NULL ,NFT_DATA_VALUE , len); }EXPORT_SYMBOL_GPL (nft_meta_get_init);
net/netfilter/nft_numgen.c +6 -9
@@ -20,7 +20,7 @@ static DEFINE_PER_CPU(struct rnd_state, nft_numgen_prandom_state);struct nft_ng_inc { -enum nft_registers dreg:8 ; +u8 dreg;u32 modulus;atomic_t counter;u32 offset;
@@ -64,11 +64,10 @@ static int nft_ng_inc_init(const structif (priv->offset + priv->modulus -1 < priv->offset)return -EOVERFLOW ; - priv->dreg =nft_parse_register (tb[NFTA_NG_DREG ]);atomic_set (&priv->counter, priv->modulus -1 ); -return nft_validate_register_store (ctx, priv->dreg,NULL , -NFT_DATA_VALUE ,sizeof (u32)); +return nft_parse_register_store (ctx, tb[NFTA_NG_DREG ], &priv->dreg, +NULL ,NFT_DATA_VALUE ,sizeof (u32)); } static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg,
@@ -98,7 +97,7 @@ static int nft_ng_inc_dump(struct sk_buf }struct nft_ng_random { -enum nft_registers dreg:8 ; +u8 dreg;u32 modulus;u32 offset; };
@@ -133,10 +132,8 @@ static int nft_ng_random_init(const struprandom_init_once (&nft_numgen_prandom_state); - priv->dreg =nft_parse_register (tb[NFTA_NG_DREG ]); - -return nft_validate_register_store (ctx, priv->dreg,NULL , -NFT_DATA_VALUE ,sizeof (u32)); +return nft_parse_register_store (ctx, tb[NFTA_NG_DREG ], &priv->dreg, +NULL ,NFT_DATA_VALUE ,sizeof (u32)); }static int nft_ng_random_dump (struct sk_buff *skb,const struct nft_expr *expr)
net/netfilter/nft_payload.c +3 -3
@@ -135,10 +135,10 @@ static int nft_payload_init(const struct priv->base =ntohl (nla_get_be32 (tb[NFTA_PAYLOAD_BASE ])); priv->offset =ntohl (nla_get_be32 (tb[NFTA_PAYLOAD_OFFSET ])); priv->len =ntohl (nla_get_be32 (tb[NFTA_PAYLOAD_LEN ])); - priv->dreg =nft_parse_register (tb[NFTA_PAYLOAD_DREG ]); -return nft_validate_register_store (ctx, priv->dreg,NULL , -NFT_DATA_VALUE , priv->len); +return nft_parse_register_store (ctx, tb[NFTA_PAYLOAD_DREG ], + &priv->dreg,NULL ,NFT_DATA_VALUE , + priv->len); }static int nft_payload_dump (struct sk_buff *skb,const struct nft_expr *expr)
net/netfilter/nft_rt.c +3 -4
@@ -20,7 +20,7 @@struct nft_rt {enum nft_rt_keys key:8 ; -enum nft_registers dreg:8 ; +u8 dreg; };static u16 get_tcpmss (const struct nft_pktinfo *pkt,const struct dst_entry *skbdst)
@@ -141,9 +141,8 @@ static int nft_rt_get_init(const structreturn -EOPNOTSUPP ; } - priv->dreg =nft_parse_register (tb[NFTA_RT_DREG ]); -return nft_validate_register_store (ctx, priv->dreg,NULL , -NFT_DATA_VALUE , len); +return nft_parse_register_store (ctx, tb[NFTA_RT_DREG ], &priv->dreg, +NULL ,NFT_DATA_VALUE , len); } static int nft_rt_get_dump(struct sk_buff *skb,
Greg Kroah-Hartman
maintainerPATCH 62/86 netfilter: nftables: statify nft_parse_register()
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ 08a01c11a5bb3de9b0a9c9b2685867e50eda9910 ]
This function is not used anymore by any extension, statify it.
--- include/net/netfilter/nf_tables.h | 1 - net/netfilter/nf_tables_api.c | 3 +-- 2 files changed, 1 insertion(+), 3 deletions(-)
include/net/netfilter/nf_tables.h +0 -1
@@ -195,7 +195,6 @@ static inline enum nft_registers nft_typ }int nft_parse_u32_check (const struct nlattr *attr,int max,u32 *dest); -unsigned int nft_parse_register (const struct nlattr *attr);int nft_dump_register (struct sk_buff *skb,unsigned int attr,unsigned int reg);int nft_parse_register_load (const struct nlattr *attr,u8 *sreg,u32 len);
net/netfilter/nf_tables_api.c +1 -2
@@ -5624,7 +5624,7 @@ EXPORT_SYMBOL_GPL(nft_parse_u32_check);* Registers used to be 128 bit wide, these register numbers will be * mapped to the corresponding 32 bit register numbers. */ -unsigned int nft_parse_register (const struct nlattr *attr) +static unsigned int nft_parse_register (const struct nlattr *attr) {unsigned int reg;
@@ -5636,7 +5636,6 @@ unsigned int nft_parse_register(const streturn reg +NFT_REG_SIZE /NFT_REG32_SIZE -NFT_REG32_00 ; } } -EXPORT_SYMBOL_GPL (nft_parse_register);/** * nft_dump_register - dump a register value to a netlink attribute
Greg Kroah-Hartman
maintainerPATCH 63/86 netfilter: nf_tables: validate registers coming from userspace.
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ 6e1acfa387b9ff82cfc7db8cc3b6959221a95851 ]
Bail out in case userspace uses unsupported registers.
--- net/netfilter/nf_tables_api.c | 31 +++++++++++++++++-------------- 1 file changed, 17 insertions(+), 14 deletions(-)
net/netfilter/nf_tables_api.c +17 -14
@@ -5615,26 +5615,23 @@ int nft_parse_u32_check(const struct nla }EXPORT_SYMBOL_GPL (nft_parse_u32_check); -/** -* nft_parse_register - parse a register value from a netlink attribute -* -* @attr: netlink attribute -* -* Parse and translate a register value from a netlink attribute. -* Registers used to be 128 bit wide, these register numbers will be -* mapped to the corresponding 32 bit register numbers. -*/ -static unsigned int nft_parse_register (const struct nlattr *attr) +static int nft_parse_register (const struct nlattr *attr,u32 *preg) {unsigned int reg; reg =ntohl (nla_get_be32 (attr));switch (reg) { case NFT_REG_VERDICT...NFT_REG_4: -return reg *NFT_REG_SIZE /NFT_REG32_SIZE ; + *preg = reg *NFT_REG_SIZE /NFT_REG32_SIZE ; +break ; + case NFT_REG32_00...NFT_REG32_15: + *preg = reg +NFT_REG_SIZE /NFT_REG32_SIZE -NFT_REG32_00 ; +break ;default : -return reg +NFT_REG_SIZE /NFT_REG32_SIZE -NFT_REG32_00 ; +return -ERANGE ; } + +return 0 ; }/**
@@ -5685,7 +5682,10 @@ int nft_parse_register_load(const structu32 reg;int err; - reg =nft_parse_register (attr); + err =nft_parse_register (attr, ®); +if (err <0 ) +return err; + err =nft_validate_register_load (reg, len);if (err <0 )return err;
@@ -5761,7 +5761,10 @@ int nft_parse_register_store(const strucint err;u32 reg; - reg =nft_parse_register (attr); + err =nft_parse_register (attr, ®); +if (err <0 ) +return err; + err =nft_validate_register_store (ctx, reg, data, type, len);if (err <0 )return err;
Greg Kroah-Hartman
maintainerPATCH 64/86 netfilter: nf_tables: add nft_setelem_parse_key()
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ 20a1452c35425b2cef76f21f8395ef069dfddfa9 ]
Add helper function to parse the set element key netlink attribute.
v4: No changes
v3: New patch
[sbrivio: refactor error paths and labels; use NFT_DATA_VALUE_MAXLEN
instead of sizeof(*key) in helper, value can be longer than that; rebase]
--- net/netfilter/nf_tables_api.c | 78 ++++++++++++++++++++++-------------------- 1 file changed, 42 insertions(+), 36 deletions(-)
net/netfilter/nf_tables_api.c +42 -36
@@ -3736,6 +3736,24 @@ static int nf_tables_dump_set_done(strucreturn 0 ; } +static int nft_setelem_parse_key (struct nft_ctx *ctx,struct nft_set *set, +struct nft_data *key,struct nlattr *attr) +{ +struct nft_data_desc desc; +int err; + + err =nft_data_init (ctx, key,NFT_DATA_VALUE_MAXLEN , &desc, attr); +if (err <0 ) +return err; + +if (desc.type !=NFT_DATA_VALUE || desc.len != set->klen) { +nft_data_release (key, desc.type); +return -EINVAL ; + } + +return 0 ; +} + static int nf_tables_getsetelem(struct net *net, struct sock *nlsk, struct sk_buff *skb, const struct nlmsghdr *nlh, const struct nlattr * const nla[],
@@ -3941,13 +3959,13 @@ static int nft_add_set_elem(struct nft_c {struct nlattr *nla[NFTA_SET_ELEM_MAX +1 ];u8 genmask =nft_genmask_next (ctx->net); -struct nft_data_desc d1, d2;struct nft_set_ext_tmpl tmpl;struct nft_set_ext *ext, *ext2;struct nft_set_elem elem;struct nft_set_binding *binding;struct nft_object *obj =NULL ;struct nft_userdata *udata; +struct nft_data_desc desc;struct nft_data data;enum nft_registers dreg;struct nft_trans *trans;
@@ -4000,15 +4018,12 @@ static int nft_add_set_elem(struct nft_c timeout = set->timeout; } - err =nft_data_init (ctx, &elem.key.val,sizeof (elem.key), &d1, - nla[NFTA_SET_ELEM_KEY ]); + err =nft_setelem_parse_key (ctx, set, &elem.key.val, + nla[NFTA_SET_ELEM_KEY ]);if (err <0 ) goto err1; - err = -EINVAL ; -if (d1.type !=NFT_DATA_VALUE || d1.len != set->klen) - goto err2; -nft_set_ext_add_length (&tmpl,NFT_SET_EXT_KEY , d1.len); +nft_set_ext_add_length (&tmpl,NFT_SET_EXT_KEY , set->klen);if (timeout >0 ) {nft_set_ext_add (&tmpl,NFT_SET_EXT_EXPIRATION );if (timeout != set->timeout)
@@ -4030,13 +4045,13 @@ static int nft_add_set_elem(struct nft_c }if (nla[NFTA_SET_ELEM_DATA ] !=NULL ) { - err =nft_data_init (ctx, &data,sizeof (data), &d2, + err =nft_data_init (ctx, &data,sizeof (data), &desc, nla[NFTA_SET_ELEM_DATA ]);if (err <0 ) goto err2; err = -EINVAL ; -if (set->dtype !=NFT_DATA_VERDICT && d2.len != set->dlen) +if (set->dtype !=NFT_DATA_VERDICT && desc.len != set->dlen) goto err3; dreg =nft_type_to_reg (set->dtype);
@@ -4053,12 +4068,12 @@ static int nft_add_set_elem(struct nft_c err =nft_validate_register_store (&bind_ctx, dreg, &data, - d2.type, d2.len); + desc.type, desc.len);if (err <0 ) goto err3; } -nft_set_ext_add_length (&tmpl,NFT_SET_EXT_DATA , d2.len); +nft_set_ext_add_length (&tmpl,NFT_SET_EXT_DATA , desc.len); }/* The full maximum length of userdata can exceed the maximum
@@ -4141,9 +4156,9 @@ err4:kfree (elem.priv); err3:if (nla[NFTA_SET_ELEM_DATA ] !=NULL ) -nft_data_release (&data, d2.type); +nft_data_release (&data, desc.type); err2: -nft_data_release (&elem.key.val, d1.type); +nft_data_release (&elem.key.val,NFT_DATA_VALUE ); err1:return err; }
@@ -4241,7 +4256,6 @@ static int nft_del_setelem(struct nft_ct {struct nlattr *nla[NFTA_SET_ELEM_MAX +1 ];struct nft_set_ext_tmpl tmpl; -struct nft_data_desc desc;struct nft_set_elem elem;struct nft_set_ext *ext;struct nft_trans *trans;
@@ -4252,11 +4266,10 @@ static int nft_del_setelem(struct nft_ct err =nla_parse_nested (nla,NFTA_SET_ELEM_MAX , attr, nft_set_elem_policy,NULL );if (err <0 ) - goto err1; +return err; - err = -EINVAL ;if (nla[NFTA_SET_ELEM_KEY ] ==NULL ) - goto err1; +return -EINVAL ;nft_set_ext_prepare (&tmpl);
@@ -4266,37 +4279,31 @@ static int nft_del_setelem(struct nft_ctif (flags !=0 )nft_set_ext_add (&tmpl,NFT_SET_EXT_FLAGS ); - err =nft_data_init (ctx, &elem.key.val,sizeof (elem.key), &desc, - nla[NFTA_SET_ELEM_KEY ]); + err =nft_setelem_parse_key (ctx, set, &elem.key.val, + nla[NFTA_SET_ELEM_KEY ]);if (err <0 ) - goto err1; - - err = -EINVAL ; -if (desc.type !=NFT_DATA_VALUE || desc.len != set->klen) - goto err2; +return err; -nft_set_ext_add_length (&tmpl,NFT_SET_EXT_KEY , desc.len); +nft_set_ext_add_length (&tmpl,NFT_SET_EXT_KEY , set->klen); err = -ENOMEM ; elem.priv =nft_set_elem_init (set, &tmpl, elem.key.val.data,NULL ,0 ,GFP_KERNEL );if (elem.priv ==NULL ) - goto err2; + goto fail_elem; ext =nft_set_elem_ext (set, elem.priv);if (flags) *nft_set_ext_flags (ext) = flags; trans =nft_trans_elem_alloc (ctx,NFT_MSG_DELSETELEM , set); -if (trans ==NULL ) { - err = -ENOMEM ; - goto err3; - } +if (trans ==NULL ) + goto fail_trans; priv = set->ops->deactivate (ctx->net, set, &elem);if (priv ==NULL ) { err = -ENOENT ; - goto err4; + goto fail_ops; }kfree (elem.priv); elem.priv = priv;
@@ -4307,13 +4314,12 @@ static int nft_del_setelem(struct nft_ctlist_add_tail (&trans->list, &ctx->net->nft.commit_list);return 0 ; -err4: +fail_ops:kfree (trans); -err3: +fail_trans:kfree (elem.priv); -err2: -nft_data_release (&elem.key.val, desc.type); -err1: +fail_elem: +nft_data_release (&elem.key.val,NFT_DATA_VALUE );return err; }
Greg Kroah-Hartman
maintainerPATCH 65/86 netfilter: nf_tables: allow up to 64 bytes in the set element data area
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ fdb9c405e35bdc6e305b9b4e20ebc141ed14fc81 ]
So far, the set elements could store up to 128-bits in the data area.
--- include/net/netfilter/nf_tables.h | 4 ++++ net/netfilter/nf_tables_api.c | 35 +++++++++++++++++++++++++---------- 2 files changed, 29 insertions(+), 10 deletions(-)
include/net/netfilter/nf_tables.h +4 -0
@@ -229,6 +229,10 @@ struct nft_set_elem {u32 buf[NFT_DATA_VALUE_MAXLEN /sizeof (u32)];struct nft_data val; } key; +union { +u32 buf[NFT_DATA_VALUE_MAXLEN /sizeof (u32)]; +struct nft_data val; + } data;void *priv; };
net/netfilter/nf_tables_api.c +25 -10
@@ -3954,6 +3954,25 @@ static int nft_setelem_parse_flags(constreturn 0 ; } +static int nft_setelem_parse_data (struct nft_ctx *ctx,struct nft_set *set, +struct nft_data_desc *desc, +struct nft_data *data, +struct nlattr *attr) +{ +int err; + + err =nft_data_init (ctx, data,NFT_DATA_VALUE_MAXLEN , desc, attr); +if (err <0 ) +return err; + +if (desc->type !=NFT_DATA_VERDICT && desc->len != set->dlen) { +nft_data_release (data, desc->type); +return -EINVAL ; + } + +return 0 ; +} +static int nft_add_set_elem (struct nft_ctx *ctx,struct nft_set *set,const struct nlattr *attr,u32 nlmsg_flags) {
@@ -3966,7 +3985,6 @@ static int nft_add_set_elem(struct nft_cstruct nft_object *obj =NULL ;struct nft_userdata *udata;struct nft_data_desc desc; -struct nft_data data;enum nft_registers dreg;struct nft_trans *trans;u32 flags =0 ;
@@ -4045,15 +4063,11 @@ static int nft_add_set_elem(struct nft_c }if (nla[NFTA_SET_ELEM_DATA ] !=NULL ) { - err =nft_data_init (ctx, &data,sizeof (data), &desc, - nla[NFTA_SET_ELEM_DATA ]); + err =nft_setelem_parse_data (ctx, set, &desc, &elem.data.val, + nla[NFTA_SET_ELEM_DATA ]);if (err <0 ) goto err2; - err = -EINVAL ; -if (set->dtype !=NFT_DATA_VERDICT && desc.len != set->dlen) - goto err3; - dreg =nft_type_to_reg (set->dtype);list_for_each_entry (binding, &set->bindings, list) { struct nft_ctx bind_ctx = {
@@ -4067,7 +4081,7 @@ static int nft_add_set_elem(struct nft_ccontinue ; err =nft_validate_register_store (&bind_ctx, dreg, - &data, + &elem.data.val, desc.type, desc.len);if (err <0 ) goto err3;
@@ -4089,7 +4103,8 @@ static int nft_add_set_elem(struct nft_c } err = -ENOMEM ; - elem.priv =nft_set_elem_init (set, &tmpl, elem.key.val.data, data.data, + elem.priv =nft_set_elem_init (set, &tmpl, elem.key.val.data, + elem.data.val.data, timeout,GFP_KERNEL );if (elem.priv ==NULL ) goto err3;
@@ -4156,7 +4171,7 @@ err4:kfree (elem.priv); err3:if (nla[NFTA_SET_ELEM_DATA ] !=NULL ) -nft_data_release (&data, desc.type); +nft_data_release (&elem.data.val, desc.type); err2:nft_data_release (&elem.key.val,NFT_DATA_VALUE ); err1:
Greg Kroah-Hartman
maintainerPATCH 66/86 netfilter: nf_tables: stricter validation of element data
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ 7e6bc1f6cabcd30aba0b11219d8e01b952eacbb6 ]
Make sure element data type and length do not mismatch the one specified by the set declaration.
--- net/netfilter/nf_tables_api.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +8 -1
@@ -3959,13 +3959,20 @@ static int nft_setelem_parse_data(structstruct nft_data *data, struct nlattr *attr) { + u32 dtype;int err; err =nft_data_init (ctx, data,NFT_DATA_VALUE_MAXLEN , desc, attr);if (err <0 )return err; -if (desc->type !=NFT_DATA_VERDICT && desc->len != set->dlen) { +if (set->dtype ==NFT_DATA_VERDICT ) + dtype =NFT_DATA_VERDICT ; +else + dtype =NFT_DATA_VALUE ; + +if (dtype != desc->type || + set->dlen != desc->len) {nft_data_release (data, desc->type);return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 49/86 ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table
In reply to Greg Kroah-HartmanFrom: Nikhil Mahale <[email protected]>
commit dc4f2ccaedddb489a83e7b12ebbdc347272aacc9 upstream.
These IDs are for AD102, AD103, AD104, AD106, and AD107 gpus with audio functions that are largely similar to the existing ones.
Tested audio using gnome-settings, over HDMI, DP-SST and DP-MST connections on AD106 gpu.
--- sound/pci/hda/patch_hdmi.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/pci/hda/patch_hdmi.c +5 -0
@@ -3889,6 +3889,11 @@ HDA_CODEC_ENTRY(0x10de009d, "GPU 9d HDMIHDA_CODEC_ENTRY (0x10de009e ,"GPU 9e HDMI/DP" , patch_nvhdmi),HDA_CODEC_ENTRY (0x10de009f ,"GPU 9f HDMI/DP" , patch_nvhdmi),HDA_CODEC_ENTRY (0x10de00a0 ,"GPU a0 HDMI/DP" , patch_nvhdmi), +HDA_CODEC_ENTRY (0x10de00a3 ,"GPU a3 HDMI/DP" , patch_nvhdmi), +HDA_CODEC_ENTRY (0x10de00a4 ,"GPU a4 HDMI/DP" , patch_nvhdmi), +HDA_CODEC_ENTRY (0x10de00a5 ,"GPU a5 HDMI/DP" , patch_nvhdmi), +HDA_CODEC_ENTRY (0x10de00a6 ,"GPU a6 HDMI/DP" , patch_nvhdmi), +HDA_CODEC_ENTRY (0x10de00a7 ,"GPU a7 HDMI/DP" , patch_nvhdmi),HDA_CODEC_ENTRY (0x10de8001 ,"MCP73 HDMI" , patch_nvhdmi_2ch),HDA_CODEC_ENTRY (0x10de8067 ,"MCP67/68 HDMI" , patch_nvhdmi_2ch), HDA_CODEC_ENTRY(0x11069f80, "VX900 HDMI/DP", patch_via_hdmi),
Greg Kroah-Hartman
maintainerPATCH 67/86 netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ 215a31f19dedd4e92a67cf5a9717ee898d012b3a ]
NFT_SET_EVAL is signalling the kernel that this sets can be updated from the evaluation path, even if there are no expressions attached to the element. Otherwise, set updates with no expressions fail. Update description to describe the right semantics.
--- include/uapi/linux/netfilter/nf_tables.h | 2 +- net/netfilter/nft_dynset.c | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-)
include/uapi/linux/netfilter/nf_tables.h +1 -1
@@ -258,7 +258,7 @@ enum nft_rule_compat_attributes {* @NFT_SET_INTERVAL: set contains intervals * @NFT_SET_MAP: set is used as a dictionary * @NFT_SET_TIMEOUT: set uses timeouts -* @NFT_SET_EVAL: set contains expressions for evaluation +* @NFT_SET_EVAL: set can be updated from the evaluation path * @NFT_SET_OBJECT: set contains stateful objects */ enum nft_set_flags {
net/netfilter/nft_dynset.c +1 -3
@@ -190,9 +190,7 @@ static int nft_dynset_init(const struct priv->expr =nft_expr_init (ctx, tb[NFTA_DYNSET_EXPR ]);if (IS_ERR (priv->expr))return PTR_ERR (priv->expr); - - }else if (set->flags &NFT_SET_EVAL ) -return -EINVAL ; + }nft_set_ext_prepare (&priv->tmpl);nft_set_ext_add_length (&priv->tmpl,NFT_SET_EXT_KEY , set->klen);
Greg Kroah-Hartman
maintainerPATCH 68/86 netfilter: nf_tables: do not allow RULE_ID to refer to another chain
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ 36d5b2913219ac853908b0f1c664345e04313856 ]
When doing lookups for rules on the same batch by using its ID, a rule from a different chain can be used. If a rule is added to a chain but tries to be positioned next to a rule from a different chain, it will be linked to chain2, but the use counter on chain1 would be the one to be incremented.
When looking for rules by ID, use the chain that was used for the lookup by name. The chain used in the context copied to the transaction needs to match that same chain. That way, struct nft_rule does not need to get enlarged with another member.
--- net/netfilter/nf_tables_api.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +3 -1
@@ -2475,6 +2475,7 @@ err1: }static struct nft_rule *nft_rule_lookup_byid (const struct net *net, +const struct nft_chain *chain,const struct nlattr *nla) {u32 id =ntohl (nla_get_be32 (nla));
@@ -2484,6 +2485,7 @@ static struct nft_rule *nft_rule_lookup_struct nft_rule *rule =nft_trans_rule (trans);if (trans->msg_type ==NFT_MSG_NEWRULE && + trans->ctx.chain == chain && id ==nft_trans_rule_id (trans))return rule; }
@@ -2530,7 +2532,7 @@ static int nf_tables_delrule(struct net err =nft_delrule (&ctx, rule); }else if (nla[NFTA_RULE_ID ]) { - rule =nft_rule_lookup_byid (net, nla[NFTA_RULE_ID ]); + rule =nft_rule_lookup_byid (net, chain, nla[NFTA_RULE_ID ]);if (IS_ERR (rule))return PTR_ERR (rule);
Greg Kroah-Hartman
maintainerPATCH 69/86 netfilter: nf_tables: do not allow SET_ID to refer to another table
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 ]
When doing lookups for sets on the same batch by using its ID, a set from a different table can be used.
Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free.
When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table.
This fixes CVE-2022-2586, also reported as ZDI-CAN-17470.
--- include/net/netfilter/nf_tables.h | 2 ++ net/netfilter/nf_tables_api.c | 7 +++++-- 2 files changed, 7 insertions(+), 2 deletions(-)
include/net/netfilter/nf_tables.h +2 -0
@@ -381,6 +381,7 @@ void nft_unregister_set(struct nft_set_t* * @list: table set list node * @bindings: list of set bindings +* @table: table this set belongs to * @name: name of the set * @ktype: key type (numeric type defined by userspace, not used in the kernel) * @dtype: data type (verdict or numeric type defined by userspace)
@@ -404,6 +405,7 @@ void nft_unregister_set(struct nft_set_tstruct nft_set {struct list_head list;struct list_head bindings; +struct nft_table *table;char *name;u32 ktype;u32 dtype;
net/netfilter/nf_tables_api.c +5 -2
@@ -2746,6 +2746,7 @@ static struct nft_set *nf_tables_set_loo }static struct nft_set *nf_tables_set_lookup_byid (const struct net *net, +const struct nft_table *table,const struct nlattr *nla,u8 genmask) {
@@ -2757,6 +2758,7 @@ static struct nft_set *nf_tables_set_loostruct nft_set *set =nft_trans_set (trans);if (id ==nft_trans_set_id (trans) && + set->table == table &&nft_active_genmask (set, genmask))return set; }
@@ -2777,7 +2779,7 @@ struct nft_set *nft_set_lookup(const strif (!nla_set_id)return set; - set =nf_tables_set_lookup_byid (net, nla_set_id, genmask); + set =nf_tables_set_lookup_byid (net, table, nla_set_id, genmask); }return set; }
@@ -3272,6 +3274,7 @@ static int nf_tables_newset(struct net * }INIT_LIST_HEAD (&set->bindings); + set->table = table; set->ops = ops; set->ktype = ktype; set->klen = desc.klen;
@@ -4209,7 +4212,7 @@ static int nf_tables_newsetelem(struct n genmask);if (IS_ERR (set)) {if (nla[NFTA_SET_ELEM_LIST_SET_ID ]) { - set =nf_tables_set_lookup_byid (net, + set =nf_tables_set_lookup_byid (net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET_ID ], genmask); }
Greg Kroah-Hartman
maintainerPATCH 70/86 netfilter: nf_tables: fix register ordering
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ d209df3e7f7002d9099fdb0f6df0f972b4386a63 ]
[ We hit the trace described in commit message with the kselftest/nft_trans_stress.sh. This patch diverges from the upstream one since kernel 4.14 does not have following symbols:nft_chain_filter_init, nf_tables_flowtable_notifier ]
We must register nfnetlink ops last, as that exposes nf_tables to userspace. Without this, we could theoretically get nfnetlink request before net->nft state has been initialized.
--- net/netfilter/nf_tables_api.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
net/netfilter/nf_tables_api.c +11 -4
@@ -6105,18 +6105,25 @@ static int __init nf_tables_module_init( goto err1; } - err =nf_tables_core_module_init (); + err =register_pernet_subsys (&nf_tables_net_ops);if (err <0 ) goto err2; - err =nfnetlink_subsys_register (&nf_tables_subsys); + err =nf_tables_core_module_init ();if (err <0 ) goto err3; +/* must be last */ + err =nfnetlink_subsys_register (&nf_tables_subsys); +if (err <0 ) + goto err4; +pr_info ("nf_tables: (c) 2007-2009 Patrick McHardy <[email protected]>\n" ); -return register_pernet_subsys (&nf_tables_net_ops); -err3: +return err; +err4:nf_tables_core_module_exit (); +err3: +unregister_pernet_subsys (&nf_tables_net_ops); err2:kfree (info); err1:
Greg Kroah-Hartman
maintainerPATCH 71/86 x86/mm: Avoid incomplete Global INVLPG flushes
In reply to Greg Kroah-HartmanFrom: Dave Hansen <[email protected]>
commit ce0b15d11ad837fbacc5356941712218e38a0a83 upstream.
The INVLPG instruction is used to invalidate TLB entries for a specified virtual address. When PCIDs are enabled, INVLPG is supposed to invalidate TLB entries for the specified address for both the current PCID *and* Global entries. (Note: Only kernel mappings set Global=1.)
Unfortunately, some INVLPG implementations can leave Global translations unflushed when PCIDs are enabled.
As a workaround, never enable PCIDs on affected processors.
I expect there to eventually be microcode mitigations to replace this software workaround. However, the exact version numbers where that will happen are not known today. Once the version numbers are set in stone, the processor list can be tweaked to only disable PCIDs on affected processors with affected microcode.
Note: if anyone wants a quick fix that doesn't require patching, just stick 'nopcid' on your kernel command-line.
--- arch/x86/include/asm/intel-family.h | 5 +++++ arch/x86/mm/init.c | 25 +++++++++++++++++++++++++ 2 files changed, 30 insertions(+)
arch/x86/include/asm/intel-family.h +5 -0
@@ -73,6 +73,11 @@#define INTEL_FAM6_LAKEFIELD 0x8A#define INTEL_FAM6_ALDERLAKE 0x97#define INTEL_FAM6_ALDERLAKE_L 0x9A +#define INTEL_FAM6_ALDERLAKE_N 0xBE + +#define INTEL_FAM6_RAPTORLAKE 0xB7 +#define INTEL_FAM6_RAPTORLAKE_P 0xBA +#define INTEL_FAM6_RAPTORLAKE_S 0xBF#define INTEL_FAM6_TIGERLAKE_L 0x8C#define INTEL_FAM6_TIGERLAKE 0x8D
arch/x86/mm/init.c +25 -0
@@ -8,6 +8,7 @@#include <linux/swapops.h> #include <asm/set_memory.h> +#include <asm/cpu_device_id.h> #include <asm/e820/api.h> #include <asm/init.h> #include <asm/page.h>
@@ -199,6 +200,24 @@ static void __init probe_page_size_mask( } } +#define INTEL_MATCH (_model) { .vendor = X86_VENDOR_INTEL, \ + .family = 6, \ + .model = _model, \ + } +/* +* INVLPG may not properly flush Global entries +* on these CPUs when PCIDs are enabled. +*/ +static const struct x86_cpu_id invlpg_miss_ids[] = { +INTEL_MATCH (INTEL_FAM6_ALDERLAKE ), +INTEL_MATCH (INTEL_FAM6_ALDERLAKE_L ), +INTEL_MATCH (INTEL_FAM6_ALDERLAKE_N ), +INTEL_MATCH (INTEL_FAM6_RAPTORLAKE ), +INTEL_MATCH (INTEL_FAM6_RAPTORLAKE_P ), +INTEL_MATCH (INTEL_FAM6_RAPTORLAKE_S ), + {} +}; +static void setup_pcid (void ) {if (!IS_ENABLED (CONFIG_X86_64 ))
@@ -207,6 +226,12 @@ static void setup_pcid(void)if (!boot_cpu_has (X86_FEATURE_PCID ))return ; +if (x86_match_cpu (invlpg_miss_ids)) { +pr_info ("Incomplete global flushes, disabling PCID" ); +setup_clear_cpu_cap (X86_FEATURE_PCID ); +return ; + } +if (boot_cpu_has (X86_FEATURE_PGE )) {/* * This can't be cr4_set_bits_and_update_boot() -- the
Greg Kroah-Hartman
maintainerPATCH 72/86 selftests/memfd: Fix unknown type name build failure
In reply to Greg Kroah-HartmanFrom: Hardik Garg <[email protected]>
Partially backport v6.3 commit 11f75a01448f ("selftests/memfd: add tests for MFD_NOEXEC_SEAL MFD_EXEC") to fix an unknown type name build error. In some systems, the __u64 typedef is not present due to differences in system headers, causing compilation errors like this one:
fuse_test.c:64:8: error: unknown type name '__u64'
64 | static __u64 mfd_assert_get_seals(int fd)
This header includes the __u64 typedef which increases the likelihood of successful compilation on a wider variety of systems.
--- tools/testing/selftests/memfd/fuse_test.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/memfd/fuse_test.c +1 -0
@@ -22,6 +22,7 @@#include <linux/falloc.h> #include <linux/fcntl.h> #include <linux/memfd.h> +#include <linux/types.h> #include <sched.h> #include <stdio.h> #include <stdlib.h>
Greg Kroah-Hartman
maintainerPATCH 73/86 USB: core: Add routines for endpoint checks in old drivers
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit 13890626501ffda22b18213ddaf7930473da5792 upstream.
Many of the older USB drivers in the Linux USB stack were written based simply on a vendor's device specification. They use the endpoint information in the spec and assume these endpoints will always be present, with the properties listed, in any device matching the given vendor and product IDs.
While that may have been true back then, with spoofing and fuzzing it is not true any more. More and more we are finding that those old drivers need to perform at least a minimum of checking before they try to use any endpoint other than ep0.
To make this checking as simple as possible, we now add a couple of utility routines to the USB core. usb_check_bulk_endpoints() and usb_check_int_endpoints() take an interface pointer together with a list of endpoint addresses (numbers and directions). They check that the interface's current alternate setting includes endpoints with those addresses and that each of these endpoints has the right type:
bulk or interrupt, respectively.
Although we already have usb_find_common_endpoints() and related routines meant for a similar purpose, they are not well suited for this kind of checking. Those routines find endpoints of various kinds, but only one (either the first or the last) of each kind, and they don't verify that the endpoints' addresses agree with what the caller expects.
In theory the new routines could be more general: They could take a particular altsetting as their argument instead of always using the interface's current altsetting. In practice I think this won't matter too much; multiple altsettings tend to be used for transferring media (audio or visual) over isochronous endpoints, not bulk or interrupt. Drivers for such devices will generally require more sophisticated checking than these simplistic routines provide.
--- drivers/usb/core/usb.c | 76 +++++++++++++++++++++++++++++++++++++++++++++++++ include/linux/usb.h | 5 +++ 2 files changed, 81 insertions(+)
drivers/usb/core/usb.c +76 -0
@@ -210,6 +210,82 @@ int usb_find_common_endpoints_reverse(stEXPORT_SYMBOL_GPL (usb_find_common_endpoints_reverse);/** +* usb_find_endpoint() - Given an endpoint address, search for the endpoint's +* usb_host_endpoint structure in an interface's current altsetting. +* @intf: the interface whose current altsetting should be searched +* @ep_addr: the endpoint address (number and direction) to find +* +* Search the altsetting's list of endpoints for one with the specified address. +* +* Return: Pointer to the usb_host_endpoint if found, %NULL otherwise. +*/ +static const struct usb_host_endpoint *usb_find_endpoint ( +const struct usb_interface *intf,unsigned int ep_addr) +{ +int n; +const struct usb_host_endpoint *ep; + + n = intf->cur_altsetting->desc.bNumEndpoints; + ep = intf->cur_altsetting->endpoint; +for (; n >0 ; (--n, ++ep)) { +if (ep->desc.bEndpointAddress == ep_addr) +return ep; + } +return NULL ; +} + +/** +* usb_check_bulk_endpoints - Check whether an interface's current altsetting +* contains a set of bulk endpoints with the given addresses. +* @intf: the interface whose current altsetting should be searched +* @ep_addrs: 0-terminated array of the endpoint addresses (number and +* direction) to look for +* +* Search for endpoints with the specified addresses and check their types. +* +* Return: %true if all the endpoints are found and are bulk, %false otherwise. +*/ +bool usb_check_bulk_endpoints ( +const struct usb_interface *intf,const u8 *ep_addrs) +{ +const struct usb_host_endpoint *ep; + +for (; *ep_addrs; ++ep_addrs) { + ep =usb_find_endpoint (intf, *ep_addrs); +if (!ep || !usb_endpoint_xfer_bulk (&ep->desc)) +return false; + } +return true; +} +EXPORT_SYMBOL_GPL (usb_check_bulk_endpoints); + +/** +* usb_check_int_endpoints - Check whether an interface's current altsetting +* contains a set of interrupt endpoints with the given addresses. +* @intf: the interface whose current altsetting should be searched +* @ep_addrs: 0-terminated array of the endpoint addresses (number and +* direction) to look for +* +* Search for endpoints with the specified addresses and check their types. +* +* Return: %true if all the endpoints are found and are interrupt, +* %false otherwise. +*/ +bool usb_check_int_endpoints ( +const struct usb_interface *intf,const u8 *ep_addrs) +{ +const struct usb_host_endpoint *ep; + +for (; *ep_addrs; ++ep_addrs) { + ep =usb_find_endpoint (intf, *ep_addrs); +if (!ep || !usb_endpoint_xfer_int (&ep->desc)) +return false; + } +return true; +} +EXPORT_SYMBOL_GPL (usb_check_int_endpoints); + +/** * usb_find_alt_setting() - Given a configuration, find the alternate setting * for the given interface. * @config: the configuration to search (not necessarily the current config).
include/linux/usb.h +5 -0
@@ -279,6 +279,11 @@ void usb_put_intf(struct usb_interface *#define USB_MAXINTERFACES 32#define USB_MAXIADS (USB_MAXINTERFACES/2) +bool usb_check_bulk_endpoints ( +const struct usb_interface *intf,const u8 *ep_addrs); +bool usb_check_int_endpoints ( +const struct usb_interface *intf,const u8 *ep_addrs); +/* * USB Resume Timer: Every Host controller driver should drive the resume * signalling on the bus for the amount of time defined by this macro.
Greg Kroah-Hartman
maintainerPATCH 74/86 USB: sisusbvga: Add endpoint checks
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit df05a9b05e466a46725564528b277d0c570d0104 upstream.
The syzbot fuzzer was able to provoke a WARNING from the sisusbvga driver:
------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 26 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.2.0-rc5-syzkaller-00199-g5af6ce704936 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 6c 50 80 fb 48 8b 7c 24 18 e8 62 1a 01 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 60 b1 fa 8a e8 84 b0 be 03 <0f> 0b e9 58 f8 ff ff e8 3e 50 80 fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90000a1ed18 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff888012783a80 RSI: ffffffff816680ec RDI: fffff52000143d95 RBP: ffff888079020000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000003 R13: ffff888017d33370 R14: 0000000000000003 R15: ffff888021213600 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005592753a60b0 CR3: 0000000022899000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> sisusb_bulkout_msg drivers/usb/misc/sisusbvga/sisusbvga.c:224 [inline] sisusb_send_bulk_msg.constprop.0+0x904/0x1230 drivers/usb/misc/sisusbvga/sisusbvga.c:379 sisusb_send_bridge_packet drivers/usb/misc/sisusbvga/sisusbvga.c:567 [inline] sisusb_do_init_gfxdevice drivers/usb/misc/sisusbvga/sisusbvga.c:2077 [inline] sisusb_init_gfxdevice+0x87b/0x4000 drivers/usb/misc/sisusbvga/sisusbvga.c:2177 sisusb_probe+0x9cd/0xbe2 drivers/usb/misc/sisusbvga/sisusbvga.c:2869
...
The problem was caused by the fact that the driver does not check whether the endpoints it uses are actually present and have the appropriate types. This can be fixed by adding a simple check of the endpoints.
--- drivers/usb/misc/sisusbvga/sisusb.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/usb/misc/sisusbvga/sisusb.c +14 -0
@@ -3015,6 +3015,20 @@ static int sisusb_probe(struct usb_interstruct usb_device *dev =interface_to_usbdev (intf);struct sisusb_usb_data *sisusb;int retval =0 , i; +static const u8 ep_addresses[] = { +SISUSB_EP_GFX_IN |USB_DIR_IN , +SISUSB_EP_GFX_OUT |USB_DIR_OUT , +SISUSB_EP_GFX_BULK_OUT |USB_DIR_OUT , +SISUSB_EP_GFX_LBULK_OUT |USB_DIR_OUT , +SISUSB_EP_BRIDGE_IN |USB_DIR_IN , +SISUSB_EP_BRIDGE_OUT |USB_DIR_OUT , +0 }; + +/* Are the expected endpoints present? */ +if (!usb_check_bulk_endpoints (intf, ep_addresses)) { +dev_err (&intf->dev,"Invalid USB2VGA device\n" ); +return -EINVAL ; + }dev_info (&dev->dev,"USB2VGA dongle found at address %d\n" , dev->devnum);
Greg Kroah-Hartman
maintainerPATCH 75/86 media: radio-shark: Add endpoint checks
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit 76e31045ba030e94e72105c01b2e98f543d175ac upstream.
The syzbot fuzzer was able to provoke a WARNING from the radio-shark2 driver:
------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 3271 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 3271 Comm: kworker/0:3 Not tainted 6.1.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 00 36 ea fb 48 8b 7c 24 18 e8 36 1c 02 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 b6 90 8a e8 9a 29 b8 03 <0f> 0b e9 58 f8 ff ff e8 d2 35 ea fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90003876dd0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff8880750b0040 RSI: ffffffff816152b8 RDI: fffff5200070edac RBP: ffff8880172d81e0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffff8880285c5040 R14: 0000000000000002 R15: ffff888017158200 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe03235b90 CR3: 000000000bc8e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_bulk_msg+0x226/0x550 drivers/usb/core/message.c:387 shark_write_reg+0x1ff/0x2e0 drivers/media/radio/radio-shark2.c:88
...
The problem was caused by the fact that the driver does not check whether the endpoints it uses are actually present and have the appropriate types. This can be fixed by adding a simple check of these endpoints (and similarly for the radio-shark driver).
--- drivers/media/radio/radio-shark.c | 10 ++++++++++ drivers/media/radio/radio-shark2.c | 10 ++++++++++ 2 files changed, 20 insertions(+)
drivers/media/radio/radio-shark.c +10 -0
@@ -316,6 +316,16 @@ static int usb_shark_probe(struct usb_in {struct shark_device *shark;int retval = -ENOMEM ; +static const u8 ep_addresses[] = { +SHARK_IN_EP |USB_DIR_IN , +SHARK_OUT_EP |USB_DIR_OUT , +0 }; + +/* Are the expected endpoints present? */ +if (!usb_check_int_endpoints (intf, ep_addresses)) { +dev_err (&intf->dev,"Invalid radioSHARK device\n" ); +return -EINVAL ; + } shark =kzalloc (sizeof (struct shark_device ),GFP_KERNEL );if (!shark)
drivers/media/radio/radio-shark2.c +10 -0
@@ -282,6 +282,16 @@ static int usb_shark_probe(struct usb_in {struct shark_device *shark;int retval = -ENOMEM ; +static const u8 ep_addresses[] = { +SHARK_IN_EP |USB_DIR_IN , +SHARK_OUT_EP |USB_DIR_OUT , +0 }; + +/* Are the expected endpoints present? */ +if (!usb_check_int_endpoints (intf, ep_addresses)) { +dev_err (&intf->dev,"Invalid radioSHARK2 device\n" ); +return -EINVAL ; + } shark =kzalloc (sizeof (struct shark_device ),GFP_KERNEL );if (!shark)
Greg Kroah-Hartman
maintainerPATCH 76/86 net: fix skb leak in __skb_tstamp_tx()
In reply to Greg Kroah-HartmanFrom: Pratyush Yadav <[email protected]>
commit 8a02fb71d7192ff1a9a47c9d937624966c6e09af upstream.
Commit 50749f2dd685 ("tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.") added a call to skb_orphan_frags_rx() to fix leaks with zerocopy skbs. But it ended up adding a leak of its own. When skb_orphan_frags_rx() fails, the function just returns, leaking the skb it just cloned. Free it before returning.
This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.
--- net/core/skbuff.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/core/skbuff.c +3 -1
@@ -4421,8 +4421,10 @@ void __skb_tstamp_tx(struct sk_buff *ori }else { skb =skb_clone (orig_skb,GFP_ATOMIC ); -if (skb_orphan_frags_rx (skb,GFP_ATOMIC )) +if (skb_orphan_frags_rx (skb,GFP_ATOMIC )) { +kfree_skb (skb);return ; + } }if (!skb)return ;
Greg Kroah-Hartman
maintainerPATCH 50/86 statfs: enforce statfs[64] structure initialization
In reply to Greg Kroah-HartmanFrom: Ilya Leoshkevich <[email protected]>
commit ed40866ec7d328b3dfb70db7e2011640a16202c3 upstream.
s390's struct statfs and struct statfs64 contain padding, which field-by-field copying does not set. Initialize the respective structs with zeros before filling them and copying them to userspace, like it's already done for the compat versions of these structs.
Found by KMSAN.
--- fs/statfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/statfs.c +2 -2
@@ -114,6 +114,7 @@ static int do_statfs_native(struct kstatif (sizeof (buf) ==sizeof (*st))memcpy (&buf, st,sizeof (*st));else { +memset (&buf,0 ,sizeof (buf));if (sizeof buf.f_blocks ==4 ) { if ((st->f_blocks | st->f_bfree | st->f_bavail | st->f_bsize | st->f_frsize) &
@@ -142,7 +143,6 @@ static int do_statfs_native(struct kstat buf.f_namelen = st->f_namelen; buf.f_frsize = st->f_frsize; buf.f_flags = st->f_flags; -memset (buf.f_spare,0 ,sizeof (buf.f_spare)); }if (copy_to_user (p, &buf,sizeof (buf)))return -EFAULT ;
@@ -155,6 +155,7 @@ static int do_statfs64(struct kstatfs *sif (sizeof (buf) ==sizeof (*st))memcpy (&buf, st,sizeof (*st));else { +memset (&buf,0 ,sizeof (buf)); buf.f_type = st->f_type; buf.f_bsize = st->f_bsize; buf.f_blocks = st->f_blocks;
@@ -166,7 +167,6 @@ static int do_statfs64(struct kstatfs *s buf.f_namelen = st->f_namelen; buf.f_frsize = st->f_frsize; buf.f_flags = st->f_flags; -memset (buf.f_spare,0 ,sizeof (buf.f_spare)); }if (copy_to_user (p, &buf,sizeof (buf)))return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 51/86 serial: Add support for Advantech PCI-1611U card
In reply to Greg Kroah-HartmanFrom: Vitaliy Tomin <[email protected]>
commit d2b00516de0e1d696724247098f6733a6ea53908 upstream.
Add support for Advantech PCI-1611U card
Advantech provides opensource drivers for this and many others card based on legacy copy of 8250_pci driver called adv950
https://www.advantech.com/emt/support/details/driver?id=1-TDOIMJ
It is hard to maintain to run as out of tree module on newer kernels. Just adding PCI ID to kernel 8250_pci works perfect.
--- drivers/tty/serial/8250/8250_pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/tty/serial/8250/8250_pci.c +5 -0
@@ -1651,6 +1651,8 @@ pci_wch_ch38x_setup(struct serial_privat#define PCI_SUBDEVICE_ID_SIIG_DUAL_30 0x2530#define PCI_VENDOR_ID_ADVANTECH 0x13fe#define PCI_DEVICE_ID_INTEL_CE4100_UART 0x2e66 +#define PCI_DEVICE_ID_ADVANTECH_PCI1600 0x1600 +#define PCI_DEVICE_ID_ADVANTECH_PCI1600_1611 0x1611#define PCI_DEVICE_ID_ADVANTECH_PCI3620 0x3620#define PCI_DEVICE_ID_ADVANTECH_PCI3618 0x3618#define PCI_DEVICE_ID_ADVANTECH_PCIf618 0xf618
@@ -3851,6 +3853,9 @@ static SIMPLE_DEV_PM_OPS(pciserial_pm_op pciserial_resume_one);static const struct pci_device_id serial_pci_tbl[] = { + {PCI_VENDOR_ID_ADVANTECH ,PCI_DEVICE_ID_ADVANTECH_PCI1600 , +PCI_DEVICE_ID_ADVANTECH_PCI1600_1611 ,PCI_ANY_ID ,0 ,0 , + pbn_b0_4_921600 },/* Advantech use PCI_DEVICE_ID_ADVANTECH_PCI3620 (0x3620) as 'PCI_SUBVENDOR_ID' */ {PCI_VENDOR_ID_ADVANTECH ,PCI_DEVICE_ID_ADVANTECH_PCI3620 ,PCI_DEVICE_ID_ADVANTECH_PCI3620 ,0x0001 ,0 ,0 ,
Greg Kroah-Hartman
maintainerPATCH 52/86 ceph: force updating the msg pointer in non-split case
In reply to Greg Kroah-HartmanFrom: Xiubo Li <[email protected]>
commit 4cafd0400bcb6187c0d4ab4d4b0229a89ac4f8c2 upstream.
When the MClientSnap reqeust's op is not CEPH_SNAP_OP_SPLIT the request may still contain a list of 'split_realms', and we need to skip it anyway. Or it will be parsed as a corrupt snaptrace.
--- fs/ceph/snap.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
fs/ceph/snap.c +13 -0
@@ -959,6 +959,19 @@ skip_inode:continue ;adjust_snap_realm_parent (mdsc, child, realm->ino); } + }else { +/* +* In the non-split case both 'num_split_inos' and +* 'num_split_realms' should be 0, making this a no-op. +* However the MDS happens to populate 'split_realms' list +* in one of the UPDATE op cases by mistake. +* +* Skip both lists just in case to ensure that 'p' is +* positioned at the start of realm info, as expected by +* ceph_update_snap_trace(). +*/ + p +=sizeof (u64) * num_split_inos; + p +=sizeof (u64) * num_split_realms; }/*
Greg Kroah-Hartman
maintainerPATCH 53/86 nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit 9b5a04ac3ad9898c4745cba46ea26de74ba56a8e upstream.
During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). However, since nilfs_evict_inode() uses nilfs_root for some cleanup operations, it may cause use-after-free read if inodes are left in "garbage_list" and released by nilfs_dispose_list() at the end of nilfs_detach_log_writer().
Fix this issue by modifying nilfs_evict_inode() to only clear inode without additional metadata changes that use nilfs_root if the file system is degraded to read-only or the writer is detached.
--- fs/nilfs2/inode.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
fs/nilfs2/inode.c +18 -0
@@ -939,6 +939,7 @@ void nilfs_evict_inode(struct inode *inostruct nilfs_transaction_info ti;struct super_block *sb = inode->i_sb;struct nilfs_inode_info *ii =NILFS_I (inode); +struct the_nilfs *nilfs;int ret;if (inode->i_nlink || !ii->i_root ||unlikely (is_bad_inode (inode))) {
@@ -951,6 +952,23 @@ void nilfs_evict_inode(struct inode *inotruncate_inode_pages_final (&inode->i_data); + nilfs = sb->s_fs_info; +if (unlikely (sb_rdonly (sb) || !nilfs->ns_writer)) { +/* +* If this inode is about to be disposed after the file system +* has been degraded to read-only due to file system corruption +* or after the writer has been detached, do not make any +* changes that cause writes, just clear it. +* Do this check after read-locking ns_segctor_sem by +* nilfs_transaction_begin() in order to avoid a race with +* the writer detach operation. +*/ +clear_inode (inode); +nilfs_clear_inode (inode); +nilfs_transaction_abort (sb); +return ; + } +/* TODO: some of the following operations may fail. */ nilfs_truncate_bmap (ii,0 );nilfs_mark_inode_dirty (inode);
Greg Kroah-Hartman
maintainerPATCH 54/86 netfilter: nf_tables: bogus EBUSY in helper removal from transaction
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
commit 8ffcd32f64633926163cdd07a7d295c500a947d1 upstream.
Proper use counter updates when activating and deactivating the object, otherwise, this hits bogus EBUSY error.
--- net/netfilter/nft_objref.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
net/netfilter/nft_objref.c +16 -3
@@ -64,21 +64,34 @@ nla_put_failure:return -1 ; } -static void nft_objref_destroy (const struct nft_ctx *ctx, -const struct nft_expr *expr) +static void nft_objref_deactivate (const struct nft_ctx *ctx, +const struct nft_expr *expr, +enum nft_trans_phase phase) {struct nft_object *obj =nft_objref_priv (expr); +if (phase ==NFT_TRANS_COMMIT ) +return ; + obj->use--; } +static void nft_objref_activate (const struct nft_ctx *ctx, +const struct nft_expr *expr) +{ +struct nft_object *obj =nft_objref_priv (expr); + + obj->use++; +} +static struct nft_expr_type nft_objref_type;static const struct nft_expr_ops nft_objref_ops = { .type = &nft_objref_type, .size =NFT_EXPR_SIZE (sizeof (struct nft_object *)), .eval = nft_objref_eval, .init = nft_objref_init, - .destroy = nft_objref_destroy, + .activate = nft_objref_activate, + .deactivate = nft_objref_deactivate, .dump = nft_objref_dump, };
Greg Kroah-Hartman
maintainerPATCH 55/86 spi: spi-fsl-spi: automatically adapt bits-per-word in cpu mode
In reply to Greg Kroah-HartmanFrom: Rasmus Villemoes <[email protected]>
(cherry picked from upstream af0e6242909c3c4297392ca3e94eff1b4db71a97)
Taking one interrupt for every byte is rather slow. Since the controller is perfectly capable of transmitting 32 bits at a time, change t->bits_per-word to 32 when the length is divisible by 4 and large enough that the reduced number of interrupts easily compensates for the one or two extra fsl_spi_setup_transfer() calls this causes.
--- drivers/spi/spi-fsl-spi.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/spi/spi-fsl-spi.c +16 -0
@@ -357,12 +357,28 @@ static int fsl_spi_bufs(struct spi_devicstatic int fsl_spi_do_one_msg (struct spi_master *master,struct spi_message *m) { +struct mpc8xxx_spi *mpc8xxx_spi =spi_master_get_devdata (master);struct spi_device *spi = m->spi;struct spi_transfer *t, *first;unsigned int cs_change;const int nsecs =50 ;int status; +/* +* In CPU mode, optimize large byte transfers to use larger +* bits_per_word values to reduce number of interrupts taken. +*/ +if (!(mpc8xxx_spi->flags &SPI_CPM_MODE )) { +list_for_each_entry (t, &m->transfers, transfer_list) { +if (t->len <256 || t->bits_per_word !=8 ) +continue ; +if ((t->len &3 ) ==0 ) + t->bits_per_word =32 ; +else if ((t->len &1 ) ==0 ) + t->bits_per_word =16 ; + } + } +/* Don't allow changes if CS is active */ first = list_first_entry(&m->transfers, struct spi_transfer, transfer_list);
Greg Kroah-Hartman
maintainerPATCH 56/86 spi: fsl-spi: Re-organise transfer bits_per_word adaptation
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
(backported from upstream 8a5299a1278eadf1e08a598a5345c376206f171e)
For different reasons, fsl-spi driver performs bits_per_word modifications for different reasons:
- On CPU mode, to minimise amount of interrupts
- On CPM/QE mode to work around controller byte order
For CPU mode that's done in fsl_spi_prepare_message() while for CPM mode that's done in fsl_spi_setup_transfer().
Reunify all of it in fsl_spi_prepare_message(), and catch impossible cases early through master's bits_per_word_mask instead of returning EINVAL later.
--- drivers/spi/spi-fsl-spi.c | 50 +++++++++++++++++++++------------------------- 1 file changed, 23 insertions(+), 27 deletions(-)
drivers/spi/spi-fsl-spi.c +23 -27
@@ -201,26 +201,6 @@ static int mspi_apply_cpu_mode_quirks(streturn bits_per_word; } -static int mspi_apply_qe_mode_quirks (struct spi_mpc8xxx_cs *cs, -struct spi_device *spi, -int bits_per_word) -{ -/* CPM/QE uses Little Endian for words > 8 -* so transform 16 and 32 bits words into 8 bits -* Unfortnatly that doesn't work for LSB so -* reject these for now */ -/* Note: 32 bits word, LSB works iff -* tfcr/rfcr is set to CPMFCR_GBL */ -if (spi->mode &SPI_LSB_FIRST && - bits_per_word >8 ) -return -EINVAL ; -if (bits_per_word <=8 ) -return bits_per_word; -if (bits_per_word ==16 || bits_per_word ==32 ) -return 8 ;/* pretend its 8 bits */ -return -EINVAL ; -} -static int fsl_spi_setup_transfer (struct spi_device *spi,struct spi_transfer *t) {
@@ -248,9 +228,6 @@ static int fsl_spi_setup_transfer(struct bits_per_word =mspi_apply_cpu_mode_quirks (cs, spi, mpc8xxx_spi, bits_per_word); - else - bits_per_word =mspi_apply_qe_mode_quirks (cs, spi, - bits_per_word);if (bits_per_word <0 )return bits_per_word;
@@ -368,14 +345,27 @@ static int fsl_spi_do_one_msg(struct spi* In CPU mode, optimize large byte transfers to use larger * bits_per_word values to reduce number of interrupts taken. */ -if (!(mpc8xxx_spi->flags &SPI_CPM_MODE )) { -list_for_each_entry (t, &m->transfers, transfer_list) { +list_for_each_entry (t, &m->transfers, transfer_list) { +if (!(mpc8xxx_spi->flags &SPI_CPM_MODE )) {if (t->len <256 || t->bits_per_word !=8 )continue ;if ((t->len &3 ) ==0 ) t->bits_per_word =32 ;else if ((t->len &1 ) ==0 ) t->bits_per_word =16 ; + }else { +/* +* CPM/QE uses Little Endian for words > 8 +* so transform 16 and 32 bits words into 8 bits +* Unfortnatly that doesn't work for LSB so +* reject these for now +* Note: 32 bits word, LSB works iff +* tfcr/rfcr is set to CPMFCR_GBL +*/ +if (m->spi->mode &SPI_LSB_FIRST && t->bits_per_word >8 ) +return -EINVAL ; +if (t->bits_per_word ==16 || t->bits_per_word ==32 ) + t->bits_per_word =8 ;/* pretend its 8 bits */ } }
@@ -658,8 +648,14 @@ static struct spi_master * fsl_spi_probeif (mpc8xxx_spi->type ==TYPE_GRLIB )fsl_spi_grlib_probe (dev); - master->bits_per_word_mask = - (SPI_BPW_RANGE_MASK (4 ,16 ) |SPI_BPW_MASK (32 )) & +if (mpc8xxx_spi->flags &SPI_CPM_MODE ) + master->bits_per_word_mask = + (SPI_BPW_RANGE_MASK (4 ,8 ) |SPI_BPW_MASK (16 ) |SPI_BPW_MASK (32 )); +else + master->bits_per_word_mask = + (SPI_BPW_RANGE_MASK (4 ,16 ) |SPI_BPW_MASK (32 )); + + master->bits_per_word_mask &=SPI_BPW_RANGE_MASK (1 , mpc8xxx_spi->max_bits_per_word);if (mpc8xxx_spi->flags &SPI_QE_CPU_MODE )
Greg Kroah-Hartman
maintainerPATCH 47/86 usb-storage: fix deadlock when a scsi command timeouts more than once
In reply to Greg Kroah-HartmanFrom: Maxime Bizon <[email protected]>
commit a398d5eac6984316e71474e25b975688f282379b upstream.
With faulty usb-storage devices, read/write can timeout, in that case the SCSI layer will abort and re-issue the command. USB storage has no internal timeout, it relies on SCSI layer aborting commands via .eh_abort_handler() for non those responsive devices.
After two consecutive timeouts of the same command, SCSI layer calls .eh_device_reset_handler(), without calling .eh_abort_handler() first.
With usb-storage, this causes a deadlock:
-> .eh_device_reset_handler
-> device_reset
-> mutex_lock(&(us->dev_mutex));mutex already by usb_stor_control_thread(), which is waiting for command completion:
-> usb_stor_control_thread (mutex taken here)
-> usb_stor_invoke_transport
-> usb_stor_Bulk_transport
-> usb_stor_bulk_srb
-> usb_stor_bulk_transfer_sglist
-> usb_sg_waitMake sure we cancel any pending command in .eh_device_reset_handler() to avoid this.
--- drivers/usb/storage/scsiglue.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
drivers/usb/storage/scsiglue.c +21 -7
@@ -408,22 +408,25 @@ static DEF_SCSI_QCMD(queuecommand)***********************************************************************/ /* Command timeout and abort */ -static int command_abort (struct scsi_cmnd *srb) +static int command_abort_matching (struct us_data *us,struct scsi_cmnd *srb_match) { -struct us_data *us =host_to_us (srb->device->host); - -usb_stor_dbg (us,"%s called\n" , __func__); -/* * us->srb together with the TIMED_OUT, RESETTING, and ABORTING * bits are protected by the host lock. */ scsi_lock (us_to_host (us)); -/* Is this command still active? */ -if (us->srb != srb) { +/* is there any active pending command to abort ? */ +if (!us->srb) {scsi_unlock (us_to_host (us));usb_stor_dbg (us,"-- nothing to abort\n" ); +return SUCCESS ; + } + +/* Does the command match the passed srb if any ? */ +if (srb_match && us->srb != srb_match) { +scsi_unlock (us_to_host (us)); +usb_stor_dbg (us,"-- pending command mismatch\n" );return FAILED ; }
@@ -446,6 +449,14 @@ static int command_abort(struct scsi_cmnreturn SUCCESS ; } +static int command_abort (struct scsi_cmnd *srb) +{ +struct us_data *us =host_to_us (srb->device->host); + +usb_stor_dbg (us,"%s called\n" , __func__); +return command_abort_matching (us, srb); +} +/* * This invokes the transport reset mechanism to reset the state of the * device
@@ -457,6 +468,9 @@ static int device_reset(struct scsi_cmndusb_stor_dbg (us,"%s called\n" , __func__); +/* abort any pending command before reset */ +command_abort_matching (us,NULL ); +/* lock the device pointers and do the reset */ mutex_lock (&(us->dev_mutex)); result = us->transport_reset (us);
Greg Kroah-Hartman
maintainerPATCH 78/86 power: supply: leds: Fix blink to LED on transition
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit e4484643991e0f6b89060092563f0dbab9450cbb upstream.
When a battery's status changes from charging to full then the charging-blink-full-solid trigger tries to change the LED from blinking to solid/on.
As is documented in include/linux/leds.h to deactivate blinking / to make the LED solid a LED_OFF must be send:
"""
* Deactivate blinking again when the brightness is set to LED_OFF
* via the brightness_set() callback.
"""
led_set_brighness() calls with a brightness value other then 0 / LED_OFF merely change the brightness of the LED in its on state while it is blinking.
So power_supply_update_bat_leds() must first send a LED_OFF event before the LED_FULL to disable blinking.
--- drivers/power/supply/power_supply_leds.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/power/supply/power_supply_leds.c +3 -2
@@ -35,8 +35,9 @@ static void power_supply_update_bat_ledsled_trigger_event (psy->charging_full_trig,LED_FULL );led_trigger_event (psy->charging_trig,LED_OFF );led_trigger_event (psy->full_trig,LED_FULL ); -led_trigger_event (psy->charging_blink_full_solid_trig, -LED_FULL ); +/* Going from blink to LED on requires a LED_OFF event to stop blink */ +led_trigger_event (psy->charging_blink_full_solid_trig,LED_OFF ); +led_trigger_event (psy->charging_blink_full_solid_trig,LED_FULL );break ;case POWER_SUPPLY_STATUS_CHARGING :led_trigger_event (psy->charging_full_trig,LED_FULL );
Greg Kroah-Hartman
maintainerPATCH 79/86 power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 5c34c0aef185dcd10881847b9ebf20046aa77cb4 upstream.
bq27xxx_battery_update() assumes / requires that it is only run once, not multiple times at the same time. But there are 3 possible callers:
1. bq27xxx_battery_poll() delayed_work item handler
2. bq27xxx_battery_irq_handler_thread() I2C IRQ handler
3. bq27xxx_battery_setup()
And there is no protection against these racing with each other, fix this race condition by making all callers take di->lock:
- Rename bq27xxx_battery_update() to bq27xxx_battery_update_unlocked()
- Add new bq27xxx_battery_update() which takes di->lock and then calls bq27xxx_battery_update_unlocked()
- Make stale cache check code in bq27xxx_battery_get_property(), which already takes di->lock directly to check the jiffies, call bq27xxx_battery_update_unlocked() instead of messing with the delayed_work item
- Make bq27xxx_battery_update_unlocked() mod the delayed-work item so that the next poll is delayed to poll_interval milliseconds after the last update independent of the source of the update
--- drivers/power/supply/bq27xxx_battery.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)
drivers/power/supply/bq27xxx_battery.c +13 -8
@@ -1506,7 +1506,7 @@ static int bq27xxx_battery_read_health(sreturn POWER_SUPPLY_HEALTH_GOOD ; } -void bq27xxx_battery_update (struct bq27xxx_device_info *di) +static void bq27xxx_battery_update_unlocked (struct bq27xxx_device_info *di) {struct bq27xxx_reg_cache cache = {0 , };bool has_ci_flag = di->opts &BQ27XXX_O_ZERO ;
@@ -1554,6 +1554,16 @@ void bq27xxx_battery_update(struct bq27x di->cache = cache; di->last_update = jiffies; + +if (poll_interval >0 ) +mod_delayed_work (system_wq, &di->work, poll_interval *HZ ); +} + +void bq27xxx_battery_update (struct bq27xxx_device_info *di) +{ +mutex_lock (&di->lock); +bq27xxx_battery_update_unlocked (di); +mutex_unlock (&di->lock); }EXPORT_SYMBOL_GPL (bq27xxx_battery_update);
@@ -1564,9 +1574,6 @@ static void bq27xxx_battery_poll(struct work.work);bq27xxx_battery_update (di); - -if (poll_interval >0 ) -schedule_delayed_work (&di->work, poll_interval *HZ ); }/*
@@ -1725,10 +1732,8 @@ static int bq27xxx_battery_get_property(struct bq27xxx_device_info *di =power_supply_get_drvdata (psy);mutex_lock (&di->lock); -if (time_is_before_jiffies (di->last_update +5 *HZ )) { -cancel_delayed_work_sync (&di->work); -bq27xxx_battery_poll (&di->work.work); - } +if (time_is_before_jiffies (di->last_update +5 *HZ )) +bq27xxx_battery_update_unlocked (di);mutex_unlock (&di->lock);if (psp !=POWER_SUPPLY_PROP_PRESENT && di->cache.flags <0 )
Greg Kroah-Hartman
maintainerPATCH 80/86 power: supply: bq27xxx: Fix I2C IRQ race on remove
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 444ff00734f3878cd54ddd1ed5e2e6dbea9326d5 upstream.
devm_request_threaded_irq() requested IRQs are only free-ed after the driver's remove function has ran. So the IRQ could trigger and call bq27xxx_battery_update() after bq27xxx_battery_teardown() has already run.
Switch to explicitly free-ing the IRQ in bq27xxx_battery_i2c_remove() to fix this.
--- drivers/power/supply/bq27xxx_battery_i2c.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/bq27xxx_battery_i2c.c +2 -1
@@ -187,7 +187,7 @@ static int bq27xxx_battery_i2c_probe(stri2c_set_clientdata (client, di);if (client->irq) { - ret =devm_request_threaded_irq (&client->dev, client->irq, + ret =request_threaded_irq (client->irq,NULL , bq27xxx_battery_irq_handler_thread,IRQF_ONESHOT , di->name, di);
@@ -217,6 +217,7 @@ static int bq27xxx_battery_i2c_remove(st {struct bq27xxx_device_info *di =i2c_get_clientdata (client); +free_irq (client->irq, di);bq27xxx_battery_teardown (di);mutex_lock (&battery_mutex);
Greg Kroah-Hartman
maintainerPATCH 81/86 power: supply: bq27xxx: Fix poll_interval handling and races on remove
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit c00bc80462afc7963f449d7f21d896d2f629cacc upstream.
Before this patch bq27xxx_battery_teardown() was setting poll_interval = 0 to avoid bq27xxx_battery_update() requeuing the delayed_work item.
There are 2 problems with this:
1. If the driver is unbound through sysfs, rather then the module being rmmod-ed, this changes poll_interval unexpectedly
2. This is racy, after it being set poll_interval could be changed before bq27xxx_battery_update() checks it through /sys/module/bq27xxx_battery/parameters/poll_interval
Fix this by added a removed attribute to struct bq27xxx_device_info and using that instead of setting poll_interval to 0.
There also is another poll_interval related race on remove(), writing /sys/module/bq27xxx_battery/parameters/poll_interval will requeue the delayed_work item for all devices on the bq27xxx_battery_devices list and the device being removed was only removed from that list after cancelling the delayed_work item.
Fix this by moving the removal from the bq27xxx_battery_devices list to before cancelling the delayed_work item.
--- drivers/power/supply/bq27xxx_battery.c | 22 +++++++++------------- include/linux/power/bq27xxx_battery.h | 1 + 2 files changed, 10 insertions(+), 13 deletions(-)
drivers/power/supply/bq27xxx_battery.c +9 -13
@@ -1555,7 +1555,7 @@ static void bq27xxx_battery_update_unloc di->last_update = jiffies; -if (poll_interval >0 ) +if (!di->removed && poll_interval >0 )mod_delayed_work (system_wq, &di->work, poll_interval *HZ ); }
@@ -1870,22 +1870,18 @@ EXPORT_SYMBOL_GPL(bq27xxx_battery_setup)void bq27xxx_battery_teardown (struct bq27xxx_device_info *di) { -/* -* power_supply_unregister call bq27xxx_battery_get_property which -* call bq27xxx_battery_poll. -* Make sure that bq27xxx_battery_poll will not call -* schedule_delayed_work again after unregister (which cause OOPS). -*/ - poll_interval =0 ; - -cancel_delayed_work_sync (&di->work); - -power_supply_unregister (di->bat); -mutex_lock (&bq27xxx_list_lock);list_del (&di->list);mutex_unlock (&bq27xxx_list_lock); +/* Set removed to avoid bq27xxx_battery_update() re-queuing the work */ +mutex_lock (&di->lock); + di->removed = true; +mutex_unlock (&di->lock); + +cancel_delayed_work_sync (&di->work); + +power_supply_unregister (di->bat);mutex_destroy (&di->lock); }EXPORT_SYMBOL_GPL (bq27xxx_battery_teardown);
include/linux/power/bq27xxx_battery.h +1 -0
@@ -61,6 +61,7 @@ struct bq27xxx_device_info {struct bq27xxx_access_methods bus;struct bq27xxx_reg_cache cache;int charge_design_full; +bool removed;unsigned long last_update;struct delayed_work work;struct power_supply *bat;
Greg Kroah-Hartman
maintainerPATCH 82/86 power: supply: sbs-charger: Fix INHIBITED bit for Status reg
In reply to Greg Kroah-HartmanFrom: Daisuke Nojiri <[email protected]>
commit b2f2a3c9800208b0db2c2e34b05323757117faa2 upstream.
CHARGE_INHIBITED bit position of the ChargerStatus register is actually 0 not 1. This patch corrects it.
--- drivers/power/supply/sbs-charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/sbs-charger.c +1 -1
@@ -29,7 +29,7 @@#define SBS_CHARGER_REG_STATUS 0x13#define SBS_CHARGER_REG_ALARM_WARNING 0x16 -#define SBS_CHARGER_STATUS_CHARGE_INHIBITED BIT(1) +#define SBS_CHARGER_STATUS_CHARGE_INHIBITED BIT(0)#define SBS_CHARGER_STATUS_RES_COLD BIT(9)#define SBS_CHARGER_STATUS_RES_HOT BIT(10)#define SBS_CHARGER_STATUS_BATTERY_PRESENT BIT(14)
Greg Kroah-Hartman
maintainerPATCH 83/86 xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 8fafac202d18230bb9926bda48e563fd2cce2a4f upstream.
In the pvcalls_new_active_socket() function, most error paths call pvcalls_back_release_active(fedata->dev, fedata, map) which calls sock_release() on "sock". The bug is that the caller also frees sock.
Fix this by making every error path in pvcalls_new_active_socket() release the sock, and don't free it in the caller.
--- drivers/xen/pvcalls-back.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/xen/pvcalls-back.c +4 -5
@@ -338,8 +338,10 @@ static struct sock_mapping *pvcalls_new_void *page; map =kzalloc (sizeof (*map),GFP_KERNEL ); -if (map ==NULL ) +if (map ==NULL ) { +sock_release (sock);return NULL ; + } map->fedata = fedata; map->sock = sock;
@@ -431,10 +433,8 @@ static int pvcalls_back_connect(struct x req->u.connect.ref, req->u.connect.evtchn, sock); -if (!map) { +if (!map) ret = -EFAULT ; -sock_release (sock); - } out: rsp =RING_GET_RESPONSE (&fedata->ring, fedata->ring.rsp_prod_pvt++);
@@ -575,7 +575,6 @@ static void __pvcalls_back_accept(struct sock);if (!map) { ret = -EFAULT ; -sock_release (sock); goto out_error; }
Greg Kroah-Hartman
maintainerPATCH 84/86 x86/show_trace_log_lvl: Ensure stack pointer is aligned, again
In reply to Greg Kroah-HartmanFrom: Vernon Lovejoy <[email protected]>
commit 2e4be0d011f21593c6b316806779ba1eba2cd7e0 upstream.
The commit e335bb51cc15 ("x86/unwind: Ensure stack pointer is aligned") tried to align the stack pointer in show_trace_log_lvl(), otherwise the "stack < stack_info.end" check can't guarantee that the last read does not go past the end of the stack.
However, we have the same problem with the initial value of the stack pointer, it can also be unaligned. So without this patch this trivial kernel module
#include <linux/module.h>
static int init(void)
{
asm volatile("sub $0x4,%rsp");
dump_stack();
asm volatile("add $0x4,%rsp");
return -EAGAIN;
}
module_init(init);
MODULE_LICENSE("GPL");crashes the kernel.
--- arch/x86/kernel/dumpstack.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
arch/x86/kernel/dumpstack.c +5 -2
@@ -115,7 +115,6 @@ void show_trace_log_lvl(struct task_struprintk ("%sCall Trace:\n" , log_lvl);unwind_start (&state, task, regs, stack); - stack = stack ? :get_stack_pointer (task, regs); regs =unwind_get_entry_regs (&state, &partial);/*
@@ -134,9 +133,13 @@ void show_trace_log_lvl(struct task_stru* - hardirq stack * - entry stack */ -for ( ; stack; stack =PTR_ALIGN (stack_info.next_sp,sizeof (long ))) { +for (stack = stack ?:get_stack_pointer (task, regs); + stack; + stack = stack_info.next_sp) {const char *stack_name; + stack =PTR_ALIGN (stack,sizeof (long )); +if (get_stack_info (stack, task, &stack_info, &visit_mask)) {/* * We weren't on a valid stack. It's possible that
Greg Kroah-Hartman
maintainerPATCH 85/86 forcedeth: Fix an error handling path in nv_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit 5b17a4971d3b2a073f4078dd65331efbe35baa2d upstream.
If an error occures after calling nv_mgmt_acquire_sema(), it should be undone with a corresponding nv_mgmt_release_sema() call.
Add it in the error handling path of the probe as already done in the remove function.
--- drivers/net/ethernet/nvidia/forcedeth.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/nvidia/forcedeth.c +1 -0
@@ -6020,6 +6020,7 @@ static int nv_probe(struct pci_dev *pci_return 0 ; out_error: +nv_mgmt_release_sema (dev);if (phystate_orig)writel (phystate|NVREG_ADAPTCTL_RUNNING , base + NvRegAdapterControl); out_freering:
Greg Kroah-Hartman
maintainerPATCH 86/86 3c589_cs: Fix an error handling path in tc589_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit 640bf95b2c7c2981fb471acdafbd3e0458f8390d upstream.
Should tc589_config() fail, some resources need to be released as already done in the remove function.
--- drivers/net/ethernet/3com/3c589_cs.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/net/ethernet/3com/3c589_cs.c +10 -1
@@ -196,6 +196,7 @@ static int tc589_probe(struct pcmcia_dev {struct el3_private *lp;struct net_device *dev; +int ret;dev_dbg (&link->dev,"3c589_attach()\n" );
@@ -219,7 +220,15 @@ static int tc589_probe(struct pcmcia_dev dev->ethtool_ops = &netdev_ethtool_ops; -return tc589_config (link); + ret =tc589_config (link); +if (ret) + goto err_free_netdev; + +return 0 ; + +err_free_netdev: +free_netdev (dev); +return ret; }static void tc589_detach (struct pcmcia_device *link)
Greg Kroah-Hartman
maintainerPATCH 77/86 ipv6: Fix out-of-bounds access in ipv6_find_tlv()
In reply to Greg Kroah-HartmanFrom: Gavrilov Ilia <[email protected]>
commit 878ecb0897f4737a4c9401f3523fd49589025671 upstream.
optlen is fetched without checking whether there is more than one byte to parse. It can lead to out-of-bounds access.
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.
--- net/ipv6/exthdrs_core.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv6/exthdrs_core.c +2 -0
@@ -142,6 +142,8 @@ int ipv6_find_tlv(const struct sk_buff * optlen =1 ;break ;default : +if (len <2 ) + goto bad; optlen = nh[offset +1 ] +2 ;if (optlen > len) goto bad;
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.316 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 30 May 2023 19:08:13 +0000. Anything received after that time might be too late.
Build results:
total: 168 pass: 168 fail: 0 Qemu test results: total: 430 pass: 430 fail: 0
Guenter
Re: [PATCH 4.14 22/86] null_blk: Always check queue mode setting from configfs
In reply to Greg Kroah-HartmanHi Greg,
Quoted 68 lines · Greg Kroah-Hartman
From: Chaitanya Kulkarni <[email protected]>
[ Upstream commit
63f8793ee60513a09f110ea460a6ff2c33811cdb]Make sure to check device queue mode in the
null_validate_conf()and return error forNULL_Q_RQas we don't allow legacy I/O path, without this patch we get OOPs when queue mode is set to 1 from configfs, following are repro steps :-modprobe
null_blknr_devices=0
mkdir config/nullb/nullb0
echo 1 > config/nullb/nullb0/memory_backed
echo 4096 > config/nullb/nullb0/blocksize
echo 20480 > config/nullb/nullb0/size
echo 1 > config/nullb/nullb0/queue_mode
echo 1 > config/nullb/nullb0/powerEntering kdb (current=0xffff88810acdd080, pid 2372) on processor 42 Oops: (null) due to oops @
0xffffffffc041c329CPU: 42 PID: 2372 Comm: sh Tainted: G O N 6.3.0-rc5lblk+ #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:null_add_dev.part.0+0xd9/0x720 [null_blk] Code: 01 00 00 85 d2 0f 85 a1 03 00 00 48 83 bb 08 01 00 00 00 0f 85 f7 03 00 00 80 bb 62 01 00 00 00 48 8b 75 20 0f 85 6d 02 00 00 <48> 89 6e 60 48 8b 75 20 bf 06 00 00 00 e8 f5 37 2c c1 48 8b 75 20 RSP: 0018:ffffc900052cbde0 EFLAGS: 00010246 RAX: 0000000000000001 RBX: ffff88811084d800 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888100042e00 RBP: ffff8881053d8200 R08: ffffc900052cbd68 R09: ffff888105db2000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000002 R13: ffff888104765200 R14: ffff88810eec1748 R15: ffff88810eec1740 FS: 00007fd445fd1740(0000) GS:ffff8897dfc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000060 CR3: 0000000166a00000 CR4: 0000000000350ee0 DR0: ffffffff8437a488 DR1: ffffffff8437a489 DR2: ffffffff8437a48a DR3: ffffffff8437a48b DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: <TASK> nullb_device_power_store+0xd1/0x120 [null_blk] configfs_write_iter+0xb4/0x120 vfs_write+0x2ba/0x3c0 ksys_write+0x5f/0xe0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fd4460c57a7 Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007ffd3792a4a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd4460c57a7 RDX: 0000000000000002 RSI: 000055b43c02e4c0 RDI: 0000000000000001 RBP: 000055b43c02e4c0 R08: 000000000000000a R09: 00007fd44615b4e0 R10: 00007fd44615b3e0 R11: 0000000000000246 R12: 0000000000000002 R13: 00007fd446198520 R14: 0000000000000002 R15: 00007fd446198700 </TASK>Signed-off-by Chaitanya Kulkarni <[email protected]>Reviewed-by Damien Le Moal <[email protected]>Reviewed-by Ming Lei <[email protected]>Reviewed-by Nitesh Shetty <[email protected]>Signed-off-by Jens Axboe <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/block/null_blk.c | 5 +++++ 1 file changed, 5 insertions(+)drivers/block/null_blk.c +0
-0
drivers/block/null_blk.c static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set) · line 1787
Quoted 8 lines
drivers/block/null_blk.c +5
-0@@ -1780,6 +1780,11 @@ static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set)static void null_validate_conf (struct nullb_device *dev) { +if (dev->queue_mode ==NULL_Q_RQ ) { +pr_err ("legacy IO path is no longer available\n" ); +return -EINVAL ; + } +
This patch introduces a warning during build:
drivers/block/null_blk.c: In function 'null_validate_conf':
drivers/block/null_blk.c:1785:10: warning: 'return' with a value, in
function returning void
return -EINVAL;
^
drivers/block/null_blk.c:1781:13: note: declared here
static void null_validate_conf(struct nullb_device *dev)
^~~~~~~~~~~~~~~~~~The commit message explains on how to reproduce the bug, with my CONFIG(CONFIG_BLK_DEV_NULL_BLK enabled) I am unable to reproduce this bug on 4.14.315. So I think we can drop this patch from 4.14.y release as it introduces the above warning.
Commit 5c4bd1f40c23d is not present on 4.14.y, which changes the return type of this.
Given that the bug mentioned in the commit message is not reproducible on 4.14.y, I think we can drop this patch instead of taking a prerequisite(5c4bd1f40c23d).
Note: I don't see this patch being queued up for 5.4.y.
[Thanks to Vegard for helping with this.]
Regards,
Harshit
Quoted 3 lines
drivers/block/null_blk.c +0
-0dev->blocksize =round_down (dev->blocksize,512 ); dev->blocksize = clamp_t(unsigned int, dev->blocksize, 512, 4096);if (dev->use_lightnvm && dev->blocksize !=4096 )
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.316 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 30 May 2023 19:08:13 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.316-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 4.14.316-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-4.14.y
* git commit: 102232d7564c0309a3860a21180d09bb04978f5f
* git describe: v4.14.315-87-g102232d7564c
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.14.y/build/v4.14.315-87-g102232d7564c
## Test Regressions (compared to v4.14.315)
## Metric Regressions (compared to v4.14.315)
## Test Fixes (compared to v4.14.315)
## Metric Fixes (compared to v4.14.315)
## Test result summary
total: 84485, pass: 70491, fail: 3766, skip: 10063, xfail: 165
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 108 total, 104 passed, 4 failed
* arm64: 35 total, 31 passed, 4 failed
* i386: 21 total, 18 passed, 3 failed
* mips: 21 total, 21 passed, 0 failed
* parisc: 6 total, 6 passed, 0 failed
* powerpc: 8 total, 7 passed, 1 failed
* s390: 6 total, 5 passed, 1 failed
* sh: 12 total, 12 passed, 0 failed
* sparc: 6 total, 6 passed, 0 failed
* x86_64: 27 total, 23 passed, 4 failed
## Test suites summary
* boot
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-net
* kselftest-net-forwarding
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* rcutorture
* v4l2-compliance
* vdso
--
Linaro LKFT
https://lkft.linaro.org
Greg Kroah-Hartman
maintainerRe: [PATCH 4.14 22/86] null_blk: Always check queue mode setting from configfs
In reply to Harshit MogalapalliQuoted 99 lines · Harshit Mogalapalli
Hi Greg,
Quoted 68 lines · Greg Kroah-Hartman
From: Chaitanya Kulkarni <[email protected]>
[ Upstream commit
63f8793ee60513a09f110ea460a6ff2c33811cdb]Make sure to check device queue mode in the
null_validate_conf()and return error forNULL_Q_RQas we don't allow legacy I/O path, without this patch we get OOPs when queue mode is set to 1 from configfs, following are repro steps :-modprobe
null_blknr_devices=0
mkdir config/nullb/nullb0
echo 1 > config/nullb/nullb0/memory_backed
echo 4096 > config/nullb/nullb0/blocksize
echo 20480 > config/nullb/nullb0/size
echo 1 > config/nullb/nullb0/queue_mode
echo 1 > config/nullb/nullb0/powerEntering kdb (current=0xffff88810acdd080, pid 2372) on processor 42 Oops: (null) due to oops @
0xffffffffc041c329CPU: 42 PID: 2372 Comm: sh Tainted: G O N 6.3.0-rc5lblk+ #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:null_add_dev.part.0+0xd9/0x720 [null_blk] Code: 01 00 00 85 d2 0f 85 a1 03 00 00 48 83 bb 08 01 00 00 00 0f 85 f7 03 00 00 80 bb 62 01 00 00 00 48 8b 75 20 0f 85 6d 02 00 00 <48> 89 6e 60 48 8b 75 20 bf 06 00 00 00 e8 f5 37 2c c1 48 8b 75 20 RSP: 0018:ffffc900052cbde0 EFLAGS: 00010246 RAX: 0000000000000001 RBX: ffff88811084d800 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888100042e00 RBP: ffff8881053d8200 R08: ffffc900052cbd68 R09: ffff888105db2000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000002 R13: ffff888104765200 R14: ffff88810eec1748 R15: ffff88810eec1740 FS: 00007fd445fd1740(0000) GS:ffff8897dfc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000060 CR3: 0000000166a00000 CR4: 0000000000350ee0 DR0: ffffffff8437a488 DR1: ffffffff8437a489 DR2: ffffffff8437a48a DR3: ffffffff8437a48b DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: <TASK> nullb_device_power_store+0xd1/0x120 [null_blk] configfs_write_iter+0xb4/0x120 vfs_write+0x2ba/0x3c0 ksys_write+0x5f/0xe0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fd4460c57a7 Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007ffd3792a4a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd4460c57a7 RDX: 0000000000000002 RSI: 000055b43c02e4c0 RDI: 0000000000000001 RBP: 000055b43c02e4c0 R08: 000000000000000a R09: 00007fd44615b4e0 R10: 00007fd44615b3e0 R11: 0000000000000246 R12: 0000000000000002 R13: 00007fd446198520 R14: 0000000000000002 R15: 00007fd446198700 </TASK>Signed-off-by Chaitanya Kulkarni <[email protected]>Reviewed-by Damien Le Moal <[email protected]>Reviewed-by Ming Lei <[email protected]>Reviewed-by Nitesh Shetty <[email protected]>Signed-off-by Jens Axboe <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/block/null_blk.c | 5 +++++ 1 file changed, 5 insertions(+)drivers/block/null_blk.c +0
-0drivers/block/null_blk.c static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set) · line 1786
Quoted 7 lines
drivers/block/null_blk.c +5
-0@@ -1780,6 +1780,11 @@ static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set)static void null_validate_conf (struct nullb_device *dev) { +if (dev->queue_mode ==NULL_Q_RQ ) { +pr_err ("legacy IO path is no longer available\n" ); +return -EINVAL ; + } +This patch introduces a warning during build:
drivers/block/null_blk.c: In function 'null_validate_conf':
drivers/block/null_blk.c:1785:10: warning: 'return' with a value, in
function returning voidreturn -EINVAL; ^ drivers/block/null_blk.c:1781:13: note: declared here static void null_validate_conf(struct nullb_device *dev) ^~~~~~~~~~~~~~~~~~The commit message explains on how to reproduce the bug, with my
CONFIG(CONFIG_BLK_DEV_NULL_BLK enabled)I am unable to reproduce this bug on 4.14.315. So I think we can drop this patch from 4.14.y release as it introduces the above warning.Commit
5c4bd1f40c23dis not present on 4.14.y, which changes the return type of this.
Quoted 7 lines
Given that the bug mentioned in the commit message is not reproducible on 4.14.y, I think we can drop this patch instead of taking a prerequisite(5c4bd1f40c23d).
Note: I don't see this patch being queued up for 5.4.y.
[Thanks to Vegard for helping with this.]
Thanks, I've dropped it now!
greg k-h
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.316 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 30 May 2023 19:08:13 +0000. Anything received after that time might be too late.
No problems seen on aarch64.
Other than a build warning reported here:
https://lore.kernel.org/stable/2023052919-jingle-pang-082f@gregkh/
Thanks,
Harshit
Quoted 10 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.316-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.316 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 30 May 2023 19:08:13 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.316-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.14:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
32 tests: 32 pass, 0 failLinux version: 4.14.316-rc1-g102232d7564c
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Jon
Hi!
Quoted 7 lines
This is the start of the stable review cycle for the 4.14.316 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Chaitanya Kulkarni <[email protected]>
null_blk: Always check queue mode setting from configfs
This one is in 4.14 and 5.10, but not in 4.19.
Quoted 2 lines
Alain Volmat <[email protected]>
phy: st: miphy28lp: use_poll_timeoutfunctions for waits
This is just a cleanup, we don't really need it in stable.
Quoted 2 lines
Arnd Bergmann <[email protected]>
clk: tegra20: fix gcc-7 constant overflow warning
Something went wrong here:
#define OSC_FREQ_DET_STATUS 0x5c
-#define OSC_FREQ_DET_BUSY (1<<31)
-#define OSC_FREQ_DET_CNT_MASK 0xFFFF
+#define OSC_FREQ_DET_BUSYu (1<<31)
+#define OSC_FREQ_DET_CNT_MASK 0xFFFFu
First, we don't really need u after hex constants. Second, we normally use upperspace U for this. Third, u should not really be appended to the constant name.
Quoted 2 lines
Vicki Pfau <[email protected]>
Input: xpad - add constants for GIP interface numbers
This is just a cleanup, we don't really need it in stable.
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Hello Greg,
Quoted 11 lines
From: Greg Kroah-Hartman <[email protected]>
Sent: Sunday, May 28, 2023 8:10 PMThis is the start of the stable review cycle for the 4.14.316 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 30 May 2023 19:08:13 +0000. Anything received after that time might be too late.
CIP configurations built and booted with Linux 4.14.316-rc1 (102232d7564c):
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/881424998
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/commits/linux-4.14.y
Kind regards, Chris