1. 15 Nov, 2015 5 commits
    • Martin KaFai Lau's avatar
      ipv6: Check rt->dst.from for the DST_NOCACHE route · 02bcf4e0
      Martin KaFai Lau authored
      All DST_NOCACHE rt6_info used to have rt->dst.from set to
      its parent.
      
      After commit 8e3d5be7 ("ipv6: Avoid double dst_free"),
      DST_NOCACHE is also set to rt6_info which does not have
      a parent (i.e. rt->dst.from is NULL).
      
      This patch catches the rt->dst.from == NULL case.
      
      Fixes: 8e3d5be7 ("ipv6: Avoid double dst_free")
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      02bcf4e0
    • Martin KaFai Lau's avatar
      ipv6: Check expire on DST_NOCACHE route · 5973fb1e
      Martin KaFai Lau authored
      Since the expires of the DST_NOCACHE rt can be set during
      the ip6_rt_update_pmtu(), we also need to consider the expires
      value when doing ip6_dst_check().
      
      This patches creates __rt6_check_expired() to only
      check the expire value (if one exists) of the current rt.
      
      In rt6_dst_from_check(), it adds __rt6_check_expired() as
      one of the condition check.
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5973fb1e
    • Martin KaFai Lau's avatar
      ipv6: Avoid creating RTF_CACHE from a rt that is not managed by fib6 tree · 0d3f6d29
      Martin KaFai Lau authored
      The original bug report:
      https://bugzilla.redhat.com/show_bug.cgi?id=1272571
      
      The setup has a IPv4 GRE tunnel running in a IPSec.  The bug
      happens when ndisc starts sending router solicitation at the gre
      interface.  The simplified oops stack is like:
      
      __lock_acquire+0x1b2/0x1c30
      lock_acquire+0xb9/0x140
      _raw_write_lock_bh+0x3f/0x50
      __ip6_ins_rt+0x2e/0x60
      ip6_ins_rt+0x49/0x50
      ~~~~~~~~
      __ip6_rt_update_pmtu.part.54+0x145/0x250
      ip6_rt_update_pmtu+0x2e/0x40
      ~~~~~~~~
      ip_tunnel_xmit+0x1f1/0xf40
      __gre_xmit+0x7a/0x90
      ipgre_xmit+0x15a/0x220
      dev_hard_start_xmit+0x2bd/0x480
      __dev_queue_xmit+0x696/0x730
      dev_queue_xmit+0x10/0x20
      neigh_direct_output+0x11/0x20
      ip6_finish_output2+0x21f/0x770
      ip6_finish_output+0xa7/0x1d0
      ip6_output+0x56/0x190
      ~~~~~~~~
      ndisc_send_skb+0x1d9/0x400
      ndisc_send_rs+0x88/0xc0
      ~~~~~~~~
      
      The rt passed to ip6_rt_update_pmtu() is created by
      icmp6_dst_alloc() and it is not managed by the fib6 tree,
      so its rt6i_table == NULL.  When __ip6_rt_update_pmtu() creates
      a RTF_CACHE clone, the newly created clone also has rt6i_table == NULL
      and it causes the ip6_ins_rt() oops.
      
      During pmtu update, we only want to create a RTF_CACHE clone
      from a rt which is currently managed (or owned) by the
      fib6 tree.  It means either rt->rt6i_node != NULL or
      rt is a RTF_PCPU clone.
      
      It is worth to note that rt6i_table may not be NULL even it is
      not (yet) managed by the fib6 tree (e.g. addrconf_dst_alloc()).
      Hence, rt6i_node is a better check instead of rt6i_table.
      
      Fixes: 45e4fd26 ("ipv6: Only create RTF_CACHE routes after encountering pmtu")
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Reported-by: default avatarChris Siebenmann <cks-rhbugzilla@cs.toronto.edu>
      Cc: Chris Siebenmann <cks-rhbugzilla@cs.toronto.edu>
      Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0d3f6d29
    • Colin Ian King's avatar
      fjes: fix inconsistent indenting · 9001d94d
      Colin Ian King authored
      minor change, indenting is one tab out.
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarTaku Izumi <izumi.taku@jp.fujitsu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9001d94d
    • Hannes Frederic Sowa's avatar
      af-unix: fix use-after-free with concurrent readers while splicing · 73ed5d25
      Hannes Frederic Sowa authored
      During splicing an af-unix socket to a pipe we have to drop all
      af-unix socket locks. While doing so we allow another reader to enter
      unix_stream_read_generic which can read, copy and finally free another
      skb. If exactly this skb is just in process of being spliced we get a
      use-after-free report by kasan.
      
      First, we must make sure to not have a free while the skb is used during
      the splice operation. We simply increment its use counter before unlocking
      the reader lock.
      
      Stream sockets have the nice characteristic that we don't care about
      zero length writes and they never reach the peer socket's queue. That
      said, we can take the UNIXCB.consumed field as the indicator if the
      skb was already freed from the socket's receive queue. If the skb was
      fully consumed after we locked the reader side again we know it has been
      dropped by a second reader. We indicate a short read to user space and
      abort the current splice operation.
      
      This bug has been found with syzkaller
      (http://github.com/google/syzkaller) by Dmitry Vyukov.
      
      Fixes: 2b514574 ("net: af_unix: implement splice for stream af_unix sockets")
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: Eric Dumazet <eric.dumazet@gmail.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      73ed5d25
  2. 12 Nov, 2015 3 commits
    • Arnd Bergmann's avatar
      stmmac: avoid ipq806x constant overflow warning · 49e4a229
      Arnd Bergmann authored
      Building dwmac-ipq806x on a 64-bit architecture produces a harmless
      warning from gcc:
      
      stmmac/dwmac-ipq806x.c: In function 'ipq806x_gmac_probe':
      include/linux/bitops.h:6:19: warning: overflow in implicit constant conversion [-Woverflow]
        val = QSGMII_PHY_CDR_EN |
      stmmac/dwmac-ipq806x.c:333:8: note: in expansion of macro 'QSGMII_PHY_CDR_EN'
       #define QSGMII_PHY_CDR_EN   BIT(0)
       #define BIT(nr)   (1UL << (nr))
      
      This is a result of the type conversion rules in C, when we take the
      logical OR of multiple different types. In particular, we have
      and unsigned long
      
      	QSGMII_PHY_CDR_EN == BIT(0) == (1ul << 0) == 0x0000000000000001ul
      
      and a signed int
      
      	0xC << QSGMII_PHY_TX_DRV_AMP_OFFSET == 0xc0000000
      
      which together gives a signed long value
      
      	0xffffffffc0000001l
      
      and when this is passed into a function that takes an unsigned int type,
      gcc warns about the signed overflow and the loss of the upper 32-bits that
      are all ones.
      
      This patch adds 'ul' type modifiers to the literal numbers passed in
      here, so now the expression remains an 'unsigned long' with the upper
      bits all zero, and that avoids the signed overflow and the warning.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Fixes: b1c17215 ("stmmac: add ipq806x glue layer")
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      49e4a229
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · 382a483e
      David S. Miller authored
      Pablo Neira Ayuso:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for your net tree. This
      large batch that includes fixes for ipset, netfilter ingress, nf_tables
      dynamic set instantiation and a longstanding Kconfig dependency problem.
      More specifically, they are:
      
      1) Add missing check for empty hook list at the ingress hook, from
         Florian Westphal.
      
      2) Input and output interface are swapped at the ingress hook,
         reported by Patrick McHardy.
      
      3) Resolve ipset extension alignment issues on ARM, patch from Jozsef
         Kadlecsik.
      
      4) Fix bit check on bitmap in ipset hash type, also from Jozsef.
      
      5) Release buckets when all entries have expired in ipset hash type,
         again from Jozsef.
      
      6) Oneliner to initialize conntrack tuple object in the PPTP helper,
         otherwise the conntrack lookup may fail due to random bits in the
         structure holes, patch from Anthony Lineham.
      
      7) Silence a bogus gcc warning in nfnetlink_log, from Arnd Bergmann.
      
      8) Fix Kconfig dependency problems with TPROXY, socket and dup, also
         from Arnd.
      
      9) Add __netdev_alloc_pcpu_stats() to allow creating percpu counters
         from atomic context, this is required by the follow up fix for
         nf_tables.
      
      10) Fix crash from the dynamic set expression, we have to add new clone
          operation that should be defined when a simple memcpy is not enough.
          This resolves a crash when using per-cpu counters with new Patrick
          McHardy's flow table nft support.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      382a483e
    • françois romieu's avatar
      r8169: fix kasan reported skb use-after-free. · 39174291
      françois romieu authored
      Signed-off-by: default avatarFrancois Romieu <romieu@fr.zoreil.com>
      Reported-by: default avatarDave Jones <davej@codemonkey.org.uk>
      Fixes: d7d2d89d ("r8169: Add software counter for multicast packages")
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarCorinna Vinschen <vinschen@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      39174291
  3. 11 Nov, 2015 30 commits
  4. 10 Nov, 2015 2 commits
    • Linus Torvalds's avatar
      Merge tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 52e9a333
      Linus Torvalds authored
      Pull ARM SoC defconfig updates from Olof Johansson:
       "Defconfig updates are kept separate from other branches mostly to
        avoid conflicts between the different categories (driver branch
        enabling something that has context conflict with SoC options, etc).
      
        A lot of this again is scattered across the various hardware
        platforms.  multi_v7_defconfig, our "generic" config for most 32-bit
        platforms has been gone through by Marvell Berlin maintainers and
        added most options they need to run on their hardware.  Broadcom NSP
        is also added there, and the new Atmel SAMA5D2 (added last release).
        Rockchip also has display and other devices supported in that config.
      
        In addition to that, the usual small churn of new options being added
        here and there"
      
      * tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (45 commits)
        ARM: multi_v7_defconfig: enable UniPhier I2C drivers
        ARM: multi_v7_defconfig: Enable rtl8152 ethernet driver for Odroid-XU4
        ARM: exynos_defconfig: Enable rtl8152 ethernet driver for Odroid-XU4
        ARM: exynos_defconfig: Enable WiFi-Ex as a module instead built-in
        ARM: exynos_defconfig: Disable simplefb support
        ARM: exynos_defconfig: Enable LEDS for Odroid-XU3/XU4
        ARM: multi_v7_defconfig: Enable DWC2 USB driver and USB ethernet gadget
        ARM: exynos_defconfig: Enable DWC2 USB driver and USB ethernet gadget
        ARM: exynos_defconfig: Enable USB Video Class support
        ARM: multi_v7_defconfig: improve multi_v7_defconfig support for Berlin
        ARM: tegra: Update multi_v7_defconfig
        ARM: multi_v7_defconfig: Add Atmel SDHCI device
        ARM: multi_v7_defconfig: Add Atmel Flexcom device
        ARM: multi_v7_defconfig: Add Atmel SAMA5D2 SoC
        ARM: at91/defconfig: add sama5d2 and its new devices to sama5 defconfig
        ARM: at91/defconfig: update at91_dt defconfig
        ARM: at91/defconfig: update sama5 defconfig
        ARM: configs: Enable FIXED_PHY in multi_v7 defconfig
        ARM: configs: update lpc18xx defconfig
        ARM: socfpga_defconfig: enable fpga manager
        ...
      52e9a333
    • Linus Torvalds's avatar
      Merge tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · c0d6fe2f
      Linus Torvalds authored
      Pull ARM DT updates from Olof Johansson:
       "As usual, this is the massive branch we have for each release.  Lots
        of various updates and additions of hardware descriptions on existing
        hardware, as well as the usual additions of new boards and SoCs.
      
        This is also the first release where we've started mixing 64- and
        32-bit DT updates in one branch.
      
        (Specific details on what's actually here and new is pretty easy to
        tell from the diffstat, so there's little point in duplicating listing
        it here)"
      
      * tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (499 commits)
        ARM: dts: uniphier: add system-bus-controller nodes
        ARM64: juno: disable NOR flash node by default
        ARM: dts: uniphier: add outer cache controller nodes
        arm64: defconfig: Enable PCI generic host bridge by default
        arm64: Juno: Add support for the PCIe host bridge on Juno R1
        Documentation: of: Document the bindings used by Juno R1 PCIe host bridge
        ARM: dts: uniphier: add I2C aliases for ProXstream2 boards
        dts/Makefile: Add build support for LS2080a QDS & RDB board DTS
        dts/ls2080a: Add DTS support for LS2080a QDS & RDB boards
        dts/ls2080a: Update Simulator DTS to add support of various peripherals
        dts/ls2080a: Remove text about writing to Free Software Foundation
        dts/ls2080a: Update DTSI to add support of various peripherals
        doc: DTS: Update DWC3 binding to provide reference to generic bindings
        doc/bindings: Update GPIO devicetree binding documentation for LS2080A
        Documentation/dts: Move FSL board-specific bindings out of /powerpc
        Documentation: DT: Add entry for FSL LS2080A QDS and RDB boards
        arm64: Rename FSL LS2085A SoC support code to LS2080A
        arm64: Use generic Layerscape SoC family naming
        ARM: dts: uniphier: add ProXstream2 Vodka board support
        ARM: dts: uniphier: add ProXstream2 Gentil board support
        ...
      c0d6fe2f