1. 16 Jan, 2019 15 commits
    • Willem de Bruijn's avatar
      tcp: allow MSG_ZEROCOPY transmission also in CLOSE_WAIT state · 13d7f463
      Willem de Bruijn authored
      TCP transmission with MSG_ZEROCOPY fails if the peer closes its end of
      the connection and so transitions this socket to CLOSE_WAIT state.
      
      Transmission in close wait state is acceptable. Other similar tests in
      the stack (e.g., in FastOpen) accept both states. Relax this test, too.
      
      Link: https://www.mail-archive.com/netdev@vger.kernel.org/msg276886.html
      Link: https://www.mail-archive.com/netdev@vger.kernel.org/msg227390.html
      Fixes: f214f915 ("tcp: enable MSG_ZEROCOPY")
      Reported-by: default avatarMarek Majkowski <marek@cloudflare.com>
      Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
      CC: Yuchung Cheng <ycheng@google.com>
      CC: Neal Cardwell <ncardwell@google.com>
      CC: Soheil Hassas Yeganeh <soheil@google.com>
      CC: Alexey Kodanev <alexey.kodanev@oracle.com>
      Acked-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      13d7f463
    • Heiner Kallweit's avatar
      net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ9031 · 1d16073a
      Heiner Kallweit authored
      So far genphy_soft_reset was used automatically if the PHY driver
      didn't implement the soft_reset callback. This changed with the
      mentioned commit and broke KSZ9031. To fix this configure the
      KSZ9031 PHY driver to use genphy_soft_reset.
      
      Fixes: 6e2d85ec ("net: phy: Stop with excessive soft reset")
      Reported-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
      Tested-by: default avatarTony Lindgren <tony@atomide.com>
      Tested-by: default avatarSekhar Nori <nsekhar@ti.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1d16073a
    • Davide Caratti's avatar
      net/sched: act_tunnel_key: fix memory leak in case of action replace · 9174c3df
      Davide Caratti authored
      running the following TDC test cases:
      
       7afc - Replace tunnel_key set action with all parameters
       364d - Replace tunnel_key set action with all parameters and cookie
      
      it's possible to trigger kmemleak warnings like:
      
        unreferenced object 0xffff94797127ab40 (size 192):
        comm "tc", pid 3248, jiffies 4300565293 (age 1006.862s)
        hex dump (first 32 bytes):
          00 00 00 00 00 00 00 00 c0 93 f9 8a ff ff ff ff  ................
          41 84 ee 89 ff ff ff ff 00 00 00 00 00 00 00 00  A...............
        backtrace:
          [<000000001e85b61c>] tunnel_key_init+0x31d/0x820 [act_tunnel_key]
          [<000000007f3f6ee7>] tcf_action_init_1+0x384/0x4c0
          [<00000000e89e3ded>] tcf_action_init+0x12b/0x1a0
          [<00000000c1c8c0f8>] tcf_action_add+0x73/0x170
          [<0000000095a9fc28>] tc_ctl_action+0x122/0x160
          [<000000004bebeac5>] rtnetlink_rcv_msg+0x263/0x2d0
          [<000000009fd862dd>] netlink_rcv_skb+0x4a/0x110
          [<00000000b55199e7>] netlink_unicast+0x1a0/0x250
          [<000000004996cd21>] netlink_sendmsg+0x2c1/0x3c0
          [<000000004d6a94b4>] sock_sendmsg+0x36/0x40
          [<000000005d9f0208>] ___sys_sendmsg+0x280/0x2f0
          [<00000000dec19023>] __sys_sendmsg+0x5e/0xa0
          [<000000004b82ac81>] do_syscall_64+0x5b/0x180
          [<00000000a0f1209a>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
          [<000000002926b2ab>] 0xffffffffffffffff
      
      when the tunnel_key action is replaced, the kernel forgets to release the
      dst metadata: ensure they are released by tunnel_key_init(), the same way
      it's done in tunnel_key_release().
      
      Fixes: d0f6dd8a ("net/sched: Introduce act_tunnel_key")
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9174c3df
    • David Howells's avatar
      Revert "rxrpc: Allow failed client calls to be retried" · e122d845
      David Howells authored
      The changes introduced to allow rxrpc calls to be retried creates an issue
      when it comes to refcounting afs_call structs.  The problem is that when
      rxrpc_send_data() queues the last packet for an asynchronous call, the
      following sequence can occur:
      
       (1) The notify_end_tx callback is invoked which causes the state in the
           afs_call to be changed from AFS_CALL_CL_REQUESTING or
           AFS_CALL_SV_REPLYING.
      
       (2) afs_deliver_to_call() can then process event notifications from rxrpc
           on the async_work queue.
      
       (3) Delivery of events, such as an abort from the server, can cause the
           afs_call state to be changed to AFS_CALL_COMPLETE on async_work.
      
       (4) For an asynchronous call, afs_process_async_call() notes that the call
           is complete and tried to clean up all the refs on async_work.
      
       (5) rxrpc_send_data() might return the amount of data transferred
           (success) or an error - which could in turn reflect a local error or a
           received error.
      
      Synchronising the clean up after rxrpc_kernel_send_data() returns an error
      with the asynchronous cleanup is then tricky to get right.
      
      Mostly revert commit c038a58c.  The two API
      functions the original commit added aren't currently used.  This makes
      rxrpc_kernel_send_data() always return successfully if it queued the data
      it was given.
      
      Note that this doesn't affect synchronous calls since their Rx notification
      function merely pokes a wait queue and does not refcounting.  The
      asynchronous call notification function *has* to do refcounting and pass a
      ref over the work item to avoid the need to sync the workqueue in call
      cleanup.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e122d845
    • David S. Miller's avatar
      Merge branch 'tipc-uninit-values' · 70a44f9f
      David S. Miller authored
      Ying Xue says:
      
      ====================
      tipc: fix uninit-value issues reported by syzbot
      
      Recently, syzbot complained that TIPC module exits several issues
      associated with uninit-value type. So, in this series, we try to
      fix them as many as possible.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      70a44f9f
    • Ying Xue's avatar
      tipc: fix uninit-value in tipc_nl_compat_doit · 2753ca5d
      Ying Xue authored
      BUG: KMSAN: uninit-value in tipc_nl_compat_doit+0x404/0xa10 net/tipc/netlink_compat.c:335
      CPU: 0 PID: 4514 Comm: syz-executor485 Not tainted 4.16.0+ #87
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:17 [inline]
       dump_stack+0x185/0x1d0 lib/dump_stack.c:53
       kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
       __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
       tipc_nl_compat_doit+0x404/0xa10 net/tipc/netlink_compat.c:335
       tipc_nl_compat_recv+0x164b/0x2700 net/tipc/netlink_compat.c:1153
       genl_family_rcv_msg net/netlink/genetlink.c:599 [inline]
       genl_rcv_msg+0x1686/0x1810 net/netlink/genetlink.c:624
       netlink_rcv_skb+0x378/0x600 net/netlink/af_netlink.c:2447
       genl_rcv+0x63/0x80 net/netlink/genetlink.c:635
       netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
       netlink_unicast+0x166b/0x1740 net/netlink/af_netlink.c:1337
       netlink_sendmsg+0x1048/0x1310 net/netlink/af_netlink.c:1900
       sock_sendmsg_nosec net/socket.c:630 [inline]
       sock_sendmsg net/socket.c:640 [inline]
       ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046
       __sys_sendmsg net/socket.c:2080 [inline]
       SYSC_sendmsg+0x2a3/0x3d0 net/socket.c:2091
       SyS_sendmsg+0x54/0x80 net/socket.c:2087
       do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
       entry_SYSCALL_64_after_hwframe+0x3d/0xa2
      RIP: 0033:0x43fda9
      RSP: 002b:00007ffd0c184ba8 EFLAGS: 00000213 ORIG_RAX: 000000000000002e
      RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fda9
      RDX: 0000000000000000 RSI: 0000000020023000 RDI: 0000000000000003
      RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8
      R10: 00000000004002c8 R11: 0000000000000213 R12: 00000000004016d0
      R13: 0000000000401760 R14: 0000000000000000 R15: 0000000000000000
      
      Uninit was created at:
       kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
       kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188
       kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314
       kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321
       slab_post_alloc_hook mm/slab.h:445 [inline]
       slab_alloc_node mm/slub.c:2737 [inline]
       __kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369
       __kmalloc_reserve net/core/skbuff.c:138 [inline]
       __alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206
       alloc_skb include/linux/skbuff.h:984 [inline]
       netlink_alloc_large_skb net/netlink/af_netlink.c:1183 [inline]
       netlink_sendmsg+0x9a6/0x1310 net/netlink/af_netlink.c:1875
       sock_sendmsg_nosec net/socket.c:630 [inline]
       sock_sendmsg net/socket.c:640 [inline]
       ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046
       __sys_sendmsg net/socket.c:2080 [inline]
       SYSC_sendmsg+0x2a3/0x3d0 net/socket.c:2091
       SyS_sendmsg+0x54/0x80 net/socket.c:2087
       do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
       entry_SYSCALL_64_after_hwframe+0x3d/0xa2
      
      In tipc_nl_compat_recv(), when the len variable returned by
      nlmsg_attrlen() is 0, the message is still treated as a valid one,
      which is obviously unresonable. When len is zero, it means the
      message not only doesn't contain any valid TLV payload, but also
      TLV header is not included. Under this stituation, tlv_type field
      in TLV header is still accessed in tipc_nl_compat_dumpit() or
      tipc_nl_compat_doit(), but the field space is obviously illegal.
      Of course, it is not initialized.
      
      Reported-by: syzbot+bca0dc46634781f08b38@syzkaller.appspotmail.com
      Reported-by: syzbot+6bdb590321a7ae40c1a6@syzkaller.appspotmail.com
      Signed-off-by: default avatarYing Xue <ying.xue@windriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2753ca5d
    • Ying Xue's avatar
      tipc: fix uninit-value in tipc_nl_compat_name_table_dump · 974cb0e3
      Ying Xue authored
      syzbot reported:
      
      BUG: KMSAN: uninit-value in __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline]
      BUG: KMSAN: uninit-value in __fswab32 include/uapi/linux/swab.h:59 [inline]
      BUG: KMSAN: uninit-value in tipc_nl_compat_name_table_dump+0x4a8/0xba0 net/tipc/netlink_compat.c:826
      CPU: 0 PID: 6290 Comm: syz-executor848 Not tainted 4.19.0-rc8+ #70
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x306/0x460 lib/dump_stack.c:113
       kmsan_report+0x1a2/0x2e0 mm/kmsan/kmsan.c:917
       __msan_warning+0x7c/0xe0 mm/kmsan/kmsan_instr.c:500
       __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline]
       __fswab32 include/uapi/linux/swab.h:59 [inline]
       tipc_nl_compat_name_table_dump+0x4a8/0xba0 net/tipc/netlink_compat.c:826
       __tipc_nl_compat_dumpit+0x59e/0xdb0 net/tipc/netlink_compat.c:205
       tipc_nl_compat_dumpit+0x63a/0x820 net/tipc/netlink_compat.c:270
       tipc_nl_compat_handle net/tipc/netlink_compat.c:1151 [inline]
       tipc_nl_compat_recv+0x1402/0x2760 net/tipc/netlink_compat.c:1210
       genl_family_rcv_msg net/netlink/genetlink.c:601 [inline]
       genl_rcv_msg+0x185c/0x1a20 net/netlink/genetlink.c:626
       netlink_rcv_skb+0x394/0x640 net/netlink/af_netlink.c:2454
       genl_rcv+0x63/0x80 net/netlink/genetlink.c:637
       netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
       netlink_unicast+0x166d/0x1720 net/netlink/af_netlink.c:1343
       netlink_sendmsg+0x1391/0x1420 net/netlink/af_netlink.c:1908
       sock_sendmsg_nosec net/socket.c:621 [inline]
       sock_sendmsg net/socket.c:631 [inline]
       ___sys_sendmsg+0xe47/0x1200 net/socket.c:2116
       __sys_sendmsg net/socket.c:2154 [inline]
       __do_sys_sendmsg net/socket.c:2163 [inline]
       __se_sys_sendmsg+0x307/0x460 net/socket.c:2161
       __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161
       do_syscall_64+0xbe/0x100 arch/x86/entry/common.c:291
       entry_SYSCALL_64_after_hwframe+0x63/0xe7
      RIP: 0033:0x440179
      Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
      RSP: 002b:00007ffecec49318 EFLAGS: 00000213 ORIG_RAX: 000000000000002e
      RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440179
      RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003
      RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8
      R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000401a00
      R13: 0000000000401a90 R14: 0000000000000000 R15: 0000000000000000
      
      Uninit was created at:
       kmsan_save_stack_with_flags mm/kmsan/kmsan.c:255 [inline]
       kmsan_internal_poison_shadow+0xc8/0x1d0 mm/kmsan/kmsan.c:180
       kmsan_kmalloc+0xa4/0x120 mm/kmsan/kmsan_hooks.c:104
       kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan_hooks.c:113
       slab_post_alloc_hook mm/slab.h:446 [inline]
       slab_alloc_node mm/slub.c:2727 [inline]
       __kmalloc_node_track_caller+0xb43/0x1400 mm/slub.c:4360
       __kmalloc_reserve net/core/skbuff.c:138 [inline]
       __alloc_skb+0x422/0xe90 net/core/skbuff.c:206
       alloc_skb include/linux/skbuff.h:996 [inline]
       netlink_alloc_large_skb net/netlink/af_netlink.c:1189 [inline]
       netlink_sendmsg+0xcaf/0x1420 net/netlink/af_netlink.c:1883
       sock_sendmsg_nosec net/socket.c:621 [inline]
       sock_sendmsg net/socket.c:631 [inline]
       ___sys_sendmsg+0xe47/0x1200 net/socket.c:2116
       __sys_sendmsg net/socket.c:2154 [inline]
       __do_sys_sendmsg net/socket.c:2163 [inline]
       __se_sys_sendmsg+0x307/0x460 net/socket.c:2161
       __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161
       do_syscall_64+0xbe/0x100 arch/x86/entry/common.c:291
       entry_SYSCALL_64_after_hwframe+0x63/0xe7
      
      We cannot take for granted the thing that the length of data contained
      in TLV is longer than the size of struct tipc_name_table_query in
      tipc_nl_compat_name_table_dump().
      
      Reported-by: syzbot+06e771a754829716a327@syzkaller.appspotmail.com
      Signed-off-by: default avatarYing Xue <ying.xue@windriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      974cb0e3
    • Ying Xue's avatar
      tipc: fix uninit-value in tipc_nl_compat_link_set · edf5ff04
      Ying Xue authored
      syzbot reports following splat:
      
      BUG: KMSAN: uninit-value in strlen+0x3b/0xa0 lib/string.c:486
      CPU: 1 PID: 9306 Comm: syz-executor172 Not tainted 4.20.0-rc7+ #2
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
      Google 01/01/2011
      Call Trace:
        __dump_stack lib/dump_stack.c:77 [inline]
        dump_stack+0x173/0x1d0 lib/dump_stack.c:113
        kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613
        __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:313
        strlen+0x3b/0xa0 lib/string.c:486
        nla_put_string include/net/netlink.h:1154 [inline]
        __tipc_nl_compat_link_set net/tipc/netlink_compat.c:708 [inline]
        tipc_nl_compat_link_set+0x929/0x1220 net/tipc/netlink_compat.c:744
        __tipc_nl_compat_doit net/tipc/netlink_compat.c:311 [inline]
        tipc_nl_compat_doit+0x3aa/0xaf0 net/tipc/netlink_compat.c:344
        tipc_nl_compat_handle net/tipc/netlink_compat.c:1107 [inline]
        tipc_nl_compat_recv+0x14d7/0x2760 net/tipc/netlink_compat.c:1210
        genl_family_rcv_msg net/netlink/genetlink.c:601 [inline]
        genl_rcv_msg+0x185f/0x1a60 net/netlink/genetlink.c:626
        netlink_rcv_skb+0x444/0x640 net/netlink/af_netlink.c:2477
        genl_rcv+0x63/0x80 net/netlink/genetlink.c:637
        netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
        netlink_unicast+0xf40/0x1020 net/netlink/af_netlink.c:1336
        netlink_sendmsg+0x127f/0x1300 net/netlink/af_netlink.c:1917
        sock_sendmsg_nosec net/socket.c:621 [inline]
        sock_sendmsg net/socket.c:631 [inline]
        ___sys_sendmsg+0xdb9/0x11b0 net/socket.c:2116
        __sys_sendmsg net/socket.c:2154 [inline]
        __do_sys_sendmsg net/socket.c:2163 [inline]
        __se_sys_sendmsg+0x305/0x460 net/socket.c:2161
        __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161
        do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
        entry_SYSCALL_64_after_hwframe+0x63/0xe7
      
      The uninitialised access happened in
          nla_put_string(skb, TIPC_NLA_LINK_NAME, lc->name)
      
      This is because lc->name string is not validated before it's used.
      
      Reported-by: syzbot+d78b8a29241a195aefb8@syzkaller.appspotmail.com
      Signed-off-by: default avatarYing Xue <ying.xue@windriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      edf5ff04
    • Ying Xue's avatar
      tipc: fix uninit-value in tipc_nl_compat_bearer_enable · 0762216c
      Ying Xue authored
      syzbot reported:
      
      BUG: KMSAN: uninit-value in strlen+0x3b/0xa0 lib/string.c:484
      CPU: 1 PID: 6371 Comm: syz-executor652 Not tainted 4.19.0-rc8+ #70
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x306/0x460 lib/dump_stack.c:113
       kmsan_report+0x1a2/0x2e0 mm/kmsan/kmsan.c:917
       __msan_warning+0x7c/0xe0 mm/kmsan/kmsan_instr.c:500
       strlen+0x3b/0xa0 lib/string.c:484
       nla_put_string include/net/netlink.h:1011 [inline]
       tipc_nl_compat_bearer_enable+0x238/0x7b0 net/tipc/netlink_compat.c:389
       __tipc_nl_compat_doit net/tipc/netlink_compat.c:311 [inline]
       tipc_nl_compat_doit+0x39f/0xae0 net/tipc/netlink_compat.c:344
       tipc_nl_compat_recv+0x147c/0x2760 net/tipc/netlink_compat.c:1107
       genl_family_rcv_msg net/netlink/genetlink.c:601 [inline]
       genl_rcv_msg+0x185c/0x1a20 net/netlink/genetlink.c:626
       netlink_rcv_skb+0x394/0x640 net/netlink/af_netlink.c:2454
       genl_rcv+0x63/0x80 net/netlink/genetlink.c:637
       netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
       netlink_unicast+0x166d/0x1720 net/netlink/af_netlink.c:1343
       netlink_sendmsg+0x1391/0x1420 net/netlink/af_netlink.c:1908
       sock_sendmsg_nosec net/socket.c:621 [inline]
       sock_sendmsg net/socket.c:631 [inline]
       ___sys_sendmsg+0xe47/0x1200 net/socket.c:2116
       __sys_sendmsg net/socket.c:2154 [inline]
       __do_sys_sendmsg net/socket.c:2163 [inline]
       __se_sys_sendmsg+0x307/0x460 net/socket.c:2161
       __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161
       do_syscall_64+0xbe/0x100 arch/x86/entry/common.c:291
       entry_SYSCALL_64_after_hwframe+0x63/0xe7
      RIP: 0033:0x440179
      Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
      RSP: 002b:00007fffef7beee8 EFLAGS: 00000213 ORIG_RAX: 000000000000002e
      RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440179
      RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003
      RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8
      R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000401a00
      R13: 0000000000401a90 R14: 0000000000000000 R15: 0000000000000000
      
      Uninit was created at:
       kmsan_save_stack_with_flags mm/kmsan/kmsan.c:255 [inline]
       kmsan_internal_poison_shadow+0xc8/0x1d0 mm/kmsan/kmsan.c:180
       kmsan_kmalloc+0xa4/0x120 mm/kmsan/kmsan_hooks.c:104
       kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan_hooks.c:113
       slab_post_alloc_hook mm/slab.h:446 [inline]
       slab_alloc_node mm/slub.c:2727 [inline]
       __kmalloc_node_track_caller+0xb43/0x1400 mm/slub.c:4360
       __kmalloc_reserve net/core/skbuff.c:138 [inline]
       __alloc_skb+0x422/0xe90 net/core/skbuff.c:206
       alloc_skb include/linux/skbuff.h:996 [inline]
       netlink_alloc_large_skb net/netlink/af_netlink.c:1189 [inline]
       netlink_sendmsg+0xcaf/0x1420 net/netlink/af_netlink.c:1883
       sock_sendmsg_nosec net/socket.c:621 [inline]
       sock_sendmsg net/socket.c:631 [inline]
       ___sys_sendmsg+0xe47/0x1200 net/socket.c:2116
       __sys_sendmsg net/socket.c:2154 [inline]
       __do_sys_sendmsg net/socket.c:2163 [inline]
       __se_sys_sendmsg+0x307/0x460 net/socket.c:2161
       __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161
       do_syscall_64+0xbe/0x100 arch/x86/entry/common.c:291
       entry_SYSCALL_64_after_hwframe+0x63/0xe7
      
      The root cause is that we don't validate whether bear name is a valid
      string in tipc_nl_compat_bearer_enable().
      
      Meanwhile, we also fix the same issue in the following functions:
      tipc_nl_compat_bearer_disable()
      tipc_nl_compat_link_stat_dump()
      tipc_nl_compat_media_set()
      tipc_nl_compat_bearer_set()
      
      Reported-by: syzbot+b33d5cae0efd35dbfe77@syzkaller.appspotmail.com
      Signed-off-by: default avatarYing Xue <ying.xue@windriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0762216c
    • Ying Xue's avatar
      tipc: fix uninit-value in tipc_nl_compat_link_reset_stats · 8b66fee7
      Ying Xue authored
      syzbot reports following splat:
      
      BUG: KMSAN: uninit-value in strlen+0x3b/0xa0 lib/string.c:486
      CPU: 1 PID: 11057 Comm: syz-executor0 Not tainted 4.20.0-rc7+ #2
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x173/0x1d0 lib/dump_stack.c:113
       kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613
       __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:295
       strlen+0x3b/0xa0 lib/string.c:486
       nla_put_string include/net/netlink.h:1154 [inline]
       tipc_nl_compat_link_reset_stats+0x1f0/0x360 net/tipc/netlink_compat.c:760
       __tipc_nl_compat_doit net/tipc/netlink_compat.c:311 [inline]
       tipc_nl_compat_doit+0x3aa/0xaf0 net/tipc/netlink_compat.c:344
       tipc_nl_compat_handle net/tipc/netlink_compat.c:1107 [inline]
       tipc_nl_compat_recv+0x14d7/0x2760 net/tipc/netlink_compat.c:1210
       genl_family_rcv_msg net/netlink/genetlink.c:601 [inline]
       genl_rcv_msg+0x185f/0x1a60 net/netlink/genetlink.c:626
       netlink_rcv_skb+0x444/0x640 net/netlink/af_netlink.c:2477
       genl_rcv+0x63/0x80 net/netlink/genetlink.c:637
       netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
       netlink_unicast+0xf40/0x1020 net/netlink/af_netlink.c:1336
       netlink_sendmsg+0x127f/0x1300 net/netlink/af_netlink.c:1917
       sock_sendmsg_nosec net/socket.c:621 [inline]
       sock_sendmsg net/socket.c:631 [inline]
       ___sys_sendmsg+0xdb9/0x11b0 net/socket.c:2116
       __sys_sendmsg net/socket.c:2154 [inline]
       __do_sys_sendmsg net/socket.c:2163 [inline]
       __se_sys_sendmsg+0x305/0x460 net/socket.c:2161
       __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161
       do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
       entry_SYSCALL_64_after_hwframe+0x63/0xe7
      RIP: 0033:0x457ec9
      Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
      RSP: 002b:00007f2557338c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
      RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457ec9
      RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003
      RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 00007f25573396d4
      R13: 00000000004cb478 R14: 00000000004d86c8 R15: 00000000ffffffff
      
      Uninit was created at:
       kmsan_save_stack_with_flags mm/kmsan/kmsan.c:204 [inline]
       kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:158
       kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:176
       kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:185
       slab_post_alloc_hook mm/slab.h:446 [inline]
       slab_alloc_node mm/slub.c:2759 [inline]
       __kmalloc_node_track_caller+0xe18/0x1030 mm/slub.c:4383
       __kmalloc_reserve net/core/skbuff.c:137 [inline]
       __alloc_skb+0x309/0xa20 net/core/skbuff.c:205
       alloc_skb include/linux/skbuff.h:998 [inline]
       netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline]
       netlink_sendmsg+0xb82/0x1300 net/netlink/af_netlink.c:1892
       sock_sendmsg_nosec net/socket.c:621 [inline]
       sock_sendmsg net/socket.c:631 [inline]
       ___sys_sendmsg+0xdb9/0x11b0 net/socket.c:2116
       __sys_sendmsg net/socket.c:2154 [inline]
       __do_sys_sendmsg net/socket.c:2163 [inline]
       __se_sys_sendmsg+0x305/0x460 net/socket.c:2161
       __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161
       do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
       entry_SYSCALL_64_after_hwframe+0x63/0xe7
      
      The uninitialised access happened in tipc_nl_compat_link_reset_stats:
          nla_put_string(skb, TIPC_NLA_LINK_NAME, name)
      
      This is because name string is not validated before it's used.
      
      Reported-by: syzbot+e01d94b5a4c266be6e4c@syzkaller.appspotmail.com
      Signed-off-by: default avatarYing Xue <ying.xue@windriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8b66fee7
    • Ying Xue's avatar
      tipc: fix uninit-value in in tipc_conn_rcv_sub · a88289f4
      Ying Xue authored
      syzbot reported:
      
      BUG: KMSAN: uninit-value in tipc_conn_rcv_sub+0x184/0x950 net/tipc/topsrv.c:373
      CPU: 0 PID: 66 Comm: kworker/u4:4 Not tainted 4.17.0-rc3+ #88
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Workqueue: tipc_rcv tipc_conn_recv_work
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x185/0x1d0 lib/dump_stack.c:113
       kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
       __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
       tipc_conn_rcv_sub+0x184/0x950 net/tipc/topsrv.c:373
       tipc_conn_rcv_from_sock net/tipc/topsrv.c:409 [inline]
       tipc_conn_recv_work+0x3cd/0x560 net/tipc/topsrv.c:424
       process_one_work+0x12c6/0x1f60 kernel/workqueue.c:2145
       worker_thread+0x113c/0x24f0 kernel/workqueue.c:2279
       kthread+0x539/0x720 kernel/kthread.c:239
       ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:412
      
      Local variable description: ----s.i@tipc_conn_recv_work
      Variable was created at:
       tipc_conn_recv_work+0x65/0x560 net/tipc/topsrv.c:419
       process_one_work+0x12c6/0x1f60 kernel/workqueue.c:2145
      
      In tipc_conn_rcv_from_sock(), it always supposes the length of message
      received from sock_recvmsg() is not smaller than the size of struct
      tipc_subscr. However, this assumption is false. Especially when the
      length of received message is shorter than struct tipc_subscr size,
      we will end up touching uninitialized fields in tipc_conn_rcv_sub().
      
      Reported-by: syzbot+8951a3065ee7fd6d6e23@syzkaller.appspotmail.com
      Reported-by: syzbot+75e6e042c5bbf691fc82@syzkaller.appspotmail.com
      Signed-off-by: default avatarYing Xue <ying.xue@windriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a88289f4
    • David S. Miller's avatar
      Merge branch 'sch_cake-leaf-qdisc-fixes' · d62f38c2
      David S. Miller authored
      Toke Høiland-Jørgensen says:
      
      ====================
      sched: Fix qdisc interactions exposed by using sch_cake as a leaf qdisc
      
      This series fixes a couple of issues exposed by running sch_cake as a
      leaf qdisc in an HFSC tree, which were discovered and reported by Pete
      Heist. The interaction between CAKE's GSO splitting and the parent
      qdisc's notion of its own queue length could cause queue stalls. While
      investigating the report, I also noticed that several qdiscs would
      dereference the skb pointer after dequeue, which is potentially
      problematic since the GSO splitting code also frees the original skb.
      
      See the individual patches in the series for details.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d62f38c2
    • Toke Høiland-Jørgensen's avatar
      sch_cake: Correctly update parent qlen when splitting GSO packets · 8c6c37fd
      Toke Høiland-Jørgensen authored
      To ensure parent qdiscs have the same notion of the number of enqueued
      packets even after splitting a GSO packet, update the qdisc tree with the
      number of packets that was added due to the split.
      Reported-by: default avatarPete Heist <pete@heistp.net>
      Tested-by: default avatarPete Heist <pete@heistp.net>
      Signed-off-by: default avatarToke Høiland-Jørgensen <toke@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8c6c37fd
    • Toke Høiland-Jørgensen's avatar
      sched: Fix detection of empty queues in child qdiscs · 37d9cf1a
      Toke Høiland-Jørgensen authored
      Several qdiscs check on enqueue whether the packet was enqueued to a class
      with an empty queue, in which case the class is activated. This is done by
      checking if the qlen is exactly 1 after enqueue. However, if GSO splitting
      is enabled in the child qdisc, a single packet can result in a qlen longer
      than 1. This means the activation check fails, leading to a stalled queue.
      
      Fix this by checking if the queue is empty *before* enqueue, and running
      the activation logic if this was the case.
      Reported-by: default avatarPete Heist <pete@heistp.net>
      Signed-off-by: default avatarToke Høiland-Jørgensen <toke@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      37d9cf1a
    • Toke Høiland-Jørgensen's avatar
      sched: Avoid dereferencing skb pointer after child enqueue · f6bab199
      Toke Høiland-Jørgensen authored
      Parent qdiscs may dereference the pointer to the enqueued skb after
      enqueue. However, both CAKE and TBF call consume_skb() on the original skb
      when splitting GSO packets, leading to a potential use-after-free in the
      parent. Fix this by avoiding dereferencing the skb pointer after enqueueing
      to the child.
      Signed-off-by: default avatarToke Høiland-Jørgensen <toke@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f6bab199
  2. 15 Jan, 2019 11 commits
    • Hangbin Liu's avatar
      ip6_gre: update version related info when changing link · 80b3671e
      Hangbin Liu authored
      We forgot to update ip6erspan version related info when changing link,
      which will cause setting new hwid failed.
      Reported-by: default avatarJianlin Shi <jishi@redhat.com>
      Fixes: 94d7d8f2 ("ip6_gre: add erspan v2 support")
      Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      80b3671e
    • Heiner Kallweit's avatar
      net: phy: fix too strict check in phy_start_aneg · d9f903f6
      Heiner Kallweit authored
      When adding checks to detect wrong usage of the phylib API we added
      a check to phy_start_aneg() which is too strict. If the phylib
      state machine is in state PHY_HALTED we should allow reconfiguring
      and restarting aneg, and just don't touch the state.
      
      Fixes: 2b3e88ea ("net: phy: improve phy state checking")
      Reported-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Signed-off-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
      Tested-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d9f903f6
    • Jeff Kirsher's avatar
      Revert "igb: reduce CPU0 latency when updating statistics" · 5642e27b
      Jeff Kirsher authored
      This reverts commit 59361316.
      
      Due to problems found in additional testing, this causes an illegal
      context switch in the RCU read-side critical section.
      
      CC: Dave Jones <davej@codemonkey.org.uk>
      CC: Cong Wang <xiyou.wangcong@gmail.com>
      CC: Jan Jablonsky <jan.jablonsky@thalesgroup.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5642e27b
    • Dan Carpenter's avatar
      selftests/txtimestamp: Fix an equals vs assign bug · 5be99560
      Dan Carpenter authored
      This should be == instead of =.
      
      Fixes: b52354aa ("selftests: expand txtimestamp with ipv6 dgram + raw and pf_packet")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Acked-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5be99560
    • Ido Schimmel's avatar
      net: ipv4: Fix memory leak in network namespace dismantle · f97f4dd8
      Ido Schimmel authored
      IPv4 routing tables are flushed in two cases:
      
      1. In response to events in the netdev and inetaddr notification chains
      2. When a network namespace is being dismantled
      
      In both cases only routes associated with a dead nexthop group are
      flushed. However, a nexthop group will only be marked as dead in case it
      is populated with actual nexthops using a nexthop device. This is not
      the case when the route in question is an error route (e.g.,
      'blackhole', 'unreachable').
      
      Therefore, when a network namespace is being dismantled such routes are
      not flushed and leaked [1].
      
      To reproduce:
      # ip netns add blue
      # ip -n blue route add unreachable 192.0.2.0/24
      # ip netns del blue
      
      Fix this by not skipping error routes that are not marked with
      RTNH_F_DEAD when flushing the routing tables.
      
      To prevent the flushing of such routes in case #1, add a parameter to
      fib_table_flush() that indicates if the table is flushed as part of
      namespace dismantle or not.
      
      Note that this problem does not exist in IPv6 since error routes are
      associated with the loopback device.
      
      [1]
      unreferenced object 0xffff888066650338 (size 56):
        comm "ip", pid 1206, jiffies 4294786063 (age 26.235s)
        hex dump (first 32 bytes):
          00 00 00 00 00 00 00 00 b0 1c 62 61 80 88 ff ff  ..........ba....
          e8 8b a1 64 80 88 ff ff 00 07 00 08 fe 00 00 00  ...d............
        backtrace:
          [<00000000856ed27d>] inet_rtm_newroute+0x129/0x220
          [<00000000fcdfc00a>] rtnetlink_rcv_msg+0x397/0xa20
          [<00000000cb85801a>] netlink_rcv_skb+0x132/0x380
          [<00000000ebc991d2>] netlink_unicast+0x4c0/0x690
          [<0000000014f62875>] netlink_sendmsg+0x929/0xe10
          [<00000000bac9d967>] sock_sendmsg+0xc8/0x110
          [<00000000223e6485>] ___sys_sendmsg+0x77a/0x8f0
          [<000000002e94f880>] __sys_sendmsg+0xf7/0x250
          [<00000000ccb1fa72>] do_syscall_64+0x14d/0x610
          [<00000000ffbe3dae>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
          [<000000003a8b605b>] 0xffffffffffffffff
      unreferenced object 0xffff888061621c88 (size 48):
        comm "ip", pid 1206, jiffies 4294786063 (age 26.235s)
        hex dump (first 32 bytes):
          6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
          6b 6b 6b 6b 6b 6b 6b 6b d8 8e 26 5f 80 88 ff ff  kkkkkkkk..&_....
        backtrace:
          [<00000000733609e3>] fib_table_insert+0x978/0x1500
          [<00000000856ed27d>] inet_rtm_newroute+0x129/0x220
          [<00000000fcdfc00a>] rtnetlink_rcv_msg+0x397/0xa20
          [<00000000cb85801a>] netlink_rcv_skb+0x132/0x380
          [<00000000ebc991d2>] netlink_unicast+0x4c0/0x690
          [<0000000014f62875>] netlink_sendmsg+0x929/0xe10
          [<00000000bac9d967>] sock_sendmsg+0xc8/0x110
          [<00000000223e6485>] ___sys_sendmsg+0x77a/0x8f0
          [<000000002e94f880>] __sys_sendmsg+0xf7/0x250
          [<00000000ccb1fa72>] do_syscall_64+0x14d/0x610
          [<00000000ffbe3dae>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
          [<000000003a8b605b>] 0xffffffffffffffff
      
      Fixes: 8cced9ef ("[NETNS]: Enable routing configuration in non-initial namespace.")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Reviewed-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f97f4dd8
    • Olivier Matz's avatar
      ip6_gre: fix tunnel list corruption for x-netns · ab5098fa
      Olivier Matz authored
      In changelink ops, the ip6gre_net pointer is retrieved from
      dev_net(dev), which is wrong in case of x-netns. Thus, the tunnel is not
      unlinked from its current list and is relinked into another net
      namespace. This corrupts the tunnel lists and can later trigger a kernel
      oops.
      
      Fix this by retrieving the netns from device private area.
      
      Fixes: c8632fc3 ("net: ip6_gre: Split up ip6gre_changelink()")
      Cc: Petr Machata <petrm@mellanox.com>
      Signed-off-by: default avatarOlivier Matz <olivier.matz@6wind.com>
      Acked-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ab5098fa
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · 72f6d4d1
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      This is the first batch of Netfilter fixes for your net tree:
      
      1) Fix endless loop in nf_tables rules netlink dump, from Phil Sutter.
      
      2) Reference counter leak in object from the error path, from Taehee Yoo.
      
      3) Selective rule dump requires table and chain.
      
      4) Fix DNAT with nft_flow_offload reverse route lookup, from wenxu.
      
      5) Use GFP_KERNEL_ACCOUNT in vmalloc allocation from ebtables, from
         Shakeel Butt.
      
      6) Set ifindex from route to fix interaction with VRF slave device,
         also from wenxu.
      
      7) Use nfct_help() to check for conntrack helper, IPS_HELPER status
         flag is only set from explicit helpers via -j CT, from Henry Yen.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      72f6d4d1
    • Linus Torvalds's avatar
      Merge tag 'trace-v5.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 7939f8be
      Linus Torvalds authored
      Pull tracing fix from Steven Rostedt:
       "Andrea Righi fixed a NULL pointer dereference in trace_kprobe_create()
      
        It is possible to trigger a NULL pointer dereference by writing an
        incorrectly formatted string to the krpobe_events file"
      
      * tag 'trace-v5.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing/kprobes: Fix NULL pointer dereference in trace_kprobe_create()
      7939f8be
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · e8746440
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix regression in multi-SKB responses to RTM_GETADDR, from Arthur
          Gautier.
      
       2) Fix ipv6 frag parsing in openvswitch, from Yi-Hung Wei.
      
       3) Unbounded recursion in ipv4 and ipv6 GUE tunnels, from Stefano
          Brivio.
      
       4) Use after free in hns driver, from Yonglong Liu.
      
       5) icmp6_send() needs to handle the case of NULL skb, from Eric
          Dumazet.
      
       6) Missing rcu read lock in __inet6_bind() when operating on mapped
          addresses, from David Ahern.
      
       7) Memory leak in tipc-nl_compat_publ_dump(), from Gustavo A. R. Silva.
      
       8) Fix PHY vs r8169 module loading ordering issues, from Heiner
          Kallweit.
      
       9) Fix bridge vlan memory leak, from Ido Schimmel.
      
      10) Dev refcount leak in AF_PACKET, from Jason Gunthorpe.
      
      11) Infoleak in ipv6_local_error(), flow label isn't completely
          initialized. From Eric Dumazet.
      
      12) Handle mv88e6390 errata, from Andrew Lunn.
      
      13) Making vhost/vsock CID hashing consistent, from Zha Bin.
      
      14) Fix lack of UMH cleanup when it unexpectedly exits, from Taehee Yoo.
      
      15) Bridge forwarding must clear skb->tstamp, from Paolo Abeni.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (87 commits)
        bnxt_en: Fix context memory allocation.
        bnxt_en: Fix ring checking logic on 57500 chips.
        mISDN: hfcsusb: Use struct_size() in kzalloc()
        net: clear skb->tstamp in bridge forwarding path
        net: bpfilter: disallow to remove bpfilter module while being used
        net: bpfilter: restart bpfilter_umh when error occurred
        net: bpfilter: use cleanup callback to release umh_info
        umh: add exit routine for UMH process
        isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
        vhost/vsock: fix vhost vsock cid hashing inconsistent
        net: stmmac: Prevent RX starvation in stmmac_napi_poll()
        net: stmmac: Fix the logic of checking if RX Watchdog must be enabled
        net: stmmac: Check if CBS is supported before configuring
        net: stmmac: dwxgmac2: Only clear interrupts that are active
        net: stmmac: Fix PCI module removal leak
        tools/bpf: fix bpftool map dump with bitfields
        tools/bpf: test btf bitfield with >=256 struct member offset
        bpf: fix bpffs bitfield pretty print
        net: ethernet: mediatek: fix warning in phy_start_aneg
        tcp: change txhash on SYN-data timeout
        ...
      e8746440
    • Andrea Righi's avatar
      tracing/kprobes: Fix NULL pointer dereference in trace_kprobe_create() · 8b05a3a7
      Andrea Righi authored
      It is possible to trigger a NULL pointer dereference by writing an
      incorrectly formatted string to krpobe_events (trying to create a
      kretprobe omitting the symbol).
      
      Example:
      
       echo "r:event_1 " >> /sys/kernel/debug/tracing/kprobe_events
      
      That triggers this:
      
       BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
       #PF error: [normal kernel read fault]
       PGD 0 P4D 0
       Oops: 0000 [#1] SMP PTI
       CPU: 6 PID: 1757 Comm: bash Not tainted 5.0.0-rc1+ #125
       Hardware name: Dell Inc. XPS 13 9370/0F6P3V, BIOS 1.5.1 08/09/2018
       RIP: 0010:kstrtoull+0x2/0x20
       Code: 28 00 00 00 75 17 48 83 c4 18 5b 41 5c 5d c3 b8 ea ff ff ff eb e1 b8 de ff ff ff eb da e8 d6 36 bb ff 66 0f 1f 44 00 00 31 c0 <80> 3f 2b 55 48 89 e5 0f 94 c0 48 01 c7 e8 5c ff ff ff 5d c3 66 2e
       RSP: 0018:ffffb5d482e57cb8 EFLAGS: 00010246
       RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff82b12720
       RDX: ffffb5d482e57cf8 RSI: 0000000000000000 RDI: 0000000000000000
       RBP: ffffb5d482e57d70 R08: ffffa0c05e5a7080 R09: ffffa0c05e003980
       R10: 0000000000000000 R11: 0000000040000000 R12: ffffa0c04fe87b08
       R13: 0000000000000001 R14: 000000000000000b R15: ffffa0c058d749e1
       FS:  00007f137c7f7740(0000) GS:ffffa0c05e580000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 0000000000000000 CR3: 0000000497d46004 CR4: 00000000003606e0
       Call Trace:
        ? trace_kprobe_create+0xb6/0x840
        ? _cond_resched+0x19/0x40
        ? _cond_resched+0x19/0x40
        ? __kmalloc+0x62/0x210
        ? argv_split+0x8f/0x140
        ? trace_kprobe_create+0x840/0x840
        ? trace_kprobe_create+0x840/0x840
        create_or_delete_trace_kprobe+0x11/0x30
        trace_run_command+0x50/0x90
        trace_parse_run_command+0xc1/0x160
        probes_write+0x10/0x20
        __vfs_write+0x3a/0x1b0
        ? apparmor_file_permission+0x1a/0x20
        ? security_file_permission+0x31/0xf0
        ? _cond_resched+0x19/0x40
        vfs_write+0xb1/0x1a0
        ksys_write+0x55/0xc0
        __x64_sys_write+0x1a/0x20
        do_syscall_64+0x5a/0x120
        entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      Fix by doing the proper argument checks in trace_kprobe_create().
      
      Cc: Ingo Molnar <mingo@redhat.com>
      Link: https://lore.kernel.org/lkml/20190111095108.b79a2ee026185cbd62365977@kernel.org
      Link: http://lkml.kernel.org/r/20190111060113.GA22841@xps-13
      Fixes: 6212dd29 ("tracing/kprobes: Use dyn_event framework for kprobe events")
      Acked-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
      Signed-off-by: default avatarAndrea Righi <righi.andrea@gmail.com>
      Signed-off-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      8b05a3a7
    • Ming Lei's avatar
      sbitmap: Protect swap_lock from hardirq · fe76fc6a
      Ming Lei authored
      Because we may call blk_mq_get_driver_tag() directly from
      blk_mq_dispatch_rq_list() without holding any lock, then HARDIRQ may
      come and the above DEADLOCK is triggered.
      
      Commit ab53dcfb3e7b ("sbitmap: Protect swap_lock from hardirq") tries to
      fix this issue by using 'spin_lock_bh', which isn't enough because we
      complete request from hardirq context direclty in case of multiqueue.
      
      Cc: Clark Williams <williams@redhat.com>
      Fixes: ab53dcfb3e7b ("sbitmap: Protect swap_lock from hardirq")
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: Ming Lei <ming.lei@redhat.com>
      Cc: Guenter Roeck <linux@roeck-us.net>
      Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
      Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fe76fc6a
  3. 14 Jan, 2019 5 commits
    • Steven Rostedt (VMware)'s avatar
      sbitmap: Protect swap_lock from softirqs · 37198768
      Steven Rostedt (VMware) authored
      The swap_lock used by sbitmap has a chain with locks taken from softirq,
      but the swap_lock is not protected from being preempted by softirqs.
      
      A chain exists of:
      
       sbq->ws[i].wait -> dispatch_wait_lock -> swap_lock
      
      Where the sbq->ws[i].wait lock can be taken from softirq context, which
      means all locks below it in the chain must also be protected from
      softirqs.
      Reported-by: default avatarClark Williams <williams@redhat.com>
      Fixes: 58ab5e32 ("sbitmap: silence bogus lockdep IRQ warning")
      Fixes: ea86ea2c ("sbitmap: amortize cost of clearing bits")
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: Ming Lei <ming.lei@redhat.com>
      Cc: Guenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      37198768
    • Linus Torvalds's avatar
      Merge tag 'gpio-v5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · c962cb32
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "The patch hitting the MMC/SD subsystem is fixing up my own mess when
        moving semantics from MMC/SD over to gpiolib. Ulf is on vacation but I
        managed to reach him on chat and obtain his ACK.
      
        The other two are early-rc fixes that are not super serious but pretty
        annoying so I'd like to get rid of them.
      
        Summary:
      
         - Get rid of some WARN_ON() from the ACPI code
      
         - Staticize a symbol
      
         - Fix MMC polarity detection"
      
      * tag 'gpio-v5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        mmc: core: don't override the CD GPIO level when "cd-inverted" is set
        gpio: pca953x: Make symbol 'pca953x_i2c_regmap' static
        gpiolib-acpi: Remove unnecessary WARN_ON from acpi_gpiochip_free_interrupts
      c962cb32
    • Linus Torvalds's avatar
      Merge tag 'mfd-next-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd · 9deb9e16
      Linus Torvalds authored
      Pull MFD updates from Lee Jones:
       "New Device Support
         - Add support for Power Supply to AXP813
         - Add support for GPIO, ADC, AC and Battery Power Supply to AXP803
         - Add support for UART to Exynos LPASS
      
        Fix-ups:
         - Use supplied MACROS; ti_am335x_tscadc
         - Trivial spelling/whitespace/alignment; tmio, axp20x, rave-sp
         - Regmap changes; bd9571mwv, wm5110-tables
         - Kconfig dependencies; MFD_AT91_USART
         - Supply shared data for child-devices; madera-core
         - Use new of_node_name_eq() API call; max77620, stmpe
         - Use managed resources (devm_*); tps65218
         - Comment descriptions; ingenic-tcu
         - Coding style; madera-core
      
        Bug Fixes:
         - Fix section mismatches; twl-core, db8500-prcmu
         - Correct error path related issues; mt6397-core, ab8500-core, mc13xxx-core
         - IRQ related fixes; tps6586x
         - Ensure proper initialisation sequence; qcom_rpm
         - Repair potential memory leak; cros_ec_dev"
      
      * tag 'mfd-next-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (25 commits)
        mfd: exynos-lpass: Enable UART module support
        mfd: mc13xxx: Fix a missing check of a register-read failure
        mfd: cros_ec: Add commands to control codec
        mfd: madera: Remove spurious semicolon in while loop
        mfd: rave-sp: Fix typo in rave_sp_checksum comment
        mfd: ingenic-tcu: Fix bit field description in header
        mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path in probe()
        mfd: Use of_node_name_eq() for node name comparisons
        mfd: cros_ec_dev: Add missing mfd_remove_devices() call in remove
        mfd: axp20x: Add supported cells for AXP803
        mfd: axp20x: Re-align MFD cell entries
        mfd: axp20x: Add AC power supply cell for AXP813
        mfd: wm5110: Add missing ASRC rate register
        mfd: qcom_rpm: write fw_version to CTRL_REG
        mfd: tps6586x: Handle interrupts on suspend
        mfd: madera: Add shared data for accessory detection
        mfd: at91-usart: Add platform dependency
        mfd: bd9571mwv: Add volatile register to make DVFS work
        mfd: ab8500-core: Return zero in get_register_interruptible()
        mfd: tmio: Typo s/use use/use/
        ...
      9deb9e16
    • Linus Torvalds's avatar
      Merge tag 'backlight-next-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight · 3a73e73a
      Linus Torvalds authored
      Pull backlight updates from Lee Jones:
       "Fix-ups:
         - Use new of_node_name_eq() API call
      
        Bug Fixes:
         - Internally track 'enabled' state in pwm_bl
         - Fix auto-generated pwm_bl brightness tables parsed by DT
      
      * tag 'backlight-next-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
        backlight: 88pm860x_bl: Use of_node_name_eq for node name comparisons
        backlight: pwm_bl: Fix devicetree parsing with auto-generated brightness tables
        backlight: pwm_bl: Re-add driver internal enabled tracking
      3a73e73a
    • Henry Yen's avatar
      netfilter: nft_flow_offload: fix checking method of conntrack helper · 2314e879
      Henry Yen authored
      This patch uses nfct_help() to detect whether an established connection
      needs conntrack helper instead of using test_bit(IPS_HELPER_BIT,
      &ct->status).
      
      The reason is that IPS_HELPER_BIT is only set when using explicit CT
      target.
      
      However, in the case that a device enables conntrack helper via command
      "echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper", the status of
      IPS_HELPER_BIT will not present any change, and consequently it loses
      the checking ability in the context.
      Signed-off-by: default avatarHenry Yen <henry.yen@mediatek.com>
      Reviewed-by: default avatarRyder Lee <ryder.lee@mediatek.com>
      Tested-by: default avatarJohn Crispin <john@phrozen.org>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      2314e879
  4. 13 Jan, 2019 9 commits
    • Linus Torvalds's avatar
      Linux 5.0-rc2 · 1c7fc5cb
      Linus Torvalds authored
      1c7fc5cb
    • Jonathan Neuschäfer's avatar
      kernel/sys.c: Clarify that UNAME26 does not generate unique versions anymore · b7285b42
      Jonathan Neuschäfer authored
      UNAME26 is a mechanism to report Linux's version as 2.6.x, for
      compatibility with old/broken software.  Due to the way it is
      implemented, it would have to be updated after 5.0, to keep the
      resulting versions unique.  Linus Torvalds argued:
      
       "Do we actually need this?
      
        I'd rather let it bitrot, and just let it return random versions. It
        will just start again at 2.4.60, won't it?
      
        Anybody who uses UNAME26 for a 5.x kernel might as well think it's
        still 4.x. The user space is so old that it can't possibly care about
        differences between 4.x and 5.x, can it?
      
        The only thing that matters is that it shows "2.4.<largeenough>",
        which it will do regardless"
      Signed-off-by: default avatarJonathan Neuschäfer <j.neuschaefer@gmx.net>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b7285b42
    • Linus Torvalds's avatar
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · dbc3c09b
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "A bigger batch than I anticipated this week, for two reasons:
      
         - Some fallout on Davinci from board file -> DTB conversion, that
           also includes a few longer-standing fixes (i.e. not recent
           regressions).
      
         - drivers/reset material that has been in linux-next for a while, but
           didn't get sent to us until now for a variety of reasons
           (maintainer out sick, holidays, etc). There's a functional
           dependency in there such that one platform (Altera's SoCFPGA) won't
           boot without one of the patches; instead of reverting the patch
           that got merged, I looked at this set and decided it was small
           enough that I'll pick it up anyway. If you disagree I can revisit
           with a smaller set.
      
        That being said, there's also a handful of the usual stuff:
      
         - Fix for a crash on Armada 7K/8K when the kernel touches
           PSCI-reserved memory
      
         - Fix for PCIe reset on Macchiatobin (Armada 8K development board,
           what this email is sent from in fact :)
      
         - Enable a few new-merged modules for Amlogic in arm64 defconfig
      
         - Error path fixes on Integrator
      
         - Build fix for Renesas and Qualcomm
      
         - Initialization fix for Renesas RZ/G2E
      
        .. plus a few more fixlets"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (28 commits)
        ARM: integrator: impd1: use struct_size() in devm_kzalloc()
        qcom-scm: Include <linux/err.h> header
        gpio: pl061: handle failed allocations
        ARM: dts: kirkwood: Fix polarity of GPIO fan lines
        arm64: dts: marvell: mcbin: fix PCIe reset signal
        arm64: dts: marvell: armada-ap806: reserve PSCI area
        ARM: dts: da850-lcdk: Correct the sound card name
        ARM: dts: da850-lcdk: Correct the audio codec regulators
        ARM: dts: da850-evm: Correct the sound card name
        ARM: dts: da850-evm: Correct the audio codec regulators
        ARM: davinci: omapl138-hawk: fix label names in GPIO lookup entries
        ARM: davinci: dm644x-evm: fix label names in GPIO lookup entries
        ARM: davinci: dm355-evm: fix label names in GPIO lookup entries
        ARM: davinci: da850-evm: fix label names in GPIO lookup entries
        ARM: davinci: da830-evm: fix label names in GPIO lookup entries
        arm64: defconfig: enable modules for amlogic s400 sound card
        reset: uniphier-glue: Add AHCI reset control support in glue layer
        dt-bindings: reset: uniphier: Add AHCI core reset description
        reset: uniphier-usb3: Rename to reset-uniphier-glue
        dt-bindings: reset: uniphier: Replace the expression of USB3 with generic peripherals
        ...
      dbc3c09b
    • Linus Torvalds's avatar
      Merge tag 'for-5.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 6b529fb0
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
      
       - two regression fixes in clone/dedupe ioctls, the generic check
         callback needs to lock extents properly and wait for io to avoid
         problems with writeback and relocation
      
       - fix deadlock when using free space tree due to block group creation
      
       - a recently added check refuses a valid fileystem with seeding device,
         make that work again with a quickfix, proper solution needs more
         intrusive changes
      
      * tag 'for-5.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: Use real device structure to verify dev extent
        Btrfs: fix deadlock when using free space tree due to block group creation
        Btrfs: fix race between reflink/dedupe and relocation
        Btrfs: fix race between cloning range ending at eof and writeback
      6b529fb0
    • Linus Torvalds's avatar
      Merge tag 'driver-core-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core · 72d657dd
      Linus Torvalds authored
      Pull driver core fixes from Greg KH:
       "Here is one small sysfs change, and a documentation update for 5.0-rc2
      
        The sysfs change moves from using BUG_ON to WARN_ON, as discussed in
        an email thread on lkml while trying to track down another driver bug.
        sysfs should not be crashing and preventing people from seeing where
        they went wrong. Now it properly recovers and warns the developer.
      
        The documentation update removes the use of BUS_ATTR() as the kernel
        is moving away from this to use the specific BUS_ATTR_RW() and friends
        instead. There are pending patches in all of the different subsystems
        to remove the last users of this macro, but for now, don't advertise
        it should be used anymore to keep new ones from being introduced.
      
        Both have been in linux-next with no reported issues"
      
      * tag 'driver-core-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        Documentation: driver core: remove use of BUS_ATTR
        sysfs: convert BUG_ON to WARN_ON
      72d657dd
    • Linus Torvalds's avatar
      Merge tag 'staging-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · f7c1038b
      Linus Torvalds authored
      Pull staging driver fixes from Greg KH:
       "Here are some small staging driver fixes for some reported issues.
      
        One reverts a patch that was made to the rtl8723bs driver that turned
        out to not be needed at all as it was a bug in clang. The others fix
        up some reported issues in the rtl8188eu driver and update the
        MAINTAINERS file to point to Larry for this driver so he can get the
        bug reports easier.
      
        All have been in linux-next with no reported issues"
      
      * tag 'staging-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        Revert "staging: rtl8723bs: Mark ACPI table declaration as used"
        staging: rtl8188eu: Fix module loading from tasklet for WEP encryption
        staging: rtl8188eu: Fix module loading from tasklet for CCMP encryption
        MAINTAINERS: Add entry for staging driver r8188eu
      f7c1038b
    • Linus Torvalds's avatar
      Merge tag 'tty-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 437e878a
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are 2 tty and serial fixes for 5.0-rc2 that resolve some reported
        issues.
      
        The first is a simple serial driver fix for a regression that showed
        up in 5.0-rc1. The second one resolves a number of reported issues
        with the recent tty locking fixes that went into 5.0-rc1. Lots of
        people have tested the second one and say it resolves their issues.
      
        Both have been in linux-next with no reported issues"
      
      * tag 'tty-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        tty: Don't hold ldisc lock in tty_reopen() if ldisc present
        serial: lantiq: Do not swap register read/writes
      437e878a
    • Linus Torvalds's avatar
      Merge tag 'usb-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 1dd8a3f6
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are some small USB driver fixes and quirk updates for 5.0-rc2.
      
        The majority here are some quirks for some storage devices to get them
        to work properly. There's also a fix here to resolve the reported
        issues with some audio devices that say they are UAC3 compliant, but
        really are not.
      
        And a fix up for the MAINTAINERS file to remove a dead url.
      
        All have been in linux-next with no reported issues"
      
      * tag 'usb-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: storage: Remove outdated URL from MAINTAINERS
        USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
        usbcore: Select only first configuration for non-UAC3 compliant devices
        USB: storage: add quirk for SMI SM3350
        USB: storage: don't insert sane sense for SPC3+ when bad sense specified
        usb: cdc-acm: send ZLP for Telit 3G Intel based modems
      1dd8a3f6
    • Linus Torvalds's avatar
      Merge tag '5.0-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 0f9d140a
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "A set of cifs/smb3 fixes, 4 for stable, most from Pavel. His patches
        fix an important set of crediting (flow control) problems, and also
        two problems in cifs_writepages, ddressing some large i/o and also
        compounding issues"
      
      * tag '5.0-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: update internal module version number
        CIFS: Fix error paths in writeback code
        CIFS: Move credit processing to mid callbacks for SMB3
        CIFS: Fix credits calculation for cancelled requests
        cifs: Fix potential OOB access of lock element array
        cifs: Limit memory used by lock request calls to a page
        cifs: move large array from stack to heap
        CIFS: Do not hide EINTR after sending network packets
        CIFS: Fix credit computation for compounded requests
        CIFS: Do not set credits to 1 if the server didn't grant anything
        CIFS: Fix adjustment of credits for MTU requests
        cifs: Fix a tiny potential memory leak
        cifs: Fix a debug message
      0f9d140a