1. 16 Jan, 2020 2 commits
    • Florian Westphal's avatar
      netfilter: nft_tunnel: fix null-attribute check · 1c702bf9
      Florian Westphal authored
      else we get null deref when one of the attributes is missing, both
      must be non-null.
      
      Reported-by: syzbot+76d0b80493ac881ff77b@syzkaller.appspotmail.com
      Fixes: aaecfdb5 ("netfilter: nf_tables: match on tunnel metadata")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      1c702bf9
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: store transaction list locally while requesting module · ec7470b8
      Pablo Neira Ayuso authored
      This patch fixes a WARN_ON in nft_set_destroy() due to missing
      set reference count drop from the preparation phase. This is triggered
      by the module autoload path. Do not exercise the abort path from
      nft_request_module() while preparation phase cleaning up is still
      pending.
      
       WARNING: CPU: 3 PID: 3456 at net/netfilter/nf_tables_api.c:3740 nft_set_destroy+0x45/0x50 [nf_tables]
       [...]
       CPU: 3 PID: 3456 Comm: nft Not tainted 5.4.6-arch3-1 #1
       RIP: 0010:nft_set_destroy+0x45/0x50 [nf_tables]
       Code: e8 30 eb 83 c6 48 8b 85 80 00 00 00 48 8b b8 90 00 00 00 e8 dd 6b d7 c5 48 8b 7d 30 e8 24 dd eb c5 48 89 ef 5d e9 6b c6 e5 c5 <0f> 0b c3 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8b 7f 10 e9 52
       RSP: 0018:ffffac4f43e53700 EFLAGS: 00010202
       RAX: 0000000000000001 RBX: ffff99d63a154d80 RCX: 0000000001f88e03
       RDX: 0000000001f88c03 RSI: ffff99d6560ef0c0 RDI: ffff99d63a101200
       RBP: ffff99d617721de0 R08: 0000000000000000 R09: 0000000000000318
       R10: 00000000f0000000 R11: 0000000000000001 R12: ffffffff880fabf0
       R13: dead000000000122 R14: dead000000000100 R15: ffff99d63a154d80
       FS:  00007ff3dbd5b740(0000) GS:ffff99d6560c0000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 00001cb5de6a9000 CR3: 000000016eb6a004 CR4: 00000000001606e0
       Call Trace:
        __nf_tables_abort+0x3e3/0x6d0 [nf_tables]
        nft_request_module+0x6f/0x110 [nf_tables]
        nft_expr_type_request_module+0x28/0x50 [nf_tables]
        nf_tables_expr_parse+0x198/0x1f0 [nf_tables]
        nft_expr_init+0x3b/0xf0 [nf_tables]
        nft_dynset_init+0x1e2/0x410 [nf_tables]
        nf_tables_newrule+0x30a/0x930 [nf_tables]
        nfnetlink_rcv_batch+0x2a0/0x640 [nfnetlink]
        nfnetlink_rcv+0x125/0x171 [nfnetlink]
        netlink_unicast+0x179/0x210
        netlink_sendmsg+0x208/0x3d0
        sock_sendmsg+0x5e/0x60
        ____sys_sendmsg+0x21b/0x290
      
      Update comment on the code to describe the new behaviour.
      Reported-by: default avatarMarco Oliverio <marco.oliverio@tanaza.com>
      Fixes: 452238e8 ("netfilter: nf_tables: add and use helper for module autoload")
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      ec7470b8
  2. 13 Jan, 2020 2 commits
  3. 11 Jan, 2020 7 commits
  4. 10 Jan, 2020 9 commits
  5. 09 Jan, 2020 10 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid · e69ec487
      Linus Torvalds authored
      Pull HID fixes from Jiri Kosina:
      
       - fix for OOB in hiddev, from Dmitry Torokhov
      
       - _poll API fixes for hidraw, from Marcel Holtmann
      
       - functional fix for Steam driver, from Rodrigo Rivas Costa
      
       - a few new device IDs / device-specific quirks and other assorted
         smaller fixes
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
        HID: steam: Fix input device disappearing
        HID: intel-ish-hid: ipc: Add Tiger Lake PCI device ID
        drivers/hid/hid-multitouch.c: fix a possible null pointer access.
        HID: wacom: Recognize new MobileStudio Pro PID
        HID: intel-ish-hid: ipc: add CMP device id
        HID: hiddev: fix mess in hiddev_open()
        HID: hid-input: clear unmapped usages
        HID: Add quirk for incorrect input length on Lenovo Y720
        HID: asus: Ignore Asus vendor-page usage-code 0xff events
        HID: ite: Add USB id match for Acer SW5-012 keyboard dock
        HID: Add quirk for Xin-Mo Dual Controller
        HID: Fix slab-out-of-bounds read in hid_field_extract
        HID: multitouch: Add LG MELF0410 I2C touchscreen support
        HID: uhid: Fix returning EPOLLOUT from uhid_char_poll
        HID: hidraw: Fix returning EPOLLOUT from hidraw_poll
      e69ec487
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · a5f48c78
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Missing netns pointer init in arp_tables, from Florian Westphal.
      
       2) Fix normal tcp SACK being treated as D-SACK, from Pengcheng Yang.
      
       3) Fix divide by zero in sch_cake, from Wen Yang.
      
       4) Len passed to skb_put_padto() is wrong in qrtr code, from Carl
          Huang.
      
       5) cmd->obj.chunk is leaked in sctp code error paths, from Xin Long.
      
       6) cgroup bpf programs can be released out of order, fix from Roman
          Gushchin.
      
       7) Make sure stmmac debugfs entry name is changed when device name
          changes, from Jiping Ma.
      
       8) Fix memory leak in vlan_dev_set_egress_priority(), from Eric
          Dumazet.
      
       9) SKB leak in lan78xx usb driver, also from Eric Dumazet.
      
      10) Ridiculous TCA_FQ_QUANTUM values configured can cause loops in fq
          packet scheduler, reject them. From Eric Dumazet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (69 commits)
        tipc: fix wrong connect() return code
        tipc: fix link overflow issue at socket shutdown
        netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present
        netfilter: conntrack: dccp, sctp: handle null timeout argument
        atm: eni: fix uninitialized variable warning
        macvlan: do not assume mac_header is set in macvlan_broadcast()
        net: sch_prio: When ungrafting, replace with FIFO
        mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO
        MAINTAINERS: Remove myself as co-maintainer for qcom-ethqos
        gtp: fix bad unlock balance in gtp_encap_enable_socket
        pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
        tipc: remove meaningless assignment in Makefile
        tipc: do not add socket.o to tipc-y twice
        net: stmmac: dwmac-sun8i: Allow all RGMII modes
        net: stmmac: dwmac-sunxi: Allow all RGMII modes
        net: usb: lan78xx: fix possible skb leak
        net: stmmac: Fixed link does not need MDIO Bus
        vlan: vlan_changelink() should propagate errors
        vlan: fix memory leak in vlan_dev_set_egress_priority
        stmmac: debugfs entry name is not be changed when udev rename device name.
        ...
      a5f48c78
    • Jeff Kirsher's avatar
      e1000e: Revert "e1000e: Make watchdog use delayed work" · d5ad7a6a
      Jeff Kirsher authored
      This reverts commit 59653e64.
      
      This is due to this commit causing driver crashes and connections to
      reset unexpectedly.
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Tested-by: default avatarAaron Brown <aaron.f.brown@intel.com>
      d5ad7a6a
    • Adam Ludkiewicz's avatar
      i40e: Set PHY Access flag on X722 · bb37362f
      Adam Ludkiewicz authored
      The X722 FW API version 1.9 adds support for accessing PHY
      registers with Admin Queue Command. This enables reading
      EEPROM data from (Q)SFP+ transceivers, what was previously
      possible only on X710 devices.
      Signed-off-by: default avatarAdam Ludkiewicz <adam.ludkiewicz@intel.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      bb37362f
    • Stefan Assmann's avatar
      iavf: remove current MAC address filter on VF reset · 9e052291
      Stefan Assmann authored
      Currently MAC filters are not altered during a VF reset event. This may
      lead to a stale filter when an administratively set MAC is forced by the
      PF.
      
      For an administratively set MAC the PF driver deletes the VFs filters,
      overwrites the VFs MAC address and triggers a VF reset. However
      the VF driver itself is not aware of the filter removal, which is what
      the VF reset is for.
      The VF reset queues all filters present in the VF driver to be re-added
      to the PF filter list (including the filter for the now stale VF MAC
      address) and triggers a VIRTCHNL_OP_GET_VF_RESOURCES event, which
      provides the new MAC address to the VF.
      
      When this happens i40e will complain and reject the stale MAC filter,
      at least in the untrusted VF case.
      i40e 0000:08:00.0: Setting MAC 3c:fa:fa:fa:fa:01 on VF 0
      iavf 0000:08:02.0: Reset warning received from the PF
      iavf 0000:08:02.0: Scheduling reset task
      i40e 0000:08:00.0: Bring down and up the VF interface to make this change effective.
      i40e 0000:08:00.0: VF attempting to override administratively set MAC address, bring down and up the VF interface to resume normal operation
      i40e 0000:08:00.0: VF 0 failed opcode 10, retval: -1
      iavf 0000:08:02.0: Failed to add MAC filter, error IAVF_ERR_NVM
      
      To avoid re-adding the stale MAC filter it needs to be removed from the
      VF driver's filter list before queuing the existing filters. Then during
      the VIRTCHNL_OP_GET_VF_RESOURCES event the correct filter needs to be
      added again, at which point the MAC address has been updated.
      
      As a bonus this change makes bringing the VF down and up again
      superfluous for the administratively set MAC case.
      Signed-off-by: default avatarStefan Assmann <sassmann@kpanic.de>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      9e052291
    • Manfred Rudigier's avatar
      igb: Fix SGMII SFP module discovery for 100FX/LX. · 5365ec1a
      Manfred Rudigier authored
      Changing the link mode should also be done for 100BaseFX SGMII modules,
      otherwise they just don't work when the default link mode in CTRL_EXT
      coming from the EEPROM is SERDES.
      
      Additionally 100Base-LX SGMII SFP modules are also supported now, which
      was not the case before.
      
      Tested with an i210 using Flexoptix S.1303.2M.G 100FX and
      S.1303.10.G 100LX SGMII SFP modules.
      Signed-off-by: default avatarManfred Rudigier <manfred.rudigier@omicronenergy.com>
      Tested-by: default avatarAaron Brown <aaron.f.brown@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      5365ec1a
    • Cambda Zhu's avatar
      ixgbe: Fix calculation of queue with VFs and flow director on interface flap · 4fad78ad
      Cambda Zhu authored
      This patch fixes the calculation of queue when we restore flow director
      filters after resetting adapter. In ixgbe_fdir_filter_restore(), filter's
      vf may be zero which makes the queue outside of the rx_ring array.
      
      The calculation is changed to the same as ixgbe_add_ethtool_fdir_entry().
      Signed-off-by: default avatarCambda Zhu <cambda@linux.alibaba.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      4fad78ad
    • Radoslaw Tyl's avatar
      ixgbevf: Remove limit of 10 entries for unicast filter list · aa604651
      Radoslaw Tyl authored
      Currently, though the FDB entry is added to VF, it does not appear in
      RAR filters. VF driver only allows to add 10 entries. Attempting to add
      another causes an error. This patch removes limitation and allows use of
      all free RAR entries for the FDB if needed.
      
      Fixes: 46ec20ff ("ixgbevf: Add macvlan support in the set rx mode op")
      Signed-off-by: default avatarRadoslaw Tyl <radoslawx.tyl@intel.com>
      Acked-by: default avatarPaul Menzel <pmenzel@molgen.mpg.de>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      aa604651
    • Brett Creeley's avatar
      i40e: Fix virtchnl_queue_select bitmap validation · d9d6a9ae
      Brett Creeley authored
      Currently in i40e_vc_disable_queues_msg() we are incorrectly
      validating the virtchnl queue select bitmaps. The
      virtchnl_queue_select rx_queues and tx_queue bitmap is being
      compared against ICE_MAX_VF_QUEUES, but the problem is that
      these bitmaps can have a value greater than I40E_MAX_VF_QUEUES.
      Fix this by comparing the bitmaps against BIT(I40E_MAX_VF_QUEUES).
      
      Also, add the function i40e_vc_validate_vqs_bitmaps() that checks to see
      if both virtchnl_queue_select bitmaps are empty along with checking that
      the bitmaps only have valid bits set. This function can then be used in
      both the queue enable and disable flows.
      Suggested-by: default avatarArkady Gilinksky <arkady.gilinsky@harmonicinc.com>
      Signed-off-by: default avatarBrett Creeley <brett.creeley@intel.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      d9d6a9ae
    • Rodrigo Rivas Costa's avatar
      HID: steam: Fix input device disappearing · 20eee6e5
      Rodrigo Rivas Costa authored
      The `connected` value for wired devices was not properly initialized,
      it must be set to `true` upon creation, because wired devices do not
      generate connection events.
      
      When a raw client (the Steam Client) uses the device, the input device
      is destroyed. Then, when the raw client finishes, it must be recreated.
      But since the `connected` variable was false this never happended.
      Signed-off-by: default avatarRodrigo Rivas Costa <rodrigorivascosta@gmail.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      20eee6e5
  6. 08 Jan, 2020 10 commits
    • Tuong Lien's avatar
      tipc: fix wrong connect() return code · 9546a0b7
      Tuong Lien authored
      The current 'tipc_wait_for_connect()' function does a wait-loop for the
      condition 'sk->sk_state != TIPC_CONNECTING' to conclude if the socket
      connecting has done. However, when the condition is met, it returns '0'
      even in the case the connecting is actually failed, the socket state is
      set to 'TIPC_DISCONNECTING' (e.g. when the server socket has closed..).
      This results in a wrong return code for the 'connect()' call from user,
      making it believe that the connection is established and go ahead with
      building, sending a message, etc. but finally failed e.g. '-EPIPE'.
      
      This commit fixes the issue by changing the wait condition to the
      'tipc_sk_connected(sk)', so the function will return '0' only when the
      connection is really established. Otherwise, either the socket 'sk_err'
      if any or '-ETIMEDOUT'/'-EINTR' will be returned correspondingly.
      Acked-by: default avatarYing Xue <ying.xue@windriver.com>
      Acked-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarTuong Lien <tuong.t.lien@dektech.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9546a0b7
    • Tuong Lien's avatar
      tipc: fix link overflow issue at socket shutdown · 49afb806
      Tuong Lien authored
      When a socket is suddenly shutdown or released, it will reject all the
      unreceived messages in its receive queue. This applies to a connected
      socket too, whereas there is only one 'FIN' message required to be sent
      back to its peer in this case.
      
      In case there are many messages in the queue and/or some connections
      with such messages are shutdown at the same time, the link layer will
      easily get overflowed at the 'TIPC_SYSTEM_IMPORTANCE' backlog level
      because of the message rejections. As a result, the link will be taken
      down. Moreover, immediately when the link is re-established, the socket
      layer can continue to reject the messages and the same issue happens...
      
      The commit refactors the '__tipc_shutdown()' function to only send one
      'FIN' in the situation mentioned above. For the connectionless case, it
      is unavoidable but usually there is no rejections for such socket
      messages because they are 'dest-droppable' by default.
      
      In addition, the new code makes the other socket states clear
      (e.g.'TIPC_LISTEN') and treats as a separate case to avoid misbehaving.
      Acked-by: default avatarYing Xue <ying.xue@windriver.com>
      Acked-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarTuong Lien <tuong.t.lien@dektech.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      49afb806
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · b73a6561
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for net:
      
      1) Missing netns context in arp_tables, from Florian Westphal.
      
      2) Underflow in flowtable reference counter, from wenxu.
      
      3) Fix incorrect ethernet destination address in flowtable offload,
         from wenxu.
      
      4) Check for status of neighbour entry, from wenxu.
      
      5) Fix NAT port mangling, from wenxu.
      
      6) Unbind callbacks from destroy path to cleanup hardware properly
         on flowtable removal.
      
      7) Fix missing casting statistics timestamp, add nf_flowtable_time_stamp
         and use it.
      
      8) NULL pointer exception when timeout argument is null in conntrack
         dccp and sctp protocol helpers, from Florian Westphal.
      
      9) Possible nul-dereference in ipset with IPSET_ATTR_LINENO, also from
         Florian.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b73a6561
    • Florian Westphal's avatar
      netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present · 22dad713
      Florian Westphal authored
      The set uadt functions assume lineno is never NULL, but it is in
      case of ip_set_utest().
      
      syzkaller managed to generate a netlink message that calls this with
      LINENO attr present:
      
      general protection fault: 0000 [#1] PREEMPT SMP KASAN
      RIP: 0010:hash_mac4_uadt+0x1bc/0x470 net/netfilter/ipset/ip_set_hash_mac.c:104
      Call Trace:
       ip_set_utest+0x55b/0x890 net/netfilter/ipset/ip_set_core.c:1867
       nfnetlink_rcv_msg+0xcf2/0xfb0 net/netfilter/nfnetlink.c:229
       netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
       nfnetlink_rcv+0x1ba/0x460 net/netfilter/nfnetlink.c:563
      
      pass a dummy lineno storage, its easier than patching all set
      implementations.
      
      This seems to be a day-0 bug.
      
      Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
      Reported-by: syzbot+34bd2369d38707f3f4a7@syzkaller.appspotmail.com
      Fixes: a7b4f989 ("netfilter: ipset: IP set core support")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Acked-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      22dad713
    • Florian Westphal's avatar
      netfilter: conntrack: dccp, sctp: handle null timeout argument · 1d9a7acd
      Florian Westphal authored
      The timeout pointer can be NULL which means we should modify the
      per-nets timeout instead.
      
      All do this, except sctp and dccp which instead give:
      
      general protection fault: 0000 [#1] PREEMPT SMP KASAN
      net/netfilter/nf_conntrack_proto_dccp.c:682
       ctnl_timeout_parse_policy+0x150/0x1d0 net/netfilter/nfnetlink_cttimeout.c:67
       cttimeout_default_set+0x150/0x1c0 net/netfilter/nfnetlink_cttimeout.c:368
       nfnetlink_rcv_msg+0xcf2/0xfb0 net/netfilter/nfnetlink.c:229
       netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
      
      Reported-by: syzbot+46a4ad33f345d1dd346e@syzkaller.appspotmail.com
      Fixes: c779e849 ("netfilter: conntrack: remove get_timeout() indirection")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      1d9a7acd
    • Arnd Bergmann's avatar
      atm: eni: fix uninitialized variable warning · 30780d08
      Arnd Bergmann authored
      With -O3, gcc has found an actual unintialized variable stored
      into an mmio register in two instances:
      
      drivers/atm/eni.c: In function 'discard':
      drivers/atm/eni.c:465:13: error: 'dma[1]' is used uninitialized in this function [-Werror=uninitialized]
         writel(dma[i*2+1],eni_dev->rx_dma+dma_wr*8+4);
                   ^
      drivers/atm/eni.c:465:13: error: 'dma[3]' is used uninitialized in this function [-Werror=uninitialized]
      
      Change the code to always write zeroes instead.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      30780d08
    • Eric Dumazet's avatar
      macvlan: do not assume mac_header is set in macvlan_broadcast() · 96cc4b69
      Eric Dumazet authored
      Use of eth_hdr() in tx path is error prone.
      
      Many drivers call skb_reset_mac_header() before using it,
      but others do not.
      
      Commit 6d1ccff6 ("net: reset mac header in dev_start_xmit()")
      attempted to fix this generically, but commit d346a3fa
      ("packet: introduce PACKET_QDISC_BYPASS socket option") brought
      back the macvlan bug.
      
      Lets add a new helper, so that tx paths no longer have
      to call skb_reset_mac_header() only to get a pointer
      to skb->data.
      
      Hopefully we will be able to revert 6d1ccff6
      ("net: reset mac header in dev_start_xmit()") and save few cycles
      in transmit fast path.
      
      BUG: KASAN: use-after-free in __get_unaligned_cpu32 include/linux/unaligned/packed_struct.h:19 [inline]
      BUG: KASAN: use-after-free in mc_hash drivers/net/macvlan.c:251 [inline]
      BUG: KASAN: use-after-free in macvlan_broadcast+0x547/0x620 drivers/net/macvlan.c:277
      Read of size 4 at addr ffff8880a4932401 by task syz-executor947/9579
      
      CPU: 0 PID: 9579 Comm: syz-executor947 Not tainted 5.5.0-rc4-syzkaller #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x197/0x210 lib/dump_stack.c:118
       print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
       __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
       kasan_report+0x12/0x20 mm/kasan/common.c:639
       __asan_report_load_n_noabort+0xf/0x20 mm/kasan/generic_report.c:145
       __get_unaligned_cpu32 include/linux/unaligned/packed_struct.h:19 [inline]
       mc_hash drivers/net/macvlan.c:251 [inline]
       macvlan_broadcast+0x547/0x620 drivers/net/macvlan.c:277
       macvlan_queue_xmit drivers/net/macvlan.c:520 [inline]
       macvlan_start_xmit+0x402/0x77f drivers/net/macvlan.c:559
       __netdev_start_xmit include/linux/netdevice.h:4447 [inline]
       netdev_start_xmit include/linux/netdevice.h:4461 [inline]
       dev_direct_xmit+0x419/0x630 net/core/dev.c:4079
       packet_direct_xmit+0x1a9/0x250 net/packet/af_packet.c:240
       packet_snd net/packet/af_packet.c:2966 [inline]
       packet_sendmsg+0x260d/0x6220 net/packet/af_packet.c:2991
       sock_sendmsg_nosec net/socket.c:639 [inline]
       sock_sendmsg+0xd7/0x130 net/socket.c:659
       __sys_sendto+0x262/0x380 net/socket.c:1985
       __do_sys_sendto net/socket.c:1997 [inline]
       __se_sys_sendto net/socket.c:1993 [inline]
       __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1993
       do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      RIP: 0033:0x442639
      Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00
      RSP: 002b:00007ffc13549e08 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
      RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000442639
      RDX: 000000000000000e RSI: 0000000020000080 RDI: 0000000000000003
      RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
      R13: 0000000000403bb0 R14: 0000000000000000 R15: 0000000000000000
      
      Allocated by task 9389:
       save_stack+0x23/0x90 mm/kasan/common.c:72
       set_track mm/kasan/common.c:80 [inline]
       __kasan_kmalloc mm/kasan/common.c:513 [inline]
       __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486
       kasan_kmalloc+0x9/0x10 mm/kasan/common.c:527
       __do_kmalloc mm/slab.c:3656 [inline]
       __kmalloc+0x163/0x770 mm/slab.c:3665
       kmalloc include/linux/slab.h:561 [inline]
       tomoyo_realpath_from_path+0xc5/0x660 security/tomoyo/realpath.c:252
       tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
       tomoyo_path_perm+0x230/0x430 security/tomoyo/file.c:822
       tomoyo_inode_getattr+0x1d/0x30 security/tomoyo/tomoyo.c:129
       security_inode_getattr+0xf2/0x150 security/security.c:1222
       vfs_getattr+0x25/0x70 fs/stat.c:115
       vfs_statx_fd+0x71/0xc0 fs/stat.c:145
       vfs_fstat include/linux/fs.h:3265 [inline]
       __do_sys_newfstat+0x9b/0x120 fs/stat.c:378
       __se_sys_newfstat fs/stat.c:375 [inline]
       __x64_sys_newfstat+0x54/0x80 fs/stat.c:375
       do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Freed by task 9389:
       save_stack+0x23/0x90 mm/kasan/common.c:72
       set_track mm/kasan/common.c:80 [inline]
       kasan_set_free_info mm/kasan/common.c:335 [inline]
       __kasan_slab_free+0x102/0x150 mm/kasan/common.c:474
       kasan_slab_free+0xe/0x10 mm/kasan/common.c:483
       __cache_free mm/slab.c:3426 [inline]
       kfree+0x10a/0x2c0 mm/slab.c:3757
       tomoyo_realpath_from_path+0x1a7/0x660 security/tomoyo/realpath.c:289
       tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
       tomoyo_path_perm+0x230/0x430 security/tomoyo/file.c:822
       tomoyo_inode_getattr+0x1d/0x30 security/tomoyo/tomoyo.c:129
       security_inode_getattr+0xf2/0x150 security/security.c:1222
       vfs_getattr+0x25/0x70 fs/stat.c:115
       vfs_statx_fd+0x71/0xc0 fs/stat.c:145
       vfs_fstat include/linux/fs.h:3265 [inline]
       __do_sys_newfstat+0x9b/0x120 fs/stat.c:378
       __se_sys_newfstat fs/stat.c:375 [inline]
       __x64_sys_newfstat+0x54/0x80 fs/stat.c:375
       do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      The buggy address belongs to the object at ffff8880a4932000
       which belongs to the cache kmalloc-4k of size 4096
      The buggy address is located 1025 bytes inside of
       4096-byte region [ffff8880a4932000, ffff8880a4933000)
      The buggy address belongs to the page:
      page:ffffea0002924c80 refcount:1 mapcount:0 mapping:ffff8880aa402000 index:0x0 compound_mapcount: 0
      raw: 00fffe0000010200 ffffea0002846208 ffffea00028f3888 ffff8880aa402000
      raw: 0000000000000000 ffff8880a4932000 0000000100000001 0000000000000000
      page dumped because: kasan: bad access detected
      
      Memory state around the buggy address:
       ffff8880a4932300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
       ffff8880a4932380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      >ffff8880a4932400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
       ffff8880a4932480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
       ffff8880a4932500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      
      Fixes: b863ceb7 ("[NET]: Add macvlan driver")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      96cc4b69
    • David S. Miller's avatar
      Merge branch 'net-ungraft-prio' · 2f806c2a
      David S. Miller authored
      Petr Machata says:
      
      ====================
      When ungrafting from PRIO, replace child with FIFO
      
      When a child Qdisc is removed from one of the PRIO Qdisc's bands, it is
      replaced unconditionally by a NOOP qdisc. As a result, any traffic hitting
      that band gets dropped. That is incorrect--no Qdisc was explicitly added
      when PRIO was created, and after removal, none should have to be added
      either.
      
      In patch #2, this problem is fixed for PRIO by first attempting to create a
      default Qdisc and only falling back to noop when that fails. This pattern
      of attempting to create an invisible FIFO, using NOOP only as a fallback,
      is also seen in some other Qdiscs.
      
      The only driver currently offloading PRIO (and thus presumably the only one
      impacted by this) is mlxsw. Therefore patch #1 extends mlxsw to handle the
      replacement by an invisible FIFO gracefully.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2f806c2a
    • Petr Machata's avatar
      net: sch_prio: When ungrafting, replace with FIFO · 240ce7f6
      Petr Machata authored
      When a child Qdisc is removed from one of the PRIO Qdisc's bands, it is
      replaced unconditionally by a NOOP qdisc. As a result, any traffic hitting
      that band gets dropped. That is incorrect--no Qdisc was explicitly added
      when PRIO was created, and after removal, none should have to be added
      either.
      
      Fix PRIO by first attempting to create a default Qdisc and only falling
      back to noop when that fails. This pattern of attempting to create an
      invisible FIFO, using NOOP only as a fallback, is also seen in other
      Qdiscs.
      
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Signed-off-by: default avatarPetr Machata <petrm@mellanox.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      240ce7f6
    • Petr Machata's avatar
      mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO · 3971a535
      Petr Machata authored
      The following patch will change PRIO to replace a removed Qdisc with an
      invisible FIFO, instead of NOOP. mlxsw will see this replacement due to the
      graft message that is generated. But because FIFO does not issue its own
      REPLACE message, when the graft operation takes place, the Qdisc that mlxsw
      tracks under the indicated band is still the old one. The child
      handle (0:0) therefore does not match, and mlxsw rejects the graft
      operation, which leads to an extack message:
      
          Warning: Offloading graft operation failed.
      
      Fix by ignoring the invisible children in the PRIO graft handler. The
      DESTROY message of the removed Qdisc is going to follow shortly and handle
      the removal.
      
      Fixes: 32dc5efc ("mlxsw: spectrum: qdiscs: prio: Handle graft command")
      Signed-off-by: default avatarPetr Machata <petrm@mellanox.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3971a535