1. 23 Nov, 2016 3 commits
  2. 22 Nov, 2016 7 commits
  3. 21 Nov, 2016 14 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security · 3b404a51
      Linus Torvalds authored
      Pull apparmor bugfix from James Morris:
       "This has a fix for a policy replacement bug that is fairly serious for
        apache mod_apparmor users, as it results in the wrong policy being
        applied on an network facing service"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
        apparmor: fix change_hat not finding hat after policy replacement
      3b404a51
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · 8d1a2408
      Linus Torvalds authored
      Pull sparc fixes from David Miller:
      
       1) With modern networking cards we can run out of 32-bit DMA space, so
          support 64-bit DMA addressing when possible on sparc64. From Dave
          Tushar.
      
       2) Some signal frame validation checks are inverted on sparc32, fix
          from Andreas Larsson.
      
       3) Lockdep tables can get too large in some circumstances on sparc64,
          add a way to adjust the size a bit. From Babu Moger.
      
       4) Fix NUMA node probing on some sun4v systems, from Thomas Tai.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc: drop duplicate header scatterlist.h
        lockdep: Limit static allocations if PROVE_LOCKING_SMALL is defined
        config: Adding the new config parameter CONFIG_PROVE_LOCKING_SMALL for sparc
        sunbmac: Fix compiler warning
        sunqe: Fix compiler warnings
        sparc64: Enable 64-bit DMA
        sparc64: Enable sun4v dma ops to use IOMMU v2 APIs
        sparc64: Bind PCIe devices to use IOMMU v2 service
        sparc64: Initialize iommu_map_table and iommu_pool
        sparc64: Add ATU (new IOMMU) support
        sparc64: Add FORCE_MAX_ZONEORDER and default to 13
        sparc64: fix compile warning section mismatch in find_node()
        sparc32: Fix inverted invalid_frame_pointer checks on sigreturns
        sparc64: Fix find_node warning if numa node cannot be found
      8d1a2408
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 27e7ab99
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Clear congestion control state when changing algorithms on an
          existing socket, from Florian Westphal.
      
       2) Fix register bit values in altr_tse_pcs portion of stmmac driver,
          from Jia Jie Ho.
      
       3) Fix PTP handling in stammc driver for GMAC4, from Giuseppe
          CAVALLARO.
      
       4) Fix udplite multicast delivery handling, it ignores the udp_table
          parameter passed into the lookups, from Pablo Neira Ayuso.
      
       5) Synchronize the space estimated by rtnl_vfinfo_size and the space
          actually used by rtnl_fill_vfinfo. From Sabrina Dubroca.
      
       6) Fix memory leak in fib_info when splitting nodes, from Alexander
          Duyck.
      
       7) If a driver does a napi_hash_del() explicitily and not via
          netif_napi_del(), it must perform RCU synchronization as needed. Fix
          this in virtio-net and bnxt drivers, from Eric Dumazet.
      
       8) Likewise, it is not necessary to invoke napi_hash_del() is we are
          also doing neif_napi_del() in the same code path. Remove such calls
          from be2net and cxgb4 drivers, also from Eric Dumazet.
      
       9) Don't allocate an ID in peernet2id_alloc() if the netns is dead,
          from WANG Cong.
      
      10) Fix OF node and device struct leaks in of_mdio, from Johan Hovold.
      
      11) We cannot cache routes in ip6_tunnel when using inherited traffic
          classes, from Paolo Abeni.
      
      12) Fix several crashes and leaks in cpsw driver, from Johan Hovold.
      
      13) Splice operations cannot use freezable blocking calls in AF_UNIX,
          from WANG Cong.
      
      14) Link dump filtering by master device and kind support added an error
          in loop index updates during the dump if we actually do filter, fix
          from Zhang Shengju.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (59 commits)
        tcp: zero ca_priv area when switching cc algorithms
        net: l2tp: Treat NET_XMIT_CN as success in l2tp_eth_dev_xmit
        ethernet: stmmac: make DWMAC_STM32 depend on it's associated SoC
        tipc: eliminate obsolete socket locking policy description
        rtnl: fix the loop index update error in rtnl_dump_ifinfo()
        l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind()
        net: macb: add check for dma mapping error in start_xmit()
        rtnetlink: fix FDB size computation
        netns: fix get_net_ns_by_fd(int pid) typo
        af_unix: conditionally use freezable blocking calls in read
        net: ethernet: ti: cpsw: fix fixed-link phy probe deferral
        net: ethernet: ti: cpsw: add missing sanity check
        net: ethernet: ti: cpsw: fix secondary-emac probe error path
        net: ethernet: ti: cpsw: fix of_node and phydev leaks
        net: ethernet: ti: cpsw: fix deferred probe
        net: ethernet: ti: cpsw: fix mdio device reference leak
        net: ethernet: ti: cpsw: fix bad register access in probe error path
        net: sky2: Fix shutdown crash
        cfg80211: limit scan results cache size
        net sched filters: pass netlink message flags in event notification
        ...
      27e7ab99
    • Florian Westphal's avatar
      tcp: zero ca_priv area when switching cc algorithms · 7082c5c3
      Florian Westphal authored
      We need to zero out the private data area when application switches
      connection to different algorithm (TCP_CONGESTION setsockopt).
      
      When congestion ops get assigned at connect time everything is already
      zeroed because sk_alloc uses GFP_ZERO flag.  But in the setsockopt case
      this contains whatever previous cc placed there.
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7082c5c3
    • Gao Feng's avatar
      net: l2tp: Treat NET_XMIT_CN as success in l2tp_eth_dev_xmit · 7c6ae610
      Gao Feng authored
      The tc could return NET_XMIT_CN as one congestion notification, but
      it does not mean the packe is lost. Other modules like ipvlan,
      macvlan, and others treat NET_XMIT_CN as success too.
      So l2tp_eth_dev_xmit should add the NET_XMIT_CN check.
      Signed-off-by: default avatarGao Feng <gfree.wind@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7c6ae610
    • Peter Robinson's avatar
      ethernet: stmmac: make DWMAC_STM32 depend on it's associated SoC · 6bc5445c
      Peter Robinson authored
      There's not much point, except compile test, enabling the stmmac
      platform drivers unless the STM32 SoC is enabled. It's not
      useful without it.
      Signed-off-by: default avatarPeter Robinson <pbrobinson@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6bc5445c
    • Jacob Pan's avatar
      thermal/powerclamp: add back module device table · ec638db8
      Jacob Pan authored
      Commit 3105f234 replaced module
      cpu id table with a cpu feature check, which is logically correct.
      But we need the module device table to allow module auto loading.
      
      Cc: stable@vger.kernel.org # 4.8
      Fixes:3105f234 thermal/powerclamp: correct cpu support check
      Signed-off-by: default avatarJacob Pan <jacob.jun.pan@linux.intel.com>
      Signed-off-by: default avatarZhang Rui <rui.zhang@intel.com>
      ec638db8
    • Andy Shevchenko's avatar
      x86/platform/intel-mid: Rename platform_wdt to platform_mrfld_wdt · e5dce286
      Andy Shevchenko authored
      Rename the watchdog platform library file to explicitly show that is used only
      on Intel Merrifield platforms.
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/20161118172723.179761-1-andriy.shevchenko@linux.intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      e5dce286
    • H.J. Lu's avatar
      x86/build: Build compressed x86 kernels as PIE when !CONFIG_RELOCATABLE as well · a980ce35
      H.J. Lu authored
      Since the bootloader may load the compressed x86 kernel at any address,
      it should always be built as PIE, not just when CONFIG_RELOCATABLE=y.
      
      Otherwise, linker in binutils 2.27 will optimize GOT load into the
      absolute address when building the compressed x86 kernel as a non-PIE
      executable.
      Signed-off-by: default avatarH.J. Lu <hjl.tools@gmail.com>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: linux-kernel@vger.kernel.org
      [ Small wording changes. ]
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      a980ce35
    • Andy Shevchenko's avatar
      x86/platform/intel-mid: Register watchdog device after SCU · 8c5c86fb
      Andy Shevchenko authored
      Watchdog device in Intel Tangier relies on SCU to be present. It uses the SCU
      IPC channel to send commands and receive responses. If watchdog driver is
      initialized quite before SCU and a command has been sent the result is always
      an error like the following:
      
      	intel_mid_wdt: Error stopping watchdog: 0xffffffed
      
      Register watchdog device whne SCU is ready to avoid described issue.
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/20161118165224.175514-1-andriy.shevchenko@linux.intel.com
      [ Small cleanups. ]
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      8c5c86fb
    • Yu-cheng Yu's avatar
      x86/fpu: Fix invalid FPU ptrace state after execve() · b22cbe40
      Yu-cheng Yu authored
      Robert O'Callahan reported that after an execve PTRACE_GETREGSET
      NT_X86_XSTATE continues to return the pre-exec register values
      until the exec'ed task modifies FPU state.
      
      The test code is at:
      
        https://bugzilla.redhat.com/attachment.cgi?id=1164286.
      
      What is happening is fpu__clear() does not properly clear fpstate.
      Fix it by doing just that.
      Reported-by: default avatarRobert O'Callahan <robert@ocallahan.org>
      Signed-off-by: default avatarYu-cheng Yu <yu-cheng.yu@intel.com>
      Cc: <stable@vger.kernel.org>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: David Hansen <dave.hansen@linux.intel.com>
      Cc: Fenghua Yu <fenghua.yu@intel.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/1479402695-6553-1-git-send-email-yu-cheng.yu@intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      b22cbe40
    • Andy Lutomirski's avatar
      x86/boot: Fail the boot if !M486 and CPUID is missing · ed68d7e9
      Andy Lutomirski authored
      Linux will have all kinds of sporadic problems on systems that don't
      have the CPUID instruction unless CONFIG_M486=y.  In particular,
      sync_core() will explode.
      
      I believe that these kernels had a better chance of working before
      commit 05fb3c19 ("x86/boot: Initialize FPU and X86_FEATURE_ALWAYS
      even if we don't have CPUID").  That commit inadvertently fixed a
      serious bug: we used to fail to detect the FPU if CPUID wasn't
      present.  Because we also used to forget to set X86_FEATURE_ALWAYS, we
      end up with no cpu feature bits set at all.  This meant that
      alternative patching didn't do anything and, if paravirt was disabled,
      we could plausibly finish the entire boot process without calling
      sync_core().
      
      Rather than trying to work around these issues, just have the kernel
      fail loudly if it's running on a CPUID-less 486, doesn't have CPUID,
      and doesn't have CONFIG_M486 set.
      Reported-by: default avatarMatthew Whitehead <tedheadster@gmail.com>
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/70eac6639f23df8be5fe03fa1984aedd5d40077a.1479598603.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      ed68d7e9
    • Andy Lutomirski's avatar
      x86/traps: Ignore high word of regs->cs in early_fixup_exception() · fc0e81b2
      Andy Lutomirski authored
      On the 80486 DX, it seems that some exceptions may leave garbage in
      the high bits of CS.  This causes sporadic failures in which
      early_fixup_exception() refuses to fix up an exception.
      
      As far as I can tell, this has been buggy for a long time, but the
      problem seems to have been exacerbated by commits:
      
        1e02ce4c ("x86: Store a per-cpu shadow copy of CR4")
        e1bfc11c ("x86/init: Fix cr4_init_shadow() on CR4-less machines")
      
      This appears to have broken for as long as we've had early
      exception handling.
      
      [ Note to stable maintainers: This patch is needed all the way back to 3.4,
        but it will only apply to 4.6 and up, as it depends on commit:
      
          0e861fbb ("x86/head: Move early exception panic code into early_fixup_exception()")
      
        If you want to backport to kernels before 4.6, please don't backport the
        prerequisites (there was a big chain of them that rewrote a lot of the
        early exception machinery); instead, ask me and I can send you a one-liner
        that will apply. ]
      Reported-by: default avatarMatthew Whitehead <tedheadster@gmail.com>
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: stable@vger.kernel.org
      Fixes: 4c5023a3 ("x86-32: Handle exception table entries during early boot")
      Link: http://lkml.kernel.org/r/cb32c69920e58a1a58e7b5cad975038a69c0ce7d.1479609510.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      fc0e81b2
    • John Johansen's avatar
      apparmor: fix change_hat not finding hat after policy replacement · 3d40658c
      John Johansen authored
      After a policy replacement, the task cred may be out of date and need
      to be updated. However change_hat is using the stale profiles from
      the out of date cred resulting in either: a stale profile being applied
      or, incorrect failure when searching for a hat profile as it has been
      migrated to the new parent profile.
      
      Fixes: 01e2b670 (failure to find hat)
      Fixes: 898127c3 (stale policy being applied)
      Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1000287
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
      3d40658c
  4. 20 Nov, 2016 10 commits
    • Linus Torvalds's avatar
      Linux 4.9-rc6 · 9c763584
      Linus Torvalds authored
      9c763584
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm · 697ed8d0
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "A few more ARM fixes:
      
         - the assembly backtrace code suffers problems with the new printk()
           implementation which assumes that kernel messages without KERN_CONT
           should have newlines inserted between them. Fix this.
         - fix a section naming error - ".init.text" rather than ".text.init"
         - preallocate DMA debug memory at core_initcall() time rather than
           fs_initcall(), as we have some core drivers that need to use DMA
           mapping - and that triggers a kernel warning from the DMA debug
           code.
         - fix XIP kernels after the ro_after_init changes made this data
           permanently read-only"
      
      * 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm:
        ARM: Fix XIP kernels
        ARM: 8628/1: dma-mapping: preallocate DMA-debug hash tables in core_initcall
        ARM: 8624/1: proc-v7m.S: fix init section name
        ARM: fix backtrace
      697ed8d0
    • Jon Paul Maloy's avatar
      tipc: eliminate obsolete socket locking policy description · 51b9a31c
      Jon Paul Maloy authored
      The comment block in socket.c describing the locking policy is
      obsolete, and does not reflect current reality. We remove it in this
      commit.
      
      Since the current locking policy is much simpler and follows a
      mainstream approach, we see no need to add a new description.
      Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      51b9a31c
    • Zhang Shengju's avatar
      rtnl: fix the loop index update error in rtnl_dump_ifinfo() · 3f0ae05d
      Zhang Shengju authored
      If the link is filtered out, loop index should also be updated. If not,
      loop index will not be correct.
      
      Fixes: dc599f76 ("net: Add support for filtering link dump by master device and kind")
      Signed-off-by: default avatarZhang Shengju <zhangshengju@cmss.chinamobile.com>
      Acked-by: default avatarDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3f0ae05d
    • Guillaume Nault's avatar
      l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() · 32c23116
      Guillaume Nault authored
      Lock socket before checking the SOCK_ZAPPED flag in l2tp_ip6_bind().
      Without lock, a concurrent call could modify the socket flags between
      the sock_flag(sk, SOCK_ZAPPED) test and the lock_sock() call. This way,
      a socket could be inserted twice in l2tp_ip6_bind_table. Releasing it
      would then leave a stale pointer there, generating use-after-free
      errors when walking through the list or modifying adjacent entries.
      
      BUG: KASAN: use-after-free in l2tp_ip6_close+0x22e/0x290 at addr ffff8800081b0ed8
      Write of size 8 by task syz-executor/10987
      CPU: 0 PID: 10987 Comm: syz-executor Not tainted 4.8.0+ #39
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
       ffff880031d97838 ffffffff829f835b ffff88001b5a1640 ffff8800081b0ec0
       ffff8800081b15a0 ffff8800081b6d20 ffff880031d97860 ffffffff8174d3cc
       ffff880031d978f0 ffff8800081b0e80 ffff88001b5a1640 ffff880031d978e0
      Call Trace:
       [<ffffffff829f835b>] dump_stack+0xb3/0x118 lib/dump_stack.c:15
       [<ffffffff8174d3cc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156
       [<     inline     >] print_address_description mm/kasan/report.c:194
       [<ffffffff8174d666>] kasan_report_error+0x1f6/0x4d0 mm/kasan/report.c:283
       [<     inline     >] kasan_report mm/kasan/report.c:303
       [<ffffffff8174db7e>] __asan_report_store8_noabort+0x3e/0x40 mm/kasan/report.c:329
       [<     inline     >] __write_once_size ./include/linux/compiler.h:249
       [<     inline     >] __hlist_del ./include/linux/list.h:622
       [<     inline     >] hlist_del_init ./include/linux/list.h:637
       [<ffffffff8579047e>] l2tp_ip6_close+0x22e/0x290 net/l2tp/l2tp_ip6.c:239
       [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415
       [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422
       [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570
       [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017
       [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208
       [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244
       [<ffffffff813774f9>] task_work_run+0xf9/0x170
       [<ffffffff81324aae>] do_exit+0x85e/0x2a00
       [<ffffffff81326dc8>] do_group_exit+0x108/0x330
       [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307
       [<ffffffff811b49af>] do_signal+0x7f/0x18f0
       [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156
       [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:190
       [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259
       [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6
      Object at ffff8800081b0ec0, in cache L2TP/IPv6 size: 1448
      Allocated:
      PID = 10987
       [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20
       [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0
       [ 1116.897025] [<ffffffff8174c9ad>] kasan_kmalloc+0xad/0xe0
       [ 1116.897025] [<ffffffff8174cee2>] kasan_slab_alloc+0x12/0x20
       [ 1116.897025] [<     inline     >] slab_post_alloc_hook mm/slab.h:417
       [ 1116.897025] [<     inline     >] slab_alloc_node mm/slub.c:2708
       [ 1116.897025] [<     inline     >] slab_alloc mm/slub.c:2716
       [ 1116.897025] [<ffffffff817476a8>] kmem_cache_alloc+0xc8/0x2b0 mm/slub.c:2721
       [ 1116.897025] [<ffffffff84c4f6a9>] sk_prot_alloc+0x69/0x2b0 net/core/sock.c:1326
       [ 1116.897025] [<ffffffff84c58ac8>] sk_alloc+0x38/0xae0 net/core/sock.c:1388
       [ 1116.897025] [<ffffffff851ddf67>] inet6_create+0x2d7/0x1000 net/ipv6/af_inet6.c:182
       [ 1116.897025] [<ffffffff84c4af7b>] __sock_create+0x37b/0x640 net/socket.c:1153
       [ 1116.897025] [<     inline     >] sock_create net/socket.c:1193
       [ 1116.897025] [<     inline     >] SYSC_socket net/socket.c:1223
       [ 1116.897025] [<ffffffff84c4b46f>] SyS_socket+0xef/0x1b0 net/socket.c:1203
       [ 1116.897025] [<ffffffff85e4d685>] entry_SYSCALL_64_fastpath+0x23/0xc6
      Freed:
      PID = 10987
       [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20
       [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0
       [ 1116.897025] [<ffffffff8174cf61>] kasan_slab_free+0x71/0xb0
       [ 1116.897025] [<     inline     >] slab_free_hook mm/slub.c:1352
       [ 1116.897025] [<     inline     >] slab_free_freelist_hook mm/slub.c:1374
       [ 1116.897025] [<     inline     >] slab_free mm/slub.c:2951
       [ 1116.897025] [<ffffffff81748b28>] kmem_cache_free+0xc8/0x330 mm/slub.c:2973
       [ 1116.897025] [<     inline     >] sk_prot_free net/core/sock.c:1369
       [ 1116.897025] [<ffffffff84c541eb>] __sk_destruct+0x32b/0x4f0 net/core/sock.c:1444
       [ 1116.897025] [<ffffffff84c5aca4>] sk_destruct+0x44/0x80 net/core/sock.c:1452
       [ 1116.897025] [<ffffffff84c5ad33>] __sk_free+0x53/0x220 net/core/sock.c:1460
       [ 1116.897025] [<ffffffff84c5af23>] sk_free+0x23/0x30 net/core/sock.c:1471
       [ 1116.897025] [<ffffffff84c5cb6c>] sk_common_release+0x28c/0x3e0 ./include/net/sock.h:1589
       [ 1116.897025] [<ffffffff8579044e>] l2tp_ip6_close+0x1fe/0x290 net/l2tp/l2tp_ip6.c:243
       [ 1116.897025] [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415
       [ 1116.897025] [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422
       [ 1116.897025] [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570
       [ 1116.897025] [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017
       [ 1116.897025] [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208
       [ 1116.897025] [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244
       [ 1116.897025] [<ffffffff813774f9>] task_work_run+0xf9/0x170
       [ 1116.897025] [<ffffffff81324aae>] do_exit+0x85e/0x2a00
       [ 1116.897025] [<ffffffff81326dc8>] do_group_exit+0x108/0x330
       [ 1116.897025] [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307
       [ 1116.897025] [<ffffffff811b49af>] do_signal+0x7f/0x18f0
       [ 1116.897025] [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156
       [ 1116.897025] [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:190
       [ 1116.897025] [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259
       [ 1116.897025] [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6
      Memory state around the buggy address:
       ffff8800081b0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
       ffff8800081b0e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      >ffff8800081b0e80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
                                                          ^
       ffff8800081b0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
       ffff8800081b0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      
      ==================================================================
      
      The same issue exists with l2tp_ip_bind() and l2tp_ip_bind_table.
      
      Fixes: c51ce497 ("l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case")
      Reported-by: default avatarBaozeng Ding <sploving1@gmail.com>
      Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Tested-by: default avatarBaozeng Ding <sploving1@gmail.com>
      Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      32c23116
    • Linus Torvalds's avatar
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 77079b13
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "Again a set of smaller fixes across several platforms (OMAP, Marvell,
        Allwinner, i.MX, etc).
      
        A handful of typo fixes and smaller missing contents from device
        trees, with some tweaks to OMAP mach files to deal with CPU feature
        print misformatting, potential NULL ptr dereference and one setup
        issue with UARTs"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ipmi/bt-bmc: change compatible node to 'aspeed, ast2400-ibt-bmc'
        ARM: dts: STiH410-b2260: Fix typo in spi0 chipselect definition
        ARM: dts: omap5: board-common: fix wrong SMPS6 (VDD-DDR3) voltage
        ARM: omap3: Add missing memory node in SOM-LV
        arm64: dts: marvell: add unique identifiers for Armada A8k SPI controllers
        arm64: dts: marvell: fix clocksource for CP110 slave SPI0
        arm64: dts: marvell: Fix typo in label name on Armada 37xx
        ASoC: omap-abe-twl6040: fix typo in bindings documentation
        dts: omap5: board-common: enable twl6040 headset jack detection
        dts: omap5: board-common: add phandle to reference Palmas gpadc
        ARM: OMAP2+: avoid NULL pointer dereference
        ARM: OMAP2+: PRM: initialize en_uart4_mask and grpsel_uart4_mask
        ARM: dts: omap3: Fix memory node in Torpedo board
        ARM: AM43XX: Select OMAP_INTERCONNECT in Kconfig
        ARM: OMAP3: Fix formatting of features printed
        ARM: dts: imx53-qsb: Fix regulator constraints
        ARM: dts: sun8i: fix the pinmux for UART1
      77079b13
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · d117b9ac
      Linus Torvalds authored
      Pull ext4 fixes from Ted Ts'o:
       "A security fix (so a maliciously corrupted file system image won't
        panic the kernel) and some fixes for CONFIG_VMAP_STACK"
      
      * tag 'ext4_for_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: sanity check the block and cluster size at mount time
        fscrypto: don't use on-stack buffer for key derivation
        fscrypto: don't use on-stack buffer for filename encryption
      d117b9ac
    • Theodore Ts'o's avatar
      ext4: sanity check the block and cluster size at mount time · 8cdf3372
      Theodore Ts'o authored
      If the block size or cluster size is insane, reject the mount.  This
      is important for security reasons (although we shouldn't be just
      depending on this check).
      
      Ref: http://www.securityfocus.com/archive/1/539661
      Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1332506Reported-by: default avatarBorislav Petkov <bp@alien8.de>
      Reported-by: default avatarNikolay Borisov <kernel@kyup.com>
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      Cc: stable@vger.kernel.org
      8cdf3372
    • Eric Biggers's avatar
      fscrypto: don't use on-stack buffer for key derivation · 0f0909e2
      Eric Biggers authored
      With the new (in 4.9) option to use a virtually-mapped stack
      (CONFIG_VMAP_STACK), stack buffers cannot be used as input/output for
      the scatterlist crypto API because they may not be directly mappable to
      struct page.  get_crypt_info() was using a stack buffer to hold the
      output from the encryption operation used to derive the per-file key.
      Fix it by using a heap buffer.
      
      This bug could most easily be observed in a CONFIG_DEBUG_SG kernel
      because this allowed the BUG in sg_set_buf() to be triggered.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      0f0909e2
    • Eric Biggers's avatar
      fscrypto: don't use on-stack buffer for filename encryption · 3c7018eb
      Eric Biggers authored
      With the new (in 4.9) option to use a virtually-mapped stack
      (CONFIG_VMAP_STACK), stack buffers cannot be used as input/output for
      the scatterlist crypto API because they may not be directly mappable to
      struct page.  For short filenames, fname_encrypt() was encrypting a
      stack buffer holding the padded filename.  Fix it by encrypting the
      filename in-place in the output buffer, thereby making the temporary
      buffer unnecessary.
      
      This bug could most easily be observed in a CONFIG_DEBUG_SG kernel
      because this allowed the BUG in sg_set_buf() to be triggered.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      3c7018eb
  5. 19 Nov, 2016 6 commits