- 09 May, 2017 14 commits
-
-
Eric Dumazet authored
syzkaller found a way to trigger double frees from ip_mc_drop_socket() It turns out that leave a copy of parent mc_list at accept() time, which is very bad. Very similar to commit 8b485ce6 ("tcp: do not inherit fastopen_req from parent") Initial report from Pray3r, completed by Andrey one. Thanks a lot to them ! Signed-off-by:
Eric Dumazet <edumazet@google.com> Reported-by:
Pray3r <pray3r.z@gmail.com> Reported-by:
Andrey Konovalov <andreyknvl@google.com> Tested-by:
David S. Miller <davem@davemloft.net>
-
David S. Miller authored
Yuval Mintz says: ==================== qed*: General fixes This series contain several fixes for qed and qede. - #1 [and ~#5] relate to XDP cleanups - #2 and #5 correct VF behavior - #3 and #4 fix and add missing configurations needed for RoCE & storage ==================== Signed-off-by: -
Mintz, Yuval authored
PFs and VFs share the same structure of NDOs today, and the VFs explicitly fails the ndo_xdp() callback stating it doesn't support XDP. This results in lots of: [qede_xdp:1032(enp131s2)]VFs don't support XDP ------------[ cut here ]------------ WARNING: CPU: 4 PID: 1426 at net/core/rtnetlink.c:1637 rtnl_dump_ifinfo+0x354/0x3c0 ... Call Trace: ? __alloc_skb+0x9b/0x1d0 netlink_dump+0x122/0x290 netlink_recvmsg+0x27d/0x430 sock_recvmsg+0x3d/0x50 ... As every dump request for the VF interface info would fail due to rtnl_xdp_fill() returning an error code. To resolve this, introduce a subset of the NDOs meant for the VF in a seperate structure and register that one instead for VFs, and omit the ndo_xdp initialization. Fixes: 40b8c454 ("qede: Prevent VFs from using XDP") Signed-off-by:Yuval Mintz <Yuval.Mintz@cavium.com> Signed-off-by:
-
Ram Amrani authored
When configuring the doorbell DPI address, driver aligns the start address to 4KB [HW-pages] instead of host PAGE_SIZE. As a result, RoCE applications might receive addresses which are unaligned to pages [when PAGE_SIZE > 4KB], which is a security risk. Fixes: 51ff1725 ("qed: Add support for RoCE hw init") Signed-off-by:
Ram Amrani <Ram.Amrani@cavium.com> Signed-off-by:
-
Mintz, Yuval authored
Driver doesn't pass the number of tasks to the QM init logic which would cause back-pressure in scenarios requiring many tasks [E.g., using max MRs] and thus reduced performance. Signed-off-by:
-
Mintz, Yuval authored
After previos changes in HW-stop scheme, VFs stopped sending CLOSE messages to their PFs when they unload. Fixes: 1226337a ("qed: Correct HW stop flow") Signed-off-by:
-
Suddarsana Reddy Kalluru authored
When (re|un)loading, Tx-queues belonging to XDP would not get freed. Fixes: cb6aeb07 ("qede: Add support for XDP_TX") Signed-off-by:
Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com> Signed-off-by:
-
David S. Miller authored
Tariq Toukan says: ==================== mlx4 misc fixes This patchset contains misc bug fixes from the team to the mlx4 Core and Eth drivers. Series generated against net commit: 32f1bc0f Revert "ipv4: restore rt->fi for reference counting" ==================== Signed-off-by:
-
Jack Morgenstein authored
Under SRIOV resource management, extra counters are allocated to VFs from a free pool. If that pool is empty, the ALLOC_RES command for a counter resource fails -- and this generates a misleading error message in the message log. Under SRIOV, each VF is allocated (i.e., guaranteed) 2 counters -- one counter per port. For ETH ports, the RoCE driver requests an additional counter (above the guaranteed counters). If that request fails, the VF RoCE driver simply uses the default (i.e., guaranteed) counter for that port. Thus, failing to allocate an additional counter does not constitute a problem, and the error message on the PF when this occurs should be reduced to debug level. Finally, to identify the situation that the reason for the failure is that no resources are available to grant to the VF, we modified the error returned by mlx4_grant_resource to -EDQUOT (Quota exceeded), which more accurately describes the error. Fixes: c3abb51b ("IB/mlx4: Add RoCE/IB dedicated counters") Signed-off-by:
Jack Morgenstein <jackm@dev.mellanox.co.il> Signed-off-by:
Tariq Toukan <tariqt@mellanox.com> Signed-off-by:
-
Talat Batheesh authored
Inserting steering rules with illegal ring is an invalid operation, block it. Fixes: 82067281 ('net/mlx4_en: Manage flow steering rules with ethtool') Signed-off-by:
Talat Batheesh <talatb@mellanox.com> Signed-off-by:
-
Kamal Heib authored
The error print within mlx4_en_calc_rx_buf() should be a debug print. Fixes: 51151a16 ('mlx4: allow order-0 memory allocations in RX path') Signed-off-by:
Kamal Heib <kamalh@mellanox.com> Signed-off-by:
-
Karim Eshapa authored
Use time_after() for time comparison with the new fix. Signed-off-by:
Karim Eshapa <karim.eshapa@gmail.com> Signed-off-by:
-
Kees Cook authored
Instead of a direct cross-type cast, use conatiner_of() to locate the embedded structure, even in the face of future struct layout randomization. Signed-off-by:
Kees Cook <keescook@chromium.org> Signed-off-by:
-
David S. Miller authored
This reverts commit 82486aa6. As implemented, this causes dangling netdevice refs. Reported-by:
Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by:
-
- 08 May, 2017 26 commits
-
-
Jon Mason authored
If an error is encountered in mdio_mux_init(), the error path will call mdiobus_free(). Since mdiobus_register() has been called prior to mdio_mux_init(), the bus->state will not be MDIOBUS_UNREGISTERED. This causes a BUG_ON() in mdiobus_free(). To correct this issue, add an error path for mdio_mux_init() which calls mdiobus_unregister() prior to mdiobus_free(). Signed-off-by:
Jon Mason <jon.mason@broadcom.com> Fixes: 98bc865a ("net: mdio-mux: Add MDIO mux driver for iProc SoCs") Acked-by:
Florian Fainelli <f.fainelli@gmail.com> Signed-off-by:
-
Grygorii Strashko authored
When users set flow control using ethtool the bits are set properly in the CPGMAC_SL MACCONTROL register, but the FIFO depth in the respective Port n Maximum FIFO Blocks (Pn_MAX_BLKS) registers remains set to the minimum size reset value. When receive flow control is enabled on a port, the port's associated FIFO block allocation must be adjusted. The port RX allocation must increase to accommodate the flow control runout. The TRM recommends numbers of 5 or 6. Hence, apply required Port FIFO configuration to Pn_MAX_BLKS.Pn_TX_MAX_BLKS=0xF and Pn_MAX_BLKS.Pn_RX_MAX_BLKS=0x5 during interface initialization. Cc: Schuyler Patton <spatton@ti.com> Signed-off-by:
Grygorii Strashko <grygorii.strashko@ti.com> Signed-off-by:
-
WANG Cong authored
For each netns (except init_net), we initialize its null entry in 3 places: 1) The template itself, as we use kmemdup() 2) Code around dst_init_metrics() in ip6_route_net_init() 3) ip6_route_dev_notify(), which is supposed to initialize it after loopback registers Unfortunately the last one still happens in a wrong order because we expect to initialize net->ipv6.ip6_null_entry->rt6i_idev to net->loopback_dev's idev, thus we have to do that after we add idev to loopback. However, this notifier has priority == 0 same as ipv6_dev_notf, and ipv6_dev_notf is registered after ip6_route_dev_notifier so it is called actually after ip6_route_dev_notifier. This is similar to commit 2f460933 ("ipv6: initialize route null entry in addrconf_init()") which fixes init_net. Fix it by picking a smaller priority for ip6_route_dev_notifier. Also, we have to release the refcnt accordingly when unregistering loopback_dev because device exit functions are called before subsys exit functions. Acked-by:
David Ahern <dsahern@gmail.com> Tested-by:
Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by:
-
David S. Miller authored
Merge tag 'mac80211-for-davem-2017-05-08' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== A couple more fixes: * don't try to authenticate during reconfiguration, which causes drivers to get confused * fix a kernel-doc warning for a recently merged change * fix MU-MIMO group configuration (relevant only for monitor mode) * more rate flags fix: remove stray RX_ENC_FLAG_40MHZ * fix IBSS probe response allocation size ==================== Signed-off-by:
-
Jim Baxter authored
The zero padding that is added to NTB's does not zero the memory correctly. This is because the skb_put modifies the value of skb_out->len which results in the memset command not setting any memory to zero as (ctx->tx_max - skb_out->len) == 0. I have resolved this by storing the size of the memory to be zeroed before the skb_put and using this in the memset call. Signed-off-by:
Jim Baxter <jim_baxter@mentor.com> Reviewed-by:
Bjørn Mork <bjorn@mork.no> Signed-off-by:
-
David S. Miller authored
Andy Shevchenko says: ==================== stmmac: pci: Fix crash on Intel Galileo Gen2 Due to misconfiguration of PCI driver for Intel Quark the user will get a kernel crash: udhcpc: started, v1.26.2 stmmaceth 0000:00:14.6 eth0: device MAC address 98:4f:ee:05:ac:47 Generic PHY stmmac-a6:01: attached PHY driver [Generic PHY] (mii_bus:phy_addr=stmmac-a6:01, irq=-1) stmmaceth 0000:00:14.6 eth0: IEEE 1588-2008 Advanced Timestamp supported stmmaceth 0000:00:14.6 eth0: registered PTP clock IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready udhcpc: sending discover stmmaceth 0000:00:14.6 eth0: Link is Up - 100Mbps/Full - flow control off IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready BUG: unable to handle kernel NULL pointer dereference at (null) IP: stmmac_xmit+0xf1/0x1080 Fix this by adding necessary settings. P.S. I split fix to three patches according to what each of them adds. ==================== Tested-by:
Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by:
-
Andy Shevchenko authored
New helper is added in order to prevent misconfiguration happened for one of the platforms when configuration data is expanded. Signed-off-by:
Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by:
Joao Pinto <jpinto@synopsys.com> Signed-off-by:
-
Andy Shevchenko authored
The commit abe80fdc ("net: stmmac: RX queue routing configuration") missed Intel Quark configuration. Append it here. Fixes: abe80fdc ("net: stmmac: RX queue routing configuration") Cc: Joao Pinto <Joao.Pinto@synopsys.com> Signed-off-by:
-
Andy Shevchenko authored
The commit a8f5102a ("net: stmmac: TX and RX queue priority configuration") missed Intel Quark configuration. Append it here. Fixes: a8f5102a ("net: stmmac: TX and RX queue priority configuration") Cc: Joao Pinto <Joao.Pinto@synopsys.com> Signed-off-by:
-
Andy Shevchenko authored
The commit 26d6851f ("net: stmmac: set default number of rx and tx queues in stmmac_pci") missed Intel Quark configuration. Append it here. Fixes: 26d6851f ("net: stmmac: set default number of rx and tx queues in stmmac_pci") Cc: Joao Pinto <Joao.Pinto@synopsys.com> Signed-off-by:
Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by:
-
Hangbin Liu authored
Signed-off-by:
Hangbin Liu <liuhangbin@gmail.com> Signed-off-by:
-
Daniel Borkmann authored
The patch fixes two things at once: 1) It checks the env->allow_ptr_leaks and only prints the map address to the log if we have the privileges to do so, otherwise it just dumps 0 as we would when kptr_restrict is enabled on %pK. Given the latter is off by default and not every distro sets it, I don't want to rely on this, hence the 0 by default for unprivileged. 2) Printing of ldimm64 in the verifier log is currently broken in that we don't print the full immediate, but only the 32 bit part of the first insn part for ldimm64. Thus, fix this up as well; it's okay to access, since we verified all ldimm64 earlier already (including just constants) through replace_map_fd_with_map_ptr(). Fixes: 1be7f75d ("bpf: enable non-root eBPF programs") Fixes: cbd35700 ("bpf: verifier (add ability to receive verification log)") Reported-by:
Jann Horn <jannh@google.com> Signed-off-by:
Daniel Borkmann <daniel@iogearbox.net> Acked-by:
Alexei Starovoitov <ast@kernel.org> Signed-off-by:
-
Geliang Tang authored
Use memdup_user() helper instead of open-coding to simplify the code. Signed-off-by:
Geliang Tang <geliangtang@gmail.com> Signed-off-by:
-
Geliang Tang authored
Use memdup_user() helper instead of open-coding to simplify the code. Signed-off-by:
-
Ganesh Goudar authored
Recent Chelsio firmware started using few port capablity bits to manage FEC and as driver was not aware of FEC changes those bits were zeroed, consequently disabling FEC. Avoid zeroing those bits and default to whatever the firmware tells us the Link is currently advertising. Signed-off-by:
Ganesh Goudar <ganeshgr@chelsio.com> Signed-off-by:
-
Christophe Jaillet authored
If 'devm_kzalloc' fails, a NULL pointer will be dereferenced. Return -ENOMEM instead, as done for some other memory allocation just a few lines above. Fixes: 98cd1552 ("net: dsa: Mock-up driver") Signed-off-by:
Christophe JAILLET <christophe.jaillet@wanadoo.fr> Reviewed-by:
Andrew Lunn <andrew@lunn.ch> Acked-by:
-
Hangbin Liu authored
Signed-off-by:
-
Dan Carpenter authored
We have the number of longs, but we need to calculate the number of bytes required. Fixes: c0c050c5 ("bnxt_en: New Broadcom ethernet driver.") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Acked-by:
Michael Chan <michael.chan@broadcom.com> Signed-off-by:
-
Kees Cook authored
Using memcpy() from a string that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. Instead, use strncpy() which will fill the trailing bytes with zeros. This was found with the future CONFIG_FORTIFY_SOURCE feature. Cc: Daniel Micay <danielmicay@gmail.com> Signed-off-by:
-
Kees Cook authored
Using memcpy() from a string that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. Instead, use strncpy() which will fill the trailing bytes with zeros. This was found with the future CONFIG_FORTIFY_SOURCE feature. Cc: Daniel Micay <danielmicay@gmail.com> Signed-off-by:
-
Kees Cook authored
Using memcpy() from a string that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. Instead, use strncpy() which will fill the trailing bytes with zeros. This was found with the future CONFIG_FORTIFY_SOURCE feature. Cc: Daniel Micay <danielmicay@gmail.com> Signed-off-by:
-
Vlad Yasevich authored
Vlan devices, like all other software devices, enable NETIF_F_HW_CSUM feature. However, unlike all the othe other software devices, vlans will switch to using IP|IPV6_CSUM features, if the underlying devices uses them. In these situations, checksum offload features on the vlan device can't be controlled via ethtool. This patch makes vlans keep HW_CSUM feature if the underlying device supports checksum offloading. This makes vlan devices behave like other software devices, and restores control to the user. A side-effect is that some offload settings (typically UFO) may be enabled on the vlan device while being disabled on the HW. However, the GSO code will correctly process the packets. This actually results in slightly better raw throughput. Signed-off-by:
Vladislav Yasevich <vyasevic@redhat.com> Acked-by:
Alexander Duyck <alexander.h.duyck@intel.com> Signed-off-by:
-
Wei Wang authored
Congestion control modules that want full control over congestion control behavior do not want the cwnd modifications controlled by the sysctl_tcp_slow_start_after_idle code path. So skip those code paths for CC modules that use the cong_control() API. As an example, those cwnd effects are not desired for the BBR congestion control algorithm. Fixes: c0402760 ("tcp: new CC hook to set sending rate with rate_sample in any CA state") Signed-off-by:
Wei Wang <weiwan@google.com> Signed-off-by:
Yuchung Cheng <ycheng@google.com> Signed-off-by:
Neal Cardwell <ncardwell@google.com> Signed-off-by:
-
WANG Cong authored
IPv4 dst could use fi->fib_metrics to store metrics but fib_info itself is refcnt'ed, so without taking a refcnt fi and fi->fib_metrics could be freed while dst metrics still points to it. This triggers use-after-free as reported by Andrey twice. This patch reverts commit 2860583f ("ipv4: Kill rt->fi") to restore this reference counting. It is a quick fix for -net and -stable, for -net-next, as Eric suggested, we can consider doing reference counting for metrics itself instead of relying on fib_info. IPv6 is very different, it copies or steals the metrics from mx6_config in fib6_commit_metrics() so probably doesn't need a refcnt. Decnet has already done the refcnt'ing, see dn_fib_semantic_match(). Fixes: 2860583f ("ipv4: Kill rt->fi") Reported-by:
-
Pavel Belous authored
This patch fixes the crash that happens when driver tries to collect statistics from already released "aq_vec" object. If adapter is in "down" state we still allow user to see statistics from HW. V2: fixed braces around "aq_vec_free". Fixes: 97bde5c4 ("net: ethernet: aquantia: Support for NIC-specific code") Signed-off-by:
Pavel Belous <pavel.belous@aquantia.com> Tested-by:
David Arcari <darcari@redhat.com> Signed-off-by:
-
Johannes Berg authored
Replace @results_wk with @report_results, which was missed in an earlier patch between revisions thereof. Fixes: b34939b9 ("cfg80211: add request id to cfg80211_sched_scan_*() api") Signed-off-by:
Johannes Berg <johannes.berg@intel.com> Acked-by:
Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by:
-
