1. 10 Jan, 2020 4 commits
    • Linus Torvalds's avatar
      Merge tag 'pstore-v5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · bef1d882
      Linus Torvalds authored
      Pull pstore fix from Kees Cook:
       "Cengiz Can forwarded a Coverity report about more problems with a rare
        pstore initialization error path, so the allocation lifetime was
        rearranged to avoid needing to share the kfree() responsibilities
        between caller and callee"
      
      * tag 'pstore-v5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        pstore/ram: Regularize prz label allocation lifetime
      bef1d882
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2020-01-10' of git://anongit.freedesktop.org/drm/drm · 6d25ef77
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Pre-LCA pull request I'm not sure how things will look next week,
        myself and Daniel are at LCA and I'm speaking quite late, so if I get
        my talk finished I'll probably process fixes.
      
        This week has a bunch of i915 fixes, some amdgpu fixes, one sun4i, one
        core MST, and one core fb_helper fix. More details below:
      
        core:
         - mst Fix NO_STOP_BIT bit offset (Wayne)
      
        fb_helper:
         - fb_helper: Fix bits_per_pixel param set behavior to round up
           (Geert)
      
        sun4i:
         - Fix RGB_DIV clock min divider on old hardware (Chen-Yu)
      
        amdgpu:
         - Stability fix for raven
         - Reduce pixel encoding to if max clock is exceeded on HDMI to allow
           additional high res modes
         - enable DRIVER_SYNCOBJ_TIMELINE for amdgpu
      
        i915:
         - Fix GitLab issue #446 causing GPU hangs: Do not restore invalid RS
           state
         - Fix GitLab issue #846: Restore coarse power gating that was
           disabled by initial RC66 context corruption security fixes.
         - Revert f6ec9483 ("drm/i915: extend audio CDCLK>=2*BCLK
           constraint to more platforms") to avoid screen flicker
         - Fix to fill in unitialized uabi_instance in virtual engine uAPI
         - Add two missing W/As for ICL and EHL"
      
      * tag 'drm-fixes-2020-01-10' of git://anongit.freedesktop.org/drm/drm:
        drm/amdgpu: add DRIVER_SYNCOBJ_TIMELINE to amdgpu
        drm/amd/display: Reduce HDMI pixel encoding if max clock is exceeded
        Revert "drm/amdgpu: Set no-retry as default."
        drm/fb-helper: Round up bits_per_pixel if possible
        drm/sun4i: tcon: Set RGB DCLK min. divider based on hardware model
        drm/i915/dp: Disable Port sync mode correctly on teardown
        drm/i915: Add Wa_1407352427:icl,ehl
        drm/i915: Add Wa_1408615072 and Wa_1407596294 to icl,ehl
        drm/i915/gt: Restore coarse power gating
        drm/i915/gt: Do not restore invalid RS state
        drm/i915: Limit audio CDCLK>=2*BCLK constraint back to GLK only
        drm/i915/gt: Mark up virtual engine uabi_instance
        drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ
      6d25ef77
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · 5e7c1b75
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
       "First RDMA subsystem updates for 5.5-rc. A very small set of fixes,
        most people seem to still be recovering from December!
      
        Five small driver fixes:
      
         - Fix error flow with MR allocation in bnxt_re
      
         - An errata work around for bnxt_re
      
         - Misuse of the workqueue API in hfi1
      
         - Protocol error in hfi1
      
         - Regression in 5.5 related to the mmap rework with i40iw"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        i40iw: Remove setting of VMA private data and use rdma_user_mmap_io
        IB/hfi1: Adjust flow PSN with the correct resync_psn
        IB/hfi1: Don't cancel unused work item
        RDMA/bnxt_re: Fix Send Work Entry state check while polling completions
        RDMA/bnxt_re: Avoid freeing MR resources if dereg fails
      5e7c1b75
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2020-01-09-1' of... · 023b3b0e
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2020-01-09-1' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      - Fix GitLab issue #446 causing GPU hangs: Do not restore invalid RS state
      - Fix GitLab issue #846: Restore coarse power gating that was disabled
        by initial RC66 context corruption security fixes.
      - Revert f6ec9483 ("drm/i915: extend audio CDCLK>=2*BCLK constraint to more platforms")
        to avoid screen flicker
      - Fix to fill in unitialized uabi_instance in virtual engine uAPI
      - Add two missing W/As for ICL and EHL
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200109133458.GA15558@jlahtine-desk.ger.corp.intel.com
      023b3b0e
  2. 09 Jan, 2020 9 commits
    • Linus Torvalds's avatar
      Merge tag 'gpio-v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · 4a3033ef
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "Here is a host of GPIO fixes for the v5.5 series. The ACPI fix is
        especially important, see summary below and in the commit for details:
      
         - Select GPIOLIB_IRQCHIP on the max77620 GPIO expander
      
         - Fix context restore in the Zynq driver
      
         - Create a new ACPI quirk handler for disabling wakeups on
           problematic hardware.
      
         - Fix a coding style issue on the mockup device"
      
      * tag 'gpio-v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism
        gpiolib: acpi: Turn dmi_system_id table into a generic quirk table
        gpio: zynq: Fix for bug in zynq_gpio_restore_context API
        gpio: max77620: Add missing dependency on GPIOLIB_IRQCHIP
        gpio: mockup: fix coding style
      4a3033ef
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v5.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · a6a55b52
      Linus Torvalds authored
      Pull pin control fixes from Linus Walleij:
       "Two fixes for pin control, not much to say about it, it's just regular
        driver fixes:
      
         - Fix erroneous shift in the Meson driver
      
         - Make Lochnagar select the GPIOLIB Kconfig symbol"
      
      * tag 'pinctrl-v5.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: meson: Fix wrong shift value when get drive-strength
        pinctrl: lochnagar: select GPIOLIB
      a6a55b52
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · b5b3159c
      Linus Torvalds authored
      Pull input fixes from Dmitry Torokhov:
       "Just a few small fixups here"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: imx_sc_key - only take the valid data from SCU firmware as key state
        Input: add safety guards to input_set_keycode()
        Input: input_event - fix struct padding on sparc64
        Input: uinput - always report EPOLLOUT
      b5b3159c
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid · e69ec487
      Linus Torvalds authored
      Pull HID fixes from Jiri Kosina:
      
       - fix for OOB in hiddev, from Dmitry Torokhov
      
       - _poll API fixes for hidraw, from Marcel Holtmann
      
       - functional fix for Steam driver, from Rodrigo Rivas Costa
      
       - a few new device IDs / device-specific quirks and other assorted
         smaller fixes
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
        HID: steam: Fix input device disappearing
        HID: intel-ish-hid: ipc: Add Tiger Lake PCI device ID
        drivers/hid/hid-multitouch.c: fix a possible null pointer access.
        HID: wacom: Recognize new MobileStudio Pro PID
        HID: intel-ish-hid: ipc: add CMP device id
        HID: hiddev: fix mess in hiddev_open()
        HID: hid-input: clear unmapped usages
        HID: Add quirk for incorrect input length on Lenovo Y720
        HID: asus: Ignore Asus vendor-page usage-code 0xff events
        HID: ite: Add USB id match for Acer SW5-012 keyboard dock
        HID: Add quirk for Xin-Mo Dual Controller
        HID: Fix slab-out-of-bounds read in hid_field_extract
        HID: multitouch: Add LG MELF0410 I2C touchscreen support
        HID: uhid: Fix returning EPOLLOUT from uhid_char_poll
        HID: hidraw: Fix returning EPOLLOUT from hidraw_poll
      e69ec487
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · a5f48c78
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Missing netns pointer init in arp_tables, from Florian Westphal.
      
       2) Fix normal tcp SACK being treated as D-SACK, from Pengcheng Yang.
      
       3) Fix divide by zero in sch_cake, from Wen Yang.
      
       4) Len passed to skb_put_padto() is wrong in qrtr code, from Carl
          Huang.
      
       5) cmd->obj.chunk is leaked in sctp code error paths, from Xin Long.
      
       6) cgroup bpf programs can be released out of order, fix from Roman
          Gushchin.
      
       7) Make sure stmmac debugfs entry name is changed when device name
          changes, from Jiping Ma.
      
       8) Fix memory leak in vlan_dev_set_egress_priority(), from Eric
          Dumazet.
      
       9) SKB leak in lan78xx usb driver, also from Eric Dumazet.
      
      10) Ridiculous TCA_FQ_QUANTUM values configured can cause loops in fq
          packet scheduler, reject them. From Eric Dumazet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (69 commits)
        tipc: fix wrong connect() return code
        tipc: fix link overflow issue at socket shutdown
        netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present
        netfilter: conntrack: dccp, sctp: handle null timeout argument
        atm: eni: fix uninitialized variable warning
        macvlan: do not assume mac_header is set in macvlan_broadcast()
        net: sch_prio: When ungrafting, replace with FIFO
        mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO
        MAINTAINERS: Remove myself as co-maintainer for qcom-ethqos
        gtp: fix bad unlock balance in gtp_encap_enable_socket
        pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
        tipc: remove meaningless assignment in Makefile
        tipc: do not add socket.o to tipc-y twice
        net: stmmac: dwmac-sun8i: Allow all RGMII modes
        net: stmmac: dwmac-sunxi: Allow all RGMII modes
        net: usb: lan78xx: fix possible skb leak
        net: stmmac: Fixed link does not need MDIO Bus
        vlan: vlan_changelink() should propagate errors
        vlan: fix memory leak in vlan_dev_set_egress_priority
        stmmac: debugfs entry name is not be changed when udev rename device name.
        ...
      a5f48c78
    • Rodrigo Rivas Costa's avatar
      HID: steam: Fix input device disappearing · 20eee6e5
      Rodrigo Rivas Costa authored
      The `connected` value for wired devices was not properly initialized,
      it must be set to `true` upon creation, because wired devices do not
      generate connection events.
      
      When a raw client (the Steam Client) uses the device, the input device
      is destroyed. Then, when the raw client finishes, it must be recreated.
      But since the `connected` variable was false this never happended.
      Signed-off-by: default avatarRodrigo Rivas Costa <rodrigorivascosta@gmail.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      20eee6e5
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-5.5-2020-01-08' of... · ac0c9d3f
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-5.5-2020-01-08' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
      
      amd-drm-fixes-5.5-2020-01-08:
      
      amdgpu:
      - Stability fix for raven
      - Reduce pixel encoding to if max clock is exceeded on HDMI
        to allow additional high res modes
      
      UAPI:
      - enable DRIVER_SYNCOBJ_TIMELINE for amdgpu
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexdeucher@gmail.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200108213649.5485-1-alexander.deucher@amd.com
      ac0c9d3f
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2020-01-08' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · 2c3addd8
      Dave Airlie authored
      mst: Fix NO_STOP_BIT bit offset (Wayne)
      sun4i: Fix RGB_DIV clock min divider on old hardware (Chen-Yu)
      fb_helper: Fix bits_per_pixel param set behavior to round up (Geert)
      
      Cc: Wayne Lin <Wayne.Lin@amd.com>
      Cc: Chen-Yu Tsai <wens@csie.org>
      Cc: Geert Uytterhoeven <geert+renesas@glider.be>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Sean Paul <sean@poorly.run>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200108205949.GA233273@art_vandelay
      2c3addd8
    • Kees Cook's avatar
      pstore/ram: Regularize prz label allocation lifetime · e163fdb3
      Kees Cook authored
      In my attempt to fix a memory leak, I introduced a double-free in the
      pstore error path. Instead of trying to manage the allocation lifetime
      between persistent_ram_new() and its callers, adjust the logic so
      persistent_ram_new() always takes a kstrdup() copy, and leaves the
      caller's allocation lifetime up to the caller. Therefore callers are
      _always_ responsible for freeing their label. Before, it only needed
      freeing when the prz itself failed to allocate, and not in any of the
      other prz failure cases, which callers would have no visibility into,
      which is the root design problem that lead to both the leak and now
      double-free bugs.
      Reported-by: default avatarCengiz Can <cengiz@kernel.wtf>
      Link: https://lore.kernel.org/lkml/d4ec59002ede4aaf9928c7f7526da87c@kernel.wtf
      Fixes: 8df955a3 ("pstore/ram: Fix error-path memory leak in persistent_ram_new() callers")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      e163fdb3
  3. 08 Jan, 2020 19 commits
    • Tuong Lien's avatar
      tipc: fix wrong connect() return code · 9546a0b7
      Tuong Lien authored
      The current 'tipc_wait_for_connect()' function does a wait-loop for the
      condition 'sk->sk_state != TIPC_CONNECTING' to conclude if the socket
      connecting has done. However, when the condition is met, it returns '0'
      even in the case the connecting is actually failed, the socket state is
      set to 'TIPC_DISCONNECTING' (e.g. when the server socket has closed..).
      This results in a wrong return code for the 'connect()' call from user,
      making it believe that the connection is established and go ahead with
      building, sending a message, etc. but finally failed e.g. '-EPIPE'.
      
      This commit fixes the issue by changing the wait condition to the
      'tipc_sk_connected(sk)', so the function will return '0' only when the
      connection is really established. Otherwise, either the socket 'sk_err'
      if any or '-ETIMEDOUT'/'-EINTR' will be returned correspondingly.
      Acked-by: default avatarYing Xue <ying.xue@windriver.com>
      Acked-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarTuong Lien <tuong.t.lien@dektech.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9546a0b7
    • Tuong Lien's avatar
      tipc: fix link overflow issue at socket shutdown · 49afb806
      Tuong Lien authored
      When a socket is suddenly shutdown or released, it will reject all the
      unreceived messages in its receive queue. This applies to a connected
      socket too, whereas there is only one 'FIN' message required to be sent
      back to its peer in this case.
      
      In case there are many messages in the queue and/or some connections
      with such messages are shutdown at the same time, the link layer will
      easily get overflowed at the 'TIPC_SYSTEM_IMPORTANCE' backlog level
      because of the message rejections. As a result, the link will be taken
      down. Moreover, immediately when the link is re-established, the socket
      layer can continue to reject the messages and the same issue happens...
      
      The commit refactors the '__tipc_shutdown()' function to only send one
      'FIN' in the situation mentioned above. For the connectionless case, it
      is unavoidable but usually there is no rejections for such socket
      messages because they are 'dest-droppable' by default.
      
      In addition, the new code makes the other socket states clear
      (e.g.'TIPC_LISTEN') and treats as a separate case to avoid misbehaving.
      Acked-by: default avatarYing Xue <ying.xue@windriver.com>
      Acked-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarTuong Lien <tuong.t.lien@dektech.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      49afb806
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · b73a6561
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for net:
      
      1) Missing netns context in arp_tables, from Florian Westphal.
      
      2) Underflow in flowtable reference counter, from wenxu.
      
      3) Fix incorrect ethernet destination address in flowtable offload,
         from wenxu.
      
      4) Check for status of neighbour entry, from wenxu.
      
      5) Fix NAT port mangling, from wenxu.
      
      6) Unbind callbacks from destroy path to cleanup hardware properly
         on flowtable removal.
      
      7) Fix missing casting statistics timestamp, add nf_flowtable_time_stamp
         and use it.
      
      8) NULL pointer exception when timeout argument is null in conntrack
         dccp and sctp protocol helpers, from Florian Westphal.
      
      9) Possible nul-dereference in ipset with IPSET_ATTR_LINENO, also from
         Florian.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b73a6561
    • Florian Westphal's avatar
      netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present · 22dad713
      Florian Westphal authored
      The set uadt functions assume lineno is never NULL, but it is in
      case of ip_set_utest().
      
      syzkaller managed to generate a netlink message that calls this with
      LINENO attr present:
      
      general protection fault: 0000 [#1] PREEMPT SMP KASAN
      RIP: 0010:hash_mac4_uadt+0x1bc/0x470 net/netfilter/ipset/ip_set_hash_mac.c:104
      Call Trace:
       ip_set_utest+0x55b/0x890 net/netfilter/ipset/ip_set_core.c:1867
       nfnetlink_rcv_msg+0xcf2/0xfb0 net/netfilter/nfnetlink.c:229
       netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
       nfnetlink_rcv+0x1ba/0x460 net/netfilter/nfnetlink.c:563
      
      pass a dummy lineno storage, its easier than patching all set
      implementations.
      
      This seems to be a day-0 bug.
      
      Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
      Reported-by: syzbot+34bd2369d38707f3f4a7@syzkaller.appspotmail.com
      Fixes: a7b4f989 ("netfilter: ipset: IP set core support")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Acked-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      22dad713
    • Florian Westphal's avatar
      netfilter: conntrack: dccp, sctp: handle null timeout argument · 1d9a7acd
      Florian Westphal authored
      The timeout pointer can be NULL which means we should modify the
      per-nets timeout instead.
      
      All do this, except sctp and dccp which instead give:
      
      general protection fault: 0000 [#1] PREEMPT SMP KASAN
      net/netfilter/nf_conntrack_proto_dccp.c:682
       ctnl_timeout_parse_policy+0x150/0x1d0 net/netfilter/nfnetlink_cttimeout.c:67
       cttimeout_default_set+0x150/0x1c0 net/netfilter/nfnetlink_cttimeout.c:368
       nfnetlink_rcv_msg+0xcf2/0xfb0 net/netfilter/nfnetlink.c:229
       netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
      
      Reported-by: syzbot+46a4ad33f345d1dd346e@syzkaller.appspotmail.com
      Fixes: c779e849 ("netfilter: conntrack: remove get_timeout() indirection")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      1d9a7acd
    • Arnd Bergmann's avatar
      atm: eni: fix uninitialized variable warning · 30780d08
      Arnd Bergmann authored
      With -O3, gcc has found an actual unintialized variable stored
      into an mmio register in two instances:
      
      drivers/atm/eni.c: In function 'discard':
      drivers/atm/eni.c:465:13: error: 'dma[1]' is used uninitialized in this function [-Werror=uninitialized]
         writel(dma[i*2+1],eni_dev->rx_dma+dma_wr*8+4);
                   ^
      drivers/atm/eni.c:465:13: error: 'dma[3]' is used uninitialized in this function [-Werror=uninitialized]
      
      Change the code to always write zeroes instead.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      30780d08
    • Eric Dumazet's avatar
      macvlan: do not assume mac_header is set in macvlan_broadcast() · 96cc4b69
      Eric Dumazet authored
      Use of eth_hdr() in tx path is error prone.
      
      Many drivers call skb_reset_mac_header() before using it,
      but others do not.
      
      Commit 6d1ccff6 ("net: reset mac header in dev_start_xmit()")
      attempted to fix this generically, but commit d346a3fa
      ("packet: introduce PACKET_QDISC_BYPASS socket option") brought
      back the macvlan bug.
      
      Lets add a new helper, so that tx paths no longer have
      to call skb_reset_mac_header() only to get a pointer
      to skb->data.
      
      Hopefully we will be able to revert 6d1ccff6
      ("net: reset mac header in dev_start_xmit()") and save few cycles
      in transmit fast path.
      
      BUG: KASAN: use-after-free in __get_unaligned_cpu32 include/linux/unaligned/packed_struct.h:19 [inline]
      BUG: KASAN: use-after-free in mc_hash drivers/net/macvlan.c:251 [inline]
      BUG: KASAN: use-after-free in macvlan_broadcast+0x547/0x620 drivers/net/macvlan.c:277
      Read of size 4 at addr ffff8880a4932401 by task syz-executor947/9579
      
      CPU: 0 PID: 9579 Comm: syz-executor947 Not tainted 5.5.0-rc4-syzkaller #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x197/0x210 lib/dump_stack.c:118
       print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
       __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
       kasan_report+0x12/0x20 mm/kasan/common.c:639
       __asan_report_load_n_noabort+0xf/0x20 mm/kasan/generic_report.c:145
       __get_unaligned_cpu32 include/linux/unaligned/packed_struct.h:19 [inline]
       mc_hash drivers/net/macvlan.c:251 [inline]
       macvlan_broadcast+0x547/0x620 drivers/net/macvlan.c:277
       macvlan_queue_xmit drivers/net/macvlan.c:520 [inline]
       macvlan_start_xmit+0x402/0x77f drivers/net/macvlan.c:559
       __netdev_start_xmit include/linux/netdevice.h:4447 [inline]
       netdev_start_xmit include/linux/netdevice.h:4461 [inline]
       dev_direct_xmit+0x419/0x630 net/core/dev.c:4079
       packet_direct_xmit+0x1a9/0x250 net/packet/af_packet.c:240
       packet_snd net/packet/af_packet.c:2966 [inline]
       packet_sendmsg+0x260d/0x6220 net/packet/af_packet.c:2991
       sock_sendmsg_nosec net/socket.c:639 [inline]
       sock_sendmsg+0xd7/0x130 net/socket.c:659
       __sys_sendto+0x262/0x380 net/socket.c:1985
       __do_sys_sendto net/socket.c:1997 [inline]
       __se_sys_sendto net/socket.c:1993 [inline]
       __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1993
       do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      RIP: 0033:0x442639
      Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00
      RSP: 002b:00007ffc13549e08 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
      RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000442639
      RDX: 000000000000000e RSI: 0000000020000080 RDI: 0000000000000003
      RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
      R13: 0000000000403bb0 R14: 0000000000000000 R15: 0000000000000000
      
      Allocated by task 9389:
       save_stack+0x23/0x90 mm/kasan/common.c:72
       set_track mm/kasan/common.c:80 [inline]
       __kasan_kmalloc mm/kasan/common.c:513 [inline]
       __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486
       kasan_kmalloc+0x9/0x10 mm/kasan/common.c:527
       __do_kmalloc mm/slab.c:3656 [inline]
       __kmalloc+0x163/0x770 mm/slab.c:3665
       kmalloc include/linux/slab.h:561 [inline]
       tomoyo_realpath_from_path+0xc5/0x660 security/tomoyo/realpath.c:252
       tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
       tomoyo_path_perm+0x230/0x430 security/tomoyo/file.c:822
       tomoyo_inode_getattr+0x1d/0x30 security/tomoyo/tomoyo.c:129
       security_inode_getattr+0xf2/0x150 security/security.c:1222
       vfs_getattr+0x25/0x70 fs/stat.c:115
       vfs_statx_fd+0x71/0xc0 fs/stat.c:145
       vfs_fstat include/linux/fs.h:3265 [inline]
       __do_sys_newfstat+0x9b/0x120 fs/stat.c:378
       __se_sys_newfstat fs/stat.c:375 [inline]
       __x64_sys_newfstat+0x54/0x80 fs/stat.c:375
       do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Freed by task 9389:
       save_stack+0x23/0x90 mm/kasan/common.c:72
       set_track mm/kasan/common.c:80 [inline]
       kasan_set_free_info mm/kasan/common.c:335 [inline]
       __kasan_slab_free+0x102/0x150 mm/kasan/common.c:474
       kasan_slab_free+0xe/0x10 mm/kasan/common.c:483
       __cache_free mm/slab.c:3426 [inline]
       kfree+0x10a/0x2c0 mm/slab.c:3757
       tomoyo_realpath_from_path+0x1a7/0x660 security/tomoyo/realpath.c:289
       tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
       tomoyo_path_perm+0x230/0x430 security/tomoyo/file.c:822
       tomoyo_inode_getattr+0x1d/0x30 security/tomoyo/tomoyo.c:129
       security_inode_getattr+0xf2/0x150 security/security.c:1222
       vfs_getattr+0x25/0x70 fs/stat.c:115
       vfs_statx_fd+0x71/0xc0 fs/stat.c:145
       vfs_fstat include/linux/fs.h:3265 [inline]
       __do_sys_newfstat+0x9b/0x120 fs/stat.c:378
       __se_sys_newfstat fs/stat.c:375 [inline]
       __x64_sys_newfstat+0x54/0x80 fs/stat.c:375
       do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      The buggy address belongs to the object at ffff8880a4932000
       which belongs to the cache kmalloc-4k of size 4096
      The buggy address is located 1025 bytes inside of
       4096-byte region [ffff8880a4932000, ffff8880a4933000)
      The buggy address belongs to the page:
      page:ffffea0002924c80 refcount:1 mapcount:0 mapping:ffff8880aa402000 index:0x0 compound_mapcount: 0
      raw: 00fffe0000010200 ffffea0002846208 ffffea00028f3888 ffff8880aa402000
      raw: 0000000000000000 ffff8880a4932000 0000000100000001 0000000000000000
      page dumped because: kasan: bad access detected
      
      Memory state around the buggy address:
       ffff8880a4932300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
       ffff8880a4932380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      >ffff8880a4932400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
       ffff8880a4932480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
       ffff8880a4932500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      
      Fixes: b863ceb7 ("[NET]: Add macvlan driver")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      96cc4b69
    • David S. Miller's avatar
      Merge branch 'net-ungraft-prio' · 2f806c2a
      David S. Miller authored
      Petr Machata says:
      
      ====================
      When ungrafting from PRIO, replace child with FIFO
      
      When a child Qdisc is removed from one of the PRIO Qdisc's bands, it is
      replaced unconditionally by a NOOP qdisc. As a result, any traffic hitting
      that band gets dropped. That is incorrect--no Qdisc was explicitly added
      when PRIO was created, and after removal, none should have to be added
      either.
      
      In patch #2, this problem is fixed for PRIO by first attempting to create a
      default Qdisc and only falling back to noop when that fails. This pattern
      of attempting to create an invisible FIFO, using NOOP only as a fallback,
      is also seen in some other Qdiscs.
      
      The only driver currently offloading PRIO (and thus presumably the only one
      impacted by this) is mlxsw. Therefore patch #1 extends mlxsw to handle the
      replacement by an invisible FIFO gracefully.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2f806c2a
    • Petr Machata's avatar
      net: sch_prio: When ungrafting, replace with FIFO · 240ce7f6
      Petr Machata authored
      When a child Qdisc is removed from one of the PRIO Qdisc's bands, it is
      replaced unconditionally by a NOOP qdisc. As a result, any traffic hitting
      that band gets dropped. That is incorrect--no Qdisc was explicitly added
      when PRIO was created, and after removal, none should have to be added
      either.
      
      Fix PRIO by first attempting to create a default Qdisc and only falling
      back to noop when that fails. This pattern of attempting to create an
      invisible FIFO, using NOOP only as a fallback, is also seen in other
      Qdiscs.
      
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Signed-off-by: default avatarPetr Machata <petrm@mellanox.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      240ce7f6
    • Petr Machata's avatar
      mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO · 3971a535
      Petr Machata authored
      The following patch will change PRIO to replace a removed Qdisc with an
      invisible FIFO, instead of NOOP. mlxsw will see this replacement due to the
      graft message that is generated. But because FIFO does not issue its own
      REPLACE message, when the graft operation takes place, the Qdisc that mlxsw
      tracks under the indicated band is still the old one. The child
      handle (0:0) therefore does not match, and mlxsw rejects the graft
      operation, which leads to an extack message:
      
          Warning: Offloading graft operation failed.
      
      Fix by ignoring the invisible children in the PRIO graft handler. The
      DESTROY message of the removed Qdisc is going to follow shortly and handle
      the removal.
      
      Fixes: 32dc5efc ("mlxsw: spectrum: qdiscs: prio: Handle graft command")
      Signed-off-by: default avatarPetr Machata <petrm@mellanox.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3971a535
    • Niklas Cassel's avatar
      MAINTAINERS: Remove myself as co-maintainer for qcom-ethqos · cb6f74a1
      Niklas Cassel authored
      As I am no longer with Linaro, I no longer have access to documentation
      for this IP. The Linaro email will start bouncing soon.
      
      Vinod is fully capable to maintain this driver by himself, therefore
      remove myself as co-maintainer for qcom-ethqos.
      Signed-off-by: default avatarNiklas Cassel <niklas.cassel@wdc.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cb6f74a1
    • Eric Dumazet's avatar
      gtp: fix bad unlock balance in gtp_encap_enable_socket · 90d72256
      Eric Dumazet authored
      WARNING: bad unlock balance detected!
      5.5.0-rc5-syzkaller #0 Not tainted
      -------------------------------------
      syz-executor921/9688 is trying to release lock (sk_lock-AF_INET6) at:
      [<ffffffff84bf8506>] gtp_encap_enable_socket+0x146/0x400 drivers/net/gtp.c:830
      but there are no more locks to release!
      
      other info that might help us debug this:
      2 locks held by syz-executor921/9688:
       #0: ffffffff8a4d8840 (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
       #0: ffffffff8a4d8840 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x405/0xaf0 net/core/rtnetlink.c:5421
       #1: ffff88809304b560 (slock-AF_INET6){+...}, at: spin_lock_bh include/linux/spinlock.h:343 [inline]
       #1: ffff88809304b560 (slock-AF_INET6){+...}, at: release_sock+0x20/0x1c0 net/core/sock.c:2951
      
      stack backtrace:
      CPU: 0 PID: 9688 Comm: syz-executor921 Not tainted 5.5.0-rc5-syzkaller #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x197/0x210 lib/dump_stack.c:118
       print_unlock_imbalance_bug kernel/locking/lockdep.c:4008 [inline]
       print_unlock_imbalance_bug.cold+0x114/0x123 kernel/locking/lockdep.c:3984
       __lock_release kernel/locking/lockdep.c:4242 [inline]
       lock_release+0x5f2/0x960 kernel/locking/lockdep.c:4503
       sock_release_ownership include/net/sock.h:1496 [inline]
       release_sock+0x17c/0x1c0 net/core/sock.c:2961
       gtp_encap_enable_socket+0x146/0x400 drivers/net/gtp.c:830
       gtp_encap_enable drivers/net/gtp.c:852 [inline]
       gtp_newlink+0x9fc/0xc60 drivers/net/gtp.c:666
       __rtnl_newlink+0x109e/0x1790 net/core/rtnetlink.c:3305
       rtnl_newlink+0x69/0xa0 net/core/rtnetlink.c:3363
       rtnetlink_rcv_msg+0x45e/0xaf0 net/core/rtnetlink.c:5424
       netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
       rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442
       netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
       netlink_unicast+0x58c/0x7d0 net/netlink/af_netlink.c:1328
       netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917
       sock_sendmsg_nosec net/socket.c:639 [inline]
       sock_sendmsg+0xd7/0x130 net/socket.c:659
       ____sys_sendmsg+0x753/0x880 net/socket.c:2330
       ___sys_sendmsg+0x100/0x170 net/socket.c:2384
       __sys_sendmsg+0x105/0x1d0 net/socket.c:2417
       __do_sys_sendmsg net/socket.c:2426 [inline]
       __se_sys_sendmsg net/socket.c:2424 [inline]
       __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2424
       do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      RIP: 0033:0x445d49
      Code: e8 bc b7 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00
      RSP: 002b:00007f8019074db8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
      RAX: ffffffffffffffda RBX: 00000000006dac38 RCX: 0000000000445d49
      RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003
      RBP: 00000000006dac30 R08: 0000000000000004 R09: 0000000000000000
      R10: 0000000000000008 R11: 0000000000000246 R12: 00000000006dac3c
      R13: 00007ffea687f6bf R14: 00007f80190759c0 R15: 20c49ba5e353f7cf
      
      Fixes: e198987e ("gtp: fix suspicious RCU usage")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Cc: Taehee Yoo <ap420073@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      90d72256
    • Eric Dumazet's avatar
      pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM · d9e15a27
      Eric Dumazet authored
      As diagnosed by Florian :
      
      If TCA_FQ_QUANTUM is set to 0x80000000, fq_deueue()
      can loop forever in :
      
      if (f->credit <= 0) {
        f->credit += q->quantum;
        goto begin;
      }
      
      ... because f->credit is either 0 or -2147483648.
      
      Let's limit TCA_FQ_QUANTUM to no more than 1 << 20 :
      This max value should limit risks of breaking user setups
      while fixing this bug.
      
      Fixes: afe4fd06 ("pkt_sched: fq: Fair Queue packet scheduler")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Diagnosed-by: default avatarFlorian Westphal <fw@strlen.de>
      Reported-by: syzbot+dc9071cc5a85950bdfce@syzkaller.appspotmail.com
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d9e15a27
    • Masahiro Yamada's avatar
      tipc: remove meaningless assignment in Makefile · b969fee1
      Masahiro Yamada authored
      There is no module named tipc_diag.
      
      The assignment to tipc_diag-y has no effect.
      Signed-off-by: default avatarMasahiro Yamada <masahiroy@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b969fee1
    • Masahiro Yamada's avatar
      tipc: do not add socket.o to tipc-y twice · ea04b445
      Masahiro Yamada authored
      net/tipc/Makefile adds socket.o twice.
      
      tipc-y	+= addr.o bcast.o bearer.o \
                 core.o link.o discover.o msg.o  \
                 name_distr.o  subscr.o monitor.o name_table.o net.o  \
                 netlink.o netlink_compat.o node.o socket.o eth_media.o \
                                                   ^^^^^^^^
                 topsrv.o socket.o group.o trace.o
                          ^^^^^^^^
      Signed-off-by: default avatarMasahiro Yamada <masahiroy@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ea04b445
    • Chen-Yu Tsai's avatar
      net: stmmac: dwmac-sun8i: Allow all RGMII modes · f1239d8a
      Chen-Yu Tsai authored
      Allow all the RGMII modes to be used. This would allow us to represent
      the hardware better in the device tree with RGMII_ID where in most
      cases the PHY's internal delay for both RX and TX are used.
      
      Fixes: 9f93ac8d ("net-next: stmmac: Add dwmac-sun8i")
      Signed-off-by: default avatarChen-Yu Tsai <wens@csie.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f1239d8a
    • Chen-Yu Tsai's avatar
      net: stmmac: dwmac-sunxi: Allow all RGMII modes · 52cc73e5
      Chen-Yu Tsai authored
      Allow all the RGMII modes to be used. This would allow us to represent
      the hardware better in the device tree with RGMII_ID where in most
      cases the PHY's internal delay for both RX and TX are used.
      
      Fixes: af0bd4e9 ("net: stmmac: sunxi platform extensions for GMAC in Allwinner A20 SoC's")
      Signed-off-by: default avatarChen-Yu Tsai <wens@csie.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      52cc73e5
    • Linus Torvalds's avatar
      Merge tag 'tpmdd-next-20200108' of git://git.infradead.org/users/jjs/linux-tpmdd · b07f636f
      Linus Torvalds authored
      Pull more tpmd fixes from Jarkko Sakkinen:
       "One critical regression fix (the faulty commit got merged in rc3, but
        also marked for stable)"
      
      * tag 'tpmdd-next-20200108' of git://git.infradead.org/users/jjs/linux-tpmdd:
        tpm: Handle negative priv->response_len in tpm_common_read()
      b07f636f
    • Tadeusz Struk's avatar
      tpm: Handle negative priv->response_len in tpm_common_read() · a430e67d
      Tadeusz Struk authored
      The priv->response_length can hold the size of an response or an negative
      error code, and the tpm_common_read() needs to handle both cases correctly.
      Changed the type of response_length to signed and accounted for negative
      value in tpm_common_read().
      
      Cc: stable@vger.kernel.org
      Fixes: d23d1248 ("tpm: fix invalid locking in NONBLOCKING mode")
      Reported-by: default avatarLaura Abbott <labbott@redhat.com>
      Signed-off-by: default avatarTadeusz Struk <tadeusz.struk@intel.com>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      a430e67d
  4. 07 Jan, 2020 8 commits
    • Eric Dumazet's avatar
      net: usb: lan78xx: fix possible skb leak · 47240ba0
      Eric Dumazet authored
      If skb_linearize() fails, we need to free the skb.
      
      TSO makes skb bigger, and this bug might be the reason
      Raspberry Pi 3B+ users had to disable TSO.
      
      Fixes: 55d7de9d ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarRENARD Pierre-Francois <pfrenard@gmail.com>
      Cc: Stefan Wahren <stefan.wahren@i2se.com>
      Cc: Woojung Huh <woojung.huh@microchip.com>
      Cc: Microchip Linux Driver Support <UNGLinuxDriver@microchip.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      47240ba0
    • Jose Abreu's avatar
      net: stmmac: Fixed link does not need MDIO Bus · da29f2d8
      Jose Abreu authored
      When using fixed link we don't need the MDIO bus support.
      Reported-by: default avatarHeiko Stuebner <heiko@sntech.de>
      Reported-by: default avatarkernelci.org bot <bot@kernelci.org>
      Fixes: d3e014ec ("net: stmmac: platform: Fix MDIO init for platforms without PHY")
      Signed-off-by: default avatarJose Abreu <Jose.Abreu@synopsys.com>
      Acked-by: default avatarSriram Dash <Sriram.dash@samsung.com>
      Tested-by: default avatarPatrice Chotard <patrice.chotard@st.com>
      Tested-by: default avatarHeiko Stuebner <heiko@sntech.de>
      Acked-by: default avatarNeil Armstrong <narmstrong@baylibre.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Tested-by: Florian Fainelli <f.fainelli@gmail> # Lamobo R1 (fixed-link + MDIO sub node for roboswitch).
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      da29f2d8
    • David S. Miller's avatar
      Merge branch 'vlan-rtnetlink-newlink-fixes' · b57e1fff
      David S. Miller authored
      Eric Dumazet says:
      
      ====================
      vlan: rtnetlink newlink fixes
      
      First patch fixes a potential memory leak found by syzbot
      
      Second patch makes vlan_changelink() aware of errors
      and report them to user.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b57e1fff
    • Eric Dumazet's avatar
      vlan: vlan_changelink() should propagate errors · eb8ef2a3
      Eric Dumazet authored
      Both vlan_dev_change_flags() and vlan_dev_set_egress_priority()
      can return an error. vlan_changelink() should not ignore them.
      
      Fixes: 07b5b17e ("[VLAN]: Use rtnl_link API")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      eb8ef2a3
    • Eric Dumazet's avatar
      vlan: fix memory leak in vlan_dev_set_egress_priority · 9bbd917e
      Eric Dumazet authored
      There are few cases where the ndo_uninit() handler might be not
      called if an error happens while device is initialized.
      
      Since vlan_newlink() calls vlan_changelink() before
      trying to register the netdevice, we need to make sure
      vlan_dev_uninit() has been called at least once,
      or we might leak allocated memory.
      
      BUG: memory leak
      unreferenced object 0xffff888122a206c0 (size 32):
        comm "syz-executor511", pid 7124, jiffies 4294950399 (age 32.240s)
        hex dump (first 32 bytes):
          00 00 00 00 00 00 61 73 00 00 00 00 00 00 00 00  ......as........
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        backtrace:
          [<000000000eb3bb85>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
          [<000000000eb3bb85>] slab_post_alloc_hook mm/slab.h:586 [inline]
          [<000000000eb3bb85>] slab_alloc mm/slab.c:3320 [inline]
          [<000000000eb3bb85>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3549
          [<000000007b99f620>] kmalloc include/linux/slab.h:556 [inline]
          [<000000007b99f620>] vlan_dev_set_egress_priority+0xcc/0x150 net/8021q/vlan_dev.c:194
          [<000000007b0cb745>] vlan_changelink+0xd6/0x140 net/8021q/vlan_netlink.c:126
          [<0000000065aba83a>] vlan_newlink+0x135/0x200 net/8021q/vlan_netlink.c:181
          [<00000000fb5dd7a2>] __rtnl_newlink+0x89a/0xb80 net/core/rtnetlink.c:3305
          [<00000000ae4273a1>] rtnl_newlink+0x4e/0x80 net/core/rtnetlink.c:3363
          [<00000000decab39f>] rtnetlink_rcv_msg+0x178/0x4b0 net/core/rtnetlink.c:5424
          [<00000000accba4ee>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477
          [<00000000319fe20f>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442
          [<00000000d51938dc>] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
          [<00000000d51938dc>] netlink_unicast+0x223/0x310 net/netlink/af_netlink.c:1328
          [<00000000e539ac79>] netlink_sendmsg+0x2c0/0x570 net/netlink/af_netlink.c:1917
          [<000000006250c27e>] sock_sendmsg_nosec net/socket.c:639 [inline]
          [<000000006250c27e>] sock_sendmsg+0x54/0x70 net/socket.c:659
          [<00000000e2a156d1>] ____sys_sendmsg+0x2d0/0x300 net/socket.c:2330
          [<000000008c87466e>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2384
          [<00000000110e3054>] __sys_sendmsg+0x80/0xf0 net/socket.c:2417
          [<00000000d71077c8>] __do_sys_sendmsg net/socket.c:2426 [inline]
          [<00000000d71077c8>] __se_sys_sendmsg net/socket.c:2424 [inline]
          [<00000000d71077c8>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2424
      
      Fixe: 07b5b17e ("[VLAN]: Use rtnl_link API")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9bbd917e
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf · 96b11e93
      David S. Miller authored
      Daniel Borkmann says:
      
      ====================
      pull-request: bpf 2020-01-07
      
      The following pull-request contains BPF updates for your *net* tree.
      
      We've added 2 non-merge commits during the last 1 day(s) which contain
      a total of 2 files changed, 16 insertions(+), 4 deletions(-).
      
      The main changes are:
      
      1) Fix a use-after-free in cgroup BPF due to auto-detachment, from Roman Gushchin.
      
      2) Fix skb out-of-bounds access in ld_abs/ind instruction, from Daniel Borkmann.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      96b11e93
    • Jiping Ma's avatar
      stmmac: debugfs entry name is not be changed when udev rename device name. · 481a7d15
      Jiping Ma authored
      Add one notifier for udev changes net device name.
      Fixes: b6601323ef9e ("net: stmmac: debugfs entry name is not be changed when udev rename")
      Signed-off-by: default avatarJiping Ma <jiping.ma2@windriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      481a7d15
    • Shiraz Saleem's avatar
      i40iw: Remove setting of VMA private data and use rdma_user_mmap_io · 9554de39
      Shiraz Saleem authored
      vm_ops is now initialized in ib_uverbs_mmap() with the recent rdma mmap
      API changes. Earlier it was done in rdma_umap_priv_init() which would not
      be called unless a driver called rdma_user_mmap_io() in its mmap.
      
      i40iw does not use the rdma_user_mmap_io API but sets the vma's
      vm_private_data to a driver object. This now conflicts with the vm_op
      rdma_umap_close as priv pointer points to the i40iw driver object instead
      of the private data setup by core when rdma_user_mmap_io is called.  This
      leads to a crash in rdma_umap_close with a mmap put being called when it
      should not have.
      
      Remove the redundant setting of the vma private_data in i40iw as it is not
      used. Also move i40iw over to use the rdma_user_mmap_io API. This gives
      the extra protection of having the mappings zapped when the context is
      detsroyed.
      
        BUG: unable to handle page fault for address: 0000000100000001
        #PF: supervisor write access in kernel mode
        #PF: error_code(0x0002) - not-present page
        PGD 0 P4D 0
        Oops: 0002 [#1] SMP PTI
        CPU: 6 PID: 9528 Comm: rping Kdump: loaded Not tainted 5.5.0-rc4+ #117
        Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./Q87M-D2H, BIOS F7 01/17/2014
        RIP: 0010:rdma_user_mmap_entry_put+0xa/0x30 [ib_core]
        RSP: 0018:ffffb340c04c7c38 EFLAGS: 00010202
        RAX: 00000000ffffffff RBX: ffff9308e7be2a00 RCX: 000000000000cec0
        RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000100000001
        RBP: ffff9308dc7641f0 R08: 0000000000000001 R09: 0000000000000000
        R10: 0000000000000001 R11: ffffffff8d4414d8 R12: ffff93075182c780
        R13: 0000000000000001 R14: ffff93075182d2a8 R15: ffff9308e2ddc840
        FS:  0000000000000000(0000) GS:ffff9308fdc00000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 0000000100000001 CR3: 00000002e0412004 CR4: 00000000001606e0
        Call Trace:
         rdma_umap_close+0x40/0x90 [ib_uverbs]
         remove_vma+0x43/0x80
         exit_mmap+0xfd/0x1b0
         mmput+0x6e/0x130
         do_exit+0x290/0xcc0
         ? get_signal+0x152/0xc40
         do_group_exit+0x46/0xc0
         get_signal+0x1bd/0xc40
         ? prepare_to_wait_event+0x97/0x190
         do_signal+0x36/0x630
         ? remove_wait_queue+0x60/0x60
         ? __audit_syscall_exit+0x1d9/0x290
         ? rcu_read_lock_sched_held+0x52/0x90
         ? kfree+0x21c/0x2e0
         exit_to_usermode_loop+0x4f/0xc3
         do_syscall_64+0x1ed/0x270
         entry_SYSCALL_64_after_hwframe+0x49/0xbe
        RIP: 0033:0x7fae715a81fd
        Code: Bad RIP value.
        RSP: 002b:00007fae6e163cb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
        RAX: fffffffffffffe00 RBX: 00007fae6e163d30 RCX: 00007fae715a81fd
        RDX: 0000000000000010 RSI: 00007fae6e163cf0 RDI: 0000000000000003
        RBP: 00000000013413a0 R08: 00007fae68000000 R09: 0000000000000017
        R10: 0000000000000001 R11: 0000000000000293 R12: 00007fae680008c0
        R13: 00007fae6e163cf0 R14: 00007fae717c9804 R15: 00007fae6e163ed0
        CR2: 0000000100000001
        ---[ end trace b33d58d3a06782cb ]---
        RIP: 0010:rdma_user_mmap_entry_put+0xa/0x30 [ib_core]
      
      Fixes: b86deba9 ("RDMA/core: Move core content from ib_uverbs to ib_core")
      Link: https://lore.kernel.org/r/20200107162223.1745-1-shiraz.saleem@intel.comSigned-off-by: default avatarShiraz Saleem <shiraz.saleem@intel.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      9554de39