1. 13 Sep, 2018 15 commits
    • Toke Høiland-Jørgensen's avatar
      gso_segment: Reset skb->mac_len after modifying network header · c56cae23
      Toke Høiland-Jørgensen authored
      When splitting a GSO segment that consists of encapsulated packets, the
      skb->mac_len of the segments can end up being set wrong, causing packet
      drops in particular when using act_mirred and ifb interfaces in
      combination with a qdisc that splits GSO packets.
      
      This happens because at the time skb_segment() is called, network_header
      will point to the inner header, throwing off the calculation in
      skb_reset_mac_len(). The network_header is subsequently adjust by the
      outer IP gso_segment handlers, but they don't set the mac_len.
      
      Fix this by adding skb_reset_mac_len() calls to both the IPv4 and IPv6
      gso_segment handlers, after they modify the network_header.
      
      Many thanks to Eric Dumazet for his help in identifying the cause of
      the bug.
      Acked-by: default avatarDave Taht <dave.taht@gmail.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarToke Høiland-Jørgensen <toke@toke.dk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c56cae23
    • David S. Miller's avatar
      Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth · bffb9b51
      David S. Miller authored
      Johan Hedberg says:
      
      ====================
      pull request: bluetooth 2018-09-13
      
      A few Bluetooth fixes for the 4.19-rc series:
      
       - Fixed rw_semaphore leak in hci_ldisc
       - Fixed local Out-of-Band pairing data handling
      
      Let me know if there are any issues pulling. Thanks.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bffb9b51
    • David S. Miller's avatar
      Merge branch 'tls-don-t-leave-keys-in-kernel-memory' · 79140335
      David S. Miller authored
      Sabrina Dubroca says:
      
      ====================
      tls: don't leave keys in kernel memory
      
      There are a few places where the RX/TX key for a TLS socket is copied
      to kernel memory. This series clears those memory areas when they're no
      longer needed.
      
      v2: add union tls_crypto_context, following Vakul Garg's comment
          swap patch 2 and 3, using new union in patch 3
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      79140335
    • Sabrina Dubroca's avatar
      c844eb46
    • Sabrina Dubroca's avatar
      tls: zero the crypto information from tls_context before freeing · 86029d10
      Sabrina Dubroca authored
      This contains key material in crypto_send_aes_gcm_128 and
      crypto_recv_aes_gcm_128.
      
      Introduce union tls_crypto_context, and replace the two identical
      unions directly embedded in struct tls_context with it. We can then
      use this union to clean up the memory in the new tls_ctx_free()
      function.
      
      Fixes: 3c4d7559 ("tls: kernel TLS support")
      Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      86029d10
    • Sabrina Dubroca's avatar
      tls: don't copy the key out of tls12_crypto_info_aes_gcm_128 · 7cba09c6
      Sabrina Dubroca authored
      There's no need to copy the key to an on-stack buffer before calling
      crypto_aead_setkey().
      
      Fixes: 3c4d7559 ("tls: kernel TLS support")
      Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7cba09c6
    • Vasily Khoruzhick's avatar
      neighbour: confirm neigh entries when ARP packet is received · f0e0d044
      Vasily Khoruzhick authored
      Update 'confirmed' timestamp when ARP packet is received. It shouldn't
      affect locktime logic and anyway entry can be confirmed by any higher-layer
      protocol. Thus it makes sense to confirm it when ARP packet is received.
      
      Fixes: 77d71233 ("neighbour: update neigh timestamps iff update is effective")
      Signed-off-by: default avatarVasily Khoruzhick <vasilykh@arista.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f0e0d044
    • Roopa Prabhu's avatar
      net: rtnl_configure_link: fix dev flags changes arg to __dev_notify_flags · 56a49d70
      Roopa Prabhu authored
      This fix addresses https://bugzilla.kernel.org/show_bug.cgi?id=201071
      
      Commit 5025f7f7 wrongly relied on __dev_change_flags to notify users of
      dev flag changes in the case when dev->rtnl_link_state = RTNL_LINK_INITIALIZED.
      Fix it by indicating flag changes explicitly to __dev_notify_flags.
      
      Fixes: 5025f7f7 ("rtnetlink: add rtnl_link_state check in rtnl_configure_link")
      Reported-By: default avatarLiam mcbirnie <liam.mcbirnie@boeing.com>
      Signed-off-by: default avatarRoopa Prabhu <roopa@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      56a49d70
    • Willy Tarreau's avatar
      net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT · 9824dfae
      Willy Tarreau authored
      Fields ->dev and ->next of struct ipddp_route may be copied to
      userspace on the SIOCFINDIPDDPRT ioctl. This is only accessible
      to CAP_NET_ADMIN though. Let's manually copy the relevant fields
      instead of using memcpy().
      
      BugLink: http://blog.infosectcbr.com.au/2018/09/linux-kernel-infoleaks.html
      Cc: Jann Horn <jannh@google.com>
      Signed-off-by: default avatarWilly Tarreau <w@1wt.eu>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9824dfae
    • Stephen Hemminger's avatar
      hv_netvsc: fix schedule in RCU context · 018349d7
      Stephen Hemminger authored
      When netvsc device is removed it can call reschedule in RCU context.
      This happens because canceling the subchannel setup work could (in theory)
      cause a reschedule when manipulating the timer.
      
      To reproduce, run with lockdep enabled kernel and unbind
      a network device from hv_netvsc (via sysfs).
      
      [  160.682011] WARNING: suspicious RCU usage
      [  160.707466] 4.19.0-rc3-uio+ #2 Not tainted
      [  160.709937] -----------------------------
      [  160.712352] ./include/linux/rcupdate.h:302 Illegal context switch in RCU read-side critical section!
      [  160.723691]
      [  160.723691] other info that might help us debug this:
      [  160.723691]
      [  160.730955]
      [  160.730955] rcu_scheduler_active = 2, debug_locks = 1
      [  160.762813] 5 locks held by rebind-eth.sh/1812:
      [  160.766851]  #0: 000000008befa37a (sb_writers#6){.+.+}, at: vfs_write+0x184/0x1b0
      [  160.773416]  #1: 00000000b097f236 (&of->mutex){+.+.}, at: kernfs_fop_write+0xe2/0x1a0
      [  160.783766]  #2: 0000000041ee6889 (kn->count#3){++++}, at: kernfs_fop_write+0xeb/0x1a0
      [  160.787465]  #3: 0000000056d92a74 (&dev->mutex){....}, at: device_release_driver_internal+0x39/0x250
      [  160.816987]  #4: 0000000030f6031e (rcu_read_lock){....}, at: netvsc_remove+0x1e/0x250 [hv_netvsc]
      [  160.828629]
      [  160.828629] stack backtrace:
      [  160.831966] CPU: 1 PID: 1812 Comm: rebind-eth.sh Not tainted 4.19.0-rc3-uio+ #2
      [  160.832952] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v1.0 11/26/2012
      [  160.832952] Call Trace:
      [  160.832952]  dump_stack+0x85/0xcb
      [  160.832952]  ___might_sleep+0x1a3/0x240
      [  160.832952]  __flush_work+0x57/0x2e0
      [  160.832952]  ? __mutex_lock+0x83/0x990
      [  160.832952]  ? __kernfs_remove+0x24f/0x2e0
      [  160.832952]  ? __kernfs_remove+0x1b2/0x2e0
      [  160.832952]  ? mark_held_locks+0x50/0x80
      [  160.832952]  ? get_work_pool+0x90/0x90
      [  160.832952]  __cancel_work_timer+0x13c/0x1e0
      [  160.832952]  ? netvsc_remove+0x1e/0x250 [hv_netvsc]
      [  160.832952]  ? __lock_is_held+0x55/0x90
      [  160.832952]  netvsc_remove+0x9a/0x250 [hv_netvsc]
      [  160.832952]  vmbus_remove+0x26/0x30
      [  160.832952]  device_release_driver_internal+0x18a/0x250
      [  160.832952]  unbind_store+0xb4/0x180
      [  160.832952]  kernfs_fop_write+0x113/0x1a0
      [  160.832952]  __vfs_write+0x36/0x1a0
      [  160.832952]  ? rcu_read_lock_sched_held+0x6b/0x80
      [  160.832952]  ? rcu_sync_lockdep_assert+0x2e/0x60
      [  160.832952]  ? __sb_start_write+0x141/0x1a0
      [  160.832952]  ? vfs_write+0x184/0x1b0
      [  160.832952]  vfs_write+0xbe/0x1b0
      [  160.832952]  ksys_write+0x55/0xc0
      [  160.832952]  do_syscall_64+0x60/0x1b0
      [  160.832952]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  160.832952] RIP: 0033:0x7fe48f4c8154
      
      Resolve this by getting RTNL earlier. This is safe because the subchannel
      work queue does trylock on RTNL and will detect the race.
      
      Fixes: 7b2ee50c ("hv_netvsc: common detach logic")
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Reviewed-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      018349d7
    • Cong Wang's avatar
      net_sched: notify filter deletion when deleting a chain · f5b9bac7
      Cong Wang authored
      When we delete a chain of filters, we need to notify
      user-space we are deleting each filters in this chain
      too.
      
      Fixes: 32a4f5ec ("net: sched: introduce chain object to uapi")
      Cc: Jiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f5b9bac7
    • Juergen Gross's avatar
      xen/netfront: don't bug in case of too many frags · ad4f15dc
      Juergen Gross authored
      Commit 57f230ab ("xen/netfront: raise max number of slots in
      xennet_get_responses()") raised the max number of allowed slots by one.
      This seems to be problematic in some configurations with netback using
      a larger MAX_SKB_FRAGS value (e.g. old Linux kernel with MAX_SKB_FRAGS
      defined as 18 instead of nowadays 17).
      
      Instead of BUG_ON() in this case just fall back to retransmission.
      
      Fixes: 57f230ab ("xen/netfront: raise max number of slots in xennet_get_responses()")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ad4f15dc
    • Xin Long's avatar
      ipv6: use rt6_info members when dst is set in rt6_fill_node · 22d0bd82
      Xin Long authored
      In inet6_rtm_getroute, since Commit 93531c67 ("net/ipv6: separate
      handling of FIB entries from dst based routes"), it has used rt->from
      to dump route info instead of rt.
      
      However for some route like cache, some of its information like flags
      or gateway is not the same as that of the 'from' one. It caused 'ip
      route get' to dump the wrong route information.
      
      In Jianlin's testing, the output information even lost the expiration
      time for a pmtu route cache due to the wrong fib6_flags.
      
      So change to use rt6_info members for dst addr, src addr, flags and
      gateway when it tries to dump a route entry without fibmatch set.
      
      v1->v2:
        - not use rt6i_prefsrc.
        - also fix the gw dump issue.
      
      Fixes: 93531c67 ("net/ipv6: separate handling of FIB entries from dst based routes")
      Reported-by: default avatarJianlin Shi <jishi@redhat.com>
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      22d0bd82
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2018-09-12' of git://anongit.freedesktop.org/drm/drm · 7428b2e5
      Linus Torvalds authored
      Pull drm nouveau fixes from Dave Airlie:
       "I'm sending this separately as it's a bit larger than I generally like
        for one driver, but it does contain a bunch of make my nvidia laptop
        not die (runpm) and a bunch to make my docking station and monitor
        display stuff (mst) fixes.
      
        Lyude has spent a lot of time on these, and we are putting the fixes
        into distro kernels as well asap, as it helps a bunch of standard
        Lenovo laptops, so I'm fairly happy things are better than they were
        before these patches, but I decided to split them out just for
        clarification"
      
      * tag 'drm-fixes-2018-09-12' of git://anongit.freedesktop.org/drm/drm:
        drm/nouveau/disp/gm200-: enforce identity-mapped SOR assignment for LVDS/eDP panels
        drm/nouveau/disp: fix DP disable race
        drm/nouveau/disp: move eDP panel power handling
        drm/nouveau/disp: remove unused struct member
        drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS
        drm/nouveau/mmu: don't attempt to dereference vmm without valid instance pointer
        drm/nouveau: fix oops in client init failure path
        drm/nouveau: Fix nouveau_connector_ddc_detect()
        drm/nouveau/drm/nouveau: Don't forget to cancel hpd_work on suspend/unload
        drm/nouveau/drm/nouveau: Prevent handling ACPI HPD events too early
        drm/nouveau: Reset MST branching unit before enabling
        drm/nouveau: Only write DP_MSTM_CTRL when needed
        drm/nouveau: Remove useless poll_enable() call in drm_load()
        drm/nouveau: Remove useless poll_disable() call in switcheroo_set_state()
        drm/nouveau: Remove useless poll_enable() call in switcheroo_set_state()
        drm/nouveau: Fix deadlocks in nouveau_connector_detect()
        drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in connector_detect()
        drm/nouveau/drm/nouveau: Fix deadlock with fb_helper with async RPM requests
        drm/nouveau: Remove duplicate poll_enable() in pmops_runtime_suspend()
        drm/nouveau/drm/nouveau: Fix bogus drm_kms_helper_poll_enable() placement
      7428b2e5
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 67b07609
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix up several Kconfig dependencies in netfilter, from Martin Willi
          and Florian Westphal.
      
       2) Memory leak in be2net driver, from Petr Oros.
      
       3) Memory leak in E-Switch handling of mlx5 driver, from Raed Salem.
      
       4) mlx5_attach_interface needs to check for errors, from Huy Nguyen.
      
       5) tipc_release() needs to orphan the sock, from Cong Wang.
      
       6) Need to program TxConfig register after TX/RX is enabled in r8169
          driver, not beforehand, from Maciej S. Szmigiero.
      
       7) Handle 64K PAGE_SIZE properly in ena driver, from Netanel Belgazal.
      
       8) Fix crash regression in ip_do_fragment(), from Taehee Yoo.
      
       9) syzbot can create conditions where kernel log is flooded with
          synflood warnings due to creation of many listening sockets, fix
          that. From Willem de Bruijn.
      
      10) Fix RCU issues in rds socket layer, from Cong Wang.
      
      11) Fix vlan matching in nfp driver, from Pieter Jansen van Vuuren.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (59 commits)
        nfp: flower: reject tunnel encap with ipv6 outer headers for offloading
        nfp: flower: fix vlan match by checking both vlan id and vlan pcp
        tipc: check return value of __tipc_dump_start()
        s390/qeth: don't dump past end of unknown HW header
        s390/qeth: use vzalloc for QUERY OAT buffer
        s390/qeth: switch on SG by default for IQD devices
        s390/qeth: indicate error when netdev allocation fails
        rds: fix two RCU related problems
        r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED
        erspan: fix error handling for erspan tunnel
        erspan: return PACKET_REJECT when the appropriate tunnel is not found
        tcp: rate limit synflood warnings further
        MIPS: lantiq: dma: add dev pointer
        netfilter: xt_hashlimit: use s->file instead of s->private
        netfilter: nfnetlink_queue: Solve the NFQUEUE/conntrack clash for NF_REPEAT
        netfilter: cttimeout: ctnl_timeout_find_get() returns incorrect pointer to type
        netfilter: conntrack: timeout interface depend on CONFIG_NF_CONNTRACK_TIMEOUT
        netfilter: conntrack: reset tcp maxwin on re-register
        qmi_wwan: Support dynamic config on Quectel EP06
        ethernet: renesas: convert to SPDX identifiers
        ...
      67b07609
  2. 12 Sep, 2018 19 commits
  3. 11 Sep, 2018 5 commits
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · 28a0ea77
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
       "This fixes one major regression with NFS and mlx4 due to the max_sg
        rework in this merge window, tidies a few minor error_path
        regressions, and various small fixes.
      
        The HFI1 driver is broken this cycle due to a regression caused by a
        PCI change, it is looking like Bjorn will merge a fix for this. Also,
        the lingering ipoib issue I mentioned earlier still remains unfixed.
      
        Summary:
      
         - Fix possible FD type confusion crash
      
         - Fix a user trigger-able crash in cxgb4
      
         - Fix bad handling of IOMMU resources causing user controlled leaking
           in bnxt
      
         - Add missing locking in ipoib to fix a rare 'stuck tx' situation
      
         - Add missing locking in cma
      
         - Add two missing missing uverbs cleanups on failure paths,
           regressions from this merge window
      
         - Fix a regression from this merge window that caused RDMA NFS to not
           work with the mlx4 driver due to the max_sg changes"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        RDMA/mlx4: Ensure that maximal send/receive SGE less than supported by HW
        RDMA/cma: Protect cma dev list with lock
        RDMA/uverbs: Fix error cleanup path of ib_uverbs_add_one()
        bnxt_re: Fix couple of memory leaks that could lead to IOMMU call traces
        IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler
        iw_cxgb4: only allow 1 flush on user qps
        IB/core: Release object lock if destroy failed
        RDMA/ucma: check fd type in ucma_migrate_id()
      28a0ea77
    • Hermes Zhang's avatar
      Bluetooth: hci_ldisc: Free rw_semaphore on close · e6a57d22
      Hermes Zhang authored
      The percpu_rw_semaphore is not currently freed, and this leads to
      a crash when the stale rcu callback is invoked.  DEBUG_OBJECTS
      detects this.
      
       ODEBUG: free active (active state 1) object type: rcu_head hint: (null)
       ------------[ cut here ]------------
       WARNING: CPU: 1 PID: 2024 at debug_print_object+0xac/0xc8
       PC is at debug_print_object+0xac/0xc8
       LR is at debug_print_object+0xac/0xc8
       Call trace:
       [<ffffff80082e2c2c>] debug_print_object+0xac/0xc8
       [<ffffff80082e40b0>] debug_check_no_obj_freed+0x1e8/0x228
       [<ffffff8008191254>] kfree+0x1cc/0x250
       [<ffffff80083cc03c>] hci_uart_tty_close+0x54/0x108
       [<ffffff800832e118>] tty_ldisc_close.isra.1+0x40/0x58
       [<ffffff800832e14c>] tty_ldisc_kill+0x1c/0x40
       [<ffffff800832e3dc>] tty_ldisc_release+0x94/0x170
       [<ffffff8008325554>] tty_release_struct+0x1c/0x58
       [<ffffff8008326400>] tty_release+0x3b0/0x490
       [<ffffff80081a3fe8>] __fput+0x88/0x1d0
       [<ffffff80081a418c>] ____fput+0xc/0x18
       [<ffffff80080c0624>] task_work_run+0x9c/0xc0
       [<ffffff80080a9e24>] do_exit+0x24c/0x8a0
       [<ffffff80080aa4e0>] do_group_exit+0x38/0xa0
       [<ffffff80080aa558>] __wake_up_parent+0x0/0x28
       [<ffffff8008082c00>] el0_svc_naked+0x34/0x38
       ---[ end trace bfe08cbd89098cdf ]---
      Signed-off-by: default avatarHermes Zhang <chenhuiz@axis.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      e6a57d22
    • Matias Karhumaa's avatar
      Bluetooth: Use correct tfm to generate OOB data · 4ba5175f
      Matias Karhumaa authored
      In case local OOB data was generated and other device initiated pairing
      claiming that it has got OOB data, following crash occurred:
      
      [  222.847853] general protection fault: 0000 [#1] SMP PTI
      [  222.848025] CPU: 1 PID: 42 Comm: kworker/u5:0 Tainted: G         C        4.18.0-custom #4
      [  222.848158] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
      [  222.848307] Workqueue: hci0 hci_rx_work [bluetooth]
      [  222.848416] RIP: 0010:compute_ecdh_secret+0x5a/0x270 [bluetooth]
      [  222.848540] Code: 0c af f5 48 8b 3d 46 de f0 f6 ba 40 00 00 00 be c0 00 60 00 e8 b7 7b c5 f5 48 85 c0 0f 84 ea 01 00 00 48 89 c3 e8 16 0c af f5 <49> 8b 47 38 be c0 00 60 00 8b 78 f8 48 83 c7 48 e8 51 84 c5 f5 48
      [  222.848914] RSP: 0018:ffffb1664087fbc0 EFLAGS: 00010293
      [  222.849021] RAX: ffff8a5750d7dc00 RBX: ffff8a5671096780 RCX: ffffffffc08bc32a
      [  222.849111] RDX: 0000000000000000 RSI: 00000000006000c0 RDI: ffff8a5752003800
      [  222.849192] RBP: ffffb1664087fc60 R08: ffff8a57525280a0 R09: ffff8a5752003800
      [  222.849269] R10: ffffb1664087fc70 R11: 0000000000000093 R12: ffff8a5674396e00
      [  222.849350] R13: ffff8a574c2e79aa R14: ffff8a574c2e796a R15: 020e0e100d010101
      [  222.849429] FS:  0000000000000000(0000) GS:ffff8a5752500000(0000) knlGS:0000000000000000
      [  222.849518] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  222.849586] CR2: 000055856016a038 CR3: 0000000110d2c005 CR4: 00000000000606e0
      [  222.849671] Call Trace:
      [  222.849745]  ? sc_send_public_key+0x110/0x2a0 [bluetooth]
      [  222.849825]  ? sc_send_public_key+0x115/0x2a0 [bluetooth]
      [  222.849925]  smp_recv_cb+0x959/0x2490 [bluetooth]
      [  222.850023]  ? _cond_resched+0x19/0x40
      [  222.850105]  ? mutex_lock+0x12/0x40
      [  222.850202]  l2cap_recv_frame+0x109d/0x3420 [bluetooth]
      [  222.850315]  ? l2cap_recv_frame+0x109d/0x3420 [bluetooth]
      [  222.850426]  ? __switch_to_asm+0x34/0x70
      [  222.850515]  ? __switch_to_asm+0x40/0x70
      [  222.850625]  ? __switch_to_asm+0x34/0x70
      [  222.850724]  ? __switch_to_asm+0x40/0x70
      [  222.850786]  ? __switch_to_asm+0x34/0x70
      [  222.850846]  ? __switch_to_asm+0x40/0x70
      [  222.852581]  ? __switch_to_asm+0x34/0x70
      [  222.854976]  ? __switch_to_asm+0x40/0x70
      [  222.857475]  ? __switch_to_asm+0x40/0x70
      [  222.859775]  ? __switch_to_asm+0x34/0x70
      [  222.861218]  ? __switch_to_asm+0x40/0x70
      [  222.862327]  ? __switch_to_asm+0x34/0x70
      [  222.863758]  l2cap_recv_acldata+0x266/0x3c0 [bluetooth]
      [  222.865122]  hci_rx_work+0x1c9/0x430 [bluetooth]
      [  222.867144]  process_one_work+0x210/0x4c0
      [  222.868248]  worker_thread+0x41/0x4d0
      [  222.869420]  kthread+0x141/0x160
      [  222.870694]  ? process_one_work+0x4c0/0x4c0
      [  222.871668]  ? kthread_create_worker_on_cpu+0x90/0x90
      [  222.872896]  ret_from_fork+0x35/0x40
      [  222.874132] Modules linked in: algif_hash algif_skcipher af_alg rfcomm bnep btusb btrtl btbcm btintel snd_intel8x0 cmac intel_rapl_perf vboxvideo(C) snd_ac97_codec bluetooth ac97_bus joydev ttm snd_pcm ecdh_generic drm_kms_helper snd_timer snd input_leds drm serio_raw fb_sys_fops soundcore syscopyarea sysfillrect sysimgblt mac_hid sch_fq_codel ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear hid_generic usbhid hid crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd cryptd glue_helper ahci psmouse libahci i2c_piix4 video e1000 pata_acpi
      [  222.883153] fbcon_switch: detected unhandled fb_set_par error, error code -16
      [  222.886774] fbcon_switch: detected unhandled fb_set_par error, error code -16
      [  222.890503] ---[ end trace 6504aa7a777b5316 ]---
      [  222.890541] RIP: 0010:compute_ecdh_secret+0x5a/0x270 [bluetooth]
      [  222.890551] Code: 0c af f5 48 8b 3d 46 de f0 f6 ba 40 00 00 00 be c0 00 60 00 e8 b7 7b c5 f5 48 85 c0 0f 84 ea 01 00 00 48 89 c3 e8 16 0c af f5 <49> 8b 47 38 be c0 00 60 00 8b 78 f8 48 83 c7 48 e8 51 84 c5 f5 48
      [  222.890555] RSP: 0018:ffffb1664087fbc0 EFLAGS: 00010293
      [  222.890561] RAX: ffff8a5750d7dc00 RBX: ffff8a5671096780 RCX: ffffffffc08bc32a
      [  222.890565] RDX: 0000000000000000 RSI: 00000000006000c0 RDI: ffff8a5752003800
      [  222.890571] RBP: ffffb1664087fc60 R08: ffff8a57525280a0 R09: ffff8a5752003800
      [  222.890576] R10: ffffb1664087fc70 R11: 0000000000000093 R12: ffff8a5674396e00
      [  222.890581] R13: ffff8a574c2e79aa R14: ffff8a574c2e796a R15: 020e0e100d010101
      [  222.890586] FS:  0000000000000000(0000) GS:ffff8a5752500000(0000) knlGS:0000000000000000
      [  222.890591] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  222.890594] CR2: 000055856016a038 CR3: 0000000110d2c005 CR4: 00000000000606e0
      
      This commit fixes a bug where invalid pointer to crypto tfm was used for
      SMP SC ECDH calculation when OOB was in use. Solution is to use same
      crypto tfm than when generating OOB material on generate_oob() function.
      
      This bug was introduced in commit c0153b0b ("Bluetooth: let the crypto
      subsystem generate the ecc privkey"). Bug was found by fuzzing kernel SMP
      implementation using Synopsys Defensics.
      Signed-off-by: default avatarMatias Karhumaa <matias.karhumaa@gmail.com>
      Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      4ba5175f
    • Johan Hedberg's avatar
      Bluetooth: SMP: Fix trying to use non-existent local OOB data · 94f14e47
      Johan Hedberg authored
      A remote device may claim that it has received our OOB data, even
      though we never geneated it. Add a new flag to track whether we
      actually have OOB data, and ignore the remote peer's flag if haven't
      generated OOB data.
      Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      94f14e47
    • Dave Airlie's avatar
      Merge branch 'linux-4.19' of git://github.com/skeggsb/linux into drm-fixes · 2887e5ce
      Dave Airlie authored
      A bunch of fixes for MST/runpm problems and races, as well as fixes
      for issues that prevent more recent laptops from booting.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Ben Skeggs <bskeggs@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/CABDvA==GF63dy8a9j611=-0x8G6FRu7uC-ZQypsLO_hqV4OAcA@mail.gmail.com
      2887e5ce
  4. 10 Sep, 2018 1 commit