1. 04 Jan, 2022 4 commits
  2. 03 Jan, 2022 2 commits
  3. 02 Jan, 2022 9 commits
  4. 01 Jan, 2022 3 commits
    • Haimin Zhang's avatar
      net ticp:fix a kernel-infoleak in __tipc_sendmsg() · d6d86830
      Haimin Zhang authored
      struct tipc_socket_addr.ref has a 4-byte hole,and __tipc_getname() currently
      copying it to user space,causing kernel-infoleak.
      
      BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline]
      BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] lib/usercopy.c:33
      BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 lib/usercopy.c:33
       instrument_copy_to_user include/linux/instrumented.h:121 [inline]
       instrument_copy_to_user include/linux/instrumented.h:121 [inline] lib/usercopy.c:33
       _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 lib/usercopy.c:33
       copy_to_user include/linux/uaccess.h:209 [inline]
       copy_to_user include/linux/uaccess.h:209 [inline] net/socket.c:287
       move_addr_to_user+0x3f6/0x600 net/socket.c:287 net/socket.c:287
       __sys_getpeername+0x470/0x6b0 net/socket.c:1987 net/socket.c:1987
       __do_sys_getpeername net/socket.c:1997 [inline]
       __se_sys_getpeername net/socket.c:1994 [inline]
       __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994
       __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994
       __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994
       do_syscall_x64 arch/x86/entry/common.c:51 [inline]
       do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82
       do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Uninit was stored to memory at:
       tipc_getname+0x575/0x5e0 net/tipc/socket.c:757 net/tipc/socket.c:757
       __sys_getpeername+0x3b3/0x6b0 net/socket.c:1984 net/socket.c:1984
       __do_sys_getpeername net/socket.c:1997 [inline]
       __se_sys_getpeername net/socket.c:1994 [inline]
       __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994
       __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994
       __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994
       do_syscall_x64 arch/x86/entry/common.c:51 [inline]
       do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82
       do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Uninit was stored to memory at:
       msg_set_word net/tipc/msg.h:212 [inline]
       msg_set_destport net/tipc/msg.h:619 [inline]
       msg_set_word net/tipc/msg.h:212 [inline] net/tipc/socket.c:1486
       msg_set_destport net/tipc/msg.h:619 [inline] net/tipc/socket.c:1486
       __tipc_sendmsg+0x44fa/0x5890 net/tipc/socket.c:1486 net/tipc/socket.c:1486
       tipc_sendmsg+0xeb/0x140 net/tipc/socket.c:1402 net/tipc/socket.c:1402
       sock_sendmsg_nosec net/socket.c:704 [inline]
       sock_sendmsg net/socket.c:724 [inline]
       sock_sendmsg_nosec net/socket.c:704 [inline] net/socket.c:2409
       sock_sendmsg net/socket.c:724 [inline] net/socket.c:2409
       ____sys_sendmsg+0xe11/0x12c0 net/socket.c:2409 net/socket.c:2409
       ___sys_sendmsg net/socket.c:2463 [inline]
       ___sys_sendmsg net/socket.c:2463 [inline] net/socket.c:2492
       __sys_sendmsg+0x704/0x840 net/socket.c:2492 net/socket.c:2492
       __do_sys_sendmsg net/socket.c:2501 [inline]
       __se_sys_sendmsg net/socket.c:2499 [inline]
       __do_sys_sendmsg net/socket.c:2501 [inline] net/socket.c:2499
       __se_sys_sendmsg net/socket.c:2499 [inline] net/socket.c:2499
       __x64_sys_sendmsg+0xe2/0x120 net/socket.c:2499 net/socket.c:2499
       do_syscall_x64 arch/x86/entry/common.c:51 [inline]
       do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82
       do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Local variable skaddr created at:
       __tipc_sendmsg+0x2d0/0x5890 net/tipc/socket.c:1419 net/tipc/socket.c:1419
       tipc_sendmsg+0xeb/0x140 net/tipc/socket.c:1402 net/tipc/socket.c:1402
      
      Bytes 4-7 of 16 are uninitialized
      Memory access of size 16 starts at ffff888113753e00
      Data copied to user address 0000000020000280
      
      Reported-by: syzbot+cdbd40e0c3ca02cae3b7@syzkaller.appspotmail.com
      Signed-off-by: default avatarHaimin Zhang <tcs_kernel@tencent.com>
      Acked-by: default avatarJon Maloy <jmaloy@redhat.com>
      Link: https://lore.kernel.org/r/1640918123-14547-1-git-send-email-tcs.kernel@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      d6d86830
    • Jianguo Wu's avatar
      selftests: net: udpgro_fwd.sh: explicitly checking the available ping feature · 5e75d0b2
      Jianguo Wu authored
      As Paolo pointed out, the result of ping IPv6 address depends on
      the running distro. So explicitly checking the available ping feature,
      as e.g. do the bareudp.sh self-tests.
      
      Fixes: 8b3170e0 ("selftests: net: using ping6 for IPv6 in udpgro_fwd.sh")
      Signed-off-by: default avatarJianguo Wu <wujianguo@chinatelecom.cn>
      Link: https://lore.kernel.org/r/825ee22b-4245-dbf7-d2f7-a230770d6e21@163.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      5e75d0b2
    • Jakub Kicinski's avatar
      Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf · 0f1fe7b8
      Jakub Kicinski authored
      Daniel Borkmann says:
      
      ====================
      pull-request: bpf 2021-12-31
      
      We've added 2 non-merge commits during the last 14 day(s) which contain
      a total of 2 files changed, 3 insertions(+), 3 deletions(-).
      
      The main changes are:
      
      1) Revert of an earlier attempt to fix xsk's poll() behavior where it
         turned out that the fix for a rare problem made it much worse in
         general, from Magnus Karlsson. (Fyi, Magnus mentioned that a proper
         fix is coming early next year, so the revert is mainly to avoid
         slipping the behavior into 5.16.)
      
      2) Minor misc spell fix in BPF selftests, from Colin Ian King.
      
      * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
        bpf, selftests: Fix spelling mistake "tained" -> "tainted"
        Revert "xsk: Do not sleep in poll() when need_wakeup set"
      ====================
      
      Link: https://lore.kernel.org/r/20211231160050.16105-1-daniel@iogearbox.netSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      0f1fe7b8
  5. 31 Dec, 2021 6 commits
  6. 30 Dec, 2021 12 commits
  7. 29 Dec, 2021 4 commits