1. 16 Nov, 2019 5 commits
  2. 15 Nov, 2019 23 commits
  3. 14 Nov, 2019 3 commits
    • David S. Miller's avatar
      Merge tag 'linux-can-fixes-for-5.4-20191114' of... · d15a5020
      David S. Miller authored
      Merge tag 'linux-can-fixes-for-5.4-20191114' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
      
      Marc Kleine-Budde says:
      
      ====================
      pull-request: can 2019-11-14
      
      here another pull request for net/master consisting of one patch (including my S-o-b).
      
      Jouni Hogander's patch fixes a memory leak found by the syzbot in the slcan
      driver's error path.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d15a5020
    • David S. Miller's avatar
      Merge tag 'wireless-drivers-2019-11-14' of... · bb9b5441
      David S. Miller authored
      Merge tag 'wireless-drivers-2019-11-14' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
      
      Kalle Valo says:
      
      ====================
      wireless-drivers fixes for v5.4
      
      Hopefully last fixes for v5.4, only one iwlwifi fix this time.
      
      iwlwifi
      
      * fix A-MSDU data corruption when using CCMP/GCMP ciphers
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bb9b5441
    • Jouni Hogander's avatar
      slcan: Fix memory leak in error path · ed50e160
      Jouni Hogander authored
      This patch is fixing memory leak reported by Syzkaller:
      
      BUG: memory leak unreferenced object 0xffff888067f65500 (size 4096):
        comm "syz-executor043", pid 454, jiffies 4294759719 (age 11.930s)
        hex dump (first 32 bytes):
          73 6c 63 61 6e 30 00 00 00 00 00 00 00 00 00 00 slcan0..........
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
        backtrace:
          [<00000000a06eec0d>] __kmalloc+0x18b/0x2c0
          [<0000000083306e66>] kvmalloc_node+0x3a/0xc0
          [<000000006ac27f87>] alloc_netdev_mqs+0x17a/0x1080
          [<0000000061a996c9>] slcan_open+0x3ae/0x9a0
          [<000000001226f0f9>] tty_ldisc_open.isra.1+0x76/0xc0
          [<0000000019289631>] tty_set_ldisc+0x28c/0x5f0
          [<000000004de5a617>] tty_ioctl+0x48d/0x1590
          [<00000000daef496f>] do_vfs_ioctl+0x1c7/0x1510
          [<0000000059068dbc>] ksys_ioctl+0x99/0xb0
          [<000000009a6eb334>] __x64_sys_ioctl+0x78/0xb0
          [<0000000053d0332e>] do_syscall_64+0x16f/0x580
          [<0000000021b83b99>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
          [<000000008ea75434>] 0xffffffffffffffff
      
      Cc: Wolfgang Grandegger <wg@grandegger.com>
      Cc: Marc Kleine-Budde <mkl@pengutronix.de>
      Cc: Lukas Bulwahn <lukas.bulwahn@gmail.com>
      Signed-off-by: default avatarJouni Hogander <jouni.hogander@unikie.com>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      ed50e160
  4. 13 Nov, 2019 9 commits
    • Dan Carpenter's avatar
      net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size() · a56dcc6b
      Dan Carpenter authored
      This code is supposed to test for negative error codes and partial
      reads, but because sizeof() is size_t (unsigned) type then negative
      error codes are type promoted to high positive values and the condition
      doesn't work as expected.
      
      Fixes: 332f989a ("CDC-NCM: handle incomplete transfer of MTU")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a56dcc6b
    • Jouni Hogander's avatar
      slip: Fix memory leak in slip_open error path · 3b5a3997
      Jouni Hogander authored
      Driver/net/can/slcan.c is derived from slip.c. Memory leak was detected
      by Syzkaller in slcan. Same issue exists in slip.c and this patch is
      addressing the leak in slip.c.
      
      Here is the slcan memory leak trace reported by Syzkaller:
      
      BUG: memory leak unreferenced object 0xffff888067f65500 (size 4096):
        comm "syz-executor043", pid 454, jiffies 4294759719 (age 11.930s)
        hex dump (first 32 bytes):
          73 6c 63 61 6e 30 00 00 00 00 00 00 00 00 00 00 slcan0..........
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
        backtrace:
          [<00000000a06eec0d>] __kmalloc+0x18b/0x2c0
          [<0000000083306e66>] kvmalloc_node+0x3a/0xc0
          [<000000006ac27f87>] alloc_netdev_mqs+0x17a/0x1080
          [<0000000061a996c9>] slcan_open+0x3ae/0x9a0
          [<000000001226f0f9>] tty_ldisc_open.isra.1+0x76/0xc0
          [<0000000019289631>] tty_set_ldisc+0x28c/0x5f0
          [<000000004de5a617>] tty_ioctl+0x48d/0x1590
          [<00000000daef496f>] do_vfs_ioctl+0x1c7/0x1510
          [<0000000059068dbc>] ksys_ioctl+0x99/0xb0
          [<000000009a6eb334>] __x64_sys_ioctl+0x78/0xb0
          [<0000000053d0332e>] do_syscall_64+0x16f/0x580
          [<0000000021b83b99>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
          [<000000008ea75434>] 0xfffffffffffffff
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Oliver Hartkopp <socketcan@hartkopp.net>
      Cc: Lukas Bulwahn <lukas.bulwahn@gmail.com>
      Signed-off-by: default avatarJouni Hogander <jouni.hogander@unikie.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3b5a3997
    • Aleksander Morgado's avatar
      net: usb: qmi_wwan: add support for Foxconn T77W968 LTE modules · 802753cb
      Aleksander Morgado authored
      These are the Foxconn-branded variants of the Dell DW5821e modules,
      same USB layout as those.
      
      The QMI interface is exposed in USB configuration #1:
      
      P:  Vendor=0489 ProdID=e0b4 Rev=03.18
      S:  Manufacturer=FII
      S:  Product=T77W968 LTE
      S:  SerialNumber=0123456789ABCDEF
      C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
      I:  If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
      I:  If#=0x1 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=00 Prot=00 Driver=usbhid
      I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
      I:  If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
      I:  If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
      I:  If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
      Signed-off-by: default avatarAleksander Morgado <aleksander@aleksander.es>
      Acked-by: default avatarBjørn Mork <bjorn@mork.no>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      802753cb
    • David S. Miller's avatar
      Merge tag 'linux-can-fixes-for-5.4-20191113' of... · b3dff0eb
      David S. Miller authored
      Merge tag 'linux-can-fixes-for-5.4-20191113' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
      
      Marc Kleine-Budde says:
      
      ====================
      pull-request: can 2019-11-13
      
      this is a pull request of 9 patches for net/master, hopefully for the v5.4
      release cycle.
      
      All nine patches are by Oleksij Rempel and fix locking and use-after-free bugs
      in the j1939 stack found by the syzkaller syzbot.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b3dff0eb
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec · c3afb7ea
      David S. Miller authored
      Steffen Klassert says:
      
      ====================
      pull request (net): ipsec 2019-11-13
      
      1) Fix a page memleak on xfrm state destroy.
      
      2) Fix a refcount imbalance if a xfrm_state
         gets invaild during async resumption.
         From Xiaodong Xu.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c3afb7ea
    • Oleksij Rempel's avatar
      can: j1939: warn if resources are still linked on destroy · 4a15d574
      Oleksij Rempel authored
      j1939_session_destroy() and __j1939_priv_release() should be called only
      if session, ecu or socket are not linked or used by any one else. If at
      least one of these resources is linked, then the reference counting is
      broken somewhere.
      
      This warning will be triggered before KASAN will do, and will make it
      easier to debug initial issue. This works on platforms without KASAN
      support.
      Signed-off-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      4a15d574
    • Oleksij Rempel's avatar
      can: j1939: j1939_can_recv(): add priv refcounting · ddeeb7d4
      Oleksij Rempel authored
      j1939_can_recv() can be called in parallel with socket release. In this
      case sk_release and sk_destruct can be done earlier than
      j1939_can_recv() is processed.
      
      Reported-by: syzbot+ca172a0ac477ac90f045@syzkaller.appspotmail.com
      Reported-by: syzbot+07ca5bce8530070a5650@syzkaller.appspotmail.com
      Reported-by: syzbot+a47537d3964ef6c874e1@syzkaller.appspotmail.com
      Fixes: 9d71dd0c ("can: add support of SAE J1939 protocol")
      Signed-off-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      ddeeb7d4
    • Oleksij Rempel's avatar
      can: j1939: transport: j1939_cancel_active_session(): use... · 8d7a5f00
      Oleksij Rempel authored
      can: j1939: transport: j1939_cancel_active_session(): use hrtimer_try_to_cancel() instead of hrtimer_cancel()
      
      This part of the code protected by lock used in the hrtimer as well.
      Using hrtimer_cancel() will trigger dead lock.
      
      Fixes: 9d71dd0c ("can: add support of SAE J1939 protocol")
      Signed-off-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      8d7a5f00
    • Oleksij Rempel's avatar
      can: j1939: make sure socket is held as long as session exists · 62ebce1d
      Oleksij Rempel authored
      We link the socket to the session to be able provide socket specific
      notifications. For example messages over error queue.
      
      We need to keep the socket held, while we have a reference to it.
      
      Fixes: 9d71dd0c ("can: add support of SAE J1939 protocol")
      Signed-off-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      62ebce1d