1. 25 Jul, 2020 9 commits
    • Linus Torvalds's avatar
      Merge tag 'efi-urgent-2020-07-25' of... · 17baa442
      Linus Torvalds authored
      Merge tag 'efi-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull EFI fixes from Ingo Molnar:
       "Various EFI fixes:
      
         - Fix the layering violation in the use of the EFI runtime services
           availability mask in users of the 'efivars' abstraction
      
         - Revert build fix for GCC v4.8 which is no longer supported
      
         - Clean up some x86 EFI stub details, some of which are borderline
           bugs that copy around garbage into padding fields - let's fix these
           out of caution.
      
         - Fix build issues while working on RISC-V support
      
         - Avoid --whole-archive when linking the stub on arm64"
      
      * tag 'efi-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        efi: Revert "efi/x86: Fix build with gcc 4"
        efi/efivars: Expose RT service availability via efivars abstraction
        efi/libstub: Move the function prototypes to header file
        efi/libstub: Fix gcc error around __umoddi3 for 32 bit builds
        efi/libstub/arm64: link stub lib.a conditionally
        efi/x86: Only copy upto the end of setup_header
        efi/x86: Remove unused variables
      17baa442
    • Linus Torvalds's avatar
      Merge tag '5.8-rc6-cifs-fix' of git://git.samba.org/sfrench/cifs-2.6 into master · 7cb3a5c5
      Linus Torvalds authored
      Pull cifs fix from Steve French:
       "A fix for a recently discovered regression in rename to older servers
        caused by a recent patch"
      
      * tag '5.8-rc6-cifs-fix' of git://git.samba.org/sfrench/cifs-2.6:
        Revert "cifs: Fix the target file was deleted when rename failed."
      7cb3a5c5
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net into master · 1b64b2e2
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix RCU locaking in iwlwifi, from Johannes Berg.
      
       2) mt76 can access uninitialized NAPI struct, from Felix Fietkau.
      
       3) Fix race in updating pause settings in bnxt_en, from Vasundhara
          Volam.
      
       4) Propagate error return properly during unbind failures in ax88172a,
          from George Kennedy.
      
       5) Fix memleak in adf7242_probe, from Liu Jian.
      
       6) smc_drv_probe() can leak, from Wang Hai.
      
       7) Don't muck with the carrier state if register_netdevice() fails in
          the bonding driver, from Taehee Yoo.
      
       8) Fix memleak in dpaa_eth_probe, from Liu Jian.
      
       9) Need to check skb_put_padto() return value in hsr_fill_tag(), from
          Murali Karicheri.
      
      10) Don't lose ionic RSS hash settings across FW update, from Shannon
          Nelson.
      
      11) Fix clobbered SKB control block in act_ct, from Wen Xu.
      
      12) Missing newlink in "tx_timeout" sysfs output, from Xiongfeng Wang.
      
      13) IS_UDPLITE cleanup a long time ago, incorrectly handled
          transformations involving UDPLITE_RECV_CC. From Miaohe Lin.
      
      14) Unbalanced locking in netdevsim, from Taehee Yoo.
      
      15) Suppress false-positive error messages in qed driver, from Alexander
          Lobakin.
      
      16) Out of bounds read in ax25_connect and ax25_sendmsg, from Peilin Ye.
      
      17) Missing SKB release in cxgb4's uld_send(), from Navid Emamdoost.
      
      18) Uninitialized value in geneve_changelink(), from Cong Wang.
      
      19) Fix deadlock in xen-netfront, from Andera Righi.
      
      19) flush_backlog() frees skbs with IRQs disabled, so should use
          dev_kfree_skb_irq() instead of kfree_skb(). From Subash Abhinov
          Kasiviswanathan.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (111 commits)
        drivers/net/wan: lapb: Corrected the usage of skb_cow
        dev: Defer free of skbs in flush_backlog
        qrtr: orphan socket in qrtr_release()
        xen-netfront: fix potential deadlock in xennet_remove()
        flow_offload: Move rhashtable inclusion to the source file
        geneve: fix an uninitialized value in geneve_changelink()
        bonding: check return value of register_netdevice() in bond_newlink()
        tcp: allow at most one TLP probe per flight
        AX.25: Prevent integer overflows in connect and sendmsg
        cxgb4: add missing release on skb in uld_send()
        net: atlantic: fix PTP on AQC10X
        AX.25: Prevent out-of-bounds read in ax25_sendmsg()
        sctp: shrink stream outq when fails to do addstream reconf
        sctp: shrink stream outq only when new outcnt < old outcnt
        AX.25: Fix out-of-bounds read in ax25_connect()
        enetc: Remove the mdio bus on PF probe bailout
        net: ethernet: ti: add NETIF_F_HW_TC hw feature flag for taprio offload
        net: ethernet: ave: Fix error returns in ave_init
        drivers/net/wan/x25_asy: Fix to make it work
        ipvs: fix the connection sync failed in some cases
        ...
      1b64b2e2
    • Xie He's avatar
      drivers/net/wan: lapb: Corrected the usage of skb_cow · 8754e137
      Xie He authored
      This patch fixed 2 issues with the usage of skb_cow in LAPB drivers
      "lapbether" and "hdlc_x25":
      
      1) After skb_cow fails, kfree_skb should be called to drop a reference
      to the skb. But in both drivers, kfree_skb is not called.
      
      2) skb_cow should be called before skb_push so that is can ensure the
      safety of skb_push. But in "lapbether", it is incorrectly called after
      skb_push.
      
      More details about these 2 issues:
      
      1) The behavior of calling kfree_skb on failure is also the behavior of
      netif_rx, which is called by this function with "return netif_rx(skb);".
      So this function should follow this behavior, too.
      
      2) In "lapbether", skb_cow is called after skb_push. This results in 2
      logical issues:
         a) skb_push is not protected by skb_cow;
         b) An extra headroom of 1 byte is ensured after skb_push. This extra
            headroom has no use in this function. It also has no use in the
            upper-layer function that this function passes the skb to
            (x25_lapb_receive_frame in net/x25/x25_dev.c).
      So logically skb_cow should instead be called before skb_push.
      
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Martin Schiller <ms@dev.tdt.de>
      Signed-off-by: default avatarXie He <xie.he.0141@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8754e137
    • Subash Abhinov Kasiviswanathan's avatar
      dev: Defer free of skbs in flush_backlog · 7df5cb75
      Subash Abhinov Kasiviswanathan authored
      IRQs are disabled when freeing skbs in input queue.
      Use the IRQ safe variant to free skbs here.
      
      Fixes: 145dd5f9 ("net: flush the softnet backlog in process context")
      Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7df5cb75
    • Linus Torvalds's avatar
      Merge tag 'pci-v5.8-fixes-2' of... · 23ee3e4e
      Linus Torvalds authored
      Merge tag 'pci-v5.8-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci into master
      
      Pull PCI fixes from Bjorn Helgaas:
      
       - Reject invalid IRQ 0 command line argument for virtio_mmio because
         IRQ 0 now generates warnings (Bjorn Helgaas)
      
       - Revert "PCI/PM: Assume ports without DLL Link Active train links in
         100 ms", which broke nouveau (Bjorn Helgaas)
      
      * tag 'pci-v5.8-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        Revert "PCI/PM: Assume ports without DLL Link Active train links in 100 ms"
        virtio-mmio: Reject invalid IRQ 0 command line argument
      23ee3e4e
    • Cong Wang's avatar
      qrtr: orphan socket in qrtr_release() · af9f691f
      Cong Wang authored
      We have to detach sock from socket in qrtr_release(),
      otherwise skb->sk may still reference to this socket
      when the skb is released in tun->queue, particularly
      sk->sk_wq still points to &sock->wq, which leads to
      a UAF.
      
      Reported-and-tested-by: syzbot+6720d64f31c081c2f708@syzkaller.appspotmail.com
      Fixes: 28fb4e59 ("net: qrtr: Expose tunneling endpoint to user space")
      Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
      Cc: Eric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      af9f691f
    • David S. Miller's avatar
      Merge tag 'wireless-drivers-2020-07-24' of... · 657237f5
      David S. Miller authored
      Merge tag 'wireless-drivers-2020-07-24' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
      
      Kalle Valo says:
      
      ====================
      wireless-drivers fixes for v5.8
      
      Second set of fixes for v5.8, and hopefully also the last. Three
      important regressions fixed.
      
      ath9k
      
      * fix a regression which broke support for all ath9k usb devices
      
      ath10k
      
      * fix a regression which broke support for all QCA4019 AHB devices
      
      iwlwifi
      
      * fix a regression which broke support for some Killer Wireless-AC 1550 cards
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      657237f5
    • Andrea Righi's avatar
      xen-netfront: fix potential deadlock in xennet_remove() · c2c63310
      Andrea Righi authored
      There's a potential race in xennet_remove(); this is what the driver is
      doing upon unregistering a network device:
      
        1. state = read bus state
        2. if state is not "Closed":
        3.    request to set state to "Closing"
        4.    wait for state to be set to "Closing"
        5.    request to set state to "Closed"
        6.    wait for state to be set to "Closed"
      
      If the state changes to "Closed" immediately after step 1 we are stuck
      forever in step 4, because the state will never go back from "Closed" to
      "Closing".
      
      Make sure to check also for state == "Closed" in step 4 to prevent the
      deadlock.
      
      Also add a 5 sec timeout any time we wait for the bus state to change,
      to avoid getting stuck forever in wait_event().
      Signed-off-by: default avatarAndrea Righi <andrea.righi@canonical.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c2c63310
  2. 24 Jul, 2020 29 commits
  3. 23 Jul, 2020 2 commits