1. 11 Jul, 2019 6 commits
  2. 09 Jul, 2019 1 commit
  3. 08 Jul, 2019 13 commits
    • Frank de Brabander's avatar
      selftests: txring_overwrite: fix incorrect test of mmap() return value · cecaa76b
      Frank de Brabander authored
      If mmap() fails it returns MAP_FAILED, which is defined as ((void *) -1).
      The current if-statement incorrectly tests if *ring is NULL.
      
      Fixes: 358be656 ("selftests/net: add txring_overwrite")
      Signed-off-by: default avatarFrank de Brabander <debrabander@gmail.com>
      Acked-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cecaa76b
    • Yang Wei's avatar
      nfc: fix potential illegal memory access · dd006fc4
      Yang Wei authored
      The frags_q is not properly initialized, it may result in illegal memory
      access when conn_info is NULL.
      The "goto free_exit" should be replaced by "goto exit".
      Signed-off-by: default avatarYang Wei <albin_yang@163.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dd006fc4
    • Jose Abreu's avatar
      net: stmmac: Re-work the queue selection for TSO packets · 4993e5b3
      Jose Abreu authored
      Ben Hutchings says:
      	"This is the wrong place to change the queue mapping.
      	stmmac_xmit() is called with a specific TX queue locked,
      	and accessing a different TX queue results in a data race
      	for all of that queue's state.
      
      	I think this commit should be reverted upstream and in all
      	stable branches.  Instead, the driver should implement the
      	ndo_select_queue operation and override the queue mapping there."
      
      Fixes: c5acdbee ("net: stmmac: Send TSO packets always from Queue 0")
      Suggested-by: default avatarBen Hutchings <ben@decadent.org.uk>
      Signed-off-by: default avatarJose Abreu <joabreu@synopsys.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4993e5b3
    • Gary Lin's avatar
      net: bpfilter: print umh messages to /dev/kmsg · 36c4357c
      Gary Lin authored
      bpfilter_umh currently printed all messages to /dev/console and this
      might interfere the user activity(*).
      
      This commit changes the output device to /dev/kmsg so that the messages
      from bpfilter_umh won't show on the console directly.
      
      (*) https://bugzilla.suse.com/show_bug.cgi?id=1140221Signed-off-by: default avatarGary Lin <glin@suse.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      36c4357c
    • Joe Perches's avatar
      net: nixge: Fix misuse of strlcpy · 6b4ddf99
      Joe Perches authored
      Probable cut&paste typo - use the correct field size.
      Signed-off-by: default avatarJoe Perches <joe@perches.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6b4ddf99
    • Joe Perches's avatar
      net: ethernet: sun4i-emac: Fix misuse of strlcpy · 7391324b
      Joe Perches authored
      Probable cut&paste typo - use the correct field size.
      Signed-off-by: default avatarJoe Perches <joe@perches.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7391324b
    • David S. Miller's avatar
      Merge branch 'gtp-fix-several-bugs' · 07996783
      David S. Miller authored
      Taehee Yoo says:
      
      ====================
      gtp: fix several bugs
      
      This patch series fixes several bugs in the gtp module.
      
      First patch fixes suspicious RCU usage.
      The problem is to use rcu_dereference_sk_user_data() outside of
      RCU read critical section.
      
      Second patch fixes use-after-free.
      gtp_encap_destroy() is called twice.
      gtp_encap_destroy() use both gtp->sk0 and gtp->sk1u.
      these pointers can be freed in gtp_encap_destroy().
      So, gtp_encap_destroy() should avoid using freed sk pointer.
      
      Third patch removes duplicate code in gtp_dellink().
      gtp_dellink() calls gtp_encap_disable() twice.
      So, remove one of them.
      
      Fourth patch fixes usage of GFP_KERNEL.
      GFP_KERNEL can not be used in RCU read critical section.
      This patch make ipv4_pdp_add() to use GFP_ATOMIC instead of GFP_KERNEL.
      
      Fifth patch fixes use-after-free in gtp_newlink().
      gtp_newlink() uses gtp_net which would be destroyed by the __exit_net
      routine.
      So, gtp_newlink should not be called after the __exit_net routine.
      
      Sixth patch adds missing error handling routine in gtp_encap_enable().
      gtp_encap_enable() will fail, if invalid role value is sent from
      user-space. if so, gtp_encap_enable() should execute error handling
      routine.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      07996783
    • Taehee Yoo's avatar
      gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable() · e30155fd
      Taehee Yoo authored
      If an invalid role is sent from user space, gtp_encap_enable() will fail.
      Then, it should call gtp_encap_disable_sock() but current code doesn't.
      It makes memory leak.
      
      Fixes: 91ed81f9 ("gtp: support SGSN-side tunnels")
      Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e30155fd
    • Taehee Yoo's avatar
      gtp: fix use-after-free in gtp_newlink() · a2bed907
      Taehee Yoo authored
      Current gtp_newlink() could be called after unregister_pernet_subsys().
      gtp_newlink() uses gtp_net but it can be destroyed by
      unregister_pernet_subsys().
      So unregister_pernet_subsys() should be called after
      rtnl_link_unregister().
      
      Test commands:
         #SHELL 1
         while :
         do
      	   for i in {1..5}
      	   do
      		./gtp-link add gtp$i &
      	   done
      	   killall gtp-link
         done
      
         #SHELL 2
         while :
         do
      	modprobe -rv gtp
         done
      
      Splat looks like:
      [  753.176631] BUG: KASAN: use-after-free in gtp_newlink+0x9b4/0xa5c [gtp]
      [  753.177722] Read of size 8 at addr ffff8880d48f2458 by task gtp-link/7126
      [  753.179082] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G        W         5.2.0-rc6+ #50
      [  753.185801] Call Trace:
      [  753.186264]  dump_stack+0x7c/0xbb
      [  753.186863]  ? gtp_newlink+0x9b4/0xa5c [gtp]
      [  753.187583]  print_address_description+0xc7/0x240
      [  753.188382]  ? gtp_newlink+0x9b4/0xa5c [gtp]
      [  753.189097]  ? gtp_newlink+0x9b4/0xa5c [gtp]
      [  753.189846]  __kasan_report+0x12a/0x16f
      [  753.190542]  ? gtp_newlink+0x9b4/0xa5c [gtp]
      [  753.191298]  kasan_report+0xe/0x20
      [  753.191893]  gtp_newlink+0x9b4/0xa5c [gtp]
      [  753.192580]  ? __netlink_ns_capable+0xc3/0xf0
      [  753.193370]  __rtnl_newlink+0xb9f/0x11b0
      [ ... ]
      [  753.241201] Allocated by task 7186:
      [  753.241844]  save_stack+0x19/0x80
      [  753.242399]  __kasan_kmalloc.constprop.3+0xa0/0xd0
      [  753.243192]  __kmalloc+0x13e/0x300
      [  753.243764]  ops_init+0xd6/0x350
      [  753.244314]  register_pernet_operations+0x249/0x6f0
      [ ... ]
      [  753.251770] Freed by task 7178:
      [  753.252288]  save_stack+0x19/0x80
      [  753.252833]  __kasan_slab_free+0x111/0x150
      [  753.253962]  kfree+0xc7/0x280
      [  753.254509]  ops_free_list.part.11+0x1c4/0x2d0
      [  753.255241]  unregister_pernet_operations+0x262/0x390
      [ ... ]
      [  753.285883] list_add corruption. next->prev should be prev (ffff8880d48f2458), but was ffff8880d497d878. (next.
      [  753.287241] ------------[ cut here ]------------
      [  753.287794] kernel BUG at lib/list_debug.c:25!
      [  753.288364] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
      [  753.289099] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G    B   W         5.2.0-rc6+ #50
      [  753.291036] RIP: 0010:__list_add_valid+0x74/0xd0
      [  753.291589] Code: 48 39 da 75 27 48 39 f5 74 36 48 39 dd 74 31 48 83 c4 08 b8 01 00 00 00 5b 5d c3 48 89 d9 48b
      [  753.293779] RSP: 0018:ffff8880cae8f398 EFLAGS: 00010286
      [  753.294401] RAX: 0000000000000075 RBX: ffff8880d497d878 RCX: 0000000000000000
      [  753.296260] RDX: 0000000000000075 RSI: 0000000000000008 RDI: ffffed10195d1e69
      [  753.297070] RBP: ffff8880cd250ae0 R08: ffffed101b4bff21 R09: ffffed101b4bff21
      [  753.297899] R10: 0000000000000001 R11: ffffed101b4bff20 R12: ffff8880d497d878
      [  753.298703] R13: 0000000000000000 R14: ffff8880cd250ae0 R15: ffff8880d48f2458
      [  753.299564] FS:  00007f5f79805740(0000) GS:ffff8880da400000(0000) knlGS:0000000000000000
      [  753.300533] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  753.301231] CR2: 00007fe8c7ef4f10 CR3: 00000000b71a6006 CR4: 00000000000606f0
      [  753.302183] Call Trace:
      [  753.302530]  gtp_newlink+0x5f6/0xa5c [gtp]
      [  753.303037]  ? __netlink_ns_capable+0xc3/0xf0
      [  753.303576]  __rtnl_newlink+0xb9f/0x11b0
      [  753.304092]  ? rtnl_link_unregister+0x230/0x230
      
      Fixes: 459aa660 ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
      Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a2bed907
    • Taehee Yoo's avatar
      gtp: fix Illegal context switch in RCU read-side critical section. · 3f167e19
      Taehee Yoo authored
      ipv4_pdp_add() is called in RCU read-side critical section.
      So GFP_KERNEL should not be used in the function.
      This patch make ipv4_pdp_add() to use GFP_ATOMIC instead of GFP_KERNEL.
      
      Test commands:
      gtp-link add gtp1 &
      gtp-tunnel add gtp1 v1 100 200 1.1.1.1 2.2.2.2
      
      Splat looks like:
      [  130.618881] =============================
      [  130.626382] WARNING: suspicious RCU usage
      [  130.626994] 5.2.0-rc6+ #50 Not tainted
      [  130.627622] -----------------------------
      [  130.628223] ./include/linux/rcupdate.h:266 Illegal context switch in RCU read-side critical section!
      [  130.629684]
      [  130.629684] other info that might help us debug this:
      [  130.629684]
      [  130.631022]
      [  130.631022] rcu_scheduler_active = 2, debug_locks = 1
      [  130.632136] 4 locks held by gtp-tunnel/1025:
      [  130.632925]  #0: 000000002b93c8b7 (cb_lock){++++}, at: genl_rcv+0x15/0x40
      [  130.634159]  #1: 00000000f17bc999 (genl_mutex){+.+.}, at: genl_rcv_msg+0xfb/0x130
      [  130.635487]  #2: 00000000c644ed8e (rtnl_mutex){+.+.}, at: gtp_genl_new_pdp+0x18c/0x1150 [gtp]
      [  130.636936]  #3: 0000000007a1cde7 (rcu_read_lock){....}, at: gtp_genl_new_pdp+0x187/0x1150 [gtp]
      [  130.638348]
      [  130.638348] stack backtrace:
      [  130.639062] CPU: 1 PID: 1025 Comm: gtp-tunnel Not tainted 5.2.0-rc6+ #50
      [  130.641318] Call Trace:
      [  130.641707]  dump_stack+0x7c/0xbb
      [  130.642252]  ___might_sleep+0x2c0/0x3b0
      [  130.642862]  kmem_cache_alloc_trace+0x1cd/0x2b0
      [  130.643591]  gtp_genl_new_pdp+0x6c5/0x1150 [gtp]
      [  130.644371]  genl_family_rcv_msg+0x63a/0x1030
      [  130.645074]  ? mutex_lock_io_nested+0x1090/0x1090
      [  130.645845]  ? genl_unregister_family+0x630/0x630
      [  130.646592]  ? debug_show_all_locks+0x2d0/0x2d0
      [  130.647293]  ? check_flags.part.40+0x440/0x440
      [  130.648099]  genl_rcv_msg+0xa3/0x130
      [ ... ]
      
      Fixes: 459aa660 ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
      Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3f167e19
    • Taehee Yoo's avatar
      gtp: remove duplicate code in gtp_dellink() · a635037a
      Taehee Yoo authored
      gtp_encap_disable() in gtp_dellink() is unnecessary because it will be
      called by unregister_netdevice().
      unregister_netdevice() internally calls gtp_dev_uninit() by ->ndo_uninit().
      And gtp_dev_uninit() calls gtp_encap_disable().
      Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a635037a
    • Taehee Yoo's avatar
      gtp: fix use-after-free in gtp_encap_destroy() · 1788b856
      Taehee Yoo authored
      gtp_encap_destroy() is called twice.
      1. When interface is deleted.
      2. When udp socket is destroyed.
      either gtp->sk0 or gtp->sk1u could be freed by sock_put() in
      gtp_encap_destroy(). so, when gtp_encap_destroy() is called again,
      it would uses freed sk pointer.
      
      patch makes gtp_encap_destroy() to set either gtp->sk0 or gtp->sk1u to
      null. in addition, both gtp->sk0 and gtp->sk1u pointer are protected
      by rtnl_lock. so, rtnl_lock() is added.
      
      Test command:
         gtp-link add gtp1 &
         killall gtp-link
         ip link del gtp1
      
      Splat looks like:
      [   83.182767] BUG: KASAN: use-after-free in __lock_acquire+0x3a20/0x46a0
      [   83.184128] Read of size 8 at addr ffff8880cc7d5360 by task ip/1008
      [   83.185567] CPU: 1 PID: 1008 Comm: ip Not tainted 5.2.0-rc6+ #50
      [   83.188469] Call Trace:
      [ ... ]
      [   83.200126]  lock_acquire+0x141/0x380
      [   83.200575]  ? lock_sock_nested+0x3a/0xf0
      [   83.201069]  _raw_spin_lock_bh+0x38/0x70
      [   83.201551]  ? lock_sock_nested+0x3a/0xf0
      [   83.202044]  lock_sock_nested+0x3a/0xf0
      [   83.202520]  gtp_encap_destroy+0x18/0xe0 [gtp]
      [   83.203065]  gtp_encap_disable.isra.14+0x13/0x50 [gtp]
      [   83.203687]  gtp_dellink+0x56/0x170 [gtp]
      [   83.204190]  rtnl_delete_link+0xb4/0x100
      [ ... ]
      [   83.236513] Allocated by task 976:
      [   83.236925]  save_stack+0x19/0x80
      [   83.237332]  __kasan_kmalloc.constprop.3+0xa0/0xd0
      [   83.237894]  kmem_cache_alloc+0xd8/0x280
      [   83.238360]  sk_prot_alloc.isra.42+0x50/0x200
      [   83.238874]  sk_alloc+0x32/0x940
      [   83.239264]  inet_create+0x283/0xc20
      [   83.239684]  __sock_create+0x2dd/0x540
      [   83.240136]  __sys_socket+0xca/0x1a0
      [   83.240550]  __x64_sys_socket+0x6f/0xb0
      [   83.240998]  do_syscall_64+0x9c/0x450
      [   83.241466]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [   83.242061]
      [   83.242249] Freed by task 0:
      [   83.242616]  save_stack+0x19/0x80
      [   83.243013]  __kasan_slab_free+0x111/0x150
      [   83.243498]  kmem_cache_free+0x89/0x250
      [   83.244444]  __sk_destruct+0x38f/0x5a0
      [   83.245366]  rcu_core+0x7e9/0x1c20
      [   83.245766]  __do_softirq+0x213/0x8fa
      
      Fixes: 1e3a3abd ("gtp: make GTP sockets in gtp_newlink optional")
      Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1788b856
    • Taehee Yoo's avatar
      gtp: fix suspicious RCU usage · e198987e
      Taehee Yoo authored
      gtp_encap_enable_socket() and gtp_encap_destroy() are not protected
      by rcu_read_lock(). and it's not safe to write sk->sk_user_data.
      This patch make these functions to use lock_sock() instead of
      rcu_dereference_sk_user_data().
      
      Test commands:
          gtp-link add gtp1
      
      Splat looks like:
      [   83.238315] =============================
      [   83.239127] WARNING: suspicious RCU usage
      [   83.239702] 5.2.0-rc6+ #49 Not tainted
      [   83.240268] -----------------------------
      [   83.241205] drivers/net/gtp.c:799 suspicious rcu_dereference_check() usage!
      [   83.243828]
      [   83.243828] other info that might help us debug this:
      [   83.243828]
      [   83.246325]
      [   83.246325] rcu_scheduler_active = 2, debug_locks = 1
      [   83.247314] 1 lock held by gtp-link/1008:
      [   83.248523]  #0: 0000000017772c7f (rtnl_mutex){+.+.}, at: __rtnl_newlink+0x5f5/0x11b0
      [   83.251503]
      [   83.251503] stack backtrace:
      [   83.252173] CPU: 0 PID: 1008 Comm: gtp-link Not tainted 5.2.0-rc6+ #49
      [   83.253271] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
      [   83.254562] Call Trace:
      [   83.254995]  dump_stack+0x7c/0xbb
      [   83.255567]  gtp_encap_enable_socket+0x2df/0x360 [gtp]
      [   83.256415]  ? gtp_find_dev+0x1a0/0x1a0 [gtp]
      [   83.257161]  ? memset+0x1f/0x40
      [   83.257843]  gtp_newlink+0x90/0xa21 [gtp]
      [   83.258497]  ? __netlink_ns_capable+0xc3/0xf0
      [   83.259260]  __rtnl_newlink+0xb9f/0x11b0
      [   83.260022]  ? rtnl_link_unregister+0x230/0x230
      [ ... ]
      
      Fixes: 1e3a3abd ("gtp: make GTP sockets in gtp_newlink optional")
      Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e198987e
  4. 07 Jul, 2019 3 commits
  5. 05 Jul, 2019 7 commits
    • Ido Schimmel's avatar
      ipv4: Fix NULL pointer dereference in ipv4_neigh_lookup() · 537de0c8
      Ido Schimmel authored
      Both ip_neigh_gw4() and ip_neigh_gw6() can return either a valid pointer
      or an error pointer, but the code currently checks that the pointer is
      not NULL.
      
      Fix this by checking that the pointer is not an error pointer, as this
      can result in a NULL pointer dereference [1]. Specifically, I believe
      that what happened is that ip_neigh_gw4() returned '-EINVAL'
      (0xffffffffffffffea) to which the offset of 'refcnt' (0x70) was added,
      which resulted in the address 0x000000000000005a.
      
      [1]
       BUG: KASAN: null-ptr-deref in refcount_inc_not_zero_checked+0x6e/0x180
       Read of size 4 at addr 000000000000005a by task swapper/2/0
      
       CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.2.0-rc6-custom-reg-179657-gaa32d89 #396
       Hardware name: Mellanox Technologies Ltd. MSN2010/SA002610, BIOS 5.6.5 08/24/2017
       Call Trace:
       <IRQ>
       dump_stack+0x73/0xbb
       __kasan_report+0x188/0x1ea
       kasan_report+0xe/0x20
       refcount_inc_not_zero_checked+0x6e/0x180
       ipv4_neigh_lookup+0x365/0x12c0
       __neigh_update+0x1467/0x22f0
       arp_process.constprop.6+0x82e/0x1f00
       __netif_receive_skb_one_core+0xee/0x170
       process_backlog+0xe3/0x640
       net_rx_action+0x755/0xd90
       __do_softirq+0x29b/0xae7
       irq_exit+0x177/0x1c0
       smp_apic_timer_interrupt+0x164/0x5e0
       apic_timer_interrupt+0xf/0x20
       </IRQ>
      
      Fixes: 5c9f7c1d ("ipv4: Add helpers for neigh lookup for nexthop")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Reported-by: default avatarShalom Toledo <shalomt@mellanox.com>
      Reviewed-by: default avatarJiri Pirko <jiri@mellanox.com>
      Reviewed-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      537de0c8
    • Hayes Wang's avatar
      r8152: set RTL8152_UNPLUG only for real disconnection · ffa9fec3
      Hayes Wang authored
      Set the flag of RTL8152_UNPLUG if and only if the device is unplugged.
      Some error codes sometimes don't mean the real disconnection of usb device.
      For those situations, set the flag of RTL8152_UNPLUG causes the driver skips
      some flows of disabling the device, and it let the device stay at incorrect
      state.
      Signed-off-by: default avatarHayes Wang <hayeswang@realtek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ffa9fec3
    • David S. Miller's avatar
      Merge branch 'hsr-bug-fixes' · fa804301
      David S. Miller authored
      Cong Wang says:
      
      ====================
      hsr: a few bug fixes
      
      This patchset contains 3 bug fixes for hsr triggered by a syzbot
      reproducer, please check each patch for details.
      ====================
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      fa804301
    • Cong Wang's avatar
      hsr: fix a NULL pointer deref in hsr_dev_xmit() · edf070a0
      Cong Wang authored
      hsr_port_get_hsr() could return NULL and kernel
      could crash:
      
       BUG: kernel NULL pointer dereference, address: 0000000000000010
       #PF: supervisor read access in kernel mode
       #PF: error_code(0x0000) - not-present page
       PGD 8000000074b84067 P4D 8000000074b84067 PUD 7057d067 PMD 0
       Oops: 0000 [#1] SMP PTI
       CPU: 0 PID: 754 Comm: a.out Not tainted 5.2.0-rc6+ #718
       Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014
       RIP: 0010:hsr_dev_xmit+0x20/0x31
       Code: 48 8b 1b eb e0 5b 5d 41 5c c3 66 66 66 66 90 55 48 89 fd 48 8d be 40 0b 00 00 be 04 00 00 00 e8 ee f2 ff ff 48 89 ef 48 89 c6 <48> 8b 40 10 48 89 45 10 e8 6c 1b 00 00 31 c0 5d c3 66 66 66 66 90
       RSP: 0018:ffffb5b400003c48 EFLAGS: 00010246
       RAX: 0000000000000000 RBX: ffff9821b4509a88 RCX: 0000000000000000
       RDX: ffff9821b4509a88 RSI: 0000000000000000 RDI: ffff9821bc3fc7c0
       RBP: ffff9821bc3fc7c0 R08: 0000000000000000 R09: 00000000000c2019
       R10: 0000000000000000 R11: 0000000000000002 R12: ffff9821bc3fc7c0
       R13: ffff9821b4509a88 R14: 0000000000000000 R15: 000000000000006e
       FS:  00007fee112a1800(0000) GS:ffff9821bd800000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 0000000000000010 CR3: 000000006e9ce000 CR4: 00000000000406f0
       Call Trace:
        <IRQ>
        netdev_start_xmit+0x1b/0x38
        dev_hard_start_xmit+0x121/0x21e
        ? validate_xmit_skb.isra.0+0x19/0x1e3
        __dev_queue_xmit+0x74c/0x823
        ? lockdep_hardirqs_on+0x12b/0x17d
        ip6_finish_output2+0x3d3/0x42c
        ? ip6_mtu+0x55/0x5c
        ? mld_sendpack+0x191/0x229
        mld_sendpack+0x191/0x229
        mld_ifc_timer_expire+0x1f7/0x230
        ? mld_dad_timer_expire+0x58/0x58
        call_timer_fn+0x12e/0x273
        __run_timers.part.0+0x174/0x1b5
        ? mld_dad_timer_expire+0x58/0x58
        ? sched_clock_cpu+0x10/0xad
        ? mark_lock+0x26/0x1f2
        ? __lock_is_held+0x40/0x71
        run_timer_softirq+0x26/0x48
        __do_softirq+0x1af/0x392
        irq_exit+0x53/0xa2
        smp_apic_timer_interrupt+0x1c4/0x1d9
        apic_timer_interrupt+0xf/0x20
        </IRQ>
      
      Cc: Arvid Brodin <arvid.brodin@alten.se>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      edf070a0
    • Cong Wang's avatar
      hsr: implement dellink to clean up resources · b9a1e627
      Cong Wang authored
      hsr_link_ops implements ->newlink() but not ->dellink(),
      which leads that resources not released after removing the device,
      particularly the entries in self_node_db and node_db.
      
      So add ->dellink() implementation to replace the priv_destructor.
      This also makes the code slightly easier to understand.
      
      Reported-by: syzbot+c6167ec3de7def23d1e8@syzkaller.appspotmail.com
      Cc: Arvid Brodin <arvid.brodin@alten.se>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b9a1e627
    • Cong Wang's avatar
      hsr: fix a memory leak in hsr_del_port() · 619afef0
      Cong Wang authored
      hsr_del_port() should release all the resources allocated
      in hsr_add_port().
      
      As a consequence of this change, hsr_for_each_port() is no
      longer safe to work with hsr_del_port(), switch to
      list_for_each_entry_safe() as we always hold RTNL lock.
      
      Cc: Arvid Brodin <arvid.brodin@alten.se>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      619afef0
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec · 114b5b35
      David S. Miller authored
      Steffen Klassert says:
      
      ====================
      pull request (net): ipsec 2019-07-05
      
      1)  Fix xfrm selector prefix length validation for
          inter address family tunneling.
          From Anirudh Gupta.
      
      2) Fix a memleak in pfkey.
         From Jeremy Sowden.
      
      3) Fix SA selector validation to allow empty selectors again.
         From Nicolas Dichtel.
      
      4) Select crypto ciphers for xfrm_algo, this fixes some
         randconfig builds. From Arnd Bergmann.
      
      5) Remove a duplicated assignment in xfrm_bydst_resize.
         From Cong Wang.
      
      6) Fix a hlist corruption on hash rebuild.
         From Florian Westphal.
      
      7) Fix a memory leak when creating xfrm interfaces.
         From Nicolas Dichtel.
      
      Please pull or let me know if there are problems.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      114b5b35
  6. 03 Jul, 2019 10 commits