1. 24 Sep, 2019 1 commit
    • Eric Dumazet's avatar
      net: sched: fix possible crash in tcf_action_destroy() · 3d66b89c
      Eric Dumazet authored
      If the allocation done in tcf_exts_init() failed,
      we end up with a NULL pointer in exts->actions.
      
      kasan: GPF could be caused by NULL-ptr deref or user memory access
      general protection fault: 0000 [#1] PREEMPT SMP KASAN
      CPU: 1 PID: 8198 Comm: syz-executor.3 Not tainted 5.3.0-rc8+ #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      RIP: 0010:tcf_action_destroy+0x71/0x160 net/sched/act_api.c:705
      Code: c3 08 44 89 ee e8 4f cb bb fb 41 83 fd 20 0f 84 c9 00 00 00 e8 c0 c9 bb fb 48 89 d8 48 b9 00 00 00 00 00 fc ff df 48 c1 e8 03 <80> 3c 08 00 0f 85 c0 00 00 00 4c 8b 33 4d 85 f6 0f 84 9d 00 00 00
      RSP: 0018:ffff888096e16ff0 EFLAGS: 00010246
      RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000
      RDX: 0000000000040000 RSI: ffffffff85b6ab30 RDI: 0000000000000000
      RBP: ffff888096e17020 R08: ffff8880993f6140 R09: fffffbfff11cae67
      R10: fffffbfff11cae66 R11: ffffffff88e57333 R12: 0000000000000000
      R13: 0000000000000000 R14: ffff888096e177a0 R15: 0000000000000001
      FS:  00007f62bc84a700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000758040 CR3: 0000000088b64000 CR4: 00000000001426e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       tcf_exts_destroy+0x38/0xb0 net/sched/cls_api.c:3030
       tcindex_set_parms+0xf7f/0x1e50 net/sched/cls_tcindex.c:488
       tcindex_change+0x230/0x318 net/sched/cls_tcindex.c:519
       tc_new_tfilter+0xa4b/0x1c70 net/sched/cls_api.c:2152
       rtnetlink_rcv_msg+0x838/0xb00 net/core/rtnetlink.c:5214
       netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
       rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5241
       netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
       netlink_unicast+0x531/0x710 net/netlink/af_netlink.c:1328
       netlink_sendmsg+0x8a5/0xd60 net/netlink/af_netlink.c:1917
       sock_sendmsg_nosec net/socket.c:637 [inline]
       sock_sendmsg+0xd7/0x130 net/socket.c:657
       ___sys_sendmsg+0x3e2/0x920 net/socket.c:2311
       __sys_sendmmsg+0x1bf/0x4d0 net/socket.c:2413
       __do_sys_sendmmsg net/socket.c:2442 [inline]
      
      Fixes: 90b73b77 ("net: sched: change action API to use array of pointers to actions")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Cc: Vlad Buslov <vladbu@mellanox.com>
      Cc: Jiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3d66b89c
  2. 22 Sep, 2019 12 commits
  3. 21 Sep, 2019 10 commits
  4. 20 Sep, 2019 4 commits
  5. 19 Sep, 2019 7 commits
    • Nathan Chancellor's avatar
      ionic: Remove unnecessary ternary operator in ionic_debugfs_add_ident · b47bea2b
      Nathan Chancellor authored
      clang warns:
      
      ../drivers/net/ethernet/pensando/ionic/ionic_debugfs.c:60:37: warning:
      expression result unused [-Wunused-value]
                                  ionic, &identity_fops) ? 0 : -EOPNOTSUPP;
                                                               ^~~~~~~~~~~
      1 warning generated.
      
      The return value of debugfs_create_file does not need to be checked [1]
      and the function returns void so get rid of the ternary operator, it is
      unnecessary.
      
      [1]: https://lore.kernel.org/linux-mm/20150815160730.GB25186@kroah.com/
      
      Fixes: fbfb8031 ("ionic: Add hardware init and device commands")
      Link: https://github.com/ClangBuiltLinux/linux/issues/658Signed-off-by: default avatarNathan Chancellor <natechancellor@gmail.com>
      Acked-by: default avatarShannon Nelson <snelson@pensando.io>
      Reviewed-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b47bea2b
    • Oliver Neukum's avatar
      usbnet: sanity checking of packet sizes and device mtu · 280ceaed
      Oliver Neukum authored
      After a reset packet sizes and device mtu can change and need
      to be reevaluated to calculate queue sizes.
      Malicious devices can set this to zero and we divide by it.
      Introduce sanity checking.
      
      Reported-and-tested-by:  syzbot+6102c120be558c885f04@syzkaller.appspotmail.com
      Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      280ceaed
    • Linus Torvalds's avatar
      Merge tag 'xfs-5.4-merge-7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · b41dae06
      Linus Torvalds authored
      Pull xfs updates from Darrick Wong:
       "For this cycle we have the usual pile of cleanups and bug fixes, some
        performance improvements for online metadata scrubbing, massive
        speedups in the directory entry creation code, some performance
        improvement in the file ACL lookup code, a fix for a logging stall
        during mount, and fixes for concurrency problems.
      
        It has survived a couple of weeks of xfstests runs and merges cleanly.
      
        Summary:
      
         - Remove KM_SLEEP/KM_NOSLEEP.
      
         - Ensure that memory buffers for IO are properly sector-aligned to
           avoid problems that the block layer doesn't check.
      
         - Make the bmap scrubber more efficient in its record checking.
      
         - Don't crash xfs_db when superblock inode geometry is corrupt.
      
         - Fix btree key helper functions.
      
         - Remove unneeded error returns for things that can't fail.
      
         - Fix buffer logging bugs in repair.
      
         - Clean up iterator return values.
      
         - Speed up directory entry creation.
      
         - Enable allocation of xattr value memory buffer during lookup.
      
         - Fix readahead racing with truncate/punch hole.
      
         - Other minor cleanups.
      
         - Fix one AGI/AGF deadlock with RENAME_WHITEOUT.
      
         - More BUG -> WARN whackamole.
      
         - Fix various problems with the log failing to advance under certain
           circumstances, which results in stalls during mount"
      
      * tag 'xfs-5.4-merge-7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (45 commits)
        xfs: push the grant head when the log head moves forward
        xfs: push iclog state cleaning into xlog_state_clean_log
        xfs: factor iclog state processing out of xlog_state_do_callback()
        xfs: factor callbacks out of xlog_state_do_callback()
        xfs: factor debug code out of xlog_state_do_callback()
        xfs: prevent CIL push holdoff in log recovery
        xfs: fix missed wakeup on l_flush_wait
        xfs: push the AIL in xlog_grant_head_wake
        xfs: Use WARN_ON_ONCE for bailout mount-operation
        xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT
        xfs: define a flags field for the AG geometry ioctl structure
        xfs: add a xfs_valid_startblock helper
        xfs: remove the unused XFS_ALLOC_USERDATA flag
        xfs: cleanup xfs_fsb_to_db
        xfs: fix the dax supported check in xfs_ioctl_setattr_dax_invalidate
        xfs: Fix stale data exposure when readahead races with hole punch
        fs: Export generic_fadvise()
        mm: Handle MADV_WILLNEED through vfs_fadvise()
        xfs: allocate xattr buffer on demand
        xfs: consolidate attribute value copying
        ...
      b41dae06
    • Linus Torvalds's avatar
      Merge tag 'vfs-5.4-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · e6bc9de7
      Linus Torvalds authored
      Pull swap access updates from Darrick Wong:
       "Prohibit writing to active swap files and swap partitions.
      
        There's no non-malicious use case for allowing userspace to scribble
        on storage that the kernel thinks it owns"
      
      * tag 'vfs-5.4-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        vfs: don't allow writes to swap files
        mm: set S_SWAPFILE on blockdev swap devices
      e6bc9de7
    • Linus Torvalds's avatar
      Merge tag 'ovl-fixes-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs · b6c0d357
      Linus Torvalds authored
      Pull overlayfs fixes from Miklos Szeredi:
       "Fix a regression in docker introduced by overlayfs changes in 4.19.
        Also fix a couple of miscellaneous bugs"
      
      * tag 'ovl-fixes-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
        ovl: filter of trusted xattr results in audit
        ovl: Fix dereferencing possible ERR_PTR()
        ovl: fix regression caused by overlapping layers detection
      b6c0d357
    • Linus Torvalds's avatar
      Merge tag 'for-5.4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 7d14df2d
      Linus Torvalds authored
      Pull btrfs updates from David Sterba:
       "This continues with work on code refactoring, sanity checks and space
        handling. There are some less user visible changes, nothing that would
        particularly stand out.
      
        User visible changes:
         - tree checker, more sanity checks of:
             - ROOT_ITEM (key, size, generation, level, alignment, flags)
             - EXTENT_ITEM and METADATA_ITEM checks (key, size, offset,
               alignment, refs)
             - tree block reference items
             - EXTENT_DATA_REF (key, hash, offset)
      
         - deprecate flag BTRFS_SUBVOL_CREATE_ASYNC for subvolume creation
           ioctl, scheduled removal in 5.7
      
         - delete stale and unused UAPI definitions
           BTRFS_DEV_REPLACE_ITEM_STATE_*
      
         - improved export of debugging information available via existing
           sysfs directory structure
      
         - try harder to delete relations between qgroups and allow to delete
           orphan entries
      
         - remove unreliable space checks before relocation starts
      
        Core:
         - space handling:
             - improved ticket reservations and other high level logic in
               order to remove special cases
             - factor flushing infrastructure and use it for different
               contexts, allows to remove some special case handling
             - reduce metadata reservation when only updating inodes
             - reduce global block reserve minimum size (affects small
               filesystems)
             - improved overcommit logic wrt global block reserve
      
         - tests:
             - fix memory leaks in extent IO tree
             - catch all TRIM range
      
        Fixes:
         - fix ENOSPC errors, leading to transaction aborts, when cloning
           extents
      
         - several fixes for inode number cache (mount option inode_cache)
      
         - fix potential soft lockups during send when traversing large trees
      
         - fix unaligned access to space cache pages with SLUB debug on
           (PowerPC)
      
        Other:
         - refactoring public/private functions, moving to new or more
           appropriate files
      
         - defines converted to enums
      
         - error handling improvements
      
         - more assertions and comments
      
         - old code deletion"
      
      * tag 'for-5.4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (138 commits)
        btrfs: Relinquish CPUs in btrfs_compare_trees
        btrfs: Don't assign retval of btrfs_try_tree_write_lock/btrfs_tree_read_lock_atomic
        btrfs: create structure to encode checksum type and length
        btrfs: turn checksum type define into an enum
        btrfs: add enospc debug messages for ticket failure
        btrfs: do not account global reserve in can_overcommit
        btrfs: use btrfs_try_granting_tickets in update_global_rsv
        btrfs: always reserve our entire size for the global reserve
        btrfs: change the minimum global reserve size
        btrfs: rename btrfs_space_info_add_old_bytes
        btrfs: remove orig_bytes from reserve_ticket
        btrfs: fix may_commit_transaction to deal with no partial filling
        btrfs: rework wake_all_tickets
        btrfs: refactor the ticket wakeup code
        btrfs: stop partially refilling tickets when releasing space
        btrfs: add space reservation tracepoint for reserved bytes
        btrfs: roll tracepoint into btrfs_space_info_update helper
        btrfs: do not allow reservations if we have pending tickets
        btrfs: stop clearing EXTENT_DIRTY in inode I/O tree
        btrfs: treat RWF_{,D}SYNC writes as sync for CRCs
        ...
      7d14df2d
    • Linus Torvalds's avatar
      Merge tag 'afs-next-20190915' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs · 0bb73e42
      Linus Torvalds authored
      Pull AFS updates from David Howells:
       "Here's a set of patches for AFS. The first three are trivial, deleting
        unused symbols and rolling out a wrapper function.
      
        The fourth and fifth patches make use of the previously added RCU-safe
        request_key facility to allow afs_permission() and afs_d_revalidate()
        to attempt to operate without dropping out of RCU-mode pathwalk. Under
        certain conditions, such as conflict with another client, we still
        have to drop out anyway, take a lock and consult the server"
      
      * tag 'afs-next-20190915' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
        afs: Support RCU pathwalk
        afs: Provide an RCU-capable key lookup
        afs: Use afs_extract_discard() rather than iov_iter_discard()
        afs: remove unused variable 'afs_zero_fid'
        afs: remove unused variable 'afs_voltypes'
      0bb73e42
  6. 18 Sep, 2019 6 commits
    • Linus Torvalds's avatar
      Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt · f60c55a9
      Linus Torvalds authored
      Pull fs-verity support from Eric Biggers:
       "fs-verity is a filesystem feature that provides Merkle tree based
        hashing (similar to dm-verity) for individual readonly files, mainly
        for the purpose of efficient authenticity verification.
      
        This pull request includes:
      
         (a) The fs/verity/ support layer and documentation.
      
         (b) fs-verity support for ext4 and f2fs.
      
        Compared to the original fs-verity patchset from last year, the UAPI
        to enable fs-verity on a file has been greatly simplified. Lots of
        other things were cleaned up too.
      
        fs-verity is planned to be used by two different projects on Android;
        most of the userspace code is in place already. Another userspace tool
        ("fsverity-utils"), and xfstests, are also available. e2fsprogs and
        f2fs-tools already have fs-verity support. Other people have shown
        interest in using fs-verity too.
      
        I've tested this on ext4 and f2fs with xfstests, both the existing
        tests and the new fs-verity tests. This has also been in linux-next
        since July 30 with no reported issues except a couple minor ones I
        found myself and folded in fixes for.
      
        Ted and I will be co-maintaining fs-verity"
      
      * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt:
        f2fs: add fs-verity support
        ext4: update on-disk format documentation for fs-verity
        ext4: add fs-verity read support
        ext4: add basic fs-verity support
        fs-verity: support builtin file signatures
        fs-verity: add SHA-512 support
        fs-verity: implement FS_IOC_MEASURE_VERITY ioctl
        fs-verity: implement FS_IOC_ENABLE_VERITY ioctl
        fs-verity: add data verification hooks for ->readpages()
        fs-verity: add the hook for file ->setattr()
        fs-verity: add the hook for file ->open()
        fs-verity: add inode and superblock fields
        fs-verity: add Kconfig and the helper functions for hashing
        fs: uapi: define verity bit for FS_IOC_GETFLAGS
        fs-verity: add UAPI header
        fs-verity: add MAINTAINERS file entry
        fs-verity: add a documentation file
      f60c55a9
    • Linus Torvalds's avatar
      Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt · 734d1ed8
      Linus Torvalds authored
      Pull fscrypt updates from Eric Biggers:
       "This is a large update to fs/crypto/ which includes:
      
         - Add ioctls that add/remove encryption keys to/from a
           filesystem-level keyring.
      
           These fix user-reported issues where e.g. an encrypted home
           directory can break NetworkManager, sshd, Docker, etc. because they
           don't get access to the needed keyring. These ioctls also provide a
           way to lock encrypted directories that doesn't use the
           vm.drop_caches sysctl, so is faster, more reliable, and doesn't
           always need root.
      
         - Add a new encryption policy version ("v2") which switches to a more
           standard, secure, and flexible key derivation function, and starts
           verifying that the correct key was supplied before using it.
      
           The key derivation improvement is needed for its own sake as well
           as for ongoing feature work for which the current way is too
           inflexible.
      
        Work is in progress to update both Android and the 'fscrypt' userspace
        tool to use both these features. (Working patches are available and
        just need to be reviewed+merged.) Chrome OS will likely use them too.
      
        This has also been tested on ext4, f2fs, and ubifs with xfstests --
        both the existing encryption tests, and the new tests for this. This
        has also been in linux-next since Aug 16 with no reported issues. I'm
        also using an fscrypt v2-encrypted home directory on my personal
        desktop"
      
      * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: (27 commits)
        ext4 crypto: fix to check feature status before get policy
        fscrypt: document the new ioctls and policy version
        ubifs: wire up new fscrypt ioctls
        f2fs: wire up new fscrypt ioctls
        ext4: wire up new fscrypt ioctls
        fscrypt: require that key be added when setting a v2 encryption policy
        fscrypt: add FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS ioctl
        fscrypt: allow unprivileged users to add/remove keys for v2 policies
        fscrypt: v2 encryption policy support
        fscrypt: add an HKDF-SHA512 implementation
        fscrypt: add FS_IOC_GET_ENCRYPTION_KEY_STATUS ioctl
        fscrypt: add FS_IOC_REMOVE_ENCRYPTION_KEY ioctl
        fscrypt: add FS_IOC_ADD_ENCRYPTION_KEY ioctl
        fscrypt: rename keyinfo.c to keysetup.c
        fscrypt: move v1 policy key setup to keysetup_v1.c
        fscrypt: refactor key setup code in preparation for v2 policies
        fscrypt: rename fscrypt_master_key to fscrypt_direct_key
        fscrypt: add ->ci_inode to fscrypt_info
        fscrypt: use FSCRYPT_* definitions, not FS_*
        fscrypt: use FSCRYPT_ prefix for uapi constants
        ...
      734d1ed8
    • Linus Torvalds's avatar
      Merge tag 'filelock-v5.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux · d013cc80
      Linus Torvalds authored
      Pull file locking updates from Jeff Layton:
       "Just a couple of minor bugfixes, a revision to a tracepoint to account
        for some earlier changes to the internals, and a patch to add a
        pr_warn message when someone tries to mount a filesystem with '-o
        mand' on a kernel that has that support disabled"
      
      * tag 'filelock-v5.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux:
        locks: fix a memory leak bug in __break_lease()
        locks: print a warning when mount fails due to lack of "mand" support
        locks: Fix procfs output for file leases
        locks: revise generic_add_lease tracepoint
      d013cc80
    • Linus Torvalds's avatar
      Merge branch 'work.mount-base' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · e170eb27
      Linus Torvalds authored
      Pull vfs mount API infrastructure updates from Al Viro:
       "Infrastructure bits of mount API conversions.
      
        The rest is more of per-filesystem updates and that will happen
        in separate pull requests"
      
      * 'work.mount-base' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        mtd: Provide fs_context-aware mount_mtd() replacement
        vfs: Create fs_context-aware mount_bdev() replacement
        new helper: get_tree_keyed()
        vfs: set fs_context::user_ns for reconfigure
      e170eb27
    • Linus Torvalds's avatar
      Merge branch 'work.dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · b30d87cf
      Linus Torvalds authored
      Pull d_path fix from Al Viro:
       "Fix d_absolute_path() regression in the last cycle (felt by tomoyo,
        mostly)"
      
      * 'work.dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        [PATCH] fix d_absolute_path() interplay with fsmount()
      b30d87cf
    • Linus Torvalds's avatar
      Merge branch 'work.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 53e5e7a7
      Linus Torvalds authored
      Pull vfs namei updates from Al Viro:
       "Pathwalk-related stuff"
      
      [ Audit-related cleanups, misc simplifications, and easier to follow
        nd->root refcounts     - Linus ]
      
      * 'work.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        devpts_pty_kill(): don't bother with d_delete()
        infiniband: don't bother with d_delete()
        hypfs: don't bother with d_delete()
        fs/namei.c: keep track of nd->root refcount status
        fs/namei.c: new helper - legitimize_root()
        kill the last users of user_{path,lpath,path_dir}()
        namei.h: get the comments on LOOKUP_... in sync with reality
        kill LOOKUP_NO_EVAL, don't bother including namei.h from audit.h
        audit_inode(): switch to passing AUDIT_INODE_...
        filename_mountpoint(): make LOOKUP_NO_EVAL unconditional there
        filename_lookup(): audit_inode() argument is always 0
      53e5e7a7