- 25 Sep, 2019 4 commits
-
-
Takeshi Misawa authored
When ppp is closing, __ppp_xmit_process() failed to enqueue skb and skb allocated in ppp_write() is leaked. syzbot reported : BUG: memory leak unreferenced object 0xffff88812a17bc00 (size 224): comm "syz-executor673", pid 6952, jiffies 4294942888 (age 13.040s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000d110fff9>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<00000000d110fff9>] slab_post_alloc_hook mm/slab.h:522 [inline] [<00000000d110fff9>] slab_alloc_node mm/slab.c:3262 [inline] [<00000000d110fff9>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574 [<000000002d616113>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197 [<000000000167fc45>] alloc_skb include/linux/skbuff.h:1055 [inline] [<000000000167fc45>] ppp_write+0x48/0x120 drivers/net/ppp/ppp_generic.c:502 [<000000009ab42c0b>] __vfs_write+0x43/0xa0 fs/read_write.c:494 [<00000000086b2e22>] vfs_write fs/read_write.c:558 [inline] [<00000000086b2e22>] vfs_write+0xee/0x210 fs/read_write.c:542 [<00000000a2b70ef9>] ksys_write+0x7c/0x130 fs/read_write.c:611 [<00000000ce5e0fdd>] __do_sys_write fs/read_write.c:623 [inline] [<00000000ce5e0fdd>] __se_sys_write fs/read_write.c:620 [inline] [<00000000ce5e0fdd>] __x64_sys_write+0x1e/0x30 fs/read_write.c:620 [<00000000d9d7b370>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296 [<0000000006e6d506>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fix this by freeing skb, if ppp is closing. Fixes: 6d066734 ("ppp: avoid loop in xmit recursion detection code") Reported-and-tested-by: syzbot+d9c8bf24e56416d7ce2c@syzkaller.appspotmail.com Signed-off-by:Takeshi Misawa <jeliantsurux@gmail.com> Reviewed-by:
Guillaume Nault <gnault@redhat.com> Tested-by:
David S. Miller <davem@davemloft.net>
-
David S. Miller authored
Juliet Kim says: ==================== net/ibmvnic: serialization fixes This series includes two fixes. The first improves reset code to allow linkwatch_event to proceed during reset. The second ensures that no more than one thread runs in reset at a time. v2: - Separate change param reset from do_reset() - Return IBMVNIC_OPEN_FAILED if __ibmvnic_open fails - Remove setting wait_for_reset to false from __ibmvnic_reset(), this is done in wait_for_reset() - Move the check for force_reset_recovery from patch 1 to patch 2 v3: - Restore reset’s successful return in open failure case v4: - Change resetting flag access to atomic ==================== Signed-off-by: -
Juliet Kim authored
The current code allows more than one thread to run in reset. This can corrupt struct adapter data. Check adapter->resetting before performing a reset, if there is another reset running delay (100 msec) before trying again. Signed-off-by:
Juliet Kim <julietk@linux.vnet.ibm.com> Signed-off-by:
-
Juliet Kim authored
Commit a5681e20 ("net/ibmnvic: Fix deadlock problem in reset") made the change to hold the RTNL lock during a reset to avoid deadlock but linkwatch_event is fired during the reset and needs the RTNL lock. That keeps linkwatch_event process from proceeding until the reset is complete. The reset process cannot tolerate the linkwatch_event processing after reset completes, so release the RTNL lock during the process to allow a chance for linkwatch_event to run during reset. This does not guarantee that the linkwatch_event will be processed as soon as link state changes, but is an improvement over the current code where linkwatch_event processing is always delayed, which prevents transmissions on the device from being deactivated leading transmit watchdog timer to time-out. Release the RTNL lock before link state change and re-acquire after the link state change to allow linkwatch_event to grab the RTNL lock and run during the reset. Fixes: a5681e20 ("net/ibmnvic: Fix deadlock problem in reset") Signed-off-by:
-
- 24 Sep, 2019 9 commits
-
-
Stephen Hemminger authored
Running old skge driver on PowerPC causes checksum errors because hardware reported 1's complement checksum is in little-endian byte order. Reported-by:
Benoit <benoit.sansoni@gmail.com> Signed-off-by:
Stephen Hemminger <stephen@networkplumber.org> Signed-off-by:
-
Uwe Kleine-König authored
struct archdr is only big enough to hold the header of various types of arcnet packets. So to provide enough space to hold the data read from hardware provide a buffer large enough to hold a packet with maximal size. The problem was noticed by the stack protector which makes the kernel oops. Signed-off-by:
Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Acked-by:
Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by:
-
David S. Miller authored
Greg Kroah-Hartman says: ==================== Raw socket cleanups Ori Nimron pointed out that there are a number of places in the kernel where you can create a raw socket, without having to have the CAP_NET_RAW permission. To resolve this, here's a short patch series to test these odd and old protocols for this permission before allowing the creation to succeed All patches are currently against the net tree. ==================== Signed-off-by: -
Ori Nimron authored
When creating a raw AF_NFC socket, CAP_NET_RAW needs to be checked first. Signed-off-by:
Ori Nimron <orinimron123@gmail.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
-
Ori Nimron authored
When creating a raw AF_IEEE802154 socket, CAP_NET_RAW needs to be checked first. Signed-off-by:
Stefan Schmidt <stefan@datenfreihafen.org> Signed-off-by:
-
Ori Nimron authored
When creating a raw AF_AX25 socket, CAP_NET_RAW needs to be checked first. Signed-off-by:
-
Ori Nimron authored
When creating a raw AF_APPLETALK socket, CAP_NET_RAW needs to be checked first. Signed-off-by:
-
Ori Nimron authored
When creating a raw AF_ISDN socket, CAP_NET_RAW needs to be checked first. Signed-off-by:
-
Eric Dumazet authored
If the allocation done in tcf_exts_init() failed, we end up with a NULL pointer in exts->actions. kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 8198 Comm: syz-executor.3 Not tainted 5.3.0-rc8+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:tcf_action_destroy+0x71/0x160 net/sched/act_api.c:705 Code: c3 08 44 89 ee e8 4f cb bb fb 41 83 fd 20 0f 84 c9 00 00 00 e8 c0 c9 bb fb 48 89 d8 48 b9 00 00 00 00 00 fc ff df 48 c1 e8 03 <80> 3c 08 00 0f 85 c0 00 00 00 4c 8b 33 4d 85 f6 0f 84 9d 00 00 00 RSP: 0018:ffff888096e16ff0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000040000 RSI: ffffffff85b6ab30 RDI: 0000000000000000 RBP: ffff888096e17020 R08: ffff8880993f6140 R09: fffffbfff11cae67 R10: fffffbfff11cae66 R11: ffffffff88e57333 R12: 0000000000000000 R13: 0000000000000000 R14: ffff888096e177a0 R15: 0000000000000001 FS: 00007f62bc84a700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000758040 CR3: 0000000088b64000 CR4: 00000000001426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tcf_exts_destroy+0x38/0xb0 net/sched/cls_api.c:3030 tcindex_set_parms+0xf7f/0x1e50 net/sched/cls_tcindex.c:488 tcindex_change+0x230/0x318 net/sched/cls_tcindex.c:519 tc_new_tfilter+0xa4b/0x1c70 net/sched/cls_api.c:2152 rtnetlink_rcv_msg+0x838/0xb00 net/core/rtnetlink.c:5214 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5241 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x531/0x710 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x8a5/0xd60 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:657 ___sys_sendmsg+0x3e2/0x920 net/socket.c:2311 __sys_sendmmsg+0x1bf/0x4d0 net/socket.c:2413 __do_sys_sendmmsg net/socket.c:2442 [inline] Fixes: 90b73b77 ("net: sched: change action API to use array of pointers to actions") Signed-off-by:
Eric Dumazet <edumazet@google.com> Reported-by:
syzbot <syzkaller@googlegroups.com> Cc: Vlad Buslov <vladbu@mellanox.com> Cc: Jiri Pirko <jiri@mellanox.com> Signed-off-by:
-
- 22 Sep, 2019 12 commits
-
-
Nishad Kamdar authored
This patch corrects the SPDX License Identifier style in header file for Distributed Switch Architecture drivers. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used) Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46. Suggested-by:
Joe Perches <joe@perches.com> Signed-off-by:
Nishad Kamdar <nishadkamdar@gmail.com> Reviewed-by:
Vivien Didelot <vivien.didelot@gmail.com> Reviewed-by:
Florian Fainelli <f.fainelli@gmail.com> Signed-off-by:
Jakub Kicinski <jakub.kicinski@netronome.com>
-
Nishad Kamdar authored
This patch corrects the SPDX License Identifier style in header file for Broadcom BCM53xx managed switch driver. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used) Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46. Suggested-by:
-
Dan Carpenter authored
We need to set the error code on this path. Otherwise it probably results in a NULL dereference down the line. Fixes: aa319881 ("ionic: Add RSS support") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Acked-by:
Shannon Nelson <snelson@pensando.io> Signed-off-by:
-
Mao Wenan authored
If CONFIG_ENA_ETHERNET=y and CONFIG_DIMLIB=n, below erros can be found: drivers/net/ethernet/amazon/ena/ena_netdev.o: In function `ena_dim_work': ena_netdev.c:(.text+0x21cc): undefined reference to `net_dim_get_rx_moderation' ena_netdev.c:(.text+0x21cc): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `net_dim_get_rx_moderation' drivers/net/ethernet/amazon/ena/ena_netdev.o: In function `ena_io_poll': ena_netdev.c:(.text+0x7bd4): undefined reference to `net_dim' ena_netdev.c:(.text+0x7bd4): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `net_dim' After commit 282faf61 ("net: ena: switch to dim algorithm for rx adaptive interrupt moderation"), it introduces dim algorithm, which configured by CONFIG_DIMLIB. So, this patch is to select DIMLIB for ENA_ETHERNET. Fixes: 282faf61 ("net: ena: switch to dim algorithm for rx adaptive interrupt moderation") Signed-off-by:
Mao Wenan <maowenan@huawei.com> Signed-off-by:
-
Christophe JAILLET authored
Use 'skb_put_data()' instead of rewritting it. This improves readability. Signed-off-by:
Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by:
-
Arnd Bergmann authored
Putting a struct stmmac_rss object on the stack is a bad idea, as it exceeds the warning limit for a stack frame on 32-bit architectures: drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c:1221:12: error: stack frame size of 1208 bytes in function '__stmmac_test_l3filt' [-Werror,-Wframe-larger-than=] drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c:1338:12: error: stack frame size of 1208 bytes in function '__stmmac_test_l4filt' [-Werror,-Wframe-larger-than=] As the object is the trivial empty case, change the called function to accept a NULL pointer to mean the same thing and remove the large variable in the two callers. Fixes: 4647e021 ("net: stmmac: selftests: Add selftest for L3/L4 Filters") Signed-off-by:
Arnd Bergmann <arnd@arndb.de> Acked-by:
Jose Abreu <joabreu@synopsys.com> Signed-off-by:
-
Mao Wenan authored
If CONFIG_NET_DSA_SJA1105_TAS=y and CONFIG_NET_SCH_TAPRIO=n, below error can be found: drivers/net/dsa/sja1105/sja1105_tas.o: In function `sja1105_setup_tc_taprio': sja1105_tas.c:(.text+0x318): undefined reference to `taprio_offload_free' sja1105_tas.c:(.text+0x590): undefined reference to `taprio_offload_get' drivers/net/dsa/sja1105/sja1105_tas.o: In function `sja1105_tas_teardown': sja1105_tas.c:(.text+0x610): undefined reference to `taprio_offload_free' make: *** [vmlinux] Error 1 sja1105_tas needs tc-taprio, so this patch add the dependency for it. Fixes: 317ab5b8 ("net: dsa: sja1105: Configure the Time-Aware Scheduler via tc-taprio offload") Signed-off-by:
Vladimir Oltean <olteanv@gmail.com> Signed-off-by:
-
Cong Wang authored
Similar to commit 8b4c3cdd ("net: sched: Add policy validation for tc attributes"), we need to add proper policy validation for TC action attributes too. Cc: David Ahern <dsahern@gmail.com> Cc: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by:
Cong Wang <xiyou.wangcong@gmail.com> Acked-by:
Jiri Pirko <jiri@mellanox.com> Signed-off-by:
-
Cong Wang authored
The TCA_KIND attribute is of NLA_STRING which does not check the NUL char. KMSAN reported an uninit-value of TCA_KIND which is likely caused by the lack of NUL. Change it to NLA_NUL_STRING and add a max len too. Fixes: 8b4c3cdd ("net: sched: Add policy validation for tc attributes") Reported-and-tested-by: syzbot+618aacd49e8c8b8486bd@syzkaller.appspotmail.com Cc: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by:
David Ahern <dsahern@gmail.com> Acked-by:
-
Arnd Bergmann authored
The ARM netx platform got removed in 5.3, so this driver is now useless. Reported-by:
-
Bjorn Andersson authored
As the endpoint is unregistered there might still be work pending to handle incoming messages, which will result in a use after free scenario. The plan is to remove the rx_worker, but until then (and for stable@) ensure that the work is stopped before the node is freed. Fixes: bdabad3e ("net: Add Qualcomm IPC router") Cc: stable@vger.kernel.org Signed-off-by:
Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by:
-
Peter Mamonov authored
According to the DP83865 datasheet "the 10 Mbps HDX loopback can be disabled in the expanded memory register 0x1C0.1". The driver erroneously used bit 0 instead of bit 1. Fixes: 4621bf12 ("phy: Add file missed in previous commit.") Signed-off-by:
Peter Mamonov <pmamonov@gmail.com> Reviewed-by:
Andrew Lunn <andrew@lunn.ch> Signed-off-by:
-
- 21 Sep, 2019 10 commits
-
-
Bjørn Mork authored
Endpoints with zero wMaxPacketSize are not usable for transferring data. Ignore such endpoints when looking for valid in, out and status pipes, to make the drivers more robust against invalid and meaningless descriptors. The wMaxPacketSize of these endpoints are used for memory allocations and as divisors in many usbnet minidrivers. Avoiding zero is therefore critical. Signed-off-by:
Bjørn Mork <bjorn@mork.no> Signed-off-by:
-
Bjørn Mork authored
Endpoints with zero wMaxPacketSize are not usable for transferring data. Ignore such endpoints when looking for valid in, out and status pipes, to make the driver more robust against invalid and meaningless descriptors. The wMaxPacketSize of the out pipe is used as divisor. So this change fixes a divide-by-zero bug. Reported-by: syzbot+ce366e2b8296e25d84f5@syzkaller.appspotmail.com Signed-off-by:
-
Eric Dumazet authored
Yi Ren reported an issue discovered by syzkaller, and bisected to the cited commit. Many thanks to Yi, this trivial patch does not reflect the patient work that has been done. Fixes: d64a1f57 ("ipv6: honor RT6_LOOKUP_F_DST_NOREF in rule lookup logic") Signed-off-by:
Wei Wang <weiwan@google.com> Bisected-and-reported-by:
Yi Ren <c4tren@gmail.com> Signed-off-by:
-
Eric Dumazet authored
syzbot managed to crash the kernel in tabledist() loading an empty distribution table. t = dist->table[rnd % dist->size]; Simply return an error when such load is attempted. Fixes: 1da177e4 ("Linux-2.6.12-rc2") Signed-off-by:
-
Alexandru Ardelean authored
The `adi,disable-energy-detect` property was implemented in an initial version of the `adin` driver series, but after a review it was discarded in favor of implementing the ETHTOOL_PHY_EDPD phy-tunable option. With the ETHTOOL_PHY_EDPD control, it's possible to disable/enable Energy-Detect-Power-Down for the `adin` PHY, so this device-tree is not needed. Fixes: 76707813 ("dt-bindings: net: add bindings for ADIN PHY driver") Signed-off-by:
Alexandru Ardelean <alexandru.ardelean@analog.com> Reviewed-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
David Ahern authored
Julian noted that rt_uses_gateway has a more subtle use than 'is gateway set': https://lore.kernel.org/netdev/alpine.LFD.2.21.1909151104060.2546@ja.home.ssi.bg/ Revert that part of the commit referenced in the Fixes tag. Currently, there are no u8 holes in 'struct rtable'. There is a 4-byte hole in the second cacheline which contains the gateway declaration. So move rt_gw_family down to the gateway declarations since they are always used together, and then re-use that u8 for rt_uses_gateway. End result is that rtable size is unchanged. Fixes: 1550c171 ("ipv4: Prepare rtable for IPv6 gateway") Reported-by:Julian Anastasov <ja@ssi.bg> Signed-off-by:
-
David Ahern authored
Some distributions (e.g., debian buster) do not install ping6. Re-use the hook in pmtu.sh to detect this and fallback to ping. Fixes: 735ab2f6 ("selftests: Add test with multiple prefixes using single nexthop") Signed-off-by:
-
David Ahern authored
Some distributions (e.g., debian buster) do not install ping6. Re-use the hook in pmtu.sh to detect this and fallback to ping. Fixes: a0e11da7 ("fib_tests: Add tests for metrics on routes") Signed-off-by:
-
Alexandru Ardelean authored
The 'mac-mode' property is similar to 'phy-mode' and 'phy-connection-type', which are enums of mode strings. The 'dwmac' driver supports almost all modes declared in the 'phy-mode' enum (except for 1 or 2). But in general, there may be a case where 'mac-mode' becomes more generic and is moved as part of phylib or netdev. In any case, the 'mac-mode' field should be made an enum, and it also makes sense to just reference the 'phy-connection-type' from 'ethernet-controller.yaml'. That will also make it more future-proof for new modes. Fixes: 9c15d359 ("dt-bindings: net: dwmac: document 'mac-mode' property") Signed-off-by:
-
Davide Caratti authored
current 'sample' action doesn't push the mac header of ingress packets if they are received by a layer 3 tunnel (like gre or sit); but it forgot to check for gre over ipv6, so the following script: # tc q a dev $d clsact # tc f a dev $d ingress protocol ip flower ip_proto icmp action sample \ > group 100 rate 1 # psample -v -g 100 dumps everything, including outer header and mac, when $d is a gre tunnel over ipv6. Fix this adding a missing label for ARPHRD_IP6GRE devices. Fixes: 5c5670fa ("net/sched: Introduce sample tc action") Signed-off-by:
Davide Caratti <dcaratti@redhat.com> Reviewed-by:
Yotam Gigi <yotam.gi@gmail.com> Signed-off-by:
-
- 20 Sep, 2019 4 commits
-
-
Donald Sharp authored
Add some test cases to allow the fib_nexthops.sh test code to test the flushing of nexthops based upon the proto passed in upon creation of the nexthop group. Signed-off-by:
Donald Sharp <sharpd@cumulusnetworks.com> Reviewed-by:
-
James Byrne authored
The documentation of skew values for the KSZ9021 PHY was misleading because the driver implementation followed the erroneous information given in the original KSZ9021 datasheet before it was corrected in revision 1.2 (Feb 2014). It is probably too late to correct the driver now because of the many existing device trees, so instead this just corrects the documentation to explain that what you actually get is not what you might think when looking at the device tree. Signed-off-by:
James Byrne <james.byrne@origamienergy.com> Signed-off-by:
-
Vijay Khemka authored
Disabling multicast filtering from NCSI if it is supported. As it should not filter any multicast packets. In current code, multicast filter is enabled and with an exception of optional field supported by device are disabled filtering. Mainly I see if goal is to disable filtering for IPV6 packets then let it disabled for every other types as well. As we are seeing issues with LLDP not working with this enabled filtering. And there are other issues with IPV6. By Disabling this multicast completely, it is working for both IPV6 as well as LLDP. Signed-off-by:
Vijay Khemka <vijaykhemka@fb.com> Acked-by:
Samuel Mendoza-Jonas <sam@mendozajonas.com> Signed-off-by:
-
Murilo Fossa Vicentini authored
With commit 0655f994 ("net/ibmvnic: Update carrier state after link state change") we are now able to detect when the carrier is properly present in the device, so only report an unexpected unknown speed when it is properly detected. Unknown speed is expected to be seen by the device in case the backing device has no link detected. Reported-by:
Abdul Haleem <abdhalee@linux.vnet.ibm.com> Tested-by:
Murilo Fossa Vicentini <muvic@linux.ibm.com> Reviewed-by:
Thomas Falcon <tlfalcon@linux.ibm.com>
-
- 19 Sep, 2019 1 commit
-
-
Nathan Chancellor authored
clang warns: ../drivers/net/ethernet/pensando/ionic/ionic_debugfs.c:60:37: warning: expression result unused [-Wunused-value] ionic, &identity_fops) ? 0 : -EOPNOTSUPP; ^~~~~~~~~~~ 1 warning generated. The return value of debugfs_create_file does not need to be checked [1] and the function returns void so get rid of the ternary operator, it is unnecessary. [1]: https://lore.kernel.org/linux-mm/20150815160730.GB25186@kroah.com/ Fixes: fbfb8031 ("ionic: Add hardware init and device commands") Link: https://github.com/ClangBuiltLinux/linux/issues/658Signed-off-by:Nathan Chancellor <natechancellor@gmail.com> Acked-by:
-
