1. 31 Dec, 2021 1 commit
    • David Ahern's avatar
      ipv4: Check attribute length for RTA_GATEWAY in multipath route · 7a3429ba
      David Ahern authored
      syzbot reported uninit-value:
      ============================================================
        BUG: KMSAN: uninit-value in fib_get_nhs+0xac4/0x1f80
        net/ipv4/fib_semantics.c:708
         fib_get_nhs+0xac4/0x1f80 net/ipv4/fib_semantics.c:708
         fib_create_info+0x2411/0x4870 net/ipv4/fib_semantics.c:1453
         fib_table_insert+0x45c/0x3a10 net/ipv4/fib_trie.c:1224
         inet_rtm_newroute+0x289/0x420 net/ipv4/fib_frontend.c:886
      
      Add helper to validate RTA_GATEWAY length before using the attribute.
      
      Fixes: 4e902c57 ("[IPv4]: FIB configuration using struct fib_config")
      Reported-by: syzbot+d4b9a2851cc3ce998741@syzkaller.appspotmail.com
      Signed-off-by: default avatarDavid Ahern <dsahern@kernel.org>
      Cc: Thomas Graf <tgraf@suug.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7a3429ba
  2. 30 Dec, 2021 12 commits
  3. 29 Dec, 2021 10 commits
  4. 28 Dec, 2021 12 commits
    • Linus Torvalds's avatar
      Merge tag 'selinux-pr-20211228' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux · e7c124bd
      Linus Torvalds authored
      Pull selinux fix from Paul Moore:
       "One more small SELinux patch to address an uninitialized stack
        variable"
      
      * tag 'selinux-pr-20211228' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
        selinux: initialize proto variable in selinux_ip_postroute_compat()
      e7c124bd
    • Linus Torvalds's avatar
      Merge tag 'auxdisplay-for-linus-v5.16' of git://github.com/ojeda/linux · ecf71de7
      Linus Torvalds authored
      Pull auxdisplay fixes from Miguel Ojeda:
       "A couple of improvements for charlcd:
      
         - check pointer before dereferencing
      
         - fix coding style issue"
      
      * tag 'auxdisplay-for-linus-v5.16' of git://github.com/ojeda/linux:
        auxdisplay: charlcd: checking for pointer reference before dereferencing
        auxdisplay: charlcd: fixing coding style issue
      ecf71de7
    • Linus Torvalds's avatar
      Merge tag 'powerpc-5.16-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · f651faaa
      Linus Torvalds authored
      Pull powerpc fix from Michael Ellerman:
       "Fix DEBUG_WX never reporting any WX mappings, due to use of an
        incorrect config symbol since we converted to using generic ptdump"
      
      * tag 'powerpc-5.16-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/ptdump: Fix DEBUG_WX since generic ptdump conversion
      f651faaa
    • James McLaughlin's avatar
      igc: Fix TX timestamp support for non-MSI-X platforms · f85846bb
      James McLaughlin authored
      Time synchronization was not properly enabled on non-MSI-X platforms.
      
      Fixes: 2c344ae2 ("igc: Add support for TX timestamping")
      Signed-off-by: default avatarJames McLaughlin <james.mclaughlin@qsc.com>
      Reviewed-by: default avatarVinicius Costa Gomes <vinicius.gomes@intel.com>
      Tested-by: default avatarNechama Kraus <nechamax.kraus@linux.intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      f85846bb
    • Vinicius Costa Gomes's avatar
      igc: Do not enable crosstimestamping for i225-V models · 1e81dcc1
      Vinicius Costa Gomes authored
      It was reported that when PCIe PTM is enabled, some lockups could
      be observed with some integrated i225-V models.
      
      While the issue is investigated, we can disable crosstimestamp for
      those models and see no loss of functionality, because those models
      don't have any support for time synchronization.
      
      Fixes: a90ec848 ("igc: Add support for PTP getcrosststamp()")
      Link: https://lore.kernel.org/all/924175a188159f4e03bd69908a91e606b574139b.camel@gmx.de/Reported-by: default avatarStefan Dietrich <roots@gmx.de>
      Signed-off-by: default avatarVinicius Costa Gomes <vinicius.gomes@intel.com>
      Tested-by: default avatarNechama Kraus <nechamax.kraus@linux.intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      1e81dcc1
    • David S. Miller's avatar
      Merge branch 'smc-fixes' · 16fa29ae
      David S. Miller authored
      Dust Li says:
      
      ====================
      net/smc: fix kernel panic caused by race of smc_sock
      
      This patchset fixes the race between smc_release triggered by
      close(2) and cdc_handle triggered by underlaying RDMA device.
      
      The race is caused because the smc_connection may been released
      before the pending tx CDC messages got its CQEs. In order to fix
      this, I add a counter to track how many pending WRs we have posted
      through the smc_connection, and only release the smc_connection
      after there is no pending WRs on the connection.
      
      The first patch prevents posting WR on a QP that is not in RTS
      state. This patch is needed because if we post WR on a QP that
      is not in RTS state, ib_post_send() may success but no CQE will
      return, and that will confuse the counter tracking the pending
      WRs.
      
      The second patch add a counter to track how many WRs were posted
      through the smc_connection, and don't reset the QP on link destroying
      to prevent leak of the counter.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      16fa29ae
    • Dust Li's avatar
      net/smc: fix kernel panic caused by race of smc_sock · 349d4312
      Dust Li authored
      A crash occurs when smc_cdc_tx_handler() tries to access smc_sock
      but smc_release() has already freed it.
      
      [ 4570.695099] BUG: unable to handle page fault for address: 000000002eae9e88
      [ 4570.696048] #PF: supervisor write access in kernel mode
      [ 4570.696728] #PF: error_code(0x0002) - not-present page
      [ 4570.697401] PGD 0 P4D 0
      [ 4570.697716] Oops: 0002 [#1] PREEMPT SMP NOPTI
      [ 4570.698228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-rc4+ #111
      [ 4570.699013] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/0
      [ 4570.699933] RIP: 0010:_raw_spin_lock+0x1a/0x30
      <...>
      [ 4570.711446] Call Trace:
      [ 4570.711746]  <IRQ>
      [ 4570.711992]  smc_cdc_tx_handler+0x41/0xc0
      [ 4570.712470]  smc_wr_tx_tasklet_fn+0x213/0x560
      [ 4570.712981]  ? smc_cdc_tx_dismisser+0x10/0x10
      [ 4570.713489]  tasklet_action_common.isra.17+0x66/0x140
      [ 4570.714083]  __do_softirq+0x123/0x2f4
      [ 4570.714521]  irq_exit_rcu+0xc4/0xf0
      [ 4570.714934]  common_interrupt+0xba/0xe0
      
      Though smc_cdc_tx_handler() checked the existence of smc connection,
      smc_release() may have already dismissed and released the smc socket
      before smc_cdc_tx_handler() further visits it.
      
      smc_cdc_tx_handler()           |smc_release()
      if (!conn)                     |
                                     |
                                     |smc_cdc_tx_dismiss_slots()
                                     |      smc_cdc_tx_dismisser()
                                     |
                                     |sock_put(&smc->sk) <- last sock_put,
                                     |                      smc_sock freed
      bh_lock_sock(&smc->sk) (panic) |
      
      To make sure we won't receive any CDC messages after we free the
      smc_sock, add a refcount on the smc_connection for inflight CDC
      message(posted to the QP but haven't received related CQE), and
      don't release the smc_connection until all the inflight CDC messages
      haven been done, for both success or failed ones.
      
      Using refcount on CDC messages brings another problem: when the link
      is going to be destroyed, smcr_link_clear() will reset the QP, which
      then remove all the pending CQEs related to the QP in the CQ. To make
      sure all the CQEs will always come back so the refcount on the
      smc_connection can always reach 0, smc_ib_modify_qp_reset() was replaced
      by smc_ib_modify_qp_error().
      And remove the timeout in smc_wr_tx_wait_no_pending_sends() since we
      need to wait for all pending WQEs done, or we may encounter use-after-
      free when handling CQEs.
      
      For IB device removal routine, we need to wait for all the QPs on that
      device been destroyed before we can destroy CQs on the device, or
      the refcount on smc_connection won't reach 0 and smc_sock cannot be
      released.
      
      Fixes: 5f08318f ("smc: connection data control (CDC)")
      Reported-by: default avatarWen Gu <guwen@linux.alibaba.com>
      Signed-off-by: default avatarDust Li <dust.li@linux.alibaba.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      349d4312
    • Dust Li's avatar
      net/smc: don't send CDC/LLC message if link not ready · 90cee52f
      Dust Li authored
      We found smc_llc_send_link_delete_all() sometimes wait
      for 2s timeout when testing with RDMA link up/down.
      It is possible when a smc_link is in ACTIVATING state,
      the underlaying QP is still in RESET or RTR state, which
      cannot send any messages out.
      
      smc_llc_send_link_delete_all() use smc_link_usable() to
      checks whether the link is usable, if the QP is still in
      RESET or RTR state, but the smc_link is in ACTIVATING, this
      LLC message will always fail without any CQE entering the
      CQ, and we will always wait 2s before timeout.
      
      Since we cannot send any messages through the QP before
      the QP enter RTS. I add a wrapper smc_link_sendable()
      which checks the state of QP along with the link state.
      And replace smc_link_usable() with smc_link_sendable()
      in all LLC & CDC message sending routine.
      
      Fixes: 5f08318f ("smc: connection data control (CDC)")
      Signed-off-by: default avatarDust Li <dust.li@linux.alibaba.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      90cee52f
    • Wei Yongjun's avatar
      NFC: st21nfca: Fix memory leak in device probe and remove · 1b9dadba
      Wei Yongjun authored
      'phy->pending_skb' is alloced when device probe, but forgot to free
      in the error handling path and remove path, this cause memory leak
      as follows:
      
      unreferenced object 0xffff88800bc06800 (size 512):
        comm "8", pid 11775, jiffies 4295159829 (age 9.032s)
        hex dump (first 32 bytes):
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        backtrace:
          [<00000000d66c09ce>] __kmalloc_node_track_caller+0x1ed/0x450
          [<00000000c93382b3>] kmalloc_reserve+0x37/0xd0
          [<000000005fea522c>] __alloc_skb+0x124/0x380
          [<0000000019f29f9a>] st21nfca_hci_i2c_probe+0x170/0x8f2
      
      Fix it by freeing 'pending_skb' in error and remove.
      
      Fixes: 68957303 ("NFC: ST21NFCA: Add driver for STMicroelectronics ST21NFCA NFC Chip")
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarWei Yongjun <weiyongjun1@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1b9dadba
    • Aleksander Jan Bajkowski's avatar
      net: lantiq_xrx200: fix statistics of received bytes · 5be60a94
      Aleksander Jan Bajkowski authored
      Received frames have FCS truncated. There is no need
      to subtract FCS length from the statistics.
      
      Fixes: fe1a5642 ("net: lantiq: Add Lantiq / Intel VRX200 Ethernet driver")
      Signed-off-by: default avatarAleksander Jan Bajkowski <olek2@wp.pl>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5be60a94
    • Christophe JAILLET's avatar
      net: ag71xx: Fix a potential double free in error handling paths · 1cd5384c
      Christophe JAILLET authored
      'ndev' is a managed resource allocated with devm_alloc_etherdev(), so there
      is no need to call free_netdev() explicitly or there will be a double
      free().
      
      Simplify all error handling paths accordingly.
      
      Fixes: d51b6ce4 ("net: ethernet: add ag71xx driver")
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1cd5384c
    • wolfgang huang's avatar
      mISDN: change function names to avoid conflicts · 8b5fdfc5
      wolfgang huang authored
      As we build for mips, we meet following error. l1_init error with
      multiple definition. Some architecture devices usually marked with
      l1, l2, lxx as the start-up phase. so we change the mISDN function
      names, align with Isdnl2_xxx.
      
      mips-linux-gnu-ld: drivers/isdn/mISDN/layer1.o: in function `l1_init':
      (.text+0x890): multiple definition of `l1_init'; \
      arch/mips/kernel/bmips_5xxx_init.o:(.text+0xf0): first defined here
      make[1]: *** [home/mips/kernel-build/linux/Makefile:1161: vmlinux] Error 1
      Signed-off-by: default avatarwolfgang huang <huangjinhui@kylinos.cn>
      Reported-by: default avatark2ci <kernel-bot@kylinos.cn>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8b5fdfc5
  5. 27 Dec, 2021 5 commits