1. 04 Jun, 2021 8 commits
  2. 03 Jun, 2021 32 commits
    • David S. Miller's avatar
      Merge tag 'for-net-2021-06-03' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth · 579028de
      David S. Miller authored
      bluetooth pull request for net:
      
       - Fixes UAF and CVE-2021-3564
       - Fix VIRTIO_ID_BT to use an unassigned ID
       - Fix firmware loading on some Intel Controllers
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      579028de
    • Xuan Zhuo's avatar
      virtio-net: fix for skb_over_panic inside big mode · 1a802423
      Xuan Zhuo authored
      In virtio-net's large packet mode, there is a hole in the space behind
      buf.
      
          hdr_padded_len - hdr_len
      
      We must take this into account when calculating tailroom.
      
      [   44.544385] skb_put.cold (net/core/skbuff.c:5254 (discriminator 1) net/core/skbuff.c:5252 (discriminator 1))
      [   44.544864] page_to_skb (drivers/net/virtio_net.c:485) [   44.545361] receive_buf (drivers/net/virtio_net.c:849 drivers/net/virtio_net.c:1131)
      [   44.545870] ? netif_receive_skb_list_internal (net/core/dev.c:5714)
      [   44.546628] ? dev_gro_receive (net/core/dev.c:6103)
      [   44.547135] ? napi_complete_done (./include/linux/list.h:35 net/core/dev.c:5867 net/core/dev.c:5862 net/core/dev.c:6565)
      [   44.547672] virtnet_poll (drivers/net/virtio_net.c:1427 drivers/net/virtio_net.c:1525)
      [   44.548251] __napi_poll (net/core/dev.c:6985)
      [   44.548744] net_rx_action (net/core/dev.c:7054 net/core/dev.c:7139)
      [   44.549264] __do_softirq (./arch/x86/include/asm/jump_label.h:19 ./include/linux/jump_label.h:200 ./include/trace/events/irq.h:142 kernel/softirq.c:560)
      [   44.549762] irq_exit_rcu (kernel/softirq.c:433 kernel/softirq.c:637 kernel/softirq.c:649)
      [   44.551384] common_interrupt (arch/x86/kernel/irq.c:240 (discriminator 13))
      [   44.551991] ? asm_common_interrupt (./arch/x86/include/asm/idtentry.h:638)
      [   44.552654] asm_common_interrupt (./arch/x86/include/asm/idtentry.h:638)
      
      Fixes: fb32856b ("virtio-net: page_to_skb() use build_skb when there's sufficient tailroom")
      Signed-off-by: default avatarXuan Zhuo <xuanzhuo@linux.alibaba.com>
      Reported-by: default avatarCorentin Noël <corentin.noel@collabora.com>
      Tested-by: default avatarCorentin Noël <corentin.noel@collabora.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1a802423
    • David S. Miller's avatar
      Merge tag 'ieee802154-for-davem-2021-06-03' of... · e31d57ca
      David S. Miller authored
      Merge tag 'ieee802154-for-davem-2021-06-03' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan
      
      Stefan Schmidt says:
      
      ====================
      An update from ieee802154 for your *net* tree.
      
      This time we have fixes for the ieee802154 netlink code, as well as a driver
      fix. Zhen Lei, Wei Yongjun and Yang Li each had  a patch to cleanup some return
      code handling ensuring we actually get a real error code when things fails.
      
      Dan Robertson fixed a potential null dereference in our netlink handling.
      
      Andy Shevchenko removed of_match_ptr()usage in the mrf24j40 driver.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e31d57ca
    • Coco Li's avatar
      ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions · 821bbf79
      Coco Li authored
      Reported by syzbot:
      HEAD commit:    90c911ad Merge tag 'fixes' of git://git.kernel.org/pub/scm..
      git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
      dashboard link: https://syzkaller.appspot.com/bug?extid=123aa35098fd3c000eb7
      compiler:       Debian clang version 11.0.1-2
      
      ==================================================================
      BUG: KASAN: slab-out-of-bounds in fib6_nh_get_excptn_bucket net/ipv6/route.c:1604 [inline]
      BUG: KASAN: slab-out-of-bounds in fib6_nh_flush_exceptions+0xbd/0x360 net/ipv6/route.c:1732
      Read of size 8 at addr ffff8880145c78f8 by task syz-executor.4/17760
      
      CPU: 0 PID: 17760 Comm: syz-executor.4 Not tainted 5.12.0-rc8-syzkaller #0
      Call Trace:
       <IRQ>
       __dump_stack lib/dump_stack.c:79 [inline]
       dump_stack+0x202/0x31e lib/dump_stack.c:120
       print_address_description+0x5f/0x3b0 mm/kasan/report.c:232
       __kasan_report mm/kasan/report.c:399 [inline]
       kasan_report+0x15c/0x200 mm/kasan/report.c:416
       fib6_nh_get_excptn_bucket net/ipv6/route.c:1604 [inline]
       fib6_nh_flush_exceptions+0xbd/0x360 net/ipv6/route.c:1732
       fib6_nh_release+0x9a/0x430 net/ipv6/route.c:3536
       fib6_info_destroy_rcu+0xcb/0x1c0 net/ipv6/ip6_fib.c:174
       rcu_do_batch kernel/rcu/tree.c:2559 [inline]
       rcu_core+0x8f6/0x1450 kernel/rcu/tree.c:2794
       __do_softirq+0x372/0x7a6 kernel/softirq.c:345
       invoke_softirq kernel/softirq.c:221 [inline]
       __irq_exit_rcu+0x22c/0x260 kernel/softirq.c:422
       irq_exit_rcu+0x5/0x20 kernel/softirq.c:434
       sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1100
       </IRQ>
       asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
      RIP: 0010:lock_acquire+0x1f6/0x720 kernel/locking/lockdep.c:5515
      Code: f6 84 24 a1 00 00 00 02 0f 85 8d 02 00 00 f7 c3 00 02 00 00 49 bd 00 00 00 00 00 fc ff df 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 3d 00 00 00 00 00 4b c7 44 3d 09 00 00 00 00 43 c7 44 3d
      RSP: 0018:ffffc90009e06560 EFLAGS: 00000206
      RAX: 1ffff920013c0cc0 RBX: 0000000000000246 RCX: dffffc0000000000
      RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
      RBP: ffffc90009e066e0 R08: dffffc0000000000 R09: fffffbfff1f992b1
      R10: fffffbfff1f992b1 R11: 0000000000000000 R12: 0000000000000000
      R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff920013c0cb4
       rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:267
       rcu_read_lock include/linux/rcupdate.h:656 [inline]
       ext4_get_group_info+0xea/0x340 fs/ext4/ext4.h:3231
       ext4_mb_prefetch+0x123/0x5d0 fs/ext4/mballoc.c:2212
       ext4_mb_regular_allocator+0x8a5/0x28f0 fs/ext4/mballoc.c:2379
       ext4_mb_new_blocks+0xc6e/0x24f0 fs/ext4/mballoc.c:4982
       ext4_ext_map_blocks+0x2be3/0x7210 fs/ext4/extents.c:4238
       ext4_map_blocks+0xab3/0x1cb0 fs/ext4/inode.c:638
       ext4_getblk+0x187/0x6c0 fs/ext4/inode.c:848
       ext4_bread+0x2a/0x1c0 fs/ext4/inode.c:900
       ext4_append+0x1a4/0x360 fs/ext4/namei.c:67
       ext4_init_new_dir+0x337/0xa10 fs/ext4/namei.c:2768
       ext4_mkdir+0x4b8/0xc00 fs/ext4/namei.c:2814
       vfs_mkdir+0x45b/0x640 fs/namei.c:3819
       ovl_do_mkdir fs/overlayfs/overlayfs.h:161 [inline]
       ovl_mkdir_real+0x53/0x1a0 fs/overlayfs/dir.c:146
       ovl_create_real+0x280/0x490 fs/overlayfs/dir.c:193
       ovl_workdir_create+0x425/0x600 fs/overlayfs/super.c:788
       ovl_make_workdir+0xed/0x1140 fs/overlayfs/super.c:1355
       ovl_get_workdir fs/overlayfs/super.c:1492 [inline]
       ovl_fill_super+0x39ee/0x5370 fs/overlayfs/super.c:2035
       mount_nodev+0x52/0xe0 fs/super.c:1413
       legacy_get_tree+0xea/0x180 fs/fs_context.c:592
       vfs_get_tree+0x86/0x270 fs/super.c:1497
       do_new_mount fs/namespace.c:2903 [inline]
       path_mount+0x196f/0x2be0 fs/namespace.c:3233
       do_mount fs/namespace.c:3246 [inline]
       __do_sys_mount fs/namespace.c:3454 [inline]
       __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3431
       do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      RIP: 0033:0x4665f9
      Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
      RSP: 002b:00007f68f2b87188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
      RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9
      RDX: 00000000200000c0 RSI: 0000000020000000 RDI: 000000000040000a
      RBP: 00000000004bfbb9 R08: 0000000020000100 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
      R13: 00007ffe19002dff R14: 00007f68f2b87300 R15: 0000000000022000
      
      Allocated by task 17768:
       kasan_save_stack mm/kasan/common.c:38 [inline]
       kasan_set_track mm/kasan/common.c:46 [inline]
       set_alloc_info mm/kasan/common.c:427 [inline]
       ____kasan_kmalloc+0xc2/0xf0 mm/kasan/common.c:506
       kasan_kmalloc include/linux/kasan.h:233 [inline]
       __kmalloc+0xb4/0x380 mm/slub.c:4055
       kmalloc include/linux/slab.h:559 [inline]
       kzalloc include/linux/slab.h:684 [inline]
       fib6_info_alloc+0x2c/0xd0 net/ipv6/ip6_fib.c:154
       ip6_route_info_create+0x55d/0x1a10 net/ipv6/route.c:3638
       ip6_route_add+0x22/0x120 net/ipv6/route.c:3728
       inet6_rtm_newroute+0x2cd/0x2260 net/ipv6/route.c:5352
       rtnetlink_rcv_msg+0xb34/0xe70 net/core/rtnetlink.c:5553
       netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2502
       netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
       netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1338
       netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1927
       sock_sendmsg_nosec net/socket.c:654 [inline]
       sock_sendmsg net/socket.c:674 [inline]
       ____sys_sendmsg+0x5a2/0x900 net/socket.c:2350
       ___sys_sendmsg net/socket.c:2404 [inline]
       __sys_sendmsg+0x319/0x400 net/socket.c:2433
       do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Last potentially related work creation:
       kasan_save_stack+0x27/0x50 mm/kasan/common.c:38
       kasan_record_aux_stack+0xee/0x120 mm/kasan/generic.c:345
       __call_rcu kernel/rcu/tree.c:3039 [inline]
       call_rcu+0x1b1/0xa30 kernel/rcu/tree.c:3114
       fib6_info_release include/net/ip6_fib.h:337 [inline]
       ip6_route_info_create+0x10c4/0x1a10 net/ipv6/route.c:3718
       ip6_route_add+0x22/0x120 net/ipv6/route.c:3728
       inet6_rtm_newroute+0x2cd/0x2260 net/ipv6/route.c:5352
       rtnetlink_rcv_msg+0xb34/0xe70 net/core/rtnetlink.c:5553
       netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2502
       netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
       netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1338
       netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1927
       sock_sendmsg_nosec net/socket.c:654 [inline]
       sock_sendmsg net/socket.c:674 [inline]
       ____sys_sendmsg+0x5a2/0x900 net/socket.c:2350
       ___sys_sendmsg net/socket.c:2404 [inline]
       __sys_sendmsg+0x319/0x400 net/socket.c:2433
       do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Second to last potentially related work creation:
       kasan_save_stack+0x27/0x50 mm/kasan/common.c:38
       kasan_record_aux_stack+0xee/0x120 mm/kasan/generic.c:345
       insert_work+0x54/0x400 kernel/workqueue.c:1331
       __queue_work+0x981/0xcc0 kernel/workqueue.c:1497
       queue_work_on+0x111/0x200 kernel/workqueue.c:1524
       queue_work include/linux/workqueue.h:507 [inline]
       call_usermodehelper_exec+0x283/0x470 kernel/umh.c:433
       kobject_uevent_env+0x1349/0x1730 lib/kobject_uevent.c:617
       kvm_uevent_notify_change+0x309/0x3b0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4809
       kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:877 [inline]
       kvm_put_kvm+0x9c/0xd10 arch/x86/kvm/../../../virt/kvm/kvm_main.c:920
       kvm_vcpu_release+0x53/0x60 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3120
       __fput+0x352/0x7b0 fs/file_table.c:280
       task_work_run+0x146/0x1c0 kernel/task_work.c:140
       tracehook_notify_resume include/linux/tracehook.h:189 [inline]
       exit_to_user_mode_loop kernel/entry/common.c:174 [inline]
       exit_to_user_mode_prepare+0x10b/0x1e0 kernel/entry/common.c:208
       __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
       syscall_exit_to_user_mode+0x26/0x70 kernel/entry/common.c:301
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      The buggy address belongs to the object at ffff8880145c7800
       which belongs to the cache kmalloc-192 of size 192
      The buggy address is located 56 bytes to the right of
       192-byte region [ffff8880145c7800, ffff8880145c78c0)
      The buggy address belongs to the page:
      page:ffffea00005171c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x145c7
      flags: 0xfff00000000200(slab)
      raw: 00fff00000000200 ffffea00006474c0 0000000200000002 ffff888010c41a00
      raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
      page dumped because: kasan: bad access detected
      
      Memory state around the buggy address:
       ffff8880145c7780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
       ffff8880145c7800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      >ffff8880145c7880: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
                                                                      ^
       ffff8880145c7900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
       ffff8880145c7980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
      ==================================================================
      
      In the ip6_route_info_create function, in the case that the nh pointer
      is not NULL, the fib6_nh in fib6_info has not been allocated.
      Therefore, when trying to free fib6_info in this error case using
      fib6_info_release, the function will call fib6_info_destroy_rcu,
      which it will access fib6_nh_release(f6i->fib6_nh);
      However, f6i->fib6_nh doesn't have any refcount yet given the lack of allocation
      causing the reported memory issue above.
      Therefore, releasing the empty pointer directly instead would be the solution.
      
      Fixes: f88d8ea6 ("ipv6: Plumb support for nexthop object in a fib6_info")
      Fixes: 706ec919 ("ipv6: Fix nexthop refcnt leak when creating ipv6 route info")
      Signed-off-by: default avatarCoco Li <lixiaoyan@google.com>
      Cc: David Ahern <dsahern@kernel.org>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      821bbf79
    • David S. Miller's avatar
      Merge tag 'wireless-drivers-2021-06-03' of... · 5e7a2c64
      David S. Miller authored
      Merge tag 'wireless-drivers-2021-06-03' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
      
      Kalle Valo says:
      
      ====================
      wireless-drivers fixes for v5.13
      
      We have only mt76 fixes this time, most important being the fix for
      A-MSDU injection attacks.
      
      mt76
      
      * mitigate A-MSDU injection attacks (CVE-2020-24588)
      
      * fix possible array out of bound access in mt7921_mcu_tx_rate_report
      
      * various aggregation and HE setting fixes
      
      * suspend/resume fix for pci devices
      
      * mt7615: fix crash when runtime-pm is not supported
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5e7a2c64
    • Zheng Yongjun's avatar
      fib: Return the correct errno code · 59607863
      Zheng Yongjun authored
      When kalloc or kmemdup failed, should return ENOMEM rather than ENOBUF.
      Signed-off-by: default avatarZheng Yongjun <zhengyongjun3@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      59607863
    • Zheng Yongjun's avatar
      net: Return the correct errno code · 49251cd0
      Zheng Yongjun authored
      When kalloc or kmemdup failed, should return ENOMEM rather than ENOBUF.
      Signed-off-by: default avatarZheng Yongjun <zhengyongjun3@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      49251cd0
    • Zheng Yongjun's avatar
      net/x25: Return the correct errno code · d7736958
      Zheng Yongjun authored
      When kalloc or kmemdup failed, should return ENOMEM rather than ENOBUF.
      Signed-off-by: default avatarZheng Yongjun <zhengyongjun3@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d7736958
    • Rahul Lakkireddy's avatar
      cxgb4: fix regression with HASH tc prio value update · a27fb314
      Rahul Lakkireddy authored
      commit db43b30c ("cxgb4: add ethtool n-tuple filter deletion")
      has moved searching for next highest priority HASH filter rule to
      cxgb4_flow_rule_destroy(), which searches the rhashtable before the
      the rule is removed from it and hence always finds at least 1 entry.
      Fix by removing the rule from rhashtable first before calling
      cxgb4_flow_rule_destroy() and hence avoid fetching stale info.
      
      Fixes: db43b30c ("cxgb4: add ethtool n-tuple filter deletion")
      Signed-off-by: default avatarRahul Lakkireddy <rahul.lakkireddy@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a27fb314
    • David S. Miller's avatar
      Merge branch 'caif-fixes' · e0310182
      David S. Miller authored
      Pavel Skripkin says:
      
      ====================
      This patch series fix 2 memory leaks in caif
      interface.
      
      Syzbot reported memory leak in cfserl_create().
      The problem was in cfcnfg_add_phy_layer() function.
      This function accepts struct cflayer *link_support and
      assign it to corresponting structures, but it can fail
      in some cases.
      
      These cases must be handled to prevent leaking allocated
      struct cflayer *link_support pointer, because if error accured
      before assigning link_support pointer to somewhere, this pointer
      must be freed.
      
      Fail log:
      
      [   49.051872][ T7010] caif:cfcnfg_add_phy_layer(): Too many CAIF Link Layers (max 6)
      [   49.110236][ T7042] caif:cfcnfg_add_phy_layer(): Too many CAIF Link Layers (max 6)
      [   49.134936][ T7045] caif:cfcnfg_add_phy_layer(): Too many CAIF Link Layers (max 6)
      [   49.163083][ T7043] caif:cfcnfg_add_phy_layer(): Too many CAIF Link Layers (max 6)
      [   55.248950][ T6994] kmemleak: 4 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
      
      int cfcnfg_add_phy_layer(..., struct cflayer *link_support, ...)
      {
      ...
      	/* CAIF protocol allow maximum 6 link-layers */
      	for (i = 0; i < 7; i++) {
      		phyid = (dev->ifindex + i) & 0x7;
      		if (phyid == 0)
      			continue;
      		if (cfcnfg_get_phyinfo_rcu(cnfg, phyid) == NULL)
      			goto got_phyid;
      	}
      	pr_warn("Too many CAIF Link Layers (max 6)\n");
      	goto out;
      ...
      	if (link_support != NULL) {
      		link_support->id = phyid;
      		layer_set_dn(frml, link_support);
      		layer_set_up(link_support, frml);
      		layer_set_dn(link_support, phy_layer);
      		layer_set_up(phy_layer, link_support);
      	}
      ...
      }
      
      As you can see, if cfcnfg_add_phy_layer fails before layer_set_*,
      link_support becomes leaked.
      
      So, in this series, I made cfcnfg_add_phy_layer()
      return an int and added error handling code to prevent
      leaking link_support pointer in caif_device_notify()
      and cfusbl_device_notify() functions.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e0310182
    • Pavel Skripkin's avatar
      net: caif: fix memory leak in cfusbl_device_notify · 7f5d8666
      Pavel Skripkin authored
      In case of caif_enroll_dev() fail, allocated
      link_support won't be assigned to the corresponding
      structure. So simply free allocated pointer in case
      of error.
      
      Fixes: 7ad65bf6 ("caif: Add support for CAIF over CDC NCM USB interface")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7f5d8666
    • Pavel Skripkin's avatar
      net: caif: fix memory leak in caif_device_notify · b53558a9
      Pavel Skripkin authored
      In case of caif_enroll_dev() fail, allocated
      link_support won't be assigned to the corresponding
      structure. So simply free allocated pointer in case
      of error
      
      Fixes: 7c18d220 ("caif: Restructure how link caif link layer enroll")
      Cc: stable@vger.kernel.org
      Reported-and-tested-by: syzbot+7ec324747ce876a29db6@syzkaller.appspotmail.com
      Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b53558a9
    • Pavel Skripkin's avatar
      net: caif: add proper error handling · a2805dca
      Pavel Skripkin authored
      caif_enroll_dev() can fail in some cases. Ingnoring
      these cases can lead to memory leak due to not assigning
      link_support pointer to anywhere.
      
      Fixes: 7c18d220 ("caif: Restructure how link caif link layer enroll")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a2805dca
    • Pavel Skripkin's avatar
      net: caif: added cfserl_release function · bce130e7
      Pavel Skripkin authored
      Added cfserl_release() function.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bce130e7
    • David S. Miller's avatar
      Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue · 4189777c
      David S. Miller authored
      Tony Nguyen says:
      
      ====================
      This series contains updates to igb, igc, ixgbe, ixgbevf, i40e and ice
      drivers.
      
      Kurt Kanzenbach fixes XDP for igb when PTP is enabled by pulling the
      timestamp and adjusting appropriate values prior to XDP operations.
      
      Magnus adds missing exception tracing for XDP on igb, igc, ixgbe,
      ixgbevf, i40e and ice drivers.
      
      Maciej adds tracking of AF_XDP zero copy enabled queues to resolve an
      issue with copy mode Tx for the ice driver.
      
      Note: Patch 7 will conflict when merged with net-next. Please carry
      these changes forward. IGC_XDP_TX and IGC_XDP_REDIRECT will need to be
      changed to return to conform with the net-next changes. Let me know if
      you have issues.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4189777c
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf · 86b84066
      David S. Miller authored
      Daniel Borkmann says:
      
      ====================
      pull-request: bpf 2021-06-02
      
      The following pull-request contains BPF updates for your *net* tree.
      
      We've added 2 non-merge commits during the last 7 day(s) which contain
      a total of 4 files changed, 19 insertions(+), 24 deletions(-).
      
      The main changes are:
      
      1) Fix pahole BTF generation when ccache is used, from Javier Martinez Canillas.
      
      2) Fix BPF lockdown hooks in bpf_probe_read_kernel{,_str}() helpers which caused
         a deadlock from bcc programs, triggered OOM killer from audit side and didn't
         work generally with SELinux policy rules due to pointing to wrong task struct,
         from Daniel Borkmann.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      86b84066
    • Pavel Skripkin's avatar
      net: kcm: fix memory leak in kcm_sendmsg · c47cc304
      Pavel Skripkin authored
      Syzbot reported memory leak in kcm_sendmsg()[1].
      The problem was in non-freed frag_list in case of error.
      
      In the while loop:
      
      	if (head == skb)
      		skb_shinfo(head)->frag_list = tskb;
      	else
      		skb->next = tskb;
      
      frag_list filled with skbs, but nothing was freeing them.
      
      backtrace:
        [<0000000094c02615>] __alloc_skb+0x5e/0x250 net/core/skbuff.c:198
        [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
        [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967 [1]
        [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
        [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
      
      Reported-and-tested-by: syzbot+b039f5699bd82e1fb011@syzkaller.appspotmail.com
      Fixes: ab7ac4eb ("kcm: Kernel Connection Multiplexor module")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c47cc304
    • Luiz Augusto von Dentz's avatar
      Bluetooth: btusb: Fix failing to init controllers with operation firmware · 1f14a620
      Luiz Augusto von Dentz authored
      Some firmware when operation don't may have broken versions leading to
      error like the following:
      
      [    6.176482] Bluetooth: hci0: Firmware revision 0.0 build 121 week 7 2021
      [    6.177906] bluetooth hci0: Direct firmware load for intel/ibt-20-0-0.sfi failed with error -2
      [    6.177910] Bluetooth: hci0: Failed to load Intel firmware file intel/ibt-20-0-0.sfi (-2)
      
      Since we load the firmware file just to check if its version had changed
      comparing to the one already loaded we can just skip since the firmware
      is already operation.
      
      Fixes: ac056546 ("Bluetooth: btintel: Check firmware version before
      download")
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      1f14a620
    • Marcel Holtmann's avatar
      Bluetooth: Fix VIRTIO_ID_BT assigned number · a83d9585
      Marcel Holtmann authored
      It turned out that the VIRTIO_ID_* are not assigned in the virtio_ids.h
      file in the upstream kernel. Picking the next free one was wrong and
      there is a process that has been followed now.
      
      See https://github.com/oasis-tcs/virtio-spec/issues/108 for details.
      
      Fixes: afd2daa2 ("Bluetooth: Add support for virtio transport driver")
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      a83d9585
    • zhang kai's avatar
      sit: set name of device back to struct parms · 261ba78c
      zhang kai authored
      addrconf_set_sit_dstaddr will use parms->name.
      Signed-off-by: default avatarzhang kai <zhangkaiheb@126.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      261ba78c
    • Jiapeng Chong's avatar
      rtnetlink: Fix missing error code in rtnl_bridge_notify() · a8db57c1
      Jiapeng Chong authored
      The error code is missing in this code scenario, add the error code
      '-EINVAL' to the return value 'err'.
      
      Eliminate the follow smatch warning:
      
      net/core/rtnetlink.c:4834 rtnl_bridge_notify() warn: missing error code
      'err'.
      Reported-by: default avatarAbaci Robot <abaci@linux.alibaba.com>
      Signed-off-by: default avatarJiapeng Chong <jiapeng.chong@linux.alibaba.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a8db57c1
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · 59717f39
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for net:
      
      1) Do not allow to add conntrack helper extension for confirmed
         conntracks in the nf_tables ct expectation support.
      
      2) Fix bogus EBUSY in nfnetlink_cthelper when NFCTH_PRIV_DATA_LEN
         is passed on userspace helper updates.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      59717f39
    • Maciej Fijalkowski's avatar
      ice: track AF_XDP ZC enabled queues in bitmap · e102db78
      Maciej Fijalkowski authored
      Commit c7a21904 ("ice: Remove xsk_buff_pool from VSI structure")
      silently introduced a regression and broke the Tx side of AF_XDP in copy
      mode. xsk_pool on ice_ring is set only based on the existence of the XDP
      prog on the VSI which in turn picks ice_clean_tx_irq_zc to be executed.
      That is not something that should happen for copy mode as it should use
      the regular data path ice_clean_tx_irq.
      
      This results in a following splat when xdpsock is run in txonly or l2fwd
      scenarios in copy mode:
      
      <snip>
      [  106.050195] BUG: kernel NULL pointer dereference, address: 0000000000000030
      [  106.057269] #PF: supervisor read access in kernel mode
      [  106.062493] #PF: error_code(0x0000) - not-present page
      [  106.067709] PGD 0 P4D 0
      [  106.070293] Oops: 0000 [#1] PREEMPT SMP NOPTI
      [  106.074721] CPU: 61 PID: 0 Comm: swapper/61 Not tainted 5.12.0-rc2+ #45
      [  106.081436] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019
      [  106.092027] RIP: 0010:xp_raw_get_dma+0x36/0x50
      [  106.096551] Code: 74 14 48 b8 ff ff ff ff ff ff 00 00 48 21 f0 48 c1 ee 30 48 01 c6 48 8b 87 90 00 00 00 48 89 f2 81 e6 ff 0f 00 00 48 c1 ea 0c <48> 8b 04 d0 48 83 e0 fe 48 01 f0 c3 66 66 2e 0f 1f 84 00 00 00 00
      [  106.115588] RSP: 0018:ffffc9000d694e50 EFLAGS: 00010206
      [  106.120893] RAX: 0000000000000000 RBX: ffff88984b8c8a00 RCX: ffff889852581800
      [  106.128137] RDX: 0000000000000006 RSI: 0000000000000000 RDI: ffff88984cd8b800
      [  106.135383] RBP: ffff888123b50001 R08: ffff889896800000 R09: 0000000000000800
      [  106.142628] R10: 0000000000000000 R11: ffffffff826060c0 R12: 00000000000000ff
      [  106.149872] R13: 0000000000000000 R14: 0000000000000040 R15: ffff888123b50018
      [  106.157117] FS:  0000000000000000(0000) GS:ffff8897e0f40000(0000) knlGS:0000000000000000
      [  106.165332] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  106.171163] CR2: 0000000000000030 CR3: 000000000560a004 CR4: 00000000007706e0
      [  106.178408] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  106.185653] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [  106.192898] PKRU: 55555554
      [  106.195653] Call Trace:
      [  106.198143]  <IRQ>
      [  106.200196]  ice_clean_tx_irq_zc+0x183/0x2a0 [ice]
      [  106.205087]  ice_napi_poll+0x3e/0x590 [ice]
      [  106.209356]  __napi_poll+0x2a/0x160
      [  106.212911]  net_rx_action+0xd6/0x200
      [  106.216634]  __do_softirq+0xbf/0x29b
      [  106.220274]  irq_exit_rcu+0x88/0xc0
      [  106.223819]  common_interrupt+0x7b/0xa0
      [  106.227719]  </IRQ>
      [  106.229857]  asm_common_interrupt+0x1e/0x40
      </snip>
      
      Fix this by introducing the bitmap of queues that are zero-copy enabled,
      where each bit, corresponding to a queue id that xsk pool is being
      configured on, will be set/cleared within ice_xsk_pool_{en,dis}able and
      checked within ice_xsk_pool(). The latter is a function used for
      deciding which napi poll routine is executed.
      Idea is being taken from our other drivers such as i40e and ixgbe.
      
      Fixes: c7a21904 ("ice: Remove xsk_buff_pool from VSI structure")
      Signed-off-by: default avatarMaciej Fijalkowski <maciej.fijalkowski@intel.com>
      Tested-by: default avatarKiran Bhandare <kiranx.bhandare@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      e102db78
    • Magnus Karlsson's avatar
      igc: add correct exception tracing for XDP · 45ce0859
      Magnus Karlsson authored
      Add missing exception tracing to XDP when a number of different
      errors can occur. The support was only partial. Several errors
      where not logged which would confuse the user quite a lot not
      knowing where and why the packets disappeared.
      
      Fixes: 73f1071c ("igc: Add support for XDP_TX action")
      Fixes: 4ff32036 ("igc: Add support for XDP_REDIRECT action")
      Reported-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarMagnus Karlsson <magnus.karlsson@intel.com>
      Tested-by: default avatarDvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      45ce0859
    • Magnus Karlsson's avatar
      ixgbevf: add correct exception tracing for XDP · faae8142
      Magnus Karlsson authored
      Add missing exception tracing to XDP when a number of different
      errors can occur. The support was only partial. Several errors
      where not logged which would confuse the user quite a lot not
      knowing where and why the packets disappeared.
      
      Fixes: 21092e9c ("ixgbevf: Add support for XDP_TX action")
      Reported-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarMagnus Karlsson <magnus.karlsson@intel.com>
      Tested-by: default avatarVishakha Jambekar <vishakha.jambekar@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      faae8142
    • Magnus Karlsson's avatar
      igb: add correct exception tracing for XDP · 74431c40
      Magnus Karlsson authored
      Add missing exception tracing to XDP when a number of different
      errors can occur. The support was only partial. Several errors
      where not logged which would confuse the user quite a lot not
      knowing where and why the packets disappeared.
      
      Fixes: 9cbc948b ("igb: add XDP support")
      Reported-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarMagnus Karlsson <magnus.karlsson@intel.com>
      Tested-by: default avatarVishakha Jambekar <vishakha.jambekar@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      74431c40
    • Magnus Karlsson's avatar
      ixgbe: add correct exception tracing for XDP · 8281356b
      Magnus Karlsson authored
      Add missing exception tracing to XDP when a number of different
      errors can occur. The support was only partial. Several errors
      where not logged which would confuse the user quite a lot not
      knowing where and why the packets disappeared.
      
      Fixes: 33fdc82f ("ixgbe: add support for XDP_TX action")
      Fixes: d0bcacd0 ("ixgbe: add AF_XDP zero-copy Rx support")
      Reported-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarMagnus Karlsson <magnus.karlsson@intel.com>
      Tested-by: default avatarVishakha Jambekar <vishakha.jambekar@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      8281356b
    • Magnus Karlsson's avatar
      ice: add correct exception tracing for XDP · 89d65df0
      Magnus Karlsson authored
      Add missing exception tracing to XDP when a number of different
      errors can occur. The support was only partial. Several errors
      where not logged which would confuse the user quite a lot not
      knowing where and why the packets disappeared.
      
      Fixes: efc2214b ("ice: Add support for XDP")
      Fixes: 2d4238f5 ("ice: Add support for AF_XDP")
      Reported-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarMagnus Karlsson <magnus.karlsson@intel.com>
      Tested-by: default avatarKiran Bhandare <kiranx.bhandare@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      89d65df0
    • Magnus Karlsson's avatar
      i40e: add correct exception tracing for XDP · f6c10b48
      Magnus Karlsson authored
      Add missing exception tracing to XDP when a number of different errors
      can occur. The support was only partial. Several errors where not
      logged which would confuse the user quite a lot not knowing where and
      why the packets disappeared.
      
      Fixes: 74608d17 ("i40e: add support for XDP_TX action")
      Fixes: 0a714186 ("i40e: add AF_XDP zero-copy Rx support")
      Reported-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarMagnus Karlsson <magnus.karlsson@intel.com>
      Tested-by: default avatarKiran Bhandare <kiranx.bhandare@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      f6c10b48
    • Kurt Kanzenbach's avatar
      igb: Fix XDP with PTP enabled · 53792608
      Kurt Kanzenbach authored
      When using native XDP with the igb driver, the XDP frame data doesn't point to
      the beginning of the packet. It's off by 16 bytes. Everything works as expected
      with XDP skb mode.
      
      Actually these 16 bytes are used to store the packet timestamps. Therefore, pull
      the timestamp before executing any XDP operations and adjust all other code
      accordingly. The igc driver does it like that as well.
      
      Tested with Intel i210 card and AF_XDP sockets.
      
      Fixes: 9cbc948b ("igb: add XDP support")
      Signed-off-by: Kurt Kanzenbach's avatarKurt Kanzenbach <kurt@linutronix.de>
      Acked-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Tested-by: default avatarSandeep Penigalapati <sandeep.penigalapati@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      53792608
    • Wei Yongjun's avatar
      ieee802154: fix error return code in ieee802154_llsec_getparams() · 373e864c
      Wei Yongjun authored
      Fix to return negative error code -ENOBUFS from the error handling
      case instead of 0, as done elsewhere in this function.
      
      Fixes: 3e9c156e ("ieee802154: add netlink interfaces for llsec")
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarWei Yongjun <weiyongjun1@huawei.com>
      Link: https://lore.kernel.org/r/20210519141614.3040055-1-weiyongjun1@huawei.comSigned-off-by: default avatarStefan Schmidt <stefan@datenfreihafen.org>
      373e864c
    • Zhen Lei's avatar
      ieee802154: fix error return code in ieee802154_add_iface() · 79c6b8ed
      Zhen Lei authored
      Fix to return a negative error code from the error handling
      case instead of 0, as done elsewhere in this function.
      
      Fixes: be51da0f ("ieee802154: Stop using NLA_PUT*().")
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarZhen Lei <thunder.leizhen@huawei.com>
      Link: https://lore.kernel.org/r/20210508062517.2574-1-thunder.leizhen@huawei.comSigned-off-by: default avatarStefan Schmidt <stefan@datenfreihafen.org>
      79c6b8ed