1. 19 Apr, 2018 1 commit
    • Subash Abhinov Kasiviswanathan's avatar
      net: qualcomm: rmnet: Fix warning seen with fill_info · 64e86fec
      Subash Abhinov Kasiviswanathan authored
      When the last rmnet device attached to a real device is removed, the
      real device is unregistered from rmnet. As a result, the real device
      lookup fails resulting in a warning when the fill_info handler is
      called as part of the rmnet device unregistration.
      
      Fix this by returning the rmnet flags as 0 when no real device is
      present.
      
      WARNING: CPU: 0 PID: 1779 at net/core/rtnetlink.c:3254
      rtmsg_ifinfo_build_skb+0xca/0x10d
      Modules linked in:
      CPU: 0 PID: 1779 Comm: ip Not tainted 4.16.0-11872-g7ce23672 #1
      Stack:
       7fe655f0 60371ea3 00000000 00000000
       60282bc6 6006b116 7fe65600 60371ee8
       7fe65660 6003a68c 00000000 900000000
      Call Trace:
       [<6006b116>] ? printk+0x0/0x94
       [<6001f375>] show_stack+0xfe/0x158
       [<60371ea3>] ? dump_stack_print_info+0xe8/0xf1
       [<60282bc6>] ? rtmsg_ifinfo_build_skb+0xca/0x10d
       [<6006b116>] ? printk+0x0/0x94
       [<60371ee8>] dump_stack+0x2a/0x2c
       [<6003a68c>] __warn+0x10e/0x13e
       [<6003a82c>] warn_slowpath_null+0x48/0x4f
       [<60282bc6>] rtmsg_ifinfo_build_skb+0xca/0x10d
       [<60282c4d>] rtmsg_ifinfo_event.part.37+0x1e/0x43
       [<60282c2f>] ? rtmsg_ifinfo_event.part.37+0x0/0x43
       [<60282d03>] rtmsg_ifinfo+0x24/0x28
       [<60264e86>] dev_close_many+0xba/0x119
       [<60282cdf>] ? rtmsg_ifinfo+0x0/0x28
       [<6027c225>] ? rtnl_is_locked+0x0/0x1c
       [<6026ca67>] rollback_registered_many+0x1ae/0x4ae
       [<600314be>] ? unblock_signals+0x0/0xae
       [<6026cdc0>] ? unregister_netdevice_queue+0x19/0xec
       [<6026ceec>] unregister_netdevice_many+0x21/0xa1
       [<6027c765>] rtnl_delete_link+0x3e/0x4e
       [<60280ecb>] rtnl_dellink+0x262/0x29c
       [<6027c241>] ? rtnl_get_link+0x0/0x3e
       [<6027f867>] rtnetlink_rcv_msg+0x235/0x274
      
      Fixes: be81a85f ("net: qualcomm: rmnet: Implement fill_info")
      Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      64e86fec
  2. 18 Apr, 2018 3 commits
    • Bjørn Mork's avatar
      tun: fix vlan packet truncation · 81c89507
      Bjørn Mork authored
      Bogus trimming in tun_net_xmit() causes truncated vlan packets.
      
      skb->len is correct whether or not skb_vlan_tag_present() is true. There
      is no more reason to adjust the skb length on xmit in this driver than
      any other driver. tun_put_user() adds 4 bytes to the total for tagged
      packets because it transmits the tag inline to userspace.  This is
      similar to a nic transmitting the tag inline on the wire.
      
      Reproducing the bug by sending any tagged packet through back-to-back
      connected tap interfaces:
      
       socat TUN,tun-type=tap,iff-up,tun-name=in TUN,tun-type=tap,iff-up,tun-name=out &
       ip link add link in name in.20 type vlan id 20
       ip addr add 10.9.9.9/24 dev in.20
       ip link set in.20 up
       tshark -nxxi in -f arp -c1 2>/dev/null &
       tshark -nxxi out -f arp -c1 2>/dev/null &
       ping -c 1 10.9.9.5 >/dev/null 2>&1
      
      The output from the 'in' and 'out' interfaces are different when the
      bug is present:
      
       Capturing on 'in'
       0000  ff ff ff ff ff ff 76 cf 76 37 d5 0a 81 00 00 14   ......v.v7......
       0010  08 06 00 01 08 00 06 04 00 01 76 cf 76 37 d5 0a   ..........v.v7..
       0020  0a 09 09 09 00 00 00 00 00 00 0a 09 09 05         ..............
      
       Capturing on 'out'
       0000  ff ff ff ff ff ff 76 cf 76 37 d5 0a 81 00 00 14   ......v.v7......
       0010  08 06 00 01 08 00 06 04 00 01 76 cf 76 37 d5 0a   ..........v.v7..
       0020  0a 09 09 09 00 00 00 00 00 00                     ..........
      
      Fixes: aff3d70a ("tun: allow to attach ebpf socket filter")
      Cc: Jason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarBjørn Mork <bjorn@mork.no>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      81c89507
    • Tung Nguyen's avatar
      tipc: fix infinite loop when dumping link monitor summary · 36a50a98
      Tung Nguyen authored
      When configuring the number of used bearers to MAX_BEARER and issuing
      command "tipc link monitor summary", the command enters infinite loop
      in user space.
      
      This issue happens because function tipc_nl_node_dump_monitor() returns
      the wrong 'prev_bearer' value when all potential monitors have been
      scanned.
      
      The correct behavior is to always try to scan all monitors until either
      the netlink message is full, in which case we return the bearer identity
      of the affected monitor, or we continue through the whole bearer array
      until we can return MAX_BEARERS. This solution also caters for the case
      where there may be gaps in the bearer array.
      Signed-off-by: default avatarTung Nguyen <tung.q.nguyen@dektech.com.au>
      Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      36a50a98
    • Jon Maloy's avatar
      tipc: fix use-after-free in tipc_nametbl_stop · be47e41d
      Jon Maloy authored
      When we delete a service item in tipc_nametbl_stop() we loop over
      all service ranges in the service's RB tree, and for each service
      range we loop over its pertaining publications while calling
      tipc_service_remove_publ() for each of them.
      
      However, tipc_service_remove_publ() has the side effect that it also
      removes the comprising service range item when there are no publications
      left. This leads to a "use-after-free" access when the inner loop
      continues to the next iteration, since the range item holding the list
      we are looping no longer exists.
      
      We fix this by moving the delete of the service range item outside
      the said function. Instead, we now let the two functions calling it
      test if the list is empty and perform the removal when that is the
      case.
      
      Reported-by: syzbot+d64b64afc55660106556@syzkaller.appspotmail.com
      Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      be47e41d
  3. 17 Apr, 2018 5 commits
    • Eric Biggers's avatar
      KEYS: DNS: limit the length of option strings · 9c438d7a
      Eric Biggers authored
      Adding a dns_resolver key whose payload contains a very long option name
      resulted in that string being printed in full.  This hit the WARN_ONCE()
      in set_precision() during the printk(), because printk() only supports a
      precision of up to 32767 bytes:
      
          precision 1000000 too large
          WARNING: CPU: 0 PID: 752 at lib/vsprintf.c:2189 vsnprintf+0x4bc/0x5b0
      
      Fix it by limiting option strings (combined name + value) to a much more
      reasonable 128 bytes.  The exact limit is arbitrary, but currently the
      only recognized option is formatted as "dnserror=%lu" which fits well
      within this limit.
      
      Also ratelimit the printks.
      
      Reproducer:
      
          perl -e 'print "#", "A" x 1000000, "\x00"' | keyctl padd dns_resolver desc @s
      
      This bug was found using syzkaller.
      Reported-by: default avatarMark Rutland <mark.rutland@arm.com>
      Fixes: 4a2d7892 ("DNS: If the DNS server returns an error, allow that to be cached [ver #2]")
      Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9c438d7a
    • Bert Kenward's avatar
      sfc: check RSS is active for filter insert · 89bda97b
      Bert Kenward authored
      For some firmware variants - specifically 'capture packed stream' - RSS
      filters are not valid. We must check if RSS is actually active rather
      than merely enabled.
      
      Fixes: 42356d9a ("sfc: support RSS spreading of ethtool ntuple filters")
      Signed-off-by: default avatarBert Kenward <bkenward@solarflare.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      89bda97b
    • Toshiaki Makita's avatar
      vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi · 7ce23672
      Toshiaki Makita authored
      Syzkaller spotted an old bug which leads to reading skb beyond tail by 4
      bytes on vlan tagged packets.
      This is caused because skb_vlan_tagged_multi() did not check
      skb_headlen.
      
      BUG: KMSAN: uninit-value in eth_type_vlan include/linux/if_vlan.h:283 [inline]
      BUG: KMSAN: uninit-value in skb_vlan_tagged_multi include/linux/if_vlan.h:656 [inline]
      BUG: KMSAN: uninit-value in vlan_features_check include/linux/if_vlan.h:672 [inline]
      BUG: KMSAN: uninit-value in dflt_features_check net/core/dev.c:2949 [inline]
      BUG: KMSAN: uninit-value in netif_skb_features+0xd1b/0xdc0 net/core/dev.c:3009
      CPU: 1 PID: 3582 Comm: syzkaller435149 Not tainted 4.16.0+ #82
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
        __dump_stack lib/dump_stack.c:17 [inline]
        dump_stack+0x185/0x1d0 lib/dump_stack.c:53
        kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
        __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676
        eth_type_vlan include/linux/if_vlan.h:283 [inline]
        skb_vlan_tagged_multi include/linux/if_vlan.h:656 [inline]
        vlan_features_check include/linux/if_vlan.h:672 [inline]
        dflt_features_check net/core/dev.c:2949 [inline]
        netif_skb_features+0xd1b/0xdc0 net/core/dev.c:3009
        validate_xmit_skb+0x89/0x1320 net/core/dev.c:3084
        __dev_queue_xmit+0x1cb2/0x2b60 net/core/dev.c:3549
        dev_queue_xmit+0x4b/0x60 net/core/dev.c:3590
        packet_snd net/packet/af_packet.c:2944 [inline]
        packet_sendmsg+0x7c57/0x8a10 net/packet/af_packet.c:2969
        sock_sendmsg_nosec net/socket.c:630 [inline]
        sock_sendmsg net/socket.c:640 [inline]
        sock_write_iter+0x3b9/0x470 net/socket.c:909
        do_iter_readv_writev+0x7bb/0x970 include/linux/fs.h:1776
        do_iter_write+0x30d/0xd40 fs/read_write.c:932
        vfs_writev fs/read_write.c:977 [inline]
        do_writev+0x3c9/0x830 fs/read_write.c:1012
        SYSC_writev+0x9b/0xb0 fs/read_write.c:1085
        SyS_writev+0x56/0x80 fs/read_write.c:1082
        do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
        entry_SYSCALL_64_after_hwframe+0x3d/0xa2
      RIP: 0033:0x43ffa9
      RSP: 002b:00007fff2cff3948 EFLAGS: 00000217 ORIG_RAX: 0000000000000014
      RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043ffa9
      RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003
      RBP: 00000000006cb018 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004018d0
      R13: 0000000000401960 R14: 0000000000000000 R15: 0000000000000000
      
      Uninit was created at:
        kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
        kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188
        kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314
        kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321
        slab_post_alloc_hook mm/slab.h:445 [inline]
        slab_alloc_node mm/slub.c:2737 [inline]
        __kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369
        __kmalloc_reserve net/core/skbuff.c:138 [inline]
        __alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206
        alloc_skb include/linux/skbuff.h:984 [inline]
        alloc_skb_with_frags+0x1d4/0xb20 net/core/skbuff.c:5234
        sock_alloc_send_pskb+0xb56/0x1190 net/core/sock.c:2085
        packet_alloc_skb net/packet/af_packet.c:2803 [inline]
        packet_snd net/packet/af_packet.c:2894 [inline]
        packet_sendmsg+0x6444/0x8a10 net/packet/af_packet.c:2969
        sock_sendmsg_nosec net/socket.c:630 [inline]
        sock_sendmsg net/socket.c:640 [inline]
        sock_write_iter+0x3b9/0x470 net/socket.c:909
        do_iter_readv_writev+0x7bb/0x970 include/linux/fs.h:1776
        do_iter_write+0x30d/0xd40 fs/read_write.c:932
        vfs_writev fs/read_write.c:977 [inline]
        do_writev+0x3c9/0x830 fs/read_write.c:1012
        SYSC_writev+0x9b/0xb0 fs/read_write.c:1085
        SyS_writev+0x56/0x80 fs/read_write.c:1082
        do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
        entry_SYSCALL_64_after_hwframe+0x3d/0xa2
      
      Fixes: 58e998c6 ("offloading: Force software GSO for multiple vlan tags.")
      Reported-and-tested-by: syzbot+0bbe42c764feafa82c5a@syzkaller.appspotmail.com
      Signed-off-by: default avatarToshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7ce23672
    • Nicolas Dechesne's avatar
      net: qrtr: add MODULE_ALIAS_NETPROTO macro · 77ac725e
      Nicolas Dechesne authored
      To ensure that qrtr can be loaded automatically, when needed, if it is compiled
      as module.
      Signed-off-by: default avatarNicolas Dechesne <nicolas.dechesne@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      77ac725e
    • Stefan Hajnoczi's avatar
      VSOCK: make af_vsock.ko removable again · 05e489b1
      Stefan Hajnoczi authored
      Commit c1eef220 ("vsock: always call
      vsock_init_tables()") introduced a module_init() function without a
      corresponding module_exit() function.
      
      Modules with an init function can only be removed if they also have an
      exit function.  Therefore the vsock module was considered "permanent"
      and could not be removed.
      
      This patch adds an empty module_exit() function so that "rmmod vsock"
      works.  No explicit cleanup is required because:
      
      1. Transports call vsock_core_exit() upon exit and cannot be removed
         while sockets are still alive.
      2. vsock_diag.ko does not perform any action that requires cleanup by
         vsock.ko.
      
      Fixes: c1eef220 ("vsock: always call vsock_init_tables()")
      Reported-by: default avatarXiumei Mu <xmu@redhat.com>
      Cc: Cong Wang <xiyou.wangcong@gmail.com>
      Cc: Jorgen Hansen <jhansen@vmware.com>
      Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: default avatarJorgen Hansen <jhansen@vmware.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      05e489b1
  4. 16 Apr, 2018 12 commits
    • Randy Dunlap's avatar
      textsearch: fix kernel-doc warnings and add kernel-api section · 5968a70d
      Randy Dunlap authored
      Make lib/textsearch.c usable as kernel-doc.
      Add textsearch() function family to kernel-api documentation.
      Fix kernel-doc warnings in <linux/textsearch.h>:
        ../include/linux/textsearch.h:65: warning: Incorrect use of kernel-doc format:
      	* get_next_block - fetch next block of data
        ../include/linux/textsearch.h:82: warning: Incorrect use of kernel-doc format:
      	* finish - finalize/clean a series of get_next_block() calls
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5968a70d
    • David S. Miller's avatar
      Merge branch 'tipc-Better-check-user-provided-attributes' · 1c9f0a94
      David S. Miller authored
      Eric Dumazet says:
      
      ====================
      tipc: Better check user provided attributes
      
      syzbot reported a crash in __tipc_nl_net_set()
      
      While fixing it, I also had to fix an old bug involving TIPC_NLA_NET_ADDR
      ====================
      Acked-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1c9f0a94
    • Eric Dumazet's avatar
      tipc: fix possible crash in __tipc_nl_net_set() · c6404122
      Eric Dumazet authored
      syzbot reported a crash in __tipc_nl_net_set() caused by NULL dereference.
      
      We need to check that both TIPC_NLA_NET_NODEID and TIPC_NLA_NET_NODEID_W1
      are present.
      
      We also need to make sure userland provided u64 attributes.
      
      Fixes: d50ccc2d ("tipc: add 128-bit node identifier")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Jon Maloy <jon.maloy@ericsson.com>
      Cc: Ying Xue <ying.xue@windriver.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c6404122
    • Eric Dumazet's avatar
      tipc: add policy for TIPC_NLA_NET_ADDR · ec518f21
      Eric Dumazet authored
      Before syzbot/KMSAN bites, add the missing policy for TIPC_NLA_NET_ADDR
      
      Fixes: 27c21416 ("tipc: add net set to new netlink api")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Jon Maloy <jon.maloy@ericsson.com>
      Cc: Ying Xue <ying.xue@windriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ec518f21
    • Gao Feng's avatar
      net: Fix one possible memleak in ip_setup_cork · 9783ccd0
      Gao Feng authored
      It would allocate memory in this function when the cork->opt is NULL. But
      the memory isn't freed if failed in the latter rt check, and return error
      directly. It causes the memleak if its caller is ip_make_skb which also
      doesn't free the cork->opt when meet a error.
      
      Now move the rt check ahead to avoid the memleak.
      Signed-off-by: default avatarGao Feng <gfree.wind@vip.163.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9783ccd0
    • Eric Dumazet's avatar
      net: af_packet: fix race in PACKET_{R|T}X_RING · 5171b37d
      Eric Dumazet authored
      In order to remove the race caught by syzbot [1], we need
      to lock the socket before using po->tp_version as this could
      change under us otherwise.
      
      This means lock_sock() and release_sock() must be done by
      packet_set_ring() callers.
      
      [1] :
      BUG: KMSAN: uninit-value in packet_set_ring+0x1254/0x3870 net/packet/af_packet.c:4249
      CPU: 0 PID: 20195 Comm: syzkaller707632 Not tainted 4.16.0+ #83
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:17 [inline]
       dump_stack+0x185/0x1d0 lib/dump_stack.c:53
       kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
       __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676
       packet_set_ring+0x1254/0x3870 net/packet/af_packet.c:4249
       packet_setsockopt+0x12c6/0x5a90 net/packet/af_packet.c:3662
       SYSC_setsockopt+0x4b8/0x570 net/socket.c:1849
       SyS_setsockopt+0x76/0xa0 net/socket.c:1828
       do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
       entry_SYSCALL_64_after_hwframe+0x3d/0xa2
      RIP: 0033:0x449099
      RSP: 002b:00007f42b5307ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
      RAX: ffffffffffffffda RBX: 000000000070003c RCX: 0000000000449099
      RDX: 0000000000000005 RSI: 0000000000000107 RDI: 0000000000000003
      RBP: 0000000000700038 R08: 000000000000001c R09: 0000000000000000
      R10: 00000000200000c0 R11: 0000000000000246 R12: 0000000000000000
      R13: 000000000080eecf R14: 00007f42b53089c0 R15: 0000000000000001
      
      Local variable description: ----req_u@packet_setsockopt
      Variable was created at:
       packet_setsockopt+0x13f/0x5a90 net/packet/af_packet.c:3612
       SYSC_setsockopt+0x4b8/0x570 net/socket.c:1849
      
      Fixes: f6fb8f10 ("af-packet: TPACKET_V3 flexible buffer implementation.")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5171b37d
    • Thomas Falcon's avatar
      ibmvnic: Clear pending interrupt after device reset · f23e0643
      Thomas Falcon authored
      Due to a firmware bug, the hypervisor can send an interrupt to a
      transmit or receive queue just prior to a partition migration, not
      allowing the device enough time to handle it and send an EOI. When
      the partition migrates, the interrupt is lost but an "EOI-pending"
      flag for the interrupt line is still set in firmware. No further
      interrupts will be sent until that flag is cleared, effectively
      freezing that queue. To workaround this, the driver will disable the
      hardware interrupt and send an H_EOI signal prior to re-enabling it.
      This will flush the pending EOI and allow the driver to continue
      operation.
      Signed-off-by: default avatarThomas Falcon <tlfalcon@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f23e0643
    • Soheil Hassas Yeganeh's avatar
      tcp: clear tp->packets_out when purging write queue · bffd168c
      Soheil Hassas Yeganeh authored
      Clear tp->packets_out when purging the write queue, otherwise
      tcp_rearm_rto() mistakenly assumes TCP write queue is not empty.
      This results in NULL pointer dereference.
      
      Also, remove the redundant `tp->packets_out = 0` from
      tcp_disconnect(), since tcp_disconnect() calls
      tcp_write_queue_purge().
      
      Fixes: a27fd7a8 (tcp: purge write queue upon RST)
      Reported-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
      Reported-by: default avatarSami Farin <hvtaifwkbgefbaei@gmail.com>
      Tested-by: default avatarSami Farin <hvtaifwkbgefbaei@gmail.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
      Acked-by: default avatarYuchung Cheng <ycheng@google.com>
      Acked-by: default avatarNeal Cardwell <ncardwell@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bffd168c
    • Paolo Abeni's avatar
      team: avoid adding twice the same option to the event list · 4fb0534f
      Paolo Abeni authored
      When parsing the options provided by the user space,
      team_nl_cmd_options_set() insert them in a temporary list to send
      multiple events with a single message.
      While each option's attribute is correctly validated, the code does
      not check for duplicate entries before inserting into the event
      list.
      
      Exploiting the above, the syzbot was able to trigger the following
      splat:
      
      kernel BUG at lib/list_debug.c:31!
      invalid opcode: 0000 [#1] SMP KASAN
      Dumping ftrace buffer:
          (ftrace buffer empty)
      Modules linked in:
      CPU: 0 PID: 4466 Comm: syzkaller556835 Not tainted 4.16.0+ #17
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
      Google 01/01/2011
      RIP: 0010:__list_add_valid+0xaa/0xb0 lib/list_debug.c:29
      RSP: 0018:ffff8801b04bf248 EFLAGS: 00010286
      RAX: 0000000000000058 RBX: ffff8801c8fc7a90 RCX: 0000000000000000
      RDX: 0000000000000058 RSI: ffffffff815fbf41 RDI: ffffed0036097e3f
      RBP: ffff8801b04bf260 R08: ffff8801b0b2a700 R09: ffffed003b604f90
      R10: ffffed003b604f90 R11: ffff8801db027c87 R12: ffff8801c8fc7a90
      R13: ffff8801c8fc7a90 R14: dffffc0000000000 R15: 0000000000000000
      FS:  0000000000b98880(0000) GS:ffff8801db000000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 000000000043fc30 CR3: 00000001afe8e000 CR4: 00000000001406f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
        __list_add include/linux/list.h:60 [inline]
        list_add include/linux/list.h:79 [inline]
        team_nl_cmd_options_set+0x9ff/0x12b0 drivers/net/team/team.c:2571
        genl_family_rcv_msg+0x889/0x1120 net/netlink/genetlink.c:599
        genl_rcv_msg+0xc6/0x170 net/netlink/genetlink.c:624
        netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2448
        genl_rcv+0x28/0x40 net/netlink/genetlink.c:635
        netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
        netlink_unicast+0x58b/0x740 net/netlink/af_netlink.c:1336
        netlink_sendmsg+0x9f0/0xfa0 net/netlink/af_netlink.c:1901
        sock_sendmsg_nosec net/socket.c:629 [inline]
        sock_sendmsg+0xd5/0x120 net/socket.c:639
        ___sys_sendmsg+0x805/0x940 net/socket.c:2117
        __sys_sendmsg+0x115/0x270 net/socket.c:2155
        SYSC_sendmsg net/socket.c:2164 [inline]
        SyS_sendmsg+0x29/0x30 net/socket.c:2162
        do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
        entry_SYSCALL_64_after_hwframe+0x42/0xb7
      RIP: 0033:0x4458b9
      RSP: 002b:00007ffd1d4a7278 EFLAGS: 00000213 ORIG_RAX: 000000000000002e
      RAX: ffffffffffffffda RBX: 000000000000001b RCX: 00000000004458b9
      RDX: 0000000000000010 RSI: 0000000020000d00 RDI: 0000000000000004
      RBP: 00000000004a74ed R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000213 R12: 00007ffd1d4a7348
      R13: 0000000000402a60 R14: 0000000000000000 R15: 0000000000000000
      Code: 75 e8 eb a9 48 89 f7 48 89 75 e8 e8 d1 85 7b fe 48 8b 75 e8 eb bb 48
      89 f2 48 89 d9 4c 89 e6 48 c7 c7 a0 84 d8 87 e8 ea 67 28 fe <0f> 0b 0f 1f
      40 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41
      RIP: __list_add_valid+0xaa/0xb0 lib/list_debug.c:29 RSP: ffff8801b04bf248
      
      This changeset addresses the avoiding list_add() if the current
      option is already present in the event list.
      
      Reported-and-tested-by: syzbot+4d4af685432dc0e56c91@syzkaller.appspotmail.com
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Fixes: 2fcdb2c9 ("team: allow to send multiple set events in one message")
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4fb0534f
    • Maxime Chevallier's avatar
      net: mvpp2: Fix TCAM filter reserved range · 982e0500
      Maxime Chevallier authored
      Marvell's PPv2 controller has a Packet Header parser, which uses a
      fixed-size TCAM array of filter entries.
      
      The mvpp2 driver reserves some ranges among the 256 TCAM entries to
      perform MAC and VID filtering. The rest of the TCAM ids are freely usable
      for other features, such as IPv4 proto matching.
      
      This commit fixes the MVPP2_PE_LAST_FREE_TID define that sets the end of
      the "free range", which included the MAC range. This could therefore allow
      some other features to use entries dedicated to MAC filtering,
      lowering the number of unicast/multicast addresses that could be allowed
      before switching to promiscuous mode.
      
      Fixes: 10fea26c ("net: mvpp2: Add support for unicast filtering")
      Signed-off-by: default avatarMaxime Chevallier <maxime.chevallier@bootlin.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      982e0500
    • Dan Carpenter's avatar
      Revert "macsec: missing dev_put() on error in macsec_newlink()" · bd28899d
      Dan Carpenter authored
      This patch is just wrong, sorry.  I was trying to fix a static checker
      warning and misread the code.  The reference taken in macsec_newlink()
      is released in macsec_free_netdev() when the netdevice is destroyed.
      
      This reverts commit 5dcd8400.
      Reported-by: default avatarLaura Abbott <labbott@redhat.com>
      Fixes: 5dcd8400 ("macsec: missing dev_put() on error in macsec_newlink()")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Acked-by: default avatarSabrina Dubroca <sd@queasysnail.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bd28899d
    • Wang Sheng-Hui's avatar
      filter.txt: update 'tools/net/' to 'tools/bpf/' · c246fd33
      Wang Sheng-Hui authored
      The tools are located at tootls/bpf/ instead of tools/net/.
      Update the filter.txt doc.
      Signed-off-by: default avatarWang Sheng-Hui <shhuiw@foxmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c246fd33
  5. 14 Apr, 2018 4 commits
    • David S. Miller's avatar
      Merge branch 'sfc-ARFS-fixes' · d6606bcc
      David S. Miller authored
      Edward Cree says:
      
      ====================
      sfc: ARFS fixes
      
      Three issues introduced by my recent asynchronous filter handling changes:
      1. The old filter_rfs_insert would replace a matching filter of equal
         priority; we need to pass the appropriate argument to filter_insert to
         make it do the same.
      2. We're lying to the kernel with our return value from ndo_rx_flow_steer,
         so we need to lie consistently when calling rps_may_expire_flow.  This
         is only a partial fix, as the lie still prevents us from steering
         multiple flows with the same ID to different queues; a proper fix that
         stops us lying at all will hopefully follow later.
      3. It's possible to cause the kernel to hammer ndo_rx_flow_steer very
         hard, so make sure we don't build up too huge a backlog of workitems.
      
      Possibly it would be better to fix #3 on the kernel side; I have a patch
       which I think does that but it's not a regression in 4.17 so isn't 'net'
       material.
      There's also the issue that we come up in the bad configuration that
       triggers #3 by default, but that too is a problem for another time.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d6606bcc
    • Edward Cree's avatar
      sfc: limit ARFS workitems in flight per channel · f993740e
      Edward Cree authored
      A misconfigured system (e.g. with all interrupts affinitised to all CPUs)
       may produce a storm of ARFS steering events.  With the existing sfc ARFS
       implementation, that could create a backlog of workitems that grinds the
       system to a halt.  To prevent this, limit the number of workitems that
       may be in flight for a given SFC device to 8 (EFX_RPS_MAX_IN_FLIGHT), and
       return EBUSY from our ndo_rx_flow_steer method if the limit is reached.
      Given this limit, also store the workitems in an array of slots within the
       struct efx_nic, rather than dynamically allocating for each request.
      The limit should not negatively impact performance, because it is only
       likely to be hit in cases where ARFS will be ineffective anyway.
      Signed-off-by: default avatarEdward Cree <ecree@solarflare.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f993740e
    • Edward Cree's avatar
      sfc: pass the correctly bogus filter_id to rps_may_expire_flow() · a7f80189
      Edward Cree authored
      When we inserted an ARFS filter for ndo_rx_flow_steer(), we didn't know
       what the filter ID would be, so we just returned 0.  Thus, we must also
       pass 0 as the filter ID when calling rps_may_expire_flow() for it, and
       rely on the flow_id to identify what we're talking about.
      
      Fixes: 3af0f342 ("sfc: replace asynchronous filter operations")
      Signed-off-by: default avatarEdward Cree <ecree@solarflare.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a7f80189
    • Edward Cree's avatar
      sfc: insert ARFS filters with replace_equal=true · 494bef4c
      Edward Cree authored
      Necessary to allow redirecting a flow when the application moves.
      
      Fixes: 3af0f342 ("sfc: replace asynchronous filter operations")
      Signed-off-by: default avatarEdward Cree <ecree@solarflare.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      494bef4c
  6. 13 Apr, 2018 15 commits