summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-12-05net: remove hlist_nulls_add_tail_rcu()Eric Dumazet
Alexander Potapenko reported use of uninitialized memory [1] This happens when inserting a request socket into TCP ehash, in __sk_nulls_add_node_rcu(), since sk_reuseport is not initialized. Bug was added by commit d894ba18d4e4 ("soreuseport: fix ordering for mixed v4/v6 sockets") Note that d296ba60d8e2 ("soreuseport: Resolve merge conflict for v4/v6 ordering fix") missed the opportunity to get rid of hlist_nulls_add_tail_rcu() : Both UDP sockets and TCP/DCCP listeners no longer use __sk_nulls_add_node_rcu() for their hash insertion. Since all other sockets have unique 4-tuple, the reuseport status has no special meaning, so we can always use hlist_nulls_add_head_rcu() for them and save few cycles/instructions. [1] ================================================================== BUG: KMSAN: use of uninitialized memory in inet_ehash_insert+0xd40/0x1050 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.13.0+ #3288 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace:  <IRQ>  __dump_stack lib/dump_stack.c:16  dump_stack+0x185/0x1d0 lib/dump_stack.c:52  kmsan_report+0x13f/0x1c0 mm/kmsan/kmsan.c:1016  __msan_warning_32+0x69/0xb0 mm/kmsan/kmsan_instr.c:766  __sk_nulls_add_node_rcu ./include/net/sock.h:684  inet_ehash_insert+0xd40/0x1050 net/ipv4/inet_hashtables.c:413  reqsk_queue_hash_req net/ipv4/inet_connection_sock.c:754  inet_csk_reqsk_queue_hash_add+0x1cc/0x300 net/ipv4/inet_connection_sock.c:765  tcp_conn_request+0x31e7/0x36f0 net/ipv4/tcp_input.c:6414  tcp_v4_conn_request+0x16d/0x220 net/ipv4/tcp_ipv4.c:1314  tcp_rcv_state_process+0x42a/0x7210 net/ipv4/tcp_input.c:5917  tcp_v4_do_rcv+0xa6a/0xcd0 net/ipv4/tcp_ipv4.c:1483  tcp_v4_rcv+0x3de0/0x4ab0 net/ipv4/tcp_ipv4.c:1763  ip_local_deliver_finish+0x6bb/0xcb0 net/ipv4/ip_input.c:216  NF_HOOK ./include/linux/netfilter.h:248  ip_local_deliver+0x3fa/0x480 net/ipv4/ip_input.c:257  dst_input ./include/net/dst.h:477  ip_rcv_finish+0x6fb/0x1540 net/ipv4/ip_input.c:397  NF_HOOK ./include/linux/netfilter.h:248  ip_rcv+0x10f6/0x15c0 net/ipv4/ip_input.c:488  __netif_receive_skb_core+0x36f6/0x3f60 net/core/dev.c:4298  __netif_receive_skb net/core/dev.c:4336  netif_receive_skb_internal+0x63c/0x19c0 net/core/dev.c:4497  napi_skb_finish net/core/dev.c:4858  napi_gro_receive+0x629/0xa50 net/core/dev.c:4889  e1000_receive_skb drivers/net/ethernet/intel/e1000/e1000_main.c:4018  e1000_clean_rx_irq+0x1492/0x1d30 drivers/net/ethernet/intel/e1000/e1000_main.c:4474  e1000_clean+0x43aa/0x5970 drivers/net/ethernet/intel/e1000/e1000_main.c:3819  napi_poll net/core/dev.c:5500  net_rx_action+0x73c/0x1820 net/core/dev.c:5566  __do_softirq+0x4b4/0x8dd kernel/softirq.c:284  invoke_softirq kernel/softirq.c:364  irq_exit+0x203/0x240 kernel/softirq.c:405  exiting_irq+0xe/0x10 ./arch/x86/include/asm/apic.h:638  do_IRQ+0x15e/0x1a0 arch/x86/kernel/irq.c:263  common_interrupt+0x86/0x86 Fixes: d894ba18d4e4 ("soreuseport: fix ordering for mixed v4/v6 sockets") Fixes: d296ba60d8e2 ("soreuseport: Resolve merge conflict for v4/v6 ordering fix") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Alexander Potapenko <glider@google.com> Acked-by: Craig Gallek <kraig@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05Merge branch 'rmnet-Fix-leaks-in-failure-scenarios'David S. Miller
Subash Abhinov Kasiviswanathan says: ==================== net: qualcomm: rmnet: Fix leaks in failure scenarios Patch 1 fixes a leak in transmit path where a skb cannot be transmitted due to insufficient headroom to stamp the map header. Patch 2 fixes a leak in rmnet_newlink() failure because the rmnet endpoint was never freed ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net: qualcomm: rmnet: Fix leak in device creation failureSubash Abhinov Kasiviswanathan
If the rmnet device creation fails in the newlink either while registering with the physical device or after subsequent operations, the rmnet endpoint information is never freed. Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net: qualcomm: rmnet: Fix leak on transmit failureSubash Abhinov Kasiviswanathan
If a skb in transmit path does not have sufficient headroom to add the map header, the skb is not sent out and is never freed. Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05Merge branch 'dsa-use-per-port-upstream-port'David S. Miller
Vivien Didelot says: ==================== net: dsa: use per-port upstream port An upstream port is a local switch port used to reach a CPU port. DSA still considers a unique CPU port in the whole switch fabric and thus return a unique upstream port for a given switch. This is wrong in a multiple CPU ports environment. We are now switching to using the dedicated CPU port assigned to each port in order to get rid of the deprecated unique tree CPU port. This patchset makes the dsa_upstream_port() helper take a port argument and goes one step closer complete support for multiple CPU ports. Changes in v2: - reverse-christmas-tree-fy variables ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net: dsa: return per-port upstream portVivien Didelot
The current dsa_upstream_port() helper still assumes a unique CPU port in the whole switch fabric. This is becoming wrong, as every port in the fabric has its dedicated CPU port, thus every port has an upstream port. Add a port argument to the dsa_upstream_port() helper and fetch its CPU port instead of the deprecated unique fabric CPU port. A CPU or unused port has no dedicated CPU port, so return itself in this case. At the same time, change the return value from u8 to unsigned int since there is no need to limit the size here. Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net: dsa: assign a CPU port to DSA portVivien Didelot
DSA ports also need to have a dedicated CPU port assigned to them, because they need to know where to egress frames targeting the CPU, e.g. To_Cpu frames received on a Marvell Tag port. Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net: dsa: mv88e6xxx: setup global upstream portVivien Didelot
Move the setup of the global upstream port within the mv88e6xxx_setup_upstream_port function. Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net: dsa: mv88e6xxx: helper to setup upstream portVivien Didelot
Add a helper function to setup the upstream port of a given port. This is the port used to reach the dedicated CPU port. This function will be extended later to setup the global upstream port as well. Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net: dsa: mv88e6xxx: egress floods all DSA portsVivien Didelot
The mv88e6xxx driver currently assumes a single CPU port in the fabric and thus floods frames with unknown DA on a single DSA port, the one that is one hop closer to the CPU port. With multiple CPU ports in mind, this isn't true anymore because CPU ports could be found behind both DSA ports of a device in-between others. For example in a A <-> B <-> C fabric, both A and C having CPU ports, device B will have to flood such frame to its two DSA ports. This patch considers both CPU and DSA ports of a device as upstream ports, where to flood frames with unknown DA addresses. Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05ALSA: pcm: prevent UAF in snd_pcm_infoRobb Glasser
When the device descriptor is closed, the `substream->runtime` pointer is freed. But another thread may be in the ioctl handler, case SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which calls snd_pcm_info() which accesses the now freed `substream->runtime`. Note: this fixes CVE-2017-0861 Signed-off-by: Robb Glasser <rglasser@google.com> Signed-off-by: Nick Desaulniers <ndesaulniers@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-12-05ACPI / CPPC: Fix KASAN global out of bounds warningGeorge Cherian
Default value of pcc_subspace_idx is -1. Make sure to check pcc_subspace_idx before using the same as array index. This will avoid following KASAN warnings too. [ 15.113449] ================================================================== [ 15.116983] BUG: KASAN: global-out-of-bounds in cppc_get_perf_caps+0xf3/0x3b0 [ 15.116983] Read of size 8 at addr ffffffffb9a5c0d8 by task swapper/0/1 [ 15.116983] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 4.15.0-rc2+ #2 [ 15.116983] Hardware name: Dell Inc. OptiPlex 7040/0Y7WYT, BIOS 1.2.8 01/26/2016 [ 15.116983] Call Trace: [ 15.116983] dump_stack+0x7c/0xbb [ 15.116983] print_address_description+0x1df/0x290 [ 15.116983] kasan_report+0x28a/0x370 [ 15.116983] ? cppc_get_perf_caps+0xf3/0x3b0 [ 15.116983] cppc_get_perf_caps+0xf3/0x3b0 [ 15.116983] ? cpc_read+0x210/0x210 [ 15.116983] ? __rdmsr_on_cpu+0x90/0x90 [ 15.116983] ? rdmsrl_on_cpu+0xa9/0xe0 [ 15.116983] ? rdmsr_on_cpu+0x100/0x100 [ 15.116983] ? wrmsrl_on_cpu+0x9c/0xd0 [ 15.116983] ? wrmsrl_on_cpu+0x9c/0xd0 [ 15.116983] ? wrmsr_on_cpu+0xe0/0xe0 [ 15.116983] __intel_pstate_cpu_init.part.16+0x3a2/0x530 [ 15.116983] ? intel_pstate_init_cpu+0x197/0x390 [ 15.116983] ? show_no_turbo+0xe0/0xe0 [ 15.116983] ? __lockdep_init_map+0xa0/0x290 [ 15.116983] intel_pstate_cpu_init+0x30/0x60 [ 15.116983] cpufreq_online+0x155/0xac0 [ 15.116983] cpufreq_add_dev+0x9b/0xb0 [ 15.116983] subsys_interface_register+0x1ae/0x290 [ 15.116983] ? bus_unregister_notifier+0x40/0x40 [ 15.116983] ? mark_held_locks+0x83/0xb0 [ 15.116983] ? _raw_write_unlock_irqrestore+0x32/0x60 [ 15.116983] ? intel_pstate_setup+0xc/0x104 [ 15.116983] ? intel_pstate_setup+0xc/0x104 [ 15.116983] ? cpufreq_register_driver+0x1ce/0x2b0 [ 15.116983] cpufreq_register_driver+0x1ce/0x2b0 [ 15.116983] ? intel_pstate_setup+0x104/0x104 [ 15.116983] intel_pstate_register_driver+0x3a/0xa0 [ 15.116983] intel_pstate_init+0x3c4/0x434 [ 15.116983] ? intel_pstate_setup+0x104/0x104 [ 15.116983] ? intel_pstate_setup+0x104/0x104 [ 15.116983] do_one_initcall+0x9c/0x206 [ 15.116983] ? parameq+0xa0/0xa0 [ 15.116983] ? initcall_blacklisted+0x150/0x150 [ 15.116983] ? lock_downgrade+0x2c0/0x2c0 [ 15.116983] kernel_init_freeable+0x327/0x3f0 [ 15.116983] ? start_kernel+0x612/0x612 [ 15.116983] ? _raw_spin_unlock_irq+0x29/0x40 [ 15.116983] ? finish_task_switch+0xdd/0x320 [ 15.116983] ? finish_task_switch+0x8e/0x320 [ 15.116983] ? rest_init+0xd0/0xd0 [ 15.116983] kernel_init+0xf/0x11a [ 15.116983] ? rest_init+0xd0/0xd0 [ 15.116983] ret_from_fork+0x24/0x30 [ 15.116983] The buggy address belongs to the variable: [ 15.116983] __key.36299+0x38/0x40 [ 15.116983] Memory state around the buggy address: [ 15.116983] ffffffffb9a5bf80: fa fa fa fa 00 fa fa fa fa fa fa fa 00 fa fa fa [ 15.116983] ffffffffb9a5c000: fa fa fa fa 00 fa fa fa fa fa fa fa 00 fa fa fa [ 15.116983] >ffffffffb9a5c080: fa fa fa fa 00 fa fa fa fa fa fa fa 00 00 00 00 [ 15.116983] ^ [ 15.116983] ffffffffb9a5c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 15.116983] ffffffffb9a5c180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 15.116983] ================================================================== Fixes: 85b1407bf6d2 (ACPI / CPPC: Make CPPC ACPI driver aware of PCC subspace IDs) Reported-by: Changbin Du <changbin.du@intel.com> Signed-off-by: George Cherian <george.cherian@cavium.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2017-12-05VSOCK: fix outdated sk_state value in hvs_release()Stefan Hajnoczi
Since commit 3b4477d2dcf2709d0be89e2a8dced3d0f4a017f2 ("VSOCK: use TCP state constants for sk_state") VSOCK has used TCP_* constants for sk_state. Commit b4562ca7925a3bedada87a3dd072dd5bad043288 ("hv_sock: add locking in the open/close/release code paths") reintroduced the SS_DISCONNECTING constant. This patch replaces the old SS_DISCONNECTING with the new TCP_CLOSING constant. CC: Dexuan Cui <decui@microsoft.com> CC: Cathy Avery <cavery@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Jorgen Hansen <jhansen@vmware.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05Merge branch 'sch_api-style'David S. Miller
Alexander Aring says: ==================== net: sched: sch_api: fix coding style issues for extack this patch prepares to handle extack for qdiscs and fixes checkpatch issues. There are a bunch of warnings issued by checkpatch which bothered me. This first patchset is to get rid of those warnings to make way for the next patchsets. I plan to followup with qdiscs, classifiers and actions after this. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net: sched: sch_api: rearrange init handlingAlexander Aring
This patch fixes the following checkpatch error: ERROR: do not use assignment in if condition by rearranging the if condition to execute init callback only if init callback exists. The whole setup afterwards is called in any case, doesn't matter if init callback is set or not. This patch has the same behaviour as before, just without assign err variable in if condition. It also makes the code easier to read. Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com> Cc: David Ahern <dsahern@gmail.com> Signed-off-by: Alexander Aring <aring@mojatatu.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net: sched: sch_api: fix code style issuesAlexander Aring
This patch fix checkpatch issues for upcomming patches according to the sched api file. It changes checking on null pointer, remove unnecessary brackets, add variable names for parameters and adjust 80 char width. Cc: David Ahern <dsahern@gmail.com> Signed-off-by: Alexander Aring <aring@mojatatu.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05Merge branch 'nfp-enhanced-debug-dump-via-ethtool'David S. Miller
Simon Horman says: ==================== nfp: enhanced debug dump via ethtool Add debug dump implementation to the NFP driver. This makes use of existing ethtool infrastructure. ethtool -W is used to select the dump level and ethtool -w is used to dump NFP state. The existing behaviour of dump level 0, dumping the arm.diag resource, is preserved. Dump levels greater than 0 are implemented by this patchset and optionally supported by firmware providing a _abi_dump_spec rtsym. This rtsym provides a specification, in TLV format, of the information to be dumped from the NFP at each supported dump level. Dumps are also structured using a TLVs. They consist a prolog and the data described int he corresponding dump. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05nfp: dump indirect ME CSRsCarl Heymann
- The spec defines CSR address ranges for indirect ME CSRs. For Each TLV chunk in the spec, dump a chunk that includes the spec and the data over the defined address range. - Each indirect CSR has 8 contexts. To read one context, first write the context to a specific derived address, read it back, and then read the register value. - For each address, read and dump all 8 contexts in this manner. Signed-off-by: Carl Heymann <carl.heymann@netronome.com> Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05nfp: dump CPP, XPB and direct ME CSRsCarl Heymann
- The spec defines CSR address ranges for these types. - Dump each TLV chunk in the spec as a chunk that includes the spec and the data over the defined address range. Signed-off-by: Carl Heymann <carl.heymann@netronome.com> Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05nfp: dump firmware nameCarl Heymann
Dump FW name as TLV, based on dump specification. Signed-off-by: Carl Heymann <carl.heymann@netronome.com> Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05nfp: dump single hwinfo field by keyCarl Heymann
- Add spec TLV for hwinfo field, containing key string as data. - Add dump TLV for hwinfo field, with data being key and value as packed zero-terminated strings. - If specified hwinfo field is not found, dump the spec TLV as -ENOENT error. Signed-off-by: Carl Heymann <carl.heymann@netronome.com> Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05nfp: dump all hwinfoCarl Heymann
- Dump hwinfo as separate TLV chunk, in a packed format containing zero-separated key and value strings. - This provides additional debug context, if requested by the dumpspec. Signed-off-by: Carl Heymann <carl.heymann@netronome.com> Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05nfp: dump rtsymsCarl Heymann
- Support rtsym TLVs. - If specified rtsym is not found, dump the spec TLV as -ENOENT error. Signed-off-by: Carl Heymann <carl.heymann@netronome.com> Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05nfp: dumpspec TLV traversalCarl Heymann
- Perform dumpspec traversals for calculating size and populating the dump. - Initially, wrap all spec TLVs in dump error TLVs (changed by later patches in the series). Signed-off-by: Carl Heymann <carl.heymann@netronome.com> Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05nfp: dump prologCarl Heymann
- Use a TLV structure, with the typed chunks aligned to 8-byte sizes. - Dump numeric fields as big-endian. - Prolog contains the dump level. Signed-off-by: Carl Heymann <carl.heymann@netronome.com> Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05nfp: load debug dump specCarl Heymann
Load the TLV-based binary specification of what needs to be included in a dump, from the "_abi_dump_spec" rtsymbol. If the symbol is not defined, then dumps for levels >= 1 are not supported. Signed-off-by: Carl Heymann <carl.heymann@netronome.com> Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05nfp: debug dump ethtool opsCarl Heymann
- Skeleton code to perform a binary debug dump via ethtoolops "set_dump", "get_dump_flags" and "get_dump_data", i.e. the ethtool -W/w mechanism. - Skeleton functions for debugdump operations provided. - An integer "dump level" can be specified, this is stored between ethtool invocations. Dump level 0 is still the "arm.diag" resource for backward compatibility. Other dump levels each define a set of state information to include in the dump, driven by a spec from FW. Signed-off-by: Carl Heymann <carl.heymann@netronome.com> Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net_sched: get rid of rcu_barrier() in tcf_block_put_ext()Cong Wang
Both Eric and Paolo noticed the rcu_barrier() we use in tcf_block_put_ext() could be a performance bottleneck when we have a lot of tc classes. Paolo provided the following to demonstrate the issue: tc qdisc add dev lo root htb for I in `seq 1 1000`; do tc class add dev lo parent 1: classid 1:$I htb rate 100kbit tc qdisc add dev lo parent 1:$I handle $((I + 1)): htb for J in `seq 1 10`; do tc filter add dev lo parent $((I + 1)): u32 match ip src 1.1.1.$J done done time tc qdisc del dev root real 0m54.764s user 0m0.023s sys 0m0.000s The rcu_barrier() there is to ensure we free the block after all chains are gone, that is, to queue tcf_block_put_final() at the tail of workqueue. We can achieve this ordering requirement by refcnt'ing tcf block instead, that is, the tcf block is freed only when the last chain in this block is gone. This also simplifies the code. Paolo reported after this patch we get: real 0m0.017s user 0m0.000s sys 0m0.017s Tested-by: Paolo Abeni <pabeni@redhat.com> Cc: Eric Dumazet <edumazet@google.com> Cc: Jiri Pirko <jiri@mellanox.com> Cc: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05tipc: fix memory leak in tipc_accept_from_sock()Jon Maloy
When the function tipc_accept_from_sock() fails to create an instance of struct tipc_subscriber it omits to free the already created instance of struct tipc_conn instance before it returns. We fix that with this commit. Reported-by: David S. Miller <davem@davemloft.net> Signed-off-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05tipc: fix a null pointer deref on error pathCong Wang
In tipc_topsrv_kern_subscr() when s->tipc_conn_new() fails we call tipc_close_conn() to clean up, but in this case calling conn_put() is just enough. This fixes the folllowing crash: kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 3085 Comm: syzkaller064164 Not tainted 4.15.0-rc1+ #137 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: 00000000c24413a5 task.stack: 000000005e8160b5 RIP: 0010:__lock_acquire+0xd55/0x47f0 kernel/locking/lockdep.c:3378 RSP: 0018:ffff8801cb5474a8 EFLAGS: 00010002 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffffffff85ecb400 RBP: ffff8801cb547830 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: ffffffff87489d60 R12: ffff8801cd2980c0 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000020 FS: 00000000014ee880(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffee2426e40 CR3: 00000001cb85a000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:175 spin_lock_bh include/linux/spinlock.h:320 [inline] tipc_subscrb_subscrp_delete+0x8f/0x470 net/tipc/subscr.c:201 tipc_subscrb_delete net/tipc/subscr.c:238 [inline] tipc_subscrb_release_cb+0x17/0x30 net/tipc/subscr.c:316 tipc_close_conn+0x171/0x270 net/tipc/server.c:204 tipc_topsrv_kern_subscr+0x724/0x810 net/tipc/server.c:514 tipc_group_create+0x702/0x9c0 net/tipc/group.c:184 tipc_sk_join net/tipc/socket.c:2747 [inline] tipc_setsockopt+0x249/0xc10 net/tipc/socket.c:2861 SYSC_setsockopt net/socket.c:1851 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1830 entry_SYSCALL_64_fastpath+0x1f/0x96 Fixes: 14c04493cb77 ("tipc: add ability to order and receive topology events in driver") Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Jon Maloy <jon.maloy@ericsson.com> Cc: Ying Xue <ying.xue@windriver.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05Merge branch 'ieee802154-for-davem-2017-12-04' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next Stefan Schmidt says: ==================== pull-request: ieee802154-next 2017-12-04 Some update from ieee802154 to *net-next* Jian-Hong Pan updated our docs to match the APIs in code. Michael Hennerichs enhanced the adf7242 driver to work with adf7241 devices and reworked the IRQ and packet handling in the driver. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05Merge branch 'sh_eth-dma-mapping-fixes'David S. Miller
Thomas Petazzoni says: ==================== net: sh_eth: DMA mapping API fixes Here are two patches that fix how the sh_eth driver is using the DMA mapping API: a bogus struct device is used in some places, or a NULL struct device is used. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net: sh_eth: don't use NULL as "struct device" for the DMA mapping APIThomas Petazzoni
Using NULL as argument for the DMA mapping API is bogus, as the DMA mapping API may use information from the "struct device" to perform the DMA mapping operation. Therefore, pass the appropriate "struct device". Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Acked-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net: sh_eth: use correct "struct device" when calling DMA mapping functionsThomas Petazzoni
There are two types of "struct device": the one representing the physical device on its physical bus (platform, SPI, PCI, etc.), and the one representing the logical device in its device class (net, etc.). The DMA mapping API expects to receive as argument a "struct device" representing the physical device, as the "struct device" contains information about the bus that the DMA API needs. However, the sh_eth driver mistakenly uses the "struct device" representing the logical device (embedded in "struct net_device") rather than the "struct device" representing the physical device on its bus. This commit fixes that by adjusting all calls to the DMA mapping API. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Acked-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05netdevsim: make functions nsim_bpf_create_prog and nsim_bpf_destroy_prog staticColin Ian King
Functions nsim_bpf_create_prog and nsim_bpf_destroy_prog are local to the source and do not need to be in global scope, so make them static. Cleans up sparse warnings: symbol 'nsim_bpf_create_prog' was not declared. Should it be static? symbol 'nsim_bpf_destroy_prog' was not declared. Should it be static? Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05Merge branch 'RED-qdisc-fixes'David S. Miller
Nogah Frankel says: ==================== RED qdisc fixes Add some input validation checks to RED qdisc. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net_sched: red: Avoid illegal valuesNogah Frankel
Check the qmin & qmax values doesn't overflow for the given Wlog value. Check that qmin <= qmax. Fixes: a783474591f2 ("[PKT_SCHED]: Generic RED layer") Signed-off-by: Nogah Frankel <nogahf@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05net_sched: red: Avoid devision by zeroNogah Frankel
Do not allow delta value to be zero since it is used as a divisor. Fixes: 8af2a218de38 ("sch_red: Adaptative RED AQM") Signed-off-by: Nogah Frankel <nogahf@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-05drm/ttm: swap consecutive allocated cached pages v3Christian König
When we detect consecutive allocation of pages swap them to avoid accidentally freeing them as huge page. v2: use swap v3: check if it's really the first allocated page Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Roger He <Hongbo.He@amd.com> Reviewed-by: Michel Dänzer <michel.daenzer@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2017-12-05drm/ttm: roundup the shrink request to prevent skip huge poolRoger He
e.g. shrink reqeust is less than 512, the logic will skip huge pool Reviewed-by: Chunming Zhou <david1.zhou@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Roger He <Hongbo.He@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2017-12-05drm/ttm: add page order support in ttm_pages_putRoger He
Reviewed-by: Chunming Zhou <david1.zhou@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Roger He <Hongbo.He@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2017-12-05drm/ttm: add set_pages_wb for handling page order more than zeroRoger He
Reviewed-by: Chunming Zhou <david1.zhou@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Roger He <Hongbo.He@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2017-12-05drm/ttm: add page order in page poolRoger He
to indicate page order for each element in the pool Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Roger He <Hongbo.He@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2017-12-05drm/ttm: use NUM_PAGES_TO_ALLOC alwaysRoger He
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Roger He <Hongbo.He@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2017-12-05Merge tag 'scsi-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "A bunch of fixes for aacraid, a set of coherency fixes that only affect non-coherent platforms and one coccinelle detected null check after use" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: libsas: align sata_device's rps_resp on a cacheline scsi: use dma_get_cache_alignment() as minimum DMA alignment scsi: dma-mapping: always provide dma_get_cache_alignment scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg scsi: aacraid: Prevent crash in case of free interrupt during scsi EH path scsi: aacraid: Perform initialization reset only once scsi: aacraid: Check for PCI state of device in a generic way
2017-12-05Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull rdma fixes from Jason Gunthorpe: "Here is the first rc pull request for RDMA. This includes an important core fix for a regression in iWarp if SELinux is enabled, a fix for a compilation regression introduced in this merge window, and one obscure kconfig combination that oops's the kernel. For drivers, we have hns fixes needed to make their devices work on certain ARM IOMMU configurations, a stack data leak for hfi1, and various testing discovered -rc bug fixes for i40iw. This cycle we pushed back on the driver maintainers to have better commit messages for -rc material" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: IB/core: Only enforce security for InfiniBand RDMA/hns: Get rid of page operation after dma_alloc_coherent RDMA/hns: Get rid of virt_to_page and vmap calls after dma_alloc_coherent RDMA/hns: Fix the issue of IOVA not page continuous in hip08 IB/core: Init subsys if compiled to vmlinuz-core RDMA/cma: Make sure that PSN is not over max allowed i40iw: Notify user of established connection after QP in RTS i40iw: Move MPA request event for loopback after connect i40iw: Correct ARP index mask i40iw: Do not free sqbuf when event is I40IW_TIMER_TYPE_CLOSE i40iw: Allocate a sdbuf per CQP WQE IB: INFINIBAND should depend on HAS_DMA IB/hfi1: Initialize bth1 in 16B rc ack builder
2017-12-05Merge tag 'char-misc-4.15-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fixes from Greg KH: "Here are some small misc driver fixes for 4.15-rc3 to resolve reported issues. Specifically these are: - binder fix for a memory leak - vpd driver fixes for a number of reported problems - hyperv driver fix for memory accesses where it shouldn't be. All of these have been in linux-next for a while. There's also one more MAINTAINERS file update that came in today to get the Android developer's emails correct, which is also in this pull request, that was not in linux-next, but should not be an issue" * tag 'char-misc-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: MAINTAINERS: update Android driver maintainers. firmware: vpd: Fix platform driver and device registration/unregistration firmware: vpd: Tie firmware kobject to device lifetime firmware: vpd: Destroy vpd sections in remove function hv: kvp: Avoid reading past allocated blocks from KVP file Drivers: hv: vmbus: Fix a rescind issue ANDROID: binder: fix transaction leak.
2017-12-05Merge tag 'driver-core-4.15-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are 3 small fixes for some reported issues: - a debugfs build error that lots of people have reported - a Kconfig help text cleanup now that the firmware is not in the kernel tree - an ISA bus bug fix for a reported issue that has been there since 2.6.18. All of these have been in linux-next with no reported issues" * tag 'driver-core-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: firmware: cleanup FIRMWARE_IN_KERNEL message isa: Prevent NULL dereference in isa_bus driver callbacks debugfs: fix debugfs_real_fops() build error
2017-12-05Merge tag 'staging-4.15-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging and iio driver fixes from Greg KH: "Here are a number of small staging and iio driver fixes for reported issues for 4.15-rc3. Nothing major here, the majority is IIO issues, like normal, but there are also some small bugfixes for a few staging drivers as well. Full details are in the shortlog. All of these have been in linux-next for a while with no reported issues" * tag 'staging-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: iio: stm32: fix adc/trigger link error iio: health: max30102: Temperature should be in milli Celsius iio: fix kernel-doc build errors iio: adc: meson-saradc: Meson8 and Meson8b do not have REG11 and REG13 iio: adc: meson-saradc: initialize the bandgap correctly on older SoCs iio: adc: meson-saradc: fix the bit_idx of the adc_en clock iio: proximity: sx9500: Assign interrupt from GpioIo() iio: adc: cpcap: fix incorrect validation staging: octeon-usb: use __delay() instead of cvmx_wait() staging: rtl8188eu: Fix incorrect response to SIOCGIWESSID staging: ccree: fix leak of import() after init() staging: comedi: ni_atmio: fix license warning.
2017-12-05Merge branch 'phylib-hard-resetting-devices'David S. Miller
Geert Uytterhoeven says: ==================== Teach phylib hard-resetting devices This patch series adds optional PHY reset support to phylib. The first two patches are destined for David's net-next tree. They add core PHY reset code, and update a driver that currently uses its own reset code. The last two patches are destined for Simon's renesas tree. They add properties to describe the EthernetAVB PHY reset topology to the common Salvator-X/XS and ULCB DTS files, which solves two issues: 1. On Salvator-XS, the enable pin of the regulator providing PHY power is connected to PRESETn, and PSCI powers down the SoC during system suspend. Hence a PHY reset is needed to restore network functionality after system resume. 2. Linux should not rely on the boot loader having reset the PHY, but should reset the PHY during driver probe. Changes compared to v3: - Remove Florian's Acked-by, - Add missing #include <linux/gpio/consumer.h>, - Re-add the gpiod check, as the dummy gpiod_set_value() for !GPIOLIB does not ignore NULL, and calls WARN_ON(1), - Do not reassert the reset signal if {mdio,phy}_probe() or phy_device_register() succeeded, as that may destroy initial setup, - Do not deassert the reset signal in {mdio,phy}_remove(), as it should already be deasserted, - Bring the PHY back into reset state in phy_device_remove(), - Move/consolidate GPIO descriptor acquiring code from of_mdiobus_register_phy() and of_mdiobus_register_device() to mdiobus_register_device(). Note that this changes behavior slightly, in that the reset signal is now also asserted when called from of_mdiobus_register_device(). - Add Reviewed-by, Changes compared to v2, as sent by Sergei Shtylyov: - Fix fwnode_get_named_gpiod() call due to added parameters (which allowed to eliminate the gpiod_direction_output() call), - Rebased, refreshed, reworded, - Take over from Sergei, - Add Acked-by, - Remove unneeded gpiod check, as gpiod_set_value() handles NULL fine, - Handle fwnode_get_named_gpiod() errors correctly: - -ENOENT is ignored (the GPIO is optional), and turned into NULL, which allowed to remove all later !IS_ERR() checks, - Other errors (incl. -EPROBE_DEFER) are propagated, - Extract DTS patches from series "[PATCH 0/4] ravb: Add PHY reset support" (https://www.spinics.net/lists/netdev/msg457308.html), and incorporate in this series, after moving reset-gpios from the ethernet to the ethernet-phy node. Given (1) the new reset-gpios DT property in the PHY node follows established practises, (2) the DT binding change in the first patch has been acked by Rob, and (3) the DTS patch does not cause any regressions if it is applied before the PHY driver patches, the DTS patches can be applied independently. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-02 15:41:49 +0000