15 Feb, 2016

1 commit


30 Jan, 2016

1 commit


29 Jan, 2016

2 commits

  • The tty core no longer provides nor uses ASYNC_CLOSING; remove from
    tty_port_close_start() and tty_port_close_end() as well as tty drivers
    which open-code these state changes. Unfortunately, even though the
    bit is masked from userspace, its inclusion in a uapi header precludes
    removing the macro.

    Cc: Martin Schwidefsky
    Cc: Heiko Carstens
    Cc: linux-s390@vger.kernel.org
    Cc: Mikael Starvik
    Cc: Jesper Nilsson
    Cc: linux-cris-kernel@axis.com
    Cc: Samuel Ortiz
    Cc: "David S. Miller"
    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Expressions of the form "tty->termios.c_*flag & FLAG"
    are more clearly expressed with the termios flags macros,
    I_FLAG(), C_FLAG(), O_FLAG(), and L_FLAG().

    Convert treewide.

    Signed-off-by: Peter Hurley
    Acked-by: Johan Hovold
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

15 Dec, 2015

1 commit

  • 郭永刚 reported that one could simply crash the kernel as root by
    using a simple program:

    int socket_fd;
    struct sockaddr_in addr;
    addr.sin_port = 0;
    addr.sin_addr.s_addr = INADDR_ANY;
    addr.sin_family = 10;

    socket_fd = socket(10,3,0x40000000);
    connect(socket_fd , &addr,16);

    AF_INET, AF_INET6 sockets actually only support 8-bit protocol
    identifiers. inet_sock's skc_protocol field thus is sized accordingly,
    thus larger protocol identifiers simply cut off the higher bits and
    store a zero in the protocol fields.

    This could lead to e.g. NULL function pointer because as a result of
    the cut off inet_num is zero and we call down to inet_autobind, which
    is NULL for raw sockets.

    kernel: Call Trace:
    kernel: [] ? inet_autobind+0x2e/0x70
    kernel: [] inet_dgram_connect+0x54/0x80
    kernel: [] SYSC_connect+0xd9/0x110
    kernel: [] ? ptrace_notify+0x5b/0x80
    kernel: [] ? syscall_trace_enter_phase2+0x108/0x200
    kernel: [] SyS_connect+0xe/0x10
    kernel: [] tracesys_phase2+0x84/0x89

    I found no particular commit which introduced this problem.

    CVE: CVE-2015-8543
    Cc: Cong Wang
    Reported-by: 郭永刚
    Signed-off-by: Hannes Frederic Sowa
    Signed-off-by: David S. Miller

    Hannes Frederic Sowa
     

05 Nov, 2015

1 commit

  • Pull tty/serial driver updates from Greg KH:
    "Here is the big tty and serial driver update for 4.4-rc1.

    Lots of serial driver updates and a few small tty core changes. Full
    details in the shortlog.

    All of these have been in linux-next for a while"

    * tag 'tty-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (148 commits)
    tty: Use unbound workqueue for all input workers
    tty: Abstract tty buffer work
    tty: Prevent tty teardown during tty_write_message()
    tty: core: Use correct spinlock flavor in tiocspgrp()
    tty: Combine SIGTTOU/SIGTTIN handling
    serial: amba-pl011: fix incorrect integer size in pl011_fifo_to_tty()
    ttyFDC: Fix build problems due to use of module_{init,exit}
    tty: remove unneeded return statement
    serial: 8250_mid: add support for DMA engine handling from UART MMIO
    dmaengine: hsu: remove platform data
    dmaengine: hsu: introduce stubs for the exported functions
    dmaengine: hsu: make the UART driver in control of selecting this driver
    serial: fix mctrl helper functions
    serial: 8250_pci: Intel MID UART support to its own driver
    serial: fsl_lpuart: add earlycon support
    tty: disable unbind for old 74xx based serial/mpsc console port
    serial: pl011: Spelling s/clocks-names/clock-names/
    n_tty: Remove reader wakeups for TTY_BREAK/TTY_PARITY chars
    tty: synclink, fix indentation
    serial: at91, fix rs485 properties
    ...

    Linus Torvalds
     

04 Nov, 2015

1 commit


21 Oct, 2015

1 commit


18 Oct, 2015

1 commit

  • Since at least before 2.6.30, tty drivers that do not drop the tty lock
    while closing cannot observe ASYNC_CLOSING set while holding the
    tty lock; this includes the tty driver's open() and hangup() methods,
    since the tty core calls these methods holding the tty lock.

    For these drivers, waiting for ASYNC_CLOSING to clear while opening
    is not required, since this condition cannot occur. Similarly, even
    when the open() method drops and reacquires the tty lock after
    blocking, ASYNC_CLOSING cannot be set (again, for drivers that
    do not drop the tty lock while closing).

    Now that tty port drivers no longer drop the tty lock while closing
    (since 'tty: Remove tty_wait_until_sent_from_close()'), the same
    conditions apply: waiting for ASYNC_CLOSING to clear while opening
    is not required, nor is re-checking ASYNC_CLOSING after dropping and
    reacquiring the tty lock while blocking (eg., in *_block_til_ready()).

    Note: The ASYNC_CLOSING flag state is still maintained since several
    bitrotting drivers use it for (dubious) other purposes.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

26 May, 2015

1 commit

  • API compliance scanning with coccinelle flagged:
    ./net/irda/timer.c:63:35-37: use of msecs_to_jiffies probably perferable

    Converting milliseconds to jiffies by "val * HZ / 1000" technically
    is not a clean solution as it does not handle all corner cases correctly.
    By changing the conversion to use msecs_to_jiffies(val) conversion is
    correct in all cases. Further the () around the arithmetic expression
    was dropped.

    Patch was compile tested for x86_64_defconfig + CONFIG_IRDA=m

    Patch is against 4.1-rc4 (localversion-next is -next-20150522)

    Signed-off-by: Nicholas Mc Guire
    Signed-off-by: David S. Miller

    Nicholas Mc Guire
     

11 May, 2015

1 commit


10 Mar, 2015

1 commit


09 Mar, 2015

1 commit

  • Pull tty/serial fixes from Greg KH:
    "Here are some tty and serial driver fixes for 4.0-rc3.

    Along with the atime fix that you know about, here are some other
    serial driver bugfixes as well. Most notable is a wait_until_sent
    bugfix that was traced back to being around since before 2.6.12 that
    Johan has fixed up.

    All have been in linux-next successfully"

    * tag 'tty-4.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
    TTY: fix tty_wait_until_sent maximum timeout
    TTY: fix tty_wait_until_sent on 64-bit machines
    USB: serial: fix infinite wait_until_sent timeout
    TTY: bfin_jtag_comm: remove incorrect wait_until_sent operation
    net: irda: fix wait_until_sent poll timeout
    serial: uapi: Declare all userspace-visible io types
    serial: core: Fix iotype userspace breakage
    serial: sprd: Fix missing spin_unlock in sprd_handle_irq()
    console: Fix console name size mismatch
    tty: fix up atime/mtime mess, take four
    serial: 8250_dw: Fix get_mctrl behaviour
    serial:8250:8250_pci: delete unneeded quirk entries
    serial:8250:8250_pci: fix redundant entry report for WCH_CH352_2S
    Change email address for 8250_pci
    serial: 8250: Revert "tty: serial: 8250_core: read only RX if there is something in the FIFO"
    Revert "tty/serial: of_serial: add DT alias ID handling"

    Linus Torvalds
     

07 Mar, 2015

1 commit

  • In case an infinite timeout (0) is requested, the irda wait_until_sent
    implementation would use a zero poll timeout rather than the default
    200ms.

    Note that wait_until_sent is currently never called with a 0-timeout
    argument due to a bug in tty_wait_until_sent.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Cc: stable # v2.6.12
    Signed-off-by: Johan Hovold
    Signed-off-by: Greg Kroah-Hartman

    Johan Hovold
     

04 Mar, 2015

1 commit


03 Mar, 2015

1 commit

  • After TIPC doesn't depend on iocb argument in its internal
    implementations of sendmsg() and recvmsg() hooks defined in proto
    structure, no any user is using iocb argument in them at all now.
    Then we can drop the redundant iocb argument completely from kinds of
    implementations of both sendmsg() and recvmsg() in the entire
    networking stack.

    Cc: Christoph Hellwig
    Suggested-by: Al Viro
    Signed-off-by: Ying Xue
    Signed-off-by: David S. Miller

    Ying Xue
     

24 Feb, 2015

1 commit

  • Use helper functions to access current->state.
    Direct assignments are prone to races and therefore buggy.

    current->state = TASK_RUNNING can be replaced by __set_current_state()

    Thanks to Peter Zijlstra for the exact definition of the problem.

    Suggested-By: Peter Zijlstra
    Signed-off-by: Fabian Frederick
    Signed-off-by: David S. Miller

    Fabian Frederick
     

31 Jan, 2015

1 commit


11 Dec, 2014

1 commit


24 Nov, 2014

2 commits


14 Nov, 2014

1 commit


13 Nov, 2014

2 commits


12 Nov, 2014

1 commit

  • And use the more common mechanisms directly.

    Other miscellanea:

    o Coalesce formats
    o Add missing newlines
    o Realign arguments
    o Remove unnecessary OOM message logging as
    there's a generic stack dump already on OOM.

    Signed-off-by: Joe Perches
    Signed-off-by: David S. Miller

    Joe Perches
     

06 Nov, 2014

1 commit

  • This encapsulates all of the skb_copy_datagram_iovec() callers
    with call argument signature "skb, offset, msghdr->msg_iov, length".

    When we move to iov_iters in the networking, the iov_iter object will
    sit in the msghdr.

    Having a helper like this means there will be less places to touch
    during that transformation.

    Based upon descriptions and patch from Al Viro.

    Signed-off-by: David S. Miller

    David S. Miller
     

03 Nov, 2014

1 commit

  • The sk_prot is irda's own set of protocol handlers, so irda should
    statically know what that function is anyway, without using an indirect
    pointer. And as it happens, we know *exactly* what that pointer is
    statically: it's NULL, because irda doesn't define a disconnect
    operation.

    So calling that function is doubly wrong, and will just cause an oops.

    Reported-by: Martin Lang
    Cc: Samuel Ortiz
    Cc: David Miller
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

01 Oct, 2014

1 commit


14 Aug, 2014

1 commit


07 Aug, 2014

1 commit

  • Pull networking updates from David Miller:
    "Highlights:

    1) Steady transitioning of the BPF instructure to a generic spot so
    all kernel subsystems can make use of it, from Alexei Starovoitov.

    2) SFC driver supports busy polling, from Alexandre Rames.

    3) Take advantage of hash table in UDP multicast delivery, from David
    Held.

    4) Lighten locking, in particular by getting rid of the LRU lists, in
    inet frag handling. From Florian Westphal.

    5) Add support for various RFC6458 control messages in SCTP, from
    Geir Ola Vaagland.

    6) Allow to filter bridge forwarding database dumps by device, from
    Jamal Hadi Salim.

    7) virtio-net also now supports busy polling, from Jason Wang.

    8) Some low level optimization tweaks in pktgen from Jesper Dangaard
    Brouer.

    9) Add support for ipv6 address generation modes, so that userland
    can have some input into the process. From Jiri Pirko.

    10) Consolidate common TCP connection request code in ipv4 and ipv6,
    from Octavian Purdila.

    11) New ARP packet logger in netfilter, from Pablo Neira Ayuso.

    12) Generic resizable RCU hash table, with intial users in netlink and
    nftables. From Thomas Graf.

    13) Maintain a name assignment type so that userspace can see where a
    network device name came from (enumerated by kernel, assigned
    explicitly by userspace, etc.) From Tom Gundersen.

    14) Automatic flow label generation on transmit in ipv6, from Tom
    Herbert.

    15) New packet timestamping facilities from Willem de Bruijn, meant to
    assist in measuring latencies going into/out-of the packet
    scheduler, latency from TCP data transmission to ACK, etc"

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1536 commits)
    cxgb4 : Disable recursive mailbox commands when enabling vi
    net: reduce USB network driver config options.
    tg3: Modify tg3_tso_bug() to handle multiple TX rings
    amd-xgbe: Perform phy connect/disconnect at dev open/stop
    amd-xgbe: Use dma_set_mask_and_coherent to set DMA mask
    net: sun4i-emac: fix memory leak on bad packet
    sctp: fix possible seqlock seadlock in sctp_packet_transmit()
    Revert "net: phy: Set the driver when registering an MDIO bus device"
    cxgb4vf: Turn off SGE RX/TX Callback Timers and interrupts in PCI shutdown routine
    team: Simplify return path of team_newlink
    bridge: Update outdated comment on promiscuous mode
    net-timestamp: ACK timestamp for bytestreams
    net-timestamp: TCP timestamping
    net-timestamp: SCHED timestamp on entering packet scheduler
    net-timestamp: add key to disambiguate concurrent datagrams
    net-timestamp: move timestamp flags out of sk_flags
    net-timestamp: extend SCM_TIMESTAMPING ancillary data struct
    cxgb4i : Move stray CPL definitions to cxgb4 driver
    tcp: reduce spurious retransmits due to transient SACK reneging
    qlcnic: Initialize dcbnl_ops before register_netdev
    ...

    Linus Torvalds
     

16 Jul, 2014

2 commits

  • Signed-off-by: Fabian Frederick
    Signed-off-by: David S. Miller

    Fabian Frederick
     
  • Extend alloc_netdev{,_mq{,s}}() to take name_assign_type as argument, and convert
    all users to pass NET_NAME_UNKNOWN.

    Coccinelle patch:

    @@
    expression sizeof_priv, name, setup, txqs, rxqs, count;
    @@

    (
    -alloc_netdev_mqs(sizeof_priv, name, setup, txqs, rxqs)
    +alloc_netdev_mqs(sizeof_priv, name, NET_NAME_UNKNOWN, setup, txqs, rxqs)
    |
    -alloc_netdev_mq(sizeof_priv, name, setup, count)
    +alloc_netdev_mq(sizeof_priv, name, NET_NAME_UNKNOWN, setup, count)
    |
    -alloc_netdev(sizeof_priv, name, setup)
    +alloc_netdev(sizeof_priv, name, NET_NAME_UNKNOWN, setup)
    )

    v9: move comments here from the wrong commit

    Signed-off-by: Tom Gundersen
    Reviewed-by: David Herrmann
    Signed-off-by: David S. Miller

    Tom Gundersen
     

11 Jul, 2014

1 commit

  • Since at least before 2.6.30, it has not been possible to observe
    a hung up file pointer in a tty driver's open() method unless/until
    the driver open() releases the tty_lock() (eg., before blocking).

    This is because tty_open() adds the file pointer while holding
    the tty_lock() _and_ doesn't release the lock until after calling
    the tty driver's open() method. [ Before tty_lock(), this was
    lock_kernel(). ]

    Since __tty_hangup() first waits on the tty_lock() before
    enumerating and hanging up the open file pointers, either
    __tty_hangup() will wait for the tty_lock() or tty_open() will
    not yet have added the file pointer. For example,

    CPU 0 | CPU 1
    |
    tty_open | __tty_hangup
    .. | ..
    tty_lock | ..
    tty_reopen | tty_lock / blocks
    .. |
    tty_add_file(tty, filp) |
    .. |
    tty->ops->open(tty, filp) |
    tty_port_open |
    tty_port_block_til_ready |
    .. |
    while (1) |
    .. |
    tty_unlock | / unblocks
    schedule | for each filp on tty->tty_files
    | f_ops = tty_hung_up_fops;
    | ..
    | tty_unlock
    tty_lock |
    .. |
    tty_unlock |

    Note that since tty_port_block_til_ready() and similar drop
    the tty_lock while blocking, when woken, the file pointer
    must then be tested for having been hung up.

    Also, fix bit-rotted drivers that used extra_count to track the
    port->count bump.

    CC: Mikael Starvik
    CC: Samuel Ortiz
    CC: "David S. Miller"
    Signed-off-by: Peter Hurley
    Acked-by: Jesper Nilsson
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

24 Jun, 2014

1 commit


19 Jan, 2014

1 commit

  • This is a follow-up patch to f3d3342602f8bc ("net: rework recvmsg
    handler msg_name and msg_namelen logic").

    DECLARE_SOCKADDR validates that the structure we use for writing the
    name information to is not larger than the buffer which is reserved
    for msg->msg_name (which is 128 bytes). Also use DECLARE_SOCKADDR
    consistently in sendmsg code paths.

    Signed-off-by: Steffen Hurrle
    Suggested-by: Hannes Frederic Sowa
    Acked-by: Hannes Frederic Sowa
    Signed-off-by: David S. Miller

    Steffen Hurrle
     

07 Dec, 2013

1 commit

  • Several files refer to an old address for the Free Software Foundation
    in the file header comment. Resolve by replacing the address with
    the URL so that we do not have to keep
    updating the header comments anytime the address changes.

    CC: Samuel Ortiz
    Signed-off-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Jeff Kirsher
     

21 Nov, 2013

1 commit


20 Nov, 2013

1 commit

  • As suggested by David Miller, make genl_register_family_with_ops()
    a macro and pass only the array, evaluating ARRAY_SIZE() in the
    macro, this is a little safer.

    The openvswitch has some indirection, assing ops/n_ops directly in
    that code. This might ultimately just assign the pointers in the
    family initializations, saving the struct genl_family_and_ops and
    code (once mcast groups are handled differently.)

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     

15 Nov, 2013

1 commit

  • Now that genl_ops are no longer modified in place when
    registering, they can be made const. This patch was done
    mostly with spatch:

    @@
    identifier ops;
    @@
    +const
    struct genl_ops ops[] = {
    ...
    };

    (except the struct thing in net/openvswitch/datapath.c)

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     

13 Nov, 2013

1 commit

  • Pull networking updates from David Miller:

    1) The addition of nftables. No longer will we need protocol aware
    firewall filtering modules, it can all live in userspace.

    At the core of nftables is a, for lack of a better term, virtual
    machine that executes byte codes to inspect packet or metadata
    (arriving interface index, etc.) and make verdict decisions.

    Besides support for loading packet contents and comparing them, the
    interpreter supports lookups in various datastructures as
    fundamental operations. For example sets are supports, and
    therefore one could create a set of whitelist IP address entries
    which have ACCEPT verdicts attached to them, and use the appropriate
    byte codes to do such lookups.

    Since the interpreted code is composed in userspace, userspace can
    do things like optimize things before giving it to the kernel.

    Another major improvement is the capability of atomically updating
    portions of the ruleset. In the existing netfilter implementation,
    one has to update the entire rule set in order to make a change and
    this is very expensive.

    Userspace tools exist to create nftables rules using existing
    netfilter rule sets, but both kernel implementations will need to
    co-exist for quite some time as we transition from the old to the
    new stuff.

    Kudos to Patrick McHardy, Pablo Neira Ayuso, and others who have
    worked so hard on this.

    2) Daniel Borkmann and Hannes Frederic Sowa made several improvements
    to our pseudo-random number generator, mostly used for things like
    UDP port randomization and netfitler, amongst other things.

    In particular the taus88 generater is updated to taus113, and test
    cases are added.

    3) Support 64-bit rates in HTB and TBF schedulers, from Eric Dumazet
    and Yang Yingliang.

    4) Add support for new 577xx tigon3 chips to tg3 driver, from Nithin
    Sujir.

    5) Fix two fatal flaws in TCP dynamic right sizing, from Eric Dumazet,
    Neal Cardwell, and Yuchung Cheng.

    6) Allow IP_TOS and IP_TTL to be specified in sendmsg() ancillary
    control message data, much like other socket option attributes.
    From Francesco Fusco.

    7) Allow applications to specify a cap on the rate computed
    automatically by the kernel for pacing flows, via a new
    SO_MAX_PACING_RATE socket option. From Eric Dumazet.

    8) Make the initial autotuned send buffer sizing in TCP more closely
    reflect actual needs, from Eric Dumazet.

    9) Currently early socket demux only happens for TCP sockets, but we
    can do it for connected UDP sockets too. Implementation from Shawn
    Bohrer.

    10) Refactor inet socket demux with the goal of improving hash demux
    performance for listening sockets. With the main goals being able
    to use RCU lookups on even request sockets, and eliminating the
    listening lock contention. From Eric Dumazet.

    11) The bonding layer has many demuxes in it's fast path, and an RCU
    conversion was started back in 3.11, several changes here extend the
    RCU usage to even more locations. From Ding Tianhong and Wang
    Yufen, based upon suggestions by Nikolay Aleksandrov and Veaceslav
    Falico.

    12) Allow stackability of segmentation offloads to, in particular, allow
    segmentation offloading over tunnels. From Eric Dumazet.

    13) Significantly improve the handling of secret keys we input into the
    various hash functions in the inet hashtables, TCP fast open, as
    well as syncookies. From Hannes Frederic Sowa. The key fundamental
    operation is "net_get_random_once()" which uses static keys.

    Hannes even extended this to ipv4/ipv6 fragmentation handling and
    our generic flow dissector.

    14) The generic driver layer takes care now to set the driver data to
    NULL on device removal, so it's no longer necessary for drivers to
    explicitly set it to NULL any more. Many drivers have been cleaned
    up in this way, from Jingoo Han.

    15) Add a BPF based packet scheduler classifier, from Daniel Borkmann.

    16) Improve CRC32 interfaces and generic SKB checksum iterators so that
    SCTP's checksumming can more cleanly be handled. Also from Daniel
    Borkmann.

    17) Add a new PMTU discovery mode, IP_PMTUDISC_INTERFACE, which forces
    using the interface MTU value. This helps avoid PMTU attacks,
    particularly on DNS servers. From Hannes Frederic Sowa.

    18) Use generic XPS for transmit queue steering rather than internal
    (re-)implementation in virtio-net. From Jason Wang.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1622 commits)
    random32: add test cases for taus113 implementation
    random32: upgrade taus88 generator to taus113 from errata paper
    random32: move rnd_state to linux/random.h
    random32: add prandom_reseed_late() and call when nonblocking pool becomes initialized
    random32: add periodic reseeding
    random32: fix off-by-one in seeding requirement
    PHY: Add RTL8201CP phy_driver to realtek
    xtsonic: add missing platform_set_drvdata() in xtsonic_probe()
    macmace: add missing platform_set_drvdata() in mace_probe()
    ethernet/arc/arc_emac: add missing platform_set_drvdata() in arc_emac_probe()
    ipv6: protect for_each_sk_fl_rcu in mem_check with rcu_read_lock_bh
    vlan: Implement vlan_dev_get_egress_qos_mask as an inline.
    ixgbe: add warning when max_vfs is out of range.
    igb: Update link modes display in ethtool
    netfilter: push reasm skb through instead of original frag skbs
    ip6_output: fragment outgoing reassembled skb properly
    MAINTAINERS: mv643xx_eth: take over maintainership from Lennart
    net_sched: tbf: support of 64bit rates
    ixgbe: deleting dfwd stations out of order can cause null ptr deref
    ixgbe: fix build err, num_rx_queues is only available with CONFIG_RPS
    ...

    Linus Torvalds