Eric Lee / smarc-fsl-linux-kernel

23 Jan, 2019

1 commit

  • 39ff087b5   can: gw: ensure DLC boundaries after CAN frame modification ... Browse Code »

    commit 0aaa81377c5a01f686bcdb8c7a6929a7bf330c68 upstream.

    Muyu Yu provided a POC where user root with CAP_NET_ADMIN can create a CAN
    frame modification rule that makes the data length code a higher value than
    the available CAN frame data size. In combination with a configured checksum
    calculation where the result is stored relatively to the end of the data
    (e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in
    skb_shared_info) can be rewritten which finally can cause a system crash.

    Michael Kubecek suggested to drop frames that have a DLC exceeding the
    available space after the modification process and provided a patch that can
    handle CAN FD frames too. Within this patch we also limit the length for the
    checksum calculations to the maximum of Classic CAN data length (8).

    CAN frames that are dropped by these additional checks are counted with the
    CGW_DELETED counter which indicates misconfigurations in can-gw rules.

    This fixes CVE-2019-3701.

    Reported-by: Muyu Yu
    Reported-by: Marcus Meissner
    Suggested-by: Michal Kubecek
    Tested-by: Muyu Yu
    Tested-by: Oliver Hartkopp
    Signed-off-by: Oliver Hartkopp
    Cc: linux-stable # >= v3.2
    Signed-off-by: Marc Kleine-Budde
    Signed-off-by: David S. Miller
    Signed-off-by: Greg Kroah-Hartman

    Oliver Hartkopp
     

10 Aug, 2017

1 commit

  • b97bac64a   rtnetlink: make rtnl_register accept a flags parameter ... Browse Code »

    This change allows us to later indicate to rtnetlink core that certain
    doit functions should be called without acquiring rtnl_mutex.

    This change should have no effect, we simply replace the last (now
    unused) calcit argument with the new flag.

    Signed-off-by: Florian Westphal
    Reviewed-by: Hannes Frederic Sowa
    Signed-off-by: David S. Miller

    Florian Westphal
     

25 Apr, 2017

1 commit

18 Apr, 2017

1 commit

  • c21ef3e34   net: rtnetlink: plumb extended ack to doit function ... Browse Code »

    Add netlink_ext_ack arg to rtnl_doit_func. Pass extack arg to nlmsg_parse
    for doit functions that call it directly.

    This is the first step to using extended error reporting in rtnetlink.
    >From here individual subsystems can be updated to set netlink_ext_ack as
    needed.

    Signed-off-by: David Ahern
    Signed-off-by: David S. Miller

    David Ahern
     

14 Apr, 2017

1 commit

04 Apr, 2017

1 commit

  • 8e8cda6d7   can: initial support for network namespaces ... Browse Code »

    This patch adds initial support for network namespaces. The changes only
    enable support in the CAN raw, proc and af_can code. GW and BCM still
    have their checks that ensure that they are used only from the main
    namespace.

    The patch boils down to moving the global structures, i.e. the global
    filter list and their /proc stats, into a per-namespace structure and passing
    around the corresponding "struct net" in a lot of different places.

    Changes since v1:
    - rebased on current HEAD (2bfe01e)
    - fixed overlong line

    Signed-off-by: Mario Kicherer
    Signed-off-by: Marc Kleine-Budde

    Mario Kicherer
     

30 Jan, 2017

1 commit

  • f1712c737   can: Fix kernel panic at security_sock_rcv_skb ... Browse Code »

    Zhang Yanmin reported crashes [1] and provided a patch adding a
    synchronize_rcu() call in can_rx_unregister()

    The main problem seems that the sockets themselves are not RCU
    protected.

    If CAN uses RCU for delivery, then sockets should be freed only after
    one RCU grace period.

    Recent kernels could use sock_set_flag(sk, SOCK_RCU_FREE), but let's
    ease stable backports with the following fix instead.

    [1]
    BUG: unable to handle kernel NULL pointer dereference at (null)
    IP: [] selinux_socket_sock_rcv_skb+0x65/0x2a0

    Call Trace:

    [] security_sock_rcv_skb+0x4c/0x60
    [] sk_filter+0x41/0x210
    [] sock_queue_rcv_skb+0x53/0x3a0
    [] raw_rcv+0x2a3/0x3c0
    [] can_rcv_filter+0x12b/0x370
    [] can_receive+0xd9/0x120
    [] can_rcv+0xab/0x100
    [] __netif_receive_skb_core+0xd8c/0x11f0
    [] __netif_receive_skb+0x24/0xb0
    [] process_backlog+0x127/0x280
    [] net_rx_action+0x33b/0x4f0
    [] __do_softirq+0x184/0x440
    [] do_softirq_own_stack+0x1c/0x30

    [] do_softirq.part.18+0x3b/0x40
    [] do_softirq+0x1d/0x20
    [] netif_rx_ni+0xe5/0x110
    [] slcan_receive_buf+0x507/0x520
    [] flush_to_ldisc+0x21c/0x230
    [] process_one_work+0x24f/0x670
    [] worker_thread+0x9d/0x6f0
    [] ? rescuer_thread+0x480/0x480
    [] kthread+0x12c/0x150
    [] ret_from_fork+0x3f/0x70

    Reported-by: Zhang Yanmin
    Signed-off-by: Eric Dumazet
    Acked-by: Oliver Hartkopp
    Signed-off-by: David S. Miller

    Eric Dumazet
     

26 Dec, 2016

1 commit

  • 2456e8553   ktime: Get rid of the union ... Browse Code »

    ktime is a union because the initial implementation stored the time in
    scalar nanoseconds on 64 bit machine and in a endianess optimized timespec
    variant for 32bit machines. The Y2038 cleanup removed the timespec variant
    and switched everything to scalar nanoseconds. The union remained, but
    become completely pointless.

    Get rid of the union and just keep ktime_t as simple typedef of type s64.

    The conversion was done with coccinelle and some manual mopping up.

    Signed-off-by: Thomas Gleixner
    Cc: Peter Zijlstra

    Thomas Gleixner
     

09 Jun, 2015

1 commit

  • dd895d7f2   can: cangw: introduce optional uid to reference created routing jobs ... Browse Code »

    Similar to referencing iptables rules by their line number this UID allows to
    reference created routing jobs, e.g. to alter configured data modifications.

    The UID is an optional non-zero value which can be provided at routing job
    creation time. When the UID is set the UID replaces the data modification
    configuration as job identification attribute e.g. at job removal time.

    Signed-off-by: Oliver Hartkopp
    Signed-off-by: Marc Kleine-Budde

    Oliver Hartkopp
     

18 Jan, 2015

1 commit

  • 053c095a8   netlink: make nlmsg_end() and genlmsg_end() void ... Browse Code »

    Contrary to common expectations for an "int" return, these functions
    return only a positive value -- if used correctly they cannot even
    return 0 because the message header will necessarily be in the skb.

    This makes the very common pattern of

    if (genlmsg_end(...) < 0) { ... }

    be a whole bunch of dead code. Many places also simply do

    return nlmsg_end(...);

    and the caller is expected to deal with it.

    This also commonly (at least for me) causes errors, because it is very
    common to write

    if (my_function(...))
    /* error condition */

    and if my_function() does "return nlmsg_end()" this is of course wrong.

    Additionally, there's not a single place in the kernel that actually
    needs the message length returned, and if anyone needs it later then
    it'll be very easy to just use skb->len there.

    Remove this, and make the functions void. This removes a bunch of dead
    code as described above. The patch adds lines because I did

    - return nlmsg_end(...);
    + nlmsg_end(...);
    + return 0;

    I could have preserved all the function's return values by returning
    skb->len, but instead I've audited all the places calling the affected
    functions and found that none cared. A few places actually compared
    the return value with < 0 with no change in behaviour, so I opted for the more
    efficient version.

    One instance of the error I've made numerous times now is also present
    in net/phonet/pn_netlink.c in the route_dumpit() function - it didn't
    check for
    Signed-off-by: David S. Miller

    Johannes Berg
     

08 Dec, 2014

1 commit

25 Apr, 2014

1 commit

  • 90f62cf30   net: Use netlink_ns_capable to verify the permisions of netlink messages ... Browse Code »

    It is possible by passing a netlink socket to a more privileged
    executable and then to fool that executable into writing to the socket
    data that happens to be valid netlink message to do something that
    privileged executable did not intend to do.

    To keep this from happening replace bare capable and ns_capable calls
    with netlink_capable, netlink_net_calls and netlink_ns_capable calls.
    Which act the same as the previous calls except they verify that the
    opener of the socket had the desired permissions as well.

    Reported-by: Andy Lutomirski
    Signed-off-by: "Eric W. Biederman"
    Signed-off-by: David S. Miller

    Eric W. Biederman
     

15 Jan, 2014

1 commit

21 Dec, 2013

1 commit

  • c0ebbdd6b   can: gw: remove obsolete checks ... Browse Code »

    In commit be286bafe1f4069094865264f29805854c5788bf ("can: gw: add a variable
    limit for CAN frame routings") the detection of the frame routing has been
    changed. The former solution required dev->header_ops to be unused (== NULL).

    I missed to remove the obsolete checks in the original commit - so here it is.

    Signed-off-by: Oliver Hartkopp
    Signed-off-by: Marc Kleine-Budde

    Oliver Hartkopp
     

30 Aug, 2013

1 commit

  • 391ac1282   can: gw: add a per rule limitation of frame hops ... Browse Code »

    Usually the received CAN frames can be processed/routed as much as 'max_hops'
    times (which is given at module load time of the can-gw module).
    Introduce a new configuration option to reduce the number of possible hops
    for a specific gateway rule to a value smaller then max_hops.

    Signed-off-by: Oliver Hartkopp
    Signed-off-by: Marc Kleine-Budde

    Oliver Hartkopp
     

29 May, 2013

1 commit

  • 351638e7d   net: pass info struct via netdevice notifier ... Browse Code »

    So far, only net_device * could be passed along with netdevice notifier
    event. This patch provides a possibility to pass custom structure
    able to provide info that event listener needs to know.

    Signed-off-by: Jiri Pirko

    v2->v3: fix typo on simeth
    shortened dev_getter
    shortened notifier_info struct name
    v1->v2: fix notifier_call parameter in call_netdevice_notifier()
    Signed-off-by: David S. Miller

    Jiri Pirko
     

23 Apr, 2013

1 commit

  • 6e0895c2e   Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net ... Browse Code »

    Conflicts:
    drivers/net/ethernet/emulex/benet/be_main.c
    drivers/net/ethernet/intel/igb/igb_main.c
    drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
    include/net/scm.h
    net/batman-adv/routing.c
    net/ipv4/tcp_input.c

    The e{uid,gid} --> {uid,gid} credentials fix conflicted with the
    cleanup in net-next to now pass cred structs around.

    The be2net driver had a bug fix in 'net' that overlapped with the VLAN
    interface changes by Patrick McHardy in net-next.

    An IGB conflict existed because in 'net' the build_skb() support was
    reverted, and in 'net-next' there was a comment style fix within that
    code.

    Several batman-adv conflicts were resolved by making sure that all
    calls to batadv_is_my_mac() are changed to have a new bat_priv first
    argument.

    Eric Dumazet's TS ECR fix in TCP in 'net' conflicted with the F-RTO
    rewrite in 'net-next', mostly overlapping changes.

    Thanks to Stephen Rothwell and Antonio Quartulli for help with several
    of these merge resolutions.

    Signed-off-by: David S. Miller

    David S. Miller
     

09 Apr, 2013

1 commit

22 Mar, 2013

1 commit

28 Feb, 2013

1 commit

  • b67bfe0d4   hlist: drop the node parameter from iterators ... Browse Code »

    I'm not sure why, but the hlist for each entry iterators were conceived

    list_for_each_entry(pos, head, member)

    The hlist ones were greedy and wanted an extra parameter:

    hlist_for_each_entry(tpos, pos, head, member)

    Why did they need an extra pos parameter? I'm not quite sure. Not only
    they don't really need it, it also prevents the iterator from looking
    exactly like the list iterator, which is unfortunate.

    Besides the semantic patch, there was some manual work required:

    - Fix up the actual hlist iterators in linux/list.h
    - Fix up the declaration of other iterators based on the hlist ones.
    - A very small amount of places were using the 'node' parameter, this
    was modified to use 'obj->member' instead.
    - Coccinelle didn't handle the hlist_for_each_entry_safe iterator
    properly, so those had to be fixed up manually.

    The semantic patch which is mostly the work of Peter Senna Tschudin is here:

    @@
    iterator name hlist_for_each_entry, hlist_for_each_entry_continue, hlist_for_each_entry_from, hlist_for_each_entry_rcu, hlist_for_each_entry_rcu_bh, hlist_for_each_entry_continue_rcu_bh, for_each_busy_worker, ax25_uid_for_each, ax25_for_each, inet_bind_bucket_for_each, sctp_for_each_hentry, sk_for_each, sk_for_each_rcu, sk_for_each_from, sk_for_each_safe, sk_for_each_bound, hlist_for_each_entry_safe, hlist_for_each_entry_continue_rcu, nr_neigh_for_each, nr_neigh_for_each_safe, nr_node_for_each, nr_node_for_each_safe, for_each_gfn_indirect_valid_sp, for_each_gfn_sp, for_each_host;

    type T;
    expression a,c,d,e;
    identifier b;
    statement S;
    @@

    -T b;

    [akpm@linux-foundation.org: drop bogus change from net/ipv4/raw.c]
    [akpm@linux-foundation.org: drop bogus hunk from net/ipv6/raw.c]
    [akpm@linux-foundation.org: checkpatch fixes]
    [akpm@linux-foundation.org: fix warnings]
    [akpm@linux-foudnation.org: redo intrusive kvm changes]
    Tested-by: Peter Senna Tschudin
    Acked-by: Paul E. McKenney
    Signed-off-by: Sasha Levin
    Cc: Wu Fengguang
    Cc: Marcelo Tosatti
    Cc: Gleb Natapov
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Sasha Levin
     

29 Jan, 2013

1 commit

26 Jan, 2013

3 commits

19 Nov, 2012

1 commit

  • dfc47ef86   net: Push capable(CAP_NET_ADMIN) into the rtnl methods ... Browse Code »

    - In rtnetlink_rcv_msg convert the capable(CAP_NET_ADMIN) check
    to ns_capable(net->user-ns, CAP_NET_ADMIN). Allowing unprivileged
    users to make netlink calls to modify their local network
    namespace.

    - In the rtnetlink doit methods add capable(CAP_NET_ADMIN) so
    that calls that are not safe for unprivileged users are still
    protected.

    Later patches will remove the extra capable calls from methods
    that are safe for unprivilged users.

    Acked-by: Serge Hallyn
    Signed-off-by: "Eric W. Biederman"
    Signed-off-by: David S. Miller

    Eric W. Biederman
     

06 Oct, 2012

1 commit

11 Sep, 2012

1 commit

  • 15e473046   netlink: Rename pid to portid to avoid confusion ... Browse Code »

    It is a frequent mistake to confuse the netlink port identifier with a
    process identifier. Try to reduce this confusion by renaming fields
    that hold port identifiers portid instead of pid.

    I have carefully avoided changing the structures exported to
    userspace to avoid changing the userspace API.

    I have successfully built an allyesconfig kernel with this change.

    Signed-off-by: "Eric W. Biederman"
    Acked-by: Stephen Hemminger
    Signed-off-by: David S. Miller

    Eric W. Biederman
     

11 Jul, 2012

4 commits

17 Apr, 2012

1 commit

  • a75afd477   can: fix sparse warning for cgw_list ... Browse Code »

    Make cgw_list static to remove the following sparse warning:
    net/can/gw.c:69:1: warning: symbol 'cgw_list' was not declared.
    Should it be static?

    Signed-off-by: Daniel Baluta
    Acked-by: Oliver Hartkopp
    Signed-off-by: Marc Kleine-Budde

    Daniel Baluta
     

18 Oct, 2011

1 commit

17 Sep, 2011

1 commit

  • c1aabdf37   can-gw: add netlink based CAN routing ... Browse Code »

    This patch adds a CAN Gateway/Router to route (and modify) CAN frames.

    It is based on the PF_CAN core infrastructure for msg filtering and msg
    sending and can optionally modify routed CAN frames on the fly.
    CAN frames can *only* be routed between CAN network interfaces (one hop).
    They can be modified with AND/OR/XOR/SET operations as configured by the
    netlink configuration interface known e.g. from iptables. From the netlink
    view this can-gw implements RTM_{NEW|DEL|GET}ROUTE for PF_CAN.

    The CAN specific userspace tool to manage CAN routing entries can be found in
    the CAN utils http://svn.berlios.de/wsvn/socketcan/trunk/can-utils/cangw.c
    at the SocketCAN SVN on BerliOS.

    Signed-off-by: Oliver Hartkopp
    Signed-off-by: David S. Miller

    Oliver Hartkopp