Eric Lee / smarc-fsl-linux-kernel

03 Oct, 2020

1 commit

24 Aug, 2020

1 commit

  • df561f668   treewide: Use fallthrough pseudo-keyword ... Browse Code »

    Replace the existing /* fall through */ comments and its variants with
    the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
    fall-through markings when it is the case.

    [1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

    Signed-off-by: Gustavo A. R. Silva

    Gustavo A. R. Silva
     

25 Jul, 2020

1 commit

  • a7b75c5a8   net: pass a sockptr_t into ->setsockopt ... Browse Code »

    Rework the remaining setsockopt code to pass a sockptr_t instead of a
    plain user pointer. This removes the last remaining set_fs(KERNEL_DS)
    outside of architecture specific code.

    Signed-off-by: Christoph Hellwig
    Acked-by: Stefan Schmidt [ieee802154]
    Acked-by: Matthieu Baerts
    Signed-off-by: David S. Miller

    Christoph Hellwig
     

20 Jul, 2020

1 commit

  • 8c918ffbb   net: remove compat_sock_common_{get,set}sockopt ... Browse Code »

    Add the compat handling to sock_common_{get,set}sockopt instead,
    keyed of in_compat_syscall(). This allow to remove the now unused
    ->compat_{get,set}sockopt methods from struct proto_ops.

    Signed-off-by: Christoph Hellwig
    Acked-by: Matthieu Baerts
    Acked-by: Stefan Schmidt
    Signed-off-by: David S. Miller

    Christoph Hellwig
     

14 Jun, 2020

1 commit

  • a7f7f6248   treewide: replace '---help---' in Kconfig files with 'help' ... Browse Code »

    Since commit 84af7a6194e4 ("checkpatch: kconfig: prefer 'help' over
    '---help---'"), the number of '---help---' has been gradually
    decreasing, but there are still more than 2400 instances.

    This commit finishes the conversion. While I touched the lines,
    I also fixed the indentation.

    There are a variety of indentation styles found.

    a) 4 spaces + '---help---'
    b) 7 spaces + '---help---'
    c) 8 spaces + '---help---'
    d) 1 space + 1 tab + '---help---'
    e) 1 tab + '---help---' (correct indentation)
    f) 1 tab + 1 space + '---help---'
    g) 1 tab + 2 spaces + '---help---'

    In order to convert all of them to 1 tab + 'help', I ran the
    following commend:

    $ find . -name 'Kconfig*' | xargs sed -i 's/^[[:space:]]*---help---/\thelp/'

    Signed-off-by: Masahiro Yamada

    Masahiro Yamada
     

09 May, 2020

1 commit

05 May, 2020

1 commit

  • 1a33e10e4   net: partially revert dynamic lockdep key changes ... Browse Code »

    This patch reverts the folowing commits:

    commit 064ff66e2bef84f1153087612032b5b9eab005bd
    "bonding: add missing netdev_update_lockdep_key()"

    commit 53d374979ef147ab51f5d632dfe20b14aebeccd0
    "net: avoid updating qdisc_xmit_lock_key in netdev_update_lockdep_key()"

    commit 1f26c0d3d24125992ab0026b0dab16c08df947c7
    "net: fix kernel-doc warning in "

    commit ab92d68fc22f9afab480153bd82a20f6e2533769
    "net: core: add generic lockdep keys"

    but keeps the addr_list_lock_key because we still lock
    addr_list_lock nestedly on stack devices, unlikely xmit_lock
    this is safe because we don't take addr_list_lock on any fast
    path.

    Reported-and-tested-by: syzbot+aaa6fa4949cc5d9b7b25@syzkaller.appspotmail.com
    Cc: Dmitry Vyukov
    Cc: Taehee Yoo
    Signed-off-by: Cong Wang
    Acked-by: Taehee Yoo
    Signed-off-by: David S. Miller

    Cong Wang
     

04 Mar, 2020

2 commits

03 Nov, 2019

1 commit

25 Oct, 2019

1 commit

  • ab92d68fc   net: core: add generic lockdep keys ... Browse Code »

    Some interface types could be nested.
    (VLAN, BONDING, TEAM, MACSEC, MACVLAN, IPVLAN, VIRT_WIFI, VXLAN, etc..)
    These interface types should set lockdep class because, without lockdep
    class key, lockdep always warn about unexisting circular locking.

    In the current code, these interfaces have their own lockdep class keys and
    these manage itself. So that there are so many duplicate code around the
    /driver/net and /net/.
    This patch adds new generic lockdep keys and some helper functions for it.

    This patch does below changes.
    a) Add lockdep class keys in struct net_device
    - qdisc_running, xmit, addr_list, qdisc_busylock
    - these keys are used as dynamic lockdep key.
    b) When net_device is being allocated, lockdep keys are registered.
    - alloc_netdev_mqs()
    c) When net_device is being free'd llockdep keys are unregistered.
    - free_netdev()
    d) Add generic lockdep key helper function
    - netdev_register_lockdep_key()
    - netdev_unregister_lockdep_key()
    - netdev_update_lockdep_key()
    e) Remove unnecessary generic lockdep macro and functions
    f) Remove unnecessary lockdep code of each interfaces.

    After this patch, each interface modules don't need to maintain
    their lockdep keys.

    Signed-off-by: Taehee Yoo
    Signed-off-by: David S. Miller

    Taehee Yoo
     

06 Oct, 2019

1 commit

24 Sep, 2019

1 commit

18 Sep, 2019

1 commit

  • 4feaab05d   Merge tag 'leds-for-5.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.… ... Browse Code »

    …anaszewski/linux-leds

    Pull LED updates from Jacek Anaszewski:
    "In this cycle we've finally managed to contribute the patch set
    sorting out LED naming issues. Besides that there are many changes
    scattered among various LED class drivers and triggers.

    LED naming related improvements:

    - add new 'function' and 'color' fwnode properties and deprecate
    'label' property which has been frequently abused for conveying
    vendor specific names that have been available in sysfs anyway

    - introduce a set of standard LED_FUNCTION* definitions

    - introduce a set of standard LED_COLOR_ID* definitions

    - add a new {devm_}led_classdev_register_ext() API with the
    capability of automatic LED name composition basing on the
    properties available in the passed fwnode; the function is
    backwards compatible in a sense that it uses 'label' data, if
    present in the fwnode, for creating LED name

    - add tools/leds/get_led_device_info.sh script for retrieving LED
    vendor, product and bus names, if applicable; it also performs
    basic validation of an LED name

    - update following drivers and their DT bindings to use the new LED
    registration API:

    - leds-an30259a, leds-gpio, leds-as3645a, leds-aat1290, leds-cr0014114,
    leds-lm3601x, leds-lm3692x, leds-lp8860, leds-lt3593, leds-sc27xx-blt

    Other LED class improvements:

    - replace {devm_}led_classdev_register() macros with inlines

    - allow to call led_classdev_unregister() unconditionally

    - switch to use fwnode instead of be stuck with OF one

    LED triggers improvements:

    - led-triggers:
    - fix dereferencing of null pointer
    - fix a memory leak bug

    - ledtrig-gpio:
    - GPIO 0 is valid

    Drop superseeded apu2/3 support from leds-apu since for apu2+ a newer,
    more complete driver exists, based on a generic driver for the AMD
    SOCs gpio-controller, supporting LEDs as well other devices:

    - drop profile field from priv data

    - drop iosize field from priv data

    - drop enum_apu_led_platform_types

    - drop superseeded apu2/3 led support

    - add pr_fmt prefix for better log output

    - fix error message on probing failure

    Other misc fixes and improvements to existing LED class drivers:

    - leds-ns2, leds-max77650:
    - add of_node_put() before return

    - leds-pwm, leds-is31fl32xx:
    - use struct_size() helper

    - leds-lm3697, leds-lm36274, leds-lm3532:
    - switch to use fwnode_property_count_uXX()

    - leds-lm3532:
    - fix brightness control for i2c mode
    - change the define for the fs current register
    - fixes for the driver for stability
    - add full scale current configuration
    - dt: Add property for full scale current.
    - avoid potentially unpaired regulator calls
    - move static keyword to the front of declarations
    - fix optional led-max-microamp prop error handling

    - leds-max77650:
    - add of_node_put() before return
    - add MODULE_ALIAS()
    - Switch to fwnode property API

    - leds-as3645a:
    - fix misuse of strlcpy

    - leds-netxbig:
    - add of_node_put() in netxbig_leds_get_of_pdata()
    - remove legacy board-file support

    - leds-is31fl319x:
    - simplify getting the adapter of a client

    - leds-ti-lmu-common:
    - fix coccinelle issue
    - move static keyword to the front of declaration

    - leds-syscon:
    - use resource managed variant of device register

    - leds-ktd2692:
    - fix a typo in the name of a constant

    - leds-lp5562:
    - allow firmware files up to the maximum length

    - leds-an30259a:
    - fix typo

    - leds-pca953x:
    - include the right header"

    * tag 'leds-for-5.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds: (72 commits)
    leds: lm3532: Fix optional led-max-microamp prop error handling
    led: triggers: Fix dereferencing of null pointer
    leds: ti-lmu-common: Move static keyword to the front of declaration
    leds: lm3532: Move static keyword to the front of declarations
    leds: trigger: gpio: GPIO 0 is valid
    leds: pwm: Use struct_size() helper
    leds: is31fl32xx: Use struct_size() helper
    leds: ti-lmu-common: Fix coccinelle issue in TI LMU
    leds: lm3532: Avoid potentially unpaired regulator calls
    leds: syscon: Use resource managed variant of device register
    leds: Replace {devm_}led_classdev_register() macros with inlines
    leds: Allow to call led_classdev_unregister() unconditionally
    leds: lm3532: Add full scale current configuration
    dt: lm3532: Add property for full scale current.
    leds: lm3532: Fixes for the driver for stability
    leds: lm3532: Change the define for the fs current register
    leds: lm3532: Fix brightness control for i2c mode
    leds: Switch to use fwnode instead of be stuck with OF one
    leds: max77650: Switch to fwnode property API
    led: triggers: Fix a memory leak bug
    ...

    Linus Torvalds
     

25 Aug, 2019

1 commit

14 Aug, 2019

1 commit

09 Aug, 2019

1 commit

  • 891584f48   inet: frags: re-introduce skb coalescing for local delivery ... Browse Code »

    Before commit d4289fcc9b16 ("net: IP6 defrag: use rbtrees for IPv6
    defrag"), a netperf UDP_STREAM test[0] using big IPv6 datagrams (thus
    generating many fragments) and running over an IPsec tunnel, reported
    more than 6Gbps throughput. After that patch, the same test gets only
    9Mbps when receiving on a be2net nic (driver can make a big difference
    here, for example, ixgbe doesn't seem to be affected).

    By reusing the IPv4 defragmentation code, IPv6 lost fragment coalescing
    (IPv4 fragment coalescing was dropped by commit 14fe22e33462 ("Revert
    "ipv4: use skb coalescing in defragmentation"")).

    Without fragment coalescing, be2net runs out of Rx ring entries and
    starts to drop frames (ethtool reports rx_drops_no_frags errors). Since
    the netperf traffic is only composed of UDP fragments, any lost packet
    prevents reassembly of the full datagram. Therefore, fragments which
    have no possibility to ever get reassembled pile up in the reassembly
    queue, until the memory accounting exeeds the threshold. At that point
    no fragment is accepted anymore, which effectively discards all
    netperf traffic.

    When reassembly timeout expires, some stale fragments are removed from
    the reassembly queue, so a few packets can be received, reassembled
    and delivered to the netperf receiver. But the nic still drops frames
    and soon the reassembly queue gets filled again with stale fragments.
    These long time frames where no datagram can be received explain why
    the performance drop is so significant.

    Re-introducing fragment coalescing is enough to get the initial
    performances again (6.6Gbps with be2net): driver doesn't drop frames
    anymore (no more rx_drops_no_frags errors) and the reassembly engine
    works at full speed.

    This patch is quite conservative and only coalesces skbs for local
    IPv4 and IPv6 delivery (in order to avoid changing skb geometry when
    forwarding). Coalescing could be extended in the future if need be, as
    more scenarios would probably benefit from it.

    [0]: Test configuration
    Sender:
    ip xfrm policy flush
    ip xfrm state flush
    ip xfrm state add src fc00:1::1 dst fc00:2::1 proto esp spi 0x1000 aead 'rfc4106(gcm(aes))' 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b 96 mode transport sel src fc00:1::1 dst fc00:2::1
    ip xfrm policy add src fc00:1::1 dst fc00:2::1 dir in tmpl src fc00:1::1 dst fc00:2::1 proto esp mode transport action allow
    ip xfrm state add src fc00:2::1 dst fc00:1::1 proto esp spi 0x1001 aead 'rfc4106(gcm(aes))' 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b 96 mode transport sel src fc00:2::1 dst fc00:1::1
    ip xfrm policy add src fc00:2::1 dst fc00:1::1 dir out tmpl src fc00:2::1 dst fc00:1::1 proto esp mode transport action allow
    netserver -D -L fc00:2::1

    Receiver:
    ip xfrm policy flush
    ip xfrm state flush
    ip xfrm state add src fc00:2::1 dst fc00:1::1 proto esp spi 0x1001 aead 'rfc4106(gcm(aes))' 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b 96 mode transport sel src fc00:2::1 dst fc00:1::1
    ip xfrm policy add src fc00:2::1 dst fc00:1::1 dir in tmpl src fc00:2::1 dst fc00:1::1 proto esp mode transport action allow
    ip xfrm state add src fc00:1::1 dst fc00:2::1 proto esp spi 0x1000 aead 'rfc4106(gcm(aes))' 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b 96 mode transport sel src fc00:1::1 dst fc00:2::1
    ip xfrm policy add src fc00:1::1 dst fc00:2::1 dir out tmpl src fc00:1::1 dst fc00:2::1 proto esp mode transport action allow
    netperf -H fc00:2::1 -f k -P 0 -L fc00:1::1 -l 60 -t UDP_STREAM -I 99,5 -i 5,5 -T5,5 -6

    Signed-off-by: Guillaume Nault
    Acked-by: Florian Westphal
    Signed-off-by: David S. Miller

    Guillaume Nault
     

30 Jul, 2019

1 commit

  • 6cda08a20   drivers: Introduce device lookup variants by name ... Browse Code »

    Add a helper to match the device name for device lookup. Also
    reuse this generic exported helper for the existing bus_find_device_by_name().
    and add similar variants for driver/class.

    Cc: Alessandro Zummo
    Cc: Alexander Aring
    Cc: Alexander Shishkin
    Cc: Arnd Bergmann
    Cc: Dan Murphy
    Cc: Harald Freudenberger
    Cc: Heiko Carstens
    Cc: Jacek Anaszewski
    Cc: Lee Jones
    Cc: linux-leds@vger.kernel.org
    Cc: linux-rtc@vger.kernel.org
    Cc: linux-usb@vger.kernel.org
    Cc: linux-wpan@vger.kernel.org
    Cc: Maxime Coquelin
    Cc: Pavel Machek
    Cc: Peter Oberparleiter
    Cc: "Rafael J. Wysocki"
    Cc: Stefan Schmidt
    Cc: Greg Kroah-Hartman
    Cc: "Rafael J. Wysocki"
    Signed-off-by: Suzuki K Poulose
    Reviewed-by: Heikki Krogerus
    Acked-by: Alexandre Belloni
    Link: https://lore.kernel.org/r/20190723221838.12024-2-suzuki.poulose@arm.com
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     

19 Jun, 2019

1 commit

  • d5dd88794   inet: fix various use-after-free in defrags units ... Browse Code »

    syzbot reported another issue caused by my recent patches. [1]

    The issue here is that fqdir_exit() is initiating a work queue
    and immediately returns. A bit later cleanup_net() was able
    to free the MIB (percpu data) and the whole struct net was freed,
    but we had active frag timers that fired and triggered use-after-free.

    We need to make sure that timers can catch fqdir->dead being set,
    to bailout.

    Since RCU is used for the reader side, this means
    we want to respect an RCU grace period between these operations :

    1) qfdir->dead = 1;

    2) netns dismantle (freeing of various data structure)

    This patch uses new new (struct pernet_operations)->pre_exit
    infrastructure to ensures a full RCU grace period
    happens between fqdir_pre_exit() and fqdir_exit()

    This also means we can use a regular work queue, we no
    longer need rcu_work.

    Tested:

    $ time for i in {1..1000}; do unshare -n /bin/false;done

    real 0m2.585s
    user 0m0.160s
    sys 0m2.214s

    [1]

    BUG: KASAN: use-after-free in ip_expire+0x73e/0x800 net/ipv4/ip_fragment.c:152
    Read of size 8 at addr ffff88808b9fe330 by task syz-executor.4/11860

    CPU: 1 PID: 11860 Comm: syz-executor.4 Not tainted 5.2.0-rc2+ #22
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:

    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0x172/0x1f0 lib/dump_stack.c:113
    print_address_description.cold+0x7c/0x20d mm/kasan/report.c:188
    __kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
    kasan_report+0x12/0x20 mm/kasan/common.c:614
    __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132
    ip_expire+0x73e/0x800 net/ipv4/ip_fragment.c:152
    call_timer_fn+0x193/0x720 kernel/time/timer.c:1322
    expire_timers kernel/time/timer.c:1366 [inline]
    __run_timers kernel/time/timer.c:1685 [inline]
    __run_timers kernel/time/timer.c:1653 [inline]
    run_timer_softirq+0x66f/0x1740 kernel/time/timer.c:1698
    __do_softirq+0x25c/0x94c kernel/softirq.c:293
    invoke_softirq kernel/softirq.c:374 [inline]
    irq_exit+0x180/0x1d0 kernel/softirq.c:414
    exiting_irq arch/x86/include/asm/apic.h:536 [inline]
    smp_apic_timer_interrupt+0x13b/0x550 arch/x86/kernel/apic/apic.c:1068
    apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:806

    RIP: 0010:tomoyo_domain_quota_is_ok+0x131/0x540 security/tomoyo/util.c:1035
    Code: 24 4c 3b 65 d0 0f 84 9c 00 00 00 e8 19 1d 73 fe 49 8d 7c 24 18 48 ba 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 0f b6 04 10 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 69 03 00 00 41 0f b6 5c
    RSP: 0018:ffff88806ae079c0 EFLAGS: 00000a02 ORIG_RAX: ffffffffffffff13
    RAX: 0000000000000000 RBX: 0000000000000010 RCX: ffffc9000e655000
    RDX: dffffc0000000000 RSI: ffffffff82fd88a7 RDI: ffff888086202398
    RBP: ffff88806ae07a00 R08: ffff88808b6c8700 R09: ffffed100d5c0f4d
    R10: ffffed100d5c0f4c R11: 0000000000000000 R12: ffff888086202380
    R13: 0000000000000030 R14: 00000000000000d3 R15: 0000000000000000
    tomoyo_supervisor+0x2e8/0xef0 security/tomoyo/common.c:2087
    tomoyo_audit_path_number_log security/tomoyo/file.c:235 [inline]
    tomoyo_path_number_perm+0x42f/0x520 security/tomoyo/file.c:734
    tomoyo_file_ioctl+0x23/0x30 security/tomoyo/tomoyo.c:335
    security_file_ioctl+0x77/0xc0 security/security.c:1370
    ksys_ioctl+0x57/0xd0 fs/ioctl.c:711
    __do_sys_ioctl fs/ioctl.c:720 [inline]
    __se_sys_ioctl fs/ioctl.c:718 [inline]
    __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
    do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
    entry_SYSCALL_64_after_hwframe+0x49/0xbe
    RIP: 0033:0x4592c9
    Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
    RSP: 002b:00007f8db5e44c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
    RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004592c9
    RDX: 0000000020000080 RSI: 00000000000089f1 RDI: 0000000000000006
    RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8db5e456d4
    R13: 00000000004cc770 R14: 00000000004d5cd8 R15: 00000000ffffffff

    Allocated by task 9047:
    save_stack+0x23/0x90 mm/kasan/common.c:71
    set_track mm/kasan/common.c:79 [inline]
    __kasan_kmalloc mm/kasan/common.c:489 [inline]
    __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:462
    kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:497
    slab_post_alloc_hook mm/slab.h:437 [inline]
    slab_alloc mm/slab.c:3326 [inline]
    kmem_cache_alloc+0x11a/0x6f0 mm/slab.c:3488
    kmem_cache_zalloc include/linux/slab.h:732 [inline]
    net_alloc net/core/net_namespace.c:386 [inline]
    copy_net_ns+0xed/0x340 net/core/net_namespace.c:426
    create_new_namespaces+0x400/0x7b0 kernel/nsproxy.c:107
    unshare_nsproxy_namespaces+0xc2/0x200 kernel/nsproxy.c:206
    ksys_unshare+0x440/0x980 kernel/fork.c:2692
    __do_sys_unshare kernel/fork.c:2760 [inline]
    __se_sys_unshare kernel/fork.c:2758 [inline]
    __x64_sys_unshare+0x31/0x40 kernel/fork.c:2758
    do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
    entry_SYSCALL_64_after_hwframe+0x49/0xbe

    Freed by task 2541:
    save_stack+0x23/0x90 mm/kasan/common.c:71
    set_track mm/kasan/common.c:79 [inline]
    __kasan_slab_free+0x102/0x150 mm/kasan/common.c:451
    kasan_slab_free+0xe/0x10 mm/kasan/common.c:459
    __cache_free mm/slab.c:3432 [inline]
    kmem_cache_free+0x86/0x260 mm/slab.c:3698
    net_free net/core/net_namespace.c:402 [inline]
    net_drop_ns.part.0+0x70/0x90 net/core/net_namespace.c:409
    net_drop_ns net/core/net_namespace.c:408 [inline]
    cleanup_net+0x538/0x960 net/core/net_namespace.c:571
    process_one_work+0x989/0x1790 kernel/workqueue.c:2269
    worker_thread+0x98/0xe40 kernel/workqueue.c:2415
    kthread+0x354/0x420 kernel/kthread.c:255
    ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

    The buggy address belongs to the object at ffff88808b9fe100
    which belongs to the cache net_namespace of size 6784
    The buggy address is located 560 bytes inside of
    6784-byte region [ffff88808b9fe100, ffff88808b9ffb80)
    The buggy address belongs to the page:
    page:ffffea00022e7f80 refcount:1 mapcount:0 mapping:ffff88821b6f60c0 index:0x0 compound_mapcount: 0
    flags: 0x1fffc0000010200(slab|head)
    raw: 01fffc0000010200 ffffea000256f288 ffffea0001bbef08 ffff88821b6f60c0
    raw: 0000000000000000 ffff88808b9fe100 0000000100000001 0000000000000000
    page dumped because: kasan: bad access detected

    Memory state around the buggy address:
    ffff88808b9fe200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    ffff88808b9fe280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    >ffff88808b9fe300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    ^
    ffff88808b9fe380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    ffff88808b9fe400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

    Fixes: 3c8fc8782044 ("inet: frags: rework rhashtable dismantle")
    Signed-off-by: Eric Dumazet
    Reported-by: syzbot
    Signed-off-by: David S. Miller

    Eric Dumazet
     

08 Jun, 2019

1 commit

31 May, 2019

2 commits

  • 1802d0bee   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 ... Browse Code »

    Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation this program is
    distributed in the hope that it will be useful but without any
    warranty without even the implied warranty of merchantability or
    fitness for a particular purpose see the gnu general public license
    for more details

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-only

    has been chosen to replace the boilerplate/reference in 655 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Allison Randal
    Reviewed-by: Kate Stewart
    Reviewed-by: Richard Fontana
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190527070034.575739538@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     
  • 2874c5fd2   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 ... Browse Code »

    Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation either version 2 of the license or at
    your option any later version

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-or-later

    has been chosen to replace the boilerplate/reference in 3029 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190527070032.746973796@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

29 May, 2019

1 commit

  • ae7352d38   inet: frags: call inet_frags_fini() after unregister_pernet_subsys() ... Browse Code »

    Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.

    inet_frags_fini() is dismantling a kmem_cache, that might be needed
    later when unregister_pernet_subsys() eventually has to remove
    frags queues from hash tables and free them.

    This fixes potential use-after-free, and is a prereq for the following patch.

    Fixes: d4ad4d22e7ac ("inet: frags: use kmem_cache for inet_frag_queue")
    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

27 May, 2019

7 commits

21 May, 2019

1 commit

28 Apr, 2019

3 commits

  • ef6243acb   genetlink: optionally validate strictly/dumps ... Browse Code »

    Add options to strictly validate messages and dump messages,
    sometimes perhaps validating dump messages non-strictly may
    be required, so add an option for that as well.

    Since none of this can really be applied to existing commands,
    set the options everwhere using the following spatch:

    @@
    identifier ops;
    expression X;
    @@
    struct genl_ops ops[] = {
    ...,
    {
    .cmd = X,
    + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    ...
    },
    ...
    };

    For new commands one should just not copy the .validate 'opt-out'
    flags and thus get strict validation.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • 8cb081746   netlink: make validation more configurable for future strictness ... Browse Code »

    We currently have two levels of strict validation:

    1) liberal (default)
    - undefined (type >= max) & NLA_UNSPEC attributes accepted
    - attribute length >= expected accepted
    - garbage at end of message accepted
    2) strict (opt-in)
    - NLA_UNSPEC attributes accepted
    - attribute length >= expected accepted

    Split out parsing strictness into four different options:
    * TRAILING - check that there's no trailing data after parsing
    attributes (in message or nested)
    * MAXTYPE - reject attrs > max known type
    * UNSPEC - reject attributes with NLA_UNSPEC policy entries
    * STRICT_ATTRS - strictly validate attribute size

    The default for future things should be *everything*.
    The current *_strict() is a combination of TRAILING and MAXTYPE,
    and is renamed to _deprecated_strict().
    The current regular parsing has none of this, and is renamed to
    *_parse_deprecated().

    Additionally it allows us to selectively set one of the new flags
    even on old policies. Notably, the UNSPEC flag could be useful in
    this case, since it can be arranged (by filling in the policy) to
    not be an incompatible userspace ABI change, but would then going
    forward prevent forgetting attribute entries. Similar can apply
    to the POLICY flag.

    We end up with the following renames:
    * nla_parse -> nla_parse_deprecated
    * nla_parse_strict -> nla_parse_deprecated_strict
    * nlmsg_parse -> nlmsg_parse_deprecated
    * nlmsg_parse_strict -> nlmsg_parse_deprecated_strict
    * nla_parse_nested -> nla_parse_nested_deprecated
    * nla_validate_nested -> nla_validate_nested_deprecated

    Using spatch, of course:
    @@
    expression TB, MAX, HEAD, LEN, POL, EXT;
    @@
    -nla_parse(TB, MAX, HEAD, LEN, POL, EXT)
    +nla_parse_deprecated(TB, MAX, HEAD, LEN, POL, EXT)

    @@
    expression NLH, HDRLEN, TB, MAX, POL, EXT;
    @@
    -nlmsg_parse(NLH, HDRLEN, TB, MAX, POL, EXT)
    +nlmsg_parse_deprecated(NLH, HDRLEN, TB, MAX, POL, EXT)

    @@
    expression NLH, HDRLEN, TB, MAX, POL, EXT;
    @@
    -nlmsg_parse_strict(NLH, HDRLEN, TB, MAX, POL, EXT)
    +nlmsg_parse_deprecated_strict(NLH, HDRLEN, TB, MAX, POL, EXT)

    @@
    expression TB, MAX, NLA, POL, EXT;
    @@
    -nla_parse_nested(TB, MAX, NLA, POL, EXT)
    +nla_parse_nested_deprecated(TB, MAX, NLA, POL, EXT)

    @@
    expression START, MAX, POL, EXT;
    @@
    -nla_validate_nested(START, MAX, POL, EXT)
    +nla_validate_nested_deprecated(START, MAX, POL, EXT)

    @@
    expression NLH, HDRLEN, MAX, POL, EXT;
    @@
    -nlmsg_validate(NLH, HDRLEN, MAX, POL, EXT)
    +nlmsg_validate_deprecated(NLH, HDRLEN, MAX, POL, EXT)

    For this patch, don't actually add the strict, non-renamed versions
    yet so that it breaks compile if I get it wrong.

    Also, while at it, make nla_validate and nla_parse go down to a
    common __nla_validate_parse() function to avoid code duplication.

    Ultimately, this allows us to have very strict validation for every
    new caller of nla_parse()/nlmsg_parse() etc as re-introduced in the
    next patch, while existing things will continue to work as is.

    In effect then, this adds fully strict validation for any new command.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • ae0be8de9   netlink: make nla_nest_start() add NLA_F_NESTED flag ... Browse Code »

    Even if the NLA_F_NESTED flag was introduced more than 11 years ago, most
    netlink based interfaces (including recently added ones) are still not
    setting it in kernel generated messages. Without the flag, message parsers
    not aware of attribute semantics (e.g. wireshark dissector or libmnl's
    mnl_nlmsg_fprintf()) cannot recognize nested attributes and won't display
    the structure of their contents.

    Unfortunately we cannot just add the flag everywhere as there may be
    userspace applications which check nlattr::nla_type directly rather than
    through a helper masking out the flags. Therefore the patch renames
    nla_nest_start() to nla_nest_start_noflag() and introduces nla_nest_start()
    as a wrapper adding NLA_F_NESTED. The calls which add NLA_F_NESTED manually
    are rewritten to use nla_nest_start().

    Except for changes in include/net/netlink.h, the patch was generated using
    this semantic patch:

    @@ expression E1, E2; @@
    -nla_nest_start(E1, E2)
    +nla_nest_start_noflag(E1, E2)

    @@ expression E1, E2; @@
    -nla_nest_start_noflag(E1, E2 | NLA_F_NESTED)
    +nla_nest_start(E1, E2)

    Signed-off-by: Michal Kubecek
    Acked-by: Jiri Pirko
    Acked-by: David Ahern
    Signed-off-by: David S. Miller

    Michal Kubecek
     

20 Apr, 2019

1 commit

  • c7cbdbf29   net: rework SIOCGSTAMP ioctl handling ... Browse Code »

    The SIOCGSTAMP/SIOCGSTAMPNS ioctl commands are implemented by many
    socket protocol handlers, and all of those end up calling the same
    sock_get_timestamp()/sock_get_timestampns() helper functions, which
    results in a lot of duplicate code.

    With the introduction of 64-bit time_t on 32-bit architectures, this
    gets worse, as we then need four different ioctl commands in each
    socket protocol implementation.

    To simplify that, let's add a new .gettstamp() operation in
    struct proto_ops, and move ioctl implementation into the common
    sock_ioctl()/compat_sock_ioctl_trans() functions that these all go
    through.

    We can reuse the sock_get_timestamp() implementation, but generalize
    it so it can deal with both native and compat mode, as well as
    timeval and timespec structures.

    Acked-by: Stefan Schmidt
    Acked-by: Neil Horman
    Acked-by: Marc Kleine-Budde
    Link: https://lore.kernel.org/lkml/CAK8P3a038aDQQotzua_QtKGhq8O9n+rdiz2=WDCp82ys8eUT+A@mail.gmail.com/
    Signed-off-by: Arnd Bergmann
    Acked-by: Willem de Bruijn
    Signed-off-by: David S. Miller

    Arnd Bergmann
     

22 Mar, 2019

1 commit

  • 3b0f31f2b   genetlink: make policy common to family ... Browse Code »

    Since maxattr is common, the policy can't really differ sanely,
    so make it common as well.

    The only user that did in fact manage to make a non-common policy
    is taskstats, which has to be really careful about it (since it's
    still using a common maxattr!). This is no longer supported, but
    we can fake it using pre_doit.

    This reduces the size of e.g. nl80211.o (which has lots of commands):

    text data bss dec hex filename
    398745 14323 2240 415308 6564c net/wireless/nl80211.o (before)
    397913 14331 2240 414484 65314 net/wireless/nl80211.o (after)
    --------------------------------
    -832 +8 0 -824

    Which is obviously just 8 bytes for each command, and an added 8
    bytes for the new policy pointer. I'm not sure why the ops list is
    counted as .text though.

    Most of the code transformations were done using the following spatch:
    @ops@
    identifier OPS;
    expression POLICY;
    @@
    struct genl_ops OPS[] = {
    ...,
    {
    - .policy = POLICY,
    },
    ...
    };

    @@
    identifier ops.OPS;
    expression ops.POLICY;
    identifier fam;
    expression M;
    @@
    struct genl_family fam = {
    .ops = OPS,
    .maxattr = M,
    + .policy = POLICY,
    ...
    };

    This also gets rid of devlink_nl_cmd_region_read_dumpit() accessing
    the cb->data as ops, which we want to change in a later genl patch.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     

27 Feb, 2019

1 commit

19 Feb, 2019

1 commit

  • 254c5dbe1   6lowpan: use rbtree for IP frag queue ... Browse Code »

    This patch aligns IP defragmenation logic in 6lowpan with that
    of IPv4 and IPv6: see
    commit d4289fcc9b16 ("net: IP6 defrag: use rbtrees for IPv6 defrag")

    Modifying ip_defrag selftest seemed like an overkill, as I suspect
    most kernel test setups do not have 6lowpan hwsim enabled. So I ran
    the following code/script manually:

    insmod ./mac802154_hwsim.ko

    iwpan dev wpan0 set pan_id 0xbeef
    ip link add link wpan0 name lowpan0 type lowpan
    ip link set wpan0 up
    ip link set lowpan0 up

    iwpan dev wpan1 set pan_id 0xbeef
    ip netns add foo
    iwpan phy1 set netns name foo
    ip netns exec foo ip link add link wpan1 name lowpan1 type lowpan
    ip netns exec foo ip link set wpan1 up
    ip netns exec foo ip link set lowpan1 up

    ip -6 addr add "fb01::1/128" nodad dev lowpan0
    ip -netns foo -6 addr add "fb02::1/128" nodad dev lowpan1

    ip -6 route add "fb02::1/128" dev lowpan0
    ip -netns foo -6 route add "fb01::1/128" dev lowpan1

    # then in term1:
    ip netns exec foo bash
    ./udp_stream -6

    # in term2:
    ./udp_stream -c -6 -H fb02::1

    # pr_warn_once showed that the code changed by this patch
    # was invoked.

    Signed-off-by: Peter Oskolkov
    Acked-by: Alexander Aring
    Signed-off-by: Stefan Schmidt

    Peter Oskolkov
     

25 Dec, 2018

2 commits