25 Jul, 2020

1 commit

  • Rework the remaining setsockopt code to pass a sockptr_t instead of a
    plain user pointer. This removes the last remaining set_fs(KERNEL_DS)
    outside of architecture specific code.

    Signed-off-by: Christoph Hellwig
    Acked-by: Stefan Schmidt [ieee802154]
    Acked-by: Matthieu Baerts
    Signed-off-by: David S. Miller

    Christoph Hellwig
     

14 Jun, 2020

1 commit

  • Since commit 84af7a6194e4 ("checkpatch: kconfig: prefer 'help' over
    '---help---'"), the number of '---help---' has been gradually
    decreasing, but there are still more than 2400 instances.

    This commit finishes the conversion. While I touched the lines,
    I also fixed the indentation.

    There are a variety of indentation styles found.

    a) 4 spaces + '---help---'
    b) 7 spaces + '---help---'
    c) 8 spaces + '---help---'
    d) 1 space + 1 tab + '---help---'
    e) 1 tab + '---help---' (correct indentation)
    f) 1 tab + 1 space + '---help---'
    g) 1 tab + 2 spaces + '---help---'

    In order to convert all of them to 1 tab + 'help', I ran the
    following commend:

    $ find . -name 'Kconfig*' | xargs sed -i 's/^[[:space:]]*---help---/\thelp/'

    Signed-off-by: Masahiro Yamada

    Masahiro Yamada
     

17 Mar, 2020

1 commit

  • This path fixes the suspicious RCU usage warning reported by
    kernel test robot.

    net/kcm/kcmproc.c:#RCU-list_traversed_in_non-reader_section

    There is no need to use list_for_each_entry_rcu() in
    kcm_stats_seq_show() as the list is always traversed under
    knet->mutex held.

    Reported-by: kernel test robot
    Signed-off-by: Madhuparna Bhowmik
    Signed-off-by: David S. Miller

    Madhuparna Bhowmik
     

25 Feb, 2020

1 commit

  • All of these cases are strictly of the form:

    preempt_disable();
    BPF_PROG_RUN(...);
    preempt_enable();

    Replace this with bpf_prog_run_pin_on_cpu() which wraps BPF_PROG_RUN()
    with:

    migrate_disable();
    BPF_PROG_RUN(...);
    migrate_enable();

    On non RT enabled kernels this maps to preempt_disable/enable() and on RT
    enabled kernels this solely prevents migration, which is sufficient as
    there is no requirement to prevent reentrancy to any BPF program from a
    preempting task. The only requirement is that the program stays on the same
    CPU.

    Therefore, this is a trivially correct transformation.

    The seccomp loop does not need protection over the loop. It only needs
    protection per BPF filter program

    [ tglx: Converted to bpf_prog_run_pin_on_cpu() ]

    Signed-off-by: David S. Miller
    Signed-off-by: Thomas Gleixner
    Signed-off-by: Alexei Starovoitov
    Link: https://lore.kernel.org/bpf/20200224145643.691493094@linutronix.de

    David Miller
     

27 Sep, 2019

1 commit

  • After commit a2c11b034142 ("kcm: use BPF_PROG_RUN")
    syzbot easily triggers the warning in cant_sleep().

    As explained in commit 6cab5e90ab2b ("bpf: run bpf programs
    with preemption disabled") we need to disable preemption before
    running bpf programs.

    BUG: assuming atomic context at net/kcm/kcmsock.c:382
    in_atomic(): 0, irqs_disabled(): 0, pid: 7, name: kworker/u4:0
    3 locks held by kworker/u4:0/7:
    #0: ffff888216726128 ((wq_completion)kstrp){+.+.}, at: __write_once_size include/linux/compiler.h:226 [inline]
    #0: ffff888216726128 ((wq_completion)kstrp){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
    #0: ffff888216726128 ((wq_completion)kstrp){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline]
    #0: ffff888216726128 ((wq_completion)kstrp){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:40 [inline]
    #0: ffff888216726128 ((wq_completion)kstrp){+.+.}, at: set_work_data kernel/workqueue.c:620 [inline]
    #0: ffff888216726128 ((wq_completion)kstrp){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:647 [inline]
    #0: ffff888216726128 ((wq_completion)kstrp){+.+.}, at: process_one_work+0x88b/0x1740 kernel/workqueue.c:2240
    #1: ffff8880a989fdc0 ((work_completion)(&strp->work)){+.+.}, at: process_one_work+0x8c1/0x1740 kernel/workqueue.c:2244
    #2: ffff888098998d10 (sk_lock-AF_INET){+.+.}, at: lock_sock include/net/sock.h:1522 [inline]
    #2: ffff888098998d10 (sk_lock-AF_INET){+.+.}, at: strp_sock_lock+0x2e/0x40 net/strparser/strparser.c:440
    CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.3.0+ #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Workqueue: kstrp strp_work
    Call Trace:
    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0x172/0x1f0 lib/dump_stack.c:113
    __cant_sleep kernel/sched/core.c:6826 [inline]
    __cant_sleep.cold+0xa4/0xbc kernel/sched/core.c:6803
    kcm_parse_func_strparser+0x54/0x200 net/kcm/kcmsock.c:382
    __strp_recv+0x5dc/0x1b20 net/strparser/strparser.c:221
    strp_recv+0xcf/0x10b net/strparser/strparser.c:343
    tcp_read_sock+0x285/0xa00 net/ipv4/tcp.c:1639
    strp_read_sock+0x14d/0x200 net/strparser/strparser.c:366
    do_strp_work net/strparser/strparser.c:414 [inline]
    strp_work+0xe3/0x130 net/strparser/strparser.c:423
    process_one_work+0x9af/0x1740 kernel/workqueue.c:2269

    Fixes: a2c11b034142 ("kcm: use BPF_PROG_RUN")
    Fixes: 6cab5e90ab2b ("bpf: run bpf programs with preemption disabled")
    Signed-off-by: Eric Dumazet
    Reported-by: syzbot
    Signed-off-by: David S. Miller

    Eric Dumazet
     

07 Sep, 2019

1 commit


31 Jul, 2019

1 commit


23 Jul, 2019

1 commit


19 Jun, 2019

1 commit

  • Based on 2 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation #

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-only

    has been chosen to replace the boilerplate/reference in 4122 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Enrico Weigelt
    Reviewed-by: Kate Stewart
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

21 May, 2019

1 commit


02 Apr, 2019

1 commit

  • When kcm is loaded while many processes try to create a KCM socket, a
    crash occurs:
    BUG: unable to handle kernel NULL pointer dereference at 000000000000000e
    IP: mutex_lock+0x27/0x40 kernel/locking/mutex.c:240
    PGD 8000000016ef2067 P4D 8000000016ef2067 PUD 3d6e9067 PMD 0
    Oops: 0002 [#1] SMP KASAN PTI
    CPU: 0 PID: 7005 Comm: syz-executor.5 Not tainted 4.12.14-396-default #1 SLE15-SP1 (unreleased)
    RIP: 0010:mutex_lock+0x27/0x40 kernel/locking/mutex.c:240
    RSP: 0018:ffff88000d487a00 EFLAGS: 00010246
    RAX: 0000000000000000 RBX: 000000000000000e RCX: 1ffff100082b0719
    ...
    CR2: 000000000000000e CR3: 000000004b1bc003 CR4: 0000000000060ef0
    Call Trace:
    kcm_create+0x600/0xbf0 [kcm]
    __sock_create+0x324/0x750 net/socket.c:1272
    ...

    This is due to race between sock_create and unfinished
    register_pernet_device. kcm_create tries to do "net_generic(net,
    kcm_net_id)". but kcm_net_id is not initialized yet.

    So switch the order of the two to close the race.

    This can be reproduced with mutiple processes doing socket(PF_KCM, ...)
    and one process doing module removal.

    Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
    Reviewed-by: Michal Kubecek
    Signed-off-by: Jiri Slaby
    Signed-off-by: David S. Miller

    Jiri Slaby
     

24 Feb, 2019

1 commit


25 Jul, 2018

1 commit


29 Jun, 2018

1 commit

  • The poll() changes were not well thought out, and completely
    unexplained. They also caused a huge performance regression, because
    "->poll()" was no longer a trivial file operation that just called down
    to the underlying file operations, but instead did at least two indirect
    calls.

    Indirect calls are sadly slow now with the Spectre mitigation, but the
    performance problem could at least be largely mitigated by changing the
    "->get_poll_head()" operation to just have a per-file-descriptor pointer
    to the poll head instead. That gets rid of one of the new indirections.

    But that doesn't fix the new complexity that is completely unwarranted
    for the regular case. The (undocumented) reason for the poll() changes
    was some alleged AIO poll race fixing, but we don't make the common case
    slower and more complex for some uncommon special case, so this all
    really needs way more explanations and most likely a fundamental
    redesign.

    [ This revert is a revert of about 30 different commits, not reverted
    individually because that would just be unnecessarily messy - Linus ]

    Cc: Al Viro
    Cc: Christoph Hellwig
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

05 Jun, 2018

2 commits

  • Pull aio updates from Al Viro:
    "Majority of AIO stuff this cycle. aio-fsync and aio-poll, mostly.

    The only thing I'm holding back for a day or so is Adam's aio ioprio -
    his last-minute fixup is trivial (missing stub in !CONFIG_BLOCK case),
    but let it sit in -next for decency sake..."

    * 'work.aio-1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (46 commits)
    aio: sanitize the limit checking in io_submit(2)
    aio: fold do_io_submit() into callers
    aio: shift copyin of iocb into io_submit_one()
    aio_read_events_ring(): make a bit more readable
    aio: all callers of aio_{read,write,fsync,poll} treat 0 and -EIOCBQUEUED the same way
    aio: take list removal to (some) callers of aio_complete()
    aio: add missing break for the IOCB_CMD_FDSYNC case
    random: convert to ->poll_mask
    timerfd: convert to ->poll_mask
    eventfd: switch to ->poll_mask
    pipe: convert to ->poll_mask
    crypto: af_alg: convert to ->poll_mask
    net/rxrpc: convert to ->poll_mask
    net/iucv: convert to ->poll_mask
    net/phonet: convert to ->poll_mask
    net/nfc: convert to ->poll_mask
    net/caif: convert to ->poll_mask
    net/bluetooth: convert to ->poll_mask
    net/sctp: convert to ->poll_mask
    net/tipc: convert to ->poll_mask
    ...

    Linus Torvalds
     
  • Pull procfs updates from Al Viro:
    "Christoph's proc_create_... cleanups series"

    * 'hch.procfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (44 commits)
    xfs, proc: hide unused xfs procfs helpers
    isdn/gigaset: add back gigaset_procinfo assignment
    proc: update SIZEOF_PDE_INLINE_NAME for the new pde fields
    tty: replace ->proc_fops with ->proc_show
    ide: replace ->proc_fops with ->proc_show
    ide: remove ide_driver_proc_write
    isdn: replace ->proc_fops with ->proc_show
    atm: switch to proc_create_seq_private
    atm: simplify procfs code
    bluetooth: switch to proc_create_seq_data
    netfilter/x_tables: switch to proc_create_seq_private
    netfilter/xt_hashlimit: switch to proc_create_{seq,single}_data
    neigh: switch to proc_create_seq_data
    hostap: switch to proc_create_{seq,single}_data
    bonding: switch to proc_create_seq_data
    rtc/proc: switch to proc_create_single_data
    drbd: switch to proc_create_single
    resource: switch to proc_create_seq_data
    staging/rtl8192u: simplify procfs code
    jfs: simplify procfs code
    ...

    Linus Torvalds
     

01 Jun, 2018

1 commit

  • (resend for properly queueing in patchwork)

    kcm_clone() creates kernel socket, which does not take net counter.
    Thus, the net may die before the socket is completely destructed,
    i.e. kcm_exit_net() is executed before kcm_done().

    Reported-by: syzbot+5f1a04e374a635efc426@syzkaller.appspotmail.com
    Signed-off-by: Kirill Tkhai
    Signed-off-by: David S. Miller

    Kirill Tkhai
     

26 May, 2018

1 commit


16 May, 2018

3 commits


28 Mar, 2018

1 commit


27 Mar, 2018

1 commit

  • Prefer the direct use of octal for permissions.

    Done with checkpatch -f --types=SYMBOLIC_PERMS --fix-inplace
    and some typing.

    Miscellanea:

    o Whitespace neatening around these conversions.

    Signed-off-by: Joe Perches
    Signed-off-by: David S. Miller

    Joe Perches
     

23 Mar, 2018

1 commit

  • Fun set of conflict resolutions here...

    For the mac80211 stuff, these were fortunately just parallel
    adds. Trivially resolved.

    In drivers/net/phy/phy.c we had a bug fix in 'net' that moved the
    function phy_disable_interrupts() earlier in the file, whilst in
    'net-next' the phy_error() call from this function was removed.

    In net/ipv4/xfrm4_policy.c, David Ahern's changes to remove the
    'rt_table_id' member of rtable collided with a bug fix in 'net' that
    added a new struct member "rt_mtu_locked" which needs to be copied
    over here.

    The mlxsw driver conflict consisted of net-next separating
    the span code and definitions into separate files, whilst
    a 'net' bug fix made some changes to that moved code.

    The mlx5 infiniband conflict resolution was quite non-trivial,
    the RDMA tree's merge commit was used as a guide here, and
    here are their notes:

    ====================

    Due to bug fixes found by the syzkaller bot and taken into the for-rc
    branch after development for the 4.17 merge window had already started
    being taken into the for-next branch, there were fairly non-trivial
    merge issues that would need to be resolved between the for-rc branch
    and the for-next branch. This merge resolves those conflicts and
    provides a unified base upon which ongoing development for 4.17 can
    be based.

    Conflicts:
    drivers/infiniband/hw/mlx5/main.c - Commit 42cea83f9524
    (IB/mlx5: Fix cleanup order on unload) added to for-rc and
    commit b5ca15ad7e61 (IB/mlx5: Add proper representors support)
    add as part of the devel cycle both needed to modify the
    init/de-init functions used by mlx5. To support the new
    representors, the new functions added by the cleanup patch
    needed to be made non-static, and the init/de-init list
    added by the representors patch needed to be modified to
    match the init/de-init list changes made by the cleanup
    patch.
    Updates:
    drivers/infiniband/hw/mlx5/mlx5_ib.h - Update function
    prototypes added by representors patch to reflect new function
    names as changed by cleanup patch
    drivers/infiniband/hw/mlx5/ib_rep.c - Update init/de-init
    stage list to match new order from cleanup patch
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

16 Mar, 2018

1 commit

  • Need to lock lower socket in order to provide mutual exclusion
    with kcm_unattach.

    v2: Add Reported-by for syzbot

    Fixes: ab7ac4eb9832e32a09f4e804 ("kcm: Kernel Connection Multiplexor module")
    Reported-by: syzbot+ea75c0ffcd353d32515f064aaebefc5279e6161e@syzkaller.appspotmail.com
    Signed-off-by: Tom Herbert
    Signed-off-by: David S. Miller

    Tom Herbert
     

28 Feb, 2018

2 commits

  • These pernet_operations make pretty simple actions
    like variable initialization on init, debug checks
    on exit, and so on, and they obviously are able
    to be executed in parallel with any others:

    vrf_net_ops
    lockd_net_ops
    grace_net_ops
    xfrm6_tunnel_net_ops
    kcm_net_ops
    tcf_net_ops

    Signed-off-by: Kirill Tkhai
    Signed-off-by: David S. Miller

    Kirill Tkhai
     
  • These pernet_operations just create and destroy /proc entries,
    and they can safely marked as async:

    pppoe_net_ops
    vlan_net_ops
    canbcm_pernet_ops
    kcm_net_ops
    pfkey_net_ops
    pppol2tp_net_ops
    phonet_net_ops

    Signed-off-by: Kirill Tkhai
    Signed-off-by: David S. Miller

    Kirill Tkhai
     

15 Feb, 2018

1 commit

  • In kcm_attach strp_done is called when sk_user_data is already
    set to fail the attach. strp_done needs the strp to be stopped and
    warns if it isn't. Call strp_stop in this case to eliminate the
    warning message.

    Reported-by: syzbot+88dfb55e4c8b770d86e3@syzkaller.appspotmail.com
    Fixes: e5571240236c5652f ("kcm: Check if sk_user_data already set in kcm_attach"
    Signed-off-by: Tom Herbert
    Signed-off-by: David S. Miller

    Tom Herbert
     

12 Feb, 2018

1 commit

  • This is the mindless scripted replacement of kernel use of POLL*
    variables as described by Al, done by this script:

    for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do
    L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'`
    for f in $L; do sed -i "-es/^\([^\"]*\)\(\\)/\\1E\\2/" $f; done
    done

    with de-mangling cleanups yet to come.

    NOTE! On almost all architectures, the EPOLL* constants have the same
    values as the POLL* constants do. But they keyword here is "almost".
    For various bad reasons they aren't the same, and epoll() doesn't
    actually work quite correctly in some cases due to this on Sparc et al.

    The next patch from Al will sort out the final differences, and we
    should be all done.

    Scripted-by: Al Viro
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

25 Jan, 2018

3 commits

  • Signed-off-by: David S. Miller

    David S. Miller
     
  • This is needed to prevent sk_user_data being overwritten.
    The check is done under the callback lock. This should prevent
    a socket from being attached twice to a KCM mux. It also prevents
    a socket from being attached for other use cases of sk_user_data
    as long as the other cases set sk_user_data under the lock.
    Followup work is needed to unify all the use cases of sk_user_data
    to use the same locking.

    Reported-by: syzbot+114b15f2be420a8886c3@syzkaller.appspotmail.com
    Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
    Signed-off-by: Tom Herbert
    Reviewed-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Tom Herbert
     
  • TCP sockets for IPv4 and IPv6 that are not listeners or in closed
    stated are allowed to be attached to a KCM mux.

    Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
    Reported-by: syzbot+8865eaff7f9acd593945@syzkaller.appspotmail.com
    Signed-off-by: Tom Herbert
    Reviewed-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Tom Herbert
     

17 Jan, 2018

1 commit

  • /proc has been ignoring struct file_operations::owner field for 10 years.
    Specifically, it started with commit 786d7e1612f0b0adb6046f19b906609e4fe8b1ba
    ("Fix rmmod/read/write races in /proc entries"). Notice the chunk where
    inode->i_fop is initialized with proxy struct file_operations for
    regular files:

    - if (de->proc_fops)
    - inode->i_fop = de->proc_fops;
    + if (de->proc_fops) {
    + if (S_ISREG(inode->i_mode))
    + inode->i_fop = &proc_reg_file_ops;
    + else
    + inode->i_fop = de->proc_fops;
    + }

    VFS stopped pinning module at this point.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     

06 Dec, 2017

2 commits

  • This changes calling conventions (and simplifies the hell out
    the callers). New rules: once struct socket had been passed
    to sock_alloc_file(), it's been consumed either by struct file
    or by sock_release() done by sock_alloc_file(). Either way
    the caller should not do sock_release() after that point.

    Reviewed-by: Eric Dumazet
    Signed-off-by: Al Viro
    Signed-off-by: David S. Miller

    Al Viro
     
  • 1) it's fput() or sock_release(), not both
    2) don't do fd_install() until the last failure exit.
    3) not a bug per se, but... don't attach socket to struct file
    until it's set up.

    Take reserving descriptor into the caller, move fd_install() to the
    caller, sanitize failure exits and calling conventions.

    Cc: stable@vger.kernel.org # v4.6+
    Acked-by: Tom Herbert
    Signed-off-by: Al Viro
    Signed-off-by: David S. Miller

    Al Viro
     

04 Nov, 2017

1 commit


02 Nov, 2017

1 commit

  • Many source files in the tree are missing licensing information, which
    makes it harder for compliance tools to determine the correct license.

    By default all files without license information are under the default
    license of the kernel, which is GPL version 2.

    Update the files which contain no license information with the 'GPL-2.0'
    SPDX license identifier. The SPDX identifier is a legally binding
    shorthand, which can be used instead of the full boiler plate text.

    This patch is based on work done by Thomas Gleixner and Kate Stewart and
    Philippe Ombredanne.

    How this work was done:

    Patches were generated and checked against linux-4.14-rc6 for a subset of
    the use cases:
    - file had no licensing information it it.
    - file was a */uapi/* one with no licensing information in it,
    - file was a */uapi/* one with existing licensing information,

    Further patches will be generated in subsequent months to fix up cases
    where non-standard license headers were used, and references to license
    had to be inferred by heuristics based on keywords.

    The analysis to determine which SPDX License Identifier to be applied to
    a file was done in a spreadsheet of side by side results from of the
    output of two independent scanners (ScanCode & Windriver) producing SPDX
    tag:value files created by Philippe Ombredanne. Philippe prepared the
    base worksheet, and did an initial spot review of a few 1000 files.

    The 4.13 kernel was the starting point of the analysis with 60,537 files
    assessed. Kate Stewart did a file by file comparison of the scanner
    results in the spreadsheet to determine which SPDX license identifier(s)
    to be applied to the file. She confirmed any determination that was not
    immediately clear with lawyers working with the Linux Foundation.

    Criteria used to select files for SPDX license identifier tagging was:
    - Files considered eligible had to be source code files.
    - Make and config files were included as candidates if they contained >5
    lines of source
    - File already had some variant of a license header in it (even if
    Reviewed-by: Philippe Ombredanne
    Reviewed-by: Thomas Gleixner
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     

27 Sep, 2017

1 commit


02 Sep, 2017

1 commit


31 Aug, 2017

1 commit

  • syzkaller had no problem to trigger a deadlock, attaching a KCM socket
    to another one (or itself). (original syzkaller report was a very
    confusing lockdep splat during a sendmsg())

    It seems KCM claims to only support TCP, but no enforcement is done,
    so we might need to add additional checks.

    Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
    Signed-off-by: Eric Dumazet
    Reported-by: Dmitry Vyukov
    Acked-by: Tom Herbert
    Signed-off-by: David S. Miller

    Eric Dumazet