Eric Lee / smarc-fsl-linux-kernel

29 Oct, 2019

1 commit

05 Oct, 2019

1 commit

  • a0c2dc1fe   nfc: fix memory leak in llcp_sock_bind() ... Browse Code »

    sysbot reported a memory leak after a bind() has failed.

    While we are at it, abort the operation if kmemdup() has failed.

    BUG: memory leak
    unreferenced object 0xffff888105d83ec0 (size 32):
    comm "syz-executor067", pid 7207, jiffies 4294956228 (age 19.430s)
    hex dump (first 32 bytes):
    00 69 6c 65 20 72 65 61 64 00 6e 65 74 3a 5b 34 .ile read.net:[4
    30 32 36 35 33 33 30 39 37 5d 00 00 00 00 00 00 026533097]......
    backtrace:
    [] kmemleak_alloc_recursive /./include/linux/kmemleak.h:43 [inline]
    [] slab_post_alloc_hook /mm/slab.h:522 [inline]
    [] slab_alloc /mm/slab.c:3319 [inline]
    [] __do_kmalloc /mm/slab.c:3653 [inline]
    [] __kmalloc_track_caller+0x169/0x2d0 /mm/slab.c:3670
    [] kmemdup+0x27/0x60 /mm/util.c:120
    [] kmemdup /./include/linux/string.h:432 [inline]
    [] llcp_sock_bind+0x1b3/0x230 /net/nfc/llcp_sock.c:107
    [] __sys_bind+0x11c/0x140 /net/socket.c:1647
    [] __do_sys_bind /net/socket.c:1658 [inline]
    [] __se_sys_bind /net/socket.c:1656 [inline]
    [] __x64_sys_bind+0x1e/0x30 /net/socket.c:1656
    [] do_syscall_64+0x76/0x1a0 /arch/x86/entry/common.c:296
    [] entry_SYSCALL_64_after_hwframe+0x44/0xa9

    Fixes: 30cc4587659e ("NFC: Move LLCP code to the NFC top level diirectory")
    Signed-off-by: Eric Dumazet
    Reported-by: syzbot
    Signed-off-by: David S. Miller

    Eric Dumazet
     

24 Sep, 2019

1 commit

21 May, 2019

1 commit

  • 1ccea77e2   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 ... Browse Code »

    Based on 2 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation either version 2 of the license or at
    your option any later version this program is distributed in the
    hope that it will be useful but without any warranty without even
    the implied warranty of merchantability or fitness for a particular
    purpose see the gnu general public license for more details you
    should have received a copy of the gnu general public license along
    with this program if not see http www gnu org licenses

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation either version 2 of the license or at
    your option any later version this program is distributed in the
    hope that it will be useful but without any warranty without even
    the implied warranty of merchantability or fitness for a particular
    purpose see the gnu general public license for more details [based]
    [from] [clk] [highbank] [c] you should have received a copy of the
    gnu general public license along with this program if not see http
    www gnu org licenses

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-or-later

    has been chosen to replace the boilerplate/reference in 355 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Kate Stewart
    Reviewed-by: Jilayne Lovejoy
    Reviewed-by: Steve Winslow
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190519154041.837383322@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

20 Mar, 2019

1 commit

24 Oct, 2018

1 commit

  • 89ab066d4   Revert "net: simplify sock_poll_wait" ... Browse Code »

    This reverts commit dd979b4df817e9976f18fb6f9d134d6bc4a3c317.

    This broke tcp_poll for SMC fallback: An AF_SMC socket establishes an
    internal TCP socket for the initial handshake with the remote peer.
    Whenever the SMC connection can not be established this TCP socket is
    used as a fallback. All socket operations on the SMC socket are then
    forwarded to the TCP socket. In case of poll, the file->private_data
    pointer references the SMC socket because the TCP socket has no file
    assigned. This causes tcp_poll to wait on the wrong socket.

    Signed-off-by: Karsten Graul
    Signed-off-by: David S. Miller

    Karsten Graul
     

31 Jul, 2018

1 commit

29 Jun, 2018

1 commit

  • a11e1d432   Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL ... Browse Code »

    The poll() changes were not well thought out, and completely
    unexplained. They also caused a huge performance regression, because
    "->poll()" was no longer a trivial file operation that just called down
    to the underlying file operations, but instead did at least two indirect
    calls.

    Indirect calls are sadly slow now with the Spectre mitigation, but the
    performance problem could at least be largely mitigated by changing the
    "->get_poll_head()" operation to just have a per-file-descriptor pointer
    to the poll head instead. That gets rid of one of the new indirections.

    But that doesn't fix the new complexity that is completely unwarranted
    for the regular case. The (undocumented) reason for the poll() changes
    was some alleged AIO poll race fixing, but we don't make the common case
    slower and more complex for some uncommon special case, so this all
    really needs way more explanations and most likely a fundamental
    redesign.

    [ This revert is a revert of about 30 different commits, not reverted
    individually because that would just be unnecessarily messy - Linus ]

    Cc: Al Viro
    Cc: Christoph Hellwig
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

26 May, 2018

1 commit

13 Feb, 2018

1 commit

  • 9b2c45d47   net: make getname() functions return length rather than use int* parameter ... Browse Code »

    Changes since v1:
    Added changes in these files:
    drivers/infiniband/hw/usnic/usnic_transport.c
    drivers/staging/lustre/lnet/lnet/lib-socket.c
    drivers/target/iscsi/iscsi_target_login.c
    drivers/vhost/net.c
    fs/dlm/lowcomms.c
    fs/ocfs2/cluster/tcp.c
    security/tomoyo/network.c

    Before:
    All these functions either return a negative error indicator,
    or store length of sockaddr into "int *socklen" parameter
    and return zero on success.

    "int *socklen" parameter is awkward. For example, if caller does not
    care, it still needs to provide on-stack storage for the value
    it does not need.

    None of the many FOO_getname() functions of various protocols
    ever used old value of *socklen. They always just overwrite it.

    This change drops this parameter, and makes all these functions, on success,
    return length of sockaddr. It's always >= 0 and can be differentiated
    from an error.

    Tests in callers are changed from "if (err)" to "if (err < 0)", where needed.

    rpc_sockname() lost "int buflen" parameter, since its only use was
    to be passed to kernel_getsockname() as &buflen and subsequently
    not used in any way.

    Userspace API is not changed.

    text data bss dec hex filename
    30108430 2633624 873672 33615726 200ef6e vmlinux.before.o
    30108109 2633612 873672 33615393 200ee21 vmlinux.o

    Signed-off-by: Denys Vlasenko
    CC: David S. Miller
    CC: linux-kernel@vger.kernel.org
    CC: netdev@vger.kernel.org
    CC: linux-bluetooth@vger.kernel.org
    CC: linux-decnet-user@lists.sourceforge.net
    CC: linux-wireless@vger.kernel.org
    CC: linux-rdma@vger.kernel.org
    CC: linux-sctp@vger.kernel.org
    CC: linux-nfs@vger.kernel.org
    CC: linux-x25@vger.kernel.org
    Signed-off-by: David S. Miller

    Denys Vlasenko
     

12 Feb, 2018

1 commit

  • a9a08845e   vfs: do bulk POLL* -> EPOLL* replacement ... Browse Code »

    This is the mindless scripted replacement of kernel use of POLL*
    variables as described by Al, done by this script:

    for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do
    L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'`
    for f in $L; do sed -i "-es/^\([^\"]*\)\(\\)/\\1E\\2/" $f; done
    done

    with de-mangling cleanups yet to come.

    NOTE! On almost all architectures, the EPOLL* constants have the same
    values as the POLL* constants do. But they keyword here is "almost".
    For various bad reasons they aren't the same, and epoll() doesn't
    actually work quite correctly in some cases due to this on Sparc et al.

    The next patch from Al will sort out the final differences, and we
    should be all done.

    Scripted-by: Al Viro
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

28 Nov, 2017

1 commit

23 Jun, 2017

2 commits

  • f6a5885fc   NFC: Add sockaddr length checks before accessing sa_family in bind handlers ... Browse Code »

    Verify that the caller-provided sockaddr structure is large enough to
    contain the sa_family field, before accessing it in bind() handlers of the
    AF_NFC socket. Since the syscall doesn't enforce a minimum size of the
    corresponding memory region, very short sockaddrs (zero or one byte long)
    result in operating on uninitialized memory while referencing .sa_family.

    Signed-off-by: Mateusz Jurczyk
    Signed-off-by: Samuel Ortiz

    Mateusz Jurczyk
     
  • 608c4adfc   nfc: Fix the sockaddr length sanitization in llcp_sock_connect ... Browse Code »

    Fix the sockaddr length verification in the connect() handler of NFC/LLCP
    sockets, to compare against the size of the actual structure expected on
    input (sockaddr_nfc_llcp) instead of its shorter version (sockaddr_nfc).

    Both structures are defined in include/uapi/linux/nfc.h. The fields
    specific to the _llcp extended struct are as follows:

    276 __u8 dsap; /* Destination SAP, if known */
    277 __u8 ssap; /* Source SAP to be bound to */
    278 char service_name[NFC_LLCP_MAX_SERVICE_NAME]; /* Service name URI */;
    279 size_t service_name_len;

    If the caller doesn't provide a sufficiently long sockaddr buffer, these
    fields remain uninitialized (and they currently originate from the stack
    frame of the top-level sys_connect handler). They are then copied by
    llcp_sock_connect() into internal storage (nfc_llcp_sock structure), and
    could be subsequently read back through the user-mode getsockname()
    function (handled by llcp_sock_getname()). This would result in the
    disclosure of up to ~70 uninitialized bytes from the kernel stack to
    user-mode clients capable of creating AFC_NFC sockets.

    Signed-off-by: Mateusz Jurczyk
    Acked-by: Kees Cook
    Signed-off-by: Samuel Ortiz

    Mateusz Jurczyk
     

10 Mar, 2017

1 commit

  • cdfbabfb2   net: Work around lockdep limitation in sockets that use sockets ... Browse Code »

    Lockdep issues a circular dependency warning when AFS issues an operation
    through AF_RXRPC from a context in which the VFS/VM holds the mmap_sem.

    The theory lockdep comes up with is as follows:

    (1) If the pagefault handler decides it needs to read pages from AFS, it
    calls AFS with mmap_sem held and AFS begins an AF_RXRPC call, but
    creating a call requires the socket lock:

    mmap_sem must be taken before sk_lock-AF_RXRPC

    (2) afs_open_socket() opens an AF_RXRPC socket and binds it. rxrpc_bind()
    binds the underlying UDP socket whilst holding its socket lock.
    inet_bind() takes its own socket lock:

    sk_lock-AF_RXRPC must be taken before sk_lock-AF_INET

    (3) Reading from a TCP socket into a userspace buffer might cause a fault
    and thus cause the kernel to take the mmap_sem, but the TCP socket is
    locked whilst doing this:

    sk_lock-AF_INET must be taken before mmap_sem

    However, lockdep's theory is wrong in this instance because it deals only
    with lock classes and not individual locks. The AF_INET lock in (2) isn't
    really equivalent to the AF_INET lock in (3) as the former deals with a
    socket entirely internal to the kernel that never sees userspace. This is
    a limitation in the design of lockdep.

    Fix the general case by:

    (1) Double up all the locking keys used in sockets so that one set are
    used if the socket is created by userspace and the other set is used
    if the socket is created by the kernel.

    (2) Store the kern parameter passed to sk_alloc() in a variable in the
    sock struct (sk_kern_sock). This informs sock_lock_init(),
    sock_init_data() and sk_clone_lock() as to the lock keys to be used.

    Note that the child created by sk_clone_lock() inherits the parent's
    kern setting.

    (3) Add a 'kern' parameter to ->accept() that is analogous to the one
    passed in to ->create() that distinguishes whether kernel_accept() or
    sys_accept4() was the caller and can be passed to sk_alloc().

    Note that a lot of accept functions merely dequeue an already
    allocated socket. I haven't touched these as the new socket already
    exists before we get the parameter.

    Note also that there are a couple of places where I've made the accepted
    socket unconditionally kernel-based:

    irda_accept()
    rds_rcp_accept_one()
    tcp_accept_from_sock()

    because they follow a sock_create_kern() and accept off of that.

    Whilst creating this, I noticed that lustre and ocfs don't create sockets
    through sock_create_kern() and thus they aren't marked as for-kernel,
    though they appear to be internal. I wonder if these should do that so
    that they use the new set of lock keys.

    Signed-off-by: David Howells
    Signed-off-by: David S. Miller

    David Howells
     

02 Mar, 2017

1 commit

25 Feb, 2016

1 commit

  • 03c053555   NFC: Close a race condition in llcp_sock_getname() ... Browse Code »

    llcp_sock_getname() checks llcp_sock->dev to make sure
    llcp_sock is already connected or bound, however, we could
    be in the middle of llcp_sock_bind() where llcp_sock->dev
    is bound and llcp_sock->service_name_len is set,
    but llcp_sock->service_name is not, in this case we would
    lead to copy some bytes from a NULL pointer.

    Just lock the sock since this is not a hot path anyway.

    Reported-by: Dmitry Vyukov
    Signed-off-by: Cong Wang
    Signed-off-by: Samuel Ortiz

    Cong Wang
     

02 Dec, 2015

1 commit

  • 9cd3e072b   net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA ... Browse Code »

    This patch is a cleanup to make following patch easier to
    review.

    Goal is to move SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA
    from (struct socket)->flags to a (struct socket_wq)->flags
    to benefit from RCU protection in sock_wake_async()

    To ease backports, we rename both constants.

    Two new helpers, sk_set_bit(int nr, struct sock *sk)
    and sk_clear_bit(int net, struct sock *sk) are added so that
    following patch can change their implementation.

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

11 May, 2015

1 commit

03 Mar, 2015

1 commit

  • 1b7841404   net: Remove iocb argument from sendmsg and recvmsg ... Browse Code »

    After TIPC doesn't depend on iocb argument in its internal
    implementations of sendmsg() and recvmsg() hooks defined in proto
    structure, no any user is using iocb argument in them at all now.
    Then we can drop the redundant iocb argument completely from kinds of
    implementations of both sendmsg() and recvmsg() in the entire
    networking stack.

    Cc: Christoph Hellwig
    Suggested-by: Al Viro
    Signed-off-by: Ying Xue
    Signed-off-by: David S. Miller

    Ying Xue
     

10 Dec, 2014

1 commit

  • b5f185f33   Merge tag 'master-2014-12-08' of git://git.kernel.org/pub/scm/linux/kernel/git/l… ... Browse Code »

    …inville/wireless-next

    John W. Linville says:

    ====================
    pull request: wireless-next 2014-12-08

    Please pull this last batch of pending wireless updates for the 3.19 tree...

    For the wireless bits, Johannes says:

    "This time I have Felix's no-status rate control work, which will allow
    drivers to work better with rate control even if they don't have perfect
    status reporting. In addition to this, a small hwsim fix from Patrik,
    one of the regulatory patches from Arik, and a number of cleanups and
    fixes I did myself.

    Of note is a patch where I disable CFG80211_WEXT so that compatibility
    is no longer selectable - this is intended as a wake-up call for anyone
    who's still using it, and is still easily worked around (it's a one-line
    patch) before we fully remove the code as well in the future."

    For the Bluetooth bits, Johan says:

    "Here's one more bluetooth-next pull request for 3.19:

    - Minor cleanups for ieee802154 & mac802154
    - Fix for the kernel warning with !TASK_RUNNING reported by Kirill A.
    Shutemov
    - Support for another ath3k device
    - Fix for tracking link key based security level
    - Device tree bindings for btmrvl + a state update fix
    - Fix for wrong ACL flags on LE links"

    And...

    "In addition to the previous one this contains two more cleanups to
    mac802154 as well as support for some new HCI features from the
    Bluetooth 4.2 specification.

    From the original request:

    'Here's what should be the last bluetooth-next pull request for 3.19.
    It's rather large but the majority of it is the Low Energy Secure
    Connections feature that's part of the Bluetooth 4.2 specification. The
    specification went public only this week so we couldn't publish the
    corresponding code before that. The code itself can nevertheless be
    considered fairly mature as it's been in development for over 6 months
    and gone through several interoperability test events.

    Besides LE SC the pull request contains an important fix for command
    complete events for mgmt sockets which also fixes some leaks of hci_conn
    objects when powering off or unplugging Bluetooth adapters.

    A smaller feature that's part of the pull request is service discovery
    support. This is like normal device discovery except that devices not
    matching specific UUIDs or strong enough RSSI are filtered out.

    Other changes that the pull request contains are firmware dump support
    to the btmrvl driver, firmware download support for Broadcom BCM20702A0
    variants, as well as some coding style cleanups in 6lowpan &
    ieee802154/mac802154 code.'"

    For the NFC bits, Samuel says:

    "With this one we get:

    - NFC digital improvements for DEP support: Chaining, NACK and ATN
    support added.

    - NCI improvements: Support for p2p target, SE IO operand addition,
    SE operands extensions to support proprietary implementations, and
    a few fixes.

    - NFC HCI improvements: OPEN_PIPE and NOTIFY_ALL_CLEARED support,
    and SE IO operand addition.

    - A bunch of minor improvements and fixes for STMicro st21nfcb and
    st21nfca"

    For the iwlwifi bits, Emmanuel says:

    "Major works are CSA and TDLS. On top of that I have a new
    firmware API for scan and a few rate control improvements.
    Johannes find a few tricks to improve our CPU utilization
    and adds support for a new spin of 7265 called 7265D.
    Along with this a few random things that don't stand out."

    And...

    "I deprecate here -8.ucode since -9 has been published long ago.
    Along with that I have a new activity, we have now better
    a infrastructure for firmware debugging. This will allow to
    have configurable probes insides the firmware.
    Luca continues his work on NetDetect, this feature is now
    complete. All the rest is minor fixes here and there."

    For the Atheros bits, Kalle says:

    "Only ath10k changes this time and no major changes. Most visible are:

    o new debugfs interface for runtime firmware debugging (Yanbo)

    o fix shared WEP (Sujith)

    o don't rebuild whenever kernel version changes (Johannes)

    o lots of refactoring to make it easier to add new hw support (Michal)

    There's also smaller fixes and improvements with no point of listing
    here."

    In addition, there are a few last minute updates to ath5k,
    ath9k, brcmfmac, brcmsmac, mwifiex, rt2x00, rtlwifi, and wil6210.
    Also included is a pull of the wireless tree to pick-up the fixes
    originally included in "pull request: wireless 2014-12-03"...

    Please let me know if there are problems!
    ====================

    Signed-off-by: David S. Miller <davem@davemloft.net>

    David S. Miller
     

28 Nov, 2014

1 commit

06 Nov, 2014

1 commit

  • 51f3d02b9   net: Add and use skb_copy_datagram_msg() helper. ... Browse Code »

    This encapsulates all of the skb_copy_datagram_iovec() callers
    with call argument signature "skb, offset, msghdr->msg_iov, length".

    When we move to iov_iters in the networking, the iov_iter object will
    sit in the msghdr.

    Having a helper like this means there will be less places to touch
    during that transformation.

    Based upon descriptions and patch from Al Viro.

    Signed-off-by: David S. Miller

    David S. Miller
     

19 Jan, 2014

1 commit

  • 342dfc306   net: add build-time checks for msg->msg_name size ... Browse Code »

    This is a follow-up patch to f3d3342602f8bc ("net: rework recvmsg
    handler msg_name and msg_namelen logic").

    DECLARE_SOCKADDR validates that the structure we use for writing the
    name information to is not larger than the buffer which is reserved
    for msg->msg_name (which is 128 bytes). Also use DECLARE_SOCKADDR
    consistently in sendmsg code paths.

    Signed-off-by: Steffen Hurrle
    Suggested-by: Hannes Frederic Sowa
    Acked-by: Hannes Frederic Sowa
    Signed-off-by: David S. Miller

    Steffen Hurrle
     

04 Jan, 2014

1 commit

11 Dec, 2013

1 commit

  • 98b32decc   nfc: Fix FSF address in file headers ... Browse Code »

    Several files refer to an old address for the Free Software Foundation
    in the file header comment. Resolve by replacing the address with
    the URL so that we do not have to keep
    updating the header comments anytime the address changes.

    CC: linux-wireless@vger.kernel.org
    CC: Lauro Ramos Venancio
    CC: Aloisio Almeida Jr
    CC: Samuel Ortiz
    Signed-off-by: Jeff Kirsher
    Signed-off-by: John W. Linville

    Jeff Kirsher
     

21 Nov, 2013

1 commit

14 Jun, 2013

3 commits

30 Apr, 2013

2 commits

26 Apr, 2013

1 commit