23 Sep, 2016

1 commit


17 Sep, 2016

1 commit


20 Aug, 2016

1 commit

  • We've already set sk to sock->sk and dereferenced it, so if it's NULL
    we would have crashed already. Moreover, if it was NULL we would have
    crashed anyway when jumping to 'out' and trying to unlock the sock.
    Furthermore, if we had assigned a different value to 'sk' we would
    have been calling lock_sock() and release_sock() on different sockets.

    My conclusion is that these two lines are complete nonsense and only
    serve to confuse the reader.

    Signed-off-by: Vegard Nossum
    Signed-off-by: David S. Miller

    Vegard Nossum
     

14 Aug, 2016

1 commit

  • If iriap_register_lsap() fails to allocate memory, self->lsap is
    set to NULL. However, none of the callers handle the failure and
    irlmp_connect_request() will happily dereference it:

    iriap_register_lsap: Unable to allocated LSAP!
    ================================================================================
    UBSAN: Undefined behaviour in net/irda/irlmp.c:378:2
    member access within null pointer of type 'struct lsap_cb'
    CPU: 1 PID: 15403 Comm: trinity-c0 Not tainted 4.8.0-rc1+ #81
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org
    04/01/2014
    0000000000000000 ffff88010c7e78a8 ffffffff82344f40 0000000041b58ab3
    ffffffff84f98000 ffffffff82344e94 ffff88010c7e78d0 ffff88010c7e7880
    ffff88010630ad00 ffffffff84a5fae0 ffffffff84d3f5c0 000000000000017a
    Call Trace:
    [] dump_stack+0xac/0xfc
    [] ubsan_epilogue+0xd/0x8a
    [] __ubsan_handle_type_mismatch+0x157/0x411
    [] irlmp_connect_request+0x7ac/0x970
    [] iriap_connect_request+0xa0/0x160
    [] state_s_disconnect+0x88/0xd0
    [] iriap_do_client_event+0x94/0x120
    [] iriap_getvaluebyclass_request+0x3e0/0x6d0
    [] irda_find_lsap_sel+0x1eb/0x630
    [] irda_connect+0x828/0x12d0
    [] SYSC_connect+0x22b/0x340
    [] SyS_connect+0x9/0x10
    [] do_syscall_64+0x1b3/0x4b0
    [] entry_SYSCALL64_slow_path+0x25/0x25
    ================================================================================

    The bug seems to have been around since forever.

    There's more problems with missing error checks in iriap_init() (and
    indeed all of irda_init()), but that's a bigger problem that needs
    very careful review and testing. This patch will fix the most serious
    bug (as it's easily reached from unprivileged userspace).

    I have tested my patch with a reproducer.

    Signed-off-by: Vegard Nossum
    Signed-off-by: David S. Miller

    Vegard Nossum
     

28 Jul, 2016

1 commit

  • Pull networking updates from David Miller:

    1) Unified UDP encapsulation offload methods for drivers, from
    Alexander Duyck.

    2) Make DSA binding more sane, from Andrew Lunn.

    3) Support QCA9888 chips in ath10k, from Anilkumar Kolli.

    4) Several workqueue usage cleanups, from Bhaktipriya Shridhar.

    5) Add XDP (eXpress Data Path), essentially running BPF programs on RX
    packets as soon as the device sees them, with the option to mirror
    the packet on TX via the same interface. From Brenden Blanco and
    others.

    6) Allow qdisc/class stats dumps to run lockless, from Eric Dumazet.

    7) Add VLAN support to b53 and bcm_sf2, from Florian Fainelli.

    8) Simplify netlink conntrack entry layout, from Florian Westphal.

    9) Add ipv4 forwarding support to mlxsw spectrum driver, from Ido
    Schimmel, Yotam Gigi, and Jiri Pirko.

    10) Add SKB array infrastructure and convert tun and macvtap over to it.
    From Michael S Tsirkin and Jason Wang.

    11) Support qdisc packet injection in pktgen, from John Fastabend.

    12) Add neighbour monitoring framework to TIPC, from Jon Paul Maloy.

    13) Add NV congestion control support to TCP, from Lawrence Brakmo.

    14) Add GSO support to SCTP, from Marcelo Ricardo Leitner.

    15) Allow GRO and RPS to function on macsec devices, from Paolo Abeni.

    16) Support MPLS over IPV4, from Simon Horman.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1622 commits)
    xgene: Fix build warning with ACPI disabled.
    be2net: perform temperature query in adapter regardless of its interface state
    l2tp: Correctly return -EBADF from pppol2tp_getname.
    net/mlx5_core/health: Remove deprecated create_singlethread_workqueue
    net: ipmr/ip6mr: update lastuse on entry change
    macsec: ensure rx_sa is set when validation is disabled
    tipc: dump monitor attributes
    tipc: add a function to get the bearer name
    tipc: get monitor threshold for the cluster
    tipc: make cluster size threshold for monitoring configurable
    tipc: introduce constants for tipc address validation
    net: neigh: disallow transition to NUD_STALE if lladdr is unchanged in neigh_update()
    MAINTAINERS: xgene: Add driver and documentation path
    Documentation: dtb: xgene: Add MDIO node
    dtb: xgene: Add MDIO node
    drivers: net: xgene: ethtool: Use phy_ethtool_gset and sset
    drivers: net: xgene: Use exported functions
    drivers: net: xgene: Enable MDIO driver
    drivers: net: xgene: Add backward compatibility
    drivers: net: phy: xgene: Add MDIO driver
    ...

    Linus Torvalds
     

26 Jul, 2016

1 commit

  • I ran into this:

    kasan: CONFIG_KASAN_INLINE enabled
    kasan: GPF could be caused by NULL-ptr deref or user memory access
    general protection fault: 0000 [#1] PREEMPT SMP KASAN
    CPU: 2 PID: 2012 Comm: trinity-c3 Not tainted 4.7.0-rc7+ #19
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
    task: ffff8800b745f2c0 ti: ffff880111740000 task.ti: ffff880111740000
    RIP: 0010:[] [] irttp_connect_request+0x36/0x710
    RSP: 0018:ffff880111747bb8 EFLAGS: 00010286
    RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000069dd8358
    RDX: 0000000000000009 RSI: 0000000000000027 RDI: 0000000000000048
    RBP: ffff880111747c00 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000069dd8358 R11: 1ffffffff0759723 R12: 0000000000000000
    R13: ffff88011a7e4780 R14: 0000000000000027 R15: 0000000000000000
    FS: 00007fc738404700(0000) GS:ffff88011af00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007fc737fdfb10 CR3: 0000000118087000 CR4: 00000000000006e0
    Stack:
    0000000000000200 ffff880111747bd8 ffffffff810ee611 ffff880119f1f220
    ffff880119f1f4f8 ffff880119f1f4f0 ffff88011a7e4780 ffff880119f1f232
    ffff880119f1f220 ffff880111747d58 ffffffff82bca542 0000000000000000
    Call Trace:
    [] irda_connect+0x562/0x1190
    [] SYSC_connect+0x202/0x2a0
    [] SyS_connect+0x9/0x10
    [] do_syscall_64+0x19c/0x410
    [] entry_SYSCALL64_slow_path+0x25/0x25
    Code: 41 89 ca 48 89 e5 41 57 41 56 41 55 41 54 41 89 d7 53 48 89 fb 48 83 c7 48 48 89 fa 41 89 f6 48 c1 ea 03 48 83 ec 20 4c 8b 65 10 b6 04 02 84 c0 74 08 84 c0 0f 8e 4c 04 00 00 80 7b 48 00 74
    RIP [] irttp_connect_request+0x36/0x710
    RSP
    ---[ end trace 4cda2588bc055b30 ]---

    The problem is that irda_open_tsap() can fail and leave self->tsap = NULL,
    and then irttp_connect_request() almost immediately dereferences it.

    Cc: stable@vger.kernel.org
    Signed-off-by: Vegard Nossum
    Signed-off-by: David S. Miller

    Vegard Nossum
     

25 Jun, 2016

1 commit

  • In ircomm_tty_get_serial_info, struct serial_struct is memset to 0 and
    then some members set to 0 explicitly.

    Remove the latter as it is obviously superfluous.

    And remove the retinfo check against NULL. copy_to_user will take care
    of that.

    Part of hub6 cleanup series.

    Signed-off-by: Jiri Slaby
    Cc: Samuel Ortiz
    Acked-by: David S. Miller
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     

21 May, 2016

1 commit

  • Pull tty and serial driver updates from Greg KH:
    "Here's the large TTY and Serial driver update for 4.7-rc1.

    A few new serial drivers are added here, and Peter has fixed a bunch
    of long-standing bugs in the tty layer and serial drivers as normal.
    Full details in the shortlog.

    All of these have been in linux-next for a while with no reported
    issues"

    * tag 'tty-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (88 commits)
    MAINTAINERS: 8250: remove website reference
    serial: core: Fix port mutex assert if lockdep disabled
    serial: 8250_dw: fix wrong logic in dw8250_check_lcr()
    tty: vt, finish looping on duplicate
    tty: vt, return error when con_startup fails
    QE-UART: add "fsl,t1040-ucc-uart" to of_device_id
    serial: mctrl_gpio: Drop support for out1-gpios and out2-gpios
    serial: 8250dw: Add device HID for future AMD UART controller
    Fix OpenSSH pty regression on close
    serial: mctrl_gpio: add IRQ locking
    serial: 8250: Integrate Fintek into 8250_base
    serial: mps2-uart: add support for early console
    serial: mps2-uart: add MPS2 UART driver
    dt-bindings: document the MPS2 UART bindings
    serial: sirf: Use generic uart-has-rtscts DT property
    serial: sirf: Introduce helper variable struct device_node *np
    serial: mxs-auart: Use generic uart-has-rtscts DT property
    serial: imx: Use generic uart-has-rtscts DT property
    doc: DT: Add Generic Serial Device Tree Bindings
    serial: 8250: of: Make tegra_serial_handle_break() static
    ...

    Linus Torvalds
     

05 May, 2016

1 commit

  • Replace all trans_start updates with netif_trans_update helper.
    change was done via spatch:

    struct net_device *d;
    @@
    - d->trans_start = jiffies
    + netif_trans_update(d)

    Compile tested only.

    Cc: user-mode-linux-devel@lists.sourceforge.net
    Cc: linux-xtensa@linux-xtensa.org
    Cc: linux1394-devel@lists.sourceforge.net
    Cc: linux-rdma@vger.kernel.org
    Cc: netdev@vger.kernel.org
    Cc: MPT-FusionLinux.pdl@broadcom.com
    Cc: linux-scsi@vger.kernel.org
    Cc: linux-can@vger.kernel.org
    Cc: linux-parisc@vger.kernel.org
    Cc: linux-omap@vger.kernel.org
    Cc: linux-hams@vger.kernel.org
    Cc: linux-usb@vger.kernel.org
    Cc: linux-wireless@vger.kernel.org
    Cc: linux-s390@vger.kernel.org
    Cc: devel@driverdev.osuosl.org
    Cc: b.a.t.m.a.n@lists.open-mesh.org
    Cc: linux-bluetooth@vger.kernel.org
    Signed-off-by: Florian Westphal
    Acked-by: Felipe Balbi
    Acked-by: Mugunthan V N
    Acked-by: Antonio Quartulli
    Signed-off-by: David S. Miller

    Florian Westphal
     

01 May, 2016

6 commits

  • Replace ASYNC_INITIALIZED bit in the tty_port::flags field with
    TTY_PORT_INITIALIZED bit in the tty_port::iflags field. Introduce helpers
    tty_port_set_initialized() and tty_port_initialized() to abstract
    atomic bit ops.

    Note: the transforms for test_and_set_bit() and test_and_clear_bit()
    are unnecessary as the state transitions are already mutually exclusive;
    the tty lock prevents concurrent open/close/hangup.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Replace ASYNC_CHECK_CD bit in the tty_port::flags field with
    TTY_PORT_CHECK_CD bit in the tty_port::iflags field. Introduce helpers
    tty_port_set_check_carrier() and tty_port_check_carrier() to abstract
    the atomic bit ops.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Replace ASYNC_NORMAL_ACTIVE bit in the tty_port::flags field with
    TTY_PORT_ACTIVE bit in the tty_port::iflags field. Introduce helpers
    tty_port_set_active() and tty_port_active() to abstract atomic bit ops.

    Extract state changes from port lock sections, as this usage is
    broken and confused; the state transitions are protected by the
    tty lock (which mutually excludes parallel open/close/hangup),
    and no user tests the active state while holding the port lock.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Replace ASYNC_CTS_FLOW bit in the tty_port::flags field with
    TTY_PORT_CTS_FLOW bit in the tty_port::iflags field. Add
    tty_port_set_cts_flow() helper to abstract the atomic bit ops.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Abstract TTY_THROTTLED bit tests with tty_throttled().

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Abstract TTY_IO_ERROR status test treewide with tty_io_error().
    NB: tty->flags uses atomic bit ops; replace non-atomic bit test
    with test_bit().

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

15 Feb, 2016

1 commit


30 Jan, 2016

1 commit


29 Jan, 2016

2 commits

  • The tty core no longer provides nor uses ASYNC_CLOSING; remove from
    tty_port_close_start() and tty_port_close_end() as well as tty drivers
    which open-code these state changes. Unfortunately, even though the
    bit is masked from userspace, its inclusion in a uapi header precludes
    removing the macro.

    Cc: Martin Schwidefsky
    Cc: Heiko Carstens
    Cc: linux-s390@vger.kernel.org
    Cc: Mikael Starvik
    Cc: Jesper Nilsson
    Cc: linux-cris-kernel@axis.com
    Cc: Samuel Ortiz
    Cc: "David S. Miller"
    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Expressions of the form "tty->termios.c_*flag & FLAG"
    are more clearly expressed with the termios flags macros,
    I_FLAG(), C_FLAG(), O_FLAG(), and L_FLAG().

    Convert treewide.

    Signed-off-by: Peter Hurley
    Acked-by: Johan Hovold
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

15 Dec, 2015

1 commit

  • 郭永刚 reported that one could simply crash the kernel as root by
    using a simple program:

    int socket_fd;
    struct sockaddr_in addr;
    addr.sin_port = 0;
    addr.sin_addr.s_addr = INADDR_ANY;
    addr.sin_family = 10;

    socket_fd = socket(10,3,0x40000000);
    connect(socket_fd , &addr,16);

    AF_INET, AF_INET6 sockets actually only support 8-bit protocol
    identifiers. inet_sock's skc_protocol field thus is sized accordingly,
    thus larger protocol identifiers simply cut off the higher bits and
    store a zero in the protocol fields.

    This could lead to e.g. NULL function pointer because as a result of
    the cut off inet_num is zero and we call down to inet_autobind, which
    is NULL for raw sockets.

    kernel: Call Trace:
    kernel: [] ? inet_autobind+0x2e/0x70
    kernel: [] inet_dgram_connect+0x54/0x80
    kernel: [] SYSC_connect+0xd9/0x110
    kernel: [] ? ptrace_notify+0x5b/0x80
    kernel: [] ? syscall_trace_enter_phase2+0x108/0x200
    kernel: [] SyS_connect+0xe/0x10
    kernel: [] tracesys_phase2+0x84/0x89

    I found no particular commit which introduced this problem.

    CVE: CVE-2015-8543
    Cc: Cong Wang
    Reported-by: 郭永刚
    Signed-off-by: Hannes Frederic Sowa
    Signed-off-by: David S. Miller

    Hannes Frederic Sowa
     

05 Nov, 2015

1 commit

  • Pull tty/serial driver updates from Greg KH:
    "Here is the big tty and serial driver update for 4.4-rc1.

    Lots of serial driver updates and a few small tty core changes. Full
    details in the shortlog.

    All of these have been in linux-next for a while"

    * tag 'tty-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (148 commits)
    tty: Use unbound workqueue for all input workers
    tty: Abstract tty buffer work
    tty: Prevent tty teardown during tty_write_message()
    tty: core: Use correct spinlock flavor in tiocspgrp()
    tty: Combine SIGTTOU/SIGTTIN handling
    serial: amba-pl011: fix incorrect integer size in pl011_fifo_to_tty()
    ttyFDC: Fix build problems due to use of module_{init,exit}
    tty: remove unneeded return statement
    serial: 8250_mid: add support for DMA engine handling from UART MMIO
    dmaengine: hsu: remove platform data
    dmaengine: hsu: introduce stubs for the exported functions
    dmaengine: hsu: make the UART driver in control of selecting this driver
    serial: fix mctrl helper functions
    serial: 8250_pci: Intel MID UART support to its own driver
    serial: fsl_lpuart: add earlycon support
    tty: disable unbind for old 74xx based serial/mpsc console port
    serial: pl011: Spelling s/clocks-names/clock-names/
    n_tty: Remove reader wakeups for TTY_BREAK/TTY_PARITY chars
    tty: synclink, fix indentation
    serial: at91, fix rs485 properties
    ...

    Linus Torvalds
     

04 Nov, 2015

1 commit


21 Oct, 2015

1 commit


18 Oct, 2015

1 commit

  • Since at least before 2.6.30, tty drivers that do not drop the tty lock
    while closing cannot observe ASYNC_CLOSING set while holding the
    tty lock; this includes the tty driver's open() and hangup() methods,
    since the tty core calls these methods holding the tty lock.

    For these drivers, waiting for ASYNC_CLOSING to clear while opening
    is not required, since this condition cannot occur. Similarly, even
    when the open() method drops and reacquires the tty lock after
    blocking, ASYNC_CLOSING cannot be set (again, for drivers that
    do not drop the tty lock while closing).

    Now that tty port drivers no longer drop the tty lock while closing
    (since 'tty: Remove tty_wait_until_sent_from_close()'), the same
    conditions apply: waiting for ASYNC_CLOSING to clear while opening
    is not required, nor is re-checking ASYNC_CLOSING after dropping and
    reacquiring the tty lock while blocking (eg., in *_block_til_ready()).

    Note: The ASYNC_CLOSING flag state is still maintained since several
    bitrotting drivers use it for (dubious) other purposes.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

26 May, 2015

1 commit

  • API compliance scanning with coccinelle flagged:
    ./net/irda/timer.c:63:35-37: use of msecs_to_jiffies probably perferable

    Converting milliseconds to jiffies by "val * HZ / 1000" technically
    is not a clean solution as it does not handle all corner cases correctly.
    By changing the conversion to use msecs_to_jiffies(val) conversion is
    correct in all cases. Further the () around the arithmetic expression
    was dropped.

    Patch was compile tested for x86_64_defconfig + CONFIG_IRDA=m

    Patch is against 4.1-rc4 (localversion-next is -next-20150522)

    Signed-off-by: Nicholas Mc Guire
    Signed-off-by: David S. Miller

    Nicholas Mc Guire
     

11 May, 2015

1 commit


10 Mar, 2015

1 commit


09 Mar, 2015

1 commit

  • Pull tty/serial fixes from Greg KH:
    "Here are some tty and serial driver fixes for 4.0-rc3.

    Along with the atime fix that you know about, here are some other
    serial driver bugfixes as well. Most notable is a wait_until_sent
    bugfix that was traced back to being around since before 2.6.12 that
    Johan has fixed up.

    All have been in linux-next successfully"

    * tag 'tty-4.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
    TTY: fix tty_wait_until_sent maximum timeout
    TTY: fix tty_wait_until_sent on 64-bit machines
    USB: serial: fix infinite wait_until_sent timeout
    TTY: bfin_jtag_comm: remove incorrect wait_until_sent operation
    net: irda: fix wait_until_sent poll timeout
    serial: uapi: Declare all userspace-visible io types
    serial: core: Fix iotype userspace breakage
    serial: sprd: Fix missing spin_unlock in sprd_handle_irq()
    console: Fix console name size mismatch
    tty: fix up atime/mtime mess, take four
    serial: 8250_dw: Fix get_mctrl behaviour
    serial:8250:8250_pci: delete unneeded quirk entries
    serial:8250:8250_pci: fix redundant entry report for WCH_CH352_2S
    Change email address for 8250_pci
    serial: 8250: Revert "tty: serial: 8250_core: read only RX if there is something in the FIFO"
    Revert "tty/serial: of_serial: add DT alias ID handling"

    Linus Torvalds
     

07 Mar, 2015

1 commit

  • In case an infinite timeout (0) is requested, the irda wait_until_sent
    implementation would use a zero poll timeout rather than the default
    200ms.

    Note that wait_until_sent is currently never called with a 0-timeout
    argument due to a bug in tty_wait_until_sent.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Cc: stable # v2.6.12
    Signed-off-by: Johan Hovold
    Signed-off-by: Greg Kroah-Hartman

    Johan Hovold
     

04 Mar, 2015

1 commit


03 Mar, 2015

1 commit

  • After TIPC doesn't depend on iocb argument in its internal
    implementations of sendmsg() and recvmsg() hooks defined in proto
    structure, no any user is using iocb argument in them at all now.
    Then we can drop the redundant iocb argument completely from kinds of
    implementations of both sendmsg() and recvmsg() in the entire
    networking stack.

    Cc: Christoph Hellwig
    Suggested-by: Al Viro
    Signed-off-by: Ying Xue
    Signed-off-by: David S. Miller

    Ying Xue
     

24 Feb, 2015

1 commit

  • Use helper functions to access current->state.
    Direct assignments are prone to races and therefore buggy.

    current->state = TASK_RUNNING can be replaced by __set_current_state()

    Thanks to Peter Zijlstra for the exact definition of the problem.

    Suggested-By: Peter Zijlstra
    Signed-off-by: Fabian Frederick
    Signed-off-by: David S. Miller

    Fabian Frederick
     

31 Jan, 2015

1 commit


11 Dec, 2014

1 commit


24 Nov, 2014

2 commits


14 Nov, 2014

1 commit


13 Nov, 2014

2 commits


12 Nov, 2014

1 commit

  • And use the more common mechanisms directly.

    Other miscellanea:

    o Coalesce formats
    o Add missing newlines
    o Realign arguments
    o Remove unnecessary OOM message logging as
    there's a generic stack dump already on OOM.

    Signed-off-by: Joe Perches
    Signed-off-by: David S. Miller

    Joe Perches