* [PATCH 3.18 01/29] ibmasm: dont write out of bounds in read handler
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
@ 2018-07-20 12:10 ` Greg Kroah-Hartman
2018-07-20 12:10 ` [PATCH 3.18 02/29] USB: serial: keyspan_pda: fix modem-status error handling Greg Kroah-Hartman
` (26 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jann Horn
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jannh@google.com>
commit a0341fc1981a950c1e902ab901e98f60e0e243f3 upstream.
This read handler had a lot of custom logic and wrote outside the bounds of
the provided buffer. This could lead to kernel and userspace memory
corruption. Just use simple_read_from_buffer() with a stack buffer.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/ibmasm/ibmasmfs.c | 27 +++------------------------
1 file changed, 3 insertions(+), 24 deletions(-)
--- a/drivers/misc/ibmasm/ibmasmfs.c
+++ b/drivers/misc/ibmasm/ibmasmfs.c
@@ -507,35 +507,14 @@ static int remote_settings_file_close(st
static ssize_t remote_settings_file_read(struct file *file, char __user *buf, size_t count, loff_t *offset)
{
void __iomem *address = (void __iomem *)file->private_data;
- unsigned char *page;
- int retval;
int len = 0;
unsigned int value;
-
- if (*offset < 0)
- return -EINVAL;
- if (count == 0 || count > 1024)
- return 0;
- if (*offset != 0)
- return 0;
-
- page = (unsigned char *)__get_free_page(GFP_KERNEL);
- if (!page)
- return -ENOMEM;
+ char lbuf[20];
value = readl(address);
- len = sprintf(page, "%d\n", value);
-
- if (copy_to_user(buf, page, len)) {
- retval = -EFAULT;
- goto exit;
- }
- *offset += len;
- retval = len;
+ len = snprintf(lbuf, sizeof(lbuf), "%d\n", value);
-exit:
- free_page((unsigned long)page);
- return retval;
+ return simple_read_from_buffer(buf, count, offset, lbuf, len);
}
static ssize_t remote_settings_file_write(struct file *file, const char __user *ubuff, size_t count, loff_t *offset)
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 02/29] USB: serial: keyspan_pda: fix modem-status error handling
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
2018-07-20 12:10 ` [PATCH 3.18 01/29] ibmasm: dont write out of bounds in read handler Greg Kroah-Hartman
@ 2018-07-20 12:10 ` Greg Kroah-Hartman
2018-07-20 12:10 ` [PATCH 3.18 03/29] USB: yurex: fix out-of-bounds uaccess in read handler Greg Kroah-Hartman
` (25 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 01b3cdfca263a17554f7b249d20a247b2a751521 upstream.
Fix broken modem-status error handling which could lead to bits of slab
data leaking to user space.
Fixes: 3b36a8fd6777 ("usb: fix uninitialized variable warning in keyspan_pda")
Cc: stable <stable@vger.kernel.org> # 2.6.27
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/keyspan_pda.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -373,8 +373,10 @@ static int keyspan_pda_get_modem_info(st
3, /* get pins */
USB_TYPE_VENDOR|USB_RECIP_INTERFACE|USB_DIR_IN,
0, 0, data, 1, 2000);
- if (rc >= 0)
+ if (rc == 1)
*value = *data;
+ else if (rc >= 0)
+ rc = -EIO;
kfree(data);
return rc;
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 03/29] USB: yurex: fix out-of-bounds uaccess in read handler
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
2018-07-20 12:10 ` [PATCH 3.18 01/29] ibmasm: dont write out of bounds in read handler Greg Kroah-Hartman
2018-07-20 12:10 ` [PATCH 3.18 02/29] USB: serial: keyspan_pda: fix modem-status error handling Greg Kroah-Hartman
@ 2018-07-20 12:10 ` Greg Kroah-Hartman
2018-07-20 12:10 ` [PATCH 3.18 04/29] USB: serial: mos7840: fix status-register error handling Greg Kroah-Hartman
` (24 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jann Horn
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jannh@google.com>
commit f1e255d60ae66a9f672ff9a207ee6cd8e33d2679 upstream.
In general, accessing userspace memory beyond the length of the supplied
buffer in VFS read/write handlers can lead to both kernel memory corruption
(via kernel_read()/kernel_write(), which can e.g. be triggered via
sys_splice()) and privilege escalation inside userspace.
Fix it by using simple_read_from_buffer() instead of custom logic.
Fixes: 6bc235a2e24a ("USB: add driver for Meywa-Denki & Kayac YUREX")
Signed-off-by: Jann Horn <jannh@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/yurex.c | 23 ++++++-----------------
1 file changed, 6 insertions(+), 17 deletions(-)
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -413,8 +413,7 @@ static int yurex_release(struct inode *i
static ssize_t yurex_read(struct file *file, char *buffer, size_t count, loff_t *ppos)
{
struct usb_yurex *dev;
- int retval = 0;
- int bytes_read = 0;
+ int len = 0;
char in_buffer[20];
unsigned long flags;
@@ -422,26 +421,16 @@ static ssize_t yurex_read(struct file *f
mutex_lock(&dev->io_mutex);
if (!dev->interface) { /* already disconnected */
- retval = -ENODEV;
- goto exit;
+ mutex_unlock(&dev->io_mutex);
+ return -ENODEV;
}
spin_lock_irqsave(&dev->lock, flags);
- bytes_read = snprintf(in_buffer, 20, "%lld\n", dev->bbu);
+ len = snprintf(in_buffer, 20, "%lld\n", dev->bbu);
spin_unlock_irqrestore(&dev->lock, flags);
-
- if (*ppos < bytes_read) {
- if (copy_to_user(buffer, in_buffer + *ppos, bytes_read - *ppos))
- retval = -EFAULT;
- else {
- retval = bytes_read - *ppos;
- *ppos += bytes_read;
- }
- }
-
-exit:
mutex_unlock(&dev->io_mutex);
- return retval;
+
+ return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
}
static ssize_t yurex_write(struct file *file, const char *user_buffer, size_t count, loff_t *ppos)
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 04/29] USB: serial: mos7840: fix status-register error handling
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2018-07-20 12:10 ` [PATCH 3.18 03/29] USB: yurex: fix out-of-bounds uaccess in read handler Greg Kroah-Hartman
@ 2018-07-20 12:10 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 05/29] usb: quirks: add delay quirks for Corsair Strafe Greg Kroah-Hartman
` (23 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 794744abfffef8b1f3c0c8a4896177d6d13d653d upstream.
Add missing transfer-length sanity check to the status-register
completion handler to avoid leaking bits of uninitialised slab data to
user space.
Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver")
Cc: stable <stable@vger.kernel.org> # 2.6.19
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/mos7840.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -482,6 +482,9 @@ static void mos7840_control_callback(str
}
dev_dbg(dev, "%s urb buffer size is %d\n", __func__, urb->actual_length);
+ if (urb->actual_length < 1)
+ goto out;
+
dev_dbg(dev, "%s mos7840_port->MsrLsr is %d port %d\n", __func__,
mos7840_port->MsrLsr, mos7840_port->port_num);
data = urb->transfer_buffer;
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 05/29] usb: quirks: add delay quirks for Corsair Strafe
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2018-07-20 12:10 ` [PATCH 3.18 04/29] USB: serial: mos7840: fix status-register error handling Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 06/29] xhci: xhci-mem: off by one in xhci_stream_id_to_ring() Greg Kroah-Hartman
` (22 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nico Sneck
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nico Sneck <snecknico@gmail.com>
commit bba57eddadda936c94b5dccf73787cb9e159d0a5 upstream.
Corsair Strafe appears to suffer from the same issues
as the Corsair Strafe RGB.
Apply the same quirks (control message delay and init delay)
that the RGB version has to 1b1c:1b15.
With these quirks in place the keyboard works correctly upon
booting the system, and no longer requires reattaching the device.
Signed-off-by: Nico Sneck <snecknico@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -221,6 +221,10 @@ static const struct usb_device_id usb_qu
{ USB_DEVICE(0x1a0a, 0x0200), .driver_info =
USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+ /* Corsair Strafe */
+ { USB_DEVICE(0x1b1c, 0x1b15), .driver_info = USB_QUIRK_DELAY_INIT |
+ USB_QUIRK_DELAY_CTRL_MSG },
+
/* Corsair Strafe RGB */
{ USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
USB_QUIRK_DELAY_CTRL_MSG },
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 06/29] xhci: xhci-mem: off by one in xhci_stream_id_to_ring()
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 05/29] usb: quirks: add delay quirks for Corsair Strafe Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 07/29] Fix up non-directory creation in SGID directories Greg Kroah-Hartman
` (21 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 313db3d6488bb03b61b99de9dbca061f1fd838e1 upstream.
The > should be >= here so that we don't read one element beyond the end
of the ep->stream_info->stream_rings[] array.
Fixes: e9df17eb1408 ("USB: xhci: Correct assumptions about number of rings per endpoint.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -638,7 +638,7 @@ struct xhci_ring *xhci_stream_id_to_ring
if (!ep->stream_info)
return NULL;
- if (stream_id > ep->stream_info->num_streams)
+ if (stream_id >= ep->stream_info->num_streams)
return NULL;
return ep->stream_info->stream_rings[stream_id];
}
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 07/29] Fix up non-directory creation in SGID directories
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 06/29] xhci: xhci-mem: off by one in xhci_stream_id_to_ring() Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 08/29] netfilter: x_tables: initialise match/target check parameter struct Greg Kroah-Hartman
` (20 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jann Horn, Andy Lutomirski, Al Viro,
Linus Torvalds
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit 0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7 upstream.
sgid directories have special semantics, making newly created files in
the directory belong to the group of the directory, and newly created
subdirectories will also become sgid. This is historically used for
group-shared directories.
But group directories writable by non-group members should not imply
that such non-group members can magically join the group, so make sure
to clear the sgid bit on non-directories for non-members (but remember
that sgid without group execute means "mandatory locking", just to
confuse things even more).
Reported-by: Jann Horn <jannh@google.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1821,8 +1821,14 @@ void inode_init_owner(struct inode *inod
inode->i_uid = current_fsuid();
if (dir && dir->i_mode & S_ISGID) {
inode->i_gid = dir->i_gid;
+
+ /* Directories are special, and always inherit S_ISGID */
if (S_ISDIR(mode))
mode |= S_ISGID;
+ else if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP) &&
+ !in_group_p(inode->i_gid) &&
+ !capable_wrt_inode_uidgid(dir, CAP_FSETID))
+ mode &= ~S_ISGID;
} else
inode->i_gid = current_fsgid();
inode->i_mode = mode;
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 08/29] netfilter: x_tables: initialise match/target check parameter struct
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 07/29] Fix up non-directory creation in SGID directories Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 09/29] loop: add recursion validation to LOOP_CHANGE_FD Greg Kroah-Hartman
` (19 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+da4494182233c23a5fcf,
Florian Westphal, Pablo Neira Ayuso
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit c568503ef02030f169c9e19204def610a3510918 upstream.
syzbot reports following splat:
BUG: KMSAN: uninit-value in ebt_stp_mt_check+0x24b/0x450
net/bridge/netfilter/ebt_stp.c:162
ebt_stp_mt_check+0x24b/0x450 net/bridge/netfilter/ebt_stp.c:162
xt_check_match+0x1438/0x1650 net/netfilter/x_tables.c:506
ebt_check_match net/bridge/netfilter/ebtables.c:372 [inline]
ebt_check_entry net/bridge/netfilter/ebtables.c:702 [inline]
The uninitialised access is
xt_mtchk_param->nft_compat
... which should be set to 0.
Fix it by zeroing the struct beforehand, same for tgchk.
ip(6)tables targetinfo uses c99-style initialiser, so no change
needed there.
Reported-by: syzbot+da4494182233c23a5fcf@syzkaller.appspotmail.com
Fixes: 55917a21d0cc0 ("netfilter: x_tables: add context to know if extension runs from nft_compat")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/netfilter/ebtables.c | 2 ++
net/ipv4/netfilter/ip_tables.c | 1 +
net/ipv6/netfilter/ip6_tables.c | 1 +
3 files changed, 4 insertions(+)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -699,6 +699,8 @@ ebt_check_entry(struct ebt_entry *e, str
}
i = 0;
+ memset(&mtpar, 0, sizeof(mtpar));
+ memset(&tgpar, 0, sizeof(tgpar));
mtpar.net = tgpar.net = net;
mtpar.table = tgpar.table = name;
mtpar.entryinfo = tgpar.entryinfo = e;
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -651,6 +651,7 @@ find_check_entry(struct ipt_entry *e, st
struct xt_entry_match *ematch;
j = 0;
+ memset(&mtpar, 0, sizeof(mtpar));
mtpar.net = net;
mtpar.table = name;
mtpar.entryinfo = &e->ip;
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -662,6 +662,7 @@ find_check_entry(struct ip6t_entry *e, s
struct xt_entry_match *ematch;
j = 0;
+ memset(&mtpar, 0, sizeof(mtpar));
mtpar.net = net;
mtpar.table = name;
mtpar.entryinfo = &e->ipv6;
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 09/29] loop: add recursion validation to LOOP_CHANGE_FD
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 08/29] netfilter: x_tables: initialise match/target check parameter struct Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 10/29] PM / hibernate: Fix oops at snapshot_write() Greg Kroah-Hartman
` (18 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable,
syzbot+4349872271ece473a7c91190b68b4bac7c5dbc87,
syzbot+40bd32c4d9a3cc12a339, syzbot+769c54e66f994b041be7,
syzbot+0a89a9ce473936c57065, Theodore Tso, Jens Axboe
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit d2ac838e4cd7e5e9891ecc094d626734b0245c99 upstream.
Refactor the validation code used in LOOP_SET_FD so it is also used in
LOOP_CHANGE_FD. Otherwise it is possible to construct a set of loop
devices that all refer to each other. This can lead to a infinite
loop in starting with "while (is_loop_device(f)) .." in loop_set_fd().
Fix this by refactoring out the validation code and using it for
LOOP_CHANGE_FD as well as LOOP_SET_FD.
Reported-by: syzbot+4349872271ece473a7c91190b68b4bac7c5dbc87@syzkaller.appspotmail.com
Reported-by: syzbot+40bd32c4d9a3cc12a339@syzkaller.appspotmail.com
Reported-by: syzbot+769c54e66f994b041be7@syzkaller.appspotmail.com
Reported-by: syzbot+0a89a9ce473936c57065@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/loop.c | 68 ++++++++++++++++++++++++++++-----------------------
1 file changed, 38 insertions(+), 30 deletions(-)
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -628,6 +628,36 @@ out:
}
+static inline int is_loop_device(struct file *file)
+{
+ struct inode *i = file->f_mapping->host;
+
+ return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR;
+}
+
+static int loop_validate_file(struct file *file, struct block_device *bdev)
+{
+ struct inode *inode = file->f_mapping->host;
+ struct file *f = file;
+
+ /* Avoid recursion */
+ while (is_loop_device(f)) {
+ struct loop_device *l;
+
+ if (f->f_mapping->host->i_bdev == bdev)
+ return -EBADF;
+
+ l = f->f_mapping->host->i_bdev->bd_disk->private_data;
+ if (l->lo_state == Lo_unbound) {
+ return -EINVAL;
+ }
+ f = l->lo_backing_file;
+ }
+ if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
+ return -EINVAL;
+ return 0;
+}
+
/*
* loop_change_fd switched the backing store of a loopback device to
* a new file. This is useful for operating system installers to free up
@@ -657,14 +687,15 @@ static int loop_change_fd(struct loop_de
if (!file)
goto out;
+ error = loop_validate_file(file, bdev);
+ if (error)
+ goto out_putf;
+
inode = file->f_mapping->host;
old_file = lo->lo_backing_file;
error = -EINVAL;
- if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
- goto out_putf;
-
/* size of the new backing store needs to be the same */
if (get_loop_size(lo, file) != get_loop_size(lo, old_file))
goto out_putf;
@@ -685,13 +716,6 @@ static int loop_change_fd(struct loop_de
return error;
}
-static inline int is_loop_device(struct file *file)
-{
- struct inode *i = file->f_mapping->host;
-
- return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR;
-}
-
/* loop sysfs attributes */
static ssize_t loop_attr_show(struct device *dev, char *page,
@@ -823,7 +847,7 @@ static void loop_config_discard(struct l
static int loop_set_fd(struct loop_device *lo, fmode_t mode,
struct block_device *bdev, unsigned int arg)
{
- struct file *file, *f;
+ struct file *file;
struct inode *inode;
struct address_space *mapping;
unsigned lo_blocksize;
@@ -843,29 +867,13 @@ static int loop_set_fd(struct loop_devic
if (lo->lo_state != Lo_unbound)
goto out_putf;
- /* Avoid recursion */
- f = file;
- while (is_loop_device(f)) {
- struct loop_device *l;
-
- if (f->f_mapping->host->i_bdev == bdev)
- goto out_putf;
-
- l = f->f_mapping->host->i_bdev->bd_disk->private_data;
- if (l->lo_state == Lo_unbound) {
- error = -EINVAL;
- goto out_putf;
- }
- f = l->lo_backing_file;
- }
+ error = loop_validate_file(file, bdev);
+ if (error)
+ goto out_putf;
mapping = file->f_mapping;
inode = mapping->host;
- error = -EINVAL;
- if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
- goto out_putf;
-
if (!(file->f_mode & FMODE_WRITE) || !(mode & FMODE_WRITE) ||
!file->f_op->write)
lo_flags |= LO_FLAGS_READ_ONLY;
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 10/29] PM / hibernate: Fix oops at snapshot_write()
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 09/29] loop: add recursion validation to LOOP_CHANGE_FD Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 11/29] RDMA/ucm: Mark UCM interface as BROKEN Greg Kroah-Hartman
` (17 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, syzbot,
Rafael J. Wysocki
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
commit fc14eebfc20854a38fd9f1d93a42b1783dad4d17 upstream.
syzbot is reporting NULL pointer dereference at snapshot_write() [1].
This is because data->handle is zero-cleared by ioctl(SNAPSHOT_FREE).
Fix this by checking data_of(data->handle) != NULL before using it.
[1] https://syzkaller.appspot.com/bug?id=828a3c71bd344a6de8b6a31233d51a72099f27fd
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+ae590932da6e45d6564d@syzkaller.appspotmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/power/user.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -184,6 +184,11 @@ static ssize_t snapshot_write(struct fil
res = PAGE_SIZE - pg_offp;
}
+ if (!data_of(data->handle)) {
+ res = -EINVAL;
+ goto unlock;
+ }
+
res = simple_write_to_buffer(data_of(data->handle), res, &pg_offp,
buf, count);
if (res > 0)
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 11/29] RDMA/ucm: Mark UCM interface as BROKEN
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 10/29] PM / hibernate: Fix oops at snapshot_write() Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 12/29] loop: remember whether sysfs_create_group() was done Greg Kroah-Hartman
` (16 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Jason Gunthorpe
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@mellanox.com>
commit 7a8690ed6f5346f6738971892205e91d39b6b901 upstream.
In commit 357d23c811a7 ("Remove the obsolete libibcm library")
in rdma-core [1], we removed obsolete library which used the
/dev/infiniband/ucmX interface.
Following multiple syzkaller reports about non-sanitized
user input in the UCMA module, the short audit reveals the same
issues in UCM module too.
It is better to disable this interface in the kernel,
before syzkaller team invests time and energy to harden
this unused interface.
[1] https://github.com/linux-rdma/rdma-core/pull/279
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/Kconfig | 12 ++++++++++++
drivers/infiniband/core/Makefile | 4 ++--
2 files changed, 14 insertions(+), 2 deletions(-)
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -33,6 +33,18 @@ config INFINIBAND_USER_ACCESS
libibverbs, libibcm and a hardware driver library from
<http://www.openfabrics.org/git/>.
+config INFINIBAND_USER_ACCESS_UCM
+ bool "Userspace CM (UCM, DEPRECATED)"
+ depends on BROKEN
+ depends on INFINIBAND_USER_ACCESS
+ help
+ The UCM module has known security flaws, which no one is
+ interested to fix. The user-space part of this code was
+ dropped from the upstream a long time ago.
+
+ This option is DEPRECATED and planned to be removed.
+
+
config INFINIBAND_USER_MEM
bool
depends on INFINIBAND_USER_ACCESS != n
--- a/drivers/infiniband/core/Makefile
+++ b/drivers/infiniband/core/Makefile
@@ -5,8 +5,8 @@ obj-$(CONFIG_INFINIBAND) += ib_core.o i
ib_cm.o iw_cm.o ib_addr.o \
$(infiniband-y)
obj-$(CONFIG_INFINIBAND_USER_MAD) += ib_umad.o
-obj-$(CONFIG_INFINIBAND_USER_ACCESS) += ib_uverbs.o ib_ucm.o \
- $(user_access-y)
+obj-$(CONFIG_INFINIBAND_USER_ACCESS) += ib_uverbs.o $(user_access-y)
+obj-$(CONFIG_INFINIBAND_USER_ACCESS_UCM) += ib_ucm.o $(user_access-y)
ib_core-y := packer.o ud_header.o verbs.o sysfs.o \
device.o fmr_pool.o cache.o netlink.o
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 12/29] loop: remember whether sysfs_create_group() was done
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 11/29] RDMA/ucm: Mark UCM interface as BROKEN Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 13/29] bcm63xx_enet: correct clock usage Greg Kroah-Hartman
` (15 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, syzbot, Jens Axboe
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
commit d3349b6b3c373ac1fbfb040b810fcee5e2adc7e0 upstream.
syzbot is hitting WARN() triggered by memory allocation fault
injection [1] because loop module is calling sysfs_remove_group()
when sysfs_create_group() failed.
Fix this by remembering whether sysfs_create_group() succeeded.
[1] https://syzkaller.appspot.com/bug?id=3f86c0edf75c86d2633aeb9dd69eccc70bc7e90b
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+9f03168400f56df89dbc6f1751f4458fe739ff29@syzkaller.appspotmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Renamed sysfs_ready -> sysfs_inited.
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/loop.c | 11 ++++++-----
drivers/block/loop.h | 1 +
2 files changed, 7 insertions(+), 5 deletions(-)
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -803,16 +803,17 @@ static struct attribute_group loop_attri
.attrs= loop_attrs,
};
-static int loop_sysfs_init(struct loop_device *lo)
+static void loop_sysfs_init(struct loop_device *lo)
{
- return sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj,
- &loop_attribute_group);
+ lo->sysfs_inited = !sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj,
+ &loop_attribute_group);
}
static void loop_sysfs_exit(struct loop_device *lo)
{
- sysfs_remove_group(&disk_to_dev(lo->lo_disk)->kobj,
- &loop_attribute_group);
+ if (lo->sysfs_inited)
+ sysfs_remove_group(&disk_to_dev(lo->lo_disk)->kobj,
+ &loop_attribute_group);
}
static void loop_config_discard(struct loop_device *lo)
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -60,6 +60,7 @@ struct loop_device {
wait_queue_head_t lo_event;
/* wait queue for incoming requests */
wait_queue_head_t lo_req_wait;
+ bool sysfs_inited;
struct request_queue *lo_queue;
struct gendisk *lo_disk;
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 13/29] bcm63xx_enet: correct clock usage
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 12/29] loop: remember whether sysfs_create_group() was done Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 14/29] bcm63xx_enet: do not write to random DMA channel on BCM6345 Greg Kroah-Hartman
` (14 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonas Gorski, David S. Miller,
Amit Pundir
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
commit 9c86b846ce02f7e35d7234cf090b80553eba5389 upstream.
Check the return code of prepare_enable and change one last instance of
enable only to prepare_enable. Also properly disable and release the
clock in error paths and on remove for enetsw.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bcm63xx_enet.c | 31 ++++++++++++++++++++-------
1 file changed, 23 insertions(+), 8 deletions(-)
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
@@ -1788,7 +1788,9 @@ static int bcm_enet_probe(struct platfor
ret = PTR_ERR(priv->mac_clk);
goto out;
}
- clk_prepare_enable(priv->mac_clk);
+ ret = clk_prepare_enable(priv->mac_clk);
+ if (ret)
+ goto out_put_clk_mac;
/* initialize default and fetch platform data */
priv->rx_ring_size = BCMENET_DEF_RX_DESC;
@@ -1820,9 +1822,11 @@ static int bcm_enet_probe(struct platfor
if (IS_ERR(priv->phy_clk)) {
ret = PTR_ERR(priv->phy_clk);
priv->phy_clk = NULL;
- goto out_put_clk_mac;
+ goto out_disable_clk_mac;
}
- clk_prepare_enable(priv->phy_clk);
+ ret = clk_prepare_enable(priv->phy_clk);
+ if (ret)
+ goto out_put_clk_phy;
}
/* do minimal hardware init to be able to probe mii bus */
@@ -1922,13 +1926,16 @@ out_free_mdio:
out_uninit_hw:
/* turn off mdc clock */
enet_writel(priv, 0, ENET_MIISC_REG);
- if (priv->phy_clk) {
+ if (priv->phy_clk)
clk_disable_unprepare(priv->phy_clk);
+
+out_put_clk_phy:
+ if (priv->phy_clk)
clk_put(priv->phy_clk);
- }
-out_put_clk_mac:
+out_disable_clk_mac:
clk_disable_unprepare(priv->mac_clk);
+out_put_clk_mac:
clk_put(priv->mac_clk);
out:
free_netdev(dev);
@@ -2769,7 +2776,9 @@ static int bcm_enetsw_probe(struct platf
ret = PTR_ERR(priv->mac_clk);
goto out_unmap;
}
- clk_enable(priv->mac_clk);
+ ret = clk_prepare_enable(priv->mac_clk);
+ if (ret)
+ goto out_put_clk;
priv->rx_chan = 0;
priv->tx_chan = 1;
@@ -2790,7 +2799,7 @@ static int bcm_enetsw_probe(struct platf
ret = register_netdev(dev);
if (ret)
- goto out_put_clk;
+ goto out_disable_clk;
netif_carrier_off(dev);
platform_set_drvdata(pdev, dev);
@@ -2799,6 +2808,9 @@ static int bcm_enetsw_probe(struct platf
return 0;
+out_disable_clk:
+ clk_disable_unprepare(priv->mac_clk);
+
out_put_clk:
clk_put(priv->mac_clk);
@@ -2830,6 +2842,9 @@ static int bcm_enetsw_remove(struct plat
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
release_mem_region(res->start, resource_size(res));
+ clk_disable_unprepare(priv->mac_clk);
+ clk_put(priv->mac_clk);
+
free_netdev(dev);
return 0;
}
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 14/29] bcm63xx_enet: do not write to random DMA channel on BCM6345
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 13/29] bcm63xx_enet: correct clock usage Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 15/29] crypto: crypto4xx - remove bad list_del Greg Kroah-Hartman
` (13 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonas Gorski, David S. Miller,
Amit Pundir
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
commit d6213c1f2ad54a964b77471690264ed685718928 upstream.
The DMA controller regs actually point to DMA channel 0, so the write to
ENETDMA_CFG_REG will actually modify a random DMA channel.
Since DMA controller registers do not exist on BCM6345, guard the write
with the usual check for dma_has_sram.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bcm63xx_enet.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
@@ -1063,7 +1063,8 @@ static int bcm_enet_open(struct net_devi
val = enet_readl(priv, ENET_CTL_REG);
val |= ENET_CTL_ENABLE_MASK;
enet_writel(priv, val, ENET_CTL_REG);
- enet_dma_writel(priv, ENETDMA_CFG_EN_MASK, ENETDMA_CFG_REG);
+ if (priv->dma_has_sram)
+ enet_dma_writel(priv, ENETDMA_CFG_EN_MASK, ENETDMA_CFG_REG);
enet_dmac_writel(priv, priv->dma_chan_en_mask,
ENETDMAC_CHANCFG, priv->rx_chan);
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 15/29] crypto: crypto4xx - remove bad list_del
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 14/29] bcm63xx_enet: do not write to random DMA channel on BCM6345 Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 16/29] crypto: crypto4xx - fix crypto4xx_build_pdr, crypto4xx_build_sdr leak Greg Kroah-Hartman
` (12 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Lamparter, Herbert Xu,
Amit Pundir
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <chunkeey@googlemail.com>
commit a728a196d253530f17da5c86dc7dfbe58c5f7094 upstream.
alg entries are only added to the list, after the registration
was successful. If the registration failed, it was never added
to the list in the first place.
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/amcc/crypto4xx_core.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -1049,12 +1049,10 @@ int crypto4xx_register_alg(struct crypto
break;
}
- if (rc) {
- list_del(&alg->entry);
+ if (rc)
kfree(alg);
- } else {
+ else
list_add_tail(&alg->entry, &sec_dev->alg_list);
- }
}
return 0;
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 16/29] crypto: crypto4xx - fix crypto4xx_build_pdr, crypto4xx_build_sdr leak
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 15/29] crypto: crypto4xx - remove bad list_del Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 19/29] net/mlx5: Fix incorrect raw command length parsing Greg Kroah-Hartman
` (11 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Lamparter, Herbert Xu,
Amit Pundir
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <chunkeey@googlemail.com>
commit 5d59ad6eea82ef8df92b4109615a0dde9d8093e9 upstream.
If one of the later memory allocations in rypto4xx_build_pdr()
fails: dev->pdr (and/or) dev->pdr_uinfo wouldn't be freed.
crypto4xx_build_sdr() has the same issue with dev->sdr.
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/amcc/crypto4xx_core.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -207,7 +207,7 @@ static u32 crypto4xx_build_pdr(struct cr
dev->pdr_pa);
return -ENOMEM;
}
- memset(dev->pdr, 0, sizeof(struct ce_pd) * PPC4XX_NUM_PD);
+ memset(dev->pdr, 0, sizeof(struct ce_pd) * PPC4XX_NUM_PD);
dev->shadow_sa_pool = dma_alloc_coherent(dev->core_dev->device,
256 * PPC4XX_NUM_PD,
&dev->shadow_sa_pool_pa,
@@ -240,13 +240,15 @@ static u32 crypto4xx_build_pdr(struct cr
static void crypto4xx_destroy_pdr(struct crypto4xx_device *dev)
{
- if (dev->pdr != NULL)
+ if (dev->pdr)
dma_free_coherent(dev->core_dev->device,
sizeof(struct ce_pd) * PPC4XX_NUM_PD,
dev->pdr, dev->pdr_pa);
+
if (dev->shadow_sa_pool)
dma_free_coherent(dev->core_dev->device, 256 * PPC4XX_NUM_PD,
dev->shadow_sa_pool, dev->shadow_sa_pool_pa);
+
if (dev->shadow_sr_pool)
dma_free_coherent(dev->core_dev->device,
sizeof(struct sa_state_record) * PPC4XX_NUM_PD,
@@ -416,12 +418,12 @@ static u32 crypto4xx_build_sdr(struct cr
static void crypto4xx_destroy_sdr(struct crypto4xx_device *dev)
{
- if (dev->sdr != NULL)
+ if (dev->sdr)
dma_free_coherent(dev->core_dev->device,
sizeof(struct ce_sd) * PPC4XX_NUM_SD,
dev->sdr, dev->sdr_pa);
- if (dev->scatter_buffer_va != NULL)
+ if (dev->scatter_buffer_va)
dma_free_coherent(dev->core_dev->device,
dev->scatter_buffer_size * PPC4XX_NUM_SD,
dev->scatter_buffer_va,
@@ -1206,7 +1208,7 @@ static int __init crypto4xx_probe(struct
rc = crypto4xx_build_gdr(core_dev->dev);
if (rc)
- goto err_build_gdr;
+ goto err_build_pdr;
rc = crypto4xx_build_sdr(core_dev->dev);
if (rc)
@@ -1248,12 +1250,11 @@ err_iomap:
err_request_irq:
irq_dispose_mapping(core_dev->irq);
tasklet_kill(&core_dev->tasklet);
- crypto4xx_destroy_sdr(core_dev->dev);
err_build_sdr:
+ crypto4xx_destroy_sdr(core_dev->dev);
crypto4xx_destroy_gdr(core_dev->dev);
-err_build_gdr:
- crypto4xx_destroy_pdr(core_dev->dev);
err_build_pdr:
+ crypto4xx_destroy_pdr(core_dev->dev);
kfree(core_dev->dev);
err_alloc_dev:
kfree(core_dev);
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 19/29] net/mlx5: Fix incorrect raw command length parsing
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 16/29] crypto: crypto4xx - fix crypto4xx_build_pdr, crypto4xx_build_sdr leak Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 20/29] net: sungem: fix rx checksum support Greg Kroah-Hartman
` (10 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Vesker, Saeed Mahameed
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Vesker <valex@mellanox.com>
[ Upstream commit 603b7bcff824740500ddfa001d7a7168b0b38542 ]
The NULL character was not set correctly for the string containing
the command length, this caused failures reading the output of the
command due to a random length. The fix is to initialize the output
length string.
Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: Alex Vesker <valex@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -933,7 +933,7 @@ static ssize_t outlen_write(struct file
{
struct mlx5_core_dev *dev = filp->private_data;
struct mlx5_cmd_debug *dbg = &dev->cmd.dbg;
- char outlen_str[8];
+ char outlen_str[8] = {0};
int outlen;
void *ptr;
int err;
@@ -948,8 +948,6 @@ static ssize_t outlen_write(struct file
if (copy_from_user(outlen_str, buf, count))
return -EFAULT;
- outlen_str[7] = 0;
-
err = sscanf(outlen_str, "%d", &outlen);
if (err < 0)
return err;
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 20/29] net: sungem: fix rx checksum support
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 19/29] net/mlx5: Fix incorrect raw command length parsing Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 21/29] tcp: fix Fast Open key endianness Greg Kroah-Hartman
` (9 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Meelis Roos,
Mathieu Malaterre, Andreas Schwab, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 12b03558cef6d655d0d394f5e98a6fd07c1f6c0f ]
After commit 88078d98d1bb ("net: pskb_trim_rcsum() and CHECKSUM_COMPLETE
are friends"), sungem owners reported the infamous "eth0: hw csum failure"
message.
CHECKSUM_COMPLETE has in fact never worked for this driver, but this
was masked by the fact that upper stacks had to strip the FCS, and
therefore skb->ip_summed was set back to CHECKSUM_NONE before
my recent change.
Driver configures a number of bytes to skip when the chip computes
the checksum, and for some reason only half of the Ethernet header
was skipped.
Then a second problem is that we should strip the FCS by default,
unless the driver is updated to eventually support NETIF_F_RXFCS in
the future.
Finally, a driver should check if NETIF_F_RXCSUM feature is enabled
or not, so that the admin can turn off rx checksum if wanted.
Many thanks to Andreas Schwab and Mathieu Malaterre for their
help in debugging this issue.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Meelis Roos <mroos@linux.ee>
Reported-by: Mathieu Malaterre <malat@debian.org>
Reported-by: Andreas Schwab <schwab@linux-m68k.org>
Tested-by: Andreas Schwab <schwab@linux-m68k.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/sun/sungem.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
--- a/drivers/net/ethernet/sun/sungem.c
+++ b/drivers/net/ethernet/sun/sungem.c
@@ -60,8 +60,7 @@
#include <linux/sungem_phy.h>
#include "sungem.h"
-/* Stripping FCS is causing problems, disabled for now */
-#undef STRIP_FCS
+#define STRIP_FCS
#define DEFAULT_MSG (NETIF_MSG_DRV | \
NETIF_MSG_PROBE | \
@@ -435,7 +434,7 @@ static int gem_rxmac_reset(struct gem *g
writel(desc_dma & 0xffffffff, gp->regs + RXDMA_DBLOW);
writel(RX_RING_SIZE - 4, gp->regs + RXDMA_KICK);
val = (RXDMA_CFG_BASE | (RX_OFFSET << 10) |
- ((14 / 2) << 13) | RXDMA_CFG_FTHRESH_128);
+ (ETH_HLEN << 13) | RXDMA_CFG_FTHRESH_128);
writel(val, gp->regs + RXDMA_CFG);
if (readl(gp->regs + GREG_BIFCFG) & GREG_BIFCFG_M66EN)
writel(((5 & RXDMA_BLANK_IPKTS) |
@@ -760,7 +759,6 @@ static int gem_rx(struct gem *gp, int wo
struct net_device *dev = gp->dev;
int entry, drops, work_done = 0;
u32 done;
- __sum16 csum;
if (netif_msg_rx_status(gp))
printk(KERN_DEBUG "%s: rx interrupt, done: %d, rx_new: %d\n",
@@ -855,9 +853,13 @@ static int gem_rx(struct gem *gp, int wo
skb = copy_skb;
}
- csum = (__force __sum16)htons((status & RXDCTRL_TCPCSUM) ^ 0xffff);
- skb->csum = csum_unfold(csum);
- skb->ip_summed = CHECKSUM_COMPLETE;
+ if (likely(dev->features & NETIF_F_RXCSUM)) {
+ __sum16 csum;
+
+ csum = (__force __sum16)htons((status & RXDCTRL_TCPCSUM) ^ 0xffff);
+ skb->csum = csum_unfold(csum);
+ skb->ip_summed = CHECKSUM_COMPLETE;
+ }
skb->protocol = eth_type_trans(skb, gp->dev);
napi_gro_receive(&gp->napi, skb);
@@ -1755,7 +1757,7 @@ static void gem_init_dma(struct gem *gp)
writel(0, gp->regs + TXDMA_KICK);
val = (RXDMA_CFG_BASE | (RX_OFFSET << 10) |
- ((14 / 2) << 13) | RXDMA_CFG_FTHRESH_128);
+ (ETH_HLEN << 13) | RXDMA_CFG_FTHRESH_128);
writel(val, gp->regs + RXDMA_CFG);
writel(desc_dma >> 32, gp->regs + RXDMA_DBHI);
@@ -2973,8 +2975,8 @@ static int gem_init_one(struct pci_dev *
pci_set_drvdata(pdev, dev);
/* We can do scatter/gather and HW checksum */
- dev->hw_features = NETIF_F_SG | NETIF_F_HW_CSUM;
- dev->features |= dev->hw_features | NETIF_F_RXCSUM;
+ dev->hw_features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_RXCSUM;
+ dev->features = dev->hw_features;
if (pci_using_dac)
dev->features |= NETIF_F_HIGHDMA;
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 21/29] tcp: fix Fast Open key endianness
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 20/29] net: sungem: fix rx checksum support Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 23/29] vhost_net: validate sock before trying to put its fd Greg Kroah-Hartman
` (8 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniele Iamartino, Yuchung Cheng,
Eric Dumazet, Neal Cardwell, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuchung Cheng <ycheng@google.com>
[ Upstream commit c860e997e9170a6d68f9d1e6e2cf61f572191aaf ]
Fast Open key could be stored in different endian based on the CPU.
Previously hosts in different endianness in a server farm using
the same key config (sysctl value) would produce different cookies.
This patch fixes it by always storing it as little endian to keep
same API for LE hosts.
Reported-by: Daniele Iamartino <danielei@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/sysctl_net_ipv4.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -206,8 +206,9 @@ static int proc_tcp_fastopen_key(struct
{
struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) };
struct tcp_fastopen_context *ctxt;
- int ret;
u32 user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */
+ __le32 key[4];
+ int ret, i;
tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL);
if (!tbl.data)
@@ -216,11 +217,14 @@ static int proc_tcp_fastopen_key(struct
rcu_read_lock();
ctxt = rcu_dereference(tcp_fastopen_ctx);
if (ctxt)
- memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
+ memcpy(key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
else
- memset(user_key, 0, sizeof(user_key));
+ memset(key, 0, sizeof(key));
rcu_read_unlock();
+ for (i = 0; i < ARRAY_SIZE(key); i++)
+ user_key[i] = le32_to_cpu(key[i]);
+
snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x",
user_key[0], user_key[1], user_key[2], user_key[3]);
ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
@@ -236,12 +240,16 @@ static int proc_tcp_fastopen_key(struct
* first invocation of tcp_fastopen_cookie_gen
*/
tcp_fastopen_init_key_once(false);
- tcp_fastopen_reset_cipher(user_key, TCP_FASTOPEN_KEY_LENGTH);
+
+ for (i = 0; i < ARRAY_SIZE(user_key); i++)
+ key[i] = cpu_to_le32(user_key[i]);
+
+ tcp_fastopen_reset_cipher(key, TCP_FASTOPEN_KEY_LENGTH);
}
bad_key:
pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n",
- user_key[0], user_key[1], user_key[2], user_key[3],
+ user_key[0], user_key[1], user_key[2], user_key[3],
(char *)tbl.data, ret);
kfree(tbl.data);
return ret;
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 23/29] vhost_net: validate sock before trying to put its fd
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 21/29] tcp: fix Fast Open key endianness Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 24/29] net_sched: blackhole: tell upper qdisc about dropped packets Greg Kroah-Hartman
` (7 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jason Wang,
David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <jasowang@redhat.com>
[ Upstream commit b8f1f65882f07913157c44673af7ec0b308d03eb ]
Sock will be NULL if we pass -1 to vhost_net_set_backend(), but when
we meet errors during ubuf allocation, the code does not check for
NULL before calling sockfd_put(), this will lead NULL
dereferencing. Fixing by checking sock pointer before.
Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vhost/net.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -983,7 +983,8 @@ err_used:
if (ubufs)
vhost_net_ubuf_put_wait_and_free(ubufs);
err_ubufs:
- sockfd_put(sock);
+ if (sock)
+ sockfd_put(sock);
err_vq:
mutex_unlock(&vq->mutex);
err:
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 24/29] net_sched: blackhole: tell upper qdisc about dropped packets
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 23/29] vhost_net: validate sock before trying to put its fd Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 25/29] net/mlx5: Fix command interface race in polling mode Greg Kroah-Hartman
` (6 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konstantin Khlebnikov,
David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
[ Upstream commit 7e85dc8cb35abf16455f1511f0670b57c1a84608 ]
When blackhole is used on top of classful qdisc like hfsc it breaks
qlen and backlog counters because packets are disappear without notice.
In HFSC non-zero qlen while all classes are inactive triggers warning:
WARNING: ... at net/sched/sch_hfsc.c:1393 hfsc_dequeue+0xba4/0xe90 [sch_hfsc]
and schedules watchdog work endlessly.
This patch return __NET_XMIT_BYPASS in addition to NET_XMIT_SUCCESS,
this flag tells upper layer: this packet is gone and isn't queued.
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_blackhole.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sched/sch_blackhole.c
+++ b/net/sched/sch_blackhole.c
@@ -20,7 +20,7 @@
static int blackhole_enqueue(struct sk_buff *skb, struct Qdisc *sch)
{
qdisc_drop(skb, sch);
- return NET_XMIT_SUCCESS;
+ return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
}
static struct sk_buff *blackhole_dequeue(struct Qdisc *sch)
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 25/29] net/mlx5: Fix command interface race in polling mode
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 24/29] net_sched: blackhole: tell upper qdisc about dropped packets Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 26/29] netfilter: ebtables: reject non-bridge targets Greg Kroah-Hartman
` (5 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Vesker, Saeed Mahameed
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Vesker <valex@mellanox.com>
[ Upstream commit d412c31dae053bf30a1bc15582a9990df297a660 ]
The command interface can work in two modes: Events and Polling.
In the general case, each time we invoke a command, a work is
queued to handle it.
When working in events, the interrupt handler completes the
command execution. On the other hand, when working in polling
mode, the work itself completes it.
Due to a bug in the work handler, a command could have been
completed by the interrupt handler, while the work handler
hasn't finished yet, causing the it to complete once again
if the command interface mode was changed from Events to
polling after the interrupt handler was called.
mlx5_unload_one()
mlx5_stop_eqs()
// Destroy the EQ before cmd EQ
...cmd_work_handler()
write_doorbell()
--> EVENT_TYPE_CMD
mlx5_cmd_comp_handler() // First free
free_ent(cmd, ent->idx)
complete(&ent->done)
<-- mlx5_stop_eqs //cmd was complete
// move to polling before destroying the last cmd EQ
mlx5_cmd_use_polling()
cmd->mode = POLL;
--> cmd_work_handler (continues)
if (cmd->mode == POLL)
mlx5_cmd_comp_handler() // Double free
The solution is to store the cmd->mode before writing the doorbell.
Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: Alex Vesker <valex@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -480,6 +480,7 @@ static void cmd_work_handler(struct work
struct mlx5_core_dev *dev = container_of(cmd, struct mlx5_core_dev, cmd);
struct mlx5_cmd_layout *lay;
struct semaphore *sem;
+ int cmd_mode;
sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem;
down(sem);
@@ -513,13 +514,14 @@ static void cmd_work_handler(struct work
set_signature(ent, !cmd->checksum_disabled);
dump_command(dev, ent, 1);
ent->ts1 = ktime_get_ns();
+ cmd_mode = cmd->mode;
/* ring doorbell after the descriptor is valid */
wmb();
iowrite32be(1 << ent->idx, &dev->iseg->cmd_dbell);
mlx5_core_dbg(dev, "write 0x%x to command doorbell\n", 1 << ent->idx);
mmiowb();
- if (cmd->mode == CMD_MODE_POLLING) {
+ if (cmd_mode == CMD_MODE_POLLING) {
poll_timeout(ent);
/* make sure we read the descriptor after ownership is SW */
rmb();
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 26/29] netfilter: ebtables: reject non-bridge targets
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 25/29] net/mlx5: Fix command interface race in polling mode Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 27/29] KEYS: DNS: fix parsing multiple options Greg Kroah-Hartman
` (4 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+2b43f681169a2a0d306a,
Florian Westphal, Pablo Neira Ayuso
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 11ff7288beb2b7da889a014aff0a7b80bf8efcf3 upstream.
the ebtables evaluation loop expects targets to return
positive values (jumps), or negative values (absolute verdicts).
This is completely different from what xtables does.
In xtables, targets are expected to return the standard netfilter
verdicts, i.e. NF_DROP, NF_ACCEPT, etc.
ebtables will consider these as jumps.
Therefore reject any target found due to unspec fallback.
v2: also reject watchers. ebtables ignores their return value, so
a target that assumes skb ownership (and returns NF_STOLEN) causes
use-after-free.
The only watchers in the 'ebtables' front-end are log and nflog;
both have AF_BRIDGE specific wrappers on kernel side.
Reported-by: syzbot+2b43f681169a2a0d306a@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/netfilter/ebtables.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -402,6 +402,12 @@ ebt_check_watcher(struct ebt_entry_watch
watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0);
if (IS_ERR(watcher))
return PTR_ERR(watcher);
+
+ if (watcher->family != NFPROTO_BRIDGE) {
+ module_put(watcher->me);
+ return -ENOENT;
+ }
+
w->u.watcher = watcher;
par->target = watcher;
@@ -722,6 +728,13 @@ ebt_check_entry(struct ebt_entry *e, str
goto cleanup_watchers;
}
+ /* Reject UNSPEC, xtables verdicts/return values are incompatible */
+ if (target->family != NFPROTO_BRIDGE) {
+ module_put(target->me);
+ ret = -ENOENT;
+ goto cleanup_watchers;
+ }
+
t->u.target = target;
if (t->u.target == &ebt_standard_target) {
if (gap < sizeof(struct ebt_standard_target)) {
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 27/29] KEYS: DNS: fix parsing multiple options
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 26/29] netfilter: ebtables: reject non-bridge targets Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 28/29] rds: avoid unenecessary cong_update in loop transport Greg Kroah-Hartman
` (3 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot, Eric Biggers, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit c604cb767049b78b3075497b80ebb8fd530ea2cc upstream.
My recent fix for dns_resolver_preparse() printing very long strings was
incomplete, as shown by syzbot which still managed to hit the
WARN_ONCE() in set_precision() by adding a crafted "dns_resolver" key:
precision 50001 too large
WARNING: CPU: 7 PID: 864 at lib/vsprintf.c:2164 vsnprintf+0x48a/0x5a0
The bug this time isn't just a printing bug, but also a logical error
when multiple options ("#"-separated strings) are given in the key
payload. Specifically, when separating an option string into name and
value, if there is no value then the name is incorrectly considered to
end at the end of the key payload, rather than the end of the current
option. This bypasses validation of the option length, and also means
that specifying multiple options is broken -- which presumably has gone
unnoticed as there is currently only one valid option anyway.
A similar problem also applied to option values, as the kstrtoul() when
parsing the "dnserror" option will read past the end of the current
option and into the next option.
Fix these bugs by correctly computing the length of the option name and
by copying the option value, null-terminated, into a temporary buffer.
Reproducer for the WARN_ONCE() that syzbot hit:
perl -e 'print "#A#", "\0" x 50000' | keyctl padd dns_resolver desc @s
Reproducer for "dnserror" option being parsed incorrectly (expected
behavior is to fail when seeing the unknown option "foo", actual
behavior was to read the dnserror value as "1#foo" and fail there):
perl -e 'print "#dnserror=1#foo\0"' | keyctl padd dns_resolver desc @s
Reported-by: syzbot <syzkaller@googlegroups.com>
Fixes: 4a2d789267e0 ("DNS: If the DNS server returns an error, allow that to be cached [ver #2]")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dns_resolver/dns_key.c | 30 +++++++++++++++++-------------
1 file changed, 17 insertions(+), 13 deletions(-)
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -87,35 +87,39 @@ dns_resolver_preparse(struct key_prepars
opt++;
kdebug("options: '%s'", opt);
do {
+ int opt_len, opt_nlen;
const char *eq;
- int opt_len, opt_nlen, opt_vlen, tmp;
+ char optval[128];
next_opt = memchr(opt, '#', end - opt) ?: end;
opt_len = next_opt - opt;
- if (opt_len <= 0 || opt_len > 128) {
+ if (opt_len <= 0 || opt_len > sizeof(optval)) {
pr_warn_ratelimited("Invalid option length (%d) for dns_resolver key\n",
opt_len);
return -EINVAL;
}
- eq = memchr(opt, '=', opt_len) ?: end;
- opt_nlen = eq - opt;
- eq++;
- opt_vlen = next_opt - eq; /* will be -1 if no value */
-
- tmp = opt_vlen >= 0 ? opt_vlen : 0;
- kdebug("option '%*.*s' val '%*.*s'",
- opt_nlen, opt_nlen, opt, tmp, tmp, eq);
+ eq = memchr(opt, '=', opt_len);
+ if (eq) {
+ opt_nlen = eq - opt;
+ eq++;
+ memcpy(optval, eq, next_opt - eq);
+ optval[next_opt - eq] = '\0';
+ } else {
+ opt_nlen = opt_len;
+ optval[0] = '\0';
+ }
+
+ kdebug("option '%*.*s' val '%s'",
+ opt_nlen, opt_nlen, opt, optval);
/* see if it's an error number representing a DNS error
* that's to be recorded as the result in this key */
if (opt_nlen == sizeof(DNS_ERRORNO_OPTION) - 1 &&
memcmp(opt, DNS_ERRORNO_OPTION, opt_nlen) == 0) {
kdebug("dns error number option");
- if (opt_vlen <= 0)
- goto bad_option_value;
- ret = kstrtoul(eq, 10, &derrno);
+ ret = kstrtoul(optval, 10, &derrno);
if (ret < 0)
goto bad_option_value;
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 28/29] rds: avoid unenecessary cong_update in loop transport
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 27/29] KEYS: DNS: fix parsing multiple options Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 29/29] net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL Greg Kroah-Hartman
` (2 subsequent siblings)
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+4c20b3866171ce8441d2,
Sowmini Varadhan, Santosh Shilimkar, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Santosh Shilimkar <santosh.shilimkar@oracle.com>
commit f1693c63ab133d16994cc50f773982b5905af264 upstream.
Loop transport which is self loopback, remote port congestion
update isn't relevant. Infact the xmit path already ignores it.
Receive path needs to do the same.
Reported-by: syzbot+4c20b3866171ce8441d2@syzkaller.appspotmail.com
Reviewed-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rds/loop.c | 1 +
net/rds/rds.h | 5 +++++
net/rds/recv.c | 5 +++++
3 files changed, 11 insertions(+)
--- a/net/rds/loop.c
+++ b/net/rds/loop.c
@@ -191,4 +191,5 @@ struct rds_transport rds_loop_transport
.inc_copy_to_user = rds_message_inc_copy_to_user,
.inc_free = rds_loop_inc_free,
.t_name = "loopback",
+ .t_type = RDS_TRANS_LOOP,
};
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -381,6 +381,11 @@ struct rds_notifier {
int n_status;
};
+/* Available as part of RDS core, so doesn't need to participate
+ * in get_preferred transport etc
+ */
+#define RDS_TRANS_LOOP 3
+
/**
* struct rds_transport - transport specific behavioural hooks
*
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -76,6 +76,11 @@ static void rds_recv_rcvbuf_delta(struct
return;
rs->rs_rcv_bytes += delta;
+
+ /* loop transport doesn't send/recv congestion updates */
+ if (rs->rs_transport->t_type == RDS_TRANS_LOOP)
+ return;
+
now_congested = rs->rs_rcv_bytes > rds_sk_rcvbuf(rs);
rdsdebug("rs %p (%pI4:%u) recv bytes %d buf %d "
^ permalink raw reply [flat|nested] 34+ messages in thread* [PATCH 3.18 29/29] net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL.
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 28/29] rds: avoid unenecessary cong_update in loop transport Greg Kroah-Hartman
@ 2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 13:33 ` [PATCH 3.18 00/29] 3.18.116-stable review Nathan Chancellor
2018-07-21 13:38 ` Guenter Roeck
27 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-20 12:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, syzbot, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
commit 3bc53be9db21040b5d2de4d455f023c8c494aa68 upstream.
syzbot is reporting stalls at nfc_llcp_send_ui_frame() [1]. This is
because nfc_llcp_send_ui_frame() is retrying the loop without any delay
when nonblocking nfc_alloc_send_skb() returned NULL.
Since there is no need to use MSG_DONTWAIT if we retry until
sock_alloc_send_pskb() succeeds, let's use blocking call.
Also, in case an unexpected error occurred, let's break the loop
if blocking nfc_alloc_send_skb() failed.
[1] https://syzkaller.appspot.com/bug?id=4a131cc571c3733e0eff6bc673f4e36ae48f19c6
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+d29d18215e477cfbfbdd@syzkaller.appspotmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/nfc/llcp_commands.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -752,11 +752,14 @@ int nfc_llcp_send_ui_frame(struct nfc_ll
pr_debug("Fragment %zd bytes remaining %zd",
frag_len, remaining_len);
- pdu = nfc_alloc_send_skb(sock->dev, &sock->sk, MSG_DONTWAIT,
+ pdu = nfc_alloc_send_skb(sock->dev, &sock->sk, 0,
frag_len + LLCP_HEADER_SIZE, &err);
if (pdu == NULL) {
- pr_err("Could not allocate PDU\n");
- continue;
+ pr_err("Could not allocate PDU (error=%d)\n", err);
+ len -= remaining_len;
+ if (len == 0)
+ len = err;
+ break;
}
pdu = llcp_add_header(pdu, dsap, ssap, LLCP_PDU_UI);
^ permalink raw reply [flat|nested] 34+ messages in thread* Re: [PATCH 3.18 00/29] 3.18.116-stable review
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2018-07-20 12:11 ` [PATCH 3.18 29/29] net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL Greg Kroah-Hartman
@ 2018-07-20 13:33 ` Nathan Chancellor
2018-07-21 13:38 ` Guenter Roeck
27 siblings, 0 replies; 34+ messages in thread
From: Nathan Chancellor @ 2018-07-20 13:33 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
On Fri, Jul 20, 2018 at 02:10:55PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.18.116 release.
> There are 29 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Jul 22 11:51:47 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.116-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Merged, compiled with -Werror, and installed onto my Pixel XL.
No initial issues noticed in dmesg or general usage.
Thanks!
Nathan
^ permalink raw reply [flat|nested] 34+ messages in thread* Re: [PATCH 3.18 00/29] 3.18.116-stable review
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2018-07-20 13:33 ` [PATCH 3.18 00/29] 3.18.116-stable review Nathan Chancellor
@ 2018-07-21 13:38 ` Guenter Roeck
2018-07-22 11:42 ` Greg Kroah-Hartman
27 siblings, 1 reply; 34+ messages in thread
From: Guenter Roeck @ 2018-07-21 13:38 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, shuah, patches, ben.hutchings, lkft-triage,
stable
On 07/20/2018 05:10 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.18.116 release.
> There are 29 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Jul 22 11:51:47 UTC 2018.
> Anything received after that time might be too late.
>
Build results:
total: 138 pass: 138 fail: 0
Qemu test results:
total: 132 pass: 132 fail: 0
Details are available at http://kerneltests.org/builders/.
Guenter
^ permalink raw reply [flat|nested] 34+ messages in thread* Re: [PATCH 3.18 00/29] 3.18.116-stable review
2018-07-21 13:38 ` Guenter Roeck
@ 2018-07-22 11:42 ` Greg Kroah-Hartman
0 siblings, 0 replies; 34+ messages in thread
From: Greg Kroah-Hartman @ 2018-07-22 11:42 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
lkft-triage, stable
On Sat, Jul 21, 2018 at 06:38:45AM -0700, Guenter Roeck wrote:
> On 07/20/2018 05:10 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.18.116 release.
> > There are 29 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sun Jul 22 11:51:47 UTC 2018.
> > Anything received after that time might be too late.
> >
>
> Build results:
> total: 138 pass: 138 fail: 0
> Qemu test results:
> total: 132 pass: 132 fail: 0
>
> Details are available at http://kerneltests.org/builders/.
Great! Thanks for testing all of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 34+ messages in thread