* [PATCH net-next] net: gemini: fix spelling mistake: "it" -> "is"
From: YueHaibing @ 2018-06-03 8:10 UTC (permalink / raw)
To: davem, linus.walleij; +Cc: netdev, linux-kernel, YueHaibing
Trivial fix to spelling mistake in gemini dev_warn message
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
---
drivers/net/ethernet/cortina/gemini.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index bd3f6e4..ff9eb45 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -539,7 +539,7 @@ static int gmac_setup_txqs(struct net_device *netdev)
}
if (port->txq_dma_base & ~DMA_Q_BASE_MASK) {
- dev_warn(geth->dev, "TX queue base it not aligned\n");
+ dev_warn(geth->dev, "TX queue base is not aligned\n");
kfree(skb_tab);
return -ENOMEM;
}
@@ -680,7 +680,7 @@ static int gmac_setup_rxq(struct net_device *netdev)
if (!port->rxq_ring)
return -ENOMEM;
if (port->rxq_dma_base & ~NONTOE_QHDR0_BASE_MASK) {
- dev_warn(geth->dev, "RX queue base it not aligned\n");
+ dev_warn(geth->dev, "RX queue base is not aligned\n");
return -ENOMEM;
}
@@ -905,7 +905,7 @@ static int geth_setup_freeq(struct gemini_ethernet *geth)
if (!geth->freeq_ring)
return -ENOMEM;
if (geth->freeq_dma_base & ~DMA_Q_BASE_MASK) {
- dev_warn(geth->dev, "queue ring base it not aligned\n");
+ dev_warn(geth->dev, "queue ring base is not aligned\n");
goto err_freeq;
}
--
2.7.0
^ permalink raw reply related
* [PATCH] net: ipw2x00: Replace NULL comparison with !priv
From: Varsha Rao @ 2018-06-03 11:11 UTC (permalink / raw)
To: Stanislav Yakovlev, Kalle Valo, David S. Miller, linux-wireless,
netdev, linux-kernel, Nicholas Mc Guire, Lukas Bulwahn
Cc: Varsha Rao
Remove extra parentheses and replace NULL comparison with !priv, to fix
clang warning of extraneous parentheses and check patch issue. Following
coccinelle script is used to fix it.
@disable is_null,paren@
expression e;
statement s;
@@
if (
- (e==NULL)
+!e
)
s
Signed-off-by: Varsha Rao <rvarsha016@gmail.com>
---
drivers/net/wireless/intel/ipw2x00/ipw2200.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
index 87a5e414c2f7..7d55bb09413b 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
@@ -7112,7 +7112,7 @@ static u32 ipw_qos_get_burst_duration(struct ipw_priv *priv)
{
u32 ret = 0;
- if ((priv == NULL))
+ if (!priv)
return 0;
if (!(priv->ieee->modulation & LIBIPW_OFDM_MODULATION))
--
2.17.0
^ permalink raw reply related
* [PATCH 0/2] net: bnx2: Fix checkpatch and clang warnings
From: Varsha Rao @ 2018-06-03 11:48 UTC (permalink / raw)
To: Rasesh Mody, Harish Patil, Dept-GELinuxNICDev, David S. Miller,
netdev, linux-kernel, Nicholas Mc Guire, Lukas Bulwahn
Cc: Varsha Rao
This patchset fixes NULL comparison and extra parentheses, checkpatch
and clang warnings.
Varsha Rao (2):
net: ethernet: bnx2: Remove extra parentheses
net: ethernet: bnx2: Replace NULL comparison
drivers/net/ethernet/broadcom/bnx2.c | 44 ++++++++++++++--------------
1 file changed, 22 insertions(+), 22 deletions(-)
--
2.17.0
^ permalink raw reply
* [PATCH 1/2] net: ethernet: bnx2: Remove extra parentheses
From: Varsha Rao @ 2018-06-03 11:49 UTC (permalink / raw)
To: Rasesh Mody, Harish Patil, Dept-GELinuxNICDev, David S. Miller,
netdev, linux-kernel, Nicholas Mc Guire, Lukas Bulwahn
Cc: Varsha Rao
In-Reply-To: <cover.1528025568.git.rvarsha016@gmail.com>
The following coccinelle script removes extra parentheses to fix the
clang warning of extraneous parentheses.
@disable paren@
identifier i;
expression e;
statement s;
@@
if (
-(i == e)
+i == e
)
s
Suggested-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Varsha Rao <rvarsha016@gmail.com>
---
drivers/net/ethernet/broadcom/bnx2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 9ffc4a8c5fc7..2306523778d4 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -3285,7 +3285,7 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
sw_cons = BNX2_NEXT_RX_BD(sw_cons);
sw_prod = BNX2_NEXT_RX_BD(sw_prod);
- if ((rx_pkt == budget))
+ if (rx_pkt == budget)
break;
/* Refresh hw_cons to see if there is new work */
--
2.17.0
^ permalink raw reply related
* [PATCH 2/2] net: ethernet: bnx2: Replace NULL comparison
From: Varsha Rao @ 2018-06-03 11:49 UTC (permalink / raw)
To: Rasesh Mody, Harish Patil, Dept-GELinuxNICDev, David S. Miller,
netdev, linux-kernel, Nicholas Mc Guire, Lukas Bulwahn
Cc: Varsha Rao
In-Reply-To: <cover.1528025568.git.rvarsha016@gmail.com>
This patch fixes the checkpatch issue of NULL comparison. Replace x == NULL
with !x, by using the following coccinelle script:
@disable is_null@
expression e;
@@
-e==NULL
+!e
Signed-off-by: Varsha Rao <rvarsha016@gmail.com>
---
drivers/net/ethernet/broadcom/bnx2.c | 42 ++++++++++++++--------------
1 file changed, 21 insertions(+), 21 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 2306523778d4..3853296d78c1 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -384,7 +384,7 @@ static int bnx2_register_cnic(struct net_device *dev, struct cnic_ops *ops,
struct bnx2 *bp = netdev_priv(dev);
struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
- if (ops == NULL)
+ if (!ops)
return -EINVAL;
if (cp->drv_state & CNIC_DRV_STATE_REGD)
@@ -755,13 +755,13 @@ bnx2_alloc_tx_mem(struct bnx2 *bp)
struct bnx2_tx_ring_info *txr = &bnapi->tx_ring;
txr->tx_buf_ring = kzalloc(SW_TXBD_RING_SIZE, GFP_KERNEL);
- if (txr->tx_buf_ring == NULL)
+ if (!txr->tx_buf_ring)
return -ENOMEM;
txr->tx_desc_ring =
dma_alloc_coherent(&bp->pdev->dev, TXBD_RING_SIZE,
&txr->tx_desc_mapping, GFP_KERNEL);
- if (txr->tx_desc_ring == NULL)
+ if (!txr->tx_desc_ring)
return -ENOMEM;
}
return 0;
@@ -779,7 +779,7 @@ bnx2_alloc_rx_mem(struct bnx2 *bp)
rxr->rx_buf_ring =
vzalloc(SW_RXBD_RING_SIZE * bp->rx_max_ring);
- if (rxr->rx_buf_ring == NULL)
+ if (!rxr->rx_buf_ring)
return -ENOMEM;
for (j = 0; j < bp->rx_max_ring; j++) {
@@ -788,7 +788,7 @@ bnx2_alloc_rx_mem(struct bnx2 *bp)
RXBD_RING_SIZE,
&rxr->rx_desc_mapping[j],
GFP_KERNEL);
- if (rxr->rx_desc_ring[j] == NULL)
+ if (!rxr->rx_desc_ring[j])
return -ENOMEM;
}
@@ -796,7 +796,7 @@ bnx2_alloc_rx_mem(struct bnx2 *bp)
if (bp->rx_pg_ring_size) {
rxr->rx_pg_ring = vzalloc(SW_RXPG_RING_SIZE *
bp->rx_max_pg_ring);
- if (rxr->rx_pg_ring == NULL)
+ if (!rxr->rx_pg_ring)
return -ENOMEM;
}
@@ -807,7 +807,7 @@ bnx2_alloc_rx_mem(struct bnx2 *bp)
RXBD_RING_SIZE,
&rxr->rx_pg_desc_mapping[j],
GFP_KERNEL);
- if (rxr->rx_pg_desc_ring[j] == NULL)
+ if (!rxr->rx_pg_desc_ring[j])
return -ENOMEM;
}
@@ -845,7 +845,7 @@ bnx2_alloc_stats_blk(struct net_device *dev)
sizeof(struct statistics_block);
status_blk = dma_zalloc_coherent(&bp->pdev->dev, bp->status_stats_size,
&bp->status_blk_mapping, GFP_KERNEL);
- if (status_blk == NULL)
+ if (!status_blk)
return -ENOMEM;
bp->status_blk = status_blk;
@@ -914,7 +914,7 @@ bnx2_alloc_mem(struct bnx2 *bp)
BNX2_PAGE_SIZE,
&bp->ctx_blk_mapping[i],
GFP_KERNEL);
- if (bp->ctx_blk[i] == NULL)
+ if (!bp->ctx_blk[i])
goto alloc_mem_err;
}
}
@@ -2667,7 +2667,7 @@ bnx2_alloc_bad_rbuf(struct bnx2 *bp)
u32 val;
good_mbuf = kmalloc(512 * sizeof(u16), GFP_KERNEL);
- if (good_mbuf == NULL)
+ if (!good_mbuf)
return -ENOMEM;
BNX2_WR(bp, BNX2_MISC_ENABLE_SET_BITS,
@@ -3225,7 +3225,7 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
if (len <= bp->rx_copy_thresh) {
skb = netdev_alloc_skb(bp->dev, len + 6);
- if (skb == NULL) {
+ if (!skb) {
bnx2_reuse_rx_data(bp, rxr, data, sw_ring_cons,
sw_ring_prod);
goto next_rx;
@@ -4561,7 +4561,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
if (align_start || align_end) {
align_buf = kmalloc(len32, GFP_KERNEL);
- if (align_buf == NULL)
+ if (!align_buf)
return -ENOMEM;
if (align_start) {
memcpy(align_buf, start, 4);
@@ -4575,7 +4575,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
if (!(bp->flash_info->flags & BNX2_NV_BUFFERED)) {
flash_buffer = kmalloc(264, GFP_KERNEL);
- if (flash_buffer == NULL) {
+ if (!flash_buffer) {
rc = -ENOMEM;
goto nvram_write_end;
}
@@ -5440,7 +5440,7 @@ bnx2_free_tx_skbs(struct bnx2 *bp)
struct bnx2_tx_ring_info *txr = &bnapi->tx_ring;
int j;
- if (txr->tx_buf_ring == NULL)
+ if (!txr->tx_buf_ring)
continue;
for (j = 0; j < BNX2_TX_DESC_CNT; ) {
@@ -5448,7 +5448,7 @@ bnx2_free_tx_skbs(struct bnx2 *bp)
struct sk_buff *skb = tx_buf->skb;
int k, last;
- if (skb == NULL) {
+ if (!skb) {
j = BNX2_NEXT_TX_BD(j);
continue;
}
@@ -5485,14 +5485,14 @@ bnx2_free_rx_skbs(struct bnx2 *bp)
struct bnx2_rx_ring_info *rxr = &bnapi->rx_ring;
int j;
- if (rxr->rx_buf_ring == NULL)
+ if (!rxr->rx_buf_ring)
return;
for (j = 0; j < bp->rx_max_ring_idx; j++) {
struct bnx2_sw_bd *rx_buf = &rxr->rx_buf_ring[j];
u8 *data = rx_buf->data;
- if (data == NULL)
+ if (!data)
continue;
dma_unmap_single(&bp->pdev->dev,
@@ -6826,7 +6826,7 @@ bnx2_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *net_stats)
{
struct bnx2 *bp = netdev_priv(dev);
- if (bp->stats_blk == NULL)
+ if (!bp->stats_blk)
return;
net_stats->rx_packets =
@@ -7217,7 +7217,7 @@ bnx2_get_eeprom_len(struct net_device *dev)
{
struct bnx2 *bp = netdev_priv(dev);
- if (bp->flash_info == NULL)
+ if (!bp->flash_info)
return 0;
return (int) bp->flash_size;
@@ -7678,7 +7678,7 @@ bnx2_get_ethtool_stats(struct net_device *dev,
u32 *temp_stats = (u32 *) bp->temp_stats_blk;
u8 *stats_len_arr = NULL;
- if (hw_stats == NULL) {
+ if (!hw_stats) {
memset(buf, 0, sizeof(u64) * BNX2_NUM_STATS);
return;
}
@@ -8121,7 +8121,7 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
bp->temp_stats_blk =
kzalloc(sizeof(struct statistics_block), GFP_KERNEL);
- if (bp->temp_stats_blk == NULL) {
+ if (!bp->temp_stats_blk) {
rc = -ENOMEM;
goto err_out;
}
--
2.17.0
^ permalink raw reply related
* [PATCH net] net: ipv6: prevent use after free in ip6_route_mpath_notify()
From: Eric Dumazet @ 2018-06-03 13:35 UTC (permalink / raw)
To: David S . Miller; +Cc: netdev, Eric Dumazet, Eric Dumazet, David Ahern
syzbot reported a use-after-free [1]
Issue here is that rt_last might have been freed already.
We need to grab a refcount on it to prevent this.
[1]
BUG: KASAN: use-after-free in ip6_route_mpath_notify+0xe9/0x100 net/ipv6/route.c:4180
Read of size 4 at addr ffff8801bf789cf0 by task syz-executor756/4555
CPU: 1 PID: 4555 Comm: syz-executor756 Not tainted 4.17.0-rc7+ #78
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b9/0x294 lib/dump_stack.c:113
print_address_description+0x6c/0x20b mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
ip6_route_mpath_notify+0xe9/0x100 net/ipv6/route.c:4180
ip6_route_multipath_add+0x615/0x1910 net/ipv6/route.c:4303
inet6_rtm_newroute+0xe3/0x160 net/ipv6/route.c:4391
rtnetlink_rcv_msg+0x466/0xc10 net/core/rtnetlink.c:4646
netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2448
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4664
netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
netlink_unicast+0x58b/0x740 net/netlink/af_netlink.c:1336
netlink_sendmsg+0x9f0/0xfa0 net/netlink/af_netlink.c:1901
sock_sendmsg_nosec net/socket.c:629 [inline]
sock_sendmsg+0xd5/0x120 net/socket.c:639
___sys_sendmsg+0x805/0x940 net/socket.c:2117
__sys_sendmsg+0x115/0x270 net/socket.c:2155
__do_sys_sendmsg net/socket.c:2164 [inline]
__se_sys_sendmsg net/socket.c:2162 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2162
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441819
RSP: 002b:00007ffe841e19d8 EFLAGS: 00000217 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441819
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000004
RBP: 00000000006cd018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000402510
R13: 00000000004025a0 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 4555:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
kmem_cache_alloc+0x12e/0x760 mm/slab.c:3554
dst_alloc+0xbb/0x1d0 net/core/dst.c:104
__ip6_dst_alloc+0x35/0xa0 net/ipv6/route.c:361
ip6_dst_alloc+0x29/0xb0 net/ipv6/route.c:376
ip6_route_info_create+0x4d4/0x3a30 net/ipv6/route.c:2834
ip6_route_multipath_add+0xc7e/0x1910 net/ipv6/route.c:4240
inet6_rtm_newroute+0xe3/0x160 net/ipv6/route.c:4391
rtnetlink_rcv_msg+0x466/0xc10 net/core/rtnetlink.c:4646
netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2448
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4664
netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
netlink_unicast+0x58b/0x740 net/netlink/af_netlink.c:1336
netlink_sendmsg+0x9f0/0xfa0 net/netlink/af_netlink.c:1901
sock_sendmsg_nosec net/socket.c:629 [inline]
sock_sendmsg+0xd5/0x120 net/socket.c:639
___sys_sendmsg+0x805/0x940 net/socket.c:2117
__sys_sendmsg+0x115/0x270 net/socket.c:2155
__do_sys_sendmsg net/socket.c:2164 [inline]
__se_sys_sendmsg net/socket.c:2162 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2162
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 4555:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3498 [inline]
kmem_cache_free+0x86/0x2d0 mm/slab.c:3756
dst_destroy+0x267/0x3c0 net/core/dst.c:140
dst_release_immediate+0x71/0x9e net/core/dst.c:205
fib6_add+0xa40/0x1650 net/ipv6/ip6_fib.c:1305
__ip6_ins_rt+0x6c/0x90 net/ipv6/route.c:1011
ip6_route_multipath_add+0x513/0x1910 net/ipv6/route.c:4267
inet6_rtm_newroute+0xe3/0x160 net/ipv6/route.c:4391
rtnetlink_rcv_msg+0x466/0xc10 net/core/rtnetlink.c:4646
netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2448
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4664
netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
netlink_unicast+0x58b/0x740 net/netlink/af_netlink.c:1336
netlink_sendmsg+0x9f0/0xfa0 net/netlink/af_netlink.c:1901
sock_sendmsg_nosec net/socket.c:629 [inline]
sock_sendmsg+0xd5/0x120 net/socket.c:639
___sys_sendmsg+0x805/0x940 net/socket.c:2117
__sys_sendmsg+0x115/0x270 net/socket.c:2155
__do_sys_sendmsg net/socket.c:2164 [inline]
__se_sys_sendmsg net/socket.c:2162 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2162
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8801bf789c40
which belongs to the cache ip6_dst_cache of size 320
The buggy address is located 176 bytes inside of
320-byte region [ffff8801bf789c40, ffff8801bf789d80)
The buggy address belongs to the page:
page:ffffea0006fde240 count:1 mapcount:0 mapping:ffff8801bf789040 index:0x0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffff8801bf789040 0000000000000000 000000010000000a
raw: ffffea0006f92f20 ffff8801cd9e7248 ffff8801cda00c40 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801bf789b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8801bf789c00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
>ffff8801bf789c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8801bf789d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801bf789d80: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
Fixes: 3b1137fe7482 ("net: ipv6: Change notifications for multipath add to RTA_MULTIPATH")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: David Ahern <dsa@cumulusnetworks.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
---
net/ipv6/route.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f4d61736c41abe8cd7f439c4a37100e90c1eacca..830eefdbdb6734eb81ea0322fb6077ee20be1889 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -4263,7 +4263,9 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
err_nh = NULL;
list_for_each_entry(nh, &rt6_nh_list, next) {
+ dst_release(&rt_last->dst);
rt_last = nh->rt6_info;
+ dst_hold(&rt_last->dst);
err = __ip6_ins_rt(nh->rt6_info, info, &nh->mxc, extack);
/* save reference to first route for notification */
if (!rt_notif && !err)
@@ -4317,7 +4319,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
list_del(&nh->next);
kfree(nh);
}
-
+ dst_release(&rt_last->dst);
return err;
}
--
2.17.1.1185.g55be947832-goog
^ permalink raw reply related
* Re: [PATCH net] net: ipv6: prevent use after free in ip6_route_mpath_notify()
From: David Ahern @ 2018-06-03 14:01 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller; +Cc: netdev, Eric Dumazet
In-Reply-To: <20180603133546.28635-1-edumazet@google.com>
On 6/3/18 7:35 AM, Eric Dumazet wrote:
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index f4d61736c41abe8cd7f439c4a37100e90c1eacca..830eefdbdb6734eb81ea0322fb6077ee20be1889 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -4263,7 +4263,9 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
>
> err_nh = NULL;
> list_for_each_entry(nh, &rt6_nh_list, next) {
> + dst_release(&rt_last->dst);
> rt_last = nh->rt6_info;
> + dst_hold(&rt_last->dst);
> err = __ip6_ins_rt(nh->rt6_info, info, &nh->mxc, extack);
> /* save reference to first route for notification */
> if (!rt_notif && !err)
> @@ -4317,7 +4319,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
> list_del(&nh->next);
> kfree(nh);
> }
> -
> + dst_release(&rt_last->dst);
> return err;
> }
Since the rtnl lock is held, a successfully inserted route can not be
removed until ip6_route_multipath_add finishes. This is a simpler change
that works with net-next as well:
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f4d61736c41a..1684197c189f 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -4263,11 +4263,12 @@ static int ip6_route_multipath_add(struct
fib6_config *cfg,
err_nh = NULL;
list_for_each_entry(nh, &rt6_nh_list, next) {
- rt_last = nh->rt6_info;
err = __ip6_ins_rt(nh->rt6_info, info, &nh->mxc, extack);
/* save reference to first route for notification */
if (!rt_notif && !err)
rt_notif = nh->rt6_info;
+ if (!err)
+ rt_last = nh->rt6_info;
/* nh->rt6_info is used or freed at this point, reset to
NULL*/
nh->rt6_info = NULL;
Is there a reproducer for the syzbot case?
^ permalink raw reply related
* Re: [PATCH 0/9,v2] Netfilter updates for net-next
From: David Miller @ 2018-06-03 14:31 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
In-Reply-To: <20180602232539.10574-1-pablo@netfilter.org>
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sun, 3 Jun 2018 01:25:39 +0200
> The following patchset contains Netfilter updates for your net-next tree:
>
> 1) Get rid of nf_sk_is_transparent(), use inet_sk_transparent() instead.
> From Máté Eckl.
>
> 2) Move shared tproxy infrastructure to nf_tproxy_ipv4 and nf_tproxy_ipv6.
> Also from Máté.
>
> 3) Add hashtable to speed up chain lookups by name, from Florian Westphal.
>
> 4) Patch series to add connlimit support reusing part of the
> nf_conncount infrastructure. This includes preparation changes such
> passing context to the object and expression destroy interface;
> garbage collection for expressions embedded into set elements, and
> the introduction of the clone_destroy interface for expressions.
>
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git
Pulled, thanks.
^ permalink raw reply
* Re: [PATCH net] net: ipv6: prevent use after free in ip6_route_mpath_notify()
From: Eric Dumazet @ 2018-06-03 14:31 UTC (permalink / raw)
To: David Ahern, Eric Dumazet, David S . Miller; +Cc: netdev
In-Reply-To: <4b46d531-904b-6e5f-67ce-a275f0826d47@cumulusnetworks.com>
On 06/03/2018 07:01 AM, David Ahern wrote:
> On 6/3/18 7:35 AM, Eric Dumazet wrote:
>> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
>> index f4d61736c41abe8cd7f439c4a37100e90c1eacca..830eefdbdb6734eb81ea0322fb6077ee20be1889 100644
>> --- a/net/ipv6/route.c
>> +++ b/net/ipv6/route.c
>> @@ -4263,7 +4263,9 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
>>
>> err_nh = NULL;
>> list_for_each_entry(nh, &rt6_nh_list, next) {
>> + dst_release(&rt_last->dst);
>> rt_last = nh->rt6_info;
>> + dst_hold(&rt_last->dst);
>> err = __ip6_ins_rt(nh->rt6_info, info, &nh->mxc, extack);
>> /* save reference to first route for notification */
>> if (!rt_notif && !err)
>> @@ -4317,7 +4319,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
>> list_del(&nh->next);
>> kfree(nh);
>> }
>> -
>> + dst_release(&rt_last->dst);
>> return err;
>> }
>
> Since the rtnl lock is held, a successfully inserted route can not be
> removed until ip6_route_multipath_add finishes. This is a simpler change
> that works with net-next as well:
Your patch changes the intent of your original commit.
It seems you wanted rt_last to point to the last attempted insertion,
not the last successful one ?
Or have I misunderstood, and not only we had a use-after-free, but also
a semantic error ?
>
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index f4d61736c41a..1684197c189f 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -4263,11 +4263,12 @@ static int ip6_route_multipath_add(struct
> fib6_config *cfg,
>
> err_nh = NULL;
> list_for_each_entry(nh, &rt6_nh_list, next) {
> - rt_last = nh->rt6_info;
> err = __ip6_ins_rt(nh->rt6_info, info, &nh->mxc, extack);
> /* save reference to first route for notification */
> if (!rt_notif && !err)
> rt_notif = nh->rt6_info;
> + if (!err)
> + rt_last = nh->rt6_info;
>
> /* nh->rt6_info is used or freed at this point, reset to
> NULL*/
> nh->rt6_info = NULL;
>
>
> Is there a reproducer for the syzbot case?
Not yet.
^ permalink raw reply
* Re: [PATCH v5 net] stmmac: 802.1ad tag stripping fix
From: David Miller @ 2018-06-03 14:33 UTC (permalink / raw)
To: eladv6
Cc: makita.toshiaki, Jose.Abreu, f.fainelli, netdev, peppe.cavallaro,
alexandre.torgue
In-Reply-To: <113191f7-ad35-151f-3414-a2342ff0e13c@gmail.com>
From: Elad Nachman <eladv6@gmail.com>
Date: Wed, 30 May 2018 08:48:25 +0300
> static void stmmac_rx_vlan(struct net_device *dev, struct sk_buff *skb)
> {
> - struct ethhdr *ehdr;
> + struct vlan_ethhdr *veth;
> u16 vlanid;
> + __be16 vlan_proto;
Please order local variables from longest to shortest line.
>
> - if ((dev->features & NETIF_F_HW_VLAN_CTAG_RX) ==
> - NETIF_F_HW_VLAN_CTAG_RX &&
> - !__vlan_get_tag(skb, &vlanid)) {
> + if (!__vlan_get_tag(skb, &vlanid)) {
> /* pop the vlan tag */
> - ehdr = (struct ethhdr *)skb->data;
> - memmove(skb->data + VLAN_HLEN, ehdr, ETH_ALEN * 2);
> + veth = (struct vlan_ethhdr *)skb->data;
> + vlan_proto = veth->h_vlan_proto;
> + memmove(skb->data + VLAN_HLEN, veth, ETH_ALEN * 2);
> skb_pull(skb, VLAN_HLEN);
> - __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlanid);
> + __vlan_hwaccel_put_tag(skb, vlan_proto, vlanid);
> }
> }
I can't see how it is valid to do an unconditional software VLAN
untagging even when VLAN is disabled in the kernel config or the
NETIF_F_* feature bits are not set.
At a minimum that feature test has to stay there, and when it's clear
we let the generic VLAN code untag the packet.
^ permalink raw reply
* Re: [PATCH net-next] net: phy: consider PHY_IGNORE_INTERRUPT in state machine PHY_NOLINK handling
From: David Miller @ 2018-06-03 14:33 UTC (permalink / raw)
To: hkallweit1; +Cc: f.fainelli, andrew, netdev
In-Reply-To: <0a4e472d-cb7f-ef1f-420c-1327fa41e8cd@gmail.com>
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Wed, 30 May 2018 22:13:20 +0200
> We can bail out immediately also in case of PHY_IGNORE_INTERRUPT because
> phy_mac_interupt() informs us once the link is up.
>
> Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Applied, thanks.
^ permalink raw reply
* Re: [PATCH net] vrf: check the original netdevice for generating redirect
From: David Miller @ 2018-06-03 14:34 UTC (permalink / raw)
To: ssuryaextr; +Cc: netdev, dsa
In-Reply-To: <1527825921-17677-1-git-send-email-ssuryaextr@gmail.com>
From: Stephen Suryaputra <ssuryaextr@gmail.com>
Date: Fri, 1 Jun 2018 00:05:21 -0400
> Use the right device to determine if redirect should be sent especially
> when using vrf. Same as well as when sending the redirect.
>
> Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>
David A., please review.
^ permalink raw reply
* Re: [PATCH net-next] hv_netvsc: fix error return code in netvsc_probe()
From: David Miller @ 2018-06-03 14:35 UTC (permalink / raw)
To: weiyongjun1
Cc: kys, haiyangz, sthemmin, sridhar.samudrala, devel, netdev,
kernel-janitors
In-Reply-To: <1527732283-145530-1-git-send-email-weiyongjun1@huawei.com>
From: Wei Yongjun <weiyongjun1@huawei.com>
Date: Thu, 31 May 2018 02:04:43 +0000
> Fix to return a negative error code from the failover register fail
> error handling case instead of 0, as done elsewhere in this function.
>
> Fixes: 1ff78076d8dd ("netvsc: refactor notifier/event handling code to use the failover framework")
> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Applied, thank you.
^ permalink raw reply
* Re: [PATCH net-next] net/mlx5: Make function mlx5_fpga_tls_send_teardown_cmd() static
From: David Miller @ 2018-06-03 14:36 UTC (permalink / raw)
To: weiyongjun1
Cc: borisp, saeedm, leon, ilyal, netdev, linux-rdma, kernel-janitors
In-Reply-To: <1527733872-149077-1-git-send-email-weiyongjun1@huawei.com>
From: Wei Yongjun <weiyongjun1@huawei.com>
Date: Thu, 31 May 2018 02:31:12 +0000
> Fixes the following sparse warning:
>
> drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c:199:6: warning:
> symbol 'mlx5_fpga_tls_send_teardown_cmd' was not declared. Should it be static?
>
> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Applied.
^ permalink raw reply
* Re: [PATCH net-next] net/smc: fix error return code in smc_setsockopt()
From: David Miller @ 2018-06-03 14:39 UTC (permalink / raw)
To: weiyongjun1; +Cc: ubraun, linux-s390, netdev, kernel-janitors
In-Reply-To: <1527733882-149144-1-git-send-email-weiyongjun1@huawei.com>
From: Wei Yongjun <weiyongjun1@huawei.com>
Date: Thu, 31 May 2018 02:31:22 +0000
> Fix to return error code -EINVAL instead of 0 if optlen is invalid.
>
> Fixes: 01d2f7e2cdd3 ("net/smc: sockopts TCP_NODELAY and TCP_CORK")
> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Although the TCP code should be checking this in the previous lines,
it's not good practice to depend so tightly upon that.
And it makes this code easier to audit if the check exists here
explicitly too.
So I'll apply this, thanks.
^ permalink raw reply
* Re: [PATCH net-next] net: netcp: ethss: remove unnecessary pointer set to NULL
From: David Miller @ 2018-06-03 14:40 UTC (permalink / raw)
To: yuehaibing; +Cc: w-kwok2, m-karicheri2, netdev, linux-kernel
In-Reply-To: <20180531034848.23080-1-yuehaibing@huawei.com>
From: YueHaibing <yuehaibing@huawei.com>
Date: Thu, 31 May 2018 11:48:48 +0800
> If statement has make sure the 'slave->phy' is NULL
>
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Looks good, applied.
^ permalink raw reply
* Re: [PATCH net] net: ipv6: prevent use after free in ip6_route_mpath_notify()
From: David Ahern @ 2018-06-03 14:40 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller; +Cc: netdev, Eric Dumazet
In-Reply-To: <4b46d531-904b-6e5f-67ce-a275f0826d47@cumulusnetworks.com>
On 6/3/18 8:01 AM, David Ahern wrote:
> Is there a reproducer for the syzbot case?
One reproducer is to insert a route and then add a multipath route that
has a duplicate nexthop.e.g,:
ip -6 ro add vrf red 2001:db8:101::/64 nexthop via 2001:db8:1::2
ip -6 ro append vrf red 2001:db8:101::/64 nexthop via 2001:db8:1::4
nexthop via 2001:db8:1::2
Current net and next-next generates the trace; with the fix I proposed I
don't see it on either branch and I do see the expected notifications to
userspace.
^ permalink raw reply
* Re: [PATCH net-next] net/ncsi: Avoid GFP_KERNEL in response handler
From: David Miller @ 2018-06-03 14:42 UTC (permalink / raw)
To: sam; +Cc: netdev, linux-kernel, openbmc
In-Reply-To: <20180531070254.28878-1-sam@mendozajonas.com>
From: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Date: Thu, 31 May 2018 17:02:54 +1000
> ncsi_rsp_handler_gc() allocates the filter arrays using GFP_KERNEL in
> softirq context, causing the below backtrace. This allocation is only a
> few dozen bytes during probing so allocate with GFP_ATOMIC instead.
...
> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Applied with Fixes: tag added, thanks.
^ permalink raw reply
* Re: [PATCH net] net: ipv6: prevent use after free in ip6_route_mpath_notify()
From: David Ahern @ 2018-06-03 14:46 UTC (permalink / raw)
To: Eric Dumazet, Eric Dumazet, David S . Miller; +Cc: netdev
In-Reply-To: <4dfbdd4b-947b-bbf7-27f3-abbd48a817b4@gmail.com>
On 6/3/18 8:31 AM, Eric Dumazet wrote:
>
>
> On 06/03/2018 07:01 AM, David Ahern wrote:
>> On 6/3/18 7:35 AM, Eric Dumazet wrote:
>>> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
>>> index f4d61736c41abe8cd7f439c4a37100e90c1eacca..830eefdbdb6734eb81ea0322fb6077ee20be1889 100644
>>> --- a/net/ipv6/route.c
>>> +++ b/net/ipv6/route.c
>>> @@ -4263,7 +4263,9 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
>>>
>>> err_nh = NULL;
>>> list_for_each_entry(nh, &rt6_nh_list, next) {
>>> + dst_release(&rt_last->dst);
>>> rt_last = nh->rt6_info;
>>> + dst_hold(&rt_last->dst);
>>> err = __ip6_ins_rt(nh->rt6_info, info, &nh->mxc, extack);
>>> /* save reference to first route for notification */
>>> if (!rt_notif && !err)
>>> @@ -4317,7 +4319,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
>>> list_del(&nh->next);
>>> kfree(nh);
>>> }
>>> -
>>> + dst_release(&rt_last->dst);
>>> return err;
>>> }
>>
>> Since the rtnl lock is held, a successfully inserted route can not be
>> removed until ip6_route_multipath_add finishes. This is a simpler change
>> that works with net-next as well:
>
> Your patch changes the intent of your original commit.
>
> It seems you wanted rt_last to point to the last attempted insertion,
> not the last successful one ?
The note in ip6_route_mpath_notify explains it:
/* if this is an APPEND route, then rt points to the first route
* inserted and rt_last points to last route inserted. Userspace
>
> Or have I misunderstood, and not only we had a use-after-free, but also
> a semantic error ?
It was a mistake to set rt_last before checking err. So the
use-after-free exposed the semantic error.
^ permalink raw reply
* Re: [PATCH net-next] net: axienet: remove stale comment of axienet_open
From: David Miller @ 2018-06-03 14:59 UTC (permalink / raw)
To: yuehaibing; +Cc: anirudh, John.Linn, netdev, linux-kernel, michal.simek
In-Reply-To: <20180531115115.11920-1-yuehaibing@huawei.com>
From: YueHaibing <yuehaibing@huawei.com>
Date: Thu, 31 May 2018 19:51:15 +0800
> axienet_open no longer return -ENODEV when PHY cannot be connected to
> since commit d7cc3163e026 ("net: axienet: Support phy-less mode of operation")
>
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Applied.
^ permalink raw reply
* Re: [PATCH net v2] ipv6: omit traffic class when calculating flow hash
From: David Ahern @ 2018-06-03 15:00 UTC (permalink / raw)
To: Michal Kubecek, David S. Miller
Cc: netdev, linux-kernel, Nicolas Dichtel, Tom Herbert, Ido Schimmel
In-Reply-To: <20180602080528.54B27A0C48@unicorn.suse.cz>
On 6/2/18 1:40 AM, Michal Kubecek wrote:
> diff --git a/include/net/ipv6.h b/include/net/ipv6.h
> index 836f31af1369..7fbdc3e9e25d 100644
> --- a/include/net/ipv6.h
> +++ b/include/net/ipv6.h
> @@ -906,6 +906,11 @@ static inline __be32 ip6_make_flowinfo(unsigned int tclass, __be32 flowlabel)
> return htonl(tclass << IPV6_TCLASS_SHIFT) | flowlabel;
> }
>
> +static inline u32 flowi6_get_flowlabel(const struct flowi6 *fl6)
> +{
> + return (__force u32)(fl6->flowlabel & IPV6_FLOWLABEL_MASK);
> +}
> +
> /*
> * Prototypes exported by ipv6
> */
discussing the fix for net-next and making the label vs info consistent,
Michal notes a few places where this helper is needed as a __be32, so
the typecast should be outside of this helper.
^ permalink raw reply
* Re: [PATCH] vlan: use non-archaic spelling of failes
From: David Miller @ 2018-06-03 15:02 UTC (permalink / raw)
To: cascardo; +Cc: netdev
In-Reply-To: <20180531122020.9225-1-cascardo@canonical.com>
From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Date: Thu, 31 May 2018 09:20:20 -0300
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Applied.
^ permalink raw reply
* Re: [PATCH v2 net] mlx4_core: restore optimal ICM memory allocation
From: David Miller @ 2018-06-03 15:02 UTC (permalink / raw)
To: edumazet
Cc: netdev, eric.dumazet, jsperbeck, tarick, qing.huang, danielj,
yanjun.zhu
In-Reply-To: <20180531125224.97098-1-edumazet@google.com>
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 31 May 2018 05:52:24 -0700
> Commit 1383cb8103bb ("mlx4_core: allocate ICM memory in page size chunks")
> brought two regressions caught in our regression suite.
>
> The big one is an additional cost of 256 bytes of overhead per 4096 bytes,
> or 6.25 % which is unacceptable since ICM can be pretty large.
>
> This comes from having to allocate one struct mlx4_icm_chunk (256 bytes)
> per MLX4_TABLE_CHUNK, which the buggy commit shrank to 4KB
> (instead of prior 256KB)
>
> Note that mlx4_alloc_icm() is already able to try high order allocations
> and fallback to low-order allocations under high memory pressure.
>
> Most of these allocations happen right after boot time, when we get
> plenty of non fragmented memory, there is really no point being so
> pessimistic and break huge pages into order-0 ones just for fun.
>
> We only have to tweak gfp_mask a bit, to help falling back faster,
> without risking OOM killings.
>
> Second regression is an KASAN fault, that will need further investigations.
>
> Fixes: 1383cb8103bb ("mlx4_core: allocate ICM memory in page size chunks")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Acked-by: Tariq Toukan <tariqt@mellanox.com>
Applied, thanks Eric.
^ permalink raw reply
* Re: pull-request: wireless-drivers-next 2018-05-31
From: David Miller @ 2018-06-03 15:03 UTC (permalink / raw)
To: kvalo; +Cc: linux-wireless, netdev, linux-kernel
In-Reply-To: <877enj29x4.fsf@kamboji.qca.qualcomm.com>
From: Kalle Valo <kvalo@codeaurora.org>
Date: Thu, 31 May 2018 17:10:15 +0300
> here's a pull request to net-next tree for 4.18. More info below and
> please let me know if there are any problems.
Pulled, thanks Kalle.
^ permalink raw reply
* Re: [PATCH bpf-next v3 00/11] Misc BPF improvements
From: Alexei Starovoitov @ 2018-06-03 15:08 UTC (permalink / raw)
To: Daniel Borkmann; +Cc: netdev
In-Reply-To: <20180602210641.6163-1-daniel@iogearbox.net>
On Sat, Jun 02, 2018 at 11:06:30PM +0200, Daniel Borkmann wrote:
> This set adds various patches I still had in my queue, first two
> are test cases to provide coverage for the recent two fixes that
> went to bpf tree, then a small improvement on the error message
> for gpl helpers. Next, we expose prog and map id into fdinfo in
> order to allow for inspection of these objections currently used
> in applications. Patch after that removes a retpoline call for
> map lookup/update/delete helpers. A new helper is added in the
> subsequent patch to lookup the skb's socket's cgroup v2 id which
> can be used in an efficient way for e.g. lookups on egress side.
> Next one is a fix to fully clear state info in tunnel/xfrm helpers.
> Given this is full cap_sys_admin from init ns and has same priv
> requirements like tracing, bpf-next should be okay. A small bug
> fix for bpf_asm follows, and next a fix for context access in
> tracing which was recently reported. Lastly, a small update in
> the maintainer's file to add patchwork url and missing files.
>
> Thanks!
>
> v2 -> v3:
> - Noticed a merge artefact inside uapi header comment, sigh,
> fixed now.
> v1 -> v2:
> - minor fix in getting context access work on 32 bit for tracing
> - add paragraph to uapi helper doc to better describe kernel
> build deps for cggroup helper
Applied, Thanks Daniel.
fixed up commit log s/bpftool p d x i/bpftool prog dump xlated id/
while applying, since it was indeed a bit cryptic.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox