* Re: [PATCH] brcm80211: Avoid possible null-pointer dereferences in wlc_phy_radio_init_2056()
From: Kalle Valo @ 2019-09-03 13:37 UTC (permalink / raw)
To: Jia-Ju Bai
Cc: arend.vanspriel, franky.lin, hante.meuleman, chi-hsien.lin,
wright.feng, davem, pieter-paul.giesberts, plaes, rvarsha016,
linux-wireless, brcm80211-dev-list.pdl, brcm80211-dev-list,
netdev, linux-kernel, Jia-Ju Bai
In-Reply-To: <20190729095652.1976-1-baijiaju1990@gmail.com>
Jia-Ju Bai <baijiaju1990@gmail.com> wrote:
> In wlc_phy_radio_init_2056(), regs_SYN_2056_ptr, regs_TX_2056_ptr and
> regs_RX_2056_ptr may be not assigned, and thus they are still NULL.
> Then, they are used on lines 20042-20050:
> wlc_phy_init_radio_regs(pi, regs_SYN_2056_ptr, (u16) RADIO_2056_SYN);
> wlc_phy_init_radio_regs(pi, regs_TX_2056_ptr, (u16) RADIO_2056_TX0);
> wlc_phy_init_radio_regs(pi, regs_TX_2056_ptr, (u16) RADIO_2056_TX1);
> wlc_phy_init_radio_regs(pi, regs_RX_2056_ptr, (u16) RADIO_2056_RX0);
> wlc_phy_init_radio_regs(pi, regs_RX_2056_ptr, (u16) RADIO_2056_RX1);
>
> Thus, possible null-pointer dereferences may occur.
>
> To avoid these bugs, when these variables are not assigned,
> wlc_phy_radio_init_2056() directly returns.
>
> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Patch applied to wireless-drivers-next.git, thanks.
b80df89f3909 brcm80211: Avoid possible null-pointer dereferences in wlc_phy_radio_init_2056()
--
https://patchwork.kernel.org/patch/11063553/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* [PATCH 2/2] drm: convert to use yesno(), onoff(), enableddisabled(), plural() helpers
From: Jani Nikula @ 2019-09-03 13:37 UTC (permalink / raw)
To: linux-kernel
Cc: jani.nikula, Joonas Lahtinen, Rodrigo Vivi, intel-gfx,
Vishal Kulkarni, netdev, Greg Kroah-Hartman, linux-usb,
Andrew Morton, Julia Lawall
In-Reply-To: <20190903133731.2094-1-jani.nikula@intel.com>
THIS IS NOT FOR MERGING; DEMO FOR PREVIOUS PATCH ONLY!
Further conversion should be done incrementally and by
driver/subsystem. This here is the result of running the following on
the below cocci patch:
$ spatch --sp-file yesno.cocci --in-place --dir drivers/gpu/drm
I wish I knew how to not duplicate stuff in the cocci patch so much...
@enableddisabled@
expression E;
@@
(
- (E) ? "enabled" : "disabled"
+ enableddisabled(E)
|
- E ? "enabled" : "disabled"
+ enableddisabled(E)
)
@reverse_enableddisabled@
expression A, B;
@@
(
- (A == B) ? "disabled" : "enabled"
+ enableddisabled(A != B)
|
- (A != B) ? "disabled" : "enabled"
+ enableddisabled(A == B)
|
- A == B ? "disabled" : "enabled"
+ enableddisabled(A != B)
|
- A != B ? "disabled" : "enabled"
+ enableddisabled(A == B)
|
- A ? "disabled" : "enabled"
+ enableddisabled(!A)
)
@yesno@
expression E;
@@
(
- (E) ? "yes" : "no"
+ yesno(E)
|
- E ? "yes" : "no"
+ yesno(E)
)
@reverse_yesno@
expression A, B;
@@
(
- (A == B) ? "no" : "yes"
+ yesno(A != B)
|
- (A != B) ? "no" : "yes"
+ yesno(A == B)
|
- A == B ? "no" : "yes"
+ yesno(A != B)
|
- A != B ? "no" : "yes"
+ yesno(A == B)
|
- A ? "no" : "yes"
+ yesno(!A)
)
@onoff@
expression E;
@@
(
- (E) ? "on" : "off"
+ onoff(E)
|
- E ? "on" : "off"
+ onoff(E)
)
@reverse_onoff@
expression A, B;
@@
(
- (A == B) ? "off" : "on"
+ onoff(A != B)
|
- (A != B) ? "off" : "on"
+ onoff(A == B)
|
- A == B ? "off" : "on"
+ onoff(A != B)
|
- A != B ? "off" : "on"
+ onoff(A == B)
|
- A ? "off" : "on"
+ onoff(!A)
)
@plural@
expression E;
@@
(
- (E > 1) ? "s" : ""
+ plural(E)
|
- E > 1 ? "s" : ""
+ plural(E)
|
- (E == 1) ? "" : "s"
+ plural(E)
|
- E == 1 ? "" : "s"
+ plural(E)
)
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: intel-gfx@lists.freedesktop.org
Cc: Vishal Kulkarni <vishal@chelsio.com>
Cc: netdev@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org
Cc: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 2 +-
drivers/gpu/drm/amd/amdgpu/atom.c | 2 +-
drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 3 ++-
drivers/gpu/drm/bridge/tc358767.c | 2 +-
drivers/gpu/drm/drm_client_modeset.c | 2 +-
drivers/gpu/drm/drm_dp_helper.c | 2 +-
drivers/gpu/drm/drm_edid_load.c | 2 +-
drivers/gpu/drm/drm_gem.c | 2 +-
drivers/gpu/drm/i915/display/intel_display.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_acpi.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c | 2 +-
drivers/gpu/drm/omapdrm/dss/dispc.c | 2 +-
drivers/gpu/drm/omapdrm/dss/dsi.c | 6 ++----
drivers/gpu/drm/qxl/qxl_display.c | 2 +-
drivers/gpu/drm/radeon/atom.c | 2 +-
drivers/gpu/drm/radeon/radeon_acpi.c | 2 +-
drivers/gpu/drm/sti/sti_hda.c | 4 ++--
drivers/gpu/drm/sti/sti_tvout.c | 2 +-
drivers/gpu/drm/sun4i/sun4i_backend.c | 2 +-
drivers/gpu/drm/sun4i/sun8i_ui_layer.c | 2 +-
drivers/gpu/drm/v3d/v3d_debugfs.c | 10 +++++-----
drivers/gpu/drm/virtio/virtgpu_debugfs.c | 2 +-
22 files changed, 29 insertions(+), 30 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 1e41367ef74e..65f0ee0f4ccd 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -292,7 +292,7 @@ static int amdgpu_atif_get_notification_params(struct amdgpu_atif *atif)
out:
DRM_DEBUG_DRIVER("Notification %s, command code = %#x\n",
- (n->enabled ? "enabled" : "disabled"),
+ (enableddisabled(n->enabled)),
n->command_code);
kfree(info);
return err;
diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c
index dd30f4e61a8c..b59a83fae853 100644
--- a/drivers/gpu/drm/amd/amdgpu/atom.c
+++ b/drivers/gpu/drm/amd/amdgpu/atom.c
@@ -737,7 +737,7 @@ static void atom_op_jump(atom_exec_context *ctx, int *ptr, int arg)
break;
}
if (arg != ATOM_COND_ALWAYS)
- SDEBUG(" taken: %s\n", execute ? "yes" : "no");
+ SDEBUG(" taken: %s\n", yesno(execute));
SDEBUG(" target: 0x%04X\n", target);
if (execute) {
if (ctx->last_jump == (ctx->start + target)) {
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index 3be8eb21fd6e..1e025cbd5e81 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -2918,7 +2918,8 @@ static int vega10_enable_disable_PCC_limit_feature(struct pp_hwmgr *hwmgr, bool
if (data->smu_features[GNLD_PCC_LIMIT].supported) {
if (enable == data->smu_features[GNLD_PCC_LIMIT].enabled)
- pr_info("GNLD_PCC_LIMIT has been %s \n", enable ? "enabled" : "disabled");
+ pr_info("GNLD_PCC_LIMIT has been %s \n",
+ enableddisabled(enable));
PP_ASSERT_WITH_CODE(!vega10_enable_smc_features(hwmgr,
enable, data->smu_features[GNLD_PCC_LIMIT].smu_feature_bitmap),
"Attempt to Enable PCC Limit feature Failed!",
diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index 13ade28a36a8..debce316a02d 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -653,7 +653,7 @@ static int tc_get_display_props(struct tc_data *tc)
"enhanced" : "non-enhanced");
dev_dbg(tc->dev, "Downspread: %s, scrambler: %s\n",
tc->link.spread ? "0.5%" : "0.0%",
- tc->link.scrambler_dis ? "disabled" : "enabled");
+ enableddisabled(!tc->link.scrambler_dis));
dev_dbg(tc->dev, "Display ASSR: %d, TC358767 ASSR: %d\n",
tc->link.assr, tc->assr);
diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c
index c8922b7cac09..264fa3a9ffd4 100644
--- a/drivers/gpu/drm/drm_client_modeset.c
+++ b/drivers/gpu/drm/drm_client_modeset.c
@@ -213,7 +213,7 @@ static void drm_client_connectors_enabled(struct drm_connector **connectors,
connector = connectors[i];
enabled[i] = drm_connector_enabled(connector, true);
DRM_DEBUG_KMS("connector %d enabled? %s\n", connector->base.id,
- connector->display_info.non_desktop ? "non desktop" : enabled[i] ? "yes" : "no");
+ connector->display_info.non_desktop ? "non desktop" : yesno(enabled[i]));
any_enabled |= enabled[i];
}
diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
index 0b994d083a89..fabdb3222e87 100644
--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -600,7 +600,7 @@ void drm_dp_downstream_debug(struct seq_file *m,
DP_DWN_STRM_PORT_PRESENT;
seq_printf(m, "\tDP branch device present: %s\n",
- branch_device ? "yes" : "no");
+ yesno(branch_device));
if (!branch_device)
return;
diff --git a/drivers/gpu/drm/drm_edid_load.c b/drivers/gpu/drm/drm_edid_load.c
index d38b3b255926..a5af002adf73 100644
--- a/drivers/gpu/drm/drm_edid_load.c
+++ b/drivers/gpu/drm/drm_edid_load.c
@@ -255,7 +255,7 @@ static void *edid_load(struct drm_connector *connector, const char *name,
DRM_INFO("Got %s EDID base block and %d extension%s from "
"\"%s\" for connector \"%s\"\n", (builtin >= 0) ? "built-in" :
- "external", valid_extensions, valid_extensions == 1 ? "" : "s",
+ "external", valid_extensions, plural(valid_extensions),
name, connector_name);
out:
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index a8c4468f03d9..53c2f5705c79 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -1208,7 +1208,7 @@ void drm_gem_print_info(struct drm_printer *p, unsigned int indent,
drm_vma_node_start(&obj->vma_node));
drm_printf_indent(p, indent, "size=%zu\n", obj->size);
drm_printf_indent(p, indent, "imported=%s\n",
- obj->import_attach ? "yes" : "no");
+ yesno(obj->import_attach));
if (obj->funcs && obj->funcs->print_info)
obj->funcs->print_info(p, indent, obj);
diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
index 592b92782fab..5da343a753b1 100644
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -16006,7 +16006,7 @@ int intel_modeset_init(struct drm_device *dev)
DRM_DEBUG_KMS("%d display pipe%s available.\n",
INTEL_INFO(dev_priv)->num_pipes,
- INTEL_INFO(dev_priv)->num_pipes > 1 ? "s" : "");
+ plural(INTEL_INFO(dev_priv)->num_pipes));
for_each_pipe(dev_priv, pipe) {
ret = intel_crtc_init(dev_priv, pipe);
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index fe3a10255c36..eec68ebe7cad 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -277,7 +277,7 @@ static void nouveau_dsm_pci_probe(struct pci_dev *pdev, acpi_handle *dhandle_out
nouveau_optimus_dsm(dhandle, NOUVEAU_DSM_OPTIMUS_CAPS, 0,
&result);
dev_info(&pdev->dev, "optimus capabilities: %s, status %s%s\n",
- (result & OPTIMUS_ENABLED) ? "enabled" : "disabled",
+ enableddisabled(result & OPTIMUS_ENABLED),
(result & OPTIMUS_DYNAMIC_PWR_CAP) ? "dynamic power, " : "",
(result & OPTIMUS_HDA_CODEC_MASK) ? "hda bios codec supported" : "");
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
index a11637b0f6cc..05c733598f4f 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
@@ -94,7 +94,7 @@ void
nvkm_i2c_aux_monitor(struct nvkm_i2c_aux *aux, bool monitor)
{
struct nvkm_i2c_pad *pad = aux->pad;
- AUX_TRACE(aux, "monitor: %s", monitor ? "yes" : "no");
+ AUX_TRACE(aux, "monitor: %s", yesno(monitor));
if (monitor)
nvkm_i2c_pad_mode(pad, NVKM_I2C_PAD_AUX);
else
diff --git a/drivers/gpu/drm/omapdrm/dss/dispc.c b/drivers/gpu/drm/omapdrm/dss/dispc.c
index 785c5546067a..9766101d8ab0 100644
--- a/drivers/gpu/drm/omapdrm/dss/dispc.c
+++ b/drivers/gpu/drm/omapdrm/dss/dispc.c
@@ -1506,7 +1506,7 @@ void dispc_enable_fifomerge(struct dispc_device *dispc, bool enable)
return;
}
- DSSDBG("FIFO merge %s\n", enable ? "enabled" : "disabled");
+ DSSDBG("FIFO merge %s\n", enableddisabled(enable));
REG_FLD_MOD(dispc, DISPC_CONFIG, enable ? 1 : 0, 14, 14);
}
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
index b30fcaa2d0f5..671ae88cabba 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
@@ -1408,8 +1408,7 @@ static int dsi_dump_dsi_clocks(struct seq_file *s, void *p)
DSS_CLK_SRC_PLL2_1),
cinfo->clkout[HSDIV_DISPC],
cinfo->mX[HSDIV_DISPC],
- dispc_clk_src == DSS_CLK_SRC_FCK ?
- "off" : "on");
+ onoff(dispc_clk_src != DSS_CLK_SRC_FCK));
seq_printf(s, "DSI_PLL_HSDIV_DSI (%s)\t%-16lum_dsi %u\t(%s)\n",
dss_get_clk_source_name(dsi_module == 0 ?
@@ -1417,8 +1416,7 @@ static int dsi_dump_dsi_clocks(struct seq_file *s, void *p)
DSS_CLK_SRC_PLL2_2),
cinfo->clkout[HSDIV_DSI],
cinfo->mX[HSDIV_DSI],
- dsi_clk_src == DSS_CLK_SRC_FCK ?
- "off" : "on");
+ onoff(dsi_clk_src != DSS_CLK_SRC_FCK));
seq_printf(s, "- DSI%d -\n", dsi_module + 1);
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index 8b319ebbb0fb..bae1d1277f21 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -355,7 +355,7 @@ static void qxl_crtc_update_monitors_config(struct drm_crtc *crtc,
DRM_DEBUG_KMS("head %d, %dx%d, at +%d+%d, %s (%s)\n",
i, head.width, head.height, head.x, head.y,
- crtc->state->active ? "on" : "off", reason);
+ onoff(crtc->state->active), reason);
if (oldcount != qdev->monitors_config->count)
DRM_DEBUG_KMS("active heads %d -> %d (%d total)\n",
oldcount, qdev->monitors_config->count,
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 2c27627b6659..e6dd0f5c67b8 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -722,7 +722,7 @@ static void atom_op_jump(atom_exec_context *ctx, int *ptr, int arg)
break;
}
if (arg != ATOM_COND_ALWAYS)
- SDEBUG(" taken: %s\n", execute ? "yes" : "no");
+ SDEBUG(" taken: %s\n", yesno(execute));
SDEBUG(" target: 0x%04X\n", target);
if (execute) {
if (ctx->last_jump == (ctx->start + target)) {
diff --git a/drivers/gpu/drm/radeon/radeon_acpi.c b/drivers/gpu/drm/radeon/radeon_acpi.c
index 6cf1645e7a1a..0decdd9781f4 100644
--- a/drivers/gpu/drm/radeon/radeon_acpi.c
+++ b/drivers/gpu/drm/radeon/radeon_acpi.c
@@ -299,7 +299,7 @@ static int radeon_atif_get_notification_params(acpi_handle handle,
out:
DRM_DEBUG_DRIVER("Notification %s, command code = %#x\n",
- (n->enabled ? "enabled" : "disabled"),
+ (enableddisabled(n->enabled)),
n->command_code);
kfree(info);
return err;
diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c
index 94e404f13234..80a196d13647 100644
--- a/drivers/gpu/drm/sti/sti_hda.c
+++ b/drivers/gpu/drm/sti/sti_hda.c
@@ -317,7 +317,7 @@ static void hda_enable_hd_dacs(struct sti_hda *hda, bool enable)
static void hda_dbg_cfg(struct seq_file *s, int val)
{
seq_puts(s, "\tAWG ");
- seq_puts(s, val & CFG_AWG_ASYNC_EN ? "enabled" : "disabled");
+ seq_puts(s, enableddisabled(val & CFG_AWG_ASYNC_EN));
}
static void hda_dbg_awg_microcode(struct seq_file *s, void __iomem *reg)
@@ -338,7 +338,7 @@ static void hda_dbg_video_dacs_ctrl(struct seq_file *s, void __iomem *reg)
seq_printf(s, "\n\n %-25s 0x%08X", "VIDEO_DACS_CONTROL", val);
seq_puts(s, "\tHD DACs ");
- seq_puts(s, val & DAC_CFG_HD_HZUVW_OFF_MASK ? "disabled" : "enabled");
+ seq_puts(s, enableddisabled(!(val & DAC_CFG_HD_HZUVW_OFF_MASK)));
}
static int hda_dbg_show(struct seq_file *s, void *data)
diff --git a/drivers/gpu/drm/sti/sti_tvout.c b/drivers/gpu/drm/sti/sti_tvout.c
index e1b3c8cb7287..1f169ed177e9 100644
--- a/drivers/gpu/drm/sti/sti_tvout.c
+++ b/drivers/gpu/drm/sti/sti_tvout.c
@@ -491,7 +491,7 @@ static void tvout_dbg_vip(struct seq_file *s, int val)
static void tvout_dbg_hd_dac_cfg(struct seq_file *s, int val)
{
seq_printf(s, "\t%-24s %s", "HD DAC:",
- val & 1 ? "disabled" : "enabled");
+ enableddisabled(!(val & 1)));
}
static int tvout_dbg_show(struct seq_file *s, void *data)
diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
index 78d8c3afe825..f1e301060123 100644
--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
@@ -273,7 +273,7 @@ int sun4i_backend_update_layer_formats(struct sun4i_backend *backend,
interlaced ? SUN4I_BACKEND_MODCTL_ITLMOD_EN : 0);
DRM_DEBUG_DRIVER("Switching display backend interlaced mode %s\n",
- interlaced ? "on" : "off");
+ onoff(interlaced));
val = SUN4I_BACKEND_ATTCTL_REG0_LAY_GLBALPHA(state->alpha >> 8);
if (state->alpha != DRM_BLEND_ALPHA_OPAQUE)
diff --git a/drivers/gpu/drm/sun4i/sun8i_ui_layer.c b/drivers/gpu/drm/sun4i/sun8i_ui_layer.c
index dd2a1c851939..c48b1cf07439 100644
--- a/drivers/gpu/drm/sun4i/sun8i_ui_layer.c
+++ b/drivers/gpu/drm/sun4i/sun8i_ui_layer.c
@@ -126,7 +126,7 @@ static int sun8i_ui_layer_update_coord(struct sun8i_mixer *mixer, int channel,
val);
DRM_DEBUG_DRIVER("Switching display mixer interlaced mode %s\n",
- interlaced ? "on" : "off");
+ onoff(interlaced));
}
/* Set height and width */
diff --git a/drivers/gpu/drm/v3d/v3d_debugfs.c b/drivers/gpu/drm/v3d/v3d_debugfs.c
index 78a78938e81f..0ca71eb2e760 100644
--- a/drivers/gpu/drm/v3d/v3d_debugfs.c
+++ b/drivers/gpu/drm/v3d/v3d_debugfs.c
@@ -147,15 +147,15 @@ static int v3d_v3d_debugfs_ident(struct seq_file *m, void *unused)
V3D_GET_FIELD(ident3, V3D_HUB_IDENT3_IPREV),
V3D_GET_FIELD(ident3, V3D_HUB_IDENT3_IPIDX));
seq_printf(m, "MMU: %s\n",
- (ident2 & V3D_HUB_IDENT2_WITH_MMU) ? "yes" : "no");
+ yesno(ident2 & V3D_HUB_IDENT2_WITH_MMU));
seq_printf(m, "TFU: %s\n",
- (ident1 & V3D_HUB_IDENT1_WITH_TFU) ? "yes" : "no");
+ yesno(ident1 & V3D_HUB_IDENT1_WITH_TFU));
seq_printf(m, "TSY: %s\n",
- (ident1 & V3D_HUB_IDENT1_WITH_TSY) ? "yes" : "no");
+ yesno(ident1 & V3D_HUB_IDENT1_WITH_TSY));
seq_printf(m, "MSO: %s\n",
- (ident1 & V3D_HUB_IDENT1_WITH_MSO) ? "yes" : "no");
+ yesno(ident1 & V3D_HUB_IDENT1_WITH_MSO));
seq_printf(m, "L3C: %s (%dkb)\n",
- (ident1 & V3D_HUB_IDENT1_WITH_L3C) ? "yes" : "no",
+ yesno(ident1 & V3D_HUB_IDENT1_WITH_L3C),
V3D_GET_FIELD(ident2, V3D_HUB_IDENT2_L3C_NKB));
for (core = 0; core < cores; core++) {
diff --git a/drivers/gpu/drm/virtio/virtgpu_debugfs.c b/drivers/gpu/drm/virtio/virtgpu_debugfs.c
index ed0fcda713c3..4b6bf4e9abb1 100644
--- a/drivers/gpu/drm/virtio/virtgpu_debugfs.c
+++ b/drivers/gpu/drm/virtio/virtgpu_debugfs.c
@@ -31,7 +31,7 @@
static void virtio_add_bool(struct seq_file *m, const char *name,
bool value)
{
- seq_printf(m, "%-16s : %s\n", name, value ? "yes" : "no");
+ seq_printf(m, "%-16s : %s\n", name, yesno(value));
}
static void virtio_add_int(struct seq_file *m, const char *name,
--
2.20.1
^ permalink raw reply related
* Re: [PATCH] brcmfmac: remove redundant assignment to pointer hash
From: Kalle Valo @ 2019-09-03 13:38 UTC (permalink / raw)
To: Colin King
Cc: Arend van Spriel, Hante Meuleman, Chi-Hsien Lin, Wright Feng,
David S . Miller, linux-wireless, brcm80211-dev-list.pdl,
brcm80211-dev-list, netdev, kernel-janitors, linux-kernel
In-Reply-To: <20190809172217.1809-1-colin.king@canonical.com>
Colin King <colin.king@canonical.com> wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> The pointer hash is being initialized with a value that is never read
> and is being re-assigned a little later on. The assignment is
> redundant and hence can be removed.
>
> Addresses-Coverity: ("Unused value")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Patch applied to wireless-drivers-next.git, thanks.
73c742bb9c9b brcmfmac: remove redundant assignment to pointer hash
--
https://patchwork.kernel.org/patch/11087385/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCHv3] zd1211rw: remove false assertion from zd_mac_clear()
From: Kalle Valo @ 2019-09-03 13:39 UTC (permalink / raw)
To: Oliver Neukum; +Cc: davem, netdev, dsd, kune, linux-wireless, Oliver Neukum
In-Reply-To: <20190813120412.6240-1-oneukum@suse.com>
Oliver Neukum <oneukum@suse.com> wrote:
> The function is called before the lock which is asserted was ever used.
> Just remove it.
>
> Reported-by: syzbot+74c65761783d66a9c97c@syzkaller.appspotmail.com
> Signed-off-by: Oliver Neukum <oneukum@suse.com>
Patch applied to wireless-drivers-next.git, thanks.
7a2eb7367fde zd1211rw: remove false assertion from zd_mac_clear()
--
https://patchwork.kernel.org/patch/11092009/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] airo: fix memory leaks
From: Kalle Valo @ 2019-09-03 13:39 UTC (permalink / raw)
To: Wenwen Wang
Cc: Wenwen Wang, David S. Miller, Herbert Xu, Dan Carpenter,
Eric Biggers, Ard Biesheuvel,
open list:NETWORKING DRIVERS (WIRELESS),
open list:NETWORKING DRIVERS, open list
In-Reply-To: <1565927404-4755-1-git-send-email-wenwen@cs.uga.edu>
Wenwen Wang <wenwen@cs.uga.edu> wrote:
> In proc_BSSList_open(), 'file->private_data' is allocated through kzalloc()
> and 'data->rbuffer' is allocated through kmalloc(). In the following
> execution, if an error occurs, they are not deallocated, leading to memory
> leaks. To fix this issue, free the allocated memory regions before
> returning the error.
>
> Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Patch applied to wireless-drivers-next.git, thanks.
145a32fe57e3 airo: fix memory leaks
--
https://patchwork.kernel.org/patch/11096733/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] ipw2x00: fix spelling mistake "initializationg" -> "initialization"
From: Kalle Valo @ 2019-09-03 13:40 UTC (permalink / raw)
To: Colin King
Cc: Stanislav Yakovlev, David S . Miller, linux-wireless, netdev,
kernel-janitors, linux-kernel
In-Reply-To: <20190822220025.5690-1-colin.king@canonical.com>
Colin King <colin.king@canonical.com> wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> There is a spelling mistake in an IPW_DEBUG_INFO message. Fix it.
>
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Patch applied to wireless-drivers-next.git, thanks.
14aba89386a4 ipw2x00: fix spelling mistake "initializationg" -> "initialization"
--
https://patchwork.kernel.org/patch/11110159/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH bpf-next 1/2] selftests/bpf: test_progs: fix verbose mode garbage
From: Daniel Borkmann @ 2019-09-03 13:40 UTC (permalink / raw)
To: Stanislav Fomichev, netdev, bpf; +Cc: davem, ast
In-Reply-To: <20190831023427.239820-1-sdf@google.com>
On 8/31/19 4:34 AM, Stanislav Fomichev wrote:
> fseeko(.., 0, SEEK_SET) on a memstream just puts the buffer pointer
> to the beginning so when we call fflush on it we get some garbage
> log data from the previous test. Let's manually set terminating
> byte to zero at the reported buffer size.
>
> To show the issue consider the following snippet:
>
> stream = open_memstream (&buf, &len);
>
> fprintf(stream, "aaa");
> fflush(stream);
> printf("buf=%s, len=%zu\n", buf, len);
> fseeko(stream, 0, SEEK_SET);
>
> fprintf(stream, "b");
> fflush(stream);
> printf("buf=%s, len=%zu\n", buf, len);
>
> Output:
>
> buf=aaa, len=3
> buf=baa, len=1
>
> Fixes: 946152b3c5d6 ("selftests/bpf: test_progs: switch to open_memstream")
> Signed-off-by: Stanislav Fomichev <sdf@google.com>
Both applied, thanks!
^ permalink raw reply
* Re: [PATCH] brcmfmac: replace strncpy() by strscpy()
From: Kalle Valo @ 2019-09-03 13:43 UTC (permalink / raw)
To: Xulin Sun
Cc: stefan.wahren, xulin.sun, linux-kernel, netdev,
brcm80211-dev-list, brcm80211-dev-list.pdl, linux-wireless,
arend.vanspriel, franky.lin, hante.meuleman, chi-hsien.lin,
wright.feng, davem, stanley.hsu
In-Reply-To: <20190823074708.20081-1-xulin.sun@windriver.com>
Xulin Sun <xulin.sun@windriver.com> wrote:
> The strncpy() may truncate the copied string,
> replace it by the safer strscpy().
>
> To avoid below compile warning with gcc 8.2:
>
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:In function 'brcmf_vndr_ie':
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:4227:2:
> warning: 'strncpy' output truncated before terminating nul copying 3 bytes from a string of the same length [-Wstringop-truncation]
> strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> Signed-off-by: Xulin Sun <xulin.sun@windriver.com>
> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Patch applied to wireless-drivers-next.git, thanks.
5f42b382ead2 brcmfmac: replace strncpy() by strscpy()
--
https://patchwork.kernel.org/patch/11110841/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH][next] zd1211rw: zd_usb: Use struct_size() helper
From: Kalle Valo @ 2019-09-03 13:45 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Daniel Drake, Ulrich Kunitz, David S. Miller, linux-wireless,
netdev, linux-kernel, Gustavo A. R. Silva
In-Reply-To: <20190830185716.GA10044@embeddedor>
"Gustavo A. R. Silva" <gustavo@embeddedor.com> wrote:
> One of the more common cases of allocation size calculations is finding
> the size of a structure that has a zero-sized array at the end, along
> with memory for some number of elements for that array. For example:
>
> struct usb_int_regs {
> ...
> struct reg_data regs[0];
> } __packed;
>
> Make use of the struct_size() helper instead of an open-coded version
> in order to avoid any potential type mistakes.
>
> So, replace the following function:
>
> static int usb_int_regs_length(unsigned int count)
> {
> return sizeof(struct usb_int_regs) + count * sizeof(struct reg_data);
> }
>
> with:
>
> struct_size(regs, regs, count)
>
> This code was detected with the help of Coccinelle.
>
> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Patch applied to wireless-drivers-next.git, thanks.
84b0b6635247 zd1211rw: zd_usb: Use struct_size() helper
--
https://patchwork.kernel.org/patch/11124457/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] rsi: fix a double free bug in rsi_91x_deinit()
From: Kalle Valo @ 2019-09-03 13:55 UTC (permalink / raw)
To: Hui Peng
Cc: security, Hui Peng, Mathias Payer, David S. Miller,
linux-wireless, netdev, linux-kernel
In-Reply-To: <20190819220230.10597-1-benquike@gmail.com>
Hui Peng <benquike@gmail.com> wrote:
> `dev` (struct rsi_91x_usbdev *) field of adapter
> (struct rsi_91x_usbdev *) is allocated and initialized in
> `rsi_init_usb_interface`. If any error is detected in information
> read from the device side, `rsi_init_usb_interface` will be
> freed. However, in the higher level error handling code in
> `rsi_probe`, if error is detected, `rsi_91x_deinit` is called
> again, in which `dev` will be freed again, resulting double free.
>
> This patch fixes the double free by removing the free operation on
> `dev` in `rsi_init_usb_interface`, because `rsi_91x_deinit` is also
> used in `rsi_disconnect`, in that code path, the `dev` field is not
> (and thus needs to be) freed.
>
> This bug was found in v4.19, but is also present in the latest version
> of kernel. Fixes CVE-2019-15504.
>
> Reported-by: Hui Peng <benquike@gmail.com>
> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
> Signed-off-by: Hui Peng <benquike@gmail.com>
> Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Patch applied to wireless-drivers.git, thanks.
8b51dc729147 rsi: fix a double free bug in rsi_91x_deinit()
--
https://patchwork.kernel.org/patch/11102087/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH bpf-next] arm64: bpf: optimize modulo operation
From: Daniel Borkmann @ 2019-09-03 14:05 UTC (permalink / raw)
To: jerinj, netdev, Alexei Starovoitov, Zi Shen Lim, Catalin Marinas,
Will Deacon, Martin KaFai Lau, Song Liu, Yonghong Song,
open list:BPF JIT for ARM64,
moderated list:ARM64 PORT (AARCH64 ARCHITECTURE), open list
In-Reply-To: <20190902061448.28252-1-jerinj@marvell.com>
On 9/2/19 8:14 AM, jerinj@marvell.com wrote:
> From: Jerin Jacob <jerinj@marvell.com>
>
> Optimize modulo operation instruction generation by
> using single MSUB instruction vs MUL followed by SUB
> instruction scheme.
>
> Signed-off-by: Jerin Jacob <jerinj@marvell.com>
Applied, thanks!
^ permalink raw reply
* KSZ8863 ethernet PHY support question
From: HOLTZ Matthieu @ 2019-09-03 13:59 UTC (permalink / raw)
To: netdev@vger.kernel.org; +Cc: matthieu.holtz@gmail.com
Hello,
I’d like to use a switch phy KSZ8863 with an NXP i.mx8mm MPU (new motherboard dev) and a kernel 4.14.x but I am a bit lost regarding the driver support.
Is the Phy supported by the driver under linux/drivers/net/phy/micrel.c and what about the switch configuration, is it implemented in the DSA subsystem ?
KR,
Matthieu H
^ permalink raw reply
* Re: [PATCH 2/2] Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe
From: Kalle Valo @ 2019-09-03 14:14 UTC (permalink / raw)
To: Hui Peng
Cc: davem, Hui Peng, Mathias Payer, ath10k, linux-wireless, netdev,
linux-kernel
In-Reply-To: <20190804003101.11541-1-benquike@gmail.com>
Hui Peng <benquike@gmail.com> wrote:
> The `ar_usb` field of `ath10k_usb_pipe_usb_pipe` objects
> are initialized to point to the containing `ath10k_usb` object
> according to endpoint descriptors read from the device side, as shown
> below in `ath10k_usb_setup_pipe_resources`:
>
> for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
> endpoint = &iface_desc->endpoint[i].desc;
>
> // get the address from endpoint descriptor
> pipe_num = ath10k_usb_get_logical_pipe_num(ar_usb,
> endpoint->bEndpointAddress,
> &urbcount);
> ......
> // select the pipe object
> pipe = &ar_usb->pipes[pipe_num];
>
> // initialize the ar_usb field
> pipe->ar_usb = ar_usb;
> }
>
> The driver assumes that the addresses reported in endpoint
> descriptors from device side to be complete. If a device is
> malicious and does not report complete addresses, it may trigger
> NULL-ptr-deref `ath10k_usb_alloc_urb_from_pipe` and
> `ath10k_usb_free_urb_to_pipe`.
>
> This patch fixes the bug by preventing potential NULL-ptr-deref.
>
> Signed-off-by: Hui Peng <benquike@gmail.com>
> Reported-by: Hui Peng <benquike@gmail.com>
> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This causes a new warning, please build test your patches.
In file included from ./include/uapi/linux/posix_types.h:5,
from ./include/uapi/linux/types.h:14,
from ./include/linux/types.h:6,
from ./include/linux/list.h:5,
from ./include/linux/module.h:9,
from drivers/net/wireless/ath/ath10k/usb.c:8:
drivers/net/wireless/ath/ath10k/usb.c: In function 'ath10k_usb_free_urb_to_pipe':
./include/linux/stddef.h:8:14: warning: 'return' with a value, in function returning void
#define NULL ((void *)0)
^
drivers/net/wireless/ath/ath10k/usb.c:64:10: note: in expansion of macro 'NULL'
return NULL;
^~~~
drivers/net/wireless/ath/ath10k/usb.c:57:13: note: declared here
static void ath10k_usb_free_urb_to_pipe(struct ath10k_usb_pipe *pipe,
^~~~~~~~~~~~~~~~~~~~~~~~~~~
Patch set to Changes Requested.
--
https://patchwork.kernel.org/patch/11074657/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: memory leak in nr_rx_frame (2)
From: syzbot @ 2019-09-03 14:35 UTC (permalink / raw)
To: davem, linux-hams, linux-kernel, netdev, ralf, syzkaller-bugs
In-Reply-To: <0000000000003d789d05915a9fa3@google.com>
syzbot has found a reproducer for the following crash on:
HEAD commit: 089cf7f6 Linux 5.3-rc7
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14100532600000
kernel config: https://syzkaller.appspot.com/x/.config?x=b10436cfda3838d9
dashboard link: https://syzkaller.appspot.com/bug?extid=0145ea560de205bc09f0
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=124dcf8e600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=115f2346600000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0145ea560de205bc09f0@syzkaller.appspotmail.com
executing program
executing program
executing program
executing program
executing program
BUG: memory leak
unreferenced object 0xffff88810de01800 (size 2048):
comm "softirq", pid 0, jiffies 4294947090 (age 27.260s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
06 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
backtrace:
[<0000000002377dcf>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<0000000002377dcf>] slab_post_alloc_hook mm/slab.h:522 [inline]
[<0000000002377dcf>] slab_alloc mm/slab.c:3319 [inline]
[<0000000002377dcf>] __do_kmalloc mm/slab.c:3653 [inline]
[<0000000002377dcf>] __kmalloc+0x169/0x300 mm/slab.c:3664
[<00000000af16d1f0>] kmalloc include/linux/slab.h:557 [inline]
[<00000000af16d1f0>] sk_prot_alloc+0x112/0x170 net/core/sock.c:1603
[<00000000b9033c4c>] sk_alloc+0x35/0x2f0 net/core/sock.c:1657
[<00000000fb9e6269>] nr_make_new net/netrom/af_netrom.c:476 [inline]
[<00000000fb9e6269>] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959
[<00000000fca3a307>] nr_loopback_timer+0x4e/0xd0
net/netrom/nr_loopback.c:59
[<0000000009d4e723>] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322
[<0000000047ea1d35>] expire_timers kernel/time/timer.c:1366 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1685 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1653 [inline]
[<0000000047ea1d35>] run_timer_softirq+0x256/0x740
kernel/time/timer.c:1698
[<00000000e53c6536>] __do_softirq+0x115/0x33f kernel/softirq.c:292
[<0000000024be59bc>] invoke_softirq kernel/softirq.c:373 [inline]
[<0000000024be59bc>] irq_exit+0xbb/0xe0 kernel/softirq.c:413
[<0000000080d19282>] exiting_irq arch/x86/include/asm/apic.h:537
[inline]
[<0000000080d19282>] smp_apic_timer_interrupt+0x96/0x190
arch/x86/kernel/apic/apic.c:1133
[<000000000e93dbd5>] apic_timer_interrupt+0xf/0x20
arch/x86/entry/entry_64.S:830
[<000000002864ce39>] native_safe_halt+0xe/0x10
arch/x86/include/asm/irqflags.h:60
[<000000007e3841ad>] arch_cpu_idle+0xa/0x10
arch/x86/kernel/process.c:571
[<00000000546bc34f>] default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
[<00000000e98df687>] cpuidle_idle_call kernel/sched/idle.c:154 [inline]
[<00000000e98df687>] do_idle+0x1ea/0x2c0 kernel/sched/idle.c:263
[<000000001e3f823f>] cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:354
BUG: memory leak
unreferenced object 0xffff88810fa3c9a0 (size 32):
comm "softirq", pid 0, jiffies 4294947090 (age 27.260s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03 00 00 00 03 00 00 00 0f 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e9077829>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<00000000e9077829>] slab_post_alloc_hook mm/slab.h:522 [inline]
[<00000000e9077829>] slab_alloc mm/slab.c:3319 [inline]
[<00000000e9077829>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548
[<0000000037f78c54>] kmalloc include/linux/slab.h:552 [inline]
[<0000000037f78c54>] kzalloc include/linux/slab.h:748 [inline]
[<0000000037f78c54>] selinux_sk_alloc_security+0x48/0xb0
security/selinux/hooks.c:5073
[<00000000313a65ff>] security_sk_alloc+0x49/0x70
security/security.c:2029
[<00000000ffa4a0b0>] sk_prot_alloc+0x12d/0x170 net/core/sock.c:1606
[<00000000b9033c4c>] sk_alloc+0x35/0x2f0 net/core/sock.c:1657
[<00000000fb9e6269>] nr_make_new net/netrom/af_netrom.c:476 [inline]
[<00000000fb9e6269>] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959
[<00000000fca3a307>] nr_loopback_timer+0x4e/0xd0
net/netrom/nr_loopback.c:59
[<0000000009d4e723>] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322
[<0000000047ea1d35>] expire_timers kernel/time/timer.c:1366 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1685 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1653 [inline]
[<0000000047ea1d35>] run_timer_softirq+0x256/0x740
kernel/time/timer.c:1698
[<00000000e53c6536>] __do_softirq+0x115/0x33f kernel/softirq.c:292
[<0000000024be59bc>] invoke_softirq kernel/softirq.c:373 [inline]
[<0000000024be59bc>] irq_exit+0xbb/0xe0 kernel/softirq.c:413
[<0000000080d19282>] exiting_irq arch/x86/include/asm/apic.h:537
[inline]
[<0000000080d19282>] smp_apic_timer_interrupt+0x96/0x190
arch/x86/kernel/apic/apic.c:1133
[<000000000e93dbd5>] apic_timer_interrupt+0xf/0x20
arch/x86/entry/entry_64.S:830
[<000000002864ce39>] native_safe_halt+0xe/0x10
arch/x86/include/asm/irqflags.h:60
[<000000007e3841ad>] arch_cpu_idle+0xa/0x10
arch/x86/kernel/process.c:571
[<00000000546bc34f>] default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
BUG: memory leak
unreferenced object 0xffff88810de01800 (size 2048):
comm "softirq", pid 0, jiffies 4294947090 (age 30.780s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
06 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
backtrace:
[<0000000002377dcf>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<0000000002377dcf>] slab_post_alloc_hook mm/slab.h:522 [inline]
[<0000000002377dcf>] slab_alloc mm/slab.c:3319 [inline]
[<0000000002377dcf>] __do_kmalloc mm/slab.c:3653 [inline]
[<0000000002377dcf>] __kmalloc+0x169/0x300 mm/slab.c:3664
[<00000000af16d1f0>] kmalloc include/linux/slab.h:557 [inline]
[<00000000af16d1f0>] sk_prot_alloc+0x112/0x170 net/core/sock.c:1603
[<00000000b9033c4c>] sk_alloc+0x35/0x2f0 net/core/sock.c:1657
[<00000000fb9e6269>] nr_make_new net/netrom/af_netrom.c:476 [inline]
[<00000000fb9e6269>] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959
[<00000000fca3a307>] nr_loopback_timer+0x4e/0xd0
net/netrom/nr_loopback.c:59
[<0000000009d4e723>] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322
[<0000000047ea1d35>] expire_timers kernel/time/timer.c:1366 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1685 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1653 [inline]
[<0000000047ea1d35>] run_timer_softirq+0x256/0x740
kernel/time/timer.c:1698
[<00000000e53c6536>] __do_softirq+0x115/0x33f kernel/softirq.c:292
[<0000000024be59bc>] invoke_softirq kernel/softirq.c:373 [inline]
[<0000000024be59bc>] irq_exit+0xbb/0xe0 kernel/softirq.c:413
[<0000000080d19282>] exiting_irq arch/x86/include/asm/apic.h:537
[inline]
[<0000000080d19282>] smp_apic_timer_interrupt+0x96/0x190
arch/x86/kernel/apic/apic.c:1133
[<000000000e93dbd5>] apic_timer_interrupt+0xf/0x20
arch/x86/entry/entry_64.S:830
[<000000002864ce39>] native_safe_halt+0xe/0x10
arch/x86/include/asm/irqflags.h:60
[<000000007e3841ad>] arch_cpu_idle+0xa/0x10
arch/x86/kernel/process.c:571
[<00000000546bc34f>] default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
[<00000000e98df687>] cpuidle_idle_call kernel/sched/idle.c:154 [inline]
[<00000000e98df687>] do_idle+0x1ea/0x2c0 kernel/sched/idle.c:263
[<000000001e3f823f>] cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:354
BUG: memory leak
unreferenced object 0xffff88810fa3c9a0 (size 32):
comm "softirq", pid 0, jiffies 4294947090 (age 30.780s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03 00 00 00 03 00 00 00 0f 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e9077829>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<00000000e9077829>] slab_post_alloc_hook mm/slab.h:522 [inline]
[<00000000e9077829>] slab_alloc mm/slab.c:3319 [inline]
[<00000000e9077829>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548
[<0000000037f78c54>] kmalloc include/linux/slab.h:552 [inline]
[<0000000037f78c54>] kzalloc include/linux/slab.h:748 [inline]
[<0000000037f78c54>] selinux_sk_alloc_security+0x48/0xb0
security/selinux/hooks.c:5073
[<00000000313a65ff>] security_sk_alloc+0x49/0x70
security/security.c:2029
[<00000000ffa4a0b0>] sk_prot_alloc+0x12d/0x170 net/core/sock.c:1606
[<00000000b9033c4c>] sk_alloc+0x35/0x2f0 net/core/sock.c:1657
[<00000000fb9e6269>] nr_make_new net/netrom/af_netrom.c:476 [inline]
[<00000000fb9e6269>] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959
[<00000000fca3a307>] nr_loopback_timer+0x4e/0xd0
net/netrom/nr_loopback.c:59
[<0000000009d4e723>] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322
[<0000000047ea1d35>] expire_timers kernel/time/timer.c:1366 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1685 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1653 [inline]
[<0000000047ea1d35>] run_timer_softirq+0x256/0x740
kernel/time/timer.c:1698
[<00000000e53c6536>] __do_softirq+0x115/0x33f kernel/softirq.c:292
[<0000000024be59bc>] invoke_softirq kernel/softirq.c:373 [inline]
[<0000000024be59bc>] irq_exit+0xbb/0xe0 kernel/softirq.c:413
[<0000000080d19282>] exiting_irq arch/x86/include/asm/apic.h:537
[inline]
[<0000000080d19282>] smp_apic_timer_interrupt+0x96/0x190
arch/x86/kernel/apic/apic.c:1133
[<000000000e93dbd5>] apic_timer_interrupt+0xf/0x20
arch/x86/entry/entry_64.S:830
[<000000002864ce39>] native_safe_halt+0xe/0x10
arch/x86/include/asm/irqflags.h:60
[<000000007e3841ad>] arch_cpu_idle+0xa/0x10
arch/x86/kernel/process.c:571
[<00000000546bc34f>] default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
BUG: memory leak
unreferenced object 0xffff88810de01800 (size 2048):
comm "softirq", pid 0, jiffies 4294947090 (age 32.010s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
06 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
backtrace:
[<0000000002377dcf>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<0000000002377dcf>] slab_post_alloc_hook mm/slab.h:522 [inline]
[<0000000002377dcf>] slab_alloc mm/slab.c:3319 [inline]
[<0000000002377dcf>] __do_kmalloc mm/slab.c:3653 [inline]
[<0000000002377dcf>] __kmalloc+0x169/0x300 mm/slab.c:3664
[<00000000af16d1f0>] kmalloc include/linux/slab.h:557 [inline]
[<00000000af16d1f0>] sk_prot_alloc+0x112/0x170 net/core/sock.c:1603
[<00000000b9033c4c>] sk_alloc+0x35/0x2f0 net/core/sock.c:1657
[<00000000fb9e6269>] nr_make_new net/netrom/af_netrom.c:476 [inline]
[<00000000fb9e6269>] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959
[<00000000fca3a307>] nr_loopback_timer+0x4e/0xd0
net/netrom/nr_loopback.c:59
[<0000000009d4e723>] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322
[<0000000047ea1d35>] expire_timers kernel/time/timer.c:1366 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1685 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1653 [inline]
[<0000000047ea1d35>] run_timer_softirq+0x256/0x740
kernel/time/timer.c:1698
[<00000000e53c6536>] __do_softirq+0x115/0x33f kernel/softirq.c:292
[<0000000024be59bc>] invoke_softirq kernel/softirq.c:373 [inline]
[<0000000024be59bc>] irq_exit+0xbb/0xe0 kernel/softirq.c:413
[<0000000080d19282>] exiting_irq arch/x86/include/asm/apic.h:537
[inline]
[<0000000080d19282>] smp_apic_timer_interrupt+0x96/0x190
arch/x86/kernel/apic/apic.c:1133
[<000000000e93dbd5>] apic_timer_interrupt+0xf/0x20
arch/x86/entry/entry_64.S:830
[<000000002864ce39>] native_safe_halt+0xe/0x10
arch/x86/include/asm/irqflags.h:60
[<000000007e3841ad>] arch_cpu_idle+0xa/0x10
arch/x86/kernel/process.c:571
[<00000000546bc34f>] default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
[<00000000e98df687>] cpuidle_idle_call kernel/sched/idle.c:154 [inline]
[<00000000e98df687>] do_idle+0x1ea/0x2c0 kernel/sched/idle.c:263
[<000000001e3f823f>] cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:354
BUG: memory leak
unreferenced object 0xffff88810fa3c9a0 (size 32):
comm "softirq", pid 0, jiffies 4294947090 (age 32.010s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03 00 00 00 03 00 00 00 0f 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e9077829>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<00000000e9077829>] slab_post_alloc_hook mm/slab.h:522 [inline]
[<00000000e9077829>] slab_alloc mm/slab.c:3319 [inline]
[<00000000e9077829>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548
[<0000000037f78c54>] kmalloc include/linux/slab.h:552 [inline]
[<0000000037f78c54>] kzalloc include/linux/slab.h:748 [inline]
[<0000000037f78c54>] selinux_sk_alloc_security+0x48/0xb0
security/selinux/hooks.c:5073
[<00000000313a65ff>] security_sk_alloc+0x49/0x70
security/security.c:2029
[<00000000ffa4a0b0>] sk_prot_alloc+0x12d/0x170 net/core/sock.c:1606
[<00000000b9033c4c>] sk_alloc+0x35/0x2f0 net/core/sock.c:1657
[<00000000fb9e6269>] nr_make_new net/netrom/af_netrom.c:476 [inline]
[<00000000fb9e6269>] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959
[<00000000fca3a307>] nr_loopback_timer+0x4e/0xd0
net/netrom/nr_loopback.c:59
[<0000000009d4e723>] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322
[<0000000047ea1d35>] expire_timers kernel/time/timer.c:1366 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1685 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1653 [inline]
[<0000000047ea1d35>] run_timer_softirq+0x256/0x740
kernel/time/timer.c:1698
[<00000000e53c6536>] __do_softirq+0x115/0x33f kernel/softirq.c:292
[<0000000024be59bc>] invoke_softirq kernel/softirq.c:373 [inline]
[<0000000024be59bc>] irq_exit+0xbb/0xe0 kernel/softirq.c:413
[<0000000080d19282>] exiting_irq arch/x86/include/asm/apic.h:537
[inline]
[<0000000080d19282>] smp_apic_timer_interrupt+0x96/0x190
arch/x86/kernel/apic/apic.c:1133
[<000000000e93dbd5>] apic_timer_interrupt+0xf/0x20
arch/x86/entry/entry_64.S:830
[<000000002864ce39>] native_safe_halt+0xe/0x10
arch/x86/include/asm/irqflags.h:60
[<000000007e3841ad>] arch_cpu_idle+0xa/0x10
arch/x86/kernel/process.c:571
[<00000000546bc34f>] default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
BUG: memory leak
unreferenced object 0xffff88810de01800 (size 2048):
comm "softirq", pid 0, jiffies 4294947090 (age 32.080s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
06 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
backtrace:
[<0000000002377dcf>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<0000000002377dcf>] slab_post_alloc_hook mm/slab.h:522 [inline]
[<0000000002377dcf>] slab_alloc mm/slab.c:3319 [inline]
[<0000000002377dcf>] __do_kmalloc mm/slab.c:3653 [inline]
[<0000000002377dcf>] __kmalloc+0x169/0x300 mm/slab.c:3664
[<00000000af16d1f0>] kmalloc include/linux/slab.h:557 [inline]
[<00000000af16d1f0>] sk_prot_alloc+0x112/0x170 net/core/sock.c:1603
[<00000000b9033c4c>] sk_alloc+0x35/0x2f0 net/core/sock.c:1657
[<00000000fb9e6269>] nr_make_new net/netrom/af_netrom.c:476 [inline]
[<00000000fb9e6269>] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959
[<00000000fca3a307>] nr_loopback_timer+0x4e/0xd0
net/netrom/nr_loopback.c:59
[<0000000009d4e723>] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322
[<0000000047ea1d35>] expire_timers kernel/time/timer.c:1366 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1685 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1653 [inline]
[<0000000047ea1d35>] run_timer_softirq+0x256/0x740
kernel/time/timer.c:1698
[<00000000e53c6536>] __do_softirq+0x115/0x33f kernel/softirq.c:292
[<0000000024be59bc>] invoke_softirq kernel/softirq.c:373 [inline]
[<0000000024be59bc>] irq_exit+0xbb/0xe0 kernel/softirq.c:413
[<0000000080d19282>] exiting_irq arch/x86/include/asm/apic.h:537
[inline]
[<0000000080d19282>] smp_apic_timer_interrupt+0x96/0x190
arch/x86/kernel/apic/apic.c:1133
[<000000000e93dbd5>] apic_timer_interrupt+0xf/0x20
arch/x86/entry/entry_64.S:830
[<000000002864ce39>] native_safe_halt+0xe/0x10
arch/x86/include/asm/irqflags.h:60
[<000000007e3841ad>] arch_cpu_idle+0xa/0x10
arch/x86/kernel/process.c:571
[<00000000546bc34f>] default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
[<00000000e98df687>] cpuidle_idle_call kernel/sched/idle.c:154 [inline]
[<00000000e98df687>] do_idle+0x1ea/0x2c0 kernel/sched/idle.c:263
[<000000001e3f823f>] cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:354
BUG: memory leak
unreferenced object 0xffff88810fa3c9a0 (size 32):
comm "softirq", pid 0, jiffies 4294947090 (age 32.080s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03 00 00 00 03 00 00 00 0f 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e9077829>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<00000000e9077829>] slab_post_alloc_hook mm/slab.h:522 [inline]
[<00000000e9077829>] slab_alloc mm/slab.c:3319 [inline]
[<00000000e9077829>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548
[<0000000037f78c54>] kmalloc include/linux/slab.h:552 [inline]
[<0000000037f78c54>] kzalloc include/linux/slab.h:748 [inline]
[<0000000037f78c54>] selinux_sk_alloc_security+0x48/0xb0
security/selinux/hooks.c:5073
[<00000000313a65ff>] security_sk_alloc+0x49/0x70
security/security.c:2029
[<00000000ffa4a0b0>] sk_prot_alloc+0x12d/0x170 net/core/sock.c:1606
[<00000000b9033c4c>] sk_alloc+0x35/0x2f0 net/core/sock.c:1657
[<00000000fb9e6269>] nr_make_new net/netrom/af_netrom.c:476 [inline]
[<00000000fb9e6269>] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959
[<00000000fca3a307>] nr_loopback_timer+0x4e/0xd0
net/netrom/nr_loopback.c:59
[<0000000009d4e723>] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322
[<0000000047ea1d35>] expire_timers kernel/time/timer.c:1366 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1685 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1653 [inline]
[<0000000047ea1d35>] run_timer_softirq+0x256/0x740
kernel/time/timer.c:1698
[<00000000e53c6536>] __do_softirq+0x115/0x33f kernel/softirq.c:292
[<0000000024be59bc>] invoke_softirq kernel/softirq.c:373 [inline]
[<0000000024be59bc>] irq_exit+0xbb/0xe0 kernel/softirq.c:413
[<0000000080d19282>] exiting_irq arch/x86/include/asm/apic.h:537
[inline]
[<0000000080d19282>] smp_apic_timer_interrupt+0x96/0x190
arch/x86/kernel/apic/apic.c:1133
[<000000000e93dbd5>] apic_timer_interrupt+0xf/0x20
arch/x86/entry/entry_64.S:830
[<000000002864ce39>] native_safe_halt+0xe/0x10
arch/x86/include/asm/irqflags.h:60
[<000000007e3841ad>] arch_cpu_idle+0xa/0x10
arch/x86/kernel/process.c:571
[<00000000546bc34f>] default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
BUG: memory leak
unreferenced object 0xffff88810de01800 (size 2048):
comm "softirq", pid 0, jiffies 4294947090 (age 32.150s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
06 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
backtrace:
[<0000000002377dcf>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<0000000002377dcf>] slab_post_alloc_hook mm/slab.h:522 [inline]
[<0000000002377dcf>] slab_alloc mm/slab.c:3319 [inline]
[<0000000002377dcf>] __do_kmalloc mm/slab.c:3653 [inline]
[<0000000002377dcf>] __kmalloc+0x169/0x300 mm/slab.c:3664
[<00000000af16d1f0>] kmalloc include/linux/slab.h:557 [inline]
[<00000000af16d1f0>] sk_prot_alloc+0x112/0x170 net/core/sock.c:1603
[<00000000b9033c4c>] sk_alloc+0x35/0x2f0 net/core/sock.c:1657
[<00000000fb9e6269>] nr_make_new net/netrom/af_netrom.c:476 [inline]
[<00000000fb9e6269>] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959
[<00000000fca3a307>] nr_loopback_timer+0x4e/0xd0
net/netrom/nr_loopback.c:59
[<0000000009d4e723>] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322
[<0000000047ea1d35>] expire_timers kernel/time/timer.c:1366 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1685 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1653 [inline]
[<0000000047ea1d35>] run_timer_softirq+0x256/0x740
kernel/time/timer.c:1698
[<00000000e53c6536>] __do_softirq+0x115/0x33f kernel/softirq.c:292
[<0000000024be59bc>] invoke_softirq kernel/softirq.c:373 [inline]
[<0000000024be59bc>] irq_exit+0xbb/0xe0 kernel/softirq.c:413
[<0000000080d19282>] exiting_irq arch/x86/include/asm/apic.h:537
[inline]
[<0000000080d19282>] smp_apic_timer_interrupt+0x96/0x190
arch/x86/kernel/apic/apic.c:1133
[<000000000e93dbd5>] apic_timer_interrupt+0xf/0x20
arch/x86/entry/entry_64.S:830
[<000000002864ce39>] native_safe_halt+0xe/0x10
arch/x86/include/asm/irqflags.h:60
[<000000007e3841ad>] arch_cpu_idle+0xa/0x10
arch/x86/kernel/process.c:571
[<00000000546bc34f>] default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
[<00000000e98df687>] cpuidle_idle_call kernel/sched/idle.c:154 [inline]
[<00000000e98df687>] do_idle+0x1ea/0x2c0 kernel/sched/idle.c:263
[<000000001e3f823f>] cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:354
BUG: memory leak
unreferenced object 0xffff88810fa3c9a0 (size 32):
comm "softirq", pid 0, jiffies 4294947090 (age 32.150s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03 00 00 00 03 00 00 00 0f 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e9077829>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<00000000e9077829>] slab_post_alloc_hook mm/slab.h:522 [inline]
[<00000000e9077829>] slab_alloc mm/slab.c:3319 [inline]
[<00000000e9077829>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548
[<0000000037f78c54>] kmalloc include/linux/slab.h:552 [inline]
[<0000000037f78c54>] kzalloc include/linux/slab.h:748 [inline]
[<0000000037f78c54>] selinux_sk_alloc_security+0x48/0xb0
security/selinux/hooks.c:5073
[<00000000313a65ff>] security_sk_alloc+0x49/0x70
security/security.c:2029
[<00000000ffa4a0b0>] sk_prot_alloc+0x12d/0x170 net/core/sock.c:1606
[<00000000b9033c4c>] sk_alloc+0x35/0x2f0 net/core/sock.c:1657
[<00000000fb9e6269>] nr_make_new net/netrom/af_netrom.c:476 [inline]
[<00000000fb9e6269>] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959
[<00000000fca3a307>] nr_loopback_timer+0x4e/0xd0
net/netrom/nr_loopback.c:59
[<0000000009d4e723>] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322
[<0000000047ea1d35>] expire_timers kernel/time/timer.c:1366 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1685 [inline]
[<0000000047ea1d35>] __run_timers kernel/time/timer.c:1653 [inline]
[<0000000047ea1d35>] run_timer_softirq+0x256/0x740
kernel/time/timer.c:1698
[<00000000e53c6536>] __do_softirq+0x115/0x33f kernel/softirq.c:292
[<0000000024be59bc>] invoke_softirq kernel/softirq.c:373 [inline]
[<0000000024be59bc>] irq_exit+0xbb/0xe0 kernel/softirq.c:413
[<0000000080d19282>] exiting_irq arch/x86/include/asm/apic.h:537
[inline]
[<0000000080d19282>] smp_apic_timer_interrupt+0x96/0x190
arch/x86/kernel/apic/apic.c:1133
[<000000000e93dbd5>] apic_timer_interrupt+0xf/0x20
arch/x86/entry/entry_64.S:830
[<000000002864ce39>] native_safe_halt+0xe/0x10
arch/x86/include/asm/irqflags.h:60
[<000000007e3841ad>] arch_cpu_idle+0xa/0x10
arch/x86/kernel/process.c:571
[<00000000546bc34f>] default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
executing program
executing program
executing program
^ permalink raw reply
* Re: [BACKPORT 4.14.y 4/8] net: sctp: fix warning "NULL check before some freeing functions is not needed"
From: Marcelo Ricardo Leitner @ 2019-09-03 14:52 UTC (permalink / raw)
To: Baolin Wang
Cc: stable, vyasevich, nhorman, davem, hariprasad.kelam, linux-sctp,
netdev, arnd, orsonzhai, vincent.guittot, linux-kernel
In-Reply-To: <0e71732006c11f119826b3be9c1a9ccd102742d8.1567492316.git.baolin.wang@linaro.org>
On Tue, Sep 03, 2019 at 02:58:16PM +0800, Baolin Wang wrote:
> From: Hariprasad Kelam <hariprasad.kelam@gmail.com>
>
> This patch removes NULL checks before calling kfree.
>
> fixes below issues reported by coccicheck
> net/sctp/sm_make_chunk.c:2586:3-8: WARNING: NULL check before some
> freeing functions is not needed.
> net/sctp/sm_make_chunk.c:2652:3-8: WARNING: NULL check before some
> freeing functions is not needed.
> net/sctp/sm_make_chunk.c:2667:3-8: WARNING: NULL check before some
> freeing functions is not needed.
> net/sctp/sm_make_chunk.c:2684:3-8: WARNING: NULL check before some
> freeing functions is not needed.
Hi. This doesn't seem the kind of patch that should be backported to
such old/stable releases. After all, it's just a cleanup.
Marcelo
^ permalink raw reply
* Re: [PATCH net-next v3] net: openvswitch: Set OvS recirc_id from tc chain index
From: Edward Cree @ 2019-09-03 14:56 UTC (permalink / raw)
To: Paul Blakey, Pravin B Shelar, netdev, David S. Miller,
Justin Pettit, Simon Horman, Marcelo Ricardo Leitner, Vlad Buslov
Cc: Jiri Pirko, Roi Dayan, Yossi Kuperman, Rony Efraim, Oz Shlomo
In-Reply-To: <1567517015-10778-2-git-send-email-paulb@mellanox.com>
On 03/09/2019 14:23, Paul Blakey wrote:
> Offloaded OvS datapath rules are translated one to one to tc rules,
> for example the following simplified OvS rule:
>
> recirc_id(0),in_port(dev1),eth_type(0x0800),ct_state(-trk) actions:ct(),recirc(2)
>
> Will be translated to the following tc rule:
>
> $ tc filter add dev dev1 ingress \
> prio 1 chain 0 proto ip \
> flower tcp ct_state -trk \
> action ct pipe \
> action goto chain 2
>
> Received packets will first travel though tc, and if they aren't stolen
> by it, like in the above rule, they will continue to OvS datapath.
> Since we already did some actions (action ct in this case) which might
> modify the packets, and updated action stats, we would like to continue
> the proccessing with the correct recirc_id in OvS (here recirc_id(2))
> where we left off.
IMHO each offload (OvS -> tc, and tc -> hw) ought only take place for a rule
if all sequelae of that rule are also offloaded, or if non-offloaded sequelae
can be guaranteed to provide an unmodified packet so that the exception path
can start from the beginning. I don't like this idea of doing part of the
processing in one place and then resuming the rest later in an entirely
different piece of code.
^ permalink raw reply
* Re: [PATCH bpf-next v2 2/4] xsk: add proper barriers and {READ, WRITE}_ONCE-correctness for state
From: Daniel Borkmann @ 2019-09-03 15:22 UTC (permalink / raw)
To: Björn Töpel, ast, netdev
Cc: Björn Töpel, magnus.karlsson, magnus.karlsson, bpf,
jonathan.lemon, syzbot+c82697e3043781e08802, hdanton, i.maximets
In-Reply-To: <20190826061053.15996-3-bjorn.topel@gmail.com>
On 8/26/19 8:10 AM, Björn Töpel wrote:
> From: Björn Töpel <bjorn.topel@intel.com>
>
> The state variable was read, and written outside the control mutex
> (struct xdp_sock, mutex), without proper barriers and {READ,
> WRITE}_ONCE correctness.
>
> In this commit this issue is addressed, and the state member is now
> used a point of synchronization whether the socket is setup correctly
> or not.
>
> This also fixes a race, found by syzcaller, in xsk_poll() where umem
> could be accessed when stale.
>
> Suggested-by: Hillf Danton <hdanton@sina.com>
> Reported-by: syzbot+c82697e3043781e08802@syzkaller.appspotmail.com
> Fixes: 77cd0d7b3f25 ("xsk: add support for need_wakeup flag in AF_XDP rings")
> Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Sorry for the delay.
> ---
> net/xdp/xsk.c | 57 ++++++++++++++++++++++++++++++++++++---------------
> 1 file changed, 40 insertions(+), 17 deletions(-)
>
> diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
> index f3351013c2a5..8fafa3ce3ae6 100644
> --- a/net/xdp/xsk.c
> +++ b/net/xdp/xsk.c
> @@ -162,10 +162,23 @@ static int __xsk_rcv_zc(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len)
> return err;
> }
>
> +static bool xsk_is_bound(struct xdp_sock *xs)
> +{
> + if (READ_ONCE(xs->state) == XSK_BOUND) {
> + /* Matches smp_wmb() in bind(). */
> + smp_rmb();
> + return true;
> + }
> + return false;
> +}
> +
> int xsk_rcv(struct xdp_sock *xs, struct xdp_buff *xdp)
> {
> u32 len;
>
> + if (!xsk_is_bound(xs))
> + return -EINVAL;
> +
> if (xs->dev != xdp->rxq->dev || xs->queue_id != xdp->rxq->queue_index)
> return -EINVAL;
>
> @@ -362,7 +375,7 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
> struct sock *sk = sock->sk;
> struct xdp_sock *xs = xdp_sk(sk);
>
> - if (unlikely(!xs->dev))
> + if (unlikely(!xsk_is_bound(xs)))
> return -ENXIO;
> if (unlikely(!(xs->dev->flags & IFF_UP)))
> return -ENETDOWN;
> @@ -378,10 +391,15 @@ static unsigned int xsk_poll(struct file *file, struct socket *sock,
> struct poll_table_struct *wait)
> {
> unsigned int mask = datagram_poll(file, sock, wait);
> - struct sock *sk = sock->sk;
> - struct xdp_sock *xs = xdp_sk(sk);
> - struct net_device *dev = xs->dev;
> - struct xdp_umem *umem = xs->umem;
> + struct xdp_sock *xs = xdp_sk(sock->sk);
> + struct net_device *dev;
> + struct xdp_umem *umem;
> +
> + if (unlikely(!xsk_is_bound(xs)))
> + return mask;
> +
> + dev = xs->dev;
> + umem = xs->umem;
>
> if (umem->need_wakeup)
> dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id,
> @@ -417,10 +435,9 @@ static void xsk_unbind_dev(struct xdp_sock *xs)
> {
> struct net_device *dev = xs->dev;
>
> - if (!dev || xs->state != XSK_BOUND)
> + if (xs->state != XSK_BOUND)
> return;
> -
> - xs->state = XSK_UNBOUND;
> + WRITE_ONCE(xs->state, XSK_UNBOUND);
>
> /* Wait for driver to stop using the xdp socket. */
> xdp_del_sk_umem(xs->umem, xs);
> @@ -495,7 +512,9 @@ static int xsk_release(struct socket *sock)
> local_bh_enable();
>
> xsk_delete_from_maps(xs);
> + mutex_lock(&xs->mutex);
> xsk_unbind_dev(xs);
> + mutex_unlock(&xs->mutex);
>
> xskq_destroy(xs->rx);
> xskq_destroy(xs->tx);
> @@ -589,19 +608,18 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
> }
>
> umem_xs = xdp_sk(sock->sk);
> - if (!umem_xs->umem) {
> - /* No umem to inherit. */
> + if (!xsk_is_bound(umem_xs)) {
> err = -EBADF;
> sockfd_put(sock);
> goto out_unlock;
> - } else if (umem_xs->dev != dev || umem_xs->queue_id != qid) {
> + }
> + if (umem_xs->dev != dev || umem_xs->queue_id != qid) {
> err = -EINVAL;
> sockfd_put(sock);
> goto out_unlock;
> }
> -
> xdp_get_umem(umem_xs->umem);
> - xs->umem = umem_xs->umem;
> + WRITE_ONCE(xs->umem, umem_xs->umem);
> sockfd_put(sock);
> } else if (!xs->umem || !xdp_umem_validate_queues(xs->umem)) {
> err = -EINVAL;
> @@ -626,10 +644,15 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
> xdp_add_sk_umem(xs->umem, xs);
>
> out_unlock:
> - if (err)
> + if (err) {
> dev_put(dev);
> - else
> - xs->state = XSK_BOUND;
> + } else {
> + /* Matches smp_rmb() in bind() for shared umem
> + * sockets, and xsk_is_bound().
> + */
> + smp_wmb();
You write with what this barrier matches/pairs, but would be useful for readers
to have an explanation against what it protects. I presume to have things like
xs->umem public as you seem to guard it behind xsk_is_bound() in xsk_poll() and
other cases? Would be great to have a detailed analysis of all this e.g. in the
commit message so one wouldn't need to guess; right now it feels this is doing
many things at once and w/o further explanation of why READ_ONCE() or others are
omitted sometimes. Would be great to get a lot more clarity into this, perhaps
splitting it up a bit might also help.
> + WRITE_ONCE(xs->state, XSK_BOUND);
> + }
Thanks,
Daniel
^ permalink raw reply
* Re: [PATCH v2 4/4] can: mcp251x: Get rid of legacy platform data
From: Andy Shevchenko @ 2019-09-03 15:22 UTC (permalink / raw)
To: Marc Kleine-Budde
Cc: Wolfgang Grandegger, linux-can, David S. Miller, netdev,
Daniel Mack, Haojian Zhuang, Robert Jarzmik, Russell King
In-Reply-To: <dc494f9a-0de3-5beb-bcbf-adbfb4813761@pengutronix.de>
On Tue, Sep 03, 2019 at 03:17:11PM +0200, Marc Kleine-Budde wrote:
> On 9/3/19 2:42 PM, Andy Shevchenko wrote:
> > Instead of using legacy platform data, switch to use device properties.
> > For clock frequency we are using well established clock-frequency property.
> >
> > Users, two for now, are also converted here.
>
> I've removed this section already in this patch:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next.git/commit/?h=linux-can-next-for-5.4-20190903&id=f6cae800bfdb6711f0d45af98643a944998be6f2
>
> ...I've dropped that hunk.
Awesome, thanks!
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH bpf-next v2 2/4] xsk: add proper barriers and {READ, WRITE}_ONCE-correctness for state
From: Björn Töpel @ 2019-09-03 15:26 UTC (permalink / raw)
To: Daniel Borkmann
Cc: Alexei Starovoitov, Netdev, Björn Töpel,
Karlsson, Magnus, Magnus Karlsson, bpf, Jonathan Lemon,
syzbot+c82697e3043781e08802, Hillf Danton, Ilya Maximets
In-Reply-To: <b580a3c0-c7c2-2191-997b-473ae65f977e@iogearbox.net>
On Tue, 3 Sep 2019 at 17:22, Daniel Borkmann <daniel@iogearbox.net> wrote:
>
> On 8/26/19 8:10 AM, Björn Töpel wrote:
> > From: Björn Töpel <bjorn.topel@intel.com>
> >
> > The state variable was read, and written outside the control mutex
> > (struct xdp_sock, mutex), without proper barriers and {READ,
> > WRITE}_ONCE correctness.
> >
> > In this commit this issue is addressed, and the state member is now
> > used a point of synchronization whether the socket is setup correctly
> > or not.
> >
> > This also fixes a race, found by syzcaller, in xsk_poll() where umem
> > could be accessed when stale.
> >
> > Suggested-by: Hillf Danton <hdanton@sina.com>
> > Reported-by: syzbot+c82697e3043781e08802@syzkaller.appspotmail.com
> > Fixes: 77cd0d7b3f25 ("xsk: add support for need_wakeup flag in AF_XDP rings")
> > Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
>
> Sorry for the delay.
>
> > ---
> > net/xdp/xsk.c | 57 ++++++++++++++++++++++++++++++++++++---------------
> > 1 file changed, 40 insertions(+), 17 deletions(-)
> >
> > diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
> > index f3351013c2a5..8fafa3ce3ae6 100644
> > --- a/net/xdp/xsk.c
> > +++ b/net/xdp/xsk.c
> > @@ -162,10 +162,23 @@ static int __xsk_rcv_zc(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len)
> > return err;
> > }
> >
> > +static bool xsk_is_bound(struct xdp_sock *xs)
> > +{
> > + if (READ_ONCE(xs->state) == XSK_BOUND) {
> > + /* Matches smp_wmb() in bind(). */
> > + smp_rmb();
> > + return true;
> > + }
> > + return false;
> > +}
> > +
> > int xsk_rcv(struct xdp_sock *xs, struct xdp_buff *xdp)
> > {
> > u32 len;
> >
> > + if (!xsk_is_bound(xs))
> > + return -EINVAL;
> > +
> > if (xs->dev != xdp->rxq->dev || xs->queue_id != xdp->rxq->queue_index)
> > return -EINVAL;
> >
> > @@ -362,7 +375,7 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
> > struct sock *sk = sock->sk;
> > struct xdp_sock *xs = xdp_sk(sk);
> >
> > - if (unlikely(!xs->dev))
> > + if (unlikely(!xsk_is_bound(xs)))
> > return -ENXIO;
> > if (unlikely(!(xs->dev->flags & IFF_UP)))
> > return -ENETDOWN;
> > @@ -378,10 +391,15 @@ static unsigned int xsk_poll(struct file *file, struct socket *sock,
> > struct poll_table_struct *wait)
> > {
> > unsigned int mask = datagram_poll(file, sock, wait);
> > - struct sock *sk = sock->sk;
> > - struct xdp_sock *xs = xdp_sk(sk);
> > - struct net_device *dev = xs->dev;
> > - struct xdp_umem *umem = xs->umem;
> > + struct xdp_sock *xs = xdp_sk(sock->sk);
> > + struct net_device *dev;
> > + struct xdp_umem *umem;
> > +
> > + if (unlikely(!xsk_is_bound(xs)))
> > + return mask;
> > +
> > + dev = xs->dev;
> > + umem = xs->umem;
> >
> > if (umem->need_wakeup)
> > dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id,
> > @@ -417,10 +435,9 @@ static void xsk_unbind_dev(struct xdp_sock *xs)
> > {
> > struct net_device *dev = xs->dev;
> >
> > - if (!dev || xs->state != XSK_BOUND)
> > + if (xs->state != XSK_BOUND)
> > return;
> > -
> > - xs->state = XSK_UNBOUND;
> > + WRITE_ONCE(xs->state, XSK_UNBOUND);
> >
> > /* Wait for driver to stop using the xdp socket. */
> > xdp_del_sk_umem(xs->umem, xs);
> > @@ -495,7 +512,9 @@ static int xsk_release(struct socket *sock)
> > local_bh_enable();
> >
> > xsk_delete_from_maps(xs);
> > + mutex_lock(&xs->mutex);
> > xsk_unbind_dev(xs);
> > + mutex_unlock(&xs->mutex);
> >
> > xskq_destroy(xs->rx);
> > xskq_destroy(xs->tx);
> > @@ -589,19 +608,18 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
> > }
> >
> > umem_xs = xdp_sk(sock->sk);
> > - if (!umem_xs->umem) {
> > - /* No umem to inherit. */
> > + if (!xsk_is_bound(umem_xs)) {
> > err = -EBADF;
> > sockfd_put(sock);
> > goto out_unlock;
> > - } else if (umem_xs->dev != dev || umem_xs->queue_id != qid) {
> > + }
> > + if (umem_xs->dev != dev || umem_xs->queue_id != qid) {
> > err = -EINVAL;
> > sockfd_put(sock);
> > goto out_unlock;
> > }
> > -
> > xdp_get_umem(umem_xs->umem);
> > - xs->umem = umem_xs->umem;
> > + WRITE_ONCE(xs->umem, umem_xs->umem);
> > sockfd_put(sock);
> > } else if (!xs->umem || !xdp_umem_validate_queues(xs->umem)) {
> > err = -EINVAL;
> > @@ -626,10 +644,15 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
> > xdp_add_sk_umem(xs->umem, xs);
> >
> > out_unlock:
> > - if (err)
> > + if (err) {
> > dev_put(dev);
> > - else
> > - xs->state = XSK_BOUND;
> > + } else {
> > + /* Matches smp_rmb() in bind() for shared umem
> > + * sockets, and xsk_is_bound().
> > + */
> > + smp_wmb();
>
> You write with what this barrier matches/pairs, but would be useful for readers
> to have an explanation against what it protects. I presume to have things like
> xs->umem public as you seem to guard it behind xsk_is_bound() in xsk_poll() and
> other cases? Would be great to have a detailed analysis of all this e.g. in the
> commit message so one wouldn't need to guess; right now it feels this is doing
> many things at once and w/o further explanation of why READ_ONCE() or others are
> omitted sometimes. Would be great to get a lot more clarity into this, perhaps
> splitting it up a bit might also help.
>
I'll address that. Thanks for the review!
Björn
> > + WRITE_ONCE(xs->state, XSK_BOUND);
> > + }
>
> Thanks,
> Daniel
^ permalink raw reply
* Re: [PATCH] Clock-independent TCP ISN generation
From: Cyrus Sh @ 2019-09-03 15:39 UTC (permalink / raw)
To: Eric Dumazet, davem; +Cc: shiraz.saleem, jgg, arnd, netdev, sirus
In-Reply-To: <fa0aadb3-9ada-fb08-6f32-450f5ac3a3e1@gmail.com>
On 9/3/19 1:41 AM, Eric Dumazet wrote:
> Clock skew seems quite secondary. Some firewall rules should prevent this kind of attacks ?
Can you provide any reference to somewhere that explains these firewall rules
and how to exactly use them to prevent this specific type of attack?
^ permalink raw reply
* Re: [PATCH] net/skbuff: silence warnings under memory pressure
From: Qian Cai @ 2019-09-03 15:42 UTC (permalink / raw)
To: Michal Hocko, Eric Dumazet; +Cc: davem, netdev, linux-mm, linux-kernel
In-Reply-To: <20190903132231.GC18939@dhcp22.suse.cz>
On Tue, 2019-09-03 at 15:22 +0200, Michal Hocko wrote:
> On Fri 30-08-19 18:15:22, Eric Dumazet wrote:
> > If there is a risk of flooding the syslog, we should fix this generically
> > in mm layer, not adding hundred of __GFP_NOWARN all over the places.
>
> We do already ratelimit in warn_alloc. If it isn't sufficient then we
> can think of a different parameters. Or maybe it is the ratelimiting
> which doesn't work here. Hard to tell and something to explore.
The time-based ratelimit won't work for skb_build() as when a system under
memory pressure, and the CPU is fast and IO is so slow, it could take a long
time to swap and trigger OOM.
I suppose what happens is those skb_build() allocations are from softirq, and
once one of them failed, it calls printk() which generates more interrupts.
Hence, the infinite loop.
^ permalink raw reply
* Re: BUG_ON in skb_segment, after bpf_skb_change_proto was applied
From: Shmulik Ladkani @ 2019-09-03 15:51 UTC (permalink / raw)
To: Willem de Bruijn, Daniel Borkmann
Cc: Eric Dumazet, netdev, Alexander Duyck, Alexei Starovoitov,
Yonghong Song, Steffen Klassert, Shmulik Ladkani, eyal
In-Reply-To: <CA+FuTSfVsgNDi7c=GUU8nMg2hWxF2SjCNLXetHeVPdnxAW5K-w@mail.gmail.com>
On Sun, 1 Sep 2019 16:05:48 -0400
Willem de Bruijn <willemdebruijn.kernel@gmail.com> wrote:
> One quick fix is to disable sg and thus revert to copying in this
> case. Not ideal, but better than a kernel splat:
>
> @@ -3714,6 +3714,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
> sg = !!(features & NETIF_F_SG);
> csum = !!can_checksum_protocol(features, proto);
>
> + if (list_skb && skb_headlen(list_skb) && !list_skb->head_frag)
> + sg = false;
> +
Thanks Willem.
I followed this approach, and further refined it based on the conditions
that lead to this BUG_ON:
- existance of frag_list
- mangled gso_size (using SKB_GSO_DODGY as a hint)
- some frag in the frag_list has a linear part that is NOT head_frag,
or length not equal to the requested gso_size
BTW, doing so allowed me to refactor a loop that tests for similar
conditions in the !(features & NETIF_F_GSO_PARTIAL) case, where an
attempt to execute partial splitting at the frag_list pointer (see
07b26c9454a2 and 43170c4e0ba7).
I've tested this using the reproducer, with various linear skbs in
the frag_list and different gso_size mangling. All resulting 'segs'
looked correct. Did not test on a live system yet.
Comments are welcome.
specifically, I would like to know whether we can
- better refine the condition where this "sg=false fallback" needs
to be applied
- consolidate my new 'list_skb && (type & SKB_GSO_DODGY)' case with
the existing '!(features & NETIF_F_GSO_PARTIAL)' case
see below:
@@ -3470,6 +3470,27 @@ static inline skb_frag_t skb_head_frag_to_page_desc(struct sk_buff *frag_skb)
return head_frag;
}
+static inline bool skb_is_nonlinear_equal_frags(struct sk_buff *skb,
+ unsigned int total_len,
+ unsigned int frag_len,
+ unsigned int *remain)
+{
+ struct sk_buff *iter;
+
+ skb_walk_frags(skb, iter) {
+ if (iter->len != frag_len && iter->next)
+ return false;
+ if (skb_headlen(iter) && !iter->head_frag)
+ return false;
+
+ total_len -= iter->len;
+ }
+
+ if (remain)
+ *remain = total_len;
+ return total_len == frag_len;
+}
+
/**
* skb_segment - Perform protocol segmentation on skb.
* @head_skb: buffer to segment
@@ -3486,6 +3507,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
struct sk_buff *tail = NULL;
struct sk_buff *list_skb = skb_shinfo(head_skb)->frag_list;
skb_frag_t *frag = skb_shinfo(head_skb)->frags;
+ unsigned int type = skb_shinfo(head_skb)->gso_type;
unsigned int mss = skb_shinfo(head_skb)->gso_size;
unsigned int doffset = head_skb->data - skb_mac_header(head_skb);
struct sk_buff *frag_skb = head_skb;
@@ -3510,13 +3532,29 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
sg = !!(features & NETIF_F_SG);
csum = !!can_checksum_protocol(features, proto);
- if (sg && csum && (mss != GSO_BY_FRAGS)) {
+ if (sg && (mss != GSO_BY_FRAGS)) {
+ if (list_skb && (type & SKB_GSO_DODGY)) {
+ /* gso_size is untrusted.
+ * if head_skb has a frag_list that contains a frag
+ * with a linear (non head_frag) part, or a frag whose
+ * length doesn't fit requested mss, fallback to skb
+ * copying by disabling sg.
+ */
+ if (!skb_is_nonlinear_equal_frags(head_skb, len, mss,
+ NULL)) {
+ sg = false;
+ goto normal;
+ }
+ }
+
+ if (!csum)
+ goto normal;
+
if (!(features & NETIF_F_GSO_PARTIAL)) {
- struct sk_buff *iter;
unsigned int frag_len;
if (!list_skb ||
- !net_gso_ok(features, skb_shinfo(head_skb)->gso_type))
+ !net_gso_ok(features, type))
goto normal;
/* If we get here then all the required
@@ -3528,17 +3566,10 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
* the last are of the same length.
*/
frag_len = list_skb->len;
- skb_walk_frags(head_skb, iter) {
- if (frag_len != iter->len && iter->next)
- goto normal;
- if (skb_headlen(iter) && !iter->head_frag)
- goto normal;
-
- len -= iter->len;
- }
-
- if (len != frag_len)
+ if (!skb_is_nonlinear_equal_frags(head_skb, len,
+ frag_len, &len)) {
goto normal;
+ }
}
/* GSO partial only requires that we trim off any excess that
^ permalink raw reply
* Re: [PATCH] Clock-independent TCP ISN generation
From: Eric Dumazet @ 2019-09-03 15:59 UTC (permalink / raw)
To: Cyrus Sh, davem; +Cc: shiraz.saleem, jgg, arnd, netdev, sirus
In-Reply-To: <bf10fbfb-a83f-a8d8-fefc-2a2fd1633ef8@gmail.com>
On 9/3/19 5:39 PM, Cyrus Sh wrote:
>
>
> On 9/3/19 1:41 AM, Eric Dumazet wrote:
>> Clock skew seems quite secondary. Some firewall rules should prevent this kind of attacks ?
>
> Can you provide any reference to somewhere that explains these firewall rules
> and how to exactly use them to prevent this specific type of attack?
>
You could add a random delay to all SYN packets, if you believe your host has clock skews.
^ permalink raw reply
* Re: [PATCH] Clock-independent TCP ISN generation
From: Cyrus Sh @ 2019-09-03 16:06 UTC (permalink / raw)
To: Eric Dumazet, davem; +Cc: shiraz.saleem, jgg, arnd, netdev, sirus
In-Reply-To: <2cbd5a8f-f120-a7df-83a3-923f33ca0a10@gmail.com>
On 9/3/19 9:59 AM, Eric Dumazet wrote:
>
> You could add a random delay to all SYN packets, if you believe your host has clock skews.
In theory yes, but again do you know any practical example with tested
applications and the list of the rules? I'm interested to see an actual example
that somebody has carried out and observed its results.
^ permalink raw reply
* Re: [PATCH] Clock-independent TCP ISN generation
From: Cyrus Sh @ 2019-09-03 16:12 UTC (permalink / raw)
To: Eric Dumazet, davem; +Cc: shiraz.saleem, jgg, arnd, netdev, sirus
In-Reply-To: <2cbd5a8f-f120-a7df-83a3-923f33ca0a10@gmail.com>
On 9/3/19 9:59 AM, Eric Dumazet wrote:
> You could add a random delay to all SYN packets, if you believe your host has clock skews.
And by the way adding delays has its own performance penalties.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox