* [PATCH for-3.18 01/15] ipv6: fix possible deadlock in ip6_fl_purge / ip6_fl_gc
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 02/15] net: sctp: fix race for one-to-many sockets in sendmsg's auto associate Amit Pundir
` (14 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Jan Stancek, David S . Miller
From: Jan Stancek <jstancek@redhat.com>
commit 4762fb980465463734f02c67c67f40beb8903f73 upstream.
Use spin_lock_bh in ip6_fl_purge() to prevent following potentially
deadlock scenario between ip6_fl_purge() and ip6_fl_gc() timer.
=================================
[ INFO: inconsistent lock state ]
3.19.0 #1 Not tainted
---------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
swapper/5/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
(ip6_fl_lock){+.?...}, at: [<ffffffff8171155d>] ip6_fl_gc+0x2d/0x180
{SOFTIRQ-ON-W} state was registered at:
[<ffffffff810ee9a0>] __lock_acquire+0x4a0/0x10b0
[<ffffffff810efd54>] lock_acquire+0xc4/0x2b0
[<ffffffff81751d2d>] _raw_spin_lock+0x3d/0x80
[<ffffffff81711798>] ip6_flowlabel_net_exit+0x28/0x110
[<ffffffff815f9759>] ops_exit_list.isra.1+0x39/0x60
[<ffffffff815fa320>] cleanup_net+0x100/0x1e0
[<ffffffff810ad80a>] process_one_work+0x20a/0x830
[<ffffffff810adf4b>] worker_thread+0x11b/0x460
[<ffffffff810b42f4>] kthread+0x104/0x120
[<ffffffff81752bfc>] ret_from_fork+0x7c/0xb0
irq event stamp: 84640
hardirqs last enabled at (84640): [<ffffffff81752080>] _raw_spin_unlock_irq+0x30/0x50
hardirqs last disabled at (84639): [<ffffffff81751eff>] _raw_spin_lock_irq+0x1f/0x80
softirqs last enabled at (84628): [<ffffffff81091ad1>] _local_bh_enable+0x21/0x50
softirqs last disabled at (84629): [<ffffffff81093b7d>] irq_exit+0x12d/0x150
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(ip6_fl_lock);
<Interrupt>
lock(ip6_fl_lock);
*** DEADLOCK ***
Signed-off-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
net/ipv6/ip6_flowlabel.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 3dd7d4ebd7cd..a837f2065d2a 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -172,7 +172,7 @@ static void __net_exit ip6_fl_purge(struct net *net)
{
int i;
- spin_lock(&ip6_fl_lock);
+ spin_lock_bh(&ip6_fl_lock);
for (i = 0; i <= FL_HASH_MASK; i++) {
struct ip6_flowlabel *fl;
struct ip6_flowlabel __rcu **flp;
@@ -190,7 +190,7 @@ static void __net_exit ip6_fl_purge(struct net *net)
flp = &fl->next;
}
}
- spin_unlock(&ip6_fl_lock);
+ spin_unlock_bh(&ip6_fl_lock);
}
static struct ip6_flowlabel *fl_intern(struct net *net,
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH for-3.18 02/15] net: sctp: fix race for one-to-many sockets in sendmsg's auto associate
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 01/15] ipv6: fix possible deadlock in ip6_fl_purge / ip6_fl_gc Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 03/15] sh_eth: Fix ethtool operation crash when net device is down Amit Pundir
` (13 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Daniel Borkmann, David S . Miller
From: Daniel Borkmann <dborkman@redhat.com>
commit 2061dcd6bff8b774b4fac8b0739b6be3f87bc9f2 upstream.
I.e. one-to-many sockets in SCTP are not required to explicitly
call into connect(2) or sctp_connectx(2) prior to data exchange.
Instead, they can directly invoke sendmsg(2) and the SCTP stack
will automatically trigger connection establishment through 4WHS
via sctp_primitive_ASSOCIATE(). However, this in its current
implementation is racy: INIT is being sent out immediately (as
it cannot be bundled anyway) and the rest of the DATA chunks are
queued up for later xmit when connection is established, meaning
sendmsg(2) will return successfully. This behaviour can result
in an undesired side-effect that the kernel made the application
think the data has already been transmitted, although none of it
has actually left the machine, worst case even after close(2)'ing
the socket.
Instead, when the association from client side has been shut down
e.g. first gracefully through SCTP_EOF and then close(2), the
client could afterwards still receive the server's INIT_ACK due
to a connection with higher latency. This INIT_ACK is then considered
out of the blue and hence responded with ABORT as there was no
alive assoc found anymore. This can be easily reproduced f.e.
with sctp_test application from lksctp. One way to fix this race
is to wait for the handshake to actually complete.
The fix defers waiting after sctp_primitive_ASSOCIATE() and
sctp_primitive_SEND() succeeded, so that DATA chunks cooked up
from sctp_sendmsg() have already been placed into the output
queue through the side-effect interpreter, and therefore can then
be bundeled together with COOKIE_ECHO control chunks.
strace from example application (shortened):
socket(PF_INET, SOCK_SEQPACKET, IPPROTO_SCTP) = 3
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(1)=[{"hello", 5}], msg_controllen=0, msg_flags=0}, 0) = 5
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(1)=[{"hello", 5}], msg_controllen=0, msg_flags=0}, 0) = 5
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(1)=[{"hello", 5}], msg_controllen=0, msg_flags=0}, 0) = 5
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(1)=[{"hello", 5}], msg_controllen=0, msg_flags=0}, 0) = 5
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(0)=[], msg_controllen=48, {cmsg_len=48, cmsg_level=0x84 /* SOL_??? */, cmsg_type=, ...},
msg_flags=0}, 0) = 0 // graceful shutdown for SOCK_SEQPACKET via SCTP_EOF
close(3) = 0
tcpdump before patch (fooling the application):
22:33:36.306142 IP 192.168.1.114.41462 > 192.168.1.115.8888: sctp (1) [INIT] [init tag: 3879023686] [rwnd: 106496] [OS: 10] [MIS: 65535] [init TSN: 3139201684]
22:33:36.316619 IP 192.168.1.115.8888 > 192.168.1.114.41462: sctp (1) [INIT ACK] [init tag: 3345394793] [rwnd: 106496] [OS: 10] [MIS: 10] [init TSN: 3380109591]
22:33:36.317600 IP 192.168.1.114.41462 > 192.168.1.115.8888: sctp (1) [ABORT]
tcpdump after patch:
14:28:58.884116 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [INIT] [init tag: 438593213] [rwnd: 106496] [OS: 10] [MIS: 65535] [init TSN: 3092969729]
14:28:58.888414 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [INIT ACK] [init tag: 381429855] [rwnd: 106496] [OS: 10] [MIS: 10] [init TSN: 2141904492]
14:28:58.888638 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [COOKIE ECHO] , (2) [DATA] (B)(E) [TSN: 3092969729] [...]
14:28:58.893278 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [COOKIE ACK] , (2) [SACK] [cum ack 3092969729] [a_rwnd 106491] [#gap acks 0] [#dup tsns 0]
14:28:58.893591 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [DATA] (B)(E) [TSN: 3092969730] [...]
14:28:59.096963 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [SACK] [cum ack 3092969730] [a_rwnd 106496] [#gap acks 0] [#dup tsns 0]
14:28:59.097086 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [DATA] (B)(E) [TSN: 3092969731] [...] , (2) [DATA] (B)(E) [TSN: 3092969732] [...]
14:28:59.103218 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [SACK] [cum ack 3092969732] [a_rwnd 106486] [#gap acks 0] [#dup tsns 0]
14:28:59.103330 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [SHUTDOWN]
14:28:59.107793 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [SHUTDOWN ACK]
14:28:59.107890 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [SHUTDOWN COMPLETE]
Looks like this bug is from the pre-git history museum. ;)
Fixes: 08707d5482df ("lksctp-2_5_31-0_5_1.patch")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
net/sctp/socket.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 92c920c9cfa6..92c6eac72ea6 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1604,7 +1604,7 @@ static int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
sctp_assoc_t associd = 0;
sctp_cmsgs_t cmsgs = { NULL };
sctp_scope_t scope;
- bool fill_sinfo_ttl = false;
+ bool fill_sinfo_ttl = false, wait_connect = false;
struct sctp_datamsg *datamsg;
int msg_flags = msg->msg_flags;
__u16 sinfo_flags = 0;
@@ -1944,6 +1944,7 @@ static int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
if (err < 0)
goto out_free;
+ wait_connect = true;
pr_debug("%s: we associated primitively\n", __func__);
}
@@ -1981,6 +1982,11 @@ static int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
sctp_datamsg_put(datamsg);
err = msg_len;
+ if (unlikely(wait_connect)) {
+ timeo = sock_sndtimeo(sk, msg_flags & MSG_DONTWAIT);
+ sctp_wait_for_connect(asoc, &timeo);
+ }
+
/* If we are already past ASSOCIATE, the lower
* layers are responsible for association cleanup.
*/
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH for-3.18 03/15] sh_eth: Fix ethtool operation crash when net device is down
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 01/15] ipv6: fix possible deadlock in ip6_fl_purge / ip6_fl_gc Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 02/15] net: sctp: fix race for one-to-many sockets in sendmsg's auto associate Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 04/15] ppp: take reference on channels netns Amit Pundir
` (12 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Ben Hutchings, David S . Miller
From: Ben Hutchings <ben.hutchings@codethink.co.uk>
commit 4f9dce230b32eec45cec8c28cae61efdfa2f7d57 upstream.
The driver connects and disconnects the PHY device whenever the
net device is brought up and down. The ethtool get_settings,
set_settings and nway_reset operations will dereference a null
or dangling pointer if called while it is down.
I think it would be preferable to keep the PHY connected, but there
may be good reasons not to.
As an immediate fix for this bug:
- Set the phydev pointer to NULL after disconnecting the PHY
- Change those three operations to return -ENODEV while the PHY is
not connected
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
drivers/net/ethernet/renesas/sh_eth.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index c44bae495804..f25b5b8b120f 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1832,6 +1832,9 @@ static int sh_eth_get_settings(struct net_device *ndev,
unsigned long flags;
int ret;
+ if (!mdp->phydev)
+ return -ENODEV;
+
spin_lock_irqsave(&mdp->lock, flags);
ret = phy_ethtool_gset(mdp->phydev, ecmd);
spin_unlock_irqrestore(&mdp->lock, flags);
@@ -1846,6 +1849,9 @@ static int sh_eth_set_settings(struct net_device *ndev,
unsigned long flags;
int ret;
+ if (!mdp->phydev)
+ return -ENODEV;
+
spin_lock_irqsave(&mdp->lock, flags);
/* disable tx and rx */
@@ -1880,6 +1886,9 @@ static int sh_eth_nway_reset(struct net_device *ndev)
unsigned long flags;
int ret;
+ if (!mdp->phydev)
+ return -ENODEV;
+
spin_lock_irqsave(&mdp->lock, flags);
ret = phy_start_aneg(mdp->phydev);
spin_unlock_irqrestore(&mdp->lock, flags);
@@ -2189,6 +2198,7 @@ static int sh_eth_close(struct net_device *ndev)
if (mdp->phydev) {
phy_stop(mdp->phydev);
phy_disconnect(mdp->phydev);
+ mdp->phydev = NULL;
}
free_irq(ndev->irq, ndev);
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH for-3.18 04/15] ppp: take reference on channels netns
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
` (2 preceding siblings ...)
2017-07-25 20:45 ` [PATCH for-3.18 03/15] sh_eth: Fix ethtool operation crash when net device is down Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-26 9:52 ` Guillaume Nault
2017-07-25 20:45 ` [PATCH for-3.18 05/15] mpt3sas: Don't overreach ioc->reply_post[] during initialization Amit Pundir
` (11 subsequent siblings)
15 siblings, 1 reply; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Guillaume Nault, David S . Miller
From: Guillaume Nault <g.nault@alphalink.fr>
commit 1f461dcdd296eecedaffffc6bae2bfa90bd7eb89 upstream.
Let channels hold a reference on their network namespace.
Some channel types, like ppp_async and ppp_synctty, can have their
userspace controller running in a different namespace. Therefore they
can't rely on them to preclude their netns from being removed from
under them.
==================================================================
BUG: KASAN: use-after-free in ppp_unregister_channel+0x372/0x3a0 at
addr ffff880064e217e0
Read of size 8 by task syz-executor/11581
=============================================================================
BUG net_namespace (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: Allocated in copy_net_ns+0x6b/0x1a0 age=92569 cpu=3 pid=6906
[< none >] ___slab_alloc+0x4c7/0x500 kernel/mm/slub.c:2440
[< none >] __slab_alloc+0x4c/0x90 kernel/mm/slub.c:2469
[< inline >] slab_alloc_node kernel/mm/slub.c:2532
[< inline >] slab_alloc kernel/mm/slub.c:2574
[< none >] kmem_cache_alloc+0x23a/0x2b0 kernel/mm/slub.c:2579
[< inline >] kmem_cache_zalloc kernel/include/linux/slab.h:597
[< inline >] net_alloc kernel/net/core/net_namespace.c:325
[< none >] copy_net_ns+0x6b/0x1a0 kernel/net/core/net_namespace.c:360
[< none >] create_new_namespaces+0x2f6/0x610 kernel/kernel/nsproxy.c:95
[< none >] copy_namespaces+0x297/0x320 kernel/kernel/nsproxy.c:150
[< none >] copy_process.part.35+0x1bf4/0x5760 kernel/kernel/fork.c:1451
[< inline >] copy_process kernel/kernel/fork.c:1274
[< none >] _do_fork+0x1bc/0xcb0 kernel/kernel/fork.c:1723
[< inline >] SYSC_clone kernel/kernel/fork.c:1832
[< none >] SyS_clone+0x37/0x50 kernel/kernel/fork.c:1826
[< none >] entry_SYSCALL_64_fastpath+0x16/0x7a kernel/arch/x86/entry/entry_64.S:185
INFO: Freed in net_drop_ns+0x67/0x80 age=575 cpu=2 pid=2631
[< none >] __slab_free+0x1fc/0x320 kernel/mm/slub.c:2650
[< inline >] slab_free kernel/mm/slub.c:2805
[< none >] kmem_cache_free+0x2a0/0x330 kernel/mm/slub.c:2814
[< inline >] net_free kernel/net/core/net_namespace.c:341
[< none >] net_drop_ns+0x67/0x80 kernel/net/core/net_namespace.c:348
[< none >] cleanup_net+0x4e5/0x600 kernel/net/core/net_namespace.c:448
[< none >] process_one_work+0x794/0x1440 kernel/kernel/workqueue.c:2036
[< none >] worker_thread+0xdb/0xfc0 kernel/kernel/workqueue.c:2170
[< none >] kthread+0x23f/0x2d0 kernel/drivers/block/aoe/aoecmd.c:1303
[< none >] ret_from_fork+0x3f/0x70 kernel/arch/x86/entry/entry_64.S:468
INFO: Slab 0xffffea0001938800 objects=3 used=0 fp=0xffff880064e20000
flags=0x5fffc0000004080
INFO: Object 0xffff880064e20000 @offset=0 fp=0xffff880064e24200
CPU: 1 PID: 11581 Comm: syz-executor Tainted: G B 4.4.0+
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
00000000ffffffff ffff8800662c7790 ffffffff8292049d ffff88003e36a300
ffff880064e20000 ffff880064e20000 ffff8800662c77c0 ffffffff816f2054
ffff88003e36a300 ffffea0001938800 ffff880064e20000 0000000000000000
Call Trace:
[< inline >] __dump_stack kernel/lib/dump_stack.c:15
[<ffffffff8292049d>] dump_stack+0x6f/0xa2 kernel/lib/dump_stack.c:50
[<ffffffff816f2054>] print_trailer+0xf4/0x150 kernel/mm/slub.c:654
[<ffffffff816f875f>] object_err+0x2f/0x40 kernel/mm/slub.c:661
[< inline >] print_address_description kernel/mm/kasan/report.c:138
[<ffffffff816fb0c5>] kasan_report_error+0x215/0x530 kernel/mm/kasan/report.c:236
[< inline >] kasan_report kernel/mm/kasan/report.c:259
[<ffffffff816fb4de>] __asan_report_load8_noabort+0x3e/0x40 kernel/mm/kasan/report.c:280
[< inline >] ? ppp_pernet kernel/include/linux/compiler.h:218
[<ffffffff83ad71b2>] ? ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392
[< inline >] ppp_pernet kernel/include/linux/compiler.h:218
[<ffffffff83ad71b2>] ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392
[< inline >] ? ppp_pernet kernel/drivers/net/ppp/ppp_generic.c:293
[<ffffffff83ad6f26>] ? ppp_unregister_channel+0xe6/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392
[<ffffffff83ae18f3>] ppp_asynctty_close+0xa3/0x130 kernel/drivers/net/ppp/ppp_async.c:241
[<ffffffff83ae1850>] ? async_lcp_peek+0x5b0/0x5b0 kernel/drivers/net/ppp/ppp_async.c:1000
[<ffffffff82c33239>] tty_ldisc_close.isra.1+0x99/0xe0 kernel/drivers/tty/tty_ldisc.c:478
[<ffffffff82c332c0>] tty_ldisc_kill+0x40/0x170 kernel/drivers/tty/tty_ldisc.c:744
[<ffffffff82c34943>] tty_ldisc_release+0x1b3/0x260 kernel/drivers/tty/tty_ldisc.c:772
[<ffffffff82c1ef21>] tty_release+0xac1/0x13e0 kernel/drivers/tty/tty_io.c:1901
[<ffffffff82c1e460>] ? release_tty+0x320/0x320 kernel/drivers/tty/tty_io.c:1688
[<ffffffff8174de36>] __fput+0x236/0x780 kernel/fs/file_table.c:208
[<ffffffff8174e405>] ____fput+0x15/0x20 kernel/fs/file_table.c:244
[<ffffffff813595ab>] task_work_run+0x16b/0x200 kernel/kernel/task_work.c:115
[< inline >] exit_task_work kernel/include/linux/task_work.h:21
[<ffffffff81307105>] do_exit+0x8b5/0x2c60 kernel/kernel/exit.c:750
[<ffffffff813fdd20>] ? debug_check_no_locks_freed+0x290/0x290 kernel/kernel/locking/lockdep.c:4123
[<ffffffff81306850>] ? mm_update_next_owner+0x6f0/0x6f0 kernel/kernel/exit.c:357
[<ffffffff813215e6>] ? __dequeue_signal+0x136/0x470 kernel/kernel/signal.c:550
[<ffffffff8132067b>] ? recalc_sigpending_tsk+0x13b/0x180 kernel/kernel/signal.c:145
[<ffffffff81309628>] do_group_exit+0x108/0x330 kernel/kernel/exit.c:880
[<ffffffff8132b9d4>] get_signal+0x5e4/0x14f0 kernel/kernel/signal.c:2307
[< inline >] ? kretprobe_table_lock kernel/kernel/kprobes.c:1113
[<ffffffff8151d355>] ? kprobe_flush_task+0xb5/0x450 kernel/kernel/kprobes.c:1158
[<ffffffff8115f7d3>] do_signal+0x83/0x1c90 kernel/arch/x86/kernel/signal.c:712
[<ffffffff8151d2a0>] ? recycle_rp_inst+0x310/0x310 kernel/include/linux/list.h:655
[<ffffffff8115f750>] ? setup_sigcontext+0x780/0x780 kernel/arch/x86/kernel/signal.c:165
[<ffffffff81380864>] ? finish_task_switch+0x424/0x5f0 kernel/kernel/sched/core.c:2692
[< inline >] ? finish_lock_switch kernel/kernel/sched/sched.h:1099
[<ffffffff81380560>] ? finish_task_switch+0x120/0x5f0 kernel/kernel/sched/core.c:2678
[< inline >] ? context_switch kernel/kernel/sched/core.c:2807
[<ffffffff85d794e9>] ? __schedule+0x919/0x1bd0 kernel/kernel/sched/core.c:3283
[<ffffffff81003901>] exit_to_usermode_loop+0xf1/0x1a0 kernel/arch/x86/entry/common.c:247
[< inline >] prepare_exit_to_usermode kernel/arch/x86/entry/common.c:282
[<ffffffff810062ef>] syscall_return_slowpath+0x19f/0x210 kernel/arch/x86/entry/common.c:344
[<ffffffff85d88022>] int_ret_from_sys_call+0x25/0x9f kernel/arch/x86/entry/entry_64.S:281
Memory state around the buggy address:
ffff880064e21680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff880064e21700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff880064e21780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff880064e21800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff880064e21880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Fixes: 273ec51dd7ce ("net: ppp_generic - introduce net-namespace functionality v2")
Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
drivers/net/ppp/ppp_generic.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 3dd1c19756ec..38c0231fb9b7 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2342,6 +2342,8 @@ ppp_unregister_channel(struct ppp_channel *chan)
spin_lock_bh(&pn->all_channels_lock);
list_del(&pch->list);
spin_unlock_bh(&pn->all_channels_lock);
+ put_net(pch->chan_net);
+ pch->chan_net = NULL;
pch->file.dead = 1;
wake_up_interruptible(&pch->file.rwait);
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* Re: [PATCH for-3.18 04/15] ppp: take reference on channels netns
2017-07-25 20:45 ` [PATCH for-3.18 04/15] ppp: take reference on channels netns Amit Pundir
@ 2017-07-26 9:52 ` Guillaume Nault
2017-07-26 10:30 ` Amit Pundir
0 siblings, 1 reply; 20+ messages in thread
From: Guillaume Nault @ 2017-07-26 9:52 UTC (permalink / raw)
To: Amit Pundir; +Cc: Greg KH, Stable, David S . Miller
On Wed, Jul 26, 2017 at 02:15:15AM +0530, Amit Pundir wrote:
> From: Guillaume Nault <g.nault@alphalink.fr>
>
> commit 1f461dcdd296eecedaffffc6bae2bfa90bd7eb89 upstream.
>
> Let channels hold a reference on their network namespace.
> Some channel types, like ppp_async and ppp_synctty, can have their
> userspace controller running in a different namespace. Therefore they
> can't rely on them to preclude their netns from being removed from
> under them.
>
Hi Amit,
I don't know how you got there, but one chunk is missing in your
backport (same problem happened in your -4.4 series):
@@ -2307,7 +2307,7 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan)
pch->ppp = NULL;
pch->chan = chan;
- pch->chan_net = net;
+ pch->chan_net = get_net(net);
chan->ppp = pch;
init_ppp_file(&pch->file, CHANNEL);
pch->file.hdrlen = chan->hdrlen;
Also, any backport of commit 1f461dcdd296 ("ppp: take reference on channels netns")
should be accompanied by commit 205e1e255c47 ("ppp: defer netns reference release for ppp channel").
Anyway, both are already present in stable/linux-3.18.y, so this patch
can be dropped from your series.
And FWIW, I think linux-3.18.y isn't maintained anymore.
>
> Fixes: 273ec51dd7ce ("net: ppp_generic - introduce net-namespace functionality v2")
> Reported-by: Baozeng Ding <sploving1@gmail.com>
> Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
> Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
> ---
> drivers/net/ppp/ppp_generic.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
> index 3dd1c19756ec..38c0231fb9b7 100644
> --- a/drivers/net/ppp/ppp_generic.c
> +++ b/drivers/net/ppp/ppp_generic.c
> @@ -2342,6 +2342,8 @@ ppp_unregister_channel(struct ppp_channel *chan)
> spin_lock_bh(&pn->all_channels_lock);
> list_del(&pch->list);
> spin_unlock_bh(&pn->all_channels_lock);
> + put_net(pch->chan_net);
> + pch->chan_net = NULL;
>
> pch->file.dead = 1;
> wake_up_interruptible(&pch->file.rwait);
> --
> 2.7.4
>
^ permalink raw reply [flat|nested] 20+ messages in thread* Re: [PATCH for-3.18 04/15] ppp: take reference on channels netns
2017-07-26 9:52 ` Guillaume Nault
@ 2017-07-26 10:30 ` Amit Pundir
0 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-26 10:30 UTC (permalink / raw)
To: Guillaume Nault; +Cc: Greg KH, Stable, David S . Miller
On 26 July 2017 at 15:22, Guillaume Nault <g.nault@alphalink.fr> wrote:
> On Wed, Jul 26, 2017 at 02:15:15AM +0530, Amit Pundir wrote:
>> From: Guillaume Nault <g.nault@alphalink.fr>
>>
>> commit 1f461dcdd296eecedaffffc6bae2bfa90bd7eb89 upstream.
>>
>> Let channels hold a reference on their network namespace.
>> Some channel types, like ppp_async and ppp_synctty, can have their
>> userspace controller running in a different namespace. Therefore they
>> can't rely on them to preclude their netns from being removed from
>> under them.
>>
> Hi Amit,
>
> I don't know how you got there, but one chunk is missing in your
> backport (same problem happened in your -4.4 series):
> @@ -2307,7 +2307,7 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan)
>
> pch->ppp = NULL;
> pch->chan = chan;
> - pch->chan_net = net;
> + pch->chan_net = get_net(net);
> chan->ppp = pch;
> init_ppp_file(&pch->file, CHANNEL);
> pch->file.hdrlen = chan->hdrlen;
>
> Also, any backport of commit 1f461dcdd296 ("ppp: take reference on channels netns")
> should be accompanied by commit 205e1e255c47 ("ppp: defer netns reference release for ppp channel").
>
> Anyway, both are already present in stable/linux-3.18.y, so this patch
> can be dropped from your series.
Thanks Guillaume. I realised that too earlier today. Somehow "git
cherry-pick" didn't complain this time. I replied on 4.4 series to
ignore this patch but forgot to do that on this 3.18 patch. Thanks for
pointing it out.
> And FWIW, I think linux-3.18.y isn't maintained anymore.
linux-3.18.y is still getting maintained. See
https://lkml.org/lkml/2017/4/16/209.
Regards,
Amit Pundir
>
>>
>> Fixes: 273ec51dd7ce ("net: ppp_generic - introduce net-namespace functionality v2")
>> Reported-by: Baozeng Ding <sploving1@gmail.com>
>> Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
>> Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
>> Signed-off-by: David S. Miller <davem@davemloft.net>
>> Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
>> ---
>> drivers/net/ppp/ppp_generic.c | 2 ++
>> 1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
>> index 3dd1c19756ec..38c0231fb9b7 100644
>> --- a/drivers/net/ppp/ppp_generic.c
>> +++ b/drivers/net/ppp/ppp_generic.c
>> @@ -2342,6 +2342,8 @@ ppp_unregister_channel(struct ppp_channel *chan)
>> spin_lock_bh(&pn->all_channels_lock);
>> list_del(&pch->list);
>> spin_unlock_bh(&pn->all_channels_lock);
>> + put_net(pch->chan_net);
>> + pch->chan_net = NULL;
>>
>> pch->file.dead = 1;
>> wake_up_interruptible(&pch->file.rwait);
>> --
>> 2.7.4
>>
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH for-3.18 05/15] mpt3sas: Don't overreach ioc->reply_post[] during initialization
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
` (3 preceding siblings ...)
2017-07-25 20:45 ` [PATCH for-3.18 04/15] ppp: take reference on channels netns Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 06/15] kaweth: fix firmware download Amit Pundir
` (10 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Calvin Owens, Martin K . Petersen
From: Calvin Owens <calvinowens@fb.com>
commit 5ec8a1753bc29efa7e4b1391d691c9c719b30257 upstream.
In _base_make_ioc_operational(), we walk ioc->reply_queue_list and pull
a pointer out of successive elements of ioc->reply_post[] for each entry
in that list if RDPQ is enabled.
Since the code pulls the pointer for the next iteration at the bottom of
the loop, it triggers the a KASAN dump on the final iteration:
BUG: KASAN: slab-out-of-bounds in _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas] at addr ffff880754816ab0
Read of size 8 by task modprobe/305
<snip>
Call Trace:
[<ffffffff81dfc591>] dump_stack+0x4d/0x6c
[<ffffffff814c9689>] print_trailer+0xf9/0x150
[<ffffffff814ceda4>] object_err+0x34/0x40
[<ffffffff814d1231>] kasan_report_error+0x221/0x530
[<ffffffff814d1673>] __asan_report_load8_noabort+0x43/0x50
[<ffffffffa0043637>] _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas]
[<ffffffffa0049a51>] mpt3sas_base_attach+0x1991/0x2120 [mpt3sas]
[<ffffffffa0053c93>] _scsih_probe+0xeb3/0x16b0 [mpt3sas]
[<ffffffff81ebd047>] local_pci_probe+0xc7/0x170
[<ffffffff81ebf2cf>] pci_device_probe+0x20f/0x290
[<ffffffff820d50cd>] really_probe+0x17d/0x600
[<ffffffff820d56a3>] __driver_attach+0x153/0x190
[<ffffffff820cffac>] bus_for_each_dev+0x11c/0x1a0
[<ffffffff820d421d>] driver_attach+0x3d/0x50
[<ffffffff820d378a>] bus_add_driver+0x44a/0x5f0
[<ffffffff820d666c>] driver_register+0x18c/0x3b0
[<ffffffff81ebcb76>] __pci_register_driver+0x156/0x200
[<ffffffffa00c8135>] _mpt3sas_init+0x135/0x1000 [mpt3sas]
[<ffffffff81000423>] do_one_initcall+0x113/0x2b0
[<ffffffff813caa5a>] do_init_module+0x1d0/0x4d8
[<ffffffff81273909>] load_module+0x6729/0x8dc0
[<ffffffff81276123>] SYSC_init_module+0x183/0x1a0
[<ffffffff8127625e>] SyS_init_module+0xe/0x10
[<ffffffff828fe7d7>] entry_SYSCALL_64_fastpath+0x12/0x6a
Fix this by pulling the value at the beginning of the loop.
Signed-off-by: Calvin Owens <calvinowens@fb.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Jens Axboe <axboe@fb.com>
Acked-by: Chaitra Basappa <chaitra.basappa@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
drivers/scsi/mpt3sas/mpt3sas_base.c | 33 ++++++++++++++++-----------------
1 file changed, 16 insertions(+), 17 deletions(-)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 1560115079c7..52d409408aa3 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -4378,14 +4378,13 @@ _base_make_ioc_ready(struct MPT3SAS_ADAPTER *ioc, int sleep_flag,
static int
_base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
{
- int r, i;
+ int r, i, index;
unsigned long flags;
u32 reply_address;
u16 smid;
struct _tr_list *delayed_tr, *delayed_tr_next;
struct adapter_reply_queue *reply_q;
- long reply_post_free;
- u32 reply_post_free_sz, index = 0;
+ Mpi2ReplyDescriptorsUnion_t *reply_post_free_contig;
dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name,
__func__));
@@ -4456,27 +4455,27 @@ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
_base_assign_reply_queues(ioc);
/* initialize Reply Post Free Queue */
- reply_post_free_sz = ioc->reply_post_queue_depth *
- sizeof(Mpi2DefaultReplyDescriptor_t);
- reply_post_free = (long)ioc->reply_post[index].reply_post_free;
+ index = 0;
+ reply_post_free_contig = ioc->reply_post[0].reply_post_free;
list_for_each_entry(reply_q, &ioc->reply_queue_list, list) {
+ /*
+ * If RDPQ is enabled, switch to the next allocation.
+ * Otherwise advance within the contiguous region.
+ */
+ if (ioc->rdpq_array_enable) {
+ reply_q->reply_post_free =
+ ioc->reply_post[index++].reply_post_free;
+ } else {
+ reply_q->reply_post_free = reply_post_free_contig;
+ reply_post_free_contig += ioc->reply_post_queue_depth;
+ }
+
reply_q->reply_post_host_index = 0;
- reply_q->reply_post_free = (Mpi2ReplyDescriptorsUnion_t *)
- reply_post_free;
for (i = 0; i < ioc->reply_post_queue_depth; i++)
reply_q->reply_post_free[i].Words =
cpu_to_le64(ULLONG_MAX);
if (!_base_is_controller_msix_enabled(ioc))
goto skip_init_reply_post_free_queue;
- /*
- * If RDPQ is enabled, switch to the next allocation.
- * Otherwise advance within the contiguous region.
- */
- if (ioc->rdpq_array_enable)
- reply_post_free = (long)
- ioc->reply_post[++index].reply_post_free;
- else
- reply_post_free += reply_post_free_sz;
}
skip_init_reply_post_free_queue:
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH for-3.18 06/15] kaweth: fix firmware download
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
` (4 preceding siblings ...)
2017-07-25 20:45 ` [PATCH for-3.18 05/15] mpt3sas: Don't overreach ioc->reply_post[] during initialization Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 07/15] kaweth: fix oops upon failed memory allocation Amit Pundir
` (9 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Oliver Neukum, David S . Miller
From: Oliver Neukum <oneukum@suse.com>
commit 60bcabd080f53561efa9288be45c128feda1a8bb upstream.
This fixes the oops discovered by the Umap2 project and Alan Stern.
The intf member needs to be set before the firmware is downloaded.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
drivers/net/usb/kaweth.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index dcb6d33141e0..95ef45a5e9df 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -1029,6 +1029,7 @@ static int kaweth_probe(
kaweth = netdev_priv(netdev);
kaweth->dev = udev;
kaweth->net = netdev;
+ kaweth->intf = intf;
spin_lock_init(&kaweth->device_lock);
init_waitqueue_head(&kaweth->term_wait);
@@ -1139,8 +1140,6 @@ err_fw:
dev_dbg(dev, "Initializing net device.\n");
- kaweth->intf = intf;
-
kaweth->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
if (!kaweth->tx_urb)
goto err_free_netdev;
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH for-3.18 07/15] kaweth: fix oops upon failed memory allocation
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
` (5 preceding siblings ...)
2017-07-25 20:45 ` [PATCH for-3.18 06/15] kaweth: fix firmware download Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 08/15] net: phy: Do not perform software reset for Generic PHY Amit Pundir
` (8 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Oliver Neukum, David S . Miller
From: Oliver Neukum <oneukum@suse.com>
commit 575ced7f8090c1a4e91e2daf8da9352a6a1fc7a7 upstream.
Just return an error upon failure.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
drivers/net/usb/kaweth.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 95ef45a5e9df..40f3fbf2ca01 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -1009,6 +1009,7 @@ static int kaweth_probe(
struct net_device *netdev;
const eth_addr_t bcast_addr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
int result = 0;
+ int rv = -EIO;
dev_dbg(dev,
"Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n",
@@ -1049,6 +1050,10 @@ static int kaweth_probe(
/* Download the firmware */
dev_info(dev, "Downloading firmware...\n");
kaweth->firmware_buf = (__u8 *)__get_free_page(GFP_KERNEL);
+ if (!kaweth->firmware_buf) {
+ rv = -ENOMEM;
+ goto err_free_netdev;
+ }
if ((result = kaweth_download_firmware(kaweth,
"kaweth/new_code.bin",
100,
@@ -1209,7 +1214,7 @@ err_only_tx:
err_free_netdev:
free_netdev(netdev);
- return -EIO;
+ return rv;
}
/****************************************************************
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH for-3.18 08/15] net: phy: Do not perform software reset for Generic PHY
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
` (6 preceding siblings ...)
2017-07-25 20:45 ` [PATCH for-3.18 07/15] kaweth: fix oops upon failed memory allocation Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 09/15] isdn: Fix a sleep-in-atomic bug Amit Pundir
` (7 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Florian Fainelli, David S . Miller
From: Florian Fainelli <f.fainelli@gmail.com>
commit 0878fff1f42c18e448ab5b8b4f6a3eb32365b5b6 upstream.
The Generic PHY driver is a catch-all PHY driver and it should preserve
whatever prior initialization has been done by boot loader or firmware
agents. For specific PHY device configuration it is expected that a
specialized PHY driver would take over that role.
Resetting the generic PHY was a bad idea that has lead to several
complaints and downstream workarounds e.g: in OpenWrt/LEDE so restore
the behavior prior to 87aa9f9c61ad ("net: phy: consolidate PHY
reset in phy_init_hw()").
Reported-by: Felix Fietkau <nbd@nbd.name>
Fixes: 87aa9f9c61ad ("net: phy: consolidate PHY reset in phy_init_hw()")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
drivers/net/phy/phy_device.c | 2 +-
include/linux/phy.h | 4 ++++
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 70a0d88de654..9f8e10a240db 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1341,7 +1341,7 @@ static struct phy_driver genphy_driver[] = {
.phy_id = 0xffffffff,
.phy_id_mask = 0xffffffff,
.name = "Generic PHY",
- .soft_reset = genphy_soft_reset,
+ .soft_reset = genphy_no_soft_reset,
.config_init = genphy_config_init,
.features = PHY_GBIT_FEATURES | SUPPORTED_MII |
SUPPORTED_AUI | SUPPORTED_FIBRE |
diff --git a/include/linux/phy.h b/include/linux/phy.h
index d090cfcaa167..fbdacd1278e3 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -737,6 +737,10 @@ int genphy_read_status(struct phy_device *phydev);
int genphy_suspend(struct phy_device *phydev);
int genphy_resume(struct phy_device *phydev);
int genphy_soft_reset(struct phy_device *phydev);
+static inline int genphy_no_soft_reset(struct phy_device *phydev)
+{
+ return 0;
+}
void phy_driver_unregister(struct phy_driver *drv);
void phy_drivers_unregister(struct phy_driver *drv, int n);
int phy_driver_register(struct phy_driver *new_driver);
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH for-3.18 09/15] isdn: Fix a sleep-in-atomic bug
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
` (7 preceding siblings ...)
2017-07-25 20:45 ` [PATCH for-3.18 08/15] net: phy: Do not perform software reset for Generic PHY Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 10/15] wil6210: fix deadlock when using fw_no_recovery option Amit Pundir
` (6 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Jia-Ju Bai, David S . Miller
From: Jia-Ju Bai <baijiaju1990@163.com>
commit e8f4ae85439f34bec3b0ab69223a41809dab28c9 upstream.
The driver may sleep under a spin lock, the function call path is:
isdn_ppp_mp_receive (acquire the lock)
isdn_ppp_mp_reassembly
isdn_ppp_push_higher
isdn_ppp_decompress
isdn_ppp_ccp_reset_trans
isdn_ppp_ccp_reset_alloc_state
kzalloc(GFP_KERNEL) --> may sleep
To fixed it, the "GFP_KERNEL" is replaced with "GFP_ATOMIC".
Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
drivers/isdn/i4l/isdn_ppp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 9c1e8adaf4fc..bf3fbd00a091 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -2364,7 +2364,7 @@ static struct ippp_ccp_reset_state *isdn_ppp_ccp_reset_alloc_state(struct ippp_s
id);
return NULL;
} else {
- rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_KERNEL);
+ rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_ATOMIC);
if (!rs)
return NULL;
rs->state = CCPResetIdle;
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH for-3.18 10/15] wil6210: fix deadlock when using fw_no_recovery option
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
` (8 preceding siblings ...)
2017-07-25 20:45 ` [PATCH for-3.18 09/15] isdn: Fix a sleep-in-atomic bug Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 11/15] net, sched: fix soft lockup in tc_classify Amit Pundir
` (5 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Lior David, Maya Erez, Kalle Valo
From: Lior David <qca_liord@qca.qualcomm.com>
commit dfb5b098e0f40b68aa07f2ec55f4dd762efefbfa upstream.
When FW crashes with no_fw_recovery option, driver
waits for manual recovery with wil->mutex held, this
can easily create deadlocks.
Fix the problem by moving the wait outside the lock.
Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
drivers/net/wireless/ath/wil6210/main.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 6500caf8d609..c5676841fd12 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -240,18 +240,19 @@ static void wil_fw_error_worker(struct work_struct *work)
wil->last_fw_recovery = jiffies;
+ wil_info(wil, "fw error recovery requested (try %d)...\n",
+ wil->recovery_count);
+ if (!no_fw_recovery)
+ wil->recovery_state = fw_recovery_running;
+ if (wil_wait_for_recovery(wil) != 0)
+ return;
+
mutex_lock(&wil->mutex);
switch (wdev->iftype) {
case NL80211_IFTYPE_STATION:
case NL80211_IFTYPE_P2P_CLIENT:
case NL80211_IFTYPE_MONITOR:
- wil_info(wil, "fw error recovery requested (try %d)...\n",
- wil->recovery_count);
- if (!no_fw_recovery)
- wil->recovery_state = fw_recovery_running;
- if (0 != wil_wait_for_recovery(wil))
- break;
-
+ /* silent recovery, upper layers will see disconnect */
__wil_down(wil);
__wil_up(wil);
break;
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH for-3.18 11/15] net, sched: fix soft lockup in tc_classify
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
` (9 preceding siblings ...)
2017-07-25 20:45 ` [PATCH for-3.18 10/15] wil6210: fix deadlock when using fw_no_recovery option Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 12/15] mailbox: always wait in mbox_send_message for blocking Tx mode Amit Pundir
` (4 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Daniel Borkmann, Cong Wang, David S . Miller
From: Daniel Borkmann <daniel@iogearbox.net>
commit 628185cfddf1dfb701c4efe2cfd72cf5b09f5702 upstream.
Shahar reported a soft lockup in tc_classify(), where we run into an
endless loop when walking the classifier chain due to tp->next == tp
which is a state we should never run into. The issue only seems to
trigger under load in the tc control path.
What happens is that in tc_ctl_tfilter(), thread A allocates a new
tp, initializes it, sets tp_created to 1, and calls into tp->ops->change()
with it. In that classifier callback we had to unlock/lock the rtnl
mutex and returned with -EAGAIN. One reason why we need to drop there
is, for example, that we need to request an action module to be loaded.
This happens via tcf_exts_validate() -> tcf_action_init/_1() meaning
after we loaded and found the requested action, we need to redo the
whole request so we don't race against others. While we had to unlock
rtnl in that time, thread B's request was processed next on that CPU.
Thread B added a new tp instance successfully to the classifier chain.
When thread A returned grabbing the rtnl mutex again, propagating -EAGAIN
and destroying its tp instance which never got linked, we goto replay
and redo A's request.
This time when walking the classifier chain in tc_ctl_tfilter() for
checking for existing tp instances we had a priority match and found
the tp instance that was created and linked by thread B. Now calling
again into tp->ops->change() with that tp was successful and returned
without error.
tp_created was never cleared in the second round, thus kernel thinks
that we need to link it into the classifier chain (once again). tp and
*back point to the same object due to the match we had earlier on. Thus
for thread B's already public tp, we reset tp->next to tp itself and
link it into the chain, which eventually causes the mentioned endless
loop in tc_classify() once a packet hits the data path.
Fix is to clear tp_created at the beginning of each request, also when
we replay it. On the paths that can cause -EAGAIN we already destroy
the original tp instance we had and on replay we really need to start
from scratch. It seems that this issue was first introduced in commit
12186be7d2e1 ("net_cls: fix unconfigured struct tcf_proto keeps chaining
and avoid kernel panic when we use cls_cgroup").
Fixes: 12186be7d2e1 ("net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup")
Reported-by: Shahar Klein <shahark@mellanox.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Tested-by: Shahar Klein <shahark@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
net/sched/cls_api.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index fae88709aaa2..e50272592724 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -137,13 +137,15 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n)
unsigned long cl;
unsigned long fh;
int err;
- int tp_created = 0;
+ int tp_created;
if ((n->nlmsg_type != RTM_GETTFILTER) &&
!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
return -EPERM;
replay:
+ tp_created = 0;
+
err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL);
if (err < 0)
return err;
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH for-3.18 12/15] mailbox: always wait in mbox_send_message for blocking Tx mode
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
` (10 preceding siblings ...)
2017-07-25 20:45 ` [PATCH for-3.18 11/15] net, sched: fix soft lockup in tc_classify Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 13/15] mailbox: skip complete wait event if timer expired Amit Pundir
` (3 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Sudeep Holla, Jassi Brar
From: Sudeep Holla <sudeep.holla@arm.com>
commit c61b781ee084e69855477d23dd33e7e6caad652c upstream.
There exists a race when msg_submit return immediately as there was an
active request being processed which may have completed just before it's
checked again in mbox_send_message. This will result in return to the
caller without waiting in mbox_send_message even when it's blocking Tx.
This patch fixes the issue by waiting for the completion always if Tx
is in blocking mode.
Fixes: 2b6d83e2b8b7 ("mailbox: Introduce framework for mailbox")
Reported-by: Alexey Klimov <alexey.klimov@arm.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Reviewed-by: Alexey Klimov <alexey.klimov@arm.com>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
[AmitP: fixed a minor cherry-pick conflict on 3.18.y]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
drivers/mailbox/mailbox.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
index afcb430508ec..2691cb75b2e8 100644
--- a/drivers/mailbox/mailbox.c
+++ b/drivers/mailbox/mailbox.c
@@ -255,7 +255,7 @@ int mbox_send_message(struct mbox_chan *chan, void *mssg)
if (chan->txdone_method == TXDONE_BY_POLL)
poll_txdone((unsigned long)chan->mbox);
- if (chan->cl->tx_block && chan->active_req) {
+ if (chan->cl->tx_block) {
unsigned long wait;
int ret;
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH for-3.18 13/15] mailbox: skip complete wait event if timer expired
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
` (11 preceding siblings ...)
2017-07-25 20:45 ` [PATCH for-3.18 12/15] mailbox: always wait in mbox_send_message for blocking Tx mode Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 14/15] mailbox: handle empty message in tx_tick Amit Pundir
` (2 subsequent siblings)
15 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Sudeep Holla, Jassi Brar
From: Sudeep Holla <sudeep.holla@arm.com>
commit cc6eeaa3029a6dbcb4ad41b1f92876483bd88965 upstream.
If a wait_for_completion_timeout() call returns due to a timeout,
complete() can get called after returning from the wait which is
incorrect and can cause subsequent transmissions on a channel to fail.
Since the wait_for_completion_timeout() sees the completion variable
is non-zero caused by the erroneous/spurious complete() call, and
it immediately returns without waiting for the time as expected by the
client.
This patch fixes the issue by skipping complete() call for the timer
expiry.
Fixes: 2b6d83e2b8b7 ("mailbox: Introduce framework for mailbox")
Reported-by: Alexey Klimov <alexey.klimov@arm.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
drivers/mailbox/mailbox.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
index 2691cb75b2e8..cbde6fccbc29 100644
--- a/drivers/mailbox/mailbox.c
+++ b/drivers/mailbox/mailbox.c
@@ -103,7 +103,7 @@ static void tx_tick(struct mbox_chan *chan, int r)
if (mssg && chan->cl->tx_done)
chan->cl->tx_done(chan->cl, mssg, r);
- if (chan->cl->tx_block)
+ if (r != -ETIME && chan->cl->tx_block)
complete(&chan->tx_complete);
}
@@ -266,8 +266,8 @@ int mbox_send_message(struct mbox_chan *chan, void *mssg)
ret = wait_for_completion_timeout(&chan->tx_complete, wait);
if (ret == 0) {
- t = -EIO;
- tx_tick(chan, -EIO);
+ t = -ETIME;
+ tx_tick(chan, t);
}
}
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH for-3.18 14/15] mailbox: handle empty message in tx_tick
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
` (12 preceding siblings ...)
2017-07-25 20:45 ` [PATCH for-3.18 13/15] mailbox: skip complete wait event if timer expired Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-25 20:45 ` [PATCH for-3.18 15/15] af_key: Fix sadb_x_ipsecrequest parsing Amit Pundir
2017-08-03 22:28 ` [PATCH for-3.18 00/15] Stable candidates for 3.18.y Greg KH
15 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Sudeep Holla, Jassi Brar
From: Sudeep Holla <sudeep.holla@arm.com>
commit cb710ab1d8a23f68ff8f45aedf3e552bb90e70de upstream.
We already check if the message is empty before calling the client
tx_done callback. Calling completion on a wait event is also invalid
if the message is empty.
This patch moves the existing empty message check earlier.
Fixes: 2b6d83e2b8b7 ("mailbox: Introduce framework for mailbox")
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
drivers/mailbox/mailbox.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
index cbde6fccbc29..e464ff084e82 100644
--- a/drivers/mailbox/mailbox.c
+++ b/drivers/mailbox/mailbox.c
@@ -99,8 +99,11 @@ static void tx_tick(struct mbox_chan *chan, int r)
/* Submit next message */
msg_submit(chan);
+ if (!mssg)
+ return;
+
/* Notify the client */
- if (mssg && chan->cl->tx_done)
+ if (chan->cl->tx_done)
chan->cl->tx_done(chan->cl, mssg, r);
if (r != -ETIME && chan->cl->tx_block)
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH for-3.18 15/15] af_key: Fix sadb_x_ipsecrequest parsing
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
` (13 preceding siblings ...)
2017-07-25 20:45 ` [PATCH for-3.18 14/15] mailbox: handle empty message in tx_tick Amit Pundir
@ 2017-07-25 20:45 ` Amit Pundir
2017-07-26 5:03 ` Amit Pundir
2017-08-03 22:28 ` [PATCH for-3.18 00/15] Stable candidates for 3.18.y Greg KH
15 siblings, 1 reply; 20+ messages in thread
From: Amit Pundir @ 2017-07-25 20:45 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Herbert Xu, Steffen Klassert
From: Herbert Xu <herbert@gondor.apana.org.au>
commit 096f41d3a8fcbb8dde7f71379b1ca85fe213eded upstream.
The parsing of sadb_x_ipsecrequest is broken in a number of ways.
First of all we're not verifying sadb_x_ipsecrequest_len. This
is needed when the structure carries addresses at the end. Worse
we don't even look at the length when we parse those optional
addresses.
The migration code had similar parsing code that's better but
it also has some deficiencies. The length is overcounted first
of all as it includes the header itself. It also fails to check
the length before dereferencing the sa_family field.
This patch fixes those problems in parse_sockaddr_pair and then
uses it in parse_ipsecrequest.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
---
net/key/af_key.c | 47 ++++++++++++++++++++++++++---------------------
1 file changed, 26 insertions(+), 21 deletions(-)
diff --git a/net/key/af_key.c b/net/key/af_key.c
index d49fa0dd2634..08e2c6159e03 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -65,6 +65,10 @@ struct pfkey_sock {
} dump;
};
+static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
+ xfrm_address_t *saddr, xfrm_address_t *daddr,
+ u16 *family);
+
static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
{
return (struct pfkey_sock *)sk;
@@ -1921,19 +1925,14 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
/* addresses present only in tunnel mode */
if (t->mode == XFRM_MODE_TUNNEL) {
- u8 *sa = (u8 *) (rq + 1);
- int family, socklen;
+ int err;
- family = pfkey_sockaddr_extract((struct sockaddr *)sa,
- &t->saddr);
- if (!family)
- return -EINVAL;
-
- socklen = pfkey_sockaddr_len(family);
- if (pfkey_sockaddr_extract((struct sockaddr *)(sa + socklen),
- &t->id.daddr) != family)
- return -EINVAL;
- t->encap_family = family;
+ err = parse_sockaddr_pair(
+ (struct sockaddr *)(rq + 1),
+ rq->sadb_x_ipsecrequest_len - sizeof(*rq),
+ &t->saddr, &t->id.daddr, &t->encap_family);
+ if (err)
+ return err;
} else
t->encap_family = xp->family;
@@ -1953,7 +1952,11 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
if (pol->sadb_x_policy_len * 8 < sizeof(struct sadb_x_policy))
return -EINVAL;
- while (len >= sizeof(struct sadb_x_ipsecrequest)) {
+ while (len >= sizeof(*rq)) {
+ if (len < rq->sadb_x_ipsecrequest_len ||
+ rq->sadb_x_ipsecrequest_len < sizeof(*rq))
+ return -EINVAL;
+
if ((err = parse_ipsecrequest(xp, rq)) < 0)
return err;
len -= rq->sadb_x_ipsecrequest_len;
@@ -2416,7 +2419,6 @@ out:
return err;
}
-#ifdef CONFIG_NET_KEY_MIGRATE
static int pfkey_sockaddr_pair_size(sa_family_t family)
{
return PFKEY_ALIGN8(pfkey_sockaddr_len(family) * 2);
@@ -2428,7 +2430,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
{
int af, socklen;
- if (ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
+ if (ext_len < 2 || ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
return -EINVAL;
af = pfkey_sockaddr_extract(sa, saddr);
@@ -2444,6 +2446,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
return 0;
}
+#ifdef CONFIG_NET_KEY_MIGRATE
static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
struct xfrm_migrate *m)
{
@@ -2451,13 +2454,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
struct sadb_x_ipsecrequest *rq2;
int mode;
- if (len <= sizeof(struct sadb_x_ipsecrequest) ||
- len < rq1->sadb_x_ipsecrequest_len)
+ if (len < sizeof(*rq1) ||
+ len < rq1->sadb_x_ipsecrequest_len ||
+ rq1->sadb_x_ipsecrequest_len < sizeof(*rq1))
return -EINVAL;
/* old endoints */
err = parse_sockaddr_pair((struct sockaddr *)(rq1 + 1),
- rq1->sadb_x_ipsecrequest_len,
+ rq1->sadb_x_ipsecrequest_len - sizeof(*rq1),
&m->old_saddr, &m->old_daddr,
&m->old_family);
if (err)
@@ -2466,13 +2470,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len);
len -= rq1->sadb_x_ipsecrequest_len;
- if (len <= sizeof(struct sadb_x_ipsecrequest) ||
- len < rq2->sadb_x_ipsecrequest_len)
+ if (len <= sizeof(*rq2) ||
+ len < rq2->sadb_x_ipsecrequest_len ||
+ rq2->sadb_x_ipsecrequest_len < sizeof(*rq2))
return -EINVAL;
/* new endpoints */
err = parse_sockaddr_pair((struct sockaddr *)(rq2 + 1),
- rq2->sadb_x_ipsecrequest_len,
+ rq2->sadb_x_ipsecrequest_len - sizeof(*rq2),
&m->new_saddr, &m->new_daddr,
&m->new_family);
if (err)
--
2.7.4
^ permalink raw reply related [flat|nested] 20+ messages in thread* Re: [PATCH for-3.18 15/15] af_key: Fix sadb_x_ipsecrequest parsing
2017-07-25 20:45 ` [PATCH for-3.18 15/15] af_key: Fix sadb_x_ipsecrequest parsing Amit Pundir
@ 2017-07-26 5:03 ` Amit Pundir
0 siblings, 0 replies; 20+ messages in thread
From: Amit Pundir @ 2017-07-26 5:03 UTC (permalink / raw)
To: Greg KH; +Cc: Stable, Herbert Xu, Steffen Klassert
Please ignore this one. This patch is already in your stable queue.
Regards,
Amit Pundir
On 26 July 2017 at 02:15, Amit Pundir <amit.pundir@linaro.org> wrote:
> From: Herbert Xu <herbert@gondor.apana.org.au>
>
> commit 096f41d3a8fcbb8dde7f71379b1ca85fe213eded upstream.
>
> The parsing of sadb_x_ipsecrequest is broken in a number of ways.
> First of all we're not verifying sadb_x_ipsecrequest_len. This
> is needed when the structure carries addresses at the end. Worse
> we don't even look at the length when we parse those optional
> addresses.
>
> The migration code had similar parsing code that's better but
> it also has some deficiencies. The length is overcounted first
> of all as it includes the header itself. It also fails to check
> the length before dereferencing the sa_family field.
>
> This patch fixes those problems in parse_sockaddr_pair and then
> uses it in parse_ipsecrequest.
>
> Reported-by: Andrey Konovalov <andreyknvl@google.com>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
> Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
> ---
> net/key/af_key.c | 47 ++++++++++++++++++++++++++---------------------
> 1 file changed, 26 insertions(+), 21 deletions(-)
>
> diff --git a/net/key/af_key.c b/net/key/af_key.c
> index d49fa0dd2634..08e2c6159e03 100644
> --- a/net/key/af_key.c
> +++ b/net/key/af_key.c
> @@ -65,6 +65,10 @@ struct pfkey_sock {
> } dump;
> };
>
> +static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
> + xfrm_address_t *saddr, xfrm_address_t *daddr,
> + u16 *family);
> +
> static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
> {
> return (struct pfkey_sock *)sk;
> @@ -1921,19 +1925,14 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
>
> /* addresses present only in tunnel mode */
> if (t->mode == XFRM_MODE_TUNNEL) {
> - u8 *sa = (u8 *) (rq + 1);
> - int family, socklen;
> + int err;
>
> - family = pfkey_sockaddr_extract((struct sockaddr *)sa,
> - &t->saddr);
> - if (!family)
> - return -EINVAL;
> -
> - socklen = pfkey_sockaddr_len(family);
> - if (pfkey_sockaddr_extract((struct sockaddr *)(sa + socklen),
> - &t->id.daddr) != family)
> - return -EINVAL;
> - t->encap_family = family;
> + err = parse_sockaddr_pair(
> + (struct sockaddr *)(rq + 1),
> + rq->sadb_x_ipsecrequest_len - sizeof(*rq),
> + &t->saddr, &t->id.daddr, &t->encap_family);
> + if (err)
> + return err;
> } else
> t->encap_family = xp->family;
>
> @@ -1953,7 +1952,11 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
> if (pol->sadb_x_policy_len * 8 < sizeof(struct sadb_x_policy))
> return -EINVAL;
>
> - while (len >= sizeof(struct sadb_x_ipsecrequest)) {
> + while (len >= sizeof(*rq)) {
> + if (len < rq->sadb_x_ipsecrequest_len ||
> + rq->sadb_x_ipsecrequest_len < sizeof(*rq))
> + return -EINVAL;
> +
> if ((err = parse_ipsecrequest(xp, rq)) < 0)
> return err;
> len -= rq->sadb_x_ipsecrequest_len;
> @@ -2416,7 +2419,6 @@ out:
> return err;
> }
>
> -#ifdef CONFIG_NET_KEY_MIGRATE
> static int pfkey_sockaddr_pair_size(sa_family_t family)
> {
> return PFKEY_ALIGN8(pfkey_sockaddr_len(family) * 2);
> @@ -2428,7 +2430,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
> {
> int af, socklen;
>
> - if (ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
> + if (ext_len < 2 || ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
> return -EINVAL;
>
> af = pfkey_sockaddr_extract(sa, saddr);
> @@ -2444,6 +2446,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
> return 0;
> }
>
> +#ifdef CONFIG_NET_KEY_MIGRATE
> static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
> struct xfrm_migrate *m)
> {
> @@ -2451,13 +2454,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
> struct sadb_x_ipsecrequest *rq2;
> int mode;
>
> - if (len <= sizeof(struct sadb_x_ipsecrequest) ||
> - len < rq1->sadb_x_ipsecrequest_len)
> + if (len < sizeof(*rq1) ||
> + len < rq1->sadb_x_ipsecrequest_len ||
> + rq1->sadb_x_ipsecrequest_len < sizeof(*rq1))
> return -EINVAL;
>
> /* old endoints */
> err = parse_sockaddr_pair((struct sockaddr *)(rq1 + 1),
> - rq1->sadb_x_ipsecrequest_len,
> + rq1->sadb_x_ipsecrequest_len - sizeof(*rq1),
> &m->old_saddr, &m->old_daddr,
> &m->old_family);
> if (err)
> @@ -2466,13 +2470,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
> rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len);
> len -= rq1->sadb_x_ipsecrequest_len;
>
> - if (len <= sizeof(struct sadb_x_ipsecrequest) ||
> - len < rq2->sadb_x_ipsecrequest_len)
> + if (len <= sizeof(*rq2) ||
> + len < rq2->sadb_x_ipsecrequest_len ||
> + rq2->sadb_x_ipsecrequest_len < sizeof(*rq2))
> return -EINVAL;
>
> /* new endpoints */
> err = parse_sockaddr_pair((struct sockaddr *)(rq2 + 1),
> - rq2->sadb_x_ipsecrequest_len,
> + rq2->sadb_x_ipsecrequest_len - sizeof(*rq2),
> &m->new_saddr, &m->new_daddr,
> &m->new_family);
> if (err)
> --
> 2.7.4
>
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH for-3.18 00/15] Stable candidates for 3.18.y
2017-07-25 20:45 [PATCH for-3.18 00/15] Stable candidates for 3.18.y Amit Pundir
` (14 preceding siblings ...)
2017-07-25 20:45 ` [PATCH for-3.18 15/15] af_key: Fix sadb_x_ipsecrequest parsing Amit Pundir
@ 2017-08-03 22:28 ` Greg KH
15 siblings, 0 replies; 20+ messages in thread
From: Greg KH @ 2017-08-03 22:28 UTC (permalink / raw)
To: Amit Pundir; +Cc: Stable
On Wed, Jul 26, 2017 at 02:15:11AM +0530, Amit Pundir wrote:
> Hi Greg,
>
> Few stable candidates for 3.18.y for your consideration.
> Cherry-picked and build tested on Linux v3.18.62 for
> ARCH=arm/arm64 + allmodconfig.
All now applied, thanks.
greg k-h
^ permalink raw reply [flat|nested] 20+ messages in thread