1. 08 12月, 2015 4 次提交
  2. 07 12月, 2015 1 次提交
  3. 06 12月, 2015 4 次提交
  4. 05 12月, 2015 5 次提交
    • P
      atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation · f2a3771a
      Pavel Machek 提交于
      atl1c driver is doing order-4 allocation with GFP_ATOMIC
      priority. That often breaks  networking after resume. Switch to
      GFP_KERNEL. Still not ideal, but should be significantly better.
      
      atl1c_setup_ring_resources() is called from .open() function, and
      already uses GFP_KERNEL, so this change is safe.
      Signed-off-by: NPavel Machek <pavel@ucw.cz>
      Acked-by: NMichal Hocko <mhocko@suse.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f2a3771a
    • G
      pppoe: fix memory corruption in padt work structure · fe53985a
      Guillaume Nault 提交于
      pppoe_connect() mustn't touch the padt_work field of pppoe sockets
      because that work could be already pending.
      
      [   21.473147] BUG: unable to handle kernel NULL pointer dereference at 00000004
      [   21.474523] IP: [<c1043177>] process_one_work+0x29/0x31c
      [   21.475164] *pde = 00000000
      [   21.475513] Oops: 0000 [#1] SMP
      [   21.475910] Modules linked in: pppoe pppox ppp_generic slhc crc32c_intel aesni_intel virtio_net xts aes_i586 lrw gf128mul ablk_helper cryptd evdev acpi_cpufreq processor serio_raw button ext4 crc16 mbcache jbd2 virtio_blk virtio_pci virtio_ring virtio
      [   21.476168] CPU: 2 PID: 164 Comm: kworker/2:2 Not tainted 4.4.0-rc1 #1
      [   21.476168] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
      [   21.476168] task: f5f83c00 ti: f5e28000 task.ti: f5e28000
      [   21.476168] EIP: 0060:[<c1043177>] EFLAGS: 00010046 CPU: 2
      [   21.476168] EIP is at process_one_work+0x29/0x31c
      [   21.484082] EAX: 00000000 EBX: f678b2a0 ECX: 00000004 EDX: 00000000
      [   21.484082] ESI: f6c69940 EDI: f5e29ef0 EBP: f5e29f0c ESP: f5e29edc
      [   21.484082]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
      [   21.484082] CR0: 80050033 CR2: 000000a4 CR3: 317ad000 CR4: 00040690
      [   21.484082] Stack:
      [   21.484082]  00000000 f6c69950 00000000 f6c69940 c0042338 f5e29f0c c1327945 00000000
      [   21.484082]  00000008 f678b2a0 f6c69940 f678b2b8 f5e29f30 c1043984 f5f83c00 f6c69970
      [   21.484082]  f678b2a0 c10437d3 f6775e80 f678b2a0 c10437d3 f5e29fac c1047059 f5e29f74
      [   21.484082] Call Trace:
      [   21.484082]  [<c1327945>] ? _raw_spin_lock_irq+0x28/0x30
      [   21.484082]  [<c1043984>] worker_thread+0x1b1/0x244
      [   21.484082]  [<c10437d3>] ? rescuer_thread+0x229/0x229
      [   21.484082]  [<c10437d3>] ? rescuer_thread+0x229/0x229
      [   21.484082]  [<c1047059>] kthread+0x8f/0x94
      [   21.484082]  [<c1327a32>] ? _raw_spin_unlock_irq+0x22/0x26
      [   21.484082]  [<c1327ee9>] ret_from_kernel_thread+0x21/0x38
      [   21.484082]  [<c1046fca>] ? kthread_parkme+0x19/0x19
      [   21.496082] Code: 5d c3 55 89 e5 57 56 53 89 c3 83 ec 24 89 d0 89 55 e0 8d 7d e4 e8 6c d8 ff ff b9 04 00 00 00 89 45 d8 8b 43 24 89 45 dc 8b 45 d8 <8b> 40 04 8b 80 e0 00 00 00 c1 e8 05 24 01 88 45 d7 8b 45 e0 8d
      [   21.496082] EIP: [<c1043177>] process_one_work+0x29/0x31c SS:ESP 0068:f5e29edc
      [   21.496082] CR2: 0000000000000004
      [   21.496082] ---[ end trace e362cc9cf10dae89 ]---
      Reported-by: NAndrew <nitr0@seti.kr.ua>
      Fixes: 287f3a94 ("pppoe: Use workqueue to die properly when a PADT is received")
      Signed-off-by: NGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      fe53985a
    • M
      net: mvpp2: fix refilling BM pools in RX path · b5015854
      Marcin Wojtas 提交于
      In hitherto code in case of RX buffer allocation error during refill,
      original buffer is pushed to the network stack, but the amount of
      available buffer pointers in BM pool is decreased.
      
      This commit fixes the situation by moving refill call before skb_put(),
      and returning original buffer pointer to the pool in case of an error.
      Signed-off-by: NMarcin Wojtas <mw@semihalf.com>
      
      Fixes: 3f518509 ("ethernet: Add new driver for Marvell Armada 375
      network unit")
      
      Cc: <stable@vger.kernel.org> # v3.18+
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b5015854
    • M
      net: mvpp2: fix buffers' DMA handling on RX path · 4229d502
      Marcin Wojtas 提交于
      Each allocated buffer, whose pointer is put into BM pool is DMA-mapped.
      Hence it should be properly unmapped after usage or when removing buffers
      from pool.
      
      This commit fixes DMA handling on RX path by adding dma_unmap_single() in
      mvpp2_rx() and in mvpp2_bufs_free(). The latter function's argument number
      had to be increased for this purpose.
      Signed-off-by: NMarcin Wojtas <mw@semihalf.com>
      
      Fixes: 3f518509 ("ethernet: Add new driver for Marvell Armada 375
      network unit")
      
      Cc: <stable@vger.kernel.org> # v3.18+
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4229d502
    • M
      net: mvpp2: fix missing DMA region unmap in egress processing · e864b4c7
      Marcin Wojtas 提交于
      The Tx descriptor release code currently calls dma_unmap_single() and
      dev_kfree_skb_any() if the descriptor is associated with a non-NULL skb.
      This condition is true only for the last fragment of the packet.
      
      Since every descriptor's buffer is DMA-mapped it has to be properly
      unmapped.
      Signed-off-by: NMarcin Wojtas <mw@semihalf.com>
      
      Fixes: 3f518509 ("ethernet: Add new driver for Marvell Armada 375
      network unit")
      
      Cc: <stable@vger.kernel.org> # v3.18+
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e864b4c7
  5. 04 12月, 2015 7 次提交
  6. 03 12月, 2015 10 次提交
  7. 02 12月, 2015 3 次提交
    • E
      net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA · 9cd3e072
      Eric Dumazet 提交于
      This patch is a cleanup to make following patch easier to
      review.
      
      Goal is to move SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA
      from (struct socket)->flags to a (struct socket_wq)->flags
      to benefit from RCU protection in sock_wake_async()
      
      To ease backports, we rename both constants.
      
      Two new helpers, sk_set_bit(int nr, struct sock *sk)
      and sk_clear_bit(int net, struct sock *sk) are added so that
      following patch can change their implementation.
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9cd3e072
    • A
      vmxnet3: fix checks for dma mapping errors · 5738a09d
      Alexey Khoroshilov 提交于
      vmxnet3_drv does not check dma_addr with dma_mapping_error()
      after mapping dma memory. The patch adds the checks and
      tries to handle failures.
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
      Acked-by: NShrikrishna Khare <skhare@vmware.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      5738a09d
    • P
      wan/x25: Fix use-after-free in x25_asy_open_tty() · ee9159dd
      Peter Hurley 提交于
      The N_X25 line discipline may access the previous line discipline's closed
      and already-freed private data on open [1].
      
      The tty->disc_data field _never_ refers to valid data on entry to the
      line discipline's open() method. Rather, the ldisc is expected to
      initialize that field for its own use for the lifetime of the instance
      (ie. from open() to close() only).
      
      [1]
          [  634.336761] ==================================================================
          [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
          [  634.339558] Read of size 4 by task syzkaller_execu/8981
          [  634.340359] =============================================================================
          [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
          ...
          [  634.405018] Call Trace:
          [  634.405277] dump_stack (lib/dump_stack.c:52)
          [  634.405775] print_trailer (mm/slub.c:655)
          [  634.406361] object_err (mm/slub.c:662)
          [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
          [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
          [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
          [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
          [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
          [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
          [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
          [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
          [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)
      Reported-and-tested-by: NSasha Levin <sasha.levin@oracle.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NPeter Hurley <peter@hurleysoftware.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ee9159dd
  8. 01 12月, 2015 6 次提交