1. 20 7月, 2020 4 次提交
  2. 18 7月, 2020 15 次提交
  3. 17 7月, 2020 2 次提交
  4. 16 7月, 2020 3 次提交
    • G
      ax88172a: fix ax88172a_unbind() failures · c28d9a28
      George Kennedy 提交于
      If ax88172a_unbind() fails, make sure that the return code is
      less than zero so that cleanup is done properly and avoid UAF.
      
      Fixes: a9a51bd7 ("ax88172a: fix information leak on short answers")
      Signed-off-by: NGeorge Kennedy <george.kennedy@oracle.com>
      Reported-by: syzbot+4cd84f527bf4a10fc9c1@syzkaller.appspotmail.com
      Signed-off-by: NJakub Kicinski <kuba@kernel.org>
      c28d9a28
    • S
      vsock/virtio: annotate 'the_virtio_vsock' RCU pointer · f961134a
      Stefano Garzarella 提交于
      Commit 0deab087 ("vsock/virtio: use RCU to avoid use-after-free
      on the_virtio_vsock") starts to use RCU to protect 'the_virtio_vsock'
      pointer, but we forgot to annotate it.
      
      This patch adds the annotation to fix the following sparse errors:
      
          net/vmw_vsock/virtio_transport.c:73:17: error: incompatible types in comparison expression (different address spaces):
          net/vmw_vsock/virtio_transport.c:73:17:    struct virtio_vsock [noderef] __rcu *
          net/vmw_vsock/virtio_transport.c:73:17:    struct virtio_vsock *
          net/vmw_vsock/virtio_transport.c:171:17: error: incompatible types in comparison expression (different address spaces):
          net/vmw_vsock/virtio_transport.c:171:17:    struct virtio_vsock [noderef] __rcu *
          net/vmw_vsock/virtio_transport.c:171:17:    struct virtio_vsock *
          net/vmw_vsock/virtio_transport.c:207:17: error: incompatible types in comparison expression (different address spaces):
          net/vmw_vsock/virtio_transport.c:207:17:    struct virtio_vsock [noderef] __rcu *
          net/vmw_vsock/virtio_transport.c:207:17:    struct virtio_vsock *
          net/vmw_vsock/virtio_transport.c:561:13: error: incompatible types in comparison expression (different address spaces):
          net/vmw_vsock/virtio_transport.c:561:13:    struct virtio_vsock [noderef] __rcu *
          net/vmw_vsock/virtio_transport.c:561:13:    struct virtio_vsock *
          net/vmw_vsock/virtio_transport.c:612:9: error: incompatible types in comparison expression (different address spaces):
          net/vmw_vsock/virtio_transport.c:612:9:    struct virtio_vsock [noderef] __rcu *
          net/vmw_vsock/virtio_transport.c:612:9:    struct virtio_vsock *
          net/vmw_vsock/virtio_transport.c:631:9: error: incompatible types in comparison expression (different address spaces):
          net/vmw_vsock/virtio_transport.c:631:9:    struct virtio_vsock [noderef] __rcu *
          net/vmw_vsock/virtio_transport.c:631:9:    struct virtio_vsock *
      
      Fixes: 0deab087 ("vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock")
      Reported-by: NMichael S. Tsirkin <mst@redhat.com>
      Signed-off-by: NStefano Garzarella <sgarzare@redhat.com>
      Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
      Acked-by: NMichael S. Tsirkin <mst@redhat.com>
      Signed-off-by: NJakub Kicinski <kuba@kernel.org>
      f961134a
    • I
      dpaa2-eth: check fsl_mc_get_endpoint for IS_ERR_OR_NULL() · 841eb401
      Ioana Ciornei 提交于
      The fsl_mc_get_endpoint() function can return an error or directly a
      NULL pointer in case the peer device is not under the root DPRC
      container. Treat this case also, otherwise it would lead to a NULL
      pointer when trying to access the peer fsl_mc_device.
      
      Fixes: 71947923 ("dpaa2-eth: add MAC/PHY support through phylink")
      Signed-off-by: NIoana Ciornei <ioana.ciornei@nxp.com>
      Signed-off-by: NJakub Kicinski <kuba@kernel.org>
      841eb401
  5. 15 7月, 2020 4 次提交
  6. 14 7月, 2020 3 次提交
    • D
      Merge tag 'wireless-drivers-2020-07-13' of... · d113c0f2
      David S. Miller 提交于
      Merge tag 'wireless-drivers-2020-07-13' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
      
      Kalle Valo says:
      
      ====================
      wireless-drivers fixes for v5.8
      
      First set of fixes for v5.8. Various important fixes for iwlwifi and
      mt76.
      
      iwlwifi
      
      * fix sleeping under RCU
      
      * fix a kernel crash when using compressed firmware images
      
      mt76
      
      * tx queueing fixes for mt7615/22/63
      
      * locking fix
      
      * fix a crash during watchdog reset
      
      * fix memory leaks
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d113c0f2
    • W
      ip6_gre: fix null-ptr-deref in ip6gre_init_net() · 46ef5b89
      Wei Yongjun 提交于
      KASAN report null-ptr-deref error when register_netdev() failed:
      
      KASAN: null-ptr-deref in range [0x00000000000003c0-0x00000000000003c7]
      CPU: 2 PID: 422 Comm: ip Not tainted 5.8.0-rc4+ #12
      Call Trace:
       ip6gre_init_net+0x4ab/0x580
       ? ip6gre_tunnel_uninit+0x3f0/0x3f0
       ops_init+0xa8/0x3c0
       setup_net+0x2de/0x7e0
       ? rcu_read_lock_bh_held+0xb0/0xb0
       ? ops_init+0x3c0/0x3c0
       ? kasan_unpoison_shadow+0x33/0x40
       ? __kasan_kmalloc.constprop.0+0xc2/0xd0
       copy_net_ns+0x27d/0x530
       create_new_namespaces+0x382/0xa30
       unshare_nsproxy_namespaces+0xa1/0x1d0
       ksys_unshare+0x39c/0x780
       ? walk_process_tree+0x2a0/0x2a0
       ? trace_hardirqs_on+0x4a/0x1b0
       ? _raw_spin_unlock_irq+0x1f/0x30
       ? syscall_trace_enter+0x1a7/0x330
       ? do_syscall_64+0x1c/0xa0
       __x64_sys_unshare+0x2d/0x40
       do_syscall_64+0x56/0xa0
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      ip6gre_tunnel_uninit() has set 'ign->fb_tunnel_dev' to NULL, later
      access to ign->fb_tunnel_dev cause null-ptr-deref. Fix it by saving
      'ign->fb_tunnel_dev' to local variable ndev.
      
      Fixes: dafabb65 ("ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()")
      Reported-by: NHulk Robot <hulkci@huawei.com>
      Signed-off-by: NWei Yongjun <weiyongjun1@huawei.com>
      Reviewed-by: NEric Dumazet <edumazet@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      46ef5b89
    • G
      usb: hso: Fix debug compile warning on sparc32 · e0484010
      Geert Uytterhoeven 提交于
      On sparc32, tcflag_t is "unsigned long", unlike on all other
      architectures, where it is "unsigned int":
      
          drivers/net/usb/hso.c: In function ‘hso_serial_set_termios’:
          include/linux/kern_levels.h:5:18: warning: format ‘%d’ expects argument of type ‘unsigned int’, but argument 4 has type ‘tcflag_t {aka long unsigned int}’ [-Wformat=]
          drivers/net/usb/hso.c:1393:3: note: in expansion of macro ‘hso_dbg’
             hso_dbg(0x16, "Termios called with: cflags new[%d] - old[%d]\n",
             ^~~~~~~
          include/linux/kern_levels.h:5:18: warning: format ‘%d’ expects argument of type ‘unsigned int’, but argument 5 has type ‘tcflag_t {aka long unsigned int}’ [-Wformat=]
          drivers/net/usb/hso.c:1393:3: note: in expansion of macro ‘hso_dbg’
             hso_dbg(0x16, "Termios called with: cflags new[%d] - old[%d]\n",
             ^~~~~~~
      
      As "unsigned long" is 32-bit on sparc32, fix this by casting all tcflag_t
      parameters to "unsigned int".
      While at it, use "%u" to format unsigned numbers.
      Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e0484010
  7. 13 7月, 2020 4 次提交
  8. 11 7月, 2020 5 次提交
    • L
      Merge tag 'libnvdimm-fix-v5.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · 1df0d896
      Linus Torvalds 提交于
      Pull libnvdimm fix from Dan Williams:
       "A one-line Fix for key ring search permissions to address a regression
        from -rc1"
      
      * tag 'libnvdimm-fix-v5.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        libnvdimm/security: Fix key lookup permissions
      1df0d896
    • L
      Merge tag '5.8-rc4-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 5ab39e08
      Linus Torvalds 提交于
      Pull cifs fixes from Steve French:
       "Four cifs/smb3 fixes: the three for stable fix problems found recently
        with change notification including a reference count leak"
      
      * tag '5.8-rc4-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: update internal module version number
        cifs: fix reference leak for tlink
        smb3: fix unneeded error message on change notify
        cifs: remove the retry in cifs_poxis_lock_set
        smb3: fix access denied on change notify request to some servers
      5ab39e08
    • L
      Merge tag 'inclusive-terminology' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/linux · 49decddd
      Linus Torvalds 提交于
      Pull coding style terminology documentation from Dan Williams:
       "The discussion has tapered off as well as the incoming ack, review,
        and sign-off tags. I did not see a reason to wait for the next merge
        window"
      
      * tag 'inclusive-terminology' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/linux:
        CodingStyle: Inclusive Terminology
      49decddd
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 5a764898
      Linus Torvalds 提交于
      Pull networking fixes from David Miller:
      
       1) Restore previous behavior of CAP_SYS_ADMIN wrt loading networking
          BPF programs, from Maciej Żenczykowski.
      
       2) Fix dropped broadcasts in mac80211 code, from Seevalamuthu
          Mariappan.
      
       3) Slay memory leak in nl80211 bss color attribute parsing code, from
          Luca Coelho.
      
       4) Get route from skb properly in ip_route_use_hint(), from Miaohe Lin.
      
       5) Don't allow anything other than ARPHRD_ETHER in llc code, from Eric
          Dumazet.
      
       6) xsk code dips too deeply into DMA mapping implementation internals.
          Add dma_need_sync and use it. From Christoph Hellwig
      
       7) Enforce power-of-2 for BPF ringbuf sizes. From Andrii Nakryiko.
      
       8) Check for disallowed attributes when loading flow dissector BPF
          programs. From Lorenz Bauer.
      
       9) Correct packet injection to L3 tunnel devices via AF_PACKET, from
          Jason A. Donenfeld.
      
      10) Don't advertise checksum offload on ipa devices that don't support
          it. From Alex Elder.
      
      11) Resolve several issues in TCP MD5 signature support. Missing memory
          barriers, bogus options emitted when using syncookies, and failure
          to allow md5 key changes in established states. All from Eric
          Dumazet.
      
      12) Fix interface leak in hsr code, from Taehee Yoo.
      
      13) VF reset fixes in hns3 driver, from Huazhong Tan.
      
      14) Make loopback work again with ipv6 anycast, from David Ahern.
      
      15) Fix TX starvation under high load in fec driver, from Tobias
          Waldekranz.
      
      16) MLD2 payload lengths not checked properly in bridge multicast code,
          from Linus Lüssing.
      
      17) Packet scheduler code that wants to find the inner protocol
          currently only works for one level of VLAN encapsulation. Allow
          Q-in-Q situations to work properly here, from Toke
          Høiland-Jørgensen.
      
      18) Fix route leak in l2tp, from Xin Long.
      
      19) Resolve conflict between the sk->sk_user_data usage of bpf reuseport
          support and various protocols. From Martin KaFai Lau.
      
      20) Fix socket cgroup v2 reference counting in some situations, from
          Cong Wang.
      
      21) Cure memory leak in mlx5 connection tracking offload support, from
          Eli Britstein.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (146 commits)
        mlxsw: pci: Fix use-after-free in case of failed devlink reload
        mlxsw: spectrum_router: Remove inappropriate usage of WARN_ON()
        net: macb: fix call to pm_runtime in the suspend/resume functions
        net: macb: fix macb_suspend() by removing call to netif_carrier_off()
        net: macb: fix macb_get/set_wol() when moving to phylink
        net: macb: mark device wake capable when "magic-packet" property present
        net: macb: fix wakeup test in runtime suspend/resume routines
        bnxt_en: fix NULL dereference in case SR-IOV configuration fails
        libbpf: Fix libbpf hashmap on (I)LP32 architectures
        net/mlx5e: CT: Fix memory leak in cleanup
        net/mlx5e: Fix port buffers cell size value
        net/mlx5e: Fix 50G per lane indication
        net/mlx5e: Fix CPU mapping after function reload to avoid aRFS RX crash
        net/mlx5e: Fix VXLAN configuration restore after function reload
        net/mlx5e: Fix usage of rcu-protected pointer
        net/mxl5e: Verify that rpriv is not NULL
        net/mlx5: E-Switch, Fix vlan or qos setting in legacy mode
        net/mlx5: Fix eeprom support for SFP module
        cgroup: Fix sock_cgroup_data on big-endian.
        selftests: bpf: Fix detach from sockmap tests
        ...
      5a764898
    • N
      mips: Remove compiler check in unroll macro · 9321f1aa
      Nathan Chancellor 提交于
      CONFIG_CC_IS_GCC is undefined when Clang is used, which breaks the build
      (see our Travis link below).
      
      Clang 8 was chosen as a minimum version for this check because there
      were some improvements around __builtin_constant_p in that release. In
      reality, MIPS was not even buildable until clang 9 so that check was not
      technically necessary. Just remove all compiler checks and just assume
      that we have a working compiler.
      
      Fixes: d4e60453 ("Restore gcc check in mips asm/unroll.h")
      Link: https://travis-ci.com/github/ClangBuiltLinux/continuous-integration/jobs/359642821Signed-off-by: NNathan Chancellor <natechancellor@gmail.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      9321f1aa