1. 30 10月, 2020 22 次提交
    • H
      bridge: cfm: Kernel space implementation of CFM. CCM frame RX added. · dc32cbb3
      Henrik Bjoernlund 提交于
      This is the third commit of the implementation of the CFM protocol
      according to 802.1Q section 12.14.
      
      Functionality is extended with CCM frame reception.
      The MEP instance now contains CCM based status information.
      Most important is the CCM defect status indicating if correct
      CCM frames are received with the expected interval.
      Signed-off-by: NHenrik Bjoernlund  <henrik.bjoernlund@microchip.com>
      Reviewed-by: NHoratiu Vultur  <horatiu.vultur@microchip.com>
      Acked-by: NNikolay Aleksandrov <nikolay@nvidia.com>
      Signed-off-by: NJakub Kicinski <kuba@kernel.org>
      dc32cbb3
    • H
      bridge: cfm: Kernel space implementation of CFM. CCM frame TX added. · a806ad8e
      Henrik Bjoernlund 提交于
      This is the second commit of the implementation of the CFM protocol
      according to 802.1Q section 12.14.
      
      Functionality is extended with CCM frame transmission.
      
      Interface is extended with these functions:
      br_cfm_cc_rdi_set()
      br_cfm_cc_ccm_tx()
      br_cfm_cc_config_set()
      
      A MEP Continuity Check feature can be configured by
      br_cfm_cc_config_set()
          The Continuity Check parameters can be configured to be used when
          transmitting CCM.
      
      A MEP can be configured to start or stop transmission of CCM frames by
      br_cfm_cc_ccm_tx()
          The CCM will be transmitted for a selected period in seconds.
          Must call this function before timeout to keep transmission alive.
      
      A MEP transmitting CCM can be configured with inserted RDI in PDU by
      br_cfm_cc_rdi_set()
      Signed-off-by: NHenrik Bjoernlund  <henrik.bjoernlund@microchip.com>
      Reviewed-by: NHoratiu Vultur  <horatiu.vultur@microchip.com>
      Acked-by: NNikolay Aleksandrov <nikolay@nvidia.com>
      Signed-off-by: NJakub Kicinski <kuba@kernel.org>
      a806ad8e
    • H
      bridge: cfm: Kernel space implementation of CFM. MEP create/delete. · 86a14b79
      Henrik Bjoernlund 提交于
      This is the first commit of the implementation of the CFM protocol
      according to 802.1Q section 12.14.
      
      It contains MEP instance create, delete and configuration.
      
      Connectivity Fault Management (CFM) comprises capabilities for
      detecting, verifying, and isolating connectivity failures in
      Virtual Bridged Networks. These capabilities can be used in
      networks operated by multiple independent organizations, each
      with restricted management access to each others equipment.
      
      CFM functions are partitioned as follows:
          - Path discovery
          - Fault detection
          - Fault verification and isolation
          - Fault notification
          - Fault recovery
      
      Interface consists of these functions:
      br_cfm_mep_create()
      br_cfm_mep_delete()
      br_cfm_mep_config_set()
      br_cfm_cc_config_set()
      br_cfm_cc_peer_mep_add()
      br_cfm_cc_peer_mep_remove()
      
      A MEP instance is created by br_cfm_mep_create()
          -It is the Maintenance association End Point
           described in 802.1Q section 19.2.
          -It is created on a specific level (1-7) and is assuring
           that no CFM frames are passing through this MEP on lower levels.
          -It initiates and validates CFM frames on its level.
          -It can only exist on a port that is related to a bridge.
          -Attributes given cannot be changed until the instance is
           deleted.
      
      A MEP instance can be deleted by br_cfm_mep_delete().
      
      A created MEP instance has attributes that can be
      configured by br_cfm_mep_config_set().
      
      A MEP Continuity Check feature can be configured by
      br_cfm_cc_config_set()
          The Continuity Check Receiver state machine can be
          enabled and disabled.
          According to 802.1Q section 19.2.8
      
      A MEP can have Peer MEPs added and removed by
      br_cfm_cc_peer_mep_add() and br_cfm_cc_peer_mep_remove()
          The Continuity Check feature can maintain connectivity
          status on each added Peer MEP.
      Signed-off-by: NHenrik Bjoernlund  <henrik.bjoernlund@microchip.com>
      Reviewed-by: NHoratiu Vultur  <horatiu.vultur@microchip.com>
      Acked-by: NNikolay Aleksandrov <nikolay@nvidia.com>
      Signed-off-by: NJakub Kicinski <kuba@kernel.org>
      86a14b79
    • H
      bridge: uapi: cfm: Added EtherType used by the CFM protocol. · fbaedb41
      Henrik Bjoernlund 提交于
      This EtherType is used by all CFM protocal frames transmitted
      according to 802.1Q section 12.14.
      Signed-off-by: NHenrik Bjoernlund  <henrik.bjoernlund@microchip.com>
      Reviewed-by: NHoratiu Vultur  <horatiu.vultur@microchip.com>
      Acked-by: NNikolay Aleksandrov <nikolay@nvidia.com>
      Signed-off-by: NJakub Kicinski <kuba@kernel.org>
      fbaedb41
    • H
      bridge: cfm: Add BRIDGE_CFM to Kconfig. · f323aa54
      Henrik Bjoernlund 提交于
      This makes it possible to include or exclude the CFM
      protocol according to 802.1Q section 12.14.
      Signed-off-by: NHenrik Bjoernlund  <henrik.bjoernlund@microchip.com>
      Reviewed-by: NHoratiu Vultur  <horatiu.vultur@microchip.com>
      Acked-by: NNikolay Aleksandrov <nikolay@nvidia.com>
      Signed-off-by: NJakub Kicinski <kuba@kernel.org>
      f323aa54
    • H
      net: bridge: extend the process of special frames · 90c628dd
      Henrik Bjoernlund 提交于
      This patch extends the processing of frames in the bridge. Currently MRP
      frames needs special processing and the current implementation doesn't
      allow a nice way to process different frame types. Therefore try to
      improve this by adding a list that contains frame types that need
      special processing. This list is iterated for each input frame and if
      there is a match based on frame type then these functions will be called
      and decide what to do with the frame. It can process the frame then the
      bridge doesn't need to do anything or don't process so then the bridge
      will do normal forwarding.
      Signed-off-by: NHenrik Bjoernlund  <henrik.bjoernlund@microchip.com>
      Reviewed-by: NHoratiu Vultur  <horatiu.vultur@microchip.com>
      Acked-by: NNikolay Aleksandrov <nikolay@nvidia.com>
      Signed-off-by: NJakub Kicinski <kuba@kernel.org>
      90c628dd
    • J
      Merge branch 'vsock-minor-clean-up-of-ioctl-error-handling' · ae8a6e6e
      Jakub Kicinski 提交于
      Colin Ian King says:
      
      ====================
      vsock: minor clean up of ioctl error handling
      
      Two minor changes to the ioctl error handling.
      ====================
      
      Link: https://lore.kernel.org/r/20201027090942.14916-1-colin.king@canonical.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
      ae8a6e6e
    • C
      vsock: fix the error return when an invalid ioctl command is used · c3e448cd
      Colin Ian King 提交于
      Currently when an invalid ioctl command is used the error return
      is -EINVAL.  Fix this by returning the correct error -ENOIOCTLCMD.
      Signed-off-by: NColin Ian King <colin.king@canonical.com>
      Reviewed-by: NStefano Garzarella <sgarzare@redhat.com>
      Signed-off-by: NJakub Kicinski <kuba@kernel.org>
      c3e448cd
    • C
      vsock: remove ratelimit unknown ioctl message · 6bc8f20c
      Colin Ian King 提交于
      When exercising the kernel with stress-ng with some ioctl tests the
      "Unknown ioctl" error message is spamming the kernel log at a high
      rate. Remove this message.
      Signed-off-by: NColin Ian King <colin.king@canonical.com>
      Reviewed-by: NStefano Garzarella <sgarzare@redhat.com>
      Signed-off-by: NJakub Kicinski <kuba@kernel.org>
      6bc8f20c
    • J
      1c29d989
    • L
      Merge tag 'fallthrough-fixes-clang-5.10-rc2' of... · 07e08873
      Linus Torvalds 提交于
      Merge tag 'fallthrough-fixes-clang-5.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux
      
      Pull fallthrough fix from Gustavo A. R. Silva:
       "This fixes a ton of fall-through warnings when building with Clang
        12.0.0 and -Wimplicit-fallthrough"
      
      * tag 'fallthrough-fixes-clang-5.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux:
        include: jhash/signal: Fix fall-through warnings for Clang
      07e08873
    • L
      Merge tag 'net-5.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 934291ff
      Linus Torvalds 提交于
      Pull networking fixes from Jakub Kicinski:
       "Current release regressions:
      
         - r8169: fix forced threading conflicting with other shared
           interrupts; we tried to fix the use of raise_softirq_irqoff from an
           IRQ handler on RT by forcing hard irqs, but this driver shares
           legacy PCI IRQs so drop the _irqoff() instead
      
         - tipc: fix memory leak caused by a recent syzbot report fix to
           tipc_buf_append()
      
        Current release - bugs in new features:
      
         - devlink: Unlock on error in dumpit() and fix some error codes
      
         - net/smc: fix null pointer dereference in smc_listen_decline()
      
        Previous release - regressions:
      
         - tcp: Prevent low rmem stalls with SO_RCVLOWAT.
      
         - net: protect tcf_block_unbind with block lock
      
         - ibmveth: Fix use of ibmveth in a bridge; the self-imposed filtering
           to only send legal frames to the hypervisor was too strict
      
         - net: hns3: Clear the CMDQ registers before unmapping BAR region;
           incorrect cleanup order was leading to a crash
      
         - bnxt_en - handful of fixes to fixes:
            - Send HWRM_FUNC_RESET fw command unconditionally, even if there
              are PCIe errors being reported
            - Check abort error state in bnxt_open_nic().
            - Invoke cancel_delayed_work_sync() for PFs also.
            - Fix regression in workqueue cleanup logic in bnxt_remove_one().
      
         - mlxsw: Only advertise link modes supported by both driver and
           device, after removal of 56G support from the driver 56G was not
           cleared from advertised modes
      
         - net/smc: fix suppressed return code
      
        Previous release - always broken:
      
         - netem: fix zero division in tabledist, caused by integer overflow
      
         - bnxt_en: Re-write PCI BARs after PCI fatal error.
      
         - cxgb4: set up filter action after rewrites
      
         - net: ipa: command payloads already mapped
      
        Misc:
      
         - s390/ism: fix incorrect system EID, it's okay to change since it
           was added in current release
      
         - vsock: use ns_capable_noaudit() on socket create to suppress false
           positive audit messages"
      
      * tag 'net-5.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (36 commits)
        r8169: fix issue with forced threading in combination with shared interrupts
        netem: fix zero division in tabledist
        ibmvnic: fix ibmvnic_set_mac
        mptcp: add missing memory scheduling in the rx path
        tipc: fix memory leak caused by tipc_buf_append()
        gtp: fix an use-before-init in gtp_newlink()
        net: protect tcf_block_unbind with block lock
        ibmveth: Fix use of ibmveth in a bridge.
        net/sched: act_mpls: Add softdep on mpls_gso.ko
        ravb: Fix bit fields checking in ravb_hwtstamp_get()
        devlink: Unlock on error in dumpit()
        devlink: Fix some error codes
        chelsio/chtls: fix memory leaks in CPL handlers
        chelsio/chtls: fix deadlock issue
        net: hns3: Clear the CMDQ registers before unmapping BAR region
        bnxt_en: Send HWRM_FUNC_RESET fw command unconditionally.
        bnxt_en: Check abort error state in bnxt_open_nic().
        bnxt_en: Re-write PCI BARs after PCI fatal error.
        bnxt_en: Invoke cancel_delayed_work_sync() for PFs also.
        bnxt_en: Fix regression in workqueue cleanup logic in bnxt_remove_one().
        ...
      934291ff
    • L
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · b9c0f4bd
      Linus Torvalds 提交于
      Pull rdma fixes from Jason Gunthorpe:
       "The good news is people are testing rc1 in the RDMA world - the bad
        news is testing of the for-next area is not as good as I had hoped, as
        we really should have caught at least the rdma_connect_locked() issue
        before now.
      
        Notable merge window regressions that didn't get caught/fixed in time
        for rc1:
      
         - Fix in kernel users of rxe, they were broken by the rapid fix to
           undo the uABI breakage in rxe from another patch
      
         - EFA userspace needs to read the GID table but was broken with the
           new GID table logic
      
         - Fix user triggerable deadlock in mlx5 using devlink reload
      
         - Fix deadlock in several ULPs using rdma_connect from the CM handler
           callbacks
      
         - Memory leak in qedr"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        RDMA/qedr: Fix memory leak in iWARP CM
        RDMA: Add rdma_connect_locked()
        RDMA/uverbs: Fix false error in query gid IOCTL
        RDMA/mlx5: Fix devlink deadlock on net namespace deletion
        RDMA/rxe: Fix small problem in network_type patch
      b9c0f4bd
    • H
      r8169: fix issue with forced threading in combination with shared interrupts · 2734a24e
      Heiner Kallweit 提交于
      As reported by Serge flag IRQF_NO_THREAD causes an error if the
      interrupt is actually shared and the other driver(s) don't have this
      flag set. This situation can occur if a PCI(e) legacy interrupt is
      used in combination with forced threading.
      There's no good way to deal with this properly, therefore we have to
      remove flag IRQF_NO_THREAD. For fixing the original forced threading
      issue switch to napi_schedule().
      
      Fixes: 424a646e ("r8169: fix operation under forced interrupt threading")
      Link: https://www.spinics.net/lists/netdev/msg694960.htmlReported-by: NSerge Belyshev <belyshev@depni.sinp.msu.ru>
      Signed-off-by: NHeiner Kallweit <hkallweit1@gmail.com>
      Tested-by: NSerge Belyshev <belyshev@depni.sinp.msu.ru>
      Link: https://lore.kernel.org/r/b5b53bfe-35ac-3768-85bf-74d1290cf394@gmail.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
      2734a24e
    • A
      netem: fix zero division in tabledist · eadd1bef
      Aleksandr Nogikh 提交于
      Currently it is possible to craft a special netlink RTM_NEWQDISC
      command that can result in jitter being equal to 0x80000000. It is
      enough to set the 32 bit jitter to 0x02000000 (it will later be
      multiplied by 2^6) or just set the 64 bit jitter via
      TCA_NETEM_JITTER64. This causes an overflow during the generation of
      uniformly distributed numbers in tabledist(), which in turn leads to
      division by zero (sigma != 0, but sigma * 2 is 0).
      
      The related fragment of code needs 32-bit division - see commit
      9b0ed891 ("netem: remove unnecessary 64 bit modulus"), so switching to
      64 bit is not an option.
      
      Fix the issue by keeping the value of jitter within the range that can
      be adequately handled by tabledist() - [0;INT_MAX]. As negative std
      deviation makes no sense, take the absolute value of the passed value
      and cap it at INT_MAX. Inside tabledist(), switch to unsigned 32 bit
      arithmetic in order to prevent overflows.
      
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Signed-off-by: NAleksandr Nogikh <nogikh@google.com>
      Reported-by: syzbot+ec762a6342ad0d3c0d8f@syzkaller.appspotmail.com
      Acked-by: NStephen Hemminger <stephen@networkplumber.org>
      Link: https://lore.kernel.org/r/20201028170731.1383332-1-aleksandrnogikh@gmail.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
      eadd1bef
    • L
      ibmvnic: fix ibmvnic_set_mac · 8fc3672a
      Lijun Pan 提交于
      Jakub Kicinski brought up a concern in ibmvnic_set_mac().
      ibmvnic_set_mac() does this:
      
      	ether_addr_copy(adapter->mac_addr, addr->sa_data);
      	if (adapter->state != VNIC_PROBED)
      		rc = __ibmvnic_set_mac(netdev, addr->sa_data);
      
      So if state == VNIC_PROBED, the user can assign an invalid address to
      adapter->mac_addr, and ibmvnic_set_mac() will still return 0.
      
      The fix is to validate ethernet address at the beginning of
      ibmvnic_set_mac(), and move the ether_addr_copy to
      the case of "adapter->state != VNIC_PROBED".
      
      Fixes: c26eba03 ("ibmvnic: Update reset infrastructure to support tunable parameters")
      Signed-off-by: NLijun Pan <ljp@linux.ibm.com>
      Link: https://lore.kernel.org/r/20201027220456.71450-1-ljp@linux.ibm.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
      8fc3672a
    • P
      mptcp: add missing memory scheduling in the rx path · 9c3f94e1
      Paolo Abeni 提交于
      When moving the skbs from the subflow into the msk receive
      queue, we must schedule there the required amount of memory.
      
      Try to borrow the required memory from the subflow, if needed,
      so that we leverage the existing TCP heuristic.
      
      Fixes: 6771bfd9 ("mptcp: update mptcp ack sequence from work queue")
      Signed-off-by: NPaolo Abeni <pabeni@redhat.com>
      Reviewed-by: NMat Martineau <mathew.j.martineau@linux.intel.com>
      Link: https://lore.kernel.org/r/f6143a6193a083574f11b00dbf7b5ad151bc4ff4.1603810630.git.pabeni@redhat.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
      9c3f94e1
    • G
      include: jhash/signal: Fix fall-through warnings for Clang · 4169e889
      Gustavo A. R. Silva 提交于
      In preparation to enable -Wimplicit-fallthrough for Clang, explicitly
      add break statements instead of letting the code fall through to the
      next case.
      
      This patch adds four break statements that, together, fix almost 40,000
      warnings when building Linux 5.10-rc1 with Clang 12.0.0 and this[1] change
      reverted. Notice that in order to enable -Wimplicit-fallthrough for Clang,
      such change[1] is meant to be reverted at some point. So, this patch helps
      to move in that direction.
      
      Something important to mention is that there is currently a discrepancy
      between GCC and Clang when dealing with switch fall-through to empty case
      statements or to cases that only contain a break/continue/return
      statement[2][3][4].
      
      Now that the -Wimplicit-fallthrough option has been globally enabled[5],
      any compiler should really warn on missing either a fallthrough annotation
      or any of the other case-terminating statements (break/continue/return/
      goto) when falling through to the next case statement. Making exceptions
      to this introduces variation in case handling which may continue to lead
      to bugs, misunderstandings, and a general lack of robustness. The point
      of enabling options like -Wimplicit-fallthrough is to prevent human error
      and aid developers in spotting bugs before their code is even built/
      submitted/committed, therefore eliminating classes of bugs. So, in order
      to really accomplish this, we should, and can, move in the direction of
      addressing any error-prone scenarios and get rid of the unintentional
      fallthrough bug-class in the kernel, entirely, even if there is some minor
      redundancy. Better to have explicit case-ending statements than continue to
      have exceptions where one must guess as to the right result. The compiler
      will eliminate any actual redundancy.
      
      [1] commit e2079e93 ("kbuild: Do not enable -Wimplicit-fallthrough for clang for now")
      [2] https://github.com/ClangBuiltLinux/linux/issues/636
      [3] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91432
      [4] https://godbolt.org/z/xgkvIh
      [5] commit a035d552 ("Makefile: Globally enable fall-through warning")
      Co-developed-by: NKees Cook <keescook@chromium.org>
      Signed-off-by: NKees Cook <keescook@chromium.org>
      Signed-off-by: NGustavo A. R. Silva <gustavoars@kernel.org>
      4169e889
    • L
      Merge tag 'afs-fixes-20201029' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs · 598a5976
      Linus Torvalds 提交于
      Pull AFS fixes from David Howells:
      
       - Fix copy_file_range() to an afs file now returning EINVAL if the
         splice_write file op isn't supplied.
      
       - Fix a deref-before-check in afs_unuse_cell().
      
       - Fix a use-after-free in afs_xattr_get_acl().
      
       - Fix afs to not try to clear PG_writeback when laundering a page.
      
       - Fix afs to take a ref on a page that it sets PG_private on and to
         drop that ref when clearing PG_private. This is done through recently
         added helpers.
      
       - Fix a page leak if write_begin() fails.
      
       - Fix afs_write_begin() to not alter the dirty region info stored in
         page->private, but rather do this in afs_write_end() instead when we
         know what we actually changed.
      
       - Fix afs_invalidatepage() to alter the dirty region info on a page
         when partial page invalidation occurs so that we don't inadvertantly
         include a span of zeros that will get written back if a page gets
         laundered due to a remote 3rd-party induced invalidation.
      
         We mustn't, however, reduce the dirty region if the page has been
         seen to be mapped (ie. we got called through the page_mkwrite vector)
         as the page might still be mapped and we might lose data if the file
         is extended again.
      
       - Fix the dirty region info to have a lower resolution if the size of
         the page is too large for this to be encoded (e.g. powerpc32 with 64K
         pages).
      
         Note that this might not be the ideal way to handle this, since it
         may allow some leakage of undirtied zero bytes to the server's copy
         in the case of a 3rd-party conflict.
      
      To aid the last two fixes, two additional changes:
      
       - Wrap the manipulations of the dirty region info stored in
         page->private into helper functions.
      
       - Alter the encoding of the dirty region so that the region bounds can
         be stored with one fewer bit, making a bit available for the
         indication of mappedness.
      
      * tag 'afs-fixes-20201029' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
        afs: Fix dirty-region encoding on ppc32 with 64K pages
        afs: Fix afs_invalidatepage to adjust the dirty region
        afs: Alter dirty range encoding in page->private
        afs: Wrap page->private manipulations in inline functions
        afs: Fix where page->private is set during write
        afs: Fix page leak on afs_write_begin() failure
        afs: Fix to take ref on page when PG_private is set
        afs: Fix afs_launder_page to not clear PG_writeback
        afs: Fix a use after free in afs_xattr_get_acl()
        afs: Fix tracing deref-before-check
        afs: Fix copy_file_range()
      598a5976
    • T
      tipc: fix memory leak caused by tipc_buf_append() · ceb1eb2f
      Tung Nguyen 提交于
      Commit ed42989e ("tipc: fix the skb_unshare() in tipc_buf_append()")
      replaced skb_unshare() with skb_copy() to not reduce the data reference
      counter of the original skb intentionally. This is not the correct
      way to handle the cloned skb because it causes memory leak in 2
      following cases:
       1/ Sending multicast messages via broadcast link
        The original skb list is cloned to the local skb list for local
        destination. After that, the data reference counter of each skb
        in the original list has the value of 2. This causes each skb not
        to be freed after receiving ACK:
        tipc_link_advance_transmq()
        {
         ...
         /* release skb */
         __skb_unlink(skb, &l->transmq);
         kfree_skb(skb); <-- memory exists after being freed
        }
      
       2/ Sending multicast messages via replicast link
        Similar to the above case, each skb cannot be freed after purging
        the skb list:
        tipc_mcast_xmit()
        {
         ...
         __skb_queue_purge(pkts); <-- memory exists after being freed
        }
      
      This commit fixes this issue by using skb_unshare() instead. Besides,
      to avoid use-after-free error reported by KASAN, the pointer to the
      fragment is set to NULL before calling skb_unshare() to make sure that
      the original skb is not freed after freeing the fragment 2 times in
      case skb_unshare() returns NULL.
      
      Fixes: ed42989e ("tipc: fix the skb_unshare() in tipc_buf_append()")
      Acked-by: NJon Maloy <jmaloy@redhat.com>
      Reported-by: NThang Hoang Ngo <thang.h.ngo@dektech.com.au>
      Signed-off-by: NTung Nguyen <tung.q.nguyen@dektech.com.au>
      Reviewed-by: NXin Long <lucien.xin@gmail.com>
      Acked-by: NCong Wang <xiyou.wangcong@gmail.com>
      Link: https://lore.kernel.org/r/20201027032403.1823-1-tung.q.nguyen@dektech.com.auSigned-off-by: NJakub Kicinski <kuba@kernel.org>
      ceb1eb2f
    • M
      gtp: fix an use-before-init in gtp_newlink() · 51467431
      Masahiro Fujiwara 提交于
      *_pdp_find() from gtp_encap_recv() would trigger a crash when a peer
      sends GTP packets while creating new GTP device.
      
      RIP: 0010:gtp1_pdp_find.isra.0+0x68/0x90 [gtp]
      <SNIP>
      Call Trace:
       <IRQ>
       gtp_encap_recv+0xc2/0x2e0 [gtp]
       ? gtp1_pdp_find.isra.0+0x90/0x90 [gtp]
       udp_queue_rcv_one_skb+0x1fe/0x530
       udp_queue_rcv_skb+0x40/0x1b0
       udp_unicast_rcv_skb.isra.0+0x78/0x90
       __udp4_lib_rcv+0x5af/0xc70
       udp_rcv+0x1a/0x20
       ip_protocol_deliver_rcu+0xc5/0x1b0
       ip_local_deliver_finish+0x48/0x50
       ip_local_deliver+0xe5/0xf0
       ? ip_protocol_deliver_rcu+0x1b0/0x1b0
      
      gtp_encap_enable() should be called after gtp_hastable_new() otherwise
      *_pdp_find() will access the uninitialized hash table.
      
      Fixes: 1e3a3abd ("gtp: make GTP sockets in gtp_newlink optional")
      Signed-off-by: NMasahiro Fujiwara <fujiwara.masahiro@gmail.com>
      Link: https://lore.kernel.org/r/20201027114846.3924-1-fujiwara.masahiro@gmail.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
      51467431
    • L
      Merge tag 'ext4_for_linus_fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 58130a6c
      Linus Torvalds 提交于
      Pull ext4 fixes from Ted Ts'o:
       "Bug fixes for the new ext4 fast commit feature, plus a fix for the
        'data=journal' bug fix.
      
        Also use the generic casefolding support which has now landed in
        fs/libfs.c for 5.10"
      
      * tag 'ext4_for_linus_fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: indicate that fast_commit is available via /sys/fs/ext4/feature/...
        ext4: use generic casefolding support
        ext4: do not use extent after put_bh
        ext4: use IS_ERR() for error checking of path
        ext4: fix mmap write protection for data=journal mode
        jbd2: fix a kernel-doc markup
        ext4: use s_mount_flags instead of s_mount_state for fast commit state
        ext4: make num of fast commit blocks configurable
        ext4: properly check for dirty state in ext4_inode_datasync_dirty()
        ext4: fix double locking in ext4_fc_commit_dentry_updates()
      58130a6c
  2. 29 10月, 2020 18 次提交