1. 16 12月, 2021 1 次提交
  2. 11 12月, 2021 1 次提交
  3. 04 12月, 2021 1 次提交
    • L
      net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero · 2be6d4d1
      Lee Jones 提交于
      Currently, due to the sequential use of min_t() and clamp_t() macros,
      in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is not set, the logic
      sets tx_max to 0.  This is then used to allocate the data area of the
      SKB requested later in cdc_ncm_fill_tx_frame().
      
      This does not cause an issue presently because when memory is
      allocated during initialisation phase of SKB creation, more memory
      (512b) is allocated than is required for the SKB headers alone (320b),
      leaving some space (512b - 320b = 192b) for CDC data (172b).
      
      However, if more elements (for example 3 x u64 = [24b]) were added to
      one of the SKB header structs, say 'struct skb_shared_info',
      increasing its original size (320b [320b aligned]) to something larger
      (344b [384b aligned]), then suddenly the CDC data (172b) no longer
      fits in the spare SKB data area (512b - 384b = 128b).
      
      Consequently the SKB bounds checking semantics fails and panics:
      
        skbuff: skb_over_panic: text:ffffffff830a5b5f len:184 put:172   \
           head:ffff888119227c00 data:ffff888119227c00 tail:0xb8 end:0x80 dev:<NULL>
      
        ------------[ cut here ]------------
        kernel BUG at net/core/skbuff.c:110!
        RIP: 0010:skb_panic+0x14f/0x160 net/core/skbuff.c:106
        <snip>
        Call Trace:
         <IRQ>
         skb_over_panic+0x2c/0x30 net/core/skbuff.c:115
         skb_put+0x205/0x210 net/core/skbuff.c:1877
         skb_put_zero include/linux/skbuff.h:2270 [inline]
         cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1116 [inline]
         cdc_ncm_fill_tx_frame+0x127f/0x3d50 drivers/net/usb/cdc_ncm.c:1293
         cdc_ncm_tx_fixup+0x98/0xf0 drivers/net/usb/cdc_ncm.c:1514
      
      By overriding the max value with the default CDC_NCM_NTB_MAX_SIZE_TX
      when not offered through the system provided params, we ensure enough
      data space is allocated to handle the CDC data, meaning no crash will
      occur.
      
      Cc: Oliver Neukum <oliver@neukum.org>
      Fixes: 289507d3 ("net: cdc_ncm: use sysfs for rx/tx aggregation tuning")
      Signed-off-by: NLee Jones <lee.jones@linaro.org>
      Reviewed-by: NBjørn Mork <bjorn@mork.no>
      Link: https://lore.kernel.org/r/20211202143437.1411410-1-lee.jones@linaro.orgSigned-off-by: NJakub Kicinski <kuba@kernel.org>
      2be6d4d1
  4. 29 11月, 2021 1 次提交
  5. 23 11月, 2021 1 次提交
    • M
      net: usb: Correct PHY handling of smsc95xx · a049a30f
      Martyn Welch 提交于
      The smsc95xx driver is dropping phy speed settings and causing a stack
      trace at device unbind:
      
      [  536.379147] smsc95xx 2-1:1.0 eth1: unregister 'smsc95xx' usb-ci_hdrc.2-1, smsc95xx USB 2.0 Ethernet
      [  536.425029] ------------[ cut here ]------------
      [  536.429650] WARNING: CPU: 0 PID: 439 at fs/kernfs/dir.c:1535 kernfs_remove_by_name_ns+0xb8/0xc0
      [  536.438416] kernfs: can not remove 'attached_dev', no directory
      [  536.444363] Modules linked in: xts dm_crypt dm_mod atmel_mxt_ts smsc95xx usbnet
      [  536.451748] CPU: 0 PID: 439 Comm: sh Tainted: G        W         5.15.0 #1
      [  536.458636] Hardware name: Freescale i.MX53 (Device Tree Support)
      [  536.464735] Backtrace: 
      [  536.467190] [<80b1c904>] (dump_backtrace) from [<80b1cb48>] (show_stack+0x20/0x24)
      [  536.474787]  r7:000005ff r6:8035b294 r5:600f0013 r4:80d8af78
      [  536.480449] [<80b1cb28>] (show_stack) from [<80b1f764>] (dump_stack_lvl+0x48/0x54)
      [  536.488035] [<80b1f71c>] (dump_stack_lvl) from [<80b1f788>] (dump_stack+0x18/0x1c)
      [  536.495620]  r5:00000009 r4:80d9b820
      [  536.499198] [<80b1f770>] (dump_stack) from [<80124fac>] (__warn+0xfc/0x114)
      [  536.506187] [<80124eb0>] (__warn) from [<80b1d21c>] (warn_slowpath_fmt+0xa8/0xdc)
      [  536.513688]  r7:000005ff r6:80d9b820 r5:80d9b8e0 r4:83744000
      [  536.519349] [<80b1d178>] (warn_slowpath_fmt) from [<8035b294>] (kernfs_remove_by_name_ns+0xb8/0xc0)
      [  536.528416]  r9:00000001 r8:00000000 r7:824926dc r6:00000000 r5:80df6c2c r4:00000000
      [  536.536162] [<8035b1dc>] (kernfs_remove_by_name_ns) from [<80b1f56c>] (sysfs_remove_link+0x4c/0x50)
      [  536.545225]  r6:7f00f02c r5:80df6c2c r4:83306400
      [  536.549845] [<80b1f520>] (sysfs_remove_link) from [<806f9c8c>] (phy_detach+0xfc/0x11c)
      [  536.557780]  r5:82492000 r4:83306400
      [  536.561359] [<806f9b90>] (phy_detach) from [<806f9cf8>] (phy_disconnect+0x4c/0x58)
      [  536.568943]  r7:824926dc r6:7f00f02c r5:82492580 r4:83306400
      [  536.574604] [<806f9cac>] (phy_disconnect) from [<7f00a310>] (smsc95xx_disconnect_phy+0x30/0x38 [smsc95xx])
      [  536.584290]  r5:82492580 r4:82492580
      [  536.587868] [<7f00a2e0>] (smsc95xx_disconnect_phy [smsc95xx]) from [<7f001570>] (usbnet_stop+0x70/0x1a0 [usbnet])
      [  536.598161]  r5:82492580 r4:82492000
      [  536.601740] [<7f001500>] (usbnet_stop [usbnet]) from [<808baa70>] (__dev_close_many+0xb4/0x12c)
      [  536.610466]  r8:83744000 r7:00000000 r6:83744000 r5:83745b74 r4:82492000
      [  536.617170] [<808ba9bc>] (__dev_close_many) from [<808bab78>] (dev_close_many+0x90/0x120)
      [  536.625365]  r7:00000001 r6:83745b74 r5:83745b8c r4:82492000
      [  536.631026] [<808baae8>] (dev_close_many) from [<808bf408>] (unregister_netdevice_many+0x15c/0x704)
      [  536.640094]  r9:00000001 r8:81130b98 r7:83745b74 r6:83745bc4 r5:83745b8c r4:82492000
      [  536.647840] [<808bf2ac>] (unregister_netdevice_many) from [<808bfa50>] (unregister_netdevice_queue+0xa0/0xe8)
      [  536.657775]  r10:8112bcc0 r9:83306c00 r8:83306c80 r7:8291e420 r6:83744000 r5:00000000
      [  536.665608]  r4:82492000
      [  536.668143] [<808bf9b0>] (unregister_netdevice_queue) from [<808bfac0>] (unregister_netdev+0x28/0x30)
      [  536.677381]  r6:7f01003c r5:82492000 r4:82492000
      [  536.682000] [<808bfa98>] (unregister_netdev) from [<7f000b40>] (usbnet_disconnect+0x64/0xdc [usbnet])
      [  536.691241]  r5:82492000 r4:82492580
      [  536.694819] [<7f000adc>] (usbnet_disconnect [usbnet]) from [<8076b958>] (usb_unbind_interface+0x80/0x248)
      [  536.704406]  r5:7f01003c r4:83306c80
      [  536.707984] [<8076b8d8>] (usb_unbind_interface) from [<8061765c>] (device_release_driver_internal+0x1c4/0x1cc)
      [  536.718005]  r10:8112bcc0 r9:80dff1dc r8:83306c80 r7:83744000 r6:7f01003c r5:00000000
      [  536.725838]  r4:8291e420
      [  536.728373] [<80617498>] (device_release_driver_internal) from [<80617684>] (device_release_driver+0x20/0x24)
      [  536.738302]  r7:83744000 r6:810d4f4c r5:8291e420 r4:8176ae30
      [  536.743963] [<80617664>] (device_release_driver) from [<806156cc>] (bus_remove_device+0xf0/0x148)
      [  536.752858] [<806155dc>] (bus_remove_device) from [<80610018>] (device_del+0x198/0x41c)
      [  536.760880]  r7:83744000 r6:8116e2e4 r5:8291e464 r4:8291e420
      [  536.766542] [<8060fe80>] (device_del) from [<80768fe8>] (usb_disable_device+0xcc/0x1e0)
      [  536.774576]  r10:8112bcc0 r9:80dff1dc r8:00000001 r7:8112bc48 r6:8291e400 r5:00000001
      [  536.782410]  r4:83306c00
      [  536.784945] [<80768f1c>] (usb_disable_device) from [<80769c30>] (usb_set_configuration+0x514/0x8dc)
      [  536.794011]  r10:00000000 r9:00000000 r8:832c3600 r7:00000004 r6:810d5688 r5:00000000
      [  536.801844]  r4:83306c00
      [  536.804379] [<8076971c>] (usb_set_configuration) from [<80775fac>] (usb_generic_driver_disconnect+0x34/0x38)
      [  536.814236]  r10:832c3610 r9:83745ef8 r8:832c3600 r7:00000004 r6:810d5688 r5:83306c00
      [  536.822069]  r4:83306c00
      [  536.824605] [<80775f78>] (usb_generic_driver_disconnect) from [<8076b850>] (usb_unbind_device+0x30/0x70)
      [  536.834100]  r5:83306c00 r4:810d5688
      [  536.837678] [<8076b820>] (usb_unbind_device) from [<8061765c>] (device_release_driver_internal+0x1c4/0x1cc)
      [  536.847432]  r5:822fb480 r4:83306c80
      [  536.851009] [<80617498>] (device_release_driver_internal) from [<806176a8>] (device_driver_detach+0x20/0x24)
      [  536.860853]  r7:00000004 r6:810d4f4c r5:810d5688 r4:83306c80
      [  536.866515] [<80617688>] (device_driver_detach) from [<80614d98>] (unbind_store+0x70/0xe4)
      [  536.874793] [<80614d28>] (unbind_store) from [<80614118>] (drv_attr_store+0x30/0x3c)
      [  536.882554]  r7:00000000 r6:00000000 r5:83739200 r4:80614d28
      [  536.888217] [<806140e8>] (drv_attr_store) from [<8035cb68>] (sysfs_kf_write+0x48/0x54)
      [  536.896154]  r5:83739200 r4:806140e8
      [  536.899732] [<8035cb20>] (sysfs_kf_write) from [<8035be84>] (kernfs_fop_write_iter+0x11c/0x1d4)
      [  536.908446]  r5:83739200 r4:00000004
      [  536.912024] [<8035bd68>] (kernfs_fop_write_iter) from [<802b87fc>] (vfs_write+0x258/0x3e4)
      [  536.920317]  r10:00000000 r9:83745f58 r8:83744000 r7:00000000 r6:00000004 r5:00000000
      [  536.928151]  r4:82adacc0
      [  536.930687] [<802b85a4>] (vfs_write) from [<802b8b0c>] (ksys_write+0x74/0xf4)
      [  536.937842]  r10:00000004 r9:007767a0 r8:83744000 r7:00000000 r6:00000000 r5:82adacc0
      [  536.945676]  r4:82adacc0
      [  536.948213] [<802b8a98>] (ksys_write) from [<802b8ba4>] (sys_write+0x18/0x1c)
      [  536.955367]  r10:00000004 r9:83744000 r8:80100244 r7:00000004 r6:76f47b58 r5:76fc0350
      [  536.963200]  r4:00000004
      [  536.965735] [<802b8b8c>] (sys_write) from [<80100060>] (ret_fast_syscall+0x0/0x48)
      [  536.973320] Exception stack(0x83745fa8 to 0x83745ff0)
      [  536.978383] 5fa0:                   00000004 76fc0350 00000001 007767a0 00000004 00000000
      [  536.986569] 5fc0: 00000004 76fc0350 76f47b58 00000004 76f47c7c 76f48114 00000000 7e87991c
      [  536.994753] 5fe0: 00000498 7e879908 76e6dce8 76eca2e8
      [  536.999922] ---[ end trace 9b835d809816b435 ]---
      
      The driver should not be connecting and disconnecting the PHY when the
      device is opened and closed, it should be stopping and starting the PHY. The
      phy should be connected as part of binding and disconnected during
      unbinding.
      
      As this results in the PHY not being reset during open, link speed, etc.
      settings set prior to the link coming up are now not being lost.
      
      It is necessary for phy_stop() to only be called when the phydev still
      exists (resolving the above stack trace). When unbinding, ".unbind" will be
      called prior to ".stop", with phy_disconnect() already having called
      phy_stop() before the phydev becomes inaccessible.
      Signed-off-by: NMartyn Welch <martyn.welch@collabora.com>
      Cc: Steve Glendinning <steve.glendinning@shawell.net>
      Cc: UNGLinuxDriver@microchip.com
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: stable@kernel.org # v5.15
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      a049a30f
  6. 17 11月, 2021 1 次提交
  7. 28 10月, 2021 1 次提交
  8. 26 10月, 2021 1 次提交
    • J
      net: lan78xx: fix division by zero in send path · db6c3c06
      Johan Hovold 提交于
      Add the missing endpoint max-packet sanity check to probe() to avoid
      division by zero in lan78xx_tx_bh() in case a malicious device has
      broken descriptors (or when doing descriptor fuzz testing).
      
      Note that USB core will reject URBs submitted for endpoints with zero
      wMaxPacketSize but that drivers doing packet-size calculations still
      need to handle this (cf. commit 2548288b ("USB: Fix: Don't skip
      endpoint descriptors with maxpacket=0")).
      
      Fixes: 55d7de9d ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
      Cc: stable@vger.kernel.org      # 4.3
      Cc: Woojung.Huh@microchip.com <Woojung.Huh@microchip.com>
      Signed-off-by: NJohan Hovold <johan@kernel.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      db6c3c06
  9. 25 10月, 2021 1 次提交
  10. 23 10月, 2021 3 次提交
  11. 21 10月, 2021 1 次提交
  12. 15 10月, 2021 3 次提交
  13. 14 10月, 2021 1 次提交
  14. 12 10月, 2021 1 次提交
    • V
      r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256 · 9973a430
      Vegard Nossum 提交于
      Fix the following build/link errors by adding a dependency on
      CRYPTO, CRYPTO_HASH, CRYPTO_SHA256 and CRC32:
      
        ld: drivers/net/usb/r8152.o: in function `rtl8152_fw_verify_checksum':
        r8152.c:(.text+0x2b2a): undefined reference to `crypto_alloc_shash'
        ld: r8152.c:(.text+0x2bed): undefined reference to `crypto_shash_digest'
        ld: r8152.c:(.text+0x2c50): undefined reference to `crypto_destroy_tfm'
        ld: drivers/net/usb/r8152.o: in function `_rtl8152_set_rx_mode':
        r8152.c:(.text+0xdcb0): undefined reference to `crc32_le'
      
      Fixes: 9370f2d0 ("r8152: support request_firmware for RTL8153")
      Fixes: ac718b69 ("net/usb: new driver for RTL8152")
      Signed-off-by: NVegard Nossum <vegard.nossum@oracle.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9973a430
  15. 08 10月, 2021 1 次提交
  16. 05 10月, 2021 2 次提交
  17. 02 10月, 2021 2 次提交
  18. 24 9月, 2021 1 次提交
  19. 17 9月, 2021 1 次提交
  20. 03 9月, 2021 1 次提交
  21. 02 9月, 2021 2 次提交
  22. 26 8月, 2021 1 次提交
  23. 25 8月, 2021 10 次提交
  24. 24 8月, 2021 1 次提交