1. 16 7月, 2017 7 次提交
  2. 15 7月, 2017 7 次提交
    • X
      sctp: fix an array overflow when all ext chunks are set · 10b3bf54
      Xin Long 提交于
      Marcelo noticed an array overflow caused by commit c28445c3
      ("sctp: add reconf_enable in asoc ep and netns"), in which sctp
      would add SCTP_CID_RECONF into extensions when reconf_enable is
      set in sctp_make_init and sctp_make_init_ack.
      
      Then now when all ext chunks are set, 4 ext chunk ids can be put
      into extensions array while extensions array size is 3. It would
      cause a kernel panic because of this overflow.
      
      This patch is to fix it by defining extensions array size is 4 in
      both sctp_make_init and sctp_make_init_ack.
      
      Fixes: c28445c3 ("sctp: add reconf_enable in asoc ep and netns")
      Signed-off-by: NXin Long <lucien.xin@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      10b3bf54
    • A
      liquidio: fix possible eeprom format string overflow · 56c0da49
      Arnd Bergmann 提交于
      gcc reports that the temporary buffer for computing the
      string length may be too small here:
      
      drivers/net/ethernet/cavium/liquidio/lio_ethtool.c: In function 'lio_get_eeprom_len':
      /drivers/net/ethernet/cavium/liquidio/lio_ethtool.c:345:21: error: 'sprintf' may write a terminating nul past the end of the destination [-Werror=format-overflow=]
        len = sprintf(buf, "boardname:%s serialnum:%s maj:%lld min:%lld\n",
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      drivers/net/ethernet/cavium/liquidio/lio_ethtool.c:345:6: note: 'sprintf' output between 35 and 167 bytes into a destination of size 128
        len = sprintf(buf, "boardname:%s serialnum:%s maj:%lld min:%lld\n",
      
      This extends it to 192 bytes, which is certainly enough. As far
      as I could tell, there are no other constraints that require a specific
      maximum size.
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      56c0da49
    • A
      vmxnet3: avoid format strint overflow warning · c7673e4d
      Arnd Bergmann 提交于
      gcc-7 notices that "-event-%d" could be more than 11 characters long
      if we had larger 'vector' numbers:
      
      drivers/net/vmxnet3/vmxnet3_drv.c: In function 'vmxnet3_activate_dev':
      drivers/net/vmxnet3/vmxnet3_drv.c:2095:40: error: 'sprintf' may write a terminating nul past the end of the destination [-Werror=format-overflow=]
      sprintf(intr->event_msi_vector_name, "%s-event-%d",
                                           ^~~~~~~~~~~~~
      drivers/net/vmxnet3/vmxnet3_drv.c:2095:3: note: 'sprintf' output between 9 and 33 bytes into a destination of size 32
      
      The current code is safe, but making the string a little longer
      is harmless and lets gcc see that it's ok.
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c7673e4d
    • A
      net: thunder_bgx: avoid format string overflow warning · c41626ce
      Arnd Bergmann 提交于
      gcc warns that the temporary buffer might be too small here:
      
      drivers/net/ethernet/cavium/thunder/thunder_bgx.c: In function 'bgx_probe':
      drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1020:16: error: '%d' directive writing between 1 and 10 bytes into a region of size between 9 and 11 [-Werror=format-overflow=]
      sprintf(str, "BGX%d LMAC%d mode", bgx->bgx_id, lmacid);
                   ^~~~~~~~~~~~~~~~~~~
      drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1020:16: note: directive argument in the range [0, 2147483647]
      drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1020:3: note: 'sprintf' output between 16 and 27 bytes into a destination of size 20
      
      This probably can't happen, but it can't hurt to make it long
      enough for the theoretical limit.
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c41626ce
    • A
      bnx2x: fix format overflow warning · be9cdf1b
      Arnd Bergmann 提交于
      gcc notices that large queue numbers would overflow the queue name
      string:
      
      drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c: In function 'bnx2x_get_strings':
      drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c:3165:25: error: '%d' directive writing between 1 and 10 bytes into a region of size 5 [-Werror=format-overflow=]
      drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c:3165:25: note: directive argument in the range [0, 2147483647]
      drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c:3165:5: note: 'sprintf' output between 2 and 11 bytes into a destination of size 5
      
      There is a hard limit in place that makes the number at most two
      digits, so the code is fine. This changes it to use snprintf()
      to truncate instead of overflowing, which shuts up that warning.
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      be9cdf1b
    • A
      net: niu: fix format string overflow warning: · 73066f6c
      Arnd Bergmann 提交于
      We get a warning for the port_name string that might be longer than
      six characters if we had more than 10 ports:
      
      drivers/net/ethernet/sun/niu.c: In function 'niu_put_parent':
      drivers/net/ethernet/sun/niu.c:9563:21: error: '%d' directive writing between 1 and 3 bytes into a region of size 2 [-Werror=format-overflow=]
        sprintf(port_name, "port%d", port);
                           ^~~~~~~~
      drivers/net/ethernet/sun/niu.c:9563:21: note: directive argument in the range [0, 255]
      drivers/net/ethernet/sun/niu.c:9563:2: note: 'sprintf' output between 6 and 8 bytes into a destination of size 6
        sprintf(port_name, "port%d", port);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      drivers/net/ethernet/sun/niu.c: In function 'niu_pci_init_one':
      drivers/net/ethernet/sun/niu.c:9538:22: error: '%d' directive writing between 1 and 3 bytes into a region of size 2 [-Werror=format-overflow=]
         sprintf(port_name, "port%d", port);
                            ^~~~~~~~
      drivers/net/ethernet/sun/niu.c:9538:22: note: directive argument in the range [0, 255]
      drivers/net/ethernet/sun/niu.c:9538:3: note: 'sprintf' output between 6 and 8 bytes into a destination of size 6
      
      While we know that the port number is small, there is no harm in
      making the format string two bytes longer to avoid the warning.
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      73066f6c
    • A
      isdn: divert: fix sprintf buffer overflow warning · 45e0b4b3
      Arnd Bergmann 提交于
      One string we pass into the cs->info buffer might be too long,
      as pointed out by gcc:
      
      drivers/isdn/divert/isdn_divert.c: In function 'll_callback':
      drivers/isdn/divert/isdn_divert.c:488:22: error: '%d' directive writing between 1 and 3 bytes into a region of size between 1 and 69 [-Werror=format-overflow=]
       sprintf(cs->info, "%d 0x%lx %s %s %s %s 0x%x 0x%x %d %d %s\n",
                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      drivers/isdn/divert/isdn_divert.c:488:22: note: directive argument in the range [0, 255]
      drivers/isdn/divert/isdn_divert.c:488:4: note: 'sprintf' output 25 or more bytes (assuming 129) into a destination of size 90
      
      This is unlikely to actually cause problems, so let's use snprintf
      as a simple workaround to shut  up the warning and truncate the
      buffer instead.
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      45e0b4b3
  3. 14 7月, 2017 19 次提交
  4. 13 7月, 2017 7 次提交
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · edaf3825
      Linus Torvalds 提交于
      Pull networking fixes from David Miller:
      
      1) Fix 64-bit division in mlx5 IPSEC offload support, from Ilan Tayari
         and Arnd Bergmann.
      
      2) Fix race in statistics gathering in bnxt_en driver, from Michael
         Chan.
      
      3) Can't use a mutex in RCU reader protected section on tap driver, from
         Cong WANG.
      
      4) Fix mdb leak in bridging code, from Eduardo Valentin.
      
      5) Fix free of wrong pointer variable in nfp driver, from Dan Carpenter.
      
      6) Buffer overflow in brcmfmac driver, from Arend van SPriel.
      
      7) ioremap_nocache() return value needs to be checked in smsc911x
         driver, from Alexey Khoroshilov.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (34 commits)
        net: stmmac: revert "support future possible different internal phy mode"
        sfc: don't read beyond unicast address list
        datagram: fix kernel-doc comments
        socket: add documentation for missing elements
        smsc911x: Add check for ioremap_nocache() return code
        brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
        net: hns: Bugfix for Tx timeout handling in hns driver
        net: ipmr: ipmr_get_table() returns NULL
        nfp: freeing the wrong variable
        mlxsw: spectrum_switchdev: Check status of memory allocation
        mlxsw: spectrum_switchdev: Remove unused variable
        mlxsw: spectrum_router: Fix use-after-free in route replace
        mlxsw: spectrum_router: Add missing rollback
        samples/bpf: fix a build issue
        bridge: mdb: fix leak on complete_info ptr on fail path
        tap: convert a mutex to a spinlock
        cxgb4: fix BUG() on interrupt deallocating path of ULD
        qed: Fix printk option passed when printing ipv6 addresses
        net: Fix minor code bug in timestamping.txt
        net: stmmac: Make 'alloc_dma_[rt]x_desc_resources()' look even closer
        ...
      edaf3825
    • L
      disable new gcc-7.1.1 warnings for now · bd664f6b
      Linus Torvalds 提交于
      I made the mistake of upgrading my desktop to the new Fedora 26 that
      comes with gcc-7.1.1.
      
      There's nothing wrong per se that I've noticed, but I now have 1500
      lines of warnings, mostly from the new format-truncation warning
      triggering all over the tree.
      
      We use 'snprintf()' and friends in a lot of places, and often know that
      the numbers are fairly small (ie a controller index or similar), but gcc
      doesn't know that, and sees an 'int', and thinks that it could be some
      huge number.  And then complains when our buffers are not able to fit
      the name for the ten millionth controller.
      
      These warnings aren't necessarily bad per se, and we probably want to
      look through them subsystem by subsystem, but at least during the merge
      window they just mean that I can't even see if somebody is introducing
      any *real* problems when I pull.
      
      So warnings disabled for now.
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      bd664f6b
    • L
      Merge tag 'modules-for-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux · 3a75ad14
      Linus Torvalds 提交于
      Pull modules updates from Jessica Yu:
       "Summary of modules changes for the 4.13 merge window:
      
         - Minor code cleanups
      
         - Avoid accessing mod struct prior to checking module struct version,
           from Kees
      
         - Fix racy atomic inc/dec logic of kmod_concurrent_max in kmod, from
           Luis"
      
      * tag 'modules-for-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux:
        module: make the modinfo name const
        kmod: reduce atomic operations on kmod_concurrent and simplify
        module: use list_for_each_entry_rcu() on find_module_all()
        kernel/module.c: suppress warning about unused nowarn variable
        module: Add module name to modinfo
        module: Pass struct load_info into symbol checks
      3a75ad14
    • L
      net: stmmac: revert "support future possible different internal phy mode" · d93b07f8
      LABBE Corentin 提交于
      Since internal phy-mode is reserved for non-xMII protocol we cannot use
      it with dwmac-sun8i.
      Furthermore, all DT patchs which comes with this patch were cleaned, so
      the current state is broken.
      This reverts commit 1c2fa5f8 ("net: stmmac: support future possible different internal phy mode")
      
      Fixes: 1c2fa5f8 ("net: stmmac: support future possible different internal phy mode")
      Signed-off-by: NCorentin Labbe <clabbe.montjoie@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d93b07f8
    • B
      sfc: don't read beyond unicast address list · c70d6815
      Bert Kenward 提交于
      If we have more than 32 unicast MAC addresses assigned to an interface
      we will read beyond the end of the address table in the driver when
      adding filters. The next 256 entries store multicast addresses, so we
      will end up attempting to insert duplicate filters, which is mostly
      harmless. If we add more than 288 unicast addresses we will then read
      past the multicast address table, which is likely to be more exciting.
      
      Fixes: 12fb0da4 ("sfc: clean fallbacks between promisc/normal in efx_ef10_filter_sync_rx_mode")
      Signed-off-by: NBert Kenward <bkenward@solarflare.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c70d6815
    • D
      Merge branch 'net-doc-fixes' · 07b8a7cf
      David S. Miller 提交于
      Stephen Hemminger says:
      
      ====================
      minor net kernel-doc fixes
      
      Fix a couple of small errors in kernel-doc for networking
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      07b8a7cf
    • S
      datagram: fix kernel-doc comments · d3f6cd9e
      stephen hemminger 提交于
      An underscore in the kernel-doc comment section has special meaning
      and mis-use generates an errors.
      
      ./net/core/datagram.c:207: ERROR: Unknown target name: "msg".
      ./net/core/datagram.c:379: ERROR: Unknown target name: "msg".
      ./net/core/datagram.c:816: ERROR: Unknown target name: "t".
      Signed-off-by: NStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d3f6cd9e