1. 16 Mar, 2018 12 commits
  2. 15 Mar, 2018 3 commits
    • Neil Horman's avatar
      sctp: Fix double free in sctp_sendmsg_to_asoc · 0aee4c25
      Neil Horman authored
      syzbot/kasan detected a double free in sctp_sendmsg_to_asoc:
      BUG: KASAN: use-after-free in sctp_association_free+0x7b7/0x930
      net/sctp/associola.c:332
      Read of size 8 at addr ffff8801d8006ae0 by task syzkaller914861/4202
      
      CPU: 1 PID: 4202 Comm: syzkaller914861 Not tainted 4.16.0-rc4+ #258
      Hardware name: Google Google Compute Engine/Google Compute Engine
      01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:17 [inline]
       dump_stack+0x194/0x24d lib/dump_stack.c:53
       print_address_description+0x73/0x250 mm/kasan/report.c:256
       kasan_report_error mm/kasan/report.c:354 [inline]
       kasan_report+0x23c/0x360 mm/kasan/report.c:412
       __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
       sctp_association_free+0x7b7/0x930 net/sctp/associola.c:332
       sctp_sendmsg+0xc67/0x1a80 net/sctp/socket.c:2075
       inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:763
       sock_sendmsg_nosec net/socket.c:629 [inline]
       sock_sendmsg+0xca/0x110 net/socket.c:639
       SYSC_sendto+0x361/0x5c0 net/socket.c:1748
       SyS_sendto+0x40/0x50 net/socket.c:1716
       do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
       entry_SYSCALL_64_after_hwframe+0x42/0xb7
      
      This was introduced by commit:
      f84af331 sctp: factor out sctp_sendmsg_to_asoc from sctp_sendmsg
      
      As the newly refactored function moved the wait_for_sndbuf call to a
      point after the association was connected, allowing for peeloff events
      to occur, which in turn caused wait_for_sndbuf to return -EPIPE which
      was not caught by the logic that determines if an association should be
      freed or not.
      
      Fix it the easy way by returning the ordering of
      sctp_primitive_ASSOCIATE and sctp_wait_for_sndbuf to the old order, to
      ensure that EPIPE will not happen.
      
      Tested by myself using the syzbot reproducers with positive results
      Signed-off-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      CC: davem@davemloft.net
      CC: Xin Long <lucien.xin@gmail.com>
      Reported-by: syzbot+a4e4112c3aff00c8cfd8@syzkaller.appspotmail.com
      Reviewed-by: default avatarXin Long <lucien.xin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0aee4c25
    • Joe Perches's avatar
      net: drivers/net: Remove unnecessary skb_copy_expand OOM messages · 0c3d5a96
      Joe Perches authored
      skb_copy_expand without __GFP_NOWARN already does a dump_stack
      on OOM so these messages are redundant.
      Signed-off-by: default avatarJoe Perches <joe@perches.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0c3d5a96
    • David S. Miller's avatar
      Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue · 80d9f3a0
      David S. Miller authored
      Jeff Kirsher says:
      
      ====================
      40GbE Intel Wired LAN Driver Updates 2018-03-14
      
      This series contains updates to i40e and i40evf only.
      
      Corentin Labbe cleans up the left over FCoE files in the i40e driver.
      
      Gustavo A R Silva fixes a cut and paste error.
      
      Paweł fixes a race condition when the VF driver is loaded on a host and
      virsh is trying to attach it to the virtual machine and set a MAC
      address.  Resolve the issue by adding polling in i40e_ndo_set_vf_mac()
      when the VF is in reset mode.
      
      Jake cleans up i40e_vlan_rx_register() since this only used in a single
      location, so just inline the contents of the function.  Created a helper
      function to proper update the per-filter statistics when we delete it.
      Factored out the re-enabling ATR and SB rules.  Fixed an issue when
      re-enabling ATR after the last TCPv4 filter is removed and ntuple is
      still active, we were not restoring the TCPv4 filter input set.
      
      Filip modifies the permission check function to ensure that it knows how
      many filters are being requested, which allows the check to ensure that
      the total number of filters in a single request does not cause us to go
      over the limit.
      
      Mariusz fixed an issue where the wrong calculation of partition id was
      being done on OCP PHY mezzanine cards, which in turn caused wake on LAN
      to be disabled on certain ports.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      80d9f3a0
  3. 14 Mar, 2018 25 commits