1. 27 Jul, 2020 2 commits
  2. 26 Jul, 2020 1 commit
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · a57066b1
      David S. Miller authored
      The UDP reuseport conflict was a little bit tricky.
      
      The net-next code, via bpf-next, extracted the reuseport handling
      into a helper so that the BPF sk lookup code could invoke it.
      
      At the same time, the logic for reuseport handling of unconnected
      sockets changed via commit efc6b6f6
      which changed the logic to carry on the reuseport result into the
      rest of the lookup loop if we do not return immediately.
      
      This requires moving the reuseport_has_conns() logic into the callers.
      
      While we are here, get rid of inline directives as they do not belong
      in foo.c files.
      
      The other changes were cases of more straightforward overlapping
      modifications.
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a57066b1
  3. 25 Jul, 2020 37 commits
    • Linus Torvalds's avatar
      Merge tag 'riscv-for-linus-5.8-rc7' of... · 04300d66
      Linus Torvalds authored
      Merge tag 'riscv-for-linus-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux into master
      
      Pull RISC-V fixes from Palmer Dabbelt:
       "A few more fixes this week:
      
         - A fix to avoid using SBI calls during kasan initialization, as the
           SBI calls themselves have not been probed yet.
      
         - Three fixes related to systems with multiple memory regions"
      
      * tag 'riscv-for-linus-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
        riscv: Parse all memory blocks to remove unusable memory
        RISC-V: Do not rely on initrd_start/end computed during early dt parsing
        RISC-V: Set maximum number of mapped pages correctly
        riscv: kasan: use local_tlb_flush_all() to avoid uninitialized __sbi_rfence
      04300d66
    • Linus Torvalds's avatar
      Merge tag 'x86-urgent-2020-07-25' of... · fbe0d451
      Linus Torvalds authored
      Merge tag 'x86-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull x86 fixes from Ingo Molnar:
       "Misc fixes:
      
         - Fix a section end page alignment assumption that was causing
           crashes
      
         - Fix ORC unwinding on freshly forked tasks which haven't executed
           yet and which have empty user task stacks
      
         - Fix the debug.exception-trace=1 sysctl dumping of user stacks,
           which was broken by recent maccess changes"
      
      * tag 'x86-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/dumpstack: Dump user space code correctly again
        x86/stacktrace: Fix reliable check for empty user task stacks
        x86/unwind/orc: Fix ORC for newly forked tasks
        x86, vmlinux.lds: Page-align end of ..page_aligned sections
      fbe0d451
    • Linus Torvalds's avatar
      Merge tag 'perf-urgent-2020-07-25' of... · 78b1afe2
      Linus Torvalds authored
      Merge tag 'perf-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull uprobe fix from Ingo Molnar:
       "Fix an interaction/regression between uprobes based shared library
        tracing & GDB"
      
      * tag 'perf-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression
      78b1afe2
    • Linus Torvalds's avatar
      Merge tag 'timers-urgent-2020-07-25' of... · a7b36c2b
      Linus Torvalds authored
      Merge tag 'timers-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull timer fix from Ingo Molnar:
       "Fix a suspend/resume regression (crash) on TI AM3/AM4 SoC's"
      
      * tag 'timers-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        clocksource/drivers/timer-ti-dm: Fix suspend and resume for am3 and am4
      a7b36c2b
    • Linus Torvalds's avatar
      Merge tag 'sched-urgent-2020-07-25' of... · 3077805e
      Linus Torvalds authored
      Merge tag 'sched-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull scheduler fixes from Ingo Molnar:
       "Fix a race introduced by the recent loadavg race fix, plus add a debug
        check for a hard to debug case of bogus wakeup function flags"
      
      * tag 'sched-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched: Warn if garbage is passed to default_wake_function()
        sched: Fix race against ptrace_freeze_trace()
      3077805e
    • Linus Torvalds's avatar
      Merge tag 'efi-urgent-2020-07-25' of... · 17baa442
      Linus Torvalds authored
      Merge tag 'efi-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull EFI fixes from Ingo Molnar:
       "Various EFI fixes:
      
         - Fix the layering violation in the use of the EFI runtime services
           availability mask in users of the 'efivars' abstraction
      
         - Revert build fix for GCC v4.8 which is no longer supported
      
         - Clean up some x86 EFI stub details, some of which are borderline
           bugs that copy around garbage into padding fields - let's fix these
           out of caution.
      
         - Fix build issues while working on RISC-V support
      
         - Avoid --whole-archive when linking the stub on arm64"
      
      * tag 'efi-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        efi: Revert "efi/x86: Fix build with gcc 4"
        efi/efivars: Expose RT service availability via efivars abstraction
        efi/libstub: Move the function prototypes to header file
        efi/libstub: Fix gcc error around __umoddi3 for 32 bit builds
        efi/libstub/arm64: link stub lib.a conditionally
        efi/x86: Only copy upto the end of setup_header
        efi/x86: Remove unused variables
      17baa442
    • Linus Torvalds's avatar
      Merge tag '5.8-rc6-cifs-fix' of git://git.samba.org/sfrench/cifs-2.6 into master · 7cb3a5c5
      Linus Torvalds authored
      Pull cifs fix from Steve French:
       "A fix for a recently discovered regression in rename to older servers
        caused by a recent patch"
      
      * tag '5.8-rc6-cifs-fix' of git://git.samba.org/sfrench/cifs-2.6:
        Revert "cifs: Fix the target file was deleted when rename failed."
      7cb3a5c5
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net into master · 1b64b2e2
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix RCU locaking in iwlwifi, from Johannes Berg.
      
       2) mt76 can access uninitialized NAPI struct, from Felix Fietkau.
      
       3) Fix race in updating pause settings in bnxt_en, from Vasundhara
          Volam.
      
       4) Propagate error return properly during unbind failures in ax88172a,
          from George Kennedy.
      
       5) Fix memleak in adf7242_probe, from Liu Jian.
      
       6) smc_drv_probe() can leak, from Wang Hai.
      
       7) Don't muck with the carrier state if register_netdevice() fails in
          the bonding driver, from Taehee Yoo.
      
       8) Fix memleak in dpaa_eth_probe, from Liu Jian.
      
       9) Need to check skb_put_padto() return value in hsr_fill_tag(), from
          Murali Karicheri.
      
      10) Don't lose ionic RSS hash settings across FW update, from Shannon
          Nelson.
      
      11) Fix clobbered SKB control block in act_ct, from Wen Xu.
      
      12) Missing newlink in "tx_timeout" sysfs output, from Xiongfeng Wang.
      
      13) IS_UDPLITE cleanup a long time ago, incorrectly handled
          transformations involving UDPLITE_RECV_CC. From Miaohe Lin.
      
      14) Unbalanced locking in netdevsim, from Taehee Yoo.
      
      15) Suppress false-positive error messages in qed driver, from Alexander
          Lobakin.
      
      16) Out of bounds read in ax25_connect and ax25_sendmsg, from Peilin Ye.
      
      17) Missing SKB release in cxgb4's uld_send(), from Navid Emamdoost.
      
      18) Uninitialized value in geneve_changelink(), from Cong Wang.
      
      19) Fix deadlock in xen-netfront, from Andera Righi.
      
      19) flush_backlog() frees skbs with IRQs disabled, so should use
          dev_kfree_skb_irq() instead of kfree_skb(). From Subash Abhinov
          Kasiviswanathan.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (111 commits)
        drivers/net/wan: lapb: Corrected the usage of skb_cow
        dev: Defer free of skbs in flush_backlog
        qrtr: orphan socket in qrtr_release()
        xen-netfront: fix potential deadlock in xennet_remove()
        flow_offload: Move rhashtable inclusion to the source file
        geneve: fix an uninitialized value in geneve_changelink()
        bonding: check return value of register_netdevice() in bond_newlink()
        tcp: allow at most one TLP probe per flight
        AX.25: Prevent integer overflows in connect and sendmsg
        cxgb4: add missing release on skb in uld_send()
        net: atlantic: fix PTP on AQC10X
        AX.25: Prevent out-of-bounds read in ax25_sendmsg()
        sctp: shrink stream outq when fails to do addstream reconf
        sctp: shrink stream outq only when new outcnt < old outcnt
        AX.25: Fix out-of-bounds read in ax25_connect()
        enetc: Remove the mdio bus on PF probe bailout
        net: ethernet: ti: add NETIF_F_HW_TC hw feature flag for taprio offload
        net: ethernet: ave: Fix error returns in ave_init
        drivers/net/wan/x25_asy: Fix to make it work
        ipvs: fix the connection sync failed in some cases
        ...
      1b64b2e2
    • Atish Patra's avatar
      riscv: Parse all memory blocks to remove unusable memory · fa5a1983
      Atish Patra authored
      Currently, maximum physical memory allowed is equal to -PAGE_OFFSET.
      That's why we remove any memory blocks spanning beyond that size. However,
      it is done only for memblock containing linux kernel which will not work
      if there are multiple memblocks.
      
      Process all memory blocks to figure out how much memory needs to be removed
      and remove at the end instead of updating the memblock list in place.
      Signed-off-by: default avatarAtish Patra <atish.patra@wdc.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      fa5a1983
    • Atish Patra's avatar
      RISC-V: Do not rely on initrd_start/end computed during early dt parsing · 4400231c
      Atish Patra authored
      Currently, initrd_start/end are computed during early_init_dt_scan
      but used during arch_setup. We will get the following panic if initrd is used
      and CONFIG_DEBUG_VIRTUAL is turned on.
      
      [    0.000000] ------------[ cut here ]------------
      [    0.000000] kernel BUG at arch/riscv/mm/physaddr.c:33!
      [    0.000000] Kernel BUG [#1]
      [    0.000000] Modules linked in:
      [    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.8.0-rc4-00015-ged0b226fed02 #886
      [    0.000000] epc: ffffffe0002058d2 ra : ffffffe0000053f0 sp : ffffffe001001f40
      [    0.000000]  gp : ffffffe00106e250 tp : ffffffe001009d40 t0 : ffffffe00107ee28
      [    0.000000]  t1 : 0000000000000000 t2 : ffffffe000a2e880 s0 : ffffffe001001f50
      [    0.000000]  s1 : ffffffe0001383e8 a0 : ffffffe00c087e00 a1 : 0000000080200000
      [    0.000000]  a2 : 00000000010bf000 a3 : ffffffe00106f3c8 a4 : ffffffe0010bf000
      [    0.000000]  a5 : ffffffe000000000 a6 : 0000000000000006 a7 : 0000000000000001
      [    0.000000]  s2 : ffffffe00106f068 s3 : ffffffe00106f070 s4 : 0000000080200000
      [    0.000000]  s5 : 0000000082200000 s6 : 0000000000000000 s7 : 0000000000000000
      [    0.000000]  s8 : 0000000080011010 s9 : 0000000080012700 s10: 0000000000000000
      [    0.000000]  s11: 0000000000000000 t3 : 000000000001fe30 t4 : 000000000001fe30
      [    0.000000]  t5 : 0000000000000000 t6 : ffffffe00107c471
      [    0.000000] status: 0000000000000100 badaddr: 0000000000000000 cause: 0000000000000003
      [    0.000000] random: get_random_bytes called from print_oops_end_marker+0x22/0x46 with crng_init=0
      
      To avoid the error, initrd_start/end can be computed from phys_initrd_start/size
      in setup itself. It also improves the initrd placement by aligning the start
      and size with the page size.
      
      Fixes: 76d2a049 ("RISC-V: Init and Halt Code")
      Signed-off-by: default avatarAtish Patra <atish.patra@wdc.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      4400231c
    • Xie He's avatar
      drivers/net/wan: lapb: Corrected the usage of skb_cow · 8754e137
      Xie He authored
      This patch fixed 2 issues with the usage of skb_cow in LAPB drivers
      "lapbether" and "hdlc_x25":
      
      1) After skb_cow fails, kfree_skb should be called to drop a reference
      to the skb. But in both drivers, kfree_skb is not called.
      
      2) skb_cow should be called before skb_push so that is can ensure the
      safety of skb_push. But in "lapbether", it is incorrectly called after
      skb_push.
      
      More details about these 2 issues:
      
      1) The behavior of calling kfree_skb on failure is also the behavior of
      netif_rx, which is called by this function with "return netif_rx(skb);".
      So this function should follow this behavior, too.
      
      2) In "lapbether", skb_cow is called after skb_push. This results in 2
      logical issues:
         a) skb_push is not protected by skb_cow;
         b) An extra headroom of 1 byte is ensured after skb_push. This extra
            headroom has no use in this function. It also has no use in the
            upper-layer function that this function passes the skb to
            (x25_lapb_receive_frame in net/x25/x25_dev.c).
      So logically skb_cow should instead be called before skb_push.
      
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Martin Schiller <ms@dev.tdt.de>
      Signed-off-by: default avatarXie He <xie.he.0141@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8754e137
    • David S. Miller's avatar
      Merge branch 'net-dsa-mv88e6xxx-port-mtu-support' · dfecd3e0
      David S. Miller authored
      Chris Packham says:
      
      ====================
      net: dsa: mv88e6xxx: port mtu support
      
      This series connects up the mv88e6xxx switches to the dsa infrastructure for
      configuring the port MTU. The first patch is also a bug fix which might be a
      candiatate for stable.
      
      I've rebased this series on top of net-next/master to pick up Andrew's change
      for the gigabit switches. Patch 1 and 2 are unchanged (aside from adding
      Andrew's Reviewed-by). Patch 3 is reworked to make use of the existing mtu
      support.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dfecd3e0
    • Chris Packham's avatar
      net: dsa: mv88e6xxx: Use chip-wide max frame size for MTU · 1baf0fac
      Chris Packham authored
      Some of the chips in the mv88e6xxx family don't support jumbo
      configuration per port. But they do have a chip-wide max frame size that
      can be used. Use this to approximate the behaviour of configuring a port
      based MTU.
      Signed-off-by: default avatarChris Packham <chris.packham@alliedtelesis.co.nz>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1baf0fac
    • Chris Packham's avatar
      net: dsa: mv88e6xxx: Support jumbo configuration on 6190/6190X · e8b34c67
      Chris Packham authored
      The MV88E6190 and MV88E6190X both support per port jumbo configuration
      just like the other GE switches. Install the appropriate ops.
      Signed-off-by: default avatarChris Packham <chris.packham@alliedtelesis.co.nz>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e8b34c67
    • Chris Packham's avatar
      net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration · 0f3c66a3
      Chris Packham authored
      The MV88E6097 chip does not support configuring jumbo frames. Prior to
      commit 5f436666 only the 6352, 6351, 6165 and 6320 chips configured
      jumbo mode. The refactor accidentally added the function for the 6097.
      Remove the erroneous function pointer assignment.
      
      Fixes: 5f436666 ("net: dsa: mv88e6xxx: Refactor setting of jumbo frames")
      Signed-off-by: default avatarChris Packham <chris.packham@alliedtelesis.co.nz>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0f3c66a3
    • Subash Abhinov Kasiviswanathan's avatar
      dev: Defer free of skbs in flush_backlog · 7df5cb75
      Subash Abhinov Kasiviswanathan authored
      IRQs are disabled when freeing skbs in input queue.
      Use the IRQ safe variant to free skbs here.
      
      Fixes: 145dd5f9 ("net: flush the softnet backlog in process context")
      Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7df5cb75
    • Atish Patra's avatar
      RISC-V: Set maximum number of mapped pages correctly · d0d8aae6
      Atish Patra authored
      Currently, maximum number of mapper pages are set to the pfn calculated
      from the memblock size of the memblock containing kernel. This will work
      until that memblock spans the entire memory. However, it will be set to
      a wrong value if there are multiple memblocks defined in kernel
      (e.g. with efi runtime services).
      
      Set the the maximum value to the pfn calculated from dram size.
      Signed-off-by: default avatarAtish Patra <atish.patra@wdc.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      d0d8aae6
    • Linus Torvalds's avatar
      Merge tag 'pci-v5.8-fixes-2' of... · 23ee3e4e
      Linus Torvalds authored
      Merge tag 'pci-v5.8-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci into master
      
      Pull PCI fixes from Bjorn Helgaas:
      
       - Reject invalid IRQ 0 command line argument for virtio_mmio because
         IRQ 0 now generates warnings (Bjorn Helgaas)
      
       - Revert "PCI/PM: Assume ports without DLL Link Active train links in
         100 ms", which broke nouveau (Bjorn Helgaas)
      
      * tag 'pci-v5.8-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        Revert "PCI/PM: Assume ports without DLL Link Active train links in 100 ms"
        virtio-mmio: Reject invalid IRQ 0 command line argument
      23ee3e4e
    • Cong Wang's avatar
      qrtr: orphan socket in qrtr_release() · af9f691f
      Cong Wang authored
      We have to detach sock from socket in qrtr_release(),
      otherwise skb->sk may still reference to this socket
      when the skb is released in tun->queue, particularly
      sk->sk_wq still points to &sock->wq, which leads to
      a UAF.
      
      Reported-and-tested-by: syzbot+6720d64f31c081c2f708@syzkaller.appspotmail.com
      Fixes: 28fb4e59 ("net: qrtr: Expose tunneling endpoint to user space")
      Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
      Cc: Eric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      af9f691f
    • Wang Hai's avatar
      net: hix5hd2_gmac: Remove unneeded cast from memory allocation · 9b964f16
      Wang Hai authored
      Remove casting the values returned by memory allocation function.
      
      Coccinelle emits WARNING:
      
      ./drivers/net/ethernet/hisilicon/hix5hd2_gmac.c:1027:9-23: WARNING:
       casting value returned by memory allocation function to (struct sg_desc *) is useless.
      
      This issue was detected by using the Coccinelle software.
      Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9b964f16
    • David S. Miller's avatar
      Merge tag 'wireless-drivers-2020-07-24' of... · 657237f5
      David S. Miller authored
      Merge tag 'wireless-drivers-2020-07-24' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
      
      Kalle Valo says:
      
      ====================
      wireless-drivers fixes for v5.8
      
      Second set of fixes for v5.8, and hopefully also the last. Three
      important regressions fixed.
      
      ath9k
      
      * fix a regression which broke support for all ath9k usb devices
      
      ath10k
      
      * fix a regression which broke support for all QCA4019 AHB devices
      
      iwlwifi
      
      * fix a regression which broke support for some Killer Wireless-AC 1550 cards
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      657237f5
    • David S. Miller's avatar
      Merge branch 'l2tp-avoid-multiple-assignment-remove-BUG_ON' · a8cf7d03
      David S. Miller authored
      Tom Parkin says:
      
      ====================
      l2tp: avoid multiple assignment, remove BUG_ON
      
      l2tp hasn't been kept up to date with the static analysis checks offered
      by checkpatch.pl.
      
      This patchset builds on the series: "l2tp: cleanup checkpatch.pl
      warnings" and "l2tp: further checkpatch.pl cleanups" to resolve some of
      the remaining checkpatch warnings in l2tp.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a8cf7d03
    • Tom Parkin's avatar
      l2tp: WARN_ON rather than BUG_ON in l2tp_session_free · ab6934e0
      Tom Parkin authored
      l2tp_session_free called BUG_ON if the tunnel magic feather value wasn't
      correct.  The intent of this was to catch lifetime bugs; for example
      early tunnel free due to incorrect use of reference counts.
      
      Since the tunnel magic feather being wrong indicates either early free
      or structure corruption, we can avoid doing more damage by simply
      leaving the tunnel structure alone.  If the tunnel refcount isn't
      dropped when it should be, the tunnel instance will remain in the
      kernel, resulting in the tunnel structure and socket leaking.
      Signed-off-by: default avatarTom Parkin <tparkin@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ab6934e0
    • Tom Parkin's avatar
      l2tp: remove BUG_ON refcount value in l2tp_session_free · 0dd62f69
      Tom Parkin authored
      l2tp_session_free is only called by l2tp_session_dec_refcount when the
      reference count reaches zero, so it's of limited value to validate the
      reference count value in l2tp_session_free itself.
      Signed-off-by: default avatarTom Parkin <tparkin@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0dd62f69
    • Tom Parkin's avatar
      l2tp: WARN_ON rather than BUG_ON in l2tp_session_queue_purge · 493048f5
      Tom Parkin authored
      l2tp_session_queue_purge is used during session shutdown to drop any
      skbs queued for reordering purposes according to L2TP dataplane rules.
      
      The BUG_ON in this function checks the session magic feather in an
      attempt to catch lifetime bugs.
      
      Rather than crashing the kernel with a BUG_ON, we can simply WARN_ON and
      refuse to do anything more -- in the worst case this could result in a
      leak.  However this is highly unlikely given that the session purge only
      occurs from codepaths which have obtained the session by means of a lookup
      via. the parent tunnel and which check the session "dead" flag to
      protect against shutdown races.
      
      While we're here, have l2tp_session_queue_purge return void rather than
      an integer, since neither of the callsites checked the return value.
      Signed-off-by: default avatarTom Parkin <tparkin@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      493048f5
    • Tom Parkin's avatar
      l2tp: don't BUG_ON seqfile checks in l2tp_ppp · ebb4f5e6
      Tom Parkin authored
      checkpatch advises that WARN_ON and recovery code are preferred over
      BUG_ON which crashes the kernel.
      
      l2tp_ppp has a BUG_ON check of struct seq_file's private pointer in
      pppol2tp_seq_start prior to accessing data through that pointer.
      
      Rather than crashing, we can simply bail out early and return NULL in
      order to terminate the seq file processing in much the same way as we do
      when reaching the end of tunnel/session instances to render.
      
      Retain a WARN_ON to help trace possible bugs in this area.
      Signed-off-by: default avatarTom Parkin <tparkin@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ebb4f5e6
    • Tom Parkin's avatar
      l2tp: don't BUG_ON session magic checks in l2tp_ppp · 1aa646ac
      Tom Parkin authored
      checkpatch advises that WARN_ON and recovery code are preferred over
      BUG_ON which crashes the kernel.
      
      l2tp_ppp.c's BUG_ON checks of the l2tp session structure's "magic" field
      occur in code paths where it's reasonably easy to recover:
      
       * In the case of pppol2tp_sock_to_session, we can return NULL and the
         caller will bail out appropriately.  There is no change required to
         any of the callsites of this function since they already handle
         pppol2tp_sock_to_session returning NULL.
      
       * In the case of pppol2tp_session_destruct we can just avoid
         decrementing the reference count on the suspect session structure.
         In the worst case scenario this results in a memory leak, which is
         preferable to a crash.
      
      Convert these uses of BUG_ON to WARN_ON accordingly.
      Signed-off-by: default avatarTom Parkin <tparkin@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1aa646ac
    • Tom Parkin's avatar
      l2tp: remove BUG_ON in l2tp_tunnel_closeall · cd3e29b3
      Tom Parkin authored
      l2tp_tunnel_closeall is only called from l2tp_core.c, and it's easy
      to statically analyse the code path calling it to validate that it
      should never be passed a NULL tunnel pointer.
      
      Having a BUG_ON checking the tunnel pointer triggers a checkpatch
      warning.  Since the BUG_ON is of no value, remove it to avoid the
      warning.
      Signed-off-by: default avatarTom Parkin <tparkin@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cd3e29b3
    • Tom Parkin's avatar
      l2tp: remove BUG_ON in l2tp_session_queue_purge · ce2f86ae
      Tom Parkin authored
      l2tp_session_queue_purge is only called from l2tp_core.c, and it's easy
      to statically analyse the code paths calling it to validate that it
      should never be passed a NULL session pointer.
      
      Having a BUG_ON checking the session pointer triggers a checkpatch
      warning.  Since the BUG_ON is of no value, remove it to avoid the
      warning.
      Signed-off-by: default avatarTom Parkin <tparkin@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ce2f86ae
    • Tom Parkin's avatar
      l2tp: WARN_ON rather than BUG_ON in l2tp_dfs_seq_start · 7a379558
      Tom Parkin authored
      l2tp_dfs_seq_start had a BUG_ON to catch a possible programming error in
      l2tp_dfs_seq_open.
      
      Since we can easily bail out of l2tp_dfs_seq_start, prefer to do that
      and flag the error with a WARN_ON rather than crashing the kernel.
      Signed-off-by: default avatarTom Parkin <tparkin@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7a379558
    • Tom Parkin's avatar
      l2tp: avoid multiple assignments · 95075150
      Tom Parkin authored
      checkpatch warns about multiple assignments.
      
      Update l2tp accordingly.
      Signed-off-by: default avatarTom Parkin <tparkin@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      95075150
    • David S. Miller's avatar
      Merge branch 'icmp6-support-rfc-4884' · fb92f57b
      David S. Miller authored
      Willem de Bruijn says:
      
      ====================
      icmp6: support rfc 4884
      
      Extend the feature merged earlier this week for IPv4 to IPv6.
      
      I expected this to be a single patch, but patch 1 seemed better to be
      stand-alone
      
      patch 1: small fix in length calculation
      patch 2: factor out ipv4-specific
      patch 3: add ipv6
      
      changes v1->v2: add missing static keyword in patch 3
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fb92f57b
    • Willem de Bruijn's avatar
      icmp6: support rfc 4884 · 01370434
      Willem de Bruijn authored
      Extend the rfc 4884 read interface introduced for ipv4 in
      commit eba75c58 ("icmp: support rfc 4884") to ipv6.
      
      Add socket option SOL_IPV6/IPV6_RECVERR_RFC4884.
      
      Changes v1->v2:
        - make ipv6_icmp_error_rfc4884 static (file scope)
      Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      01370434
    • Willem de Bruijn's avatar
      icmp: prepare rfc 4884 for ipv6 · 178c49d9
      Willem de Bruijn authored
      The RFC 4884 spec is largely the same between IPv4 and IPv6.
      Factor out the IPv4 specific parts in preparation for IPv6 support:
      
      - icmp types supported
      
      - icmp header size, and thus offset to original datagram start
      
      - datagram length field offset in icmp(6)hdr.
      
      - datagram length field word size: 4B for IPv4, 8B for IPv6.
      Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      178c49d9
    • Willem de Bruijn's avatar
      icmp: revise rfc4884 tests · c4e9e09f
      Willem de Bruijn authored
      1) Only accept packets with original datagram len field >= header len.
      
      The extension header must start after the original datagram headers.
      The embedded datagram len field is compared against the 128B minimum
      stipulated by RFC 4884. It is unlikely that headers extend beyond
      this. But as we know the exact header length, check explicitly.
      
      2) Remove the check that datagram length must be <= 576B.
      
      This is a send constraint. There is no value in testing this on rx.
      Within private networks it may be known safe to send larger packets.
      Process these packets.
      
      This test was also too lax. It compared original datagram length
      rather than entire icmp packet length. The stand-alone fix would be:
      
        -       if (hlen + skb->len > 576)
        +       if (-skb_network_offset(skb) + skb->len > 576)
      
      Fixes: eba75c58 ("icmp: support rfc 4884")
      Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c4e9e09f
    • Colin Ian King's avatar
      sctp: remove redundant initialization of variable status · 623b57be
      Colin Ian King authored
      The variable status is being initialized with a value that is never read
      and it is being updated later with a new value.  The initialization is
      redundant and can be removed.  Also put the variable declarations into
      reverse christmas tree order.
      
      Addresses-Coverity: ("Unused value")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      623b57be
    • Andrea Righi's avatar
      xen-netfront: fix potential deadlock in xennet_remove() · c2c63310
      Andrea Righi authored
      There's a potential race in xennet_remove(); this is what the driver is
      doing upon unregistering a network device:
      
        1. state = read bus state
        2. if state is not "Closed":
        3.    request to set state to "Closing"
        4.    wait for state to be set to "Closing"
        5.    request to set state to "Closed"
        6.    wait for state to be set to "Closed"
      
      If the state changes to "Closed" immediately after step 1 we are stuck
      forever in step 4, because the state will never go back from "Closed" to
      "Closing".
      
      Make sure to check also for state == "Closed" in step 4 to prevent the
      deadlock.
      
      Also add a 5 sec timeout any time we wait for the bus state to change,
      to avoid getting stuck forever in wait_event().
      Signed-off-by: default avatarAndrea Righi <andrea.righi@canonical.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c2c63310