1. 21 Feb, 2024 38 commits
  2. 20 Feb, 2024 2 commits
    • Paolo Abeni's avatar
      Merge tag 'linux-can-next-for-6.9-20240220' of... · 49344462
      Paolo Abeni authored
      Merge tag 'linux-can-next-for-6.9-20240220' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next
      
      Marc Kleine-Budde says:
      
      ====================
      pull-request: can-next 2024-02-20
      
      this is a pull request of 9 patches for net-next/master.
      
      The first patch is by Francesco Dolcini and removes a redundant check
      for pm_clock_support from the m_can driver.
      
      Martin Hundebøll contributes 3 patches to the m_can/tcan4x5x driver to
      allow resume upon RX of a CAN frame.
      
      3 patches by Srinivas Goud add support for ECC statistics to the
      xilinx_can driver.
      
      The last 2 patches are by Oliver Hartkopp and me, target the CAN RAW
      protocol and fix an error in the getsockopt() for CAN-XL introduced in
      the previous pull request to net-next (linux-can-next-for-6.9-20240213).
      
      linux-can-next-for-6.9-20240220
      
      * tag 'linux-can-next-for-6.9-20240220' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next:
        can: raw: raw_getsockopt(): reduce scope of err
        can: raw: fix getsockopt() for new CAN_RAW_XL_VCID_OPTS
        can: xilinx_can: Add ethtool stats interface for ECC errors
        can: xilinx_can: Add ECC support
        dt-bindings: can: xilinx_can: Add 'xlnx,has-ecc' optional property
        can: tcan4x5x: support resuming from rx interrupt signal
        can: m_can: allow keeping the transceiver running in suspend
        dt-bindings: can: tcan4x5x: Document the wakeup-source flag
        can: m_can: remove redundant check for pm_clock_support
      ====================
      
      Link: https://lore.kernel.org/r/20240220085130.2936533-1-mkl@pengutronix.deSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      49344462
    • Florian Westphal's avatar
      net: skbuff: add overflow debug check to pull/push helpers · 219eee9c
      Florian Westphal authored
      syzbot managed to trigger following splat:
      BUG: KASAN: use-after-free in __skb_flow_dissect+0x4a3b/0x5e50
      Read of size 1 at addr ffff888208a4000e by task a.out/2313
      [..]
        __skb_flow_dissect+0x4a3b/0x5e50
        __skb_get_hash+0xb4/0x400
        ip_tunnel_xmit+0x77e/0x26f0
        ipip_tunnel_xmit+0x298/0x410
        ..
      
      Analysis shows that the skb has a valid ->head, but bogus ->data
      pointer.
      
      skb->data gets its bogus value via the neigh layer, which does:
      
      1556    __skb_pull(skb, skb_network_offset(skb));
      
      ... and the skb was already dodgy at this point:
      
      skb_network_offset(skb) returns a negative value due to an
      earlier overflow of skb->network_header (u16).  __skb_pull thus
      "adjusts" skb->data by a huge offset, pointing outside skb->head
      area.
      
      Allow debug builds to splat when we try to pull/push more than
      INT_MAX bytes.
      
      After this, the syzkaller reproducer yields a more precise splat
      before the flow dissector attempts to read off skb->data memory:
      
      WARNING: CPU: 5 PID: 2313 at include/linux/skbuff.h:2653 neigh_connected_output+0x28e/0x400
        ip_finish_output2+0xb25/0xed0
        iptunnel_xmit+0x4ff/0x870
        ipgre_xmit+0x78e/0xbb0
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Reviewed-by: default avatarSimon Horman <horms@kernel.org>
      Link: https://lore.kernel.org/r/20240216113700.23013-1-fw@strlen.deSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      219eee9c