1. 28 Feb, 2018 4 commits
    • Arnd Bergmann's avatar
      cfg80211: fix cfg80211_beacon_dup · 3b4dd8ac
      Arnd Bergmann authored
      commit bee92d06 upstream.
      
      gcc-8 warns about some obviously incorrect code:
      
      net/mac80211/cfg.c: In function 'cfg80211_beacon_dup':
      net/mac80211/cfg.c:2896:3: error: 'memcpy' source argument is the same as destination [-Werror=restrict]
      
      From the context, I conclude that we want to copy from beacon into
      new_beacon, as we do in the rest of the function.
      
      Cc: stable@vger.kernel.org
      Fixes: 73da7d5b ("mac80211: add channel switch command and beacon callbacks")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      3b4dd8ac
    • Tyrel Datwyler's avatar
      scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info · bed7cb31
      Tyrel Datwyler authored
      commit c3981365 upstream.
      
      The fcp_rsp_info structure as defined in the FC spec has an initial 3
      bytes reserved field. The ibmvfc driver mistakenly defined this field as
      4 bytes resulting in the rsp_code field being defined in what should be
      the start of the second reserved field and thus always being reported as
      zero by the driver.
      
      Ideally, we should wire ibmvfc up with libfc for the sake of code
      deduplication, and ease of maintaining standardized structures in a
      single place. However, for now simply fixup the definition in ibmvfc for
      backporting to distros on older kernels. Wiring up with libfc will be
      done in a followup patch.
      
      Cc: <stable@vger.kernel.org>
      Reported-by: default avatarHannes Reinecke <hare@suse.de>
      Signed-off-by: default avatarTyrel Datwyler <tyreld@linux.vnet.ibm.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      bed7cb31
    • Max Filippov's avatar
      xtensa: fix high memory/reserved memory collision · a5ecf56c
      Max Filippov authored
      commit 6ac5a11d upstream.
      
      Xtensa memory initialization code frees high memory pages without
      checking whether they are in the reserved memory regions or not. That
      results in invalid value of totalram_pages and duplicate page usage by
      CMA and highmem. It produces a bunch of BUGs at startup looking like
      this:
      
      BUG: Bad page state in process swapper  pfn:70800
      page:be60c000 count:0 mapcount:-127 mapping:  (null) index:0x1
      flags: 0x80000000()
      raw: 80000000 00000000 00000001 ffffff80 00000000 be60c014 be60c014 0000000a
      page dumped because: nonzero mapcount
      Modules linked in:
      CPU: 0 PID: 1 Comm: swapper Tainted: G    B            4.16.0-rc1-00015-g7928b2cb-dirty #23
      Stack:
       bd839d33 00000000 00000018 ba97b64c a106578c bd839d70 be60c000 00000000
       a1378054 bd86a000 00000003 ba97b64c a1066166 bd839da0 be60c000 ffe00000
       a1066b58 bd839dc0 be504000 00000000 000002f4 bd838000 00000000 0000001e
      Call Trace:
       [<a1065734>] bad_page+0xac/0xd0
       [<a106578c>] free_pages_check_bad+0x34/0x4c
       [<a1066166>] __free_pages_ok+0xae/0x14c
       [<a1066b58>] __free_pages+0x30/0x64
       [<a1365de5>] init_cma_reserved_pageblock+0x35/0x44
       [<a13682dc>] cma_init_reserved_areas+0xf4/0x148
       [<a10034b8>] do_one_initcall+0x80/0xf8
       [<a1361c16>] kernel_init_freeable+0xda/0x13c
       [<a125b59d>] kernel_init+0x9/0xd0
       [<a1004304>] ret_from_kernel_thread+0xc/0x18
      
      Only free high memory pages that are not reserved.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMax Filippov <jcmvbkbc@gmail.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      a5ecf56c
    • Paolo Abeni's avatar
      netfilter: drop outermost socket lock in getsockopt() · d58d78c2
      Paolo Abeni authored
      commit 01ea306f upstream.
      
      The Syzbot reported a possible deadlock in the netfilter area caused by
      rtnl lock, xt lock and socket lock being acquired with a different order
      on different code paths, leading to the following backtrace:
      Reviewed-by: default avatarXin Long <lucien.xin@gmail.com>
      
      ======================================================
      WARNING: possible circular locking dependency detected
      4.15.0+ #301 Not tainted
      ------------------------------------------------------
      syzkaller233489/4179 is trying to acquire lock:
        (rtnl_mutex){+.+.}, at: [<0000000048e996fd>] rtnl_lock+0x17/0x20
      net/core/rtnetlink.c:74
      
      but task is already holding lock:
        (&xt[i].mutex){+.+.}, at: [<00000000328553a2>]
      xt_find_table_lock+0x3e/0x3e0 net/netfilter/x_tables.c:1041
      
      which lock already depends on the new lock.
      ===
      
      Since commit 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock
      only in the required scope"), we already acquire the socket lock in
      the innermost scope, where needed. In such commit I forgot to remove
      the outer-most socket lock from the getsockopt() path, this commit
      addresses the issues dropping it now.
      
      v1 -> v2: fix bad subj, added relavant 'fixes' tag
      
      Fixes: 22265a5c ("netfilter: xt_TEE: resolve oif using netdevice notifiers")
      Fixes: 202f59af ("netfilter: ipt_CLUSTERIP: do not hold dev")
      Fixes: 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock only in the required scope")
      Reported-by: syzbot+ddde1c7b7ff7442d7f2d@syzkaller.appspotmail.com
      Suggested-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Tested-by: default avatarKrzysztof Piotr Oledzki <ole@ans.pl>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d58d78c2
  2. 25 Feb, 2018 36 commits