1. 31 Jul, 2017 2 commits
  2. 24 Jul, 2017 4 commits
    • Phil Sutter's avatar
      netfilter: nf_tables: Attach process info to NFT_MSG_NEWGEN notifications · 784b4e61
      Phil Sutter authored
      This is helpful for 'nft monitor' to track which process caused a given
      change to the ruleset.
      Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      784b4e61
    • Taehee Yoo's avatar
      netfilter: Remove duplicated rcu_read_lock. · 0b35f603
      Taehee Yoo authored
      This patch removes duplicate rcu_read_lock().
      
      1. IPVS part:
      
      According to Julian Anastasov's mention, contexts of ipvs are described
      at: http://marc.info/?l=netfilter-devel&m=149562884514072&w=2, in summary:
      
       - packet RX/TX: does not need locks because packets come from hooks.
       - sync msg RX: backup server uses RCU locks while registering new
         connections.
       - ip_vs_ctl.c: configuration get/set, RCU locks needed.
       - xt_ipvs.c: It is a netfilter match, running from hook context.
      
      As result, rcu_read_lock and rcu_read_unlock can be removed from:
      
       - ip_vs_core.c: all
       - ip_vs_ctl.c:
         - only from ip_vs_has_real_service
       - ip_vs_ftp.c: all
       - ip_vs_proto_sctp.c: all
       - ip_vs_proto_tcp.c: all
       - ip_vs_proto_udp.c: all
       - ip_vs_xmit.c: all (contains only packet processing)
      
      2. Netfilter part:
      
      There are three types of functions that are guaranteed the rcu_read_lock().
      First, as result, functions are only called by nf_hook():
      
       - nf_conntrack_broadcast_help(), pptp_expectfn(), set_expected_rtp_rtcp().
       - tcpmss_reverse_mtu(), tproxy_laddr4(), tproxy_laddr6().
       - match_lookup_rt6(), check_hlist(), hashlimit_mt_common().
       - xt_osf_match_packet().
      
      Second, functions that caller already held the rcu_read_lock().
       - destroy_conntrack(), ctnetlink_conntrack_event().
       - ctnl_timeout_find_get(), nfqnl_nf_hook_drop().
      
      Third, functions that are mixed with type1 and type2.
      
      These functions are called by nf_hook() also these are called by
      ordinary functions that already held the rcu_read_lock():
      
       - __ctnetlink_glue_build(), ctnetlink_expect_event().
       - ctnetlink_proto_size().
      
      Applied files are below:
      
      - nf_conntrack_broadcast.c, nf_conntrack_core.c, nf_conntrack_netlink.c.
      - nf_conntrack_pptp.c, nf_conntrack_sip.c, nfnetlink_cttimeout.c.
      - nfnetlink_queue.c, xt_TCPMSS.c, xt_TPROXY.c, xt_addrtype.c.
      - xt_connlimit.c, xt_hashlimit.c, xt_osf.c
      
      Detailed calltrace can be found at:
      http://marc.info/?l=netfilter-devel&m=149667610710350&w=2Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      0b35f603
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: keep chain counters away from hot path · 9f08ea84
      Pablo Neira Ayuso authored
      These chain counters are only used by the iptables-compat tool, that
      allow users to use the x_tables extensions from the existing nf_tables
      framework. This patch makes nf_tables by ~5% for the general usecase,
      ie. native nft users, where no chain counters are used at all.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      9f08ea84
    • Florian Westphal's avatar
      netfilter: expect: add to hash table after expect init · 56a97e70
      Florian Westphal authored
      assuming we have lockless readers we should make sure they can only
      see expectations that have already been initialized.
      
      hlist_add_head_rcu acts as memory barrier, move it after timer setup.
      
      Theoretically we could crash due to a del_timer() on other cpu
      seeing garbage data.
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      56a97e70
  3. 21 Jul, 2017 1 commit
  4. 20 Jul, 2017 33 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 96080f69
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) BPF verifier signed/unsigned value tracking fix, from Daniel
          Borkmann, Edward Cree, and Josef Bacik.
      
       2) Fix memory allocation length when setting up calls to
          ->ndo_set_mac_address, from Cong Wang.
      
       3) Add a new cxgb4 device ID, from Ganesh Goudar.
      
       4) Fix FIB refcount handling, we have to set it's initial value before
          the configure callback (which can bump it). From David Ahern.
      
       5) Fix double-free in qcom/emac driver, from Timur Tabi.
      
       6) A bunch of gcc-7 string format overflow warning fixes from Arnd
          Bergmann.
      
       7) Fix link level headroom tests in ip_do_fragment(), from Vasily
          Averin.
      
       8) Fix chunk walking in SCTP when iterating over error and parameter
          headers. From Alexander Potapenko.
      
       9) TCP BBR congestion control fixes from Neal Cardwell.
      
      10) Fix SKB fragment handling in bcmgenet driver, from Doug Berger.
      
      11) BPF_CGROUP_RUN_PROG_SOCK_OPS needs to check for null __sk, from Cong
          Wang.
      
      12) xmit_recursion in ppp driver needs to be per-device not per-cpu,
          from Gao Feng.
      
      13) Cannot release skb->dst in UDP if IP options processing needs it.
          From Paolo Abeni.
      
      14) Some netdev ioctl ifr_name[] NULL termination fixes. From Alexander
          Levin and myself.
      
      15) Revert some rtnetlink notification changes that are causing
          regressions, from David Ahern.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (83 commits)
        net: bonding: Fix transmit load balancing in balance-alb mode
        rds: Make sure updates to cp_send_gen can be observed
        net: ethernet: ti: cpsw: Push the request_irq function to the end of probe
        ipv4: initialize fib_trie prior to register_netdev_notifier call.
        rtnetlink: allocate more memory for dev_set_mac_address()
        net: dsa: b53: Add missing ARL entries for BCM53125
        bpf: more tests for mixed signed and unsigned bounds checks
        bpf: add test for mixed signed and unsigned bounds checks
        bpf: fix up test cases with mixed signed/unsigned bounds
        bpf: allow to specify log level and reduce it for test_verifier
        bpf: fix mixed signed/unsigned derived min/max value bounds
        ipv6: avoid overflow of offset in ip6_find_1stfragopt
        net: tehuti: don't process data if it has not been copied from userspace
        Revert "rtnetlink: Do not generate notifications for CHANGEADDR event"
        net: dsa: mv88e6xxx: Enable CMODE config support for 6390X
        dt-binding: ptp: Add SoC compatibility strings for dte ptp clock
        NET: dwmac: Make dwmac reset unconditional
        net: Zero terminate ifr_name in dev_ifname().
        wireless: wext: terminate ifr name coming from userspace
        netfilter: fix netfilter_net_init() return
        ...
      96080f69
    • Kosuke Tatsukawa's avatar
      net: bonding: Fix transmit load balancing in balance-alb mode · cbf5ecb3
      Kosuke Tatsukawa authored
      balance-alb mode used to have transmit dynamic load balancing feature
      enabled by default.  However, transmit dynamic load balancing no longer
      works in balance-alb after commit 8b426dc5 ("bonding: remove
      hardcoded value").
      
      Both balance-tlb and balance-alb use the function bond_do_alb_xmit() to
      send packets.  This function uses the parameter tlb_dynamic_lb.
      tlb_dynamic_lb used to have the default value of 1 for balance-alb, but
      now the value is set to 0 except in balance-tlb.
      
      Re-enable transmit dyanmic load balancing by initializing tlb_dynamic_lb
      for balance-alb similar to balance-tlb.
      
      Fixes: 8b426dc5 ("bonding: remove hardcoded value")
      Signed-off-by: default avatarKosuke Tatsukawa <tatsu@ab.jp.nec.com>
      Acked-by: default avatarAndy Gospodarek <andy@greyhouse.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cbf5ecb3
    • Håkon Bugge's avatar
      rds: Make sure updates to cp_send_gen can be observed · e623a48e
      Håkon Bugge authored
      cp->cp_send_gen is treated as a normal variable, although it may be
      used by different threads.
      
      This is fixed by using {READ,WRITE}_ONCE when it is incremented and
      READ_ONCE when it is read outside the {acquire,release}_in_xmit
      protection.
      
      Normative reference from the Linux-Kernel Memory Model:
      
          Loads from and stores to shared (but non-atomic) variables should
          be protected with the READ_ONCE(), WRITE_ONCE(), and
          ACCESS_ONCE().
      
      Clause 5.1.2.4/25 in the C standard is also relevant.
      Signed-off-by: default avatarHåkon Bugge <haakon.bugge@oracle.com>
      Reviewed-by: default avatarKnut Omang <knut.omang@oracle.com>
      Acked-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e623a48e
    • Ganesh Goudar's avatar
      cxgb4: display serial config and vpd versions · 760446f9
      Ganesh Goudar authored
      print the versions of vpd and serial configuration file,
      flashed to adapter, and cleanup the relevant code.
      Signed-off-by: default avatarCasey Leedom <leedom@chelsio.com>
      Signed-off-by: default avatarGanesh Goudar <ganeshgr@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      760446f9
    • Keerthy's avatar
      net: ethernet: ti: cpsw: Push the request_irq function to the end of probe · 070f9c65
      Keerthy authored
      Push the request_irq function to the end of probe so as
      to ensure all the required fields are populated in the event
      of an ISR getting executed right after requesting the irq.
      
      Currently while loading the crash kernel a crash was seen as
      soon as devm_request_threaded_irq was called. This was due to
      n->poll being NULL which is called as part of net_rx_action
      function.
      Suggested-by: default avatarSekhar Nori <nsekhar@ti.com>
      Signed-off-by: default avatarKeerthy <j-keerthy@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      070f9c65
    • Mahesh Bandewar's avatar
      ipv4: initialize fib_trie prior to register_netdev_notifier call. · 8799a221
      Mahesh Bandewar authored
      Net stack initialization currently initializes fib-trie after the
      first call to netdevice_notifier() call. In fact fib_trie initialization
      needs to happen before first rtnl_register(). It does not cause any problem
      since there are no devices UP at this moment, but trying to bring 'lo'
      UP at initialization would make this assumption wrong and exposes the issue.
      
      Fixes following crash
      
       Call Trace:
        ? alternate_node_alloc+0x76/0xa0
        fib_table_insert+0x1b7/0x4b0
        fib_magic.isra.17+0xea/0x120
        fib_add_ifaddr+0x7b/0x190
        fib_netdev_event+0xc0/0x130
        register_netdevice_notifier+0x1c1/0x1d0
        ip_fib_init+0x72/0x85
        ip_rt_init+0x187/0x1e9
        ip_init+0xe/0x1a
        inet_init+0x171/0x26c
        ? ipv4_offload_init+0x66/0x66
        do_one_initcall+0x43/0x160
        kernel_init_freeable+0x191/0x219
        ? rest_init+0x80/0x80
        kernel_init+0xe/0x150
        ret_from_fork+0x22/0x30
       Code: f6 46 23 04 74 86 4c 89 f7 e8 ae 45 01 00 49 89 c7 4d 85 ff 0f 85 7b ff ff ff 31 db eb 08 4c 89 ff e8 16 47 01 00 48 8b 44 24 38 <45> 8b 6e 14 4d 63 76 74 48 89 04 24 0f 1f 44 00 00 48 83 c4 08
       RIP: kmem_cache_alloc+0xcf/0x1c0 RSP: ffff9b1500017c28
       CR2: 0000000000000014
      
      Fixes: 7b1a74fd ("[NETNS]: Refactor fib initialization so it can handle multiple namespaces.")
      Fixes: 7f9b8052 ("[IPV4]: fib hash|trie initialization")
      Signed-off-by: default avatarMahesh Bandewar <maheshb@google.com>
      Acked-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8799a221
    • WANG Cong's avatar
      rtnetlink: allocate more memory for dev_set_mac_address() · 153711f9
      WANG Cong authored
      virtnet_set_mac_address() interprets mac address as struct
      sockaddr, but upper layer only allocates dev->addr_len
      which is ETH_ALEN + sizeof(sa_family_t) in this case.
      
      We lack a unified definition for mac address, so just fix
      the upper layer, this also allows drivers to interpret it
      to struct sockaddr freely.
      Reported-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      153711f9
    • Florian Fainelli's avatar
      net: dsa: b53: Add missing ARL entries for BCM53125 · be35e8c5
      Florian Fainelli authored
      The BCM53125 entry was missing an arl_entries member which would
      basically prevent the ARL search from terminating properly. This switch
      has 4 ARL entries, so add that.
      
      Fixes: 1da6df85 ("net: dsa: b53: Implement ARL add/del/dump operations")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Reviewed-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      be35e8c5
    • David S. Miller's avatar
      Merge branch 'BPF-map-value-adjust-fix' · 5067f4cf
      David S. Miller authored
      Daniel Borkmann says:
      
      ====================
      BPF map value adjust fix
      
      First patch in the series is the actual fix and the remaining
      patches are just updates to selftests.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5067f4cf
    • Daniel Borkmann's avatar
      bpf: more tests for mixed signed and unsigned bounds checks · 86412502
      Daniel Borkmann authored
      Add a couple of more test cases to BPF selftests that are related
      to mixed signed and unsigned checks.
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      86412502
    • Edward Cree's avatar
      bpf: add test for mixed signed and unsigned bounds checks · b712296a
      Edward Cree authored
      These failed due to a bug in verifier bounds handling.
      Signed-off-by: default avatarEdward Cree <ecree@solarflare.com>
      Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b712296a
    • Daniel Borkmann's avatar
      bpf: fix up test cases with mixed signed/unsigned bounds · a1502132
      Daniel Borkmann authored
      Fix the few existing test cases that used mixed signed/unsigned
      bounds and switch them only to one flavor. Reason why we need this
      is that proper boundaries cannot be derived from mixed tests.
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a1502132
    • Daniel Borkmann's avatar
      bpf: allow to specify log level and reduce it for test_verifier · d6554904
      Daniel Borkmann authored
      For the test_verifier case, it's quite hard to parse log level 2 to
      figure out what's causing an issue when used to log level 1. We do
      want to use bpf_verify_program() in order to simulate some of the
      tests with strict alignment. So just add an argument to pass the level
      and put it to 1 for test_verifier.
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d6554904
    • Daniel Borkmann's avatar
      bpf: fix mixed signed/unsigned derived min/max value bounds · 4cabc5b1
      Daniel Borkmann authored
      Edward reported that there's an issue in min/max value bounds
      tracking when signed and unsigned compares both provide hints
      on limits when having unknown variables. E.g. a program such
      as the following should have been rejected:
      
         0: (7a) *(u64 *)(r10 -8) = 0
         1: (bf) r2 = r10
         2: (07) r2 += -8
         3: (18) r1 = 0xffff8a94cda93400
         5: (85) call bpf_map_lookup_elem#1
         6: (15) if r0 == 0x0 goto pc+7
        R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0 R10=fp
         7: (7a) *(u64 *)(r10 -16) = -8
         8: (79) r1 = *(u64 *)(r10 -16)
         9: (b7) r2 = -1
        10: (2d) if r1 > r2 goto pc+3
        R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0 R1=inv,min_value=0
        R2=imm-1,max_value=18446744073709551615,min_align=1 R10=fp
        11: (65) if r1 s> 0x1 goto pc+2
        R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0 R1=inv,min_value=0,max_value=1
        R2=imm-1,max_value=18446744073709551615,min_align=1 R10=fp
        12: (0f) r0 += r1
        13: (72) *(u8 *)(r0 +0) = 0
        R0=map_value_adj(ks=8,vs=8,id=0),min_value=0,max_value=1 R1=inv,min_value=0,max_value=1
        R2=imm-1,max_value=18446744073709551615,min_align=1 R10=fp
        14: (b7) r0 = 0
        15: (95) exit
      
      What happens is that in the first part ...
      
         8: (79) r1 = *(u64 *)(r10 -16)
         9: (b7) r2 = -1
        10: (2d) if r1 > r2 goto pc+3
      
      ... r1 carries an unsigned value, and is compared as unsigned
      against a register carrying an immediate. Verifier deduces in
      reg_set_min_max() that since the compare is unsigned and operation
      is greater than (>), that in the fall-through/false case, r1's
      minimum bound must be 0 and maximum bound must be r2. Latter is
      larger than the bound and thus max value is reset back to being
      'invalid' aka BPF_REGISTER_MAX_RANGE. Thus, r1 state is now
      'R1=inv,min_value=0'. The subsequent test ...
      
        11: (65) if r1 s> 0x1 goto pc+2
      
      ... is a signed compare of r1 with immediate value 1. Here,
      verifier deduces in reg_set_min_max() that since the compare
      is signed this time and operation is greater than (>), that
      in the fall-through/false case, we can deduce that r1's maximum
      bound must be 1, meaning with prior test, we result in r1 having
      the following state: R1=inv,min_value=0,max_value=1. Given that
      the actual value this holds is -8, the bounds are wrongly deduced.
      When this is being added to r0 which holds the map_value(_adj)
      type, then subsequent store access in above case will go through
      check_mem_access() which invokes check_map_access_adj(), that
      will then probe whether the map memory is in bounds based
      on the min_value and max_value as well as access size since
      the actual unknown value is min_value <= x <= max_value; commit
      fce366a9 ("bpf, verifier: fix alu ops against map_value{,
      _adj} register types") provides some more explanation on the
      semantics.
      
      It's worth to note in this context that in the current code,
      min_value and max_value tracking are used for two things, i)
      dynamic map value access via check_map_access_adj() and since
      commit 06c1c049 ("bpf: allow helpers access to variable memory")
      ii) also enforced at check_helper_mem_access() when passing a
      memory address (pointer to packet, map value, stack) and length
      pair to a helper and the length in this case is an unknown value
      defining an access range through min_value/max_value in that
      case. The min_value/max_value tracking is /not/ used in the
      direct packet access case to track ranges. However, the issue
      also affects case ii), for example, the following crafted program
      based on the same principle must be rejected as well:
      
         0: (b7) r2 = 0
         1: (bf) r3 = r10
         2: (07) r3 += -512
         3: (7a) *(u64 *)(r10 -16) = -8
         4: (79) r4 = *(u64 *)(r10 -16)
         5: (b7) r6 = -1
         6: (2d) if r4 > r6 goto pc+5
        R1=ctx R2=imm0,min_value=0,max_value=0,min_align=2147483648 R3=fp-512
        R4=inv,min_value=0 R6=imm-1,max_value=18446744073709551615,min_align=1 R10=fp
         7: (65) if r4 s> 0x1 goto pc+4
        R1=ctx R2=imm0,min_value=0,max_value=0,min_align=2147483648 R3=fp-512
        R4=inv,min_value=0,max_value=1 R6=imm-1,max_value=18446744073709551615,min_align=1
        R10=fp
         8: (07) r4 += 1
         9: (b7) r5 = 0
        10: (6a) *(u16 *)(r10 -512) = 0
        11: (85) call bpf_skb_load_bytes#26
        12: (b7) r0 = 0
        13: (95) exit
      
      Meaning, while we initialize the max_value stack slot that the
      verifier thinks we access in the [1,2] range, in reality we
      pass -7 as length which is interpreted as u32 in the helper.
      Thus, this issue is relevant also for the case of helper ranges.
      Resetting both bounds in check_reg_overflow() in case only one
      of them exceeds limits is also not enough as similar test can be
      created that uses values which are within range, thus also here
      learned min value in r1 is incorrect when mixed with later signed
      test to create a range:
      
         0: (7a) *(u64 *)(r10 -8) = 0
         1: (bf) r2 = r10
         2: (07) r2 += -8
         3: (18) r1 = 0xffff880ad081fa00
         5: (85) call bpf_map_lookup_elem#1
         6: (15) if r0 == 0x0 goto pc+7
        R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0 R10=fp
         7: (7a) *(u64 *)(r10 -16) = -8
         8: (79) r1 = *(u64 *)(r10 -16)
         9: (b7) r2 = 2
        10: (3d) if r2 >= r1 goto pc+3
        R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0 R1=inv,min_value=3
        R2=imm2,min_value=2,max_value=2,min_align=2 R10=fp
        11: (65) if r1 s> 0x4 goto pc+2
        R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0
        R1=inv,min_value=3,max_value=4 R2=imm2,min_value=2,max_value=2,min_align=2 R10=fp
        12: (0f) r0 += r1
        13: (72) *(u8 *)(r0 +0) = 0
        R0=map_value_adj(ks=8,vs=8,id=0),min_value=3,max_value=4
        R1=inv,min_value=3,max_value=4 R2=imm2,min_value=2,max_value=2,min_align=2 R10=fp
        14: (b7) r0 = 0
        15: (95) exit
      
      This leaves us with two options for fixing this: i) to invalidate
      all prior learned information once we switch signed context, ii)
      to track min/max signed and unsigned boundaries separately as
      done in [0]. (Given latter introduces major changes throughout
      the whole verifier, it's rather net-next material, thus this
      patch follows option i), meaning we can derive bounds either
      from only signed tests or only unsigned tests.) There is still the
      case of adjust_reg_min_max_vals(), where we adjust bounds on ALU
      operations, meaning programs like the following where boundaries
      on the reg get mixed in context later on when bounds are merged
      on the dst reg must get rejected, too:
      
         0: (7a) *(u64 *)(r10 -8) = 0
         1: (bf) r2 = r10
         2: (07) r2 += -8
         3: (18) r1 = 0xffff89b2bf87ce00
         5: (85) call bpf_map_lookup_elem#1
         6: (15) if r0 == 0x0 goto pc+6
        R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0 R10=fp
         7: (7a) *(u64 *)(r10 -16) = -8
         8: (79) r1 = *(u64 *)(r10 -16)
         9: (b7) r2 = 2
        10: (3d) if r2 >= r1 goto pc+2
        R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0 R1=inv,min_value=3
        R2=imm2,min_value=2,max_value=2,min_align=2 R10=fp
        11: (b7) r7 = 1
        12: (65) if r7 s> 0x0 goto pc+2
        R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0 R1=inv,min_value=3
        R2=imm2,min_value=2,max_value=2,min_align=2 R7=imm1,max_value=0 R10=fp
        13: (b7) r0 = 0
        14: (95) exit
      
        from 12 to 15: R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0
        R1=inv,min_value=3 R2=imm2,min_value=2,max_value=2,min_align=2 R7=imm1,min_value=1 R10=fp
        15: (0f) r7 += r1
        16: (65) if r7 s> 0x4 goto pc+2
        R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0 R1=inv,min_value=3
        R2=imm2,min_value=2,max_value=2,min_align=2 R7=inv,min_value=4,max_value=4 R10=fp
        17: (0f) r0 += r7
        18: (72) *(u8 *)(r0 +0) = 0
        R0=map_value_adj(ks=8,vs=8,id=0),min_value=4,max_value=4 R1=inv,min_value=3
        R2=imm2,min_value=2,max_value=2,min_align=2 R7=inv,min_value=4,max_value=4 R10=fp
        19: (b7) r0 = 0
        20: (95) exit
      
      Meaning, in adjust_reg_min_max_vals() we must also reset range
      values on the dst when src/dst registers have mixed signed/
      unsigned derived min/max value bounds with one unbounded value
      as otherwise they can be added together deducing false boundaries.
      Once both boundaries are established from either ALU ops or
      compare operations w/o mixing signed/unsigned insns, then they
      can safely be added to other regs also having both boundaries
      established. Adding regs with one unbounded side to a map value
      where the bounded side has been learned w/o mixing ops is
      possible, but the resulting map value won't recover from that,
      meaning such op is considered invalid on the time of actual
      access. Invalid bounds are set on the dst reg in case i) src reg,
      or ii) in case dst reg already had them. The only way to recover
      would be to perform i) ALU ops but only 'add' is allowed on map
      value types or ii) comparisons, but these are disallowed on
      pointers in case they span a range. This is fine as only BPF_JEQ
      and BPF_JNE may be performed on PTR_TO_MAP_VALUE_OR_NULL registers
      which potentially turn them into PTR_TO_MAP_VALUE type depending
      on the branch, so only here min/max value cannot be invalidated
      for them.
      
      In terms of state pruning, value_from_signed is considered
      as well in states_equal() when dealing with adjusted map values.
      With regards to breaking existing programs, there is a small
      risk, but use-cases are rather quite narrow where this could
      occur and mixing compares probably unlikely.
      
      Joint work with Josef and Edward.
      
        [0] https://lists.iovisor.org/pipermail/iovisor-dev/2017-June/000822.html
      
      Fixes: 48461135 ("bpf: allow access into map value arrays")
      Reported-by: default avatarEdward Cree <ecree@solarflare.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarEdward Cree <ecree@solarflare.com>
      Signed-off-by: default avatarJosef Bacik <jbacik@fb.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4cabc5b1
    • Linus Torvalds's avatar
      Merge tag 'pm-4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 63a86362
      Linus Torvalds authored
      Pull power management fixes from Rafael Wysocki:
       "These are two stable-candidate fixes for the intel_pstate driver and
        the generic power domains (genpd) framework.
      
        Specifics:
      
         - Fix the average CPU load computations in the intel_pstate driver on
           Knights Landing (Xeon Phi) processors that require an extra factor
           to compensate for a rate change differences between the TSC and
           MPERF which is missing (Srinivas Pandruvada).
      
         - Fix an initialization ordering issue in the generic power domains
           (genpd) framework (Sudeep Holla)"
      
      * tag 'pm-4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present
        cpufreq: intel_pstate: Correct the busy calculation for KNL
      63a86362
    • Linus Torvalds's avatar
      x86: mark kprobe templates as character arrays, not single characters · 54a7d50b
      Linus Torvalds authored
      They really are, and the "take the address of a single character" makes
      the string fortification code unhappy (it believes that you can now only
      acccess one byte, rather than a byte range, and then raises errors for
      the memory copies going on in there).
      
      We could now remove a few 'addressof' operators (since arrays naturally
      degrade to pointers), but this is the minimal patch that just changes
      the C prototypes of those template arrays (the templates themselves are
      defined in inline asm).
      Reported-by: default avatarkernel test robot <xiaolong.ye@intel.com>
      Acked-and-tested-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
      Cc: Daniel Micay <danielmicay@gmail.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      54a7d50b
    • Linus Torvalds's avatar
      Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · 791f2df3
      Linus Torvalds authored
      Pull misc filesystem fixes from Jan Kara:
       "Several ACL related fixes for ext2, reiserfs, and hfsplus.
      
        And also one minor isofs cleanup"
      
      * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        hfsplus: Don't clear SGID when inheriting ACLs
        isofs: Fix off-by-one in 'session' mount option parsing
        reiserfs: preserve i_mode if __reiserfs_set_acl() fails
        ext2: preserve i_mode if ext2_set_acl() fails
        ext2: Don't clear SGID when inheriting ACLs
        reiserfs: Don't clear SGID when inheriting ACLs
      791f2df3
    • Linus Torvalds's avatar
      Merge tag 'for-f2fs-v4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs · 465b0dbb
      Linus Torvalds authored
      Pull f2fs fixes from Jaegeuk Kim:
       "We've filed some bug fixes:
      
         - missing f2fs case in terms of stale SGID bit, introduced by Jan
      
         - build error for seq_file.h
      
         - avoid cpu lockup
      
         - wrong inode_unlock in error case"
      
      * tag 'for-f2fs-v4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs:
        f2fs: avoid cpu lockup
        f2fs: include seq_file.h for sysfs.c
        f2fs: Don't clear SGID when inheriting ACLs
        f2fs: remove extra inode_unlock() in error path
      465b0dbb
    • Linus Torvalds's avatar
      Merge branch 'stable-4.13' of git://git.infradead.org/users/pcmoore/audit · f58781c9
      Linus Torvalds authored
      Pull audit fix from Paul Moore:
       "A small audit fix, just a single line, to plug a memory leak in some
        audit error handling code"
      
      * 'stable-4.13' of git://git.infradead.org/users/pcmoore/audit:
        audit: fix memleak in auditd_send_unicast_skb.
      f58781c9
    • Linus Torvalds's avatar
      Merge tag 'libnvdimm-fixes-4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · ae1c9085
      Linus Torvalds authored
      Pull libnvdimm fixes from Dan Williams:
       "A handful of small fixes for 4.13-rc2. Three of these fixes are tagged
        for -stable. They have all appeared in at least one -next release with
        no reported issues
      
         - Fix handling of media errors that span a sector
      
         - Fix support of multiple namespaces in a libnvdimm region being in
           device-dax mode
      
         - Clean up the machine check notifier properly when the nfit driver
           fails to register
      
         - Address a static analysis (smatch) report in device-dax"
      
      * tag 'libnvdimm-fixes-4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        device-dax: fix sysfs duplicate warnings
        MAINTAINERS: list drivers/acpi/nfit/ files for libnvdimm sub-system
        acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
        device-dax: fix 'passing zero to ERR_PTR()' warning
        libnvdimm: fix badblock range handling of ARS range
      ae1c9085
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid · c6efb454
      Linus Torvalds authored
      Pull HID fixes from Jiri Kosina:
      
       - HID multitouch 4.12 regression fix from Dmitry Torokhov
      
       - error handling fix for HID++ driver from Gustavo A. R. Silva
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
        HID: hid-logitech-hidpp: add NULL check on devm_kmemdup() return value
        HID: multitouch: do not blindly set EV_KEY or EV_ABS bits
      c6efb454
    • Rafael J. Wysocki's avatar
      Merge branches 'intel_pstate' and 'pm-domains' · ffa64d5e
      Rafael J. Wysocki authored
      * intel_pstate:
        cpufreq: intel_pstate: Correct the busy calculation for KNL
      
      * pm-domains:
        PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present
      ffa64d5e
    • Gustavo A. R. Silva's avatar
      HID: hid-logitech-hidpp: add NULL check on devm_kmemdup() return value · 929b60a8
      Gustavo A. R. Silva authored
      Check return value from call to devm_kmemdup() in order to prevent a NULL
      pointer dereference.
      Signed-off-by: default avatarGustavo A. R. Silva <garsilva@embeddedor.com>
      Reviewed-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      929b60a8
    • Sabrina Dubroca's avatar
      ipv6: avoid overflow of offset in ip6_find_1stfragopt · 6399f1fa
      Sabrina Dubroca authored
      In some cases, offset can overflow and can cause an infinite loop in
      ip6_find_1stfragopt(). Make it unsigned int to prevent the overflow, and
      cap it at IPV6_MAXPLEN, since packets larger than that should be invalid.
      
      This problem has been here since before the beginning of git history.
      Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
      Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6399f1fa
    • Colin Ian King's avatar
      net: tehuti: don't process data if it has not been copied from userspace · 1e6c22ae
      Colin Ian King authored
      The array data is only populated with valid information from userspace
      if cmd != SIOCDEVPRIVATE, other cases the array contains garbage on
      the stack. The subsequent switch statement acts on a subcommand in
      data[0] which could be any garbage value if cmd is SIOCDEVPRIVATE which
      seems incorrect to me.  Instead, just return EOPNOTSUPP for the case
      where cmd == SIOCDEVPRIVATE to avoid this issue.
      
      As a side note, I suspect that the original intention of the code
      was for this ioctl to work just for cmd == SIOCDEVPRIVATE (and the
      current logic is reversed). However, I don't wont to change the current
      semantics in case any userspace code relies on this existing behaviour.
      
      Detected by CoverityScan, CID#139647 ("Uninitialized scalar variable")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1e6c22ae
    • David Ahern's avatar
      Revert "rtnetlink: Do not generate notifications for CHANGEADDR event" · 3753654e
      David Ahern authored
      This reverts commit cd8966e7.
      
      The duplicate CHANGEADDR event message is sent regardless of link
      status whereas the setlink changes only generate a notification when
      the link is up. Not sending a notification when the link is down breaks
      dhcpcd which only processes hwaddr changes when the link is down.
      
      Fixes reported regression:
          https://bugzilla.kernel.org/show_bug.cgi?id=196355Reported-by: default avatarYaroslav Isakov <yaroslav.isakov@gmail.com>
      Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3753654e
    • Arjun Vynipadath's avatar
    • Martin Hundebøll's avatar
      net: dsa: mv88e6xxx: Enable CMODE config support for 6390X · bb0a2675
      Martin Hundebøll authored
      Commit f39908d3 ('net: dsa: mv88e6xxx: Set the CMODE for mv88e6390
      ports 9 & 10') added support for setting the CMODE for the 6390X family,
      but only enabled it for 9290 and 6390 - and left out 6390X.
      
      Fix support for setting the CMODE on 6390X also by assigning
      mv88e6390x_port_set_cmode() to the .port_set_cmode function pointer in
      mv88e6390x_ops too.
      
      Fixes: f39908d3 ("net: dsa: mv88e6xxx: Set the CMODE for mv88e6390 ports 9 & 10")
      Signed-off-by: default avatarMartin Hundebøll <mnhu@prevas.dk>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Reviewed-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bb0a2675
    • David S. Miller's avatar
      Merge branch 'netvsc-lockdep-and-related-fixes' · 88f34810
      David S. Miller authored
      Stephen Hemminger says:
      
      ====================
      netvsc: lockdep and related fixes
      
      These fix sparse and lockdep warnings from netvsc driver.
      Targeting these at net-next since no actual related failures
      have been observed in non-debug kernels.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      88f34810
    • stephen hemminger's avatar
      netvsc: add rtnl annotations in rndis · 3962981f
      stephen hemminger authored
      The rndis functions are used when changing device state.
      Therefore the references from network device to internal state
      are protected by RTNL mutex.
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3962981f
    • stephen hemminger's avatar
      netvsc: save pointer to parent netvsc_device in channel table · 35fbbccf
      stephen hemminger authored
      Keep back pointer in the per-channel data structure to
      avoid any possible RCU related issues when napi poll is
      called but netvsc_device is in RCU limbo.
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      35fbbccf
    • stephen hemminger's avatar
      netvsc: need rcu_derefence when accessing internal device info · 2a926f79
      stephen hemminger authored
      The netvsc_device structure should be accessed by rcu_dereference
      in the send path.  Change arguments to netvsc_send() to make
      this easier to do correctly.
      
      Remove no longer needed hv_device_to_netvsc_device.
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2a926f79
    • stephen hemminger's avatar
      netvsc: use ERR_PTR to avoid dereference issues · 9749fed5
      stephen hemminger authored
      The rndis_filter_device_add function is called both in
      probe context and RTNL context,and creates the netvsc_device
      inner structure. It is easier to get the RTNL lock annotation
      correct if it returns the object directly, rather than implicitly
      by updating network device private data.
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9749fed5