1. 15 Jan, 2020 13 commits
  2. 14 Jan, 2020 6 commits
    • Sunil Muthuswamy's avatar
      hv_sock: Remove the accept port restriction · c742c59e
      Sunil Muthuswamy authored
      Currently, hv_sock restricts the port the guest socket can accept
      connections on. hv_sock divides the socket port namespace into two parts
      for server side (listening socket), 0-0x7FFFFFFF & 0x80000000-0xFFFFFFFF
      (there are no restrictions on client port namespace). The first part
      (0-0x7FFFFFFF) is reserved for sockets where connections can be accepted.
      The second part (0x80000000-0xFFFFFFFF) is reserved for allocating ports
      for the peer (host) socket, once a connection is accepted.
      This reservation of the port namespace is specific to hv_sock and not
      known by the generic vsock library (ex: af_vsock). This is problematic
      because auto-binds/ephemeral ports are handled by the generic vsock
      library and it has no knowledge of this port reservation and could
      allocate a port that is not compatible with hv_sock (and legitimately so).
      The issue hasn't surfaced so far because the auto-bind code of vsock
      (__vsock_bind_stream) prior to the change 'VSOCK: bind to random port for
      VMADDR_PORT_ANY' would start walking up from LAST_RESERVED_PORT (1023) and
      start assigning ports. That will take a large number of iterations to hit
      0x7FFFFFFF. But, after the above change to randomize port selection, the
      issue has started coming up more frequently.
      There has really been no good reason to have this port reservation logic
      in hv_sock from the get go. Reserving a local port for peer ports is not
      how things are handled generally. Peer ports should reflect the peer port.
      This fixes the issue by lifting the port reservation, and also returns the
      right peer port. Since the code converts the GUID to the peer port (by
      using the first 4 bytes), there is a possibility of conflicts, but that
      seems like a reasonable risk to take, given this is limited to vsock and
      that only applies to all local sockets.
      Signed-off-by: default avatarSunil Muthuswamy <sunilmut@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c742c59e
    • Eric Dumazet's avatar
      net: usb: lan78xx: limit size of local TSO packets · f8d7408a
      Eric Dumazet authored
      lan78xx_tx_bh() makes sure to not exceed MAX_SINGLE_PACKET_SIZE
      bytes in the aggregated packets it builds, but does
      nothing to prevent large GSO packets being submitted.
      
      Pierre-Francois reported various hangs when/if TSO is enabled.
      
      For localy generated packets, we can use netif_set_gso_max_size()
      to limit the size of TSO packets.
      
      Note that forwarded packets could still hit the issue,
      so a complete fix might require implementing .ndo_features_check
      for this driver, forcing a software segmentation if the size
      of the TSO packet exceeds MAX_SINGLE_PACKET_SIZE.
      
      Fixes: 55d7de9d ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarRENARD Pierre-Francois <pfrenard@gmail.com>
      Tested-by: default avatarRENARD Pierre-Francois <pfrenard@gmail.com>
      Cc: Stefan Wahren <stefan.wahren@i2se.com>
      Cc: Woojung Huh <woojung.huh@microchip.com>
      Cc: Microchip Linux Driver Support <UNGLinuxDriver@microchip.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f8d7408a
    • Vladis Dronov's avatar
      ptp: free ptp device pin descriptors properly · 75718584
      Vladis Dronov authored
      There is a bug in ptp_clock_unregister(), where ptp_cleanup_pin_groups()
      first frees ptp->pin_{,dev_}attr, but then posix_clock_unregister() needs
      them to destroy a related sysfs device.
      
      These functions can not be just swapped, as posix_clock_unregister() frees
      ptp which is needed in the ptp_cleanup_pin_groups(). Fix this by calling
      ptp_cleanup_pin_groups() in ptp_clock_release(), right before ptp is freed.
      
      This makes this patch fix an UAF bug in a patch which fixes an UAF bug.
      Reported-by: default avatarAntti Laakso <antti.laakso@intel.com>
      Fixes: a33121e5 ("ptp: fix the race between the release of ptp_clock and cdev")
      Link: https://lore.kernel.org/netdev/3d2bd09735dbdaf003585ca376b7c1e5b69a19bd.camel@intel.com/Signed-off-by: default avatarVladis Dronov <vdronov@redhat.com>
      Acked-by: default avatarRichard Cochran <richardcochran@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      75718584
    • Johan Hovold's avatar
      NFC: pn533: fix bulk-message timeout · a112adaf
      Johan Hovold authored
      The driver was doing a synchronous uninterruptible bulk-transfer without
      using a timeout. This could lead to the driver hanging on probe due to a
      malfunctioning (or malicious) device until the device is physically
      disconnected. While sleeping in probe the driver prevents other devices
      connected to the same hub from being added to (or removed from) the bus.
      
      An arbitrary limit of five seconds should be more than enough.
      
      Fixes: dbafc289 ("NFC: pn533: don't send USB data off of the stack")
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Reviewed-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      a112adaf
    • Kristian Evensen's avatar
      qmi_wwan: Add support for Quectel RM500Q · a9ff44f0
      Kristian Evensen authored
      RM500Q is a 5G module from Quectel, supporting both standalone and
      non-standalone modes. The normal Quectel quirks apply (DTR and dynamic
      interface numbers).
      Signed-off-by: default avatarKristian Evensen <kristian.evensen@gmail.com>
      Acked-by: default avatarBjørn Mork <bjorn@mork.no>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      a9ff44f0
    • Milind Parab's avatar
      net: macb: fix for fixed-link mode · fd2a8914
      Milind Parab authored
      This patch fix the issue with fixed link. With fixed-link
      device opening fails due to macb_phylink_connect not
      handling fixed-link mode, in which case no MAC-PHY connection
      is needed and phylink_connect return success (0), however
      in current driver attempt is made to search and connect to
      PHY even for fixed-link.
      
      Fixes: 7897b071 ("net: macb: convert to phylink")
      Signed-off-by: default avatarMilind Parab <mparab@cadence.com>
      Reviewed-by: default avatarClaudiu Beznea <claudiu.beznea@microchip.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      fd2a8914
  3. 11 Jan, 2020 7 commits
  4. 10 Jan, 2020 9 commits
  5. 09 Jan, 2020 5 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid · e69ec487
      Linus Torvalds authored
      Pull HID fixes from Jiri Kosina:
      
       - fix for OOB in hiddev, from Dmitry Torokhov
      
       - _poll API fixes for hidraw, from Marcel Holtmann
      
       - functional fix for Steam driver, from Rodrigo Rivas Costa
      
       - a few new device IDs / device-specific quirks and other assorted
         smaller fixes
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
        HID: steam: Fix input device disappearing
        HID: intel-ish-hid: ipc: Add Tiger Lake PCI device ID
        drivers/hid/hid-multitouch.c: fix a possible null pointer access.
        HID: wacom: Recognize new MobileStudio Pro PID
        HID: intel-ish-hid: ipc: add CMP device id
        HID: hiddev: fix mess in hiddev_open()
        HID: hid-input: clear unmapped usages
        HID: Add quirk for incorrect input length on Lenovo Y720
        HID: asus: Ignore Asus vendor-page usage-code 0xff events
        HID: ite: Add USB id match for Acer SW5-012 keyboard dock
        HID: Add quirk for Xin-Mo Dual Controller
        HID: Fix slab-out-of-bounds read in hid_field_extract
        HID: multitouch: Add LG MELF0410 I2C touchscreen support
        HID: uhid: Fix returning EPOLLOUT from uhid_char_poll
        HID: hidraw: Fix returning EPOLLOUT from hidraw_poll
      e69ec487
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · a5f48c78
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Missing netns pointer init in arp_tables, from Florian Westphal.
      
       2) Fix normal tcp SACK being treated as D-SACK, from Pengcheng Yang.
      
       3) Fix divide by zero in sch_cake, from Wen Yang.
      
       4) Len passed to skb_put_padto() is wrong in qrtr code, from Carl
          Huang.
      
       5) cmd->obj.chunk is leaked in sctp code error paths, from Xin Long.
      
       6) cgroup bpf programs can be released out of order, fix from Roman
          Gushchin.
      
       7) Make sure stmmac debugfs entry name is changed when device name
          changes, from Jiping Ma.
      
       8) Fix memory leak in vlan_dev_set_egress_priority(), from Eric
          Dumazet.
      
       9) SKB leak in lan78xx usb driver, also from Eric Dumazet.
      
      10) Ridiculous TCA_FQ_QUANTUM values configured can cause loops in fq
          packet scheduler, reject them. From Eric Dumazet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (69 commits)
        tipc: fix wrong connect() return code
        tipc: fix link overflow issue at socket shutdown
        netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present
        netfilter: conntrack: dccp, sctp: handle null timeout argument
        atm: eni: fix uninitialized variable warning
        macvlan: do not assume mac_header is set in macvlan_broadcast()
        net: sch_prio: When ungrafting, replace with FIFO
        mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO
        MAINTAINERS: Remove myself as co-maintainer for qcom-ethqos
        gtp: fix bad unlock balance in gtp_encap_enable_socket
        pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
        tipc: remove meaningless assignment in Makefile
        tipc: do not add socket.o to tipc-y twice
        net: stmmac: dwmac-sun8i: Allow all RGMII modes
        net: stmmac: dwmac-sunxi: Allow all RGMII modes
        net: usb: lan78xx: fix possible skb leak
        net: stmmac: Fixed link does not need MDIO Bus
        vlan: vlan_changelink() should propagate errors
        vlan: fix memory leak in vlan_dev_set_egress_priority
        stmmac: debugfs entry name is not be changed when udev rename device name.
        ...
      a5f48c78
    • Jeff Kirsher's avatar
      e1000e: Revert "e1000e: Make watchdog use delayed work" · d5ad7a6a
      Jeff Kirsher authored
      This reverts commit 59653e64.
      
      This is due to this commit causing driver crashes and connections to
      reset unexpectedly.
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Tested-by: default avatarAaron Brown <aaron.f.brown@intel.com>
      d5ad7a6a
    • Adam Ludkiewicz's avatar
      i40e: Set PHY Access flag on X722 · bb37362f
      Adam Ludkiewicz authored
      The X722 FW API version 1.9 adds support for accessing PHY
      registers with Admin Queue Command. This enables reading
      EEPROM data from (Q)SFP+ transceivers, what was previously
      possible only on X710 devices.
      Signed-off-by: default avatarAdam Ludkiewicz <adam.ludkiewicz@intel.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      bb37362f
    • Stefan Assmann's avatar
      iavf: remove current MAC address filter on VF reset · 9e052291
      Stefan Assmann authored
      Currently MAC filters are not altered during a VF reset event. This may
      lead to a stale filter when an administratively set MAC is forced by the
      PF.
      
      For an administratively set MAC the PF driver deletes the VFs filters,
      overwrites the VFs MAC address and triggers a VF reset. However
      the VF driver itself is not aware of the filter removal, which is what
      the VF reset is for.
      The VF reset queues all filters present in the VF driver to be re-added
      to the PF filter list (including the filter for the now stale VF MAC
      address) and triggers a VIRTCHNL_OP_GET_VF_RESOURCES event, which
      provides the new MAC address to the VF.
      
      When this happens i40e will complain and reject the stale MAC filter,
      at least in the untrusted VF case.
      i40e 0000:08:00.0: Setting MAC 3c:fa:fa:fa:fa:01 on VF 0
      iavf 0000:08:02.0: Reset warning received from the PF
      iavf 0000:08:02.0: Scheduling reset task
      i40e 0000:08:00.0: Bring down and up the VF interface to make this change effective.
      i40e 0000:08:00.0: VF attempting to override administratively set MAC address, bring down and up the VF interface to resume normal operation
      i40e 0000:08:00.0: VF 0 failed opcode 10, retval: -1
      iavf 0000:08:02.0: Failed to add MAC filter, error IAVF_ERR_NVM
      
      To avoid re-adding the stale MAC filter it needs to be removed from the
      VF driver's filter list before queuing the existing filters. Then during
      the VIRTCHNL_OP_GET_VF_RESOURCES event the correct filter needs to be
      added again, at which point the MAC address has been updated.
      
      As a bonus this change makes bringing the VF down and up again
      superfluous for the administratively set MAC case.
      Signed-off-by: default avatarStefan Assmann <sassmann@kpanic.de>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      9e052291