1. 15 Nov, 2015 6 commits
    • David S. Miller's avatar
      Merge branch 'ipv6-route-fixes' · e63e904c
      David S. Miller authored
      Martin KaFai Lau says:
      
      ====================
      ipv6: Fixes for pmtu update and DST_NOCACHE route
      
      This patchset fixes:
      1. An oops during IPv6 pmtu update on a IPv4 GRE running
         in an IPSec setup
      2. Misc fixes on DST_NOCACHE route
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e63e904c
    • Martin KaFai Lau's avatar
      ipv6: Check rt->dst.from for the DST_NOCACHE route · 02bcf4e0
      Martin KaFai Lau authored
      All DST_NOCACHE rt6_info used to have rt->dst.from set to
      its parent.
      
      After commit 8e3d5be7 ("ipv6: Avoid double dst_free"),
      DST_NOCACHE is also set to rt6_info which does not have
      a parent (i.e. rt->dst.from is NULL).
      
      This patch catches the rt->dst.from == NULL case.
      
      Fixes: 8e3d5be7 ("ipv6: Avoid double dst_free")
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      02bcf4e0
    • Martin KaFai Lau's avatar
      ipv6: Check expire on DST_NOCACHE route · 5973fb1e
      Martin KaFai Lau authored
      Since the expires of the DST_NOCACHE rt can be set during
      the ip6_rt_update_pmtu(), we also need to consider the expires
      value when doing ip6_dst_check().
      
      This patches creates __rt6_check_expired() to only
      check the expire value (if one exists) of the current rt.
      
      In rt6_dst_from_check(), it adds __rt6_check_expired() as
      one of the condition check.
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5973fb1e
    • Martin KaFai Lau's avatar
      ipv6: Avoid creating RTF_CACHE from a rt that is not managed by fib6 tree · 0d3f6d29
      Martin KaFai Lau authored
      The original bug report:
      https://bugzilla.redhat.com/show_bug.cgi?id=1272571
      
      The setup has a IPv4 GRE tunnel running in a IPSec.  The bug
      happens when ndisc starts sending router solicitation at the gre
      interface.  The simplified oops stack is like:
      
      __lock_acquire+0x1b2/0x1c30
      lock_acquire+0xb9/0x140
      _raw_write_lock_bh+0x3f/0x50
      __ip6_ins_rt+0x2e/0x60
      ip6_ins_rt+0x49/0x50
      ~~~~~~~~
      __ip6_rt_update_pmtu.part.54+0x145/0x250
      ip6_rt_update_pmtu+0x2e/0x40
      ~~~~~~~~
      ip_tunnel_xmit+0x1f1/0xf40
      __gre_xmit+0x7a/0x90
      ipgre_xmit+0x15a/0x220
      dev_hard_start_xmit+0x2bd/0x480
      __dev_queue_xmit+0x696/0x730
      dev_queue_xmit+0x10/0x20
      neigh_direct_output+0x11/0x20
      ip6_finish_output2+0x21f/0x770
      ip6_finish_output+0xa7/0x1d0
      ip6_output+0x56/0x190
      ~~~~~~~~
      ndisc_send_skb+0x1d9/0x400
      ndisc_send_rs+0x88/0xc0
      ~~~~~~~~
      
      The rt passed to ip6_rt_update_pmtu() is created by
      icmp6_dst_alloc() and it is not managed by the fib6 tree,
      so its rt6i_table == NULL.  When __ip6_rt_update_pmtu() creates
      a RTF_CACHE clone, the newly created clone also has rt6i_table == NULL
      and it causes the ip6_ins_rt() oops.
      
      During pmtu update, we only want to create a RTF_CACHE clone
      from a rt which is currently managed (or owned) by the
      fib6 tree.  It means either rt->rt6i_node != NULL or
      rt is a RTF_PCPU clone.
      
      It is worth to note that rt6i_table may not be NULL even it is
      not (yet) managed by the fib6 tree (e.g. addrconf_dst_alloc()).
      Hence, rt6i_node is a better check instead of rt6i_table.
      
      Fixes: 45e4fd26 ("ipv6: Only create RTF_CACHE routes after encountering pmtu")
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Reported-by: default avatarChris Siebenmann <cks-rhbugzilla@cs.toronto.edu>
      Cc: Chris Siebenmann <cks-rhbugzilla@cs.toronto.edu>
      Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0d3f6d29
    • Colin Ian King's avatar
      fjes: fix inconsistent indenting · 9001d94d
      Colin Ian King authored
      minor change, indenting is one tab out.
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarTaku Izumi <izumi.taku@jp.fujitsu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9001d94d
    • Hannes Frederic Sowa's avatar
      af-unix: fix use-after-free with concurrent readers while splicing · 73ed5d25
      Hannes Frederic Sowa authored
      During splicing an af-unix socket to a pipe we have to drop all
      af-unix socket locks. While doing so we allow another reader to enter
      unix_stream_read_generic which can read, copy and finally free another
      skb. If exactly this skb is just in process of being spliced we get a
      use-after-free report by kasan.
      
      First, we must make sure to not have a free while the skb is used during
      the splice operation. We simply increment its use counter before unlocking
      the reader lock.
      
      Stream sockets have the nice characteristic that we don't care about
      zero length writes and they never reach the peer socket's queue. That
      said, we can take the UNIXCB.consumed field as the indicator if the
      skb was already freed from the socket's receive queue. If the skb was
      fully consumed after we locked the reader side again we know it has been
      dropped by a second reader. We indicate a short read to user space and
      abort the current splice operation.
      
      This bug has been found with syzkaller
      (http://github.com/google/syzkaller) by Dmitry Vyukov.
      
      Fixes: 2b514574 ("net: af_unix: implement splice for stream af_unix sockets")
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: Eric Dumazet <eric.dumazet@gmail.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      73ed5d25
  2. 12 Nov, 2015 3 commits
    • Arnd Bergmann's avatar
      stmmac: avoid ipq806x constant overflow warning · 49e4a229
      Arnd Bergmann authored
      Building dwmac-ipq806x on a 64-bit architecture produces a harmless
      warning from gcc:
      
      stmmac/dwmac-ipq806x.c: In function 'ipq806x_gmac_probe':
      include/linux/bitops.h:6:19: warning: overflow in implicit constant conversion [-Woverflow]
        val = QSGMII_PHY_CDR_EN |
      stmmac/dwmac-ipq806x.c:333:8: note: in expansion of macro 'QSGMII_PHY_CDR_EN'
       #define QSGMII_PHY_CDR_EN   BIT(0)
       #define BIT(nr)   (1UL << (nr))
      
      This is a result of the type conversion rules in C, when we take the
      logical OR of multiple different types. In particular, we have
      and unsigned long
      
      	QSGMII_PHY_CDR_EN == BIT(0) == (1ul << 0) == 0x0000000000000001ul
      
      and a signed int
      
      	0xC << QSGMII_PHY_TX_DRV_AMP_OFFSET == 0xc0000000
      
      which together gives a signed long value
      
      	0xffffffffc0000001l
      
      and when this is passed into a function that takes an unsigned int type,
      gcc warns about the signed overflow and the loss of the upper 32-bits that
      are all ones.
      
      This patch adds 'ul' type modifiers to the literal numbers passed in
      here, so now the expression remains an 'unsigned long' with the upper
      bits all zero, and that avoids the signed overflow and the warning.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Fixes: b1c17215 ("stmmac: add ipq806x glue layer")
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      49e4a229
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · 382a483e
      David S. Miller authored
      Pablo Neira Ayuso:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for your net tree. This
      large batch that includes fixes for ipset, netfilter ingress, nf_tables
      dynamic set instantiation and a longstanding Kconfig dependency problem.
      More specifically, they are:
      
      1) Add missing check for empty hook list at the ingress hook, from
         Florian Westphal.
      
      2) Input and output interface are swapped at the ingress hook,
         reported by Patrick McHardy.
      
      3) Resolve ipset extension alignment issues on ARM, patch from Jozsef
         Kadlecsik.
      
      4) Fix bit check on bitmap in ipset hash type, also from Jozsef.
      
      5) Release buckets when all entries have expired in ipset hash type,
         again from Jozsef.
      
      6) Oneliner to initialize conntrack tuple object in the PPTP helper,
         otherwise the conntrack lookup may fail due to random bits in the
         structure holes, patch from Anthony Lineham.
      
      7) Silence a bogus gcc warning in nfnetlink_log, from Arnd Bergmann.
      
      8) Fix Kconfig dependency problems with TPROXY, socket and dup, also
         from Arnd.
      
      9) Add __netdev_alloc_pcpu_stats() to allow creating percpu counters
         from atomic context, this is required by the follow up fix for
         nf_tables.
      
      10) Fix crash from the dynamic set expression, we have to add new clone
          operation that should be defined when a simple memcpy is not enough.
          This resolves a crash when using per-cpu counters with new Patrick
          McHardy's flow table nft support.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      382a483e
    • françois romieu's avatar
      r8169: fix kasan reported skb use-after-free. · 39174291
      françois romieu authored
      Signed-off-by: default avatarFrancois Romieu <romieu@fr.zoreil.com>
      Reported-by: default avatarDave Jones <davej@codemonkey.org.uk>
      Fixes: d7d2d89d ("r8169: Add software counter for multicast packages")
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarCorinna Vinschen <vinschen@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      39174291
  3. 11 Nov, 2015 30 commits
  4. 10 Nov, 2015 1 commit
    • Linus Torvalds's avatar
      Merge tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 52e9a333
      Linus Torvalds authored
      Pull ARM SoC defconfig updates from Olof Johansson:
       "Defconfig updates are kept separate from other branches mostly to
        avoid conflicts between the different categories (driver branch
        enabling something that has context conflict with SoC options, etc).
      
        A lot of this again is scattered across the various hardware
        platforms.  multi_v7_defconfig, our "generic" config for most 32-bit
        platforms has been gone through by Marvell Berlin maintainers and
        added most options they need to run on their hardware.  Broadcom NSP
        is also added there, and the new Atmel SAMA5D2 (added last release).
        Rockchip also has display and other devices supported in that config.
      
        In addition to that, the usual small churn of new options being added
        here and there"
      
      * tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (45 commits)
        ARM: multi_v7_defconfig: enable UniPhier I2C drivers
        ARM: multi_v7_defconfig: Enable rtl8152 ethernet driver for Odroid-XU4
        ARM: exynos_defconfig: Enable rtl8152 ethernet driver for Odroid-XU4
        ARM: exynos_defconfig: Enable WiFi-Ex as a module instead built-in
        ARM: exynos_defconfig: Disable simplefb support
        ARM: exynos_defconfig: Enable LEDS for Odroid-XU3/XU4
        ARM: multi_v7_defconfig: Enable DWC2 USB driver and USB ethernet gadget
        ARM: exynos_defconfig: Enable DWC2 USB driver and USB ethernet gadget
        ARM: exynos_defconfig: Enable USB Video Class support
        ARM: multi_v7_defconfig: improve multi_v7_defconfig support for Berlin
        ARM: tegra: Update multi_v7_defconfig
        ARM: multi_v7_defconfig: Add Atmel SDHCI device
        ARM: multi_v7_defconfig: Add Atmel Flexcom device
        ARM: multi_v7_defconfig: Add Atmel SAMA5D2 SoC
        ARM: at91/defconfig: add sama5d2 and its new devices to sama5 defconfig
        ARM: at91/defconfig: update at91_dt defconfig
        ARM: at91/defconfig: update sama5 defconfig
        ARM: configs: Enable FIXED_PHY in multi_v7 defconfig
        ARM: configs: update lpc18xx defconfig
        ARM: socfpga_defconfig: enable fpga manager
        ...
      52e9a333