1. 15 Jan, 2020 22 commits
    • David S. Miller's avatar
      Merge tag 'batadv-net-for-davem-20200114' of git://git.open-mesh.org/linux-merge · 5a40420e
      David S. Miller authored
      Simon Wunderlich says:
      
      ====================
      Here is a batman-adv bugfix:
      
       - Fix DAT candidate selection on little endian systems,
         by Sven Eckelmann
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5a40420e
    • Mohammed Gamal's avatar
      hv_netvsc: Fix memory leak when removing rndis device · 536dc5df
      Mohammed Gamal authored
      kmemleak detects the following memory leak when hot removing
      a network device:
      
      unreferenced object 0xffff888083f63600 (size 256):
        comm "kworker/0:1", pid 12, jiffies 4294831717 (age 1113.676s)
        hex dump (first 32 bytes):
          00 40 c7 33 80 88 ff ff 00 00 00 00 10 00 00 00  .@.3............
          00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........
        backtrace:
          [<00000000d4a8f5be>] rndis_filter_device_add+0x117/0x11c0 [hv_netvsc]
          [<000000009c02d75b>] netvsc_probe+0x5e7/0xbf0 [hv_netvsc]
          [<00000000ddafce23>] vmbus_probe+0x74/0x170 [hv_vmbus]
          [<00000000046e64f1>] really_probe+0x22f/0xb50
          [<000000005cc35eb7>] driver_probe_device+0x25e/0x370
          [<0000000043c642b2>] bus_for_each_drv+0x11f/0x1b0
          [<000000005e3d09f0>] __device_attach+0x1c6/0x2f0
          [<00000000a72c362f>] bus_probe_device+0x1a6/0x260
          [<0000000008478399>] device_add+0x10a3/0x18e0
          [<00000000cf07b48c>] vmbus_device_register+0xe7/0x1e0 [hv_vmbus]
          [<00000000d46cf032>] vmbus_add_channel_work+0x8ab/0x1770 [hv_vmbus]
          [<000000002c94bb64>] process_one_work+0x919/0x17d0
          [<0000000096de6781>] worker_thread+0x87/0xb40
          [<00000000fbe7397e>] kthread+0x333/0x3f0
          [<000000004f844269>] ret_from_fork+0x3a/0x50
      
      rndis_filter_device_add() allocates an instance of struct rndis_device
      which never gets deallocated as rndis_filter_device_remove() sets
      net_device->extension which points to the rndis_device struct to NULL,
      leaving the rndis_device dangling.
      
      Since net_device->extension is eventually freed in free_netvsc_device(),
      we refrain from setting it to NULL inside rndis_filter_device_remove()
      Signed-off-by: default avatarMohammed Gamal <mgamal@redhat.com>
      Reviewed-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      536dc5df
    • Pengcheng Yang's avatar
      tcp: fix marked lost packets not being retransmitted · e176b1ba
      Pengcheng Yang authored
      When the packet pointed to by retransmit_skb_hint is unlinked by ACK,
      retransmit_skb_hint will be set to NULL in tcp_clean_rtx_queue().
      If packet loss is detected at this time, retransmit_skb_hint will be set
      to point to the current packet loss in tcp_verify_retransmit_hint(),
      then the packets that were previously marked lost but not retransmitted
      due to the restriction of cwnd will be skipped and cannot be
      retransmitted.
      
      To fix this, when retransmit_skb_hint is NULL, retransmit_skb_hint can
      be reset only after all marked lost packets are retransmitted
      (retrans_out >= lost_out), otherwise we need to traverse from
      tcp_rtx_queue_head in tcp_xmit_retransmit_queue().
      
      Packetdrill to demonstrate:
      
      // Disable RACK and set max_reordering to keep things simple
          0 `sysctl -q net.ipv4.tcp_recovery=0`
         +0 `sysctl -q net.ipv4.tcp_max_reordering=3`
      
      // Establish a connection
         +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
         +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
         +0 bind(3, ..., ...) = 0
         +0 listen(3, 1) = 0
      
        +.1 < S 0:0(0) win 32792 <mss 1000,sackOK,nop,nop,nop,wscale 7>
         +0 > S. 0:0(0) ack 1 <...>
       +.01 < . 1:1(0) ack 1 win 257
         +0 accept(3, ..., ...) = 4
      
      // Send 8 data segments
         +0 write(4, ..., 8000) = 8000
         +0 > P. 1:8001(8000) ack 1
      
      // Enter recovery and 1:3001 is marked lost
       +.01 < . 1:1(0) ack 1 win 257 <sack 3001:4001,nop,nop>
         +0 < . 1:1(0) ack 1 win 257 <sack 5001:6001 3001:4001,nop,nop>
         +0 < . 1:1(0) ack 1 win 257 <sack 5001:7001 3001:4001,nop,nop>
      
      // Retransmit 1:1001, now retransmit_skb_hint points to 1001:2001
         +0 > . 1:1001(1000) ack 1
      
      // 1001:2001 was ACKed causing retransmit_skb_hint to be set to NULL
       +.01 < . 1:1(0) ack 2001 win 257 <sack 5001:8001 3001:4001,nop,nop>
      // Now retransmit_skb_hint points to 4001:5001 which is now marked lost
      
      // BUG: 2001:3001 was not retransmitted
         +0 > . 2001:3001(1000) ack 1
      Signed-off-by: default avatarPengcheng Yang <yangpc@wangsu.com>
      Acked-by: default avatarNeal Cardwell <ncardwell@google.com>
      Tested-by: default avatarNeal Cardwell <ncardwell@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e176b1ba
    • David S. Miller's avatar
      Merge branch 'mlxsw-Various-fixes' · 8b792f84
      David S. Miller authored
      Ido Schimmel says:
      
      ====================
      mlxsw: Various fixes
      
      This patch set contains various fixes for mlxsw.
      
      Patch #1 splits the init() callback between Spectrum-2 and Spectrum-3 in
      order to avoid enforcing the same firmware version for both ASICs, as
      this can't possibly work. Without this patch the driver cannot boot with
      the Spectrum-3 ASIC.
      
      Patches #2-#3 fix a long standing race condition that was recently
      exposed while testing the driver on an emulator, which is very slow
      compared to the actual hardware. The problem is explained in detail in
      the commit messages.
      
      Patch #4 fixes a selftest.
      
      Patch #5 prevents offloaded qdiscs from presenting a non-zero backlog to
      the user when the netdev is down. This is done by clearing the cached
      backlog in the driver when the netdev goes down.
      
      Patch #6 fixes qdisc statistics (backlog and tail drops) to also take
      into account the multicast traffic classes.
      
      v2:
      * Patches #2-#3: use skb_cow_head() instead of skb_unshare() as
        suggested by Jakub. Remove unnecessary check regarding headroom
      * Patches #5-#6: new
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8b792f84
    • Petr Machata's avatar
      mlxsw: spectrum_qdisc: Include MC TCs in Qdisc counters · 85005b82
      Petr Machata authored
      mlxsw configures Spectrum in such a way that BUM traffic is passed not
      through its nominal traffic class TC, but through its MC counterpart TC+8.
      However, when collecting statistics, Qdiscs only look at the nominal TC and
      ignore the MC TC.
      
      Add two helpers to compute the value for logical TC from the constituents,
      one for backlog, the other for tail drops. Use them throughout instead of
      going through the xstats pointer directly.
      
      Counters for TX bytes and packets are deduced from packet priority
      counters, and therefore already include BUM traffic. wred_drop counter is
      irrelevant on MC TCs, because RED is not enabled on them.
      
      Fixes: 7b819530 ("mlxsw: spectrum: Configure MC-aware mode on mlxsw ports")
      Signed-off-by: default avatarPetr Machata <petrm@mellanox.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      85005b82
    • Petr Machata's avatar
      mlxsw: spectrum: Wipe xstats.backlog of down ports · ca7609ff
      Petr Machata authored
      Per-port counter cache used by Qdiscs is updated periodically, unless the
      port is down. The fact that the cache is not updated for down ports is no
      problem for most counters, which are relative in nature. However, backlog
      is absolute in nature, and if there is a non-zero value in the cache around
      the time that the port goes down, that value just stays there. This value
      then leaks to offloaded Qdiscs that report non-zero backlog even if
      there (obviously) is no traffic.
      
      The HW does not keep backlog of a downed port, so do likewise: as the port
      goes down, wipe the backlog value from xstats.
      
      Fixes: 075ab8ad ("mlxsw: spectrum: Collect tclass related stats periodically")
      Signed-off-by: default avatarPetr Machata <petrm@mellanox.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ca7609ff
    • Petr Machata's avatar
      selftests: mlxsw: qos_mc_aware: Fix mausezahn invocation · fef6d670
      Petr Machata authored
      Mausezahn does not recognize "own" as a keyword on source IP address. As a
      result, the MC stream is not running at all, and therefore no UC
      degradation can be observed even in principle.
      
      Fix the invocation, and tighten the test: due to the minimum shaper
      configured at the MC TCs, we always expect about 20% degradation. Fail the
      test if it is lower.
      
      Fixes: 573363a6 ("selftests: mlxsw: Add qos_lib.sh")
      Signed-off-by: default avatarPetr Machata <petrm@mellanox.com>
      Reported-by: default avatarAmit Cohen <amitc@mellanox.com>
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fef6d670
    • Ido Schimmel's avatar
      mlxsw: switchx2: Do not modify cloned SKBs during xmit · 63963d0f
      Ido Schimmel authored
      The driver needs to prepend a Tx header to each packet it is
      transmitting. The header includes information such as the egress port
      and traffic class.
      
      The addition of the header requires the driver to modify the SKB's
      header and therefore it must not be shared. Otherwise, we risk hitting
      various race conditions.
      
      For example, when a packet is flooded (cloned) by the bridge driver to
      two switch ports swp1 and swp2:
      
      t0 - mlxsw_sp_port_xmit() is called for swp1. Tx header is prepended with
           swp1's port number
      t1 - mlxsw_sp_port_xmit() is called for swp2. Tx header is prepended with
           swp2's port number, overwriting swp1's port number
      t2 - The device processes data buffer from t0. Packet is transmitted via
           swp2
      t3 - The device processes data buffer from t1. Packet is transmitted via
           swp2
      
      Usually, the device is fast enough and transmits the packet before its
      Tx header is overwritten, but this is not the case in emulated
      environments.
      
      Fix this by making sure the SKB's header is writable by calling
      skb_cow_head(). Since the function ensures we have headroom to push the
      Tx header, the check further in the function can be removed.
      
      v2:
      * Use skb_cow_head() instead of skb_unshare() as suggested by Jakub
      * Remove unnecessary check regarding headroom
      
      Fixes: 31557f0f ("mlxsw: Introduce Mellanox SwitchX-2 ASIC support")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Reported-by: default avatarShalom Toledo <shalomt@mellanox.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      63963d0f
    • Ido Schimmel's avatar
      mlxsw: spectrum: Do not modify cloned SKBs during xmit · 2da51ce7
      Ido Schimmel authored
      The driver needs to prepend a Tx header to each packet it is
      transmitting. The header includes information such as the egress port
      and traffic class.
      
      The addition of the header requires the driver to modify the SKB's
      header and therefore it must not be shared. Otherwise, we risk hitting
      various race conditions.
      
      For example, when a packet is flooded (cloned) by the bridge driver to
      two switch ports swp1 and swp2:
      
      t0 - mlxsw_sp_port_xmit() is called for swp1. Tx header is prepended with
           swp1's port number
      t1 - mlxsw_sp_port_xmit() is called for swp2. Tx header is prepended with
           swp2's port number, overwriting swp1's port number
      t2 - The device processes data buffer from t0. Packet is transmitted via
           swp2
      t3 - The device processes data buffer from t1. Packet is transmitted via
           swp2
      
      Usually, the device is fast enough and transmits the packet before its
      Tx header is overwritten, but this is not the case in emulated
      environments.
      
      Fix this by making sure the SKB's header is writable by calling
      skb_cow_head(). Since the function ensures we have headroom to push the
      Tx header, the check further in the function can be removed.
      
      v2:
      * Use skb_cow_head() instead of skb_unshare() as suggested by Jakub
      * Remove unnecessary check regarding headroom
      
      Fixes: 56ade8fe ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Reported-by: default avatarShalom Toledo <shalomt@mellanox.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2da51ce7
    • Ido Schimmel's avatar
      mlxsw: spectrum: Do not enforce same firmware version for multiple ASICs · d58c35ca
      Ido Schimmel authored
      In commit a72afb68 ("mlxsw: Enforce firmware version for
      Spectrum-2") I added a required firmware version for Spectrum-2, but
      missed the fact that mlxsw_sp2_init() is used by both Spectrum-2 and
      Spectrum-3. This means that the same firmware version will be used for
      both, which is wrong.
      
      Fix this by creating a new init() callback for Spectrum-3.
      
      Fixes: a72afb68 ("mlxsw: Enforce firmware version for Spectrum-2")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Tested-by: default avatarShalom Toledo <shalomt@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d58c35ca
    • David S. Miller's avatar
      Merge tag 'mac80211-for-net-2020-01-15' of... · eb507906
      David S. Miller authored
      Merge tag 'mac80211-for-net-2020-01-15' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      
      Johannes Berg says:
      
      ====================
      A few fixes:
       * -O3 enablement fallout, thanks to Arnd who ran this
       * fixes for a few leaks, thanks to Felix
       * channel 12 regulatory fix for custom regdomains
       * check for a crash reported by syzbot
         (NULL function is called on drivers that don't have it)
       * fix TKIP replay protection after setup with some APs
         (from Jouni)
       * restrict obtaining some mesh data to avoid WARN_ONs
       * fix deadlocks with auto-disconnect (socket owner)
       * fix radar detection events with multiple devices
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      eb507906
    • Felix Fietkau's avatar
      cfg80211: fix page refcount issue in A-MSDU decap · 81c044fc
      Felix Fietkau authored
      The fragments attached to a skb can be part of a compound page. In that case,
      page_ref_inc will increment the refcount for the wrong page. Fix this by
      using get_page instead, which calls page_ref_inc on the compound head and
      also checks for overflow.
      
      Fixes: 2b67f944 ("cfg80211: reuse existing page fragments in A-MSDU rx")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
      Link: https://lore.kernel.org/r/20200113182107.20461-1-nbd@nbd.nameSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      81c044fc
    • Johannes Berg's avatar
      cfg80211: check for set_wiphy_params · 24953de0
      Johannes Berg authored
      Check if set_wiphy_params is assigned and return an error if not,
      some drivers (e.g. virt_wifi where syzbot reported it) don't have
      it.
      
      Reported-by: syzbot+e8a797964a4180eb57d5@syzkaller.appspotmail.com
      Reported-by: syzbot+34b582cf32c1db008f8e@syzkaller.appspotmail.com
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Link: https://lore.kernel.org/r/20200113125358.ac07f276efff.Ibd85ee1b12e47b9efb00a2adc5cd3fac50da791a@changeidSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      24953de0
    • Felix Fietkau's avatar
      cfg80211: fix memory leak in cfg80211_cqm_rssi_update · df16737d
      Felix Fietkau authored
      The per-tid statistics need to be released after the call to rdev_get_station
      
      Cc: stable@vger.kernel.org
      Fixes: 8689c051 ("cfg80211: dynamically allocate per-tid stats for station info")
      Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
      Link: https://lore.kernel.org/r/20200108170630.33680-2-nbd@nbd.nameSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      df16737d
    • Felix Fietkau's avatar
      cfg80211: fix memory leak in nl80211_probe_mesh_link · 2a279b34
      Felix Fietkau authored
      The per-tid statistics need to be released after the call to rdev_get_station
      
      Cc: stable@vger.kernel.org
      Fixes: 5ab92e7f ("cfg80211: add support to probe unexercised mesh link")
      Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
      Link: https://lore.kernel.org/r/20200108170630.33680-1-nbd@nbd.nameSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      2a279b34
    • Markus Theil's avatar
      cfg80211: fix deadlocks in autodisconnect work · 5a128a08
      Markus Theil authored
      Use methods which do not try to acquire the wdev lock themselves.
      
      Cc: stable@vger.kernel.org
      Fixes: 37b1c004 ("cfg80211: Support all iftypes in autodisconnect_wk")
      Signed-off-by: default avatarMarkus Theil <markus.theil@tu-ilmenau.de>
      Link: https://lore.kernel.org/r/20200108115536.2262-1-markus.theil@tu-ilmenau.deSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      5a128a08
    • Arnd Bergmann's avatar
      wireless: wext: avoid gcc -O3 warning · e1611965
      Arnd Bergmann authored
      After the introduction of CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3,
      the wext code produces a bogus warning:
      
      In function 'iw_handler_get_iwstats',
          inlined from 'ioctl_standard_call' at net/wireless/wext-core.c:1015:9,
          inlined from 'wireless_process_ioctl' at net/wireless/wext-core.c:935:10,
          inlined from 'wext_ioctl_dispatch.part.8' at net/wireless/wext-core.c:986:8,
          inlined from 'wext_handle_ioctl':
      net/wireless/wext-core.c:671:3: error: argument 1 null where non-null expected [-Werror=nonnull]
         memcpy(extra, stats, sizeof(struct iw_statistics));
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      In file included from arch/x86/include/asm/string.h:5,
      net/wireless/wext-core.c: In function 'wext_handle_ioctl':
      arch/x86/include/asm/string_64.h:14:14: note: in a call to function 'memcpy' declared here
      
      The problem is that ioctl_standard_call() sometimes calls the handler
      with a NULL argument that would cause a problem for iw_handler_get_iwstats.
      However, iw_handler_get_iwstats never actually gets called that way.
      
      Marking that function as noinline avoids the warning and leads
      to slightly smaller object code as well.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Link: https://lore.kernel.org/r/20200107200741.3588770-1-arnd@arndb.deSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      e1611965
    • Jouni Malinen's avatar
      mac80211: Fix TKIP replay protection immediately after key setup · 6f601265
      Jouni Malinen authored
      TKIP replay protection was skipped for the very first frame received
      after a new key is configured. While this is potentially needed to avoid
      dropping a frame in some cases, this does leave a window for replay
      attacks with group-addressed frames at the station side. Any earlier
      frame sent by the AP using the same key would be accepted as a valid
      frame and the internal RSC would then be updated to the TSC from that
      frame. This would allow multiple previously transmitted group-addressed
      frames to be replayed until the next valid new group-addressed frame
      from the AP is received by the station.
      
      Fix this by limiting the no-replay-protection exception to apply only
      for the case where TSC=0, i.e., when this is for the very first frame
      protected using the new key, and the local RSC had not been set to a
      higher value when configuring the key (which may happen with GTK).
      Signed-off-by: default avatarJouni Malinen <j@w1.fi>
      Link: https://lore.kernel.org/r/20200107153545.10934-1-j@w1.fiSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      6f601265
    • Orr Mazor's avatar
      cfg80211: Fix radar event during another phy CAC · 26ec17a1
      Orr Mazor authored
      In case a radar event of CAC_FINISHED or RADAR_DETECTED
      happens during another phy is during CAC we might need
      to cancel that CAC.
      
      If we got a radar in a channel that another phy is now
      doing CAC on then the CAC should be canceled there.
      
      If, for example, 2 phys doing CAC on the same channels,
      or on comptable channels, once on of them will finish his
      CAC the other might need to cancel his CAC, since it is no
      longer relevant.
      
      To fix that the commit adds an callback and implement it in
      mac80211 to end CAC.
      This commit also adds a call to said callback if after a radar
      event we see the CAC is no longer relevant
      Signed-off-by: default avatarOrr Mazor <Orr.Mazor@tandemg.com>
      Reviewed-by: default avatarSergey Matyukevich <sergey.matyukevich.os@quantenna.com>
      Link: https://lore.kernel.org/r/20191222145449.15792-1-Orr.Mazor@tandemg.com
      [slightly reformat/reword commit message]
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      26ec17a1
    • Ganapathi Bhat's avatar
      wireless: fix enabling channel 12 for custom regulatory domain · c4b9d655
      Ganapathi Bhat authored
      Commit e33e2241 ("Revert "cfg80211: Use 5MHz bandwidth by
      default when checking usable channels"") fixed a broken
      regulatory (leaving channel 12 open for AP where not permitted).
      Apply a similar fix to custom regulatory domain processing.
      Signed-off-by: default avatarCathy Luo <xiaohua.luo@nxp.com>
      Signed-off-by: default avatarGanapathi Bhat <ganapathi.bhat@nxp.com>
      Link: https://lore.kernel.org/r/1576836859-8945-1-git-send-email-ganapathi.bhat@nxp.com
      [reword commit message, fix coding style, add a comment]
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      c4b9d655
    • Lorenzo Bianconi's avatar
      net: mvneta: fix dma sync size in mvneta_run_xdp · 8c4df83f
      Lorenzo Bianconi authored
      Page pool API will start syncing (if requested) starting from
      page->dma_addr + pool->p.offset. Fix dma sync length in
      mvneta_run_xdp since we do not need to account xdp headroom
      
      Fixes: 07e13edb ("net: mvneta: get rid of huge dma sync in mvneta_rx_refill")
      Signed-off-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
      Acked-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8c4df83f
    • Johan Hovold's avatar
      r8152: add missing endpoint sanity check · 86f3f4cd
      Johan Hovold authored
      Add missing endpoint sanity check to probe in order to prevent a
      NULL-pointer dereference (or slab out-of-bounds access) when retrieving
      the interrupt-endpoint bInterval on ndo_open() in case a device lacks
      the expected endpoints.
      
      Fixes: 40a82917 ("net/usb/r8152: enable interrupt transfer")
      Cc: hayeswang <hayeswang@realtek.com>
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      86f3f4cd
  2. 14 Jan, 2020 6 commits
    • Sunil Muthuswamy's avatar
      hv_sock: Remove the accept port restriction · c742c59e
      Sunil Muthuswamy authored
      Currently, hv_sock restricts the port the guest socket can accept
      connections on. hv_sock divides the socket port namespace into two parts
      for server side (listening socket), 0-0x7FFFFFFF & 0x80000000-0xFFFFFFFF
      (there are no restrictions on client port namespace). The first part
      (0-0x7FFFFFFF) is reserved for sockets where connections can be accepted.
      The second part (0x80000000-0xFFFFFFFF) is reserved for allocating ports
      for the peer (host) socket, once a connection is accepted.
      This reservation of the port namespace is specific to hv_sock and not
      known by the generic vsock library (ex: af_vsock). This is problematic
      because auto-binds/ephemeral ports are handled by the generic vsock
      library and it has no knowledge of this port reservation and could
      allocate a port that is not compatible with hv_sock (and legitimately so).
      The issue hasn't surfaced so far because the auto-bind code of vsock
      (__vsock_bind_stream) prior to the change 'VSOCK: bind to random port for
      VMADDR_PORT_ANY' would start walking up from LAST_RESERVED_PORT (1023) and
      start assigning ports. That will take a large number of iterations to hit
      0x7FFFFFFF. But, after the above change to randomize port selection, the
      issue has started coming up more frequently.
      There has really been no good reason to have this port reservation logic
      in hv_sock from the get go. Reserving a local port for peer ports is not
      how things are handled generally. Peer ports should reflect the peer port.
      This fixes the issue by lifting the port reservation, and also returns the
      right peer port. Since the code converts the GUID to the peer port (by
      using the first 4 bytes), there is a possibility of conflicts, but that
      seems like a reasonable risk to take, given this is limited to vsock and
      that only applies to all local sockets.
      Signed-off-by: default avatarSunil Muthuswamy <sunilmut@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c742c59e
    • Eric Dumazet's avatar
      net: usb: lan78xx: limit size of local TSO packets · f8d7408a
      Eric Dumazet authored
      lan78xx_tx_bh() makes sure to not exceed MAX_SINGLE_PACKET_SIZE
      bytes in the aggregated packets it builds, but does
      nothing to prevent large GSO packets being submitted.
      
      Pierre-Francois reported various hangs when/if TSO is enabled.
      
      For localy generated packets, we can use netif_set_gso_max_size()
      to limit the size of TSO packets.
      
      Note that forwarded packets could still hit the issue,
      so a complete fix might require implementing .ndo_features_check
      for this driver, forcing a software segmentation if the size
      of the TSO packet exceeds MAX_SINGLE_PACKET_SIZE.
      
      Fixes: 55d7de9d ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarRENARD Pierre-Francois <pfrenard@gmail.com>
      Tested-by: default avatarRENARD Pierre-Francois <pfrenard@gmail.com>
      Cc: Stefan Wahren <stefan.wahren@i2se.com>
      Cc: Woojung Huh <woojung.huh@microchip.com>
      Cc: Microchip Linux Driver Support <UNGLinuxDriver@microchip.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f8d7408a
    • Vladis Dronov's avatar
      ptp: free ptp device pin descriptors properly · 75718584
      Vladis Dronov authored
      There is a bug in ptp_clock_unregister(), where ptp_cleanup_pin_groups()
      first frees ptp->pin_{,dev_}attr, but then posix_clock_unregister() needs
      them to destroy a related sysfs device.
      
      These functions can not be just swapped, as posix_clock_unregister() frees
      ptp which is needed in the ptp_cleanup_pin_groups(). Fix this by calling
      ptp_cleanup_pin_groups() in ptp_clock_release(), right before ptp is freed.
      
      This makes this patch fix an UAF bug in a patch which fixes an UAF bug.
      Reported-by: default avatarAntti Laakso <antti.laakso@intel.com>
      Fixes: a33121e5 ("ptp: fix the race between the release of ptp_clock and cdev")
      Link: https://lore.kernel.org/netdev/3d2bd09735dbdaf003585ca376b7c1e5b69a19bd.camel@intel.com/Signed-off-by: default avatarVladis Dronov <vdronov@redhat.com>
      Acked-by: default avatarRichard Cochran <richardcochran@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      75718584
    • Johan Hovold's avatar
      NFC: pn533: fix bulk-message timeout · a112adaf
      Johan Hovold authored
      The driver was doing a synchronous uninterruptible bulk-transfer without
      using a timeout. This could lead to the driver hanging on probe due to a
      malfunctioning (or malicious) device until the device is physically
      disconnected. While sleeping in probe the driver prevents other devices
      connected to the same hub from being added to (or removed from) the bus.
      
      An arbitrary limit of five seconds should be more than enough.
      
      Fixes: dbafc289 ("NFC: pn533: don't send USB data off of the stack")
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Reviewed-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      a112adaf
    • Kristian Evensen's avatar
      qmi_wwan: Add support for Quectel RM500Q · a9ff44f0
      Kristian Evensen authored
      RM500Q is a 5G module from Quectel, supporting both standalone and
      non-standalone modes. The normal Quectel quirks apply (DTR and dynamic
      interface numbers).
      Signed-off-by: default avatarKristian Evensen <kristian.evensen@gmail.com>
      Acked-by: default avatarBjørn Mork <bjorn@mork.no>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      a9ff44f0
    • Milind Parab's avatar
      net: macb: fix for fixed-link mode · fd2a8914
      Milind Parab authored
      This patch fix the issue with fixed link. With fixed-link
      device opening fails due to macb_phylink_connect not
      handling fixed-link mode, in which case no MAC-PHY connection
      is needed and phylink_connect return success (0), however
      in current driver attempt is made to search and connect to
      PHY even for fixed-link.
      
      Fixes: 7897b071 ("net: macb: convert to phylink")
      Signed-off-by: default avatarMilind Parab <mparab@cadence.com>
      Reviewed-by: default avatarClaudiu Beznea <claudiu.beznea@microchip.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      fd2a8914
  3. 11 Jan, 2020 7 commits
  4. 10 Jan, 2020 5 commits