1. 29 Jun, 2018 3 commits
    • Daniel Borkmann's avatar
      bpf: undo prog rejection on read-only lock failure · 85782e03
      Daniel Borkmann authored
      Partially undo commit 9facc336 ("bpf: reject any prog that failed
      read-only lock") since it caused a regression, that is, syzkaller was
      able to manage to cause a panic via fault injection deep in set_memory_ro()
      path by letting an allocation fail: In x86's __change_page_attr_set_clr()
      it was able to change the attributes of the primary mapping but not in
      the alias mapping via cpa_process_alias(), so the second, inner call
      to the __change_page_attr() via __change_page_attr_set_clr() had to split
      a larger page and failed in the alloc_pages() with the artifically triggered
      allocation error which is then propagated down to the call site.
      
      Thus, for set_memory_ro() this means that it returned with an error, but
      from debugging a probe_kernel_write() revealed EFAULT on that memory since
      the primary mapping succeeded to get changed. Therefore the subsequent
      hdr->locked = 0 reset triggered the panic as it was performed on read-only
      memory, so call-site assumptions were infact wrong to assume that it would
      either succeed /or/ not succeed at all since there's no such rollback in
      set_memory_*() calls from partial change of mappings, in other words, we're
      left in a state that is "half done". A later undo via set_memory_rw() is
      succeeding though due to matching permissions on that part (aka due to the
      try_preserve_large_page() succeeding). While reproducing locally with
      explicitly triggering this error, the initial splitting only happens on
      rare occasions and in real world it would additionally need oom conditions,
      but that said, it could partially fail. Therefore, it is definitely wrong
      to bail out on set_memory_ro() error and reject the program with the
      set_memory_*() semantics we have today. Shouldn't have gone the extra mile
      since no other user in tree today infact checks for any set_memory_*()
      errors, e.g. neither module_enable_ro() / module_disable_ro() for module
      RO/NX handling which is mostly default these days nor kprobes core with
      alloc_insn_page() / free_insn_page() as examples that could be invoked long
      after bootup and original 314beb9b ("x86: bpf_jit_comp: secure bpf jit
      against spraying attacks") did neither when it got first introduced to BPF
      so "improving" with bailing out was clearly not right when set_memory_*()
      cannot handle it today.
      
      Kees suggested that if set_memory_*() can fail, we should annotate it with
      __must_check, and all callers need to deal with it gracefully given those
      set_memory_*() markings aren't "advisory", but they're expected to actually
      do what they say. This might be an option worth to move forward in future
      but would at the same time require that set_memory_*() calls from supporting
      archs are guaranteed to be "atomic" in that they provide rollback if part
      of the range fails, once that happened, the transition from RW -> RO could
      be made more robust that way, while subsequent RO -> RW transition /must/
      continue guaranteeing to always succeed the undo part.
      
      Reported-by: syzbot+a4eb8c7766952a1ca872@syzkaller.appspotmail.com
      Reported-by: syzbot+d866d1925855328eac3b@syzkaller.appspotmail.com
      Fixes: 9facc336 ("bpf: reject any prog that failed read-only lock")
      Cc: Laura Abbott <labbott@redhat.com>
      Cc: Kees Cook <keescook@chromium.org>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      85782e03
    • Daniel Borkmann's avatar
      bpf, s390: fix potential memleak when later bpf_jit_prog fails · f605ce5e
      Daniel Borkmann authored
      If we would ever fail in the bpf_jit_prog() pass that writes the
      actual insns to the image after we got header via bpf_jit_binary_alloc()
      then we also need to make sure to free it through bpf_jit_binary_free()
      again when bailing out. Given we had prior bpf_jit_prog() passes to
      initially probe for clobbered registers, program size and to fill in
      addrs arrray for jump targets, this is more of a theoretical one,
      but at least make sure this doesn't break with future changes.
      
      Fixes: 05462310 ("s390/bpf: Add s390x eBPF JIT compiler backend")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      f605ce5e
    • Daniel Borkmann's avatar
      bpf, arm32: fix to use bpf_jit_binary_lock_ro api · 18d405af
      Daniel Borkmann authored
      Any eBPF JIT that where its underlying arch supports ARCH_HAS_SET_MEMORY
      would need to use bpf_jit_binary_{un,}lock_ro() pair instead of the
      set_memory_{ro,rw}() pair directly as otherwise changes to the former
      might break. arm32's eBPF conversion missed to change it, so fix this
      up here.
      
      Fixes: 39c13c20 ("arm: eBPF JIT compiler")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      18d405af
  2. 28 Jun, 2018 2 commits
  3. 26 Jun, 2018 4 commits
  4. 25 Jun, 2018 1 commit
    • Jakub Kicinski's avatar
      nfp: bpf: don't stop offload if replace failed · 68d676a0
      Jakub Kicinski authored
      Stopping offload completely if replace of program failed dates
      back to days of transparent offload.  Back then we wanted to
      silently fall back to the in-driver processing.  Today we mark
      programs for offload when they are loaded into the kernel, so
      the transparent offload is no longer a reality.
      
      Flags check in the driver will only allow replace of a driver
      program with another driver program or an offload program with
      another offload program.
      
      When driver program is replaced stopping offload is a no-op,
      because driver program isn't offloaded.  When replacing
      offloaded program if the offload fails the entire operation
      will fail all the way back to user space and we should continue
      using the old program.  IOW when replacing a driver program
      stopping offload is unnecessary and when replacing offloaded
      program - it's a bug, old program should continue to run.
      
      In practice this bug would mean that if offload operation was to
      fail (either due to FW communication error, kernel OOM or new
      program being offloaded but for a different netdev) driver
      would continue reporting that previous XDP program is offloaded
      but in fact no program will be loaded in hardware.  The failure
      is fairly unlikely (found by inspection, when working on the code)
      but it's unpleasant.
      
      Backport note: even though the bug was introduced in commit
      cafa92ac ("nfp: bpf: add support for XDP_FLAGS_HW_MODE"),
      this fix depends on commit 441a3303 ("net: xdp: don't allow
      device-bound programs in driver mode"), so this fix is sufficient
      only in v4.15 or newer.  Kernels v4.13.x and v4.14.x do need to
      stop offload if it was transparent/opportunistic, i.e. if
      XDP_FLAGS_HW_MODE was not set on running program.
      
      Fixes: cafa92ac ("nfp: bpf: add support for XDP_FLAGS_HW_MODE")
      Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      Reviewed-by: default avatarQuentin Monnet <quentin.monnet@netronome.com>
      Acked-by: default avatarSong Liu <songliubraving@fb.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      68d676a0
  5. 21 Jun, 2018 16 commits
  6. 20 Jun, 2018 14 commits
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · 1abd8a8f
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
       "Here are eight fairly small fixes collected over the last two weeks.
      
        Regression and crashing bug fixes:
      
         - mlx4/5: Fixes for issues found from various checkers
      
         - A resource tracking and uverbs regression in the core code
      
         - qedr: NULL pointer regression found during testing
      
         - rxe: Various small bugs"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        IB/rxe: Fix missing completion for mem_reg work requests
        RDMA/core: Save kernel caller name when creating CQ using ib_create_cq()
        IB/uverbs: Fix ordering of ucontext check in ib_uverbs_write
        IB/mlx4: Fix an error handling path in 'mlx4_ib_rereg_user_mr()'
        RDMA/qedr: Fix NULL pointer dereference when running over iWARP without RDMA-CM
        IB/mlx5: Fix return value check in flow_counters_set_data()
        IB/mlx5: Fix memory leak in mlx5_ib_create_flow
        IB/rxe: avoid double kfree skb
      1abd8a8f
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · d8894a08
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix crash on bpf_prog_load() errors, from Daniel Borkmann.
      
       2) Fix ATM VCC memory accounting, from David Woodhouse.
      
       3) fib6_info objects need RCU freeing, from Eric Dumazet.
      
       4) Fix SO_BINDTODEVICE handling for TCP sockets, from David Ahern.
      
       5) Fix clobbered error code in enic_open() failure path, from
          Govindarajulu Varadarajan.
      
       6) Propagate dev_get_valid_name() error returns properly, from Li
          RongQing.
      
       7) Fix suspend/resume in davinci_emac driver, from Bartosz Golaszewski.
      
       8) Various act_ife fixes (recursive locking, IDR leaks, etc.) from
          Davide Caratti.
      
       9) Fix buggy checksum handling in sungem driver, from Eric Dumazet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (40 commits)
        ip: limit use of gso_size to udp
        stmmac: fix DMA channel hang in half-duplex mode
        net: stmmac: socfpga: add additional ocp reset line for Stratix10
        net: sungem: fix rx checksum support
        bpfilter: ignore binary files
        bpfilter: fix build error
        net/usb/drivers: Remove useless hrtimer_active check
        net/sched: act_ife: preserve the action control in case of error
        net/sched: act_ife: fix recursive lock and idr leak
        net: ethernet: fix suspend/resume in davinci_emac
        net: propagate dev_get_valid_name return code
        enic: do not overwrite error code
        net/tcp: Fix socket lookups with SO_BINDTODEVICE
        ptp: replace getnstimeofday64() with ktime_get_real_ts64()
        net/ipv6: respect rcu grace period before freeing fib6_info
        net: net_failover: fix typo in net_failover_slave_register()
        ipvlan: use ETH_MAX_MTU as max mtu
        net: hamradio: use eth_broadcast_addr
        enic: initialize enic->rfs_h.lock in enic_probe
        MAINTAINERS: Add Sam as the maintainer for NCSI
        ...
      d8894a08
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid · 81e97f01
      Linus Torvalds authored
      Pull HID fixes from Jiri Kosina:
      
       - Wacom 2nd-gen Intuos Pro large Y axis handling fix from Jason Gerecke
      
       - fix for hibernation in Intel ISH driver, from Even Xu
      
       - crash fix for hid-steam driver, from Rodrigo Rivas Costa
      
       - new device ID addition to google-hammer driver
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
        HID: wacom: Correct logical maximum Y for 2nd-gen Intuos Pro large
        HID: intel_ish-hid: ipc: register more pm callbacks to support hibernation
        HID: steam: use hid_device.driver_data instead of hid_set_drvdata()
        HID: google: Add support for whiskers
      81e97f01
    • Linus Torvalds's avatar
      Merge tag 'dma-rename-4.18' of git://git.infradead.org/users/hch/dma-mapping · 6d90eb7b
      Linus Torvalds authored
      Pull dma-mapping rename from Christoph Hellwig:
       "Move all the dma-mapping code to kernel/dma and lose their dma-*
        prefixes"
      
      * tag 'dma-rename-4.18' of git://git.infradead.org/users/hch/dma-mapping:
        dma-mapping: move all DMA mapping code to kernel/dma
        dma-mapping: use obj-y instead of lib-y for generic dma ops
      6d90eb7b
    • Jason Gerecke's avatar
      HID: wacom: Correct logical maximum Y for 2nd-gen Intuos Pro large · d471b6b2
      Jason Gerecke authored
      The HID descriptor for the 2nd-gen Intuos Pro large (PTH-860) contains
      a typo which defines an incorrect logical maximum Y value. This causes
      a small portion of the bottom of the tablet to become unusable (both
      because the area is below the "bottom" of the tablet and because
      'wacom_wac_event' ignores out-of-range values). It also results in a
      skewed aspect ratio.
      
      To fix this, we add a quirk to 'wacom_usage_mapping' which overwrites
      the data with the correct value.
      Signed-off-by: default avatarJason Gerecke <jason.gerecke@wacom.com>
      CC: stable@vger.kernel.org # v4.10+
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      d471b6b2
    • Even Xu's avatar
      HID: intel_ish-hid: ipc: register more pm callbacks to support hibernation · ebeaa367
      Even Xu authored
      Current ISH driver only registers suspend/resume PM callbacks which don't
      support hibernation (suspend to disk). Basically after hiberation, the ISH
      can't resume properly and user may not see sensor events (for example: screen
      		rotation may not work).
      
      User will not see a crash or panic or anything except the following message
      in log:
      
      	hid-sensor-hub 001F:8086:22D8.0001: timeout waiting for response from ISHTP device
      
      So this patch adds support for S4/hiberbation to ISH by using the
      SIMPLE_DEV_PM_OPS() MACRO instead of struct dev_pm_ops directly. The suspend
      and resume functions will now be used for both suspend to RAM and hibernation.
      
      If power management is disabled, SIMPLE_DEV_PM_OPS will do nothing, the suspend
      and resume related functions won't be used, so mark them as __maybe_unused to
      clarify that this is the intended behavior, and remove #ifdefs for power
      management.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarEven Xu <even.xu@intel.com>
      Acked-by: default avatarSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      ebeaa367
    • Rodrigo Rivas Costa's avatar
      HID: steam: use hid_device.driver_data instead of hid_set_drvdata() · 4bff980f
      Rodrigo Rivas Costa authored
      When creating the low-level hidraw device, the reference to steam_device
      was stored using hid_set_drvdata(). But this value is not guaranteed to
      be kept when set before calling probe. If this pointer is reset, it
      crashes when opening the emulated hidraw device.
      
      It looks like hid_set_drvdata() is for users "avobe" this hid_device,
      while hid_device.driver_data it for users "below" this one.
      
      In this case, we are creating a virtual hidraw device, so we must use
      hid_device.driver_data.
      Signed-off-by: default avatarRodrigo Rivas Costa <rodrigorivascosta@gmail.com>
      Tested-by: default avatarMariusz Ceier <mceier+kernel@gmail.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      4bff980f
    • Linus Torvalds's avatar
      proc: fix missing final NUL in get_mm_cmdline() rewrite · f5b65348
      Linus Torvalds authored
      The rewrite of the cmdline fetching missed the fact that we used to also
      return the final terminating NUL character of the last argument.  I
      hadn't noticed, and none of the tools I tested cared, but something
      obviously must care, because Michal Kubecek noticed the change in
      behavior.
      
      Tweak the "find the end" logic to actually include the NUL character,
      and once past the eend of argv, always start the strnlen() at the
      expected (original) argument end.
      
      This whole "allow people to rewrite their arguments in place" is a nasty
      hack and requires that odd slop handling at the end of the argv array,
      but it's our traditional model, so we continue to support it.
      Repored-and-bisected-by: default avatarMichal Kubecek <mkubecek@suse.cz>
      Reviewed-and-tested-by: default avatarMichal Kubecek <mkubecek@suse.cz>
      Cc: Alexey Dobriyan <adobriyan@gmail.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f5b65348
    • Willem de Bruijn's avatar
      ip: limit use of gso_size to udp · 9887cba1
      Willem de Bruijn authored
      The ipcm(6)_cookie field gso_size is set only in the udp path. The ip
      layer copies this to cork only if sk_type is SOCK_DGRAM. This check
      proved too permissive. Ping and l2tp sockets have the same type.
      
      Limit to sockets of type SOCK_DGRAM and protocol IPPROTO_UDP to
      exclude ping sockets.
      
      v1 -> v2
      - remove irrelevant whitespace changes
      
      Fixes: bec1f6f6 ("udp: generate gso with UDP_SEGMENT")
      Reported-by: default avatarMaciej Żenczykowski <maze@google.com>
      Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9887cba1
    • Bhadram Varka's avatar
      stmmac: fix DMA channel hang in half-duplex mode · b6cfffa7
      Bhadram Varka authored
      HW does not support Half-duplex mode in multi-queue
      scenario. Fix it by not advertising the Half-Duplex
      mode if multi-queue enabled.
      Signed-off-by: default avatarBhadram Varka <vbhadram@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b6cfffa7
    • Dinh Nguyen's avatar
      net: stmmac: socfpga: add additional ocp reset line for Stratix10 · bc8a2d9b
      Dinh Nguyen authored
      The Stratix10 platform has an additional reset line, OCP(Open Core Protocol),
      that also needs to get deasserted for the stmmac ethernet controller to work.
      Thus we need to update the Kconfig to include ARCH_STRATIX10 in order to build
      dwmac-socfpga.
      
      Also, remove the redundant check for the reset controller pointer. The
      reset driver already checks for the pointer and returns 0 if the pointer
      is NULL.
      Signed-off-by: default avatarDinh Nguyen <dinguyen@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bc8a2d9b
    • Eric Dumazet's avatar
      net: sungem: fix rx checksum support · 12b03558
      Eric Dumazet authored
      After commit 88078d98 ("net: pskb_trim_rcsum() and CHECKSUM_COMPLETE
      are friends"), sungem owners reported the infamous "eth0: hw csum failure"
      message.
      
      CHECKSUM_COMPLETE has in fact never worked for this driver, but this
      was masked by the fact that upper stacks had to strip the FCS, and
      therefore skb->ip_summed was set back to CHECKSUM_NONE before
      my recent change.
      
      Driver configures a number of bytes to skip when the chip computes
      the checksum, and for some reason only half of the Ethernet header
      was skipped.
      
      Then a second problem is that we should strip the FCS by default,
      unless the driver is updated to eventually support NETIF_F_RXFCS in
      the future.
      
      Finally, a driver should check if NETIF_F_RXCSUM feature is enabled
      or not, so that the admin can turn off rx checksum if wanted.
      
      Many thanks to Andreas Schwab and Mathieu Malaterre for their
      help in debugging this issue.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarMeelis Roos <mroos@linux.ee>
      Reported-by: default avatarMathieu Malaterre <malat@debian.org>
      Reported-by: default avatarAndreas Schwab <schwab@linux-m68k.org>
      Tested-by: default avatarAndreas Schwab <schwab@linux-m68k.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      12b03558
    • Matteo Croce's avatar
      bpfilter: ignore binary files · 8b26a06a
      Matteo Croce authored
      net/bpfilter/bpfilter_umh is a binary file generated when bpfilter is
      enabled, add it to .gitignore to avoid committing it.
      
      Fixes: d2ba09c1 ("net: add skeleton of bpfilter kernel module")
      Signed-off-by: default avatarMatteo Croce <mcroce@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8b26a06a
    • Matteo Croce's avatar
      bpfilter: fix build error · 421780fd
      Matteo Croce authored
      bpfilter Makefile assumes that the system locale is en_US, and the
      parsing of objdump output fails.
      Set LC_ALL=C and, while at it, rewrite the objdump parsing so it spawns
      only 2 processes instead of 7.
      
      Fixes: d2ba09c1 ("net: add skeleton of bpfilter kernel module")
      Signed-off-by: default avatarMatteo Croce <mcroce@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      421780fd