1. Aug 04, 2016
    • Jakub Kicinski's avatar
      bpf: fix method of PTR_TO_PACKET reg id generation · 1f415a74
      Jakub Kicinski authored
      Using per-register incrementing ID can lead to
      find_good_pkt_pointers() confusing registers which
      have completely different values.  Consider example:
      
      0: (bf) r6 = r1
      1: (61) r8 = *(u32 *)(r6 +76)
      2: (61) r0 = *(u32 *)(r6 +80)
      3: (bf) r7 = r8
      4: (07) r8 += 32
      5: (2d) if r8 > r0 goto pc+9
       R0=pkt_end R1=ctx R6=ctx R7=pkt(id=0,off=0,r=32) R8=pkt(id=0,off=32,r=32) R10=fp
      6: (bf) r8 = r7
      7: (bf) r9 = r7
      8: (71) r1 = *(u8 *)(r7 +0)
      9: (0f) r8 += r1
      10: (71) r1 = *(u8 *)(r7 +1)
      11: (0f) r9 += r1
      12: (07) r8 += 32
      13: (2d) if r8 > r0 goto pc+1
       R0=pkt_end R1=inv56 R6=ctx R7=pkt(id=0,off=0,r=32) R8=pkt(id=1,off=32,r=32) R9=pkt(id=1,off=0,r=32) R10=fp
      14: (71) r1 = *(u8 *)(r9 +16)
      15: (b7) r7 = 0
      16: (bf) r0 = r7
      17: (95) exit
      
      We need to get a UNKNOWN_VALUE with imm to force id
      generation so lines 0-5 make r7 a valid packet pointer.
      We then read two different bytes from the packet and
      add them to copies of the constructed packet pointer.
      r8 (line 9) and r9 (line 11) will get the same id of 1,
      independently.  When either of them is validated (line
      13) - find_good_pkt_pointers() will also mark the other
      as safe.  This leads to access on line 14 being mistakenly
      considered safe.
      
      Fixes: 969bf05e
      
       ("bpf: direct packet access")
      Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1f415a74
    • Arnd Bergmann's avatar
      net: xgene: fix maybe-uninitialized variable · ea966cb6
      Arnd Bergmann authored
      
      
      Building with -Wmaybe-uninitialized shows a potential use of
      an uninitialized variable:
      
      drivers/net/ethernet/apm/xgene/xgene_enet_hw.c: In function 'xgene_enet_phy_connect':
      drivers/net/ethernet/apm/xgene/xgene_enet_hw.c:802:23: warning: 'phy_dev' may be used uninitialized in this function [-Wmaybe-uninitialized]
      
      Although the compiler correctly identified this based on the function,
      the current code is still safe as long dev->of_node is non-NULL
      for the case of CONFIG_ACPI=n, which is currently the case.
      
      The warning is now disabled by default, but still appears when
      building with W=1, and other build test tools should be able to
      detect it as well. Adding an #else clause here makes the code
      more robust and makes it clear to the compiler that this cannot
      happen.
      
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Fixes: 8089a96f
      
       ("drivers: net: xgene: Add backward compatibility")
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ea966cb6
    • Jarno Rajahalme's avatar
      openvswitch: Remove incorrect WARN_ONCE(). · bce91f8a
      Jarno Rajahalme authored
      ovs_ct_find_existing() issues a warning if an existing conntrack entry
      classified as IP_CT_NEW is found, with the premise that this should
      not happen.  However, a newly confirmed, non-expected conntrack entry
      remains IP_CT_NEW as long as no reply direction traffic is seen.  This
      has resulted into somewhat confusing kernel log messages.  This patch
      removes this check and warning.
      
      Fixes: 289f2253
      
       ("openvswitch: Find existing conntrack entry after upcall.")
      Suggested-by: default avatarJoe Stringer <joe@ovn.org>
      Signed-off-by: default avatarJarno Rajahalme <jarno@ovn.org>
      Acked-by: default avatarJoe Stringer <joe@ovn.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bce91f8a
    • Linus Torvalds's avatar
      Merge tag 'trace-v4.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · bf0f500b
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
       "A few updates and fixes:
      
         - move the suppressing of the __builtin_return_address >0 warning to
           the tracing directory only.
      
         - metag recordmcount fix for newer glibc's
      
         - two tracing histogram fixes that were reported by KASAN"
      
      * tag 'trace-v4.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Fix use-after-free in hist_register_trigger()
        tracing: Fix use-after-free in hist_unreg_all/hist_enable_unreg_all
        Makefile: Mute warning for __builtin_return_address(>0) for tracing only
        ftrace/recordmcount: Work around for addition of metag magic but not relocations
      bf0f500b
    • Geert Uytterhoeven's avatar
      fs/proc: Add compiler check for -Wno-override-init to support gcc < 4.2 · 4b2e0162
      Geert Uytterhoeven authored
      With gcc < 4.2 (e.g. 4.1.2):
      
            CC      fs/proc/task_mmu.o
          cc1: error: unrecognized command line option "-Wno-override-init"
      
      To fix this, only enable the compiler option when it is actually
      supported by the compiler.
      
      Fixes: ca52953f
      
       ("fs/proc/task_mmu.c: suppress compilation warnings with W=1")
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Acked-by: default avatarValdis Kletnieks <valdis.kletnieks@vt.edu>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      4b2e0162
  2. Aug 03, 2016