- Aug 10, 2022
-
-
Pablo Neira Ayuso authored
Update template to validate variable length extensions. This patch adds a new .ext_len[id] field to the template to store the expected extension length. This is used to sanity check the initialization of the variable length extension. Use PTR_ERR() in nft_set_elem_init() to report errors since, after this update, there are two reason why this might fail, either because of ENOMEM or insufficient room in the extension field (EINVAL). Kernels up until 7e6bc1f6 ("netfilter: nf_tables: stricter validation of element data") allowed to copy more data to the extension than was allocated. This ext_len field allows to validate if the destination has the correct size as additional check. Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org>
-
- Aug 09, 2022
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetoothJakub Kicinski authored
Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fixes various issues related to ISO channel/socket support - Fixes issues when building with C=1 - Fix cancel uninitilized work which blocks syzbot to run * tag 'for-net-2022-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: ISO: Fix not using the correct QoS Bluetooth: don't try to cancel uninitialized works at mgmt_index_removed() Bluetooth: ISO: Fix iso_sock_getsockopt for BT_DEFER_SETUP Bluetooth: MGMT: Fixes build warnings with C=1 Bluetooth: hci_event: Fix build warning with C=1 Bluetooth: ISO: Fix memory corruption Bluetooth: Fix null pointer deref on unexpected status event Bluetooth: ISO: Fix info leak in iso_sock_getsockopt() Bluetooth: hci_conn: Fix updating ISO QoS PHY Bluetooth: ISO: unlock on error path in iso_sock_setsockopt() Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression ==================== Link: https://lore.kernel.org/r/20220809001224.412807-1-luiz.dentz@gmail.com Signed-off-by:
Jakub Kicinski <kuba@kernel.org>
-
Alexandra Winter authored
Since commit e6e771b3 ("s390/qeth: detach netdevice while card is offline") there was a timing window during recovery, that qeth_query_card_info could be sent to the card, even before it was ready for it, leading to a failing card recovery. There is evidence that this window was hit, as not all callers of get_link_ksettings() check for netif_device_present. Use cached values in qeth_get_link_ksettings(), instead of calling qeth_query_card_info() and falling back to default values in case it fails. Link info is already updated when the card goes online, e.g. after STARTLAN (physical link up). Set the link info to default values, when the card goes offline or at STOPLAN (physical link down). A follow-on patch will improve values reported for link down. Fixes: e6e771b3 ("s390/qeth: detach netdevice while card is offline") Signed-off-by:
Alexandra Winter <wintera@linux.ibm.com> Reviewed-by:
Thorsten Winkler <twinkler@linux.ibm.com> Link: https://lore.kernel.org/r/20220805155714.59609-1-wintera@linux.ibm.com Signed-off-by:
-
Nikita Shubin authored
If CONFIG_NVMEM is not set of_nvmem_cell_get, of_nvmem_device_get functions will return ERR_PTR(-EOPNOTSUPP) and "failed to get nvmem cell io_impedance_ctrl" error would be reported despite "io_impedance_ctrl" is completely missing in Device Tree and we should use default values. Check -EOPNOTSUPP togather with -ENOENT to avoid this situation. Fixes: 5c2d0a6a ("net: phy: dp83867: implement support for io_impedance_ctrl nvmem cell") Signed-off-by:
Nikita Shubin <n.shubin@yadro.com> Acked-by:
Rasmus Villemoes <linux@rasmusvillemoes.dk> Reviewed-by:
Andrew Lunn <andrew@lunn.ch> Link: https://lore.kernel.org/r/20220805084843.24542-1-nikita.shubin@maquefel.me Signed-off-by:
-
Oleksij Rempel authored
In case master/slave clock role is not specified (which is default), the aneg registers will not be written. The visible impact of this is missing pause advertisement. So, rework genphy_c45_baset1_an_config_aneg() to be able to write advertisement registers even if clock role is unknown. Fixes: 3da8ffd8 ("net: phy: Add 10BASE-T1L support in phy-c45") Signed-off-by:
Oleksij Rempel <o.rempel@pengutronix.de> Reviewed-by:
-
Duoming Zhou authored
There are use-after-free bugs caused by tst_timer. The root cause is that there are no functions to stop tst_timer in idt77252_exit(). One of the possible race conditions is shown below: (thread 1) | (thread 2) | idt77252_init_one | init_card | fill_tst | mod_timer(&card->tst_timer, ...) idt77252_exit | (wait a time) | tst_timer | | ... kfree(card) // FREE | | card->soft_tst[e] // USE The idt77252_dev is deallocated in idt77252_exit() and used in timer handler. This patch adds del_timer_sync() in idt77252_exit() in order that the timer handler could be stopped before the idt77252_dev is deallocated. Fixes: 1da177e4 ("Linux-2.6.12-rc2") Signed-off-by:Duoming Zhou <duoming@zju.edu.cn> Link: https://lore.kernel.org/r/20220805070008.18007-1-duoming@zju.edu.cn Signed-off-by:
-
Vladimir Oltean authored
min_gate_len[tc] is supposed to track the shortest interval of continuously open gates for a traffic class. For example, in the following case: TC 76543210 t0 00000001b 200000 ns t1 00000010b 200000 ns min_gate_len[0] and min_gate_len[1] should be 200000, while min_gate_len[2-7] should be 0. However what happens is that min_gate_len[0] is 200000, but min_gate_len[1] ends up being 0 (despite gate_len[1] being 200000 at the point where the logic detects the gate close event for TC 1). The problem is that the code considers a "gate close" event whenever it sees that there is a 0 for that TC (essentially it's level rather than edge triggered). By doing that, any time a gate is seen as closed without having been open prior, gate_len, which is 0, will be written into min_gate_len. Once min_gate_len becomes 0, it's impossible for it to track anything higher than that (the length of actually open intervals). To fix this, we make the writing to min_gate_len[tc] be edge-triggered, which avoids writes for gates that are closed in consecutive intervals. However what this does is it makes us need to special-case the permanently closed gates at the end. Fixes: 55a515b1 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port") Signed-off-by:
Vladimir Oltean <vladimir.oltean@nxp.com> Link: https://lore.kernel.org/r/20220804202817.1677572-1-vladimir.oltean@nxp.com Signed-off-by:
-
Martin Schiller authored
When a userspace application starts a blocking connect(), a CALL REQUEST is sent, the t21 timer is started and the connect is waiting in x25_wait_for_connection_establishment(). If then for some reason the t21 timer expires before any reaction on the assigned logical channel (e.g. CALL ACCEPT, CLEAR REQUEST), there is sent a CLEAR REQUEST and timer t23 is started waiting for a CLEAR confirmation. If we now receive a CLEAR CONFIRMATION from the peer, x25_disconnect() is called in x25_state2_machine() with reason "0", which means "normal" call clearing. This is ok, but the parameter "reason" is used as sk->sk_err in x25_disconnect() and sock_error(sk) is evaluated in x25_wait_for_connection_establishment() to check if the call is still pending. As "0" is not rated as an error, the connect will stuck here forever. To fix this situation, also check if the sk->sk_state changed form TCP_SYN_SENT to TCP_CLOSE in the meantime, which is also done by x25_disconnect(). Signed-off-by:
Martin Schiller <ms@dev.tdt.de> Link: https://lore.kernel.org/r/20220805061810.10824-1-ms@dev.tdt.de Signed-off-by:
-
Jakub Kicinski authored
Gerhard Engleder says: ==================== tsnep: Two fixes for the driver Two simple bugfixes for tsnep driver. ==================== Link: https://lore.kernel.org/r/20220804183935.73763-1-gerhard@engleder-embedded.com Signed-off-by:
-
Gerhard Engleder authored
If tsnep_tx_map() fails, then tsnep_tx_unmap() shall start at the write index like tsnep_tx_map(). This is different to the normal operation. Thus, add an additional parameter to tsnep_tx_unmap() to enable start at different positions for successful TX and failed TX. Fixes: 403f69bb ("tsnep: Add TSN endpoint Ethernet MAC driver") Signed-off-by:
Gerhard Engleder <gerhard@engleder-embedded.com> Signed-off-by:
-
Gerhard Engleder authored
Kernel test robot found the following warning: drivers/net/ethernet/engleder/tsnep_main.c:1254:34: warning: 'tsnep_of_match' defined but not used [-Wunused-const-variable=] of_match_ptr() compiles into NULL if CONFIG_OF is disabled. tsnep_of_match exists always so use of of_match_ptr() is useless. Fix warning by dropping of_match_ptr(). Reported-by:
kernel test robot <lkp@intel.com> Signed-off-by:
-
Luiz Augusto von Dentz authored
This fixes using wrong QoS settings when attempting to send frames while acting as peripheral since the QoS settings in use are stored in hconn->iso_qos not in sk->qos, this is actually properly handled on getsockopt(BT_ISO_QOS) but not on iso_send_frame. Fixes: ccf74f23 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by:
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-
Tetsuo Handa authored
syzbot is reporting attempt to cancel uninitialized work at mgmt_index_removed() [1], for calling cancel_delayed_work_sync() without INIT_DELAYED_WORK() is not permitted. INIT_DELAYED_WORK() is called from mgmt_init_hdev() via chan->hdev_init() from hci_mgmt_cmd(), but cancel_delayed_work_sync() is unconditionally called from mgmt_index_removed(). Call cancel_delayed_work_sync() only if HCI_MGMT flag was set, for mgmt_init_hdev() sets HCI_MGMT flag when calling INIT_DELAYED_WORK(). Link: https://syzkaller.appspot.com/bug?extid=b8ddd338a8838e581b1c [1] Reported-by:
syzbot <syzbot+b8ddd338a8838e581b1c@syzkaller.appspotmail.com> Signed-off-by:
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Fixes: 0ef08313 ("Bluetooth: Convert delayed discov_off to hci_sync") Signed-off-by:
-
Luiz Augusto von Dentz authored
BT_DEFER_SETUP shall be considered valid for all states except for BT_CONNECTED as it is also used when initiated a connection rather then only for BT_BOUND and BT_LISTEN. Fixes: ccf74f23 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by:
-
Luiz Augusto von Dentz authored
This fixes the following warning when building with make C=1: net/bluetooth/mgmt.c:3821:29: warning: restricted __le16 degrades to integer net/bluetooth/mgmt.c:4625:9: warning: cast to restricted __le32 Fixes: 600a8749 ("Bluetooth: Implementation of MGMT_OP_SET_BLOCKED_KEYS.") Fixes: 4c54bf2b ("Bluetooth: Add get/set device flags mgmt op") Signed-off-by:
-
Luiz Augusto von Dentz authored
This fixes the following warning when build with make C=1: net/bluetooth/hci_event.c:337:15: warning: restricted __le16 degrades to integer Fixes: a9366120 ("Bluetooth: Process result of HCI Delete Stored Link Key command") Signed-off-by:
-
Luiz Augusto von Dentz authored
The following memory corruption can happen since iso_pinfo.base size did not account for its headers (4 bytes): net/bluetooth/eir.c 76 memcpy(&eir[eir_len], data, data_len); ^^^^^^^ ^^^^^^^^ 77 eir_len += data_len; 78 79 return eir_len; 80 } The "eir" buffer has 252 bytes and data_len is 252 but we do a memcpy() to &eir[4] so this can corrupt 4 bytes beyond the end of the buffer. Fixes: f764a6c2 ("Bluetooth: ISO: Add broadcast support") Signed-off-by:Dan Carpenter <dan.carpenter@oracle.com>
-
Soenke Huster authored
__hci_cmd_sync returns NULL if the controller responds with a status event. This is unexpected for the commands sent here, but on occurrence leads to null pointer dereferences and thus must be handled. Signed-off-by:
Soenke Huster <soenke.huster@eknoes.de> Signed-off-by:
-
Luiz Augusto von Dentz authored
The C standard rules for when struct holes are zeroed out are slightly weird. The existing assignments might initialize everything, but GCC is allowed to (and does sometimes) leave the struct holes uninitialized, so instead of using yet another variable and copy the QoS settings just use a pointer to the stored QoS settings. Fixes: ccf74f23 ("Bluetooth: Add BTPROTO_ISO socket type") Reported-by:
-
Luiz Augusto von Dentz authored
BT_ISO_QOS has different semantics when it comes to QoS PHY as it uses 0x00 to disable a direction but that value is invalid over HCI and sockets using DEFER_SETUP to connect may attempt to use hci_bind_cis multiple times in order to detect if the parameters have changed, so to fix the code will now just mirror the PHY for the parameters of HCI_OP_LE_SET_CIG_PARAMS and will not update the PHY of the socket leaving it disabled. Fixes: 26afbd82 ("Bluetooth: Add initial implementation of CIS connections") Signed-off-by:
-
Dan Carpenter authored
Call release_sock(sk); before returning on this error path. Fixes: ccf74f23 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by:
-
Luiz Augusto von Dentz authored
The patch d0be8347: "Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put" from Jul 21, 2022, leads to the following Smatch static checker warning: net/bluetooth/l2cap_core.c:1977 l2cap_global_chan_by_psm() error: we previously assumed 'c' could be null (see line 1996) Fixes: d0be8347 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put") Reported-by:
-
- Aug 08, 2022
-
-
Gao Feng authored
The commit d1361840 ("tcp: fix SO_RCVLOWAT and RCVBUF autotuning") add one new (struct proto_ops)->set_rcvlowat method so that a protocol can override the default setsockopt(SO_RCVLOWAT) behavior. The prior bpf codes don't check and invoke the protos's set_rcvlowat, now correct it. Signed-off-by:
Gao Feng <gfree.wind@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Xuan Zhuo authored
When we call xdp_convert_buff_to_frame() to get xdpf, if it returns NULL, we should check if xdp_page was allocated by xdp_linearize_page(). If it is newly allocated, it should be freed here alone. Just like any other "goto err_xdp". Fixes: 44fa2dbd ("xdp: transition into using xdp_frame for ndo_xdp_xmit") Signed-off-by:
Xuan Zhuo <xuanzhuo@linux.alibaba.com> Acked-by:
Jason Wang <jasowang@redhat.com> Signed-off-by:
-
- Aug 06, 2022
-
-
Nick Desaulniers authored
Fixes the following warnings observed when building CONFIG_IPV6_SEG6_LWTUNNEL=y with clang: net/ipv6/seg6_local.o: warning: objtool: seg6_local_fill_encap() falls through to next function seg6_local_get_encap_size() net/ipv6/seg6_local.o: warning: objtool: seg6_local_cmp_encap() falls through to next function input_action_end() LLVM can fully unroll loops in seg6_local_get_encap_size() and seg6_local_cmp_encap(). One issue in those loops is that the induction variable is initialized to 0. The loop iterates over members of seg6_action_params, a global array of struct seg6_action_param calling their put() function pointer members. seg6_action_param uses an array initializer to initialize SEG6_LOCAL_SRH and later elements, which is the third enumeration of an anonymous union. The guard `if (attrs & SEG6_F_ATTR(i))` may prevent this from being called at runtime, but it would still be UB for `seg6_action_params[0]->put` to be called; the unrolled loop will make the initial iterations unreachable, which LLVM will later rotate to fallthrough to the next function. Make this more obvious that this cannot happen to the compiler by initializing the loop induction variable to the minimum valid index that seg6_action_params is initialized to. Reported-by:
Thomas Gleixner <tglx@linutronix.de> Signed-off-by:
Nick Desaulniers <ndesaulniers@google.com> Link: https://lore.kernel.org/r/20220802161203.622293-1-ndesaulniers@google.com Signed-off-by:
-
Florian Fainelli authored
Avoid the PHY library call unnecessarily into the suspend/resume functions by setting phydev->mac_managed_pm to true. The GENET driver essentially does exactly what mdio_bus_phy_resume() does by calling phy_init_hw() plus phy_resume(). Fixes: fba863b8 ("net: phy: make PHY PM ops a no-op if MAC driver manages PHY PM") Signed-off-by:
Florian Fainelli <f.fainelli@gmail.com> Link: https://lore.kernel.org/r/20220804173605.1266574-1-f.fainelli@gmail.com Signed-off-by:
-
Jakub Kicinski authored
The text was copy&pasted from Intel, adjust it to say Wangxun. Reported-by:
Ingo Saitz <ingo@hannover.ccc.de> Fixes: 3ce7547e ("net: txgbe: Add build support for txgbe") Link: https://lore.kernel.org/r/20220804182641.1442000-1-kuba@kernel.org Signed-off-by:
-
Francois Romieu authored
rose /proc code does not serialize timer accesses. Initial report by Bernard F6BVP Pidoux exhibits overflow amounting to 116 ticks on its HZ=250 system. Full timer access serialization would imho be overkill as rose /proc does not enforce consistency between displayed ROSE_STATE_XYZ and timer values during changes of state. The patch may also fix similar behavior in ax25 /proc, ax25 ioctl and netrom /proc as they all exhibit the same timer serialization policy. This point has not been reported though. The sole remaining use of ax25_display_timer - ax25 rtt valuation - may also perform marginally better but I have not analyzed it too deeply. Cc: Thomas DL9SAU Osterried <thomas@osterried.de> Link: https://lore.kernel.org/all/d5e93cc7-a91f-13d3-49a1-b50c11f0f811@free.fr/ Signed-off-by:
Francois Romieu <romieu@fr.zoreil.com> Tested-by:
Bernard Pidoux <f6bvp@free.fr> Link: https://lore.kernel.org/r/Yuk9vq7t7VhmnOXu@electric-eye.fr.zoreil.com Signed-off-by:
-
Naveen Mamindlapalli authored
For packets scheduled to RPM and LBK, NIX_AF_PSE_CHANNEL_LEVEL[BP_LEVEL] selects the TL3 or TL2 scheduling level as the one used for link/channel selection and backpressure. For each scheduling queue at the selected level: Setting NIX_AF_TL3_TL2(0..255)_LINK(0..12)_CFG[ENA] = 1 allows the TL3/TL2 queue to schedule packets to a specified RPM or LBK link and channel. There is an issue in the code where NIX_AF_PSE_CHANNEL_LEVEL[BP_LEVEL] is set to TL3 where as the NIX_AF_TL3_TL2(0..255)_LINK(0..12)_CFG is configured for TL2 queue in some cases. As a result packets will not transmit on that link/channel. This patch fixes the issue by configuring the NIX_AF_TL3_TL2(0..255)_LINK(0..12)_CFG register depending on the NIX_AF_PSE_CHANNEL_LEVEL[BP_LEVEL] value. Fixes: caa2da34 ("octeontx2-pf: Initialize and config queues") Signed-off-by:
Naveen Mamindlapalli <naveenm@marvell.com> Signed-off-by:
Sunil Kovvuri Goutham <sgoutham@marvell.com> Link: https://lore.kernel.org/r/20220802142813.25031-1-naveenm@marvell.com Signed-off-by:
-
Jakub Kicinski authored
Subbaraya Sundeep says: ==================== Octeontx2 AF driver fixes for NPC This patchset includes AF driver fixes wrt packet parser NPC. Following are the changes: Patch 1: The parser nibble configuration must be same for TX and RX interfaces and if not fix up is applied. This fixup was applied only for default profile currently and it has been fixed to apply for all profiles. Patch 2: Firmware image may not be present all times in the kernel image and default profile is used mostly hence suppress the warning. Patch 3: This patch fixes a corner case where NIXLF is detached but without freeing its mcam entries which results in resource leak. Patch 4: SMAC is overlapped with DMAC mistakenly while installing rules based on SMAC. This patch fixes that. ==================== Link: https://lore.kernel.org/r/1659513255-28667-1-git-send-email-sbhatta@marvell.com Signed-off-by:
-
Subbaraya Sundeep authored
Given a field with its location/offset in input packet, the key checking logic verifies whether extracting the field can be supported or not based on the mkex profile loaded in hardware. This logic is wrong wrt source mac and this patch fixes that. Fixes: 9b179a96 ("octeontx2-af: Generate key field bit mask from KEX profile") Signed-off-by:
Subbaraya Sundeep <sbhatta@marvell.com> Signed-off-by:
-
Subbaraya Sundeep authored
The teardown sequence in FLR handler returns if no NIX LF is attached to PF/VF because it indicates that graceful shutdown of resources already happened. But there is a chance of all allocated MCAM entries not being freed by PF/VF. Hence free mcam entries even in case of detached LF. Fixes: c554f9c1 ("octeontx2-af: Teardown NPA, NIX LF upon receiving FLR") Signed-off-by:
-
Harman Kalra authored
The packet parser profile supplied as firmware may not be present all the time and default profile is used mostly. Hence suppress firmware loading warning from kernel due to absence of firmware in kernel image. Fixes: 3a724415 ("octeontx2-af: add support for custom KPU entries") Signed-off-by:
Harman Kalra <hkalra@marvell.com> Signed-off-by:
-
Stanislaw Kardach authored
NPC_PARSE_NIBBLE for TX interface has to be equal to the RX one for some silicon revisions. Mistakenly this fixup was only applied to the default MKEX profile while it should also be applied to any loaded profile. Fixes: 1c1935c9 ("octeontx2-af: Add NIX1 interfaces to NPC") Signed-off-by:
Stanislaw Kardach <skardach@marvell.com> Signed-off-by:
-
Nick Child authored
Add Nick Child as the maintainer of the IBM Power Virtual Ethernet Device Driver, replacing Cristobal Forno. Signed-off-by:
Nick Child <nnac123@linux.ibm.com> Link: https://lore.kernel.org/r/20220803155246.39582-1-nnac123@linux.ibm.com Signed-off-by:
-
Yang Li authored
bnxt_ethtool.h is included twice in bnxt_devlink.c, remove one of them. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=1817 Reported-by:
Abaci Robot <abaci@linux.alibaba.com> Signed-off-by:
Yang Li <yang.lee@linux.alibaba.com> Link: https://lore.kernel.org/r/20220804003722.54088-1-yang.lee@linux.alibaba.com Signed-off-by:
-
Jakub Kicinski authored
Florian Westphal says: ==================== netfilter followup fixes for net Regressions, since 5.19: Fix crash when packet tracing is enabled via 'meta nftrace set 1' rule. Also comes with a test case. Regressions, this cycle: Fix Kconfig dependency for the flowtable /proc interface, we want this to be off by default. ==================== Link: https://lore.kernel.org/r/20220804172629.29748-1-fw@strlen.de Signed-off-by:
-
Pablo Neira Ayuso authored
Remove default to 'y', this infrastructure is not fundamental for the flowtable operational. Add a missing dependency on CONFIG_NF_FLOW_TABLE. Reported-by:
Linus Torvalds <torvalds@linux-foundation.org> Fixes: b0381776 ("netfilter: nf_flow_table: count pending offload workqueue tasks") Signed-off-by:
Florian Westphal <fw@strlen.de> Signed-off-by:
-
Florian Westphal authored
Enable/disable tracing infrastructure while packets are in-flight. This triggers KASAN splat after e34b9ed9 ("netfilter: nf_tables: avoid skb access on nf_stolen"). While at it, reduce script run time as well. Signed-off-by:
-
Florian Westphal authored
do not access info->pkt when info->trace is not 1. nft_traceinfo is not initialized, except when tracing is enabled. The 'nft_trace_enabled' static key cannot be used for this, we must always check info->trace first. Pass nft_pktinfo directly to avoid this. Fixes: e34b9ed9 ("netfilter: nf_tables: avoid skb access on nf_stolen") Reported-by:
Hangbin Liu <liuhangbin@gmail.com> Signed-off-by:
-
