Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1429319 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2016-06-23 01:30 +0200 |
| Last post | 2016-06-23 07:00 +0200 |
| Articles | 13 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH 3.14 00/29] 3.14.73-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
[PATCH 3.14 12/29] fix d_walk()/non-delayed __d_free() race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
[PATCH 3.14 14/29] powerpc/pseries/eeh: Handle RTAS delay requests in configure_bridge Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
[PATCH 3.14 21/29] netfilter: x_tables: validate targets of jumps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
Re: [PATCH 3.14 21/29] netfilter: x_tables: validate targets of jumps Florian Westphal <fw@strlen.de> - 2016-06-23 11:00 +0200
Re: [PATCH 3.14 21/29] netfilter: x_tables: validate targets of jumps Florian Westphal <fw@strlen.de> - 2016-06-23 11:20 +0200
[PATCH 3.14 02/29] sfc: on MC reset, clear PIO buffer linkage in TXQs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
[PATCH 3.14 15/29] netfilter: x_tables: validate e->target_offset early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
[PATCH 3.14 16/29] netfilter: x_tables: make sure e->next_offset covers remaining blob size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
[PATCH 3.14 08/29] powerpc: Use privileged SPR number for MMCR2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
[PATCH 3.14 09/29] parisc: Fix pagefault crash in unaligned __get_user() call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
[PATCH 3.14 11/29] wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:40 +0200
Re: [PATCH 3.14 00/29] 3.14.73-stable review -rc2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 07:00 +0200
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-06-23 01:30 +0200 |
| Subject | [PATCH 3.14 00/29] 3.14.73-stable review |
| Message-ID | <rMYYp-11q-3@gated-at.bofh.it> |
This is the start of the stable review cycle for the 3.14.73 release.
There are 29 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri Jun 24 22:35:07 UTC 2016.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.73-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 3.14.73-rc1
Florian Westphal <fw@strlen.de>
netfilter: x_tables: don't reject valid target size on some architectures
Florian Westphal <fw@strlen.de>
netfilter: x_tables: validate all offsets and sizes in a rule
Florian Westphal <fw@strlen.de>
netfilter: x_tables: check for bogus target offset
Florian Westphal <fw@strlen.de>
netfilter: x_tables: check standard target size too
Florian Westphal <fw@strlen.de>
netfilter: x_tables: add compat version of xt_check_entry_offsets
Florian Westphal <fw@strlen.de>
netfilter: x_tables: assert minimum target size
Florian Westphal <fw@strlen.de>
netfilter: x_tables: kill check_entry helper
Florian Westphal <fw@strlen.de>
netfilter: x_tables: add and use xt_check_entry_offsets
Florian Westphal <fw@strlen.de>
netfilter: x_tables: validate targets of jumps
Florian Westphal <fw@strlen.de>
netfilter: x_tables: don't move to non-existent next rule
Willy Tarreau <w@1wt.eu>
pipe: limit the per-user amount of pages allocated in pipes
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
xfs: fix up backport error in fs/xfs/xfs_inode.c
Florian Westphal <fw@strlen.de>
netfilter: x_tables: fix unconditional helper
Florian Westphal <fw@strlen.de>
netfilter: x_tables: make sure e->next_offset covers remaining blob size
Florian Westphal <fw@strlen.de>
netfilter: x_tables: validate e->target_offset early
Russell Currey <ruscur@russell.cc>
powerpc/pseries/eeh: Handle RTAS delay requests in configure_bridge
Ralf Baechle <ralf@linux-mips.org>
MIPS: Fix 64k page support for 32 bit kernels.
Al Viro <viro@zeniv.linux.org.uk>
fix d_walk()/non-delayed __d_free() race
Prasun Maiti <prasunmaiti87@gmail.com>
wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel
Jann Horn <jannh@google.com>
ecryptfs: forbid opening files without mmap handler
Helge Deller <deller@gmx.de>
parisc: Fix pagefault crash in unaligned __get_user() call
Thomas Huth <thuth@redhat.com>
powerpc: Use privileged SPR number for MMCR2
Thomas Huth <thuth@redhat.com>
powerpc: Fix definition of SIAR and SDAR registers
Tom Lendacky <thomas.lendacky@amd.com>
crypto: ccp - Fix AES XTS error for request sizes above 4096
Russell King <rmk+kernel@armlinux.org.uk>
ARM: fix PTRACE_SETVFPREGS on SMP systems
Paolo Bonzini <pbonzini@redhat.com>
KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS
Yuchung Cheng <ycheng@google.com>
tcp: record TLP and ER timer stats in v6 stats
Edward Cree <ecree@solarflare.com>
sfc: on MC reset, clear PIO buffer linkage in TXQs
Herbert Xu <herbert@gondor.apana.org.au>
netlink: Fix dump skb leak/double free
-------------
Diffstat:
Documentation/sysctl/fs.txt | 23 ++++
Makefile | 4 +-
arch/arm/kernel/ptrace.c | 2 +-
arch/mips/include/asm/processor.h | 2 +-
arch/parisc/kernel/unaligned.c | 10 +-
arch/powerpc/include/asm/reg.h | 6 +-
arch/powerpc/platforms/pseries/eeh_pseries.c | 51 ++++++---
arch/x86/kvm/x86.c | 5 +
drivers/crypto/ccp/ccp-crypto-aes-xts.c | 17 ++-
drivers/net/ethernet/sfc/ef10.c | 16 +++
fs/dcache.c | 4 +-
fs/ecryptfs/kthread.c | 13 ++-
fs/pipe.c | 47 +++++++-
fs/xfs/xfs_inode.c | 2 +-
include/linux/netfilter/x_tables.h | 7 ++
include/linux/pipe_fs_i.h | 4 +
include/linux/sched.h | 1 +
kernel/sysctl.c | 14 +++
net/ipv4/netfilter/arp_tables.c | 87 ++++++++-------
net/ipv4/netfilter/ip_tables.c | 90 ++++++++-------
net/ipv6/netfilter/ip6_tables.c | 90 ++++++++-------
net/ipv6/tcp_ipv6.c | 4 +-
net/netfilter/x_tables.c | 158 +++++++++++++++++++++++++++
net/netlink/af_netlink.c | 7 +-
net/wireless/wext-core.c | 25 ++++-
25 files changed, 528 insertions(+), 161 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-06-23 01:30 +0200 |
| Subject | [PATCH 3.14 12/29] fix d_walk()/non-delayed __d_free() race |
| Message-ID | <rMZKO-1BV-35@gated-at.bofh.it> |
| In reply to | #1429319 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 3d56c25e3bb0726a5c5e16fc2d9e38f8ed763085 upstream.
Ascend-to-parent logics in d_walk() depends on all encountered child
dentries not getting freed without an RCU delay. Unfortunately, in
quite a few cases it is not true, with hard-to-hit oopsable race as
the result.
Fortunately, the fix is simiple; right now the rule is "if it ever
been hashed, freeing must be delayed" and changing it to "if it
ever had a parent, freeing must be delayed" closes that hole and
covers all cases the old rule used to cover. Moreover, pipes and
sockets remain _not_ covered, so we do not introduce RCU delay in
the cases which are the reason for having that delay conditional
in the first place.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/dcache.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1500,7 +1500,7 @@ struct dentry *d_alloc(struct dentry * p
struct dentry *dentry = __d_alloc(parent->d_sb, name);
if (!dentry)
return NULL;
-
+ dentry->d_flags |= DCACHE_RCUACCESS;
spin_lock(&parent->d_lock);
/*
* don't need child lock because it is not subject
@@ -2352,7 +2352,6 @@ static void __d_rehash(struct dentry * e
{
BUG_ON(!d_unhashed(entry));
hlist_bl_lock(b);
- entry->d_flags |= DCACHE_RCUACCESS;
hlist_bl_add_head_rcu(&entry->d_hash, b);
hlist_bl_unlock(b);
}
@@ -2536,6 +2535,7 @@ static void __d_move(struct dentry * den
/* ... and switch the parents */
if (IS_ROOT(dentry)) {
+ dentry->d_flags |= DCACHE_RCUACCESS;
dentry->d_parent = target->d_parent;
target->d_parent = target;
INIT_LIST_HEAD(&target->d_child);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-06-23 01:30 +0200 |
| Subject | [PATCH 3.14 14/29] powerpc/pseries/eeh: Handle RTAS delay requests in configure_bridge |
| Message-ID | <rMZKO-1BV-41@gated-at.bofh.it> |
| In reply to | #1429319 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell Currey <ruscur@russell.cc>
commit 871e178e0f2c4fa788f694721a10b4758d494ce1 upstream.
In the "ibm,configure-pe" and "ibm,configure-bridge" RTAS calls, the
spec states that values of 9900-9905 can be returned, indicating that
software should delay for 10^x (where x is the last digit, i.e. 990x)
milliseconds and attempt the call again. Currently, the kernel doesn't
know about this, and respecting it fixes some PCI failures when the
hypervisor is busy.
The delay is capped at 0.2 seconds.
Cc: <stable@vger.kernel.org> # 3.10+
Signed-off-by: Russell Currey <ruscur@russell.cc>
Acked-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/eeh_pseries.c | 51 +++++++++++++++++++--------
1 file changed, 36 insertions(+), 15 deletions(-)
--- a/arch/powerpc/platforms/pseries/eeh_pseries.c
+++ b/arch/powerpc/platforms/pseries/eeh_pseries.c
@@ -615,29 +615,50 @@ static int pseries_eeh_configure_bridge(
{
int config_addr;
int ret;
+ /* Waiting 0.2s maximum before skipping configuration */
+ int max_wait = 200;
/* Figure out the PE address */
config_addr = pe->config_addr;
if (pe->addr)
config_addr = pe->addr;
- /* Use new configure-pe function, if supported */
- if (ibm_configure_pe != RTAS_UNKNOWN_SERVICE) {
- ret = rtas_call(ibm_configure_pe, 3, 1, NULL,
- config_addr, BUID_HI(pe->phb->buid),
- BUID_LO(pe->phb->buid));
- } else if (ibm_configure_bridge != RTAS_UNKNOWN_SERVICE) {
- ret = rtas_call(ibm_configure_bridge, 3, 1, NULL,
- config_addr, BUID_HI(pe->phb->buid),
- BUID_LO(pe->phb->buid));
- } else {
- return -EFAULT;
- }
+ while (max_wait > 0) {
+ /* Use new configure-pe function, if supported */
+ if (ibm_configure_pe != RTAS_UNKNOWN_SERVICE) {
+ ret = rtas_call(ibm_configure_pe, 3, 1, NULL,
+ config_addr, BUID_HI(pe->phb->buid),
+ BUID_LO(pe->phb->buid));
+ } else if (ibm_configure_bridge != RTAS_UNKNOWN_SERVICE) {
+ ret = rtas_call(ibm_configure_bridge, 3, 1, NULL,
+ config_addr, BUID_HI(pe->phb->buid),
+ BUID_LO(pe->phb->buid));
+ } else {
+ return -EFAULT;
+ }
+
+ if (!ret)
+ return ret;
+
+ /*
+ * If RTAS returns a delay value that's above 100ms, cut it
+ * down to 100ms in case firmware made a mistake. For more
+ * on how these delay values work see rtas_busy_delay_time
+ */
+ if (ret > RTAS_EXTENDED_DELAY_MIN+2 &&
+ ret <= RTAS_EXTENDED_DELAY_MAX)
+ ret = RTAS_EXTENDED_DELAY_MIN+2;
- if (ret)
- pr_warning("%s: Unable to configure bridge PHB#%d-PE#%x (%d)\n",
- __func__, pe->phb->global_number, pe->addr, ret);
+ max_wait -= rtas_busy_delay_time(ret);
+
+ if (max_wait < 0)
+ break;
+
+ rtas_busy_delay(ret);
+ }
+ pr_warn("%s: Unable to configure bridge PHB#%d-PE#%x (%d)\n",
+ __func__, pe->phb->global_number, pe->addr, ret);
return ret;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-06-23 01:30 +0200 |
| Subject | [PATCH 3.14 21/29] netfilter: x_tables: validate targets of jumps |
| Message-ID | <rMZKP-1BV-57@gated-at.bofh.it> |
| In reply to | #1429319 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 36472341017529e2b12573093cc0f68719300997 upstream.
When we see a jump also check that the offset gets us to beginning of
a rule (an ipt_entry).
The extra overhead is negible, even with absurd cases.
300k custom rules, 300k jumps to 'next' user chain:
[ plus one jump from INPUT to first userchain ]:
Before:
real 0m24.874s
user 0m7.532s
sys 0m16.076s
After:
real 0m27.464s
user 0m7.436s
sys 0m18.840s
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/netfilter/arp_tables.c | 16 ++++++++++++++++
net/ipv4/netfilter/ip_tables.c | 16 ++++++++++++++++
net/ipv6/netfilter/ip6_tables.c | 16 ++++++++++++++++
3 files changed, 48 insertions(+)
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -363,6 +363,18 @@ static inline bool unconditional(const s
memcmp(&e->arp, &uncond, sizeof(uncond)) == 0;
}
+static bool find_jump_target(const struct xt_table_info *t,
+ const struct arpt_entry *target)
+{
+ struct arpt_entry *iter;
+
+ xt_entry_foreach(iter, t->entries, t->size) {
+ if (iter == target)
+ return true;
+ }
+ return false;
+}
+
/* Figures out from what hook each rule can be called: returns 0 if
* there are loops. Puts hook bitmask in comefrom.
*/
@@ -456,6 +468,10 @@ static int mark_source_chains(const stru
/* This a jump; chase it. */
duprintf("Jump rule %u -> %u\n",
pos, newpos);
+ e = (struct arpt_entry *)
+ (entry0 + newpos);
+ if (!find_jump_target(newinfo, e))
+ return 0;
} else {
/* ... this is a fallthru */
newpos = pos + e->next_offset;
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -439,6 +439,18 @@ ipt_do_table(struct sk_buff *skb,
#endif
}
+static bool find_jump_target(const struct xt_table_info *t,
+ const struct ipt_entry *target)
+{
+ struct ipt_entry *iter;
+
+ xt_entry_foreach(iter, t->entries, t->size) {
+ if (iter == target)
+ return true;
+ }
+ return false;
+}
+
/* Figures out from what hook each rule can be called: returns 0 if
there are loops. Puts hook bitmask in comefrom. */
static int
@@ -536,6 +548,10 @@ mark_source_chains(const struct xt_table
/* This a jump; chase it. */
duprintf("Jump rule %u -> %u\n",
pos, newpos);
+ e = (struct ipt_entry *)
+ (entry0 + newpos);
+ if (!find_jump_target(newinfo, e))
+ return 0;
} else {
/* ... this is a fallthru */
newpos = pos + e->next_offset;
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -449,6 +449,18 @@ ip6t_do_table(struct sk_buff *skb,
#endif
}
+static bool find_jump_target(const struct xt_table_info *t,
+ const struct ip6t_entry *target)
+{
+ struct ip6t_entry *iter;
+
+ xt_entry_foreach(iter, t->entries, t->size) {
+ if (iter == target)
+ return true;
+ }
+ return false;
+}
+
/* Figures out from what hook each rule can be called: returns 0 if
there are loops. Puts hook bitmask in comefrom. */
static int
@@ -546,6 +558,10 @@ mark_source_chains(const struct xt_table
/* This a jump; chase it. */
duprintf("Jump rule %u -> %u\n",
pos, newpos);
+ e = (struct ip6t_entry *)
+ (entry0 + newpos);
+ if (!find_jump_target(newinfo, e))
+ return 0;
} else {
/* ... this is a fallthru */
newpos = pos + e->next_offset;
[toc] | [prev] | [next] | [standalone]
| From | Florian Westphal <fw@strlen.de> |
|---|---|
| Date | 2016-06-23 11:00 +0200 |
| Subject | Re: [PATCH 3.14 21/29] netfilter: x_tables: validate targets of jumps |
| Message-ID | <rN8Eq-7sH-37@gated-at.bofh.it> |
| In reply to | #1429326 |
Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> 3.14-stable review patch. If anyone has any objections, please let me know.
I have -- this doesn't work in 3.14 as t->entries (the ruleset blob)
is still kept percpu.
> +static bool find_jump_target(const struct xt_table_info *t,
> + const struct arpt_entry *target)
> +{
> + struct arpt_entry *iter;
> +
> + xt_entry_foreach(iter, t->entries, t->size) {
.. so this causes in kernel soft lockup when I try to insert a rule.
I will go over the 3.14 stable queue and see if I can amend this to work
with 3.14.
[toc] | [prev] | [next] | [standalone]
| From | Florian Westphal <fw@strlen.de> |
|---|---|
| Date | 2016-06-23 11:20 +0200 |
| Subject | Re: [PATCH 3.14 21/29] netfilter: x_tables: validate targets of jumps |
| Message-ID | <rN8XM-7PN-35@gated-at.bofh.it> |
| In reply to | #1429612 |
Florian Westphal <fw@strlen.de> wrote:
> Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> > 3.14-stable review patch. If anyone has any objections, please let me know.
>
> I have -- this doesn't work in 3.14 as t->entries (the ruleset blob)
> is still kept percpu.
>
> > +static bool find_jump_target(const struct xt_table_info *t,
> > + const struct arpt_entry *target)
> > +{
> > + struct arpt_entry *iter;
> > +
> > + xt_entry_foreach(iter, t->entries, t->size) {
>
>
> .. so this causes in kernel soft lockup when I try to insert a rule.
>
> I will go over the 3.14 stable queue and see if I can amend this to work
> with 3.14.
This amended patch works for me (iptables-test.py passes except those
tests that I expected to fail due to some missing features in 3.14).
I also briefly tried 32bit iptables/ip6tables and that seems happy
as well. The reproduces for the two bugs fail with -EINVAL.
ebtables doesn't work (even ebtables -A INPUT -j ACCEPT fails), but
that should be solved by picking up
d26e2c9ffa385dd1b646f43c1397ba12af9e, "Revert "netfilter: ensure number
of counters is >0 in do_replace()" [ its a PARTIAL revert, so don't drop
the original patch ... ]
Subject: netfilter: x_tables: validate targets of jumps
commit 36472341017529e2b12573093cc0f68719300997 upstream.
When we see a jump also check that the offset gets us to beginning of
a rule (an ipt_entry).
The extra overhead is negible, even with absurd cases.
300k custom rules, 300k jumps to 'next' user chain:
[ plus one jump from INPUT to first userchain ]:
Before:
real 0m24.874s
user 0m7.532s
sys 0m16.076s
After:
real 0m27.464s
user 0m7.436s
sys 0m18.840s
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Need to pass the start of the ruleset as extra argument as
t->entries won't work in 3.14 (its percpu and not even set
up for all processors at this point).
net/ipv4/netfilter/arp_tables.c | 17 +++++++++++++++++
net/ipv4/netfilter/ip_tables.c | 17 +++++++++++++++++
net/ipv6/netfilter/ip6_tables.c | 17 +++++++++++++++++
3 files changed, 51 insertions(+)
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 993da4a..5f3e807 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -363,6 +363,19 @@ static inline bool unconditional(const struct arpt_entry *e)
memcmp(&e->arp, &uncond, sizeof(uncond)) == 0;
}
+static bool find_jump_target(const struct xt_table_info *t,
+ const void *entry0,
+ const struct arpt_entry *target)
+{
+ struct arpt_entry *iter;
+
+ xt_entry_foreach(iter, entry0, t->size) {
+ if (iter == target)
+ return true;
+ }
+ return false;
+}
+
/* Figures out from what hook each rule can be called: returns 0 if
* there are loops. Puts hook bitmask in comefrom.
*/
@@ -456,6 +469,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
/* This a jump; chase it. */
duprintf("Jump rule %u -> %u\n",
pos, newpos);
+ e = (struct arpt_entry *)
+ (entry0 + newpos);
+ if (!find_jump_target(newinfo, entry0, e))
+ return 0;
} else {
/* ... this is a fallthru */
newpos = pos + e->next_offset;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index b75c5bb..f402317 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -439,6 +439,19 @@ ipt_do_table(struct sk_buff *skb,
#endif
}
+static bool find_jump_target(const struct xt_table_info *t,
+ const void *entry0,
+ const struct ipt_entry *target)
+{
+ struct ipt_entry *iter;
+
+ xt_entry_foreach(iter, entry0, t->size) {
+ if (iter == target)
+ return true;
+ }
+ return false;
+}
+
/* Figures out from what hook each rule can be called: returns 0 if
there are loops. Puts hook bitmask in comefrom. */
static int
@@ -536,6 +549,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
/* This a jump; chase it. */
duprintf("Jump rule %u -> %u\n",
pos, newpos);
+ e = (struct ipt_entry *)
+ (entry0 + newpos);
+ if (!find_jump_target(newinfo, entry0, e))
+ return 0;
} else {
/* ... this is a fallthru */
newpos = pos + e->next_offset;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 9367bbd..e312639 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -449,6 +449,19 @@ ip6t_do_table(struct sk_buff *skb,
#endif
}
+static bool find_jump_target(const struct xt_table_info *t,
+ const void *entry0,
+ const struct ip6t_entry *target)
+{
+ struct ip6t_entry *iter;
+
+ xt_entry_foreach(iter, entry0, t->size) {
+ if (iter == target)
+ return true;
+ }
+ return false;
+}
+
/* Figures out from what hook each rule can be called: returns 0 if
there are loops. Puts hook bitmask in comefrom. */
static int
@@ -546,6 +559,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
/* This a jump; chase it. */
duprintf("Jump rule %u -> %u\n",
pos, newpos);
+ e = (struct ip6t_entry *)
+ (entry0 + newpos);
+ if (!find_jump_target(newinfo, entry0, e))
+ return 0;
} else {
/* ... this is a fallthru */
newpos = pos + e->next_offset;
--
2.7.3
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-06-23 01:30 +0200 |
| Subject | [PATCH 3.14 02/29] sfc: on MC reset, clear PIO buffer linkage in TXQs |
| Message-ID | <rMZKP-1BV-45@gated-at.bofh.it> |
| In reply to | #1429319 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Cree <ecree@solarflare.com>
[ Upstream commit c0795bf64cba4d1b796fdc5b74b33772841ed1bb ]
Otherwise, if we fail to allocate new PIO buffers, our TXQs will try to
use the old ones, which aren't there any more.
Fixes: 183233bec810 "sfc: Allocate and link PIO buffers; map them with write-combining"
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/sfc/ef10.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -451,6 +451,17 @@ fail:
return rc;
}
+static void efx_ef10_forget_old_piobufs(struct efx_nic *efx)
+{
+ struct efx_channel *channel;
+ struct efx_tx_queue *tx_queue;
+
+ /* All our existing PIO buffers went away */
+ efx_for_each_channel(channel, efx)
+ efx_for_each_channel_tx_queue(tx_queue, channel)
+ tx_queue->piobuf = NULL;
+}
+
#else /* !EFX_USE_PIO */
static int efx_ef10_alloc_piobufs(struct efx_nic *efx, unsigned int n)
@@ -467,6 +478,10 @@ static void efx_ef10_free_piobufs(struct
{
}
+static void efx_ef10_forget_old_piobufs(struct efx_nic *efx)
+{
+}
+
#endif /* EFX_USE_PIO */
static void efx_ef10_remove(struct efx_nic *efx)
@@ -698,6 +713,7 @@ static void efx_ef10_reset_mc_allocation
nic_data->must_realloc_vis = true;
nic_data->must_restore_filters = true;
nic_data->must_restore_piobufs = true;
+ efx_ef10_forget_old_piobufs(efx);
nic_data->rx_rss_context = EFX_EF10_RSS_CONTEXT_INVALID;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-06-23 01:30 +0200 |
| Subject | [PATCH 3.14 15/29] netfilter: x_tables: validate e->target_offset early |
| Message-ID | <rMZKP-1BV-47@gated-at.bofh.it> |
| In reply to | #1429319 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit bdf533de6968e9686df777dc178486f600c6e617 upstream.
We should check that e->target_offset is sane before
mark_source_chains gets called since it will fetch the target entry
for loop detection.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/netfilter/arp_tables.c | 17 ++++++++---------
net/ipv4/netfilter/ip_tables.c | 17 ++++++++---------
net/ipv6/netfilter/ip6_tables.c | 17 ++++++++---------
3 files changed, 24 insertions(+), 27 deletions(-)
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -470,14 +470,12 @@ static int mark_source_chains(const stru
return 1;
}
-static inline int check_entry(const struct arpt_entry *e, const char *name)
+static inline int check_entry(const struct arpt_entry *e)
{
const struct xt_entry_target *t;
- if (!arp_checkentry(&e->arp)) {
- duprintf("arp_tables: arp check failed %p %s.\n", e, name);
+ if (!arp_checkentry(&e->arp))
return -EINVAL;
- }
if (e->target_offset + sizeof(struct xt_entry_target) > e->next_offset)
return -EINVAL;
@@ -518,10 +516,6 @@ find_check_entry(struct arpt_entry *e, c
struct xt_target *target;
int ret;
- ret = check_entry(e, name);
- if (ret)
- return ret;
-
t = arpt_get_target(e);
target = xt_request_find_target(NFPROTO_ARP, t->u.user.name,
t->u.user.revision);
@@ -566,6 +560,7 @@ static inline int check_entry_size_and_h
unsigned int valid_hooks)
{
unsigned int h;
+ int err;
if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||
(unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
@@ -580,6 +575,10 @@ static inline int check_entry_size_and_h
return -EINVAL;
}
+ err = check_entry(e);
+ if (err)
+ return err;
+
/* Check hooks & underflows */
for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
if (!(valid_hooks & (1 << h)))
@@ -1237,7 +1236,7 @@ check_compat_entry_size_and_hooks(struct
}
/* For purposes of check_entry casting the compat entry is fine */
- ret = check_entry((struct arpt_entry *)e, name);
+ ret = check_entry((struct arpt_entry *)e);
if (ret)
return ret;
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -565,14 +565,12 @@ static void cleanup_match(struct xt_entr
}
static int
-check_entry(const struct ipt_entry *e, const char *name)
+check_entry(const struct ipt_entry *e)
{
const struct xt_entry_target *t;
- if (!ip_checkentry(&e->ip)) {
- duprintf("ip check failed %p %s.\n", e, name);
+ if (!ip_checkentry(&e->ip))
return -EINVAL;
- }
if (e->target_offset + sizeof(struct xt_entry_target) >
e->next_offset)
@@ -662,10 +660,6 @@ find_check_entry(struct ipt_entry *e, st
struct xt_mtchk_param mtpar;
struct xt_entry_match *ematch;
- ret = check_entry(e, name);
- if (ret)
- return ret;
-
j = 0;
mtpar.net = net;
mtpar.table = name;
@@ -729,6 +723,7 @@ check_entry_size_and_hooks(struct ipt_en
unsigned int valid_hooks)
{
unsigned int h;
+ int err;
if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
(unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
@@ -743,6 +738,10 @@ check_entry_size_and_hooks(struct ipt_en
return -EINVAL;
}
+ err = check_entry(e);
+ if (err)
+ return err;
+
/* Check hooks & underflows */
for (h = 0; h < NF_INET_NUMHOOKS; h++) {
if (!(valid_hooks & (1 << h)))
@@ -1503,7 +1502,7 @@ check_compat_entry_size_and_hooks(struct
}
/* For purposes of check_entry casting the compat entry is fine */
- ret = check_entry((struct ipt_entry *)e, name);
+ ret = check_entry((struct ipt_entry *)e);
if (ret)
return ret;
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -575,14 +575,12 @@ static void cleanup_match(struct xt_entr
}
static int
-check_entry(const struct ip6t_entry *e, const char *name)
+check_entry(const struct ip6t_entry *e)
{
const struct xt_entry_target *t;
- if (!ip6_checkentry(&e->ipv6)) {
- duprintf("ip_tables: ip check failed %p %s.\n", e, name);
+ if (!ip6_checkentry(&e->ipv6))
return -EINVAL;
- }
if (e->target_offset + sizeof(struct xt_entry_target) >
e->next_offset)
@@ -673,10 +671,6 @@ find_check_entry(struct ip6t_entry *e, s
struct xt_mtchk_param mtpar;
struct xt_entry_match *ematch;
- ret = check_entry(e, name);
- if (ret)
- return ret;
-
j = 0;
mtpar.net = net;
mtpar.table = name;
@@ -740,6 +734,7 @@ check_entry_size_and_hooks(struct ip6t_e
unsigned int valid_hooks)
{
unsigned int h;
+ int err;
if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
(unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
@@ -754,6 +749,10 @@ check_entry_size_and_hooks(struct ip6t_e
return -EINVAL;
}
+ err = check_entry(e);
+ if (err)
+ return err;
+
/* Check hooks & underflows */
for (h = 0; h < NF_INET_NUMHOOKS; h++) {
if (!(valid_hooks & (1 << h)))
@@ -1515,7 +1514,7 @@ check_compat_entry_size_and_hooks(struct
}
/* For purposes of check_entry casting the compat entry is fine */
- ret = check_entry((struct ip6t_entry *)e, name);
+ ret = check_entry((struct ip6t_entry *)e);
if (ret)
return ret;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-06-23 01:30 +0200 |
| Subject | [PATCH 3.14 16/29] netfilter: x_tables: make sure e->next_offset covers remaining blob size |
| Message-ID | <rMZKP-1BV-51@gated-at.bofh.it> |
| In reply to | #1429319 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91 upstream.
Otherwise this function may read data beyond the ruleset blob.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/netfilter/arp_tables.c | 6 ++++--
net/ipv4/netfilter/ip_tables.c | 6 ++++--
net/ipv6/netfilter/ip6_tables.c | 6 ++++--
3 files changed, 12 insertions(+), 6 deletions(-)
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -563,7 +563,8 @@ static inline int check_entry_size_and_h
int err;
if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||
- (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
+ (unsigned char *)e + sizeof(struct arpt_entry) >= limit ||
+ (unsigned char *)e + e->next_offset > limit) {
duprintf("Bad offset %p\n", e);
return -EINVAL;
}
@@ -1223,7 +1224,8 @@ check_compat_entry_size_and_hooks(struct
duprintf("check_compat_entry_size_and_hooks %p\n", e);
if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0 ||
- (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {
+ (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit ||
+ (unsigned char *)e + e->next_offset > limit) {
duprintf("Bad offset %p, limit = %p\n", e, limit);
return -EINVAL;
}
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -726,7 +726,8 @@ check_entry_size_and_hooks(struct ipt_en
int err;
if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
- (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
+ (unsigned char *)e + sizeof(struct ipt_entry) >= limit ||
+ (unsigned char *)e + e->next_offset > limit) {
duprintf("Bad offset %p\n", e);
return -EINVAL;
}
@@ -1489,7 +1490,8 @@ check_compat_entry_size_and_hooks(struct
duprintf("check_compat_entry_size_and_hooks %p\n", e);
if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
- (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
+ (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit ||
+ (unsigned char *)e + e->next_offset > limit) {
duprintf("Bad offset %p, limit = %p\n", e, limit);
return -EINVAL;
}
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -737,7 +737,8 @@ check_entry_size_and_hooks(struct ip6t_e
int err;
if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
- (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
+ (unsigned char *)e + sizeof(struct ip6t_entry) >= limit ||
+ (unsigned char *)e + e->next_offset > limit) {
duprintf("Bad offset %p\n", e);
return -EINVAL;
}
@@ -1501,7 +1502,8 @@ check_compat_entry_size_and_hooks(struct
duprintf("check_compat_entry_size_and_hooks %p\n", e);
if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
- (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
+ (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit ||
+ (unsigned char *)e + e->next_offset > limit) {
duprintf("Bad offset %p, limit = %p\n", e, limit);
return -EINVAL;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-06-23 01:30 +0200 |
| Subject | [PATCH 3.14 08/29] powerpc: Use privileged SPR number for MMCR2 |
| Message-ID | <rMZKP-1BV-71@gated-at.bofh.it> |
| In reply to | #1429319 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Huth <thuth@redhat.com>
commit 8dd75ccb571f3c92c48014b3dabd3d51a115ab41 upstream.
We are already using the privileged versions of MMCR0, MMCR1
and MMCRA in the kernel, so for MMCR2, we should better use
the privileged versions, too, to be consistent.
Fixes: 240686c13687 ("powerpc: Initialise PMU related regs on Power8")
Suggested-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Acked-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/reg.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -680,7 +680,7 @@
#define MMCR0_FCWAIT 0x00000002UL /* freeze counter in WAIT state */
#define MMCR0_FCHV 0x00000001UL /* freeze conditions in hypervisor mode */
#define SPRN_MMCR1 798
-#define SPRN_MMCR2 769
+#define SPRN_MMCR2 785
#define SPRN_MMCRA 0x312
#define MMCRA_SDSYNC 0x80000000UL /* SDAR synced with SIAR */
#define MMCRA_SDAR_DCACHE_MISS 0x40000000UL
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-06-23 01:30 +0200 |
| Subject | [PATCH 3.14 09/29] parisc: Fix pagefault crash in unaligned __get_user() call |
| Message-ID | <rMZKP-1BV-73@gated-at.bofh.it> |
| In reply to | #1429319 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit 8b78f260887df532da529f225c49195d18fef36b upstream.
One of the debian buildd servers had this crash in the syslog without
any other information:
Unaligned handler failed, ret = -2
clock_adjtime (pid 22578): Unaligned data reference (code 28)
CPU: 1 PID: 22578 Comm: clock_adjtime Tainted: G E 4.5.0-2-parisc64-smp #1 Debian 4.5.4-1
task: 000000007d9960f8 ti: 00000001bde7c000 task.ti: 00000001bde7c000
YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
PSW: 00001000000001001111100000001111 Tainted: G E
r00-03 000000ff0804f80f 00000001bde7c2b0 00000000402d2be8 00000001bde7c2b0
r04-07 00000000409e1fd0 00000000fa6f7fff 00000001bde7c148 00000000fa6f7fff
r08-11 0000000000000000 00000000ffffffff 00000000fac9bb7b 000000000002b4d4
r12-15 000000000015241c 000000000015242c 000000000000002d 00000000fac9bb7b
r16-19 0000000000028800 0000000000000001 0000000000000070 00000001bde7c218
r20-23 0000000000000000 00000001bde7c210 0000000000000002 0000000000000000
r24-27 0000000000000000 0000000000000000 00000001bde7c148 00000000409e1fd0
r28-31 0000000000000001 00000001bde7c320 00000001bde7c350 00000001bde7c218
sr00-03 0000000001200000 0000000001200000 0000000000000000 0000000001200000
sr04-07 0000000000000000 0000000000000000 0000000000000000 0000000000000000
IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000402d2e84 00000000402d2e88
IIR: 0ca0d089 ISR: 0000000001200000 IOR: 00000000fa6f7fff
CPU: 1 CR30: 00000001bde7c000 CR31: ffffffffffffffff
ORIG_R28: 00000002369fe628
IAOQ[0]: compat_get_timex+0x2dc/0x3c0
IAOQ[1]: compat_get_timex+0x2e0/0x3c0
RP(r2): compat_get_timex+0x40/0x3c0
Backtrace:
[<00000000402d4608>] compat_SyS_clock_adjtime+0x40/0xc0
[<0000000040205024>] syscall_exit+0x0/0x14
This means the userspace program clock_adjtime called the clock_adjtime()
syscall and then crashed inside the compat_get_timex() function.
Syscalls should never crash programs, but instead return EFAULT.
The IIR register contains the executed instruction, which disassebles
into "ldw 0(sr3,r5),r9".
This load-word instruction is part of __get_user() which tried to read the word
at %r5/IOR (0xfa6f7fff). This means the unaligned handler jumped in. The
unaligned handler is able to emulate all ldw instructions, but it fails if it
fails to read the source e.g. because of page fault.
The following program reproduces the problem:
#define _GNU_SOURCE
#include <unistd.h>
#include <sys/syscall.h>
#include <sys/mman.h>
int main(void) {
/* allocate 8k */
char *ptr = mmap(NULL, 2*4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
/* free second half (upper 4k) and make it invalid. */
munmap(ptr+4096, 4096);
/* syscall where first int is unaligned and clobbers into invalid memory region */
/* syscall should return EFAULT */
return syscall(__NR_clock_adjtime, 0, ptr+4095);
}
To fix this issue we simply need to check if the faulting instruction address
is in the exception fixup table when the unaligned handler failed. If it
is, call the fixup routine instead of crashing.
While looking at the unaligned handler I found another issue as well: The
target register should not be modified if the handler was unsuccessful.
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/kernel/unaligned.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/arch/parisc/kernel/unaligned.c
+++ b/arch/parisc/kernel/unaligned.c
@@ -666,7 +666,7 @@ void handle_unaligned(struct pt_regs *re
break;
}
- if (modify && R1(regs->iir))
+ if (ret == 0 && modify && R1(regs->iir))
regs->gr[R1(regs->iir)] = newbase;
@@ -677,6 +677,14 @@ void handle_unaligned(struct pt_regs *re
if (ret)
{
+ /*
+ * The unaligned handler failed.
+ * If we were called by __get_user() or __put_user() jump
+ * to it's exception fixup handler instead of crashing.
+ */
+ if (!user_mode(regs) && fixup_exception(regs))
+ return;
+
printk(KERN_CRIT "Unaligned handler failed, ret = %d\n", ret);
die_if_kernel("Unaligned data reference", regs, 28);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-06-23 01:40 +0200 |
| Subject | [PATCH 3.14 11/29] wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel |
| Message-ID | <rMZUu-1Ig-7@gated-at.bofh.it> |
| In reply to | #1429319 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prasun Maiti <prasunmaiti87@gmail.com>
commit 3d5fdff46c4b2b9534fa2f9fc78e90a48e0ff724 upstream.
iwpriv app uses iw_point structure to send data to Kernel. The iw_point
structure holds a pointer. For compatibility Kernel converts the pointer
as required for WEXT IOCTLs (SIOCIWFIRST to SIOCIWLAST). Some drivers
may use iw_handler_def.private_args to populate iwpriv commands instead
of iw_handler_def.private. For those case, the IOCTLs from
SIOCIWFIRSTPRIV to SIOCIWLASTPRIV will follow the path ndo_do_ioctl().
Accordingly when the filled up iw_point structure comes from 32 bit
iwpriv to 64 bit Kernel, Kernel will not convert the pointer and sends
it to driver. So, the driver may get the invalid data.
The pointer conversion for the IOCTLs (SIOCIWFIRSTPRIV to
SIOCIWLASTPRIV), which follow the path ndo_do_ioctl(), is mandatory.
This patch adds pointer conversion from 32 bit to 64 bit and vice versa,
if the ioctl comes from 32 bit iwpriv to 64 bit Kernel.
Signed-off-by: Prasun Maiti <prasunmaiti87@gmail.com>
Signed-off-by: Ujjal Roy <royujjal@gmail.com>
Tested-by: Dibyajyoti Ghosh <dibyajyotig@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/wext-core.c | 25 +++++++++++++++++++++++--
1 file changed, 23 insertions(+), 2 deletions(-)
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -954,8 +954,29 @@ static int wireless_process_ioctl(struct
return private(dev, iwr, cmd, info, handler);
}
/* Old driver API : call driver ioctl handler */
- if (dev->netdev_ops->ndo_do_ioctl)
- return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
+ if (dev->netdev_ops->ndo_do_ioctl) {
+#ifdef CONFIG_COMPAT
+ if (info->flags & IW_REQUEST_FLAG_COMPAT) {
+ int ret = 0;
+ struct iwreq iwr_lcl;
+ struct compat_iw_point *iwp_compat = (void *) &iwr->u.data;
+
+ memcpy(&iwr_lcl, iwr, sizeof(struct iwreq));
+ iwr_lcl.u.data.pointer = compat_ptr(iwp_compat->pointer);
+ iwr_lcl.u.data.length = iwp_compat->length;
+ iwr_lcl.u.data.flags = iwp_compat->flags;
+
+ ret = dev->netdev_ops->ndo_do_ioctl(dev, (void *) &iwr_lcl, cmd);
+
+ iwp_compat->pointer = ptr_to_compat(iwr_lcl.u.data.pointer);
+ iwp_compat->length = iwr_lcl.u.data.length;
+ iwp_compat->flags = iwr_lcl.u.data.flags;
+
+ return ret;
+ } else
+#endif
+ return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
+ }
return -EOPNOTSUPP;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-06-23 07:00 +0200 |
| Subject | Re: [PATCH 3.14 00/29] 3.14.73-stable review -rc2 |
| Message-ID | <rN4U9-50i-9@gated-at.bofh.it> |
| In reply to | #1429319 |
-rc2!
Please test this...
This is the start of the stable review cycle for the 3.14.73 release.
There are 35 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Jun 25 04:50:44 UTC 2016.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.73-rc2.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 3.14.73-rc2
Florian Westphal <fw@strlen.de>
netfilter: x_tables: do compat validation via translate_table
Dave Jones <davej@codemonkey.org.uk>
netfilter: ensure number of counters is >0 in do_replace()
Florian Westphal <fw@strlen.de>
netfilter: x_tables: xt_compat_match_from_user doesn't need a retval
Florian Westphal <fw@strlen.de>
netfilter: ip6_tables: simplify translate_compat_table args
Florian Westphal <fw@strlen.de>
netfilter: ip_tables: simplify translate_compat_table args
Florian Westphal <fw@strlen.de>
netfilter: arp_tables: simplify translate_compat_table args
Florian Westphal <fw@strlen.de>
netfilter: x_tables: don't reject valid target size on some architectures
Florian Westphal <fw@strlen.de>
netfilter: x_tables: validate all offsets and sizes in a rule
Florian Westphal <fw@strlen.de>
netfilter: x_tables: check for bogus target offset
Florian Westphal <fw@strlen.de>
netfilter: x_tables: check standard target size too
Florian Westphal <fw@strlen.de>
netfilter: x_tables: add compat version of xt_check_entry_offsets
Florian Westphal <fw@strlen.de>
netfilter: x_tables: assert minimum target size
Florian Westphal <fw@strlen.de>
netfilter: x_tables: kill check_entry helper
Florian Westphal <fw@strlen.de>
netfilter: x_tables: add and use xt_check_entry_offsets
Florian Westphal <fw@strlen.de>
netfilter: x_tables: validate targets of jumps
Florian Westphal <fw@strlen.de>
netfilter: x_tables: don't move to non-existent next rule
Willy Tarreau <w@1wt.eu>
pipe: limit the per-user amount of pages allocated in pipes
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
xfs: fix up backport error in fs/xfs/xfs_inode.c
Florian Westphal <fw@strlen.de>
netfilter: x_tables: fix unconditional helper
Florian Westphal <fw@strlen.de>
netfilter: x_tables: make sure e->next_offset covers remaining blob size
Florian Westphal <fw@strlen.de>
netfilter: x_tables: validate e->target_offset early
Russell Currey <ruscur@russell.cc>
powerpc/pseries/eeh: Handle RTAS delay requests in configure_bridge
Ralf Baechle <ralf@linux-mips.org>
MIPS: Fix 64k page support for 32 bit kernels.
Al Viro <viro@zeniv.linux.org.uk>
fix d_walk()/non-delayed __d_free() race
Prasun Maiti <prasunmaiti87@gmail.com>
wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel
Jann Horn <jannh@google.com>
ecryptfs: forbid opening files without mmap handler
Helge Deller <deller@gmx.de>
parisc: Fix pagefault crash in unaligned __get_user() call
Thomas Huth <thuth@redhat.com>
powerpc: Use privileged SPR number for MMCR2
Thomas Huth <thuth@redhat.com>
powerpc: Fix definition of SIAR and SDAR registers
Tom Lendacky <thomas.lendacky@amd.com>
crypto: ccp - Fix AES XTS error for request sizes above 4096
Russell King <rmk+kernel@armlinux.org.uk>
ARM: fix PTRACE_SETVFPREGS on SMP systems
Paolo Bonzini <pbonzini@redhat.com>
KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS
Yuchung Cheng <ycheng@google.com>
tcp: record TLP and ER timer stats in v6 stats
Edward Cree <ecree@solarflare.com>
sfc: on MC reset, clear PIO buffer linkage in TXQs
Herbert Xu <herbert@gondor.apana.org.au>
netlink: Fix dump skb leak/double free
-------------
Diffstat:
Documentation/sysctl/fs.txt | 23 ++
Makefile | 4 +-
arch/arm/kernel/ptrace.c | 2 +-
arch/mips/include/asm/processor.h | 2 +-
arch/parisc/kernel/unaligned.c | 10 +-
arch/powerpc/include/asm/reg.h | 6 +-
arch/powerpc/platforms/pseries/eeh_pseries.c | 51 +++--
arch/x86/kvm/x86.c | 5 +
drivers/crypto/ccp/ccp-crypto-aes-xts.c | 17 +-
drivers/net/ethernet/sfc/ef10.c | 16 ++
fs/dcache.c | 4 +-
fs/ecryptfs/kthread.c | 13 +-
fs/pipe.c | 47 +++-
fs/xfs/xfs_inode.c | 2 +-
include/linux/netfilter/x_tables.h | 9 +-
include/linux/pipe_fs_i.h | 4 +
include/linux/sched.h | 1 +
kernel/sysctl.c | 14 ++
net/bridge/netfilter/ebtables.c | 4 +
net/ipv4/netfilter/arp_tables.c | 279 +++++++++---------------
net/ipv4/netfilter/ip_tables.c | 312 +++++++++------------------
net/ipv6/netfilter/ip6_tables.c | 305 +++++++++-----------------
net/ipv6/tcp_ipv6.c | 4 +-
net/netfilter/x_tables.c | 171 ++++++++++++++-
net/netlink/af_netlink.c | 7 +-
net/wireless/wext-core.c | 25 ++-
26 files changed, 708 insertions(+), 629 deletions(-)
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web