Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1691451 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2017-07-19 12:50 +0200 |
| Last post | 2017-07-20 01:40 +0200 |
| Articles | 11 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH 4.11 00/88] 4.11.12-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
[PATCH 4.11 23/88] vrf: fix bug_on triggered by rx when destroying a vrf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
[PATCH 4.11 35/88] block: Fix a blk_exit_rl() regression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
[PATCH 4.11 11/88] mlxsw: spectrum_router: Fix NULL pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
[PATCH 4.11 26/88] cxgb4: fix BUG() on interrupt deallocating path of ULD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
[PATCH 4.11 21/88] liquidio: fix bug in soft reset failure detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
[PATCH 4.11 13/88] bpf: prevent leaking pointer via xadd on unpriviledged Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
[PATCH 4.11 03/88] netvsc: dont access netdev->num_rx_queues directly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
[PATCH 4.11 12/88] rocker: move dereference before free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
Re: [PATCH 4.11 00/88] 4.11.12-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-19 22:40 +0200
Re: [PATCH 4.11 00/88] 4.11.12-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-07-20 01:40 +0200
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-19 12:50 +0200 |
| Subject | [PATCH 4.11 00/88] 4.11.12-stable review |
| Message-ID | <u4U5A-74z-17@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.11.12 release.
There are 88 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri Jul 21 10:07:36 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.11.12-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.11.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.11.12-rc1
Haozhong Zhang <haozhong.zhang@intel.com>
kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS
Jim Mattson <jmattson@google.com>
kvm: vmx: Check value written to IA32_BNDCFGS
Jim Mattson <jmattson@google.com>
kvm: x86: Guest BNDCFGS requires guest MPX support
Jim Mattson <jmattson@google.com>
kvm: vmx: Do not disable intercepts for BNDCFGS
Dan Carpenter <dan.carpenter@oracle.com>
PM / QoS: return -EINVAL for bogus strings
Ville Syrjälä <ville.syrjala@linux.intel.com>
ALSA: x86: Clear the pdata.notify_lpe_audio pointer before teardown
Thomas Gleixner <tglx@linutronix.de>
PM / wakeirq: Convert to SRCU
Peter Zijlstra <peterz@infradead.org>
sched/topology: Fix overlapping sched_group_mask
Lauro Ramos Venancio <lvenanci@redhat.com>
sched/topology: Optimize build_group_mask()
Peter Zijlstra <peterz@infradead.org>
sched/topology: Fix building of overlapping sched-groups
Peter Zijlstra <peterz@infradead.org>
sched/fair, cpumask: Export for_each_cpu_wrap()
Horia Geantă <horia.geanta@nxp.com>
crypto: caam - fix signals handling
David Gstir <david@sigma-star.at>
crypto: caam - properly set IV after {en,de}crypt
Herbert Xu <herbert@gondor.apana.org.au>
crypto: sha1-ssse3 - Disable avx2
Gilad Ben-Yossef <gilad@benyossef.com>
crypto: atmel - only treat EBUSY as transient if backlog
Martin Hicks <mort@bork.org>
crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD
Helge Deller <deller@gmx.de>
mm: fix overflow check in expand_upwards()
Andy Lutomirski <luto@kernel.org>
selftests/capabilities: Fix the test_execve test
Eric W. Biederman <ebiederm@xmission.com>
mnt: Make propagate_umount less slow for overlapping mount propagation trees
Eric W. Biederman <ebiederm@xmission.com>
mnt: In propgate_umount handle visiting mounts in any order
Eric W. Biederman <ebiederm@xmission.com>
mnt: In umount propagation reparent in a separate pass
Michael Kelley <mikelley@microsoft.com>
Drivers: hv: vmbus: Close timing hole that can corrupt per-cpu page
Johan Hovold <johan@kernel.org>
nvmem: core: fix leaks on registration errors
Paul E. McKenney <paulmck@linux.vnet.ibm.com>
rcu: Add memory barriers for NOCB leader wakeup
Adam Borowski <kilobyte@angband.pl>
vt: fix unchecked __put_user() in tioclinux ioctls
Dong Bo <dongbo4@huawei.com>
arm64: Preventing READ_IMPLIES_EXEC propagation
Marc Zyngier <marc.zyngier@arm.com>
ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers
Balbir Singh <bsingharora@gmail.com>
powerpc/kexec: Fix radix to hash kexec due to IAMR/AMOR
Kees Cook <keescook@chromium.org>
exec: Limit arg stack to at most 75% of _STK_LIM
Kees Cook <keescook@chromium.org>
s390: reduce ELF_ET_DYN_BASE
Kees Cook <keescook@chromium.org>
powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB
Kees Cook <keescook@chromium.org>
arm64: move ELF_ET_DYN_BASE to 4GB / 4MB
Kees Cook <keescook@chromium.org>
arm: move ELF_ET_DYN_BASE to 4MB
Kees Cook <keescook@chromium.org>
binfmt_elf: use ELF_ET_DYN_BASE only for PIE
Cyril Bur <cyrilbur@gmail.com>
checkpatch: silence perl 5.26.0 unescaped left brace warnings
Sahitya Tummala <stummala@codeaurora.org>
fs/dcache.c: fix spin lockup issue on nlru->lock
Sahitya Tummala <stummala@codeaurora.org>
mm/list_lru.c: fix list_lru_count_node() to be race free
Marcin Nowakowski <marcin.nowakowski@imgtec.com>
kernel/extable.c: mark core_kernel_text notrace
Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
thp, mm: fix crash due race in MADV_FREE handling
Ben Hutchings <ben@decadent.org.uk>
tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth
Helge Deller <deller@gmx.de>
parisc/mm: Ensure IRQs are off in switch_mm()
Thomas Bogendoerfer <tsbogend@alpha.franken.de>
parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs
Eric Biggers <ebiggers@google.com>
parisc: use compat_sys_keyctl()
Helge Deller <deller@gmx.de>
parisc: Report SIGSEGV instead of SIGBUS when running out of stack
Suzuki K Poulose <suzuki.poulose@arm.com>
irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/gfx6: properly cache mc_arb_ramcfg
Srinivas Dasari <dasaris@qti.qualcomm.com>
cfg80211: Check if NAN service ID is of expected size
Srinivas Dasari <dasaris@qti.qualcomm.com>
cfg80211: Check if PMKID attribute is of expected size
Srinivas Dasari <dasaris@qti.qualcomm.com>
cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES
Srinivas Dasari <dasaris@qti.qualcomm.com>
cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE
Daniel Kiper <daniel.kiper@oracle.com>
efi: Process the MEMATTR table only if EFI_MEMMAP is enabled
Peter S. Housel <housel@acm.org>
brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain
Christophe Jaillet <christophe.jaillet@wanadoo.fr>
brcmfmac: Fix a memory leak in error handling path in 'brcmf_cfg80211_attach'
Bart Van Assche <bart.vanassche@sandisk.com>
block: Fix a blk_exit_rl() regression
Nitin Gupta <nitin.m.gupta@oracle.com>
sparc64: Fix gup_huge_pmd
Nagarathnam Muthusamy <nagarathnam.muthusamy@oracle.com>
Adding the type of exported symbols
Nagarathnam Muthusamy <nagarathnam.muthusamy@oracle.com>
sed regex in Makefile.build requires line break between exported symbols
Nagarathnam Muthusamy <nagarathnam.muthusamy@oracle.com>
Adding asm-prototypes.h for genksyms to generate crc
Bert Kenward <bkenward@solarflare.com>
sfc: don't read beyond unicast address list
Arend van Spriel <arend.vanspriel@broadcom.com>
brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
Eduardo Valentin <eduval@amazon.com>
bridge: mdb: fix leak on complete_info ptr on fail path
WANG Cong <xiyou.wangcong@gmail.com>
tap: convert a mutex to a spinlock
Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
cxgb4: fix BUG() on interrupt deallocating path of ULD
Huy Nguyen <huyn@mellanox.com>
net/mlx5e: Initialize CEE's getpermhwaddr address buffer to 0xff
Sowmini Varadhan <sowmini.varadhan@oracle.com>
rds: tcp: use sock_create_lite() to create the accept socket
Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
vrf: fix bug_on triggered by rx when destroying a vrf
David Ahern <dsahern@gmail.com>
net: ipv6: Compare lwstate in detecting duplicate nexthops
Derek Chickles <derek.chickles@cavium.com>
liquidio: fix bug in soft reset failure detection
Alban Browaeys <alban.browaeys@gmail.com>
net: core: Fix slab-out-of-bounds in netdev_stats_to_stats64
Jiri Benc <jbenc@redhat.com>
geneve: fix hlist corruption
Jiri Benc <jbenc@redhat.com>
vxlan: fix hlist corruption
Sabrina Dubroca <sd@queasysnail.net>
ipv6: dad: don't remove dynamic addresses if link is down
Gal Pressman <galp@mellanox.com>
net/mlx5e: Fix TX carrier errors report in get stats ndo
Mohamad Haj Yahia <mohamad@mellanox.com>
net/mlx5: Cancel delayed recovery work when unloading the driver
Michal Kubeček <mkubecek@suse.cz>
net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish()
Daniel Borkmann <daniel@iogearbox.net>
bpf: prevent leaking pointer via xadd on unpriviledged
Dan Carpenter <dan.carpenter@oracle.com>
rocker: move dereference before free
Ido Schimmel <idosch@mellanox.com>
mlxsw: spectrum_router: Fix NULL pointer dereference
Gao Feng <gfree.wind@vip.163.com>
net: sched: Fix one possible panic when no destroy callback
Jason Wang <jasowang@redhat.com>
virtio-net: serialize tx routine during reset
Eric Dumazet <edumazet@google.com>
net: prevent sign extension in dev_get_stats()
WANG Cong <xiyou.wangcong@gmail.com>
tcp: reset sk_rx_dst in tcp_disconnect()
Richard Cochran <richardcochran@gmail.com>
net: dp83640: Avoid NULL pointer dereference.
Michal Kubeček <mkubecek@suse.cz>
net: account for current skb length when deciding about UFO
Martin Habets <mhabets@solarflare.com>
sfc: Fix MCDI command size for filter operations
Arnd Bergmann <arnd@arndb.de>
netvsc: don't access netdev->num_rx_queues directly
WANG Cong <xiyou.wangcong@gmail.com>
ipv6: avoid unregistering inet6_dev for loopback
Zach Brown <zach.brown@ni.com>
net/phy: micrel: configure intterupts after autoneg workaround
-------------
Diffstat:
Makefile | 4 +-
arch/arm/include/asm/elf.h | 8 +-
arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 12 +-
arch/arm64/include/asm/elf.h | 18 +-
arch/parisc/include/asm/dma-mapping.h | 11 +-
arch/parisc/include/asm/mmu_context.h | 15 +-
arch/parisc/kernel/syscall_table.S | 2 +-
arch/parisc/mm/fault.c | 2 +-
arch/powerpc/include/asm/elf.h | 13 +-
arch/powerpc/kernel/misc_64.S | 12 ++
arch/s390/include/asm/elf.h | 15 +-
arch/sparc/include/asm/asm-prototypes.h | 24 +++
arch/sparc/lib/atomic_64.S | 44 +++--
arch/sparc/lib/checksum_64.S | 1 +
arch/sparc/lib/csum_copy.S | 1 +
arch/sparc/lib/memscan_64.S | 2 +
arch/sparc/lib/memset.S | 1 +
arch/sparc/mm/gup.c | 4 +-
arch/x86/crypto/sha1_ssse3_glue.c | 2 +-
arch/x86/include/asm/elf.h | 13 +-
arch/x86/include/asm/msr-index.h | 2 +
arch/x86/kvm/cpuid.h | 8 +
arch/x86/kvm/vmx.c | 10 +-
block/blk-sysfs.c | 34 ++--
drivers/base/power/sysfs.c | 2 +
drivers/base/power/wakeup.c | 32 ++--
drivers/crypto/atmel-sha.c | 4 +-
drivers/crypto/caam/caamalg.c | 20 +-
drivers/crypto/caam/caamhash.c | 2 +-
drivers/crypto/caam/key_gen.c | 2 +-
drivers/crypto/talitos.c | 7 +-
drivers/firmware/efi/efi.c | 3 +-
drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 3 +-
drivers/hv/hv.c | 7 +-
drivers/irqchip/irq-gic-v3.c | 3 +
.../ethernet/cavium/liquidio/cn23xx_pf_device.c | 2 +-
.../net/ethernet/cavium/liquidio/cn66xx_device.c | 2 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 16 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c | 42 ++--
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 2 +
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 -
drivers/net/ethernet/mellanox/mlx5/core/health.c | 15 +-
drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +-
drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 3 +
drivers/net/ethernet/rocker/rocker_ofdpa.c | 2 +-
drivers/net/ethernet/sfc/ef10.c | 16 +-
drivers/net/geneve.c | 48 +++--
drivers/net/hyperv/netvsc_drv.c | 4 +-
drivers/net/phy/dp83640.c | 2 +-
drivers/net/phy/micrel.c | 2 +
drivers/net/tap.c | 18 +-
drivers/net/virtio_net.c | 1 +
drivers/net/vrf.c | 11 +-
drivers/net/vxlan.c | 30 ++-
.../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 7 +-
.../broadcom/brcm80211/brcmfmac/cfg80211.c | 8 +-
drivers/nvmem/core.c | 13 +-
drivers/parisc/ccio-dma.c | 12 ++
drivers/parisc/dino.c | 5 +-
drivers/parisc/lba_pci.c | 6 +-
drivers/parisc/sba_iommu.c | 14 ++
drivers/tty/vt/vt.c | 6 +-
fs/binfmt_elf.c | 59 +++++-
fs/dcache.c | 5 +-
fs/exec.c | 11 +-
fs/mount.h | 1 +
fs/namespace.c | 1 +
fs/pnode.c | 212 ++++++++++++++++-----
include/linux/blkdev.h | 2 +
include/linux/cpumask.h | 17 ++
include/linux/list_lru.h | 1 +
include/linux/mlx5/driver.h | 1 +
include/net/ip6_route.h | 8 +
include/net/vxlan.h | 10 +-
kernel/bpf/verifier.c | 5 +
kernel/extable.c | 2 +-
kernel/rcu/tree_plugin.h | 2 +
kernel/sched/fair.c | 45 +----
kernel/sched/topology.c | 24 ++-
lib/cpumask.c | 32 ++++
mm/huge_memory.c | 2 +-
mm/list_lru.c | 14 +-
mm/mmap.c | 2 +-
net/bridge/br_mdb.c | 3 +-
net/core/dev.c | 32 ++--
net/ipv4/ip_output.c | 3 +-
net/ipv4/tcp.c | 2 +
net/ipv6/addrconf.c | 23 +--
net/ipv6/ip6_fib.c | 5 +-
net/ipv6/ip6_output.c | 2 +-
net/ipv6/route.c | 8 +-
net/rds/tcp_listen.c | 2 +-
net/sched/sch_api.c | 3 +-
net/wireless/nl80211.c | 10 +-
scripts/checkpatch.pl | 6 +-
sound/x86/intel_hdmi_audio.c | 5 +
tools/lib/lockdep/uinclude/linux/lockdep.h | 2 +-
tools/testing/selftests/bpf/test_verifier.c | 66 +++++++
tools/testing/selftests/capabilities/test_execve.c | 7 +-
99 files changed, 892 insertions(+), 377 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-19 12:50 +0200 |
| Subject | [PATCH 4.11 23/88] vrf: fix bug_on triggered by rx when destroying a vrf |
| Message-ID | <u4UIi-7mS-33@gated-at.bofh.it> |
| In reply to | #1691451 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
[ Upstream commit f630c38ef0d785101363a8992bbd4f302180f86f ]
When destroying a VRF device we cleanup the slaves in its ndo_uninit()
function, but that causes packets to be switched (skb->dev == vrf being
destroyed) even though we're pass the point where the VRF should be
receiving any packets while it is being dismantled. This causes a BUG_ON
to trigger if we have raw sockets (trace below).
The reason is that the inetdev of the VRF has been destroyed but we're
still sending packets up the stack with it, so let's free the slaves in
the dellink callback as David Ahern suggested.
Note that this fix doesn't prevent packets from going up when the VRF
device is admin down.
[ 35.631371] ------------[ cut here ]------------
[ 35.631603] kernel BUG at net/ipv4/fib_frontend.c:285!
[ 35.631854] invalid opcode: 0000 [#1] SMP
[ 35.631977] Modules linked in:
[ 35.632081] CPU: 2 PID: 22 Comm: ksoftirqd/2 Not tainted 4.12.0-rc7+ #45
[ 35.632247] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 35.632477] task: ffff88005ad68000 task.stack: ffff88005ad64000
[ 35.632632] RIP: 0010:fib_compute_spec_dst+0xfc/0x1ee
[ 35.632769] RSP: 0018:ffff88005ad67978 EFLAGS: 00010202
[ 35.632910] RAX: 0000000000000001 RBX: ffff880059a7f200 RCX: 0000000000000000
[ 35.633084] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff82274af0
[ 35.633256] RBP: ffff88005ad679f8 R08: 000000000001ef70 R09: 0000000000000046
[ 35.633430] R10: ffff88005ad679f8 R11: ffff880037731cb0 R12: 0000000000000001
[ 35.633603] R13: ffff8800599e3000 R14: 0000000000000000 R15: ffff8800599cb852
[ 35.634114] FS: 0000000000000000(0000) GS:ffff88005d900000(0000) knlGS:0000000000000000
[ 35.634306] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 35.634456] CR2: 00007f3563227095 CR3: 000000000201d000 CR4: 00000000000406e0
[ 35.634632] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 35.634865] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 35.635055] Call Trace:
[ 35.635271] ? __lock_acquire+0xf0d/0x1117
[ 35.635522] ipv4_pktinfo_prepare+0x82/0x151
[ 35.635831] raw_rcv_skb+0x17/0x3c
[ 35.636062] raw_rcv+0xe5/0xf7
[ 35.636287] raw_local_deliver+0x169/0x1d9
[ 35.636534] ip_local_deliver_finish+0x87/0x1c4
[ 35.636820] ip_local_deliver+0x63/0x7f
[ 35.637058] ip_rcv_finish+0x340/0x3a1
[ 35.637295] ip_rcv+0x314/0x34a
[ 35.637525] __netif_receive_skb_core+0x49f/0x7c5
[ 35.637780] ? lock_acquire+0x13f/0x1d7
[ 35.638018] ? lock_acquire+0x15e/0x1d7
[ 35.638259] __netif_receive_skb+0x1e/0x94
[ 35.638502] ? __netif_receive_skb+0x1e/0x94
[ 35.638748] netif_receive_skb_internal+0x74/0x300
[ 35.639002] ? dev_gro_receive+0x2ed/0x411
[ 35.639246] ? lock_is_held_type+0xc4/0xd2
[ 35.639491] napi_gro_receive+0x105/0x1a0
[ 35.639736] receive_buf+0xc32/0xc74
[ 35.639965] ? detach_buf+0x67/0x153
[ 35.640201] ? virtqueue_get_buf_ctx+0x120/0x176
[ 35.640453] virtnet_poll+0x128/0x1c5
[ 35.640690] net_rx_action+0x103/0x343
[ 35.640932] __do_softirq+0x1c7/0x4b7
[ 35.641171] run_ksoftirqd+0x23/0x5c
[ 35.641403] smpboot_thread_fn+0x24f/0x26d
[ 35.641646] ? sort_range+0x22/0x22
[ 35.641878] kthread+0x129/0x131
[ 35.642104] ? __list_add+0x31/0x31
[ 35.642335] ? __list_add+0x31/0x31
[ 35.642568] ret_from_fork+0x2a/0x40
[ 35.642804] Code: 05 bd 87 a3 00 01 e8 1f ef 98 ff 4d 85 f6 48 c7 c7 f0 4a 27 82 41 0f 94 c4 31 c9 31 d2 41 0f b6 f4 e8 04 71 a1 ff 45 84 e4 74 02 <0f> 0b 0f b7 93 c4 00 00 00 4d 8b a5 80 05 00 00 48 03 93 d0 00
[ 35.644342] RIP: fib_compute_spec_dst+0xfc/0x1ee RSP: ffff88005ad67978
Fixes: 193125dbd8eb ("net: Introduce VRF device driver")
Reported-by: Chris Cormier <chriscormier@cumulusnetworks.com>
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Acked-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/vrf.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -788,15 +788,10 @@ static int vrf_del_slave(struct net_devi
static void vrf_dev_uninit(struct net_device *dev)
{
struct net_vrf *vrf = netdev_priv(dev);
- struct net_device *port_dev;
- struct list_head *iter;
vrf_rtable_release(dev, vrf);
vrf_rt6_release(dev, vrf);
- netdev_for_each_lower_dev(dev, port_dev, iter)
- vrf_del_slave(dev, port_dev);
-
free_percpu(dev->dstats);
dev->dstats = NULL;
}
@@ -1247,6 +1242,12 @@ static int vrf_validate(struct nlattr *t
static void vrf_dellink(struct net_device *dev, struct list_head *head)
{
+ struct net_device *port_dev;
+ struct list_head *iter;
+
+ netdev_for_each_lower_dev(dev, port_dev, iter)
+ vrf_del_slave(dev, port_dev);
+
unregister_netdevice_queue(dev, head);
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-19 12:50 +0200 |
| Subject | [PATCH 4.11 35/88] block: Fix a blk_exit_rl() regression |
| Message-ID | <u4UIi-7mS-35@gated-at.bofh.it> |
| In reply to | #1691451 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@sandisk.com>
commit dc9edc44de6cd7cc8cc7f5b36c1adb221eda3207 upstream.
Avoid that the following complaint is reported:
BUG: sleeping function called from invalid context at kernel/workqueue.c:2790
in_atomic(): 1, irqs_disabled(): 0, pid: 41, name: rcuop/3
1 lock held by rcuop/3/41:
#0: (rcu_callback){......}, at: [<ffffffff8111f9a2>] rcu_nocb_kthread+0x282/0x500
Call Trace:
dump_stack+0x86/0xcf
___might_sleep+0x174/0x260
__might_sleep+0x4a/0x80
flush_work+0x7e/0x2e0
__cancel_work_timer+0x143/0x1c0
cancel_work_sync+0x10/0x20
blk_throtl_exit+0x25/0x60
blkcg_exit_queue+0x35/0x40
blk_release_queue+0x42/0x130
kobject_put+0xa9/0x190
This happens since we invoke callbacks that need to block from the
queue release handler. Fix this by pushing the final release to
a workqueue.
Reported-by: Ross Zwisler <zwisler@gmail.com>
Fixes: commit b425e5049258 ("block: Avoid that blk_exit_rl() triggers a use-after-free")
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Tested-by: Ross Zwisler <ross.zwisler@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Updated changelog
Signed-off-by: Jens Axboe <axboe@fb.com>
Cc: Laura Abbott <labbott@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-sysfs.c | 34 ++++++++++++++++++++++------------
include/linux/blkdev.h | 2 ++
2 files changed, 24 insertions(+), 12 deletions(-)
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -791,24 +791,25 @@ static void blk_free_queue_rcu(struct rc
}
/**
- * blk_release_queue: - release a &struct request_queue when it is no longer needed
- * @kobj: the kobj belonging to the request queue to be released
+ * __blk_release_queue - release a request queue when it is no longer needed
+ * @work: pointer to the release_work member of the request queue to be released
*
* Description:
- * blk_release_queue is the pair to blk_init_queue() or
- * blk_queue_make_request(). It should be called when a request queue is
- * being released; typically when a block device is being de-registered.
- * Currently, its primary task it to free all the &struct request
- * structures that were allocated to the queue and the queue itself.
+ * blk_release_queue is the counterpart of blk_init_queue(). It should be
+ * called when a request queue is being released; typically when a block
+ * device is being de-registered. Its primary task it to free the queue
+ * itself.
*
- * Note:
+ * Notes:
* The low level driver must have finished any outstanding requests first
* via blk_cleanup_queue().
- **/
-static void blk_release_queue(struct kobject *kobj)
+ *
+ * Although blk_release_queue() may be called with preemption disabled,
+ * __blk_release_queue() may sleep.
+ */
+static void __blk_release_queue(struct work_struct *work)
{
- struct request_queue *q =
- container_of(kobj, struct request_queue, kobj);
+ struct request_queue *q = container_of(work, typeof(*q), release_work);
wbt_exit(q);
bdi_put(q->backing_dev_info);
@@ -844,6 +845,15 @@ static void blk_release_queue(struct kob
call_rcu(&q->rcu_head, blk_free_queue_rcu);
}
+static void blk_release_queue(struct kobject *kobj)
+{
+ struct request_queue *q =
+ container_of(kobj, struct request_queue, kobj);
+
+ INIT_WORK(&q->release_work, __blk_release_queue);
+ schedule_work(&q->release_work);
+}
+
static const struct sysfs_ops queue_sysfs_ops = {
.show = queue_attr_show,
.store = queue_attr_store,
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -580,6 +580,8 @@ struct request_queue {
size_t cmd_size;
void *rq_alloc_data;
+
+ struct work_struct release_work;
};
#define QUEUE_FLAG_QUEUED 1 /* uses generic tag queueing */
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-19 12:50 +0200 |
| Subject | [PATCH 4.11 11/88] mlxsw: spectrum_router: Fix NULL pointer dereference |
| Message-ID | <u4UIj-7mS-39@gated-at.bofh.it> |
| In reply to | #1691451 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@mellanox.com>
[ Upstream commit 6b27c8adf27edf1dabe2cdcfaa101ef7e2712415 ]
In case a VLAN device is enslaved to a bridge we shouldn't create a
router interface (RIF) for it when it's configured with an IP address.
This is already handled by the driver for other types of netdevs, such
as physical ports and LAG devices.
If this IP address is then removed and the interface is subsequently
unlinked from the bridge, a NULL pointer dereference can happen, as the
original 802.1d FID was replaced with an rFID which was then deleted.
To reproduce:
$ ip link set dev enp3s0np9 up
$ ip link add name enp3s0np9.111 link enp3s0np9 type vlan id 111
$ ip link set dev enp3s0np9.111 up
$ ip link add name br0 type bridge
$ ip link set dev br0 up
$ ip link set enp3s0np9.111 master br0
$ ip address add dev enp3s0np9.111 192.168.0.1/24
$ ip address del dev enp3s0np9.111 192.168.0.1/24
$ ip link set dev enp3s0np9.111 nomaster
Fixes: 99724c18fc66 ("mlxsw: spectrum: Introduce support for router interfaces")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reported-by: Petr Machata <petrm@mellanox.com>
Tested-by: Petr Machata <petrm@mellanox.com>
Reviewed-by: Petr Machata <petrm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -3829,6 +3829,9 @@ static int mlxsw_sp_inetaddr_vlan_event(
struct mlxsw_sp *mlxsw_sp = mlxsw_sp_lower_get(vlan_dev);
u16 vid = vlan_dev_vlan_id(vlan_dev);
+ if (netif_is_bridge_port(vlan_dev))
+ return 0;
+
if (mlxsw_sp_port_dev_check(real_dev))
return mlxsw_sp_inetaddr_vport_event(vlan_dev, real_dev, event,
vid);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-19 12:50 +0200 |
| Subject | [PATCH 4.11 26/88] cxgb4: fix BUG() on interrupt deallocating path of ULD |
| Message-ID | <u4UIj-7mS-43@gated-at.bofh.it> |
| In reply to | #1691451 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Guilherme G. Piccoli" <gpiccoli@linux.vnet.ibm.com>
[ Upstream commit 6a146f3a5894b751cef16feb3d7903e45e3c445c ]
Since the introduction of ULD (Upper-Layer Drivers), the MSI-X
deallocating path changed in cxgb4: the driver frees the interrupts
of ULD when unregistering it or on shutdown PCI handler.
Problem is that if a MSI-X is not freed before deallocated in the PCI
layer, it will trigger a BUG() due to still "alive" interrupt being
tentatively quiesced.
The below trace was observed when doing a simple unbind of Chelsio's
adapter PCI function, like:
"echo 001e:80:00.4 > /sys/bus/pci/drivers/cxgb4/unbind"
Trace:
kernel BUG at drivers/pci/msi.c:352!
Oops: Exception in kernel mode, sig: 5 [#1]
...
NIP [c0000000005a5e60] free_msi_irqs+0xa0/0x250
LR [c0000000005a5e50] free_msi_irqs+0x90/0x250
Call Trace:
[c0000000005a5e50] free_msi_irqs+0x90/0x250 (unreliable)
[c0000000005a72c4] pci_disable_msix+0x124/0x180
[d000000011e06708] disable_msi+0x88/0xb0 [cxgb4]
[d000000011e06948] free_some_resources+0xa8/0x160 [cxgb4]
[d000000011e06d60] remove_one+0x170/0x3c0 [cxgb4]
[c00000000058a910] pci_device_remove+0x70/0x110
[c00000000064ef04] device_release_driver_internal+0x1f4/0x2c0
...
This patch fixes the issue by refactoring the shutdown path of ULD on
cxgb4 driver, by properly freeing and disabling interrupts on PCI
remove handler too.
Fixes: 0fbc81b3ad51 ("Allocate resources dynamically for all cxgb4 ULD's")
Reported-by: Harsha Thyagaraja <hathyaga@in.ibm.com>
Signed-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 16 ++++++---
drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c | 42 ++++++++++++++----------
2 files changed, 36 insertions(+), 22 deletions(-)
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -2076,12 +2076,12 @@ static void detach_ulds(struct adapter *
mutex_lock(&uld_mutex);
list_del(&adap->list_node);
+
for (i = 0; i < CXGB4_ULD_MAX; i++)
- if (adap->uld && adap->uld[i].handle) {
+ if (adap->uld && adap->uld[i].handle)
adap->uld[i].state_change(adap->uld[i].handle,
CXGB4_STATE_DETACH);
- adap->uld[i].handle = NULL;
- }
+
if (netevent_registered && list_empty(&adapter_list)) {
unregister_netevent_notifier(&cxgb4_netevent_nb);
netevent_registered = false;
@@ -5089,8 +5089,10 @@ static void remove_one(struct pci_dev *p
*/
destroy_workqueue(adapter->workq);
- if (is_uld(adapter))
+ if (is_uld(adapter)) {
detach_ulds(adapter);
+ t4_uld_clean_up(adapter);
+ }
disable_interrupts(adapter);
@@ -5167,7 +5169,11 @@ static void shutdown_one(struct pci_dev
if (adapter->port[i]->reg_state == NETREG_REGISTERED)
cxgb_close(adapter->port[i]);
- t4_uld_clean_up(adapter);
+ if (is_uld(adapter)) {
+ detach_ulds(adapter);
+ t4_uld_clean_up(adapter);
+ }
+
disable_interrupts(adapter);
disable_msi(adapter);
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
@@ -589,22 +589,37 @@ void t4_uld_mem_free(struct adapter *ada
kfree(adap->uld);
}
+/* This function should be called with uld_mutex taken. */
+static void cxgb4_shutdown_uld_adapter(struct adapter *adap, enum cxgb4_uld type)
+{
+ if (adap->uld[type].handle) {
+ adap->uld[type].handle = NULL;
+ adap->uld[type].add = NULL;
+ release_sge_txq_uld(adap, type);
+
+ if (adap->flags & FULL_INIT_DONE)
+ quiesce_rx_uld(adap, type);
+
+ if (adap->flags & USING_MSIX)
+ free_msix_queue_irqs_uld(adap, type);
+
+ free_sge_queues_uld(adap, type);
+ free_queues_uld(adap, type);
+ }
+}
+
void t4_uld_clean_up(struct adapter *adap)
{
unsigned int i;
- if (!adap->uld)
- return;
+ mutex_lock(&uld_mutex);
for (i = 0; i < CXGB4_ULD_MAX; i++) {
if (!adap->uld[i].handle)
continue;
- if (adap->flags & FULL_INIT_DONE)
- quiesce_rx_uld(adap, i);
- if (adap->flags & USING_MSIX)
- free_msix_queue_irqs_uld(adap, i);
- free_sge_queues_uld(adap, i);
- free_queues_uld(adap, i);
+
+ cxgb4_shutdown_uld_adapter(adap, i);
}
+ mutex_unlock(&uld_mutex);
}
static void uld_init(struct adapter *adap, struct cxgb4_lld_info *lld)
@@ -782,15 +797,8 @@ int cxgb4_unregister_uld(enum cxgb4_uld
continue;
if (type == CXGB4_ULD_ISCSIT && is_t4(adap->params.chip))
continue;
- adap->uld[type].handle = NULL;
- adap->uld[type].add = NULL;
- release_sge_txq_uld(adap, type);
- if (adap->flags & FULL_INIT_DONE)
- quiesce_rx_uld(adap, type);
- if (adap->flags & USING_MSIX)
- free_msix_queue_irqs_uld(adap, type);
- free_sge_queues_uld(adap, type);
- free_queues_uld(adap, type);
+
+ cxgb4_shutdown_uld_adapter(adap, type);
}
mutex_unlock(&uld_mutex);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-19 12:50 +0200 |
| Subject | [PATCH 4.11 21/88] liquidio: fix bug in soft reset failure detection |
| Message-ID | <u4UIj-7mS-45@gated-at.bofh.it> |
| In reply to | #1691451 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek Chickles <derek.chickles@cavium.com>
[ Upstream commit 05a6b4cae8c0cc1680c9dd33a97a49a13c0f01bc ]
The code that detects a failed soft reset of Octeon is comparing the wrong
value against the reset value of the Octeon SLI_SCRATCH_1 register,
resulting in an inability to detect a soft reset failure. Fix it by using
the correct value in the comparison, which is any non-zero value.
Fixes: f21fb3ed364b ("Add support of Cavium Liquidio ethernet adapters")
Fixes: c0eab5b3580a ("liquidio: CN23XX firmware download")
Signed-off-by: Derek Chickles <derek.chickles@cavium.com>
Signed-off-by: Satanand Burla <satananda.burla@cavium.com>
Signed-off-by: Raghu Vatsavayi <raghu.vatsavayi@cavium.com>
Signed-off-by: Felix Manlunas <felix.manlunas@cavium.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c | 2 +-
drivers/net/ethernet/cavium/liquidio/cn66xx_device.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
@@ -221,7 +221,7 @@ static int cn23xx_pf_soft_reset(struct o
/* Wait for 100ms as Octeon resets. */
mdelay(100);
- if (octeon_read_csr64(oct, CN23XX_SLI_SCRATCH1) == 0x1234ULL) {
+ if (octeon_read_csr64(oct, CN23XX_SLI_SCRATCH1)) {
dev_err(&oct->pci_dev->dev, "OCTEON[%d]: Soft reset failed\n",
oct->octeon_id);
return 1;
--- a/drivers/net/ethernet/cavium/liquidio/cn66xx_device.c
+++ b/drivers/net/ethernet/cavium/liquidio/cn66xx_device.c
@@ -44,7 +44,7 @@ int lio_cn6xxx_soft_reset(struct octeon_
/* Wait for 10ms as Octeon resets. */
mdelay(100);
- if (octeon_read_csr64(oct, CN6XXX_SLI_SCRATCH1) == 0x1234ULL) {
+ if (octeon_read_csr64(oct, CN6XXX_SLI_SCRATCH1)) {
dev_err(&oct->pci_dev->dev, "Soft reset failed\n");
return 1;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-19 12:50 +0200 |
| Subject | [PATCH 4.11 13/88] bpf: prevent leaking pointer via xadd on unpriviledged |
| Message-ID | <u4UIj-7mS-49@gated-at.bofh.it> |
| In reply to | #1691451 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit 6bdf6abc56b53103324dfd270a86580306e1a232 ]
Leaking kernel addresses on unpriviledged is generally disallowed,
for example, verifier rejects the following:
0: (b7) r0 = 0
1: (18) r2 = 0xffff897e82304400
3: (7b) *(u64 *)(r1 +48) = r2
R2 leaks addr into ctx
Doing pointer arithmetic on them is also forbidden, so that they
don't turn into unknown value and then get leaked out. However,
there's xadd as a special case, where we don't check the src reg
for being a pointer register, e.g. the following will pass:
0: (b7) r0 = 0
1: (7b) *(u64 *)(r1 +48) = r0
2: (18) r2 = 0xffff897e82304400 ; map
4: (db) lock *(u64 *)(r1 +48) += r2
5: (95) exit
We could store the pointer into skb->cb, loose the type context,
and then read it out from there again to leak it eventually out
of a map value. Or more easily in a different variant, too:
0: (bf) r6 = r1
1: (7a) *(u64 *)(r10 -8) = 0
2: (bf) r2 = r10
3: (07) r2 += -8
4: (18) r1 = 0x0
6: (85) call bpf_map_lookup_elem#1
7: (15) if r0 == 0x0 goto pc+3
R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0 R6=ctx R10=fp
8: (b7) r3 = 0
9: (7b) *(u64 *)(r0 +0) = r3
10: (db) lock *(u64 *)(r0 +0) += r6
11: (b7) r0 = 0
12: (95) exit
from 7 to 11: R0=inv,min_value=0,max_value=0 R6=ctx R10=fp
11: (b7) r0 = 0
12: (95) exit
Prevent this by checking xadd src reg for pointer types. Also
add a couple of test cases related to this.
Fixes: 1be7f75d1668 ("bpf: enable non-root eBPF programs")
Fixes: 17a5267067f3 ("bpf: verifier (add verifier core)")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/verifier.c | 5 ++
tools/testing/selftests/bpf/test_verifier.c | 66 ++++++++++++++++++++++++++++
2 files changed, 71 insertions(+)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -951,6 +951,11 @@ static int check_xadd(struct bpf_verifie
if (err)
return err;
+ if (is_pointer_value(env, insn->src_reg)) {
+ verbose("R%d leaks addr into mem\n", insn->src_reg);
+ return -EACCES;
+ }
+
/* check whether atomic_add can read the memory */
err = check_mem_access(env, insn->dst_reg, insn->off,
BPF_SIZE(insn->code), BPF_READ, -1);
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -3518,6 +3518,72 @@ static struct bpf_test tests[] = {
.errstr = "invalid bpf_context access",
},
{
+ "leak pointer into ctx 1",
+ .insns = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+ offsetof(struct __sk_buff, cb[0])),
+ BPF_LD_MAP_FD(BPF_REG_2, 0),
+ BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
+ offsetof(struct __sk_buff, cb[0])),
+ BPF_EXIT_INSN(),
+ },
+ .fixup_map1 = { 2 },
+ .errstr_unpriv = "R2 leaks addr into mem",
+ .result_unpriv = REJECT,
+ .result = ACCEPT,
+ },
+ {
+ "leak pointer into ctx 2",
+ .insns = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+ offsetof(struct __sk_buff, cb[0])),
+ BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
+ offsetof(struct __sk_buff, cb[0])),
+ BPF_EXIT_INSN(),
+ },
+ .errstr_unpriv = "R10 leaks addr into mem",
+ .result_unpriv = REJECT,
+ .result = ACCEPT,
+ },
+ {
+ "leak pointer into ctx 3",
+ .insns = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_LD_MAP_FD(BPF_REG_2, 0),
+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
+ offsetof(struct __sk_buff, cb[0])),
+ BPF_EXIT_INSN(),
+ },
+ .fixup_map1 = { 1 },
+ .errstr_unpriv = "R2 leaks addr into ctx",
+ .result_unpriv = REJECT,
+ .result = ACCEPT,
+ },
+ {
+ "leak pointer into map val",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+ BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+ BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+ BPF_LD_MAP_FD(BPF_REG_1, 0),
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+ BPF_FUNC_map_lookup_elem),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+ BPF_MOV64_IMM(BPF_REG_3, 0),
+ BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
+ BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ },
+ .fixup_map1 = { 4 },
+ .errstr_unpriv = "R6 leaks addr into mem",
+ .result_unpriv = REJECT,
+ .result = ACCEPT,
+ },
+ {
"helper access to map: full range",
.insns = {
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-19 12:50 +0200 |
| Subject | [PATCH 4.11 03/88] netvsc: dont access netdev->num_rx_queues directly |
| Message-ID | <u4UIj-7mS-59@gated-at.bofh.it> |
| In reply to | #1691451 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit b92b7d3312033a08cae2c879b9243c42ad7de94b ]
This structure member is hidden behind CONFIG_SYSFS, and we
get a build error when that is disabled:
drivers/net/hyperv/netvsc_drv.c: In function 'netvsc_set_channels':
drivers/net/hyperv/netvsc_drv.c:754:49: error: 'struct net_device' has no member named 'num_rx_queues'; did you mean 'num_tx_queues'?
drivers/net/hyperv/netvsc_drv.c: In function 'netvsc_set_rxfh':
drivers/net/hyperv/netvsc_drv.c:1181:25: error: 'struct net_device' has no member named 'num_rx_queues'; did you mean 'num_tx_queues'?
As the value is only set once to the argument of alloc_netdev_mq(),
we can compare against that constant directly.
Fixes: ff4a44199012 ("netvsc: allow get/set of RSS indirection table")
Fixes: 2b01888d1b45 ("netvsc: allow more flexible setting of number of channels")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/hyperv/netvsc_drv.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -753,7 +753,7 @@ static int netvsc_set_channels(struct ne
channels->rx_count || channels->tx_count || channels->other_count)
return -EINVAL;
- if (count > net->num_tx_queues || count > net->num_rx_queues)
+ if (count > net->num_tx_queues || count > VRSS_CHANNEL_MAX)
return -EINVAL;
if (net_device_ctx->start_remove || !nvdev || nvdev->destroy)
@@ -1142,7 +1142,7 @@ static int netvsc_set_rxfh(struct net_de
if (indir) {
for (i = 0; i < ITAB_NUM; i++)
- if (indir[i] >= dev->num_rx_queues)
+ if (indir[i] >= VRSS_CHANNEL_MAX)
return -EINVAL;
for (i = 0; i < ITAB_NUM; i++)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-19 12:50 +0200 |
| Subject | [PATCH 4.11 12/88] rocker: move dereference before free |
| Message-ID | <u4UIj-7mS-55@gated-at.bofh.it> |
| In reply to | #1691451 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit acb4b7df48b539cb391287921de57e4e5fae3460 ]
My static checker complains that ofdpa_neigh_del() can sometimes free
"found". It just makes sense to use it first before deleting it.
Fixes: ecf244f753e0 ("rocker: fix maybe-uninitialized warning")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/rocker/rocker_ofdpa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/rocker/rocker_ofdpa.c
+++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c
@@ -1505,8 +1505,8 @@ static int ofdpa_port_ipv4_nh(struct ofd
*index = entry->index;
resolved = false;
} else if (removing) {
- ofdpa_neigh_del(trans, found);
*index = found->index;
+ ofdpa_neigh_del(trans, found);
} else if (updating) {
ofdpa_neigh_update(found, trans, NULL, false);
resolved = !is_zero_ether_addr(found->eth_dst);
[toc] | [prev] | [next] | [standalone]
| From | Guenter Roeck <linux@roeck-us.net> |
|---|---|
| Date | 2017-07-19 22:40 +0200 |
| Message-ID | <u53Vg-5jH-7@gated-at.bofh.it> |
| In reply to | #1691451 |
On Wed, Jul 19, 2017 at 12:07:22PM +0200, Greg Kroah-Hartman wrote: > This is the start of the stable review cycle for the 4.11.12 release. > There are 88 patches in this series, all will be posted as a response > to this one. If anyone has any issues with these being applied, please > let me know. > > Responses should be made by Fri Jul 21 10:07:36 UTC 2017. > Anything received after that time might be too late. > Build results: total: 145 pass: 145 fail: 0 Qemu test results: total: 122 pass: 122 fail: 0 Details are available at http://kerneltests.org/builders. Guenter
[toc] | [prev] | [next] | [standalone]
| From | Shuah Khan <shuahkh@osg.samsung.com> |
|---|---|
| Date | 2017-07-20 01:40 +0200 |
| Message-ID | <u56Jr-7ff-7@gated-at.bofh.it> |
| In reply to | #1691451 |
On 07/19/2017 04:07 AM, Greg Kroah-Hartman wrote: > This is the start of the stable review cycle for the 4.11.12 release. > There are 88 patches in this series, all will be posted as a response > to this one. If anyone has any issues with these being applied, please > let me know. > > Responses should be made by Fri Jul 21 10:07:36 UTC 2017. > Anything received after that time might be too late. > > The whole patch series can be found in one patch at: > kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.11.12-rc1.gz > or in the git tree and branch at: > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.11.y > and the diffstat can be found below. > > thanks, > > greg k-h > Compiled and booted on my test system. No dmesg regressions. thanks, -- Shuah
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web