github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-12 00:23:01 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
843,814 Commits 1 Branch 934 Tags 20 GiB
f56e208d80
Commit Graph

56777 Commits

Author SHA1 Message Date
Tao Huang
fd0e3eb0c2 Merge remote branch 'android-4.19' of https://android.googlesource.com/kernel/common 
* android-4.19: (3557 commits)
  ANDROID: kernel: cgroup: cpuset: Clear cpus_requested for empty buf
  ANDROID: kernel: cgroup: cpuset: Add missing allocation of cpus_requested in alloc_trial_cpuset
  Linux 4.19.53
  rtc: pcf8523: don't return invalid date when battery is low
  drm: add fallback override/firmware EDID modes workaround
  drm/edid: abstract override/firmware EDID retrieval
  x86/resctrl: Prevent NULL pointer dereference when local MBM is disabled
  x86/mm/KASLR: Compute the size of the vmemmap section properly
  x86/kasan: Fix boot with 5-level paging and KASAN
  x86/microcode, cpuhotplug: Add a microcode loader CPU hotplug callback
  RAS/CEC: Fix binary search function
  RAS/CEC: Convert the timer callback to a workqueue
  timekeeping: Repair ktime_get_coarse*() granularity
  USB: serial: option: add Telit 0x1260 and 0x1261 compositions
  USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode
  USB: serial: pl2303: add Allied Telesis VT-Kit3
  USB: usb-storage: Add new ID to ums-realtek
  USB: Fix chipmunk-like voice when using Logitech C270 for recording audio.
  usb: dwc2: host: Fix wMaxPacketSize handling (fix webcam regression)
  usb: dwc2: Fix DMA cache alignment issues
  ...

Conflicts:
	arch/arm/boot/dts/rk3288.dtsi
	drivers/bluetooth/hci_ldisc.c
	drivers/clk/clk-fractional-divider.c
	drivers/clk/rockchip/clk-rk3288.c
	drivers/gpu/drm/rockchip/rockchip_drm_vop.c
	init/main.c
	kernel/sched/fair.c

Change-Id: I8bcf9aad06fe9648fc2621bac8475a47be1212fb
 2019-06-22 22:26:14 +08:00
Greg Kroah-Hartman
d9bd2653b0 This is the 4.19.52 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl0H0z4ACgkQONu9yGCS
 aT4HWBAAll+fZP+lyzJEN30dMUARvPpA6ZL5zwiKVWqTHNDyIRNAonrM/MOPyq9h
 NpiadntN4BTn/X1rdM81FrWNSoMbgfYsXbtW3DsaoMndA3+YPvEWtoUakBQ6Xqop
 FnZoCSUTC9ZMpuPz4JH1z6y+QrtobQAf6y+bsMr5Ur4VUu1LYhVIVf+O0yYkhJP1
 h1MdehCFZPdrAmqhaGp5lscWmdGS+pvXNhJu/je7mpKgNXF+amDHmOc6ipFTsf2I
 q/2GR1GzO4aym4VMdWQo9H9HD4l/Sm+fih+nf2wHqJdpIsg6cnrgy2Q6r2WZlKVZ
 bYu8UffXbXJQLT1MwLJbxr/qpKX/PcS/y9D+S8PZOzA9SO7GfeME5YIpvSxZ9AAG
 mFNdqdByNETSRwCwuTGac+Gs2f77b/1YY3boWiJvcX/l91iwefVABv7reC9BAd/f
 39NARnboVH5B7LPrMRjL2nQB5JZL6iTXbxgej2IHr2ew+9kIr6z5Hfu4Asq6KJtH
 L25tyMk6u99qQqtLfX2xaSeYCXmyyj6Qro4iy3M5hWuWhr9n3ZpCTzWUSwGBqz5z
 ov1wjBBUwPoHGuD6SDStIU1rAU0lHy2lELPA2B0GuwKPeAe1GRBYPaednSpAH8R6
 yJTEmN5seL7h6J0QvtOe5dsIZ7CV9vxuI1jqX6Zxw7Zh8ldBDRo=
 =/0zg
 -----END PGP SIGNATURE-----

Merge 4.19.52 into android-4.19

Changes in 4.19.52
	tcp: limit payload size of sacked skbs
	tcp: tcp_fragment() should apply sane memory limits
	tcp: add tcp_min_snd_mss sysctl
	tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
	Linux 4.19.52

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2019-06-17 20:02:56 +02:00
Eric Dumazet
59222807fc tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() 
commit 967c05aee4 upstream.

If mtu probing is enabled tcp_mtu_probing() could very well end up
with a too small MSS.

Use the new sysctl tcp_min_snd_mss to make sure MSS search
is performed in an acceptable range.

CVE-2019-11479 -- tcp mss hardcoded to 48

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Cc: Jonathan Looney <jtl@netflix.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Tyler Hicks <tyhicks@canonical.com>
Cc: Bruce Curtis <brucec@netflix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-17 19:51:56 +02:00
Eric Dumazet
7f9f8a37e5 tcp: add tcp_min_snd_mss sysctl 
commit 5f3e2bf008 upstream.

Some TCP peers announce a very small MSS option in their SYN and/or
SYN/ACK messages.

This forces the stack to send packets with a very high network/cpu
overhead.

Linux has enforced a minimal value of 48. Since this value includes
the size of TCP options, and that the options can consume up to 40
bytes, this means that each segment can include only 8 bytes of payload.

In some cases, it can be useful to increase the minimal value
to a saner value.

We still let the default to 48 (TCP_MIN_SND_MSS), for compatibility
reasons.

Note that TCP_MAXSEG socket option enforces a minimal value
of (TCP_MIN_MSS). David Miller increased this minimal value
in commit c39508d6f1 ("tcp: Make TCP_MAXSEG minimum more correct.")
from 64 to 88.

We might in the future merge TCP_MIN_SND_MSS and TCP_MIN_MSS.

CVE-2019-11479 -- tcp mss hardcoded to 48

Signed-off-by: Eric Dumazet <edumazet@google.com>
Suggested-by: Jonathan Looney <jtl@netflix.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Tyler Hicks <tyhicks@canonical.com>
Cc: Bruce Curtis <brucec@netflix.com>
Cc: Jonathan Lemon <jonathan.lemon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-17 19:51:56 +02:00
Eric Dumazet
ec83921899 tcp: tcp_fragment() should apply sane memory limits 
commit f070ef2ac6 upstream.

Jonathan Looney reported that a malicious peer can force a sender
to fragment its retransmit queue into tiny skbs, inflating memory
usage and/or overflow 32bit counters.

TCP allows an application to queue up to sk_sndbuf bytes,
so we need to give some allowance for non malicious splitting
of retransmit queue.

A new SNMP counter is added to monitor how many times TCP
did not allow to split an skb if the allowance was exceeded.

Note that this counter might increase in the case applications
use SO_SNDBUF socket option to lower sk_sndbuf.

CVE-2019-11478 : tcp_fragment, prevent fragmenting a packet when the
	socket is already using more than half the allowed space

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Jonathan Looney <jtl@netflix.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
Cc: Bruce Curtis <brucec@netflix.com>
Cc: Jonathan Lemon <jonathan.lemon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-17 19:51:56 +02:00
Eric Dumazet
c09be31461 tcp: limit payload size of sacked skbs 
commit 3b4929f65b upstream.

Jonathan Looney reported that TCP can trigger the following crash
in tcp_shifted_skb() :

	BUG_ON(tcp_skb_pcount(skb) < pcount);

This can happen if the remote peer has advertized the smallest
MSS that linux TCP accepts : 48

An skb can hold 17 fragments, and each fragment can hold 32KB
on x86, or 64KB on PowerPC.

This means that the 16bit witdh of TCP_SKB_CB(skb)->tcp_gso_segs
can overflow.

Note that tcp_sendmsg() builds skbs with less than 64KB
of payload, so this problem needs SACK to be enabled.
SACK blocks allow TCP to coalesce multiple skbs in the retransmit
queue, thus filling the 17 fragments to maximal capacity.

CVE-2019-11477 -- u16 overflow of TCP_SKB_CB(skb)->tcp_gso_segs

Fixes: 832d11c5cd ("tcp: Try to restore large SKBs while SACK processing")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Jonathan Looney <jtl@netflix.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Bruce Curtis <brucec@netflix.com>
Cc: Jonathan Lemon <jonathan.lemon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-17 19:51:56 +02:00
Greg Kroah-Hartman
d1f7f3be99 This is the 4.19.51 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIyBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl0EwEMACgkQONu9yGCS
 aT4UpA/3UqmMAaHH4g20cic8YDoBkYXoQUyj/kbf1w6bXqCuLTHOFS/qXa6QtPK3
 WfwNWChIob+EbfAMjreQZjT6pwBbxyCNUvsvpB0k8YhJ3v/sIZL/Wc+1ZDu+jBC9
 xfqwT9+JGzgu8P4PUTr1BsGMhgiH9qoJAeq7RCuDcicMIJ4/aJVr4Cvrs+18PVUe
 95T5vSn6G62QyOrUExmuuztvNM2P/kos6yJTkN80l3uPLMUjsnWCsMKu+9utd5ea
 ew332Z/BQs+ff4oljH1uRwsM/Z7+AKXlXatXD0sHQ8CTEqh44SgUSU96vB/h9W8I
 6a0t4M2atsdaGjMHmiiPA+gIgd1rW0lsHk6ob6qgfzuRBFGN9BTUfZgQwhOW7uXt
 e4o5RrWELkbk/TlJzrG1dFjhfyeb7q3LHOOg8kOVU0KdPD44ekJW9qoI8tlMPI+5
 mafCCS/oS6TaW20ZKmjjkIbfTndzdO3dy5EWLy3elCEyLF2gDZ6WCAL+SMngdApC
 /dbuBigF/+RBaEU1e56DkcYUYXjt6UO84O3dYAx69s6EhHS5CP4yCySuYpdxyg/G
 MWdFDhtbnFyMXqoK1ROS0hNnxpydkh+R1Ns0TeSYibJI2J2enMGIa0thu4aVLD3v
 +GLqHV2PsPTRQmF5ChnvNV7O53i4j4WBQQjL+80PQulJwRFb/A==
 =bIqz
 -----END PGP SIGNATURE-----

Merge 4.19.51 into android-4.19

Changes in 4.19.51
	rapidio: fix a NULL pointer dereference when create_workqueue() fails
	fs/fat/file.c: issue flush after the writeback of FAT
	sysctl: return -EINVAL if val violates minmax
	ipc: prevent lockup on alloc_msg and free_msg
	drm/pl111: Initialize clock spinlock early
	ARM: prevent tracing IPI_CPU_BACKTRACE
	mm/hmm: select mmu notifier when selecting HMM
	hugetlbfs: on restore reserve error path retain subpool reservation
	mem-hotplug: fix node spanned pages when we have a node with only ZONE_MOVABLE
	mm/cma.c: fix crash on CMA allocation if bitmap allocation fails
	initramfs: free initrd memory if opening /initrd.image fails
	mm/cma.c: fix the bitmap status to show failed allocation reason
	mm: page_mkclean vs MADV_DONTNEED race
	mm/cma_debug.c: fix the break condition in cma_maxchunk_get()
	mm/slab.c: fix an infinite loop in leaks_show()
	kernel/sys.c: prctl: fix false positive in validate_prctl_map()
	thermal: rcar_gen3_thermal: disable interrupt in .remove
	drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER
	mfd: tps65912-spi: Add missing of table registration
	mfd: intel-lpss: Set the device in reset state when init
	drm/nouveau/disp/dp: respect sink limits when selecting failsafe link configuration
	mfd: twl6040: Fix device init errors for ACCCTL register
	perf/x86/intel: Allow PEBS multi-entry in watermark mode
	drm/nouveau/kms/gf119-gp10x: push HeadSetControlOutputResource() mthd when encoders change
	drm/bridge: adv7511: Fix low refresh rate selection
	objtool: Don't use ignore flag for fake jumps
	drm/nouveau/kms/gv100-: fix spurious window immediate interlocks
	bpf: fix undefined behavior in narrow load handling
	EDAC/mpc85xx: Prevent building as a module
	pwm: meson: Use the spin-lock only to protect register modifications
	mailbox: stm32-ipcc: check invalid irq
	ntp: Allow TAI-UTC offset to be set to zero
	f2fs: fix to avoid panic in do_recover_data()
	f2fs: fix to avoid panic in f2fs_inplace_write_data()
	f2fs: fix to avoid panic in f2fs_remove_inode_page()
	f2fs: fix to do sanity check on free nid
	f2fs: fix to clear dirty inode in error path of f2fs_iget()
	f2fs: fix to avoid panic in dec_valid_block_count()
	f2fs: fix to use inline space only if inline_xattr is enable
	f2fs: fix to do sanity check on valid block count of segment
	f2fs: fix to do checksum even if inode page is uptodate
	percpu: remove spurious lock dependency between percpu and sched
	configfs: fix possible use-after-free in configfs_register_group
	uml: fix a boot splat wrt use of cpu_all_mask
	PCI: dwc: Free MSI in dw_pcie_host_init() error path
	PCI: dwc: Free MSI IRQ page in dw_pcie_free_msi()
	ovl: do not generate duplicate fsnotify events for "fake" path
	mmc: mmci: Prevent polling for busy detection in IRQ context
	netfilter: nf_flow_table: fix missing error check for rhashtable_insert_fast
	netfilter: nf_conntrack_h323: restore boundary check correctness
	mips: Make sure dt memory regions are valid
	netfilter: nf_tables: fix base chain stat rcu_dereference usage
	watchdog: imx2_wdt: Fix set_timeout for big timeout values
	watchdog: fix compile time error of pretimeout governors
	blk-mq: move cancel of requeue_work into blk_mq_release
	iommu/vt-d: Set intel_iommu_gfx_mapped correctly
	misc: pci_endpoint_test: Fix test_reg_bar to be updated in pci_endpoint_test
	PCI: designware-ep: Use aligned ATU window for raising MSI interrupts
	nvme-pci: unquiesce admin queue on shutdown
	nvme-pci: shutdown on timeout during deletion
	netfilter: nf_flow_table: check ttl value in flow offload data path
	netfilter: nf_flow_table: fix netdev refcnt leak
	ALSA: hda - Register irq handler after the chip initialization
	nvmem: core: fix read buffer in place
	nvmem: sunxi_sid: Support SID on A83T and H5
	fuse: retrieve: cap requested size to negotiated max_write
	nfsd: allow fh_want_write to be called twice
	nfsd: avoid uninitialized variable warning
	vfio: Fix WARNING "do not call blocking ops when !TASK_RUNNING"
	iommu/arm-smmu-v3: Don't disable SMMU in kdump kernel
	switchtec: Fix unintended mask of MRPC event
	net: thunderbolt: Unregister ThunderboltIP protocol handler when suspending
	x86/PCI: Fix PCI IRQ routing table memory leak
	i40e: Queues are reserved despite "Invalid argument" error
	platform/chrome: cros_ec_proto: check for NULL transfer function
	PCI: keystone: Prevent ARM32 specific code to be compiled for ARM64
	soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher
	clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288
	soc: rockchip: Set the proper PWM for rk3288
	ARM: dts: imx51: Specify IMX5_CLK_IPG as "ahb" clock to SDMA
	ARM: dts: imx50: Specify IMX5_CLK_IPG as "ahb" clock to SDMA
	ARM: dts: imx53: Specify IMX5_CLK_IPG as "ahb" clock to SDMA
	ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ahb" clock to SDMA
	ARM: dts: imx6sll: Specify IMX6SLL_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx7d: Specify IMX7D_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx6ul: Specify IMX6UL_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx6qdl: Specify IMX6QDL_CLK_IPG as "ipg" clock to SDMA
	PCI: rpadlpar: Fix leaked device_node references in add/remove paths
	drm/amd/display: Use plane->color_space for dpp if specified
	ARM: OMAP2+: pm33xx-core: Do not Turn OFF CEFUSE as PPA may be using it
	platform/x86: intel_pmc_ipc: adding error handling
	power: supply: max14656: fix potential use-before-alloc
	net: hns3: return 0 and print warning when hit duplicate MAC
	PCI: rcar: Fix a potential NULL pointer dereference
	PCI: rcar: Fix 64bit MSI message address handling
	scsi: qla2xxx: Reset the FCF_ASYNC_{SENT|ACTIVE} flags
	video: hgafb: fix potential NULL pointer dereference
	video: imsttfb: fix potential NULL pointer dereferences
	block, bfq: increase idling for weight-raised queues
	PCI: xilinx: Check for __get_free_pages() failure
	gpio: gpio-omap: add check for off wake capable gpios
	ice: Add missing case in print_link_msg for printing flow control
	dmaengine: idma64: Use actual device for DMA transfers
	pwm: tiehrpwm: Update shadow register for disabling PWMs
	ARM: dts: exynos: Always enable necessary APIO_1V8 and ABB_1V8 regulators on Arndale Octa
	pwm: Fix deadlock warning when removing PWM device
	ARM: exynos: Fix undefined instruction during Exynos5422 resume
	usb: typec: fusb302: Check vconn is off when we start toggling
	soc: renesas: Identify R-Car M3-W ES1.3
	gpio: vf610: Do not share irq_chip
	percpu: do not search past bitmap when allocating an area
	Revert "Bluetooth: Align minimum encryption key size for LE and BR/EDR connections"
	Revert "drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)"
	ovl: check the capability before cred overridden
	ovl: support stacked SEEK_HOLE/SEEK_DATA
	drm/vc4: fix fb references in async update
	ALSA: seq: Cover unsubscribe_port() in list_mutex
	Linux 4.19.51

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2019-06-15 16:12:59 +02:00
Greg Kroah-Hartman
8e5483aeae Revert "Bluetooth: Align minimum encryption key size for LE and BR/EDR connections" 
This reverts commit 38f092c41c which is
commit d5bb334a8e upstream.

Lots of people have reported issues with this patch, and as there does
not seem to be a fix going into Linus's kernel tree any time soon,
revert the commit in the stable trees so as to get people's machines
working properly again.

Reported-by: Vasily Khoruzhick <anarsoul@gmail.com>
Reported-by: Hans de Goede <hdegoede@redhat.com>
Cc: Jeremy Cline <jeremy@jcline.org>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-15 11:54:11 +02:00
Taehee Yoo
028b3d8d54 netfilter: nf_flow_table: fix netdev refcnt leak 
[ Upstream commit 26a302afbe ]

flow_offload_alloc() calls nf_route() to get a dst_entry. Internally,
nf_route() calls ip_route_output_key() that allocates a dst_entry and
holds it. So, a dst_entry should be released by dst_release() if
nf_route() is successful.

Otherwise, netns exit routine cannot be finished and the following
message is printed:

[  257.490952] unregister_netdevice: waiting for lo to become free. Usage count = 1

Fixes: ac2a66665e ("netfilter: add generic flow table infrastructure")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2019-06-15 11:54:06 +02:00
Taehee Yoo
650a4b7c5d netfilter: nf_flow_table: check ttl value in flow offload data path 
[ Upstream commit 33cc3c0cfa ]

nf_flow_offload_ip_hook() and nf_flow_offload_ipv6_hook() do not check
ttl value. So, ttl value overflow may occur.

Fixes: 97add9f0d6 ("netfilter: flow table support for IPv4")
Fixes: 0995210753 ("netfilter: flow table support for IPv6")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2019-06-15 11:54:06 +02:00
Florian Westphal
dc58e40274 netfilter: nf_tables: fix base chain stat rcu_dereference usage 
[ Upstream commit edbd82c5fb ]

Following splat gets triggered when nfnetlink monitor is running while
xtables-nft selftests are running:

net/netfilter/nf_tables_api.c:1272 suspicious rcu_dereference_check() usage!
other info that might help us debug this:

1 lock held by xtables-nft-mul/27006:
 #0: 00000000e0f85be9 (&net->nft.commit_mutex){+.+.}, at: nf_tables_valid_genid+0x1a/0x50
Call Trace:
 nf_tables_fill_chain_info.isra.45+0x6cc/0x6e0
 nf_tables_chain_notify+0xf8/0x1a0
 nf_tables_commit+0x165c/0x1740

nf_tables_fill_chain_info() can be called both from dumps (rcu read locked)
or from the transaction path if a userspace process subscribed to nftables
notifications.

In the 'table dump' case, rcu_access_pointer() cannot be used: We do not
hold transaction mutex so the pointer can be NULLed right after the check.
Just unconditionally fetch the value, then have the helper return
immediately if its NULL.

In the notification case we don't hold the rcu read lock, but updates are
prevented due to transaction mutex. Use rcu_dereference_check() to make lockdep
aware of this.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2019-06-15 11:54:05 +02:00
Jakub Jankowski
2aed9dfe1e netfilter: nf_conntrack_h323: restore boundary check correctness 
[ Upstream commit f5e85ce8e7 ]

Since commit bc7d811ace ("netfilter: nf_ct_h323: Convert
CHECK_BOUND macro to function"), NAT traversal for H.323
doesn't work, failing to parse H323-UserInformation.
nf_h323_error_boundary() compares contents of the bitstring,
not the addresses, preventing valid H.323 packets from being
conntrack'd.

This looks like an oversight from when CHECK_BOUND macro was
converted to a function.

To fix it, stop dereferencing bs->cur and bs->end.

Fixes: bc7d811ace ("netfilter: nf_ct_h323: Convert CHECK_BOUND macro to function")
Signed-off-by: Jakub Jankowski <shasta@toxcorp.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2019-06-15 11:54:05 +02:00
Taehee Yoo
d0941980fd netfilter: nf_flow_table: fix missing error check for rhashtable_insert_fast 
[ Upstream commit 43c8f13118 ]

rhashtable_insert_fast() may return an error value when memory
allocation fails, but flow_offload_add() does not check for errors.
This patch just adds missing error checking.

Fixes: ac2a66665e ("netfilter: add generic flow table infrastructure")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2019-06-15 11:54:05 +02:00
Greg Kroah-Hartman
be7c1cbd03 This is the 4.19.50 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlz/gIkACgkQONu9yGCS
 aT5OhA/9Fkm+5JmZGIS+zA8QCOHGRwX4ttO67yKxZUmHWp5kOEmPAEWFcf4zLeSB
 T7cpYfeW0YG7lOb53CLCVfXxOI+gVzOrhNC/Hk9Xerph6izew/oon3f6v125nrSE
 INZiYsFL0S5uCbA+wh0P6KVyq05SP01l1Et2q9mlIOp58mGhQadWF58eqw6V6rwn
 64NJyV1fwXXpnsiuCoy5E0Og9aSctlr+LCFCXaXnQU7WJXfXKBmUHNWRdfZnH+n7
 29OnC4oAyZ7aFRvP7iUS8hFxXvnVsHw1HDdRr1Ton0uFuiVGUkQ3oRjoVjPyTBwO
 M9Y+tViuCXEtH6KwiMMRKHHsIOZa2VguX8PO9cdr1Kl7kCMrkxGqk9YPOT/bDzrZ
 N69Lr7aZk3vxJtXPAhsoryKN0a0t5glOZD0CYTIoDsQHBMg0RfjKg8k4I2It7UMY
 blT8j4gNX17Ij240dbvJkD444mPBipk3wPXMrNkFvFAqT064cCQza7cbuXx5dpue
 NkgamI5tCyzTUap0jiQ4FP00RN7Vbfh3rZSXLqaeOo0oA8x228+NjkDrrM2pGsGI
 UFrXaphrwKSpvieuk2g2s/kzyJuOBWOk5mXf8jy8zR+NaLamdeI071PhqCmSVsm0
 4AuDaJGLiBnqX90N09EJ819F6vSUe3MULfZLC9rjISzh7aOI9Pk=
 =IPNo
 -----END PGP SIGNATURE-----

Merge 4.19.50 into android-4.19

Changes in 4.19.50
	ethtool: fix potential userspace buffer overflow
	Fix memory leak in sctp_process_init
	ipv4: not do cache for local delivery if bc_forwarding is enabled
	ipv6: fix the check before getting the cookie in rt6_get_cookie
	neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit
	net: ethernet: ti: cpsw_ethtool: fix ethtool ring param set
	net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query
	net: mvpp2: Use strscpy to handle stat strings
	net: rds: fix memory leak in rds_ib_flush_mr_pool
	net: sfp: read eeprom in maximum 16 byte increments
	net/tls: replace the sleeping lock around RX resync with a bit lock
	packet: unconditionally free po->rollover
	pktgen: do not sleep with the thread lock held.
	Revert "fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied"
	ipv6: use READ_ONCE() for inet->hdrincl as in ipv4
	ipv6: fix EFAULT on sendto with icmpv6 and hdrincl
	mtd: spinand: macronix: Fix ECC Status Read
	rcu: locking and unlocking need to always be at least barriers
	parisc: Use implicit space register selection for loading the coherence index of I/O pdirs
	NFSv4.1: Again fix a race where CB_NOTIFY_LOCK fails to wake a waiter
	NFSv4.1: Fix bug only first CB_NOTIFY_LOCK is handled
	fuse: fallocate: fix return with locked inode
	pstore: Remove needless lock during console writes
	pstore: Convert buf_lock to semaphore
	pstore: Set tfm to NULL on free_buf_for_compression
	pstore/ram: Run without kernel crash dump region
	x86/power: Fix 'nosmt' vs hibernation triple fault during resume
	x86/insn-eval: Fix use-after-free access to LDT entry
	i2c: xiic: Add max_read_len quirk
	s390/mm: fix address space detection in exception handling
	xen-blkfront: switch kcalloc to kvcalloc for large array allocation
	MIPS: Bounds check virt_addr_valid
	MIPS: pistachio: Build uImage.gz by default
	Revert "MIPS: perf: ath79: Fix perfcount IRQ assignment"
	genwqe: Prevent an integer overflow in the ioctl
	test_firmware: Use correct snprintf() limit
	drm/gma500/cdv: Check vbt config bits when detecting lvds panels
	drm/msm: fix fb references in async update
	drm: add non-desktop quirk for Valve HMDs
	drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)
	drm: add non-desktop quirks to Sensics and OSVR headsets.
	drm/amdgpu/psp: move psp version specific function pointers to early_init
	drm/radeon: prefer lower reference dividers
	drm/amdgpu: remove ATPX_DGPU_REQ_POWER_FOR_DISPLAYS check when hotplug-in
	drm/i915: Fix I915_EXEC_RING_MASK
	drm/i915/fbc: disable framebuffer compression on GeminiLake
	drm/i915: Maintain consistent documentation subsection ordering
	drm: don't block fb changes for async plane updates
	drm/i915/gvt: Initialize intel_gvt_gtt_entry in stack
	TTY: serial_core, add ->install
	ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
	ethtool: check the return value of get_regs_len
	Linux 4.19.50

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2019-06-11 12:38:58 +02:00
Yunsheng Lin
51dc284e2a ethtool: check the return value of get_regs_len 
commit f9fc54d313 upstream.

The return type for get_regs_len in struct ethtool_ops is int,
the hns3 driver may return error when failing to get the regs
len by sending cmd to firmware.

Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-11 12:20:57 +02:00
Olivier Matz
2488b9f9af ipv6: fix EFAULT on sendto with icmpv6 and hdrincl 
[ Upstream commit b9aa52c4cb ]

The following code returns EFAULT (Bad address):

  s = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
  setsockopt(s, SOL_IPV6, IPV6_HDRINCL, 1);
  sendto(ipv6_icmp6_packet, addr);   /* returns -1, errno = EFAULT */

The IPv4 equivalent code works. A workaround is to use IPPROTO_RAW
instead of IPPROTO_ICMPV6.

The failure happens because 2 bytes are eaten from the msghdr by
rawv6_probe_proto_opt() starting from commit 19e3c66b52 ("ipv6
equivalent of "ipv4: Avoid reading user iov twice after
raw_probe_proto_opt""), but at that time it was not a problem because
IPV6_HDRINCL was not yet introduced.

Only eat these 2 bytes if hdrincl == 0.

Fixes: 715f504b11 ("ipv6: add IPV6_HDRINCL option for raw sockets")
Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-11 12:20:50 +02:00
Olivier Matz
0b16d956ee ipv6: use READ_ONCE() for inet->hdrincl as in ipv4 
[ Upstream commit 59e3e4b526 ]

As it was done in commit 8f659a03a0 ("net: ipv4: fix for a race
condition in raw_sendmsg") and commit 20b50d7997 ("net: ipv4: emulate
READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()") for ipv4, copy the
value of inet->hdrincl in a local variable, to avoid introducing a race
condition in the next commit.

Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-11 12:20:50 +02:00
Hangbin Liu
d769853dbd Revert "fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied" 
[ Upstream commit 4970b42d5c ]

This reverts commit e9919a24d3.

Nathan reported the new behaviour breaks Android, as Android just add
new rules and delete old ones.

If we return 0 without adding dup rules, Android will remove the new
added rules and causing system to soft-reboot.

Fixes: e9919a24d3 ("fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied")
Reported-by: Nathan Chancellor <natechancellor@gmail.com>
Reported-by: Yaro Slav <yaro330@gmail.com>
Reported-by: Maciej Żenczykowski <zenczykowski@gmail.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-11 12:20:50 +02:00
Paolo Abeni
396244b6ec pktgen: do not sleep with the thread lock held. 
[ Upstream commit 720f1de402 ]

Currently, the process issuing a "start" command on the pktgen procfs
interface, acquires the pktgen thread lock and never release it, until
all pktgen threads are completed. The above can blocks indefinitely any
other pktgen command and any (even unrelated) netdevice removal - as
the pktgen netdev notifier acquires the same lock.

The issue is demonstrated by the following script, reported by Matteo:

ip -b - <<'EOF'
	link add type dummy
	link add type veth
	link set dummy0 up
EOF
modprobe pktgen
echo reset >/proc/net/pktgen/pgctrl
{
	echo rem_device_all
	echo add_device dummy0
} >/proc/net/pktgen/kpktgend_0
echo count 0 >/proc/net/pktgen/dummy0
echo start >/proc/net/pktgen/pgctrl &
sleep 1
rmmod veth

Fix the above releasing the thread lock around the sleep call.

Additionally we must prevent racing with forcefull rmmod - as the
thread lock no more protects from them. Instead, acquire a self-reference
before waiting for any thread. As a side effect, running

rmmod pktgen

while some thread is running now fails with "module in use" error,
before this patch such command hanged indefinitely.

Note: the issue predates the commit reported in the fixes tag, but
this fix can't be applied before the mentioned commit.

v1 -> v2:
 - no need to check for thread existence after flipping the lock,
   pktgen threads are freed only at net exit time
 -

Fixes: 6146e6a43b ("[PKTGEN]: Removes thread_{un,}lock() macros.")
Reported-and-tested-by: Matteo Croce <mcroce@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-11 12:20:49 +02:00
Willem de Bruijn
da096fe1a6 packet: unconditionally free po->rollover 
[ Upstream commit afa0925c6f ]

Rollover used to use a complex RCU mechanism for assignment, which had
a race condition. The below patch fixed the bug and greatly simplified
the logic.

The feature depends on fanout, but the state is private to the socket.
Fanout_release returns f only when the last member leaves and the
fanout struct is to be freed.

Destroy rollover unconditionally, regardless of fanout state.

Fixes: 57f015f5ec ("packet: fix crash in fanout_demux_rollover()")
Reported-by: syzbot <syzkaller@googlegroups.com>
Diagnosed-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-11 12:20:49 +02:00
Jakub Kicinski
be0343af12 net/tls: replace the sleeping lock around RX resync with a bit lock 
[ Upstream commit e52972c11d ]

Commit 38030d7cb7 ("net/tls: avoid NULL-deref on resync during device removal")
tried to fix a potential NULL-dereference by taking the
context rwsem.  Unfortunately the RX resync may get called
from soft IRQ, so we can't use the rwsem to protect from
the device disappearing.  Because we are guaranteed there
can be only one resync at a time (it's called from strparser)
use a bit to indicate resync is busy and make device
removal wait for the bit to get cleared.

Note that there is a leftover "flags" field in struct
tls_context already.

Fixes: 4799ac81e5 ("tls: Add rx inline crypto offload")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-11 12:20:49 +02:00
Zhu Yanjun
7700d5afff net: rds: fix memory leak in rds_ib_flush_mr_pool 
[ Upstream commit 85cb928787 ]

When the following tests last for several hours, the problem will occur.

Server:
    rds-stress -r 1.1.1.16 -D 1M
Client:
    rds-stress -r 1.1.1.14 -s 1.1.1.16 -D 1M -T 30

The following will occur.

"
Starting up....
tsks   tx/s   rx/s  tx+rx K/s    mbi K/s    mbo K/s tx us/c   rtt us cpu
%
  1      0      0       0.00       0.00       0.00    0.00 0.00 -1.00
  1      0      0       0.00       0.00       0.00    0.00 0.00 -1.00
  1      0      0       0.00       0.00       0.00    0.00 0.00 -1.00
  1      0      0       0.00       0.00       0.00    0.00 0.00 -1.00
"
>From vmcore, we can find that clean_list is NULL.

>From the source code, rds_mr_flushd calls rds_ib_mr_pool_flush_worker.
Then rds_ib_mr_pool_flush_worker calls
"
 rds_ib_flush_mr_pool(pool, 0, NULL);
"
Then in function
"
int rds_ib_flush_mr_pool(struct rds_ib_mr_pool *pool,
                         int free_all, struct rds_ib_mr **ibmr_ret)
"
ibmr_ret is NULL.

In the source code,
"
...
list_to_llist_nodes(pool, &unmap_list, &clean_nodes, &clean_tail);
if (ibmr_ret)
        *ibmr_ret = llist_entry(clean_nodes, struct rds_ib_mr, llnode);

/* more than one entry in llist nodes */
if (clean_nodes->next)
        llist_add_batch(clean_nodes->next, clean_tail, &pool->clean_list);
...
"
When ibmr_ret is NULL, llist_entry is not executed. clean_nodes->next
instead of clean_nodes is added in clean_list.
So clean_nodes is discarded. It can not be used again.
The workqueue is executed periodically. So more and more clean_nodes are
discarded. Finally the clean_list is NULL.
Then this problem will occur.

Fixes: 1bc144b625 ("net, rds, Replace xlist in net/rds/xlist.h with llist")
Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-11 12:20:49 +02:00
David Ahern
893e2a5f5c neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit 
[ Upstream commit 4b2a2bfeb3 ]

Commit cd9ff4de01 changed the key for IFF_POINTOPOINT devices to
INADDR_ANY but neigh_xmit which is used for MPLS encapsulations was not
updated to use the altered key. The result is that every packet Tx does
a lookup on the gateway address which does not find an entry, a new one
is created only to find the existing one in the table right before the
insert since arp_constructor was updated to reset the primary key. This
is seen in the allocs and destroys counters:
    ip -s -4 ntable show | head -10 | grep alloc

which increase for each packet showing the unnecessary overhread.

Fix by having neigh_xmit use __ipv4_neigh_lookup_noref for NEIGH_ARP_TABLE.

Fixes: cd9ff4de01 ("ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY")
Reported-by: Alan Maguire <alan.maguire@oracle.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
Tested-by: Alan Maguire <alan.maguire@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-11 12:20:48 +02:00
Xin Long
daa11cc841 ipv4: not do cache for local delivery if bc_forwarding is enabled 
[ Upstream commit 0a90478b93 ]

With the topo:

    h1 ---| rp1            |
          |     route  rp3 |--- h3 (192.168.200.1)
    h2 ---| rp2            |

If rp1 bc_forwarding is set while rp2 bc_forwarding is not, after
doing "ping 192.168.200.255" on h1, then ping 192.168.200.255 on
h2, and the packets can still be forwared.

This issue was caused by the input route cache. It should only do
the cache for either bc forwarding or local delivery. Otherwise,
local delivery can use the route cache for bc forwarding of other
interfaces.

This patch is to fix it by not doing cache for local delivery if
all.bc_forwarding is enabled.

Note that we don't fix it by checking route cache local flag after
rt_cache_valid() in "local_input:" and "ip_mkroute_input", as the
common route code shouldn't be touched for bc_forwarding.

Fixes: 5cbf777cfd ("route: add support for directed broadcast forwarding")
Reported-by: Jianlin Shi <jishi@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-11 12:20:47 +02:00
Neil Horman
05b933f25a Fix memory leak in sctp_process_init 
[ Upstream commit 0a8dd9f67c ]

syzbot found the following leak in sctp_process_init
BUG: memory leak
unreferenced object 0xffff88810ef68400 (size 1024):
  comm "syz-executor273", pid 7046, jiffies 4294945598 (age 28.770s)
  hex dump (first 32 bytes):
    1d de 28 8d de 0b 1b e3 b5 c2 f9 68 fd 1a 97 25  ..(........h...%
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000a02cebbd>] kmemleak_alloc_recursive include/linux/kmemleak.h:55
[inline]
    [<00000000a02cebbd>] slab_post_alloc_hook mm/slab.h:439 [inline]
    [<00000000a02cebbd>] slab_alloc mm/slab.c:3326 [inline]
    [<00000000a02cebbd>] __do_kmalloc mm/slab.c:3658 [inline]
    [<00000000a02cebbd>] __kmalloc_track_caller+0x15d/0x2c0 mm/slab.c:3675
    [<000000009e6245e6>] kmemdup+0x27/0x60 mm/util.c:119
    [<00000000dfdc5d2d>] kmemdup include/linux/string.h:432 [inline]
    [<00000000dfdc5d2d>] sctp_process_init+0xa7e/0xc20
net/sctp/sm_make_chunk.c:2437
    [<00000000b58b62f8>] sctp_cmd_process_init net/sctp/sm_sideeffect.c:682
[inline]
    [<00000000b58b62f8>] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1384
[inline]
    [<00000000b58b62f8>] sctp_side_effects net/sctp/sm_sideeffect.c:1194
[inline]
    [<00000000b58b62f8>] sctp_do_sm+0xbdc/0x1d60 net/sctp/sm_sideeffect.c:1165
    [<0000000044e11f96>] sctp_assoc_bh_rcv+0x13c/0x200
net/sctp/associola.c:1074
    [<00000000ec43804d>] sctp_inq_push+0x7f/0xb0 net/sctp/inqueue.c:95
    [<00000000726aa954>] sctp_backlog_rcv+0x5e/0x2a0 net/sctp/input.c:354
    [<00000000d9e249a8>] sk_backlog_rcv include/net/sock.h:950 [inline]
    [<00000000d9e249a8>] __release_sock+0xab/0x110 net/core/sock.c:2418
    [<00000000acae44fa>] release_sock+0x37/0xd0 net/core/sock.c:2934
    [<00000000963cc9ae>] sctp_sendmsg+0x2c0/0x990 net/sctp/socket.c:2122
    [<00000000a7fc7565>] inet_sendmsg+0x64/0x120 net/ipv4/af_inet.c:802
    [<00000000b732cbd3>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000b732cbd3>] sock_sendmsg+0x54/0x70 net/socket.c:671
    [<00000000274c57ab>] ___sys_sendmsg+0x393/0x3c0 net/socket.c:2292
    [<000000008252aedb>] __sys_sendmsg+0x80/0xf0 net/socket.c:2330
    [<00000000f7bf23d1>] __do_sys_sendmsg net/socket.c:2339 [inline]
    [<00000000f7bf23d1>] __se_sys_sendmsg net/socket.c:2337 [inline]
    [<00000000f7bf23d1>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2337
    [<00000000a8b4131f>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:3

The problem was that the peer.cookie value points to an skb allocated
area on the first pass through this function, at which point it is
overwritten with a heap allocated value, but in certain cases, where a
COOKIE_ECHO chunk is included in the packet, a second pass through
sctp_process_init is made, where the cookie value is re-allocated,
leaking the first allocation.

Fix is to always allocate the cookie value, and free it when we are done
using it.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Reported-by: syzbot+f7e9153b037eac9b1df8@syzkaller.appspotmail.com
CC: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
CC: "David S. Miller" <davem@davemloft.net>
CC: netdev@vger.kernel.org
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-11 12:20:47 +02:00
Vivien Didelot
d6782b8c5c ethtool: fix potential userspace buffer overflow 
[ Upstream commit 0ee4e76937 ]

ethtool_get_regs() allocates a buffer of size ops->get_regs_len(),
and pass it to the kernel driver via ops->get_regs() for filling.

There is no restriction about what the kernel drivers can or cannot do
with the open ethtool_regs structure. They usually set regs->version
and ignore regs->len or set it to the same size as ops->get_regs_len().

But if userspace allocates a smaller buffer for the registers dump,
we would cause a userspace buffer overflow in the final copy_to_user()
call, which uses the regs.len value potentially reset by the driver.

To fix this, make this case obvious and store regs.len before calling
ops->get_regs(), to only copy as much data as requested by userspace,
up to the value returned by ops->get_regs_len().

While at it, remove the redundant check for non-null regbuf.

Signed-off-by: Vivien Didelot <vivien.didelot@gmail.com>
Reviewed-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-11 12:20:47 +02:00
Greg Kroah-Hartman
bf4f1c0c56 Revert "fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied" 
The fib_rules change was incorrect and will be reverted upstream soon.

Bug: 133653863
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2019-06-06 19:27:59 +02:00
Greg Kroah-Hartman
01f5de3fbc This is the 4.19.48 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlz2CXsACgkQONu9yGCS
 aT7c0RAAvW/0LcCxnP5ksEs+0zGljm/+KHq1GF7Rg60SqlKFYayF/q2E94Bn1mt7
 3Rxb8ppViOPlFxr24B6bMCr3NKsCfSgnh1Z2oEjhWGLfxTkmL4npfj/lJCrcTQdg
 zaq4AydWuhrF1ykdTmC4ILgpi/Kn08TlNLP1QftXC9EUG59023q/hq7pb+OgfzkD
 a3eVyQSqU47F6xLqJDny2yo08tAIWIBTH9V+9YL0RJKflc5VhQoLSa/TXsxVEm1h
 ULRa2SjGldgwE4uOgnxTVjKPw8GWOv68w7uJedhNLBTdUOr3I9GMR7J38N2y1uIC
 Opm8blpovs4m3dWh342+pxdbEc+Pm22wNNLjenc5eutGdxAdlP+VTdySoZsAfEfV
 SjtIirgclLsXw/0q9PS8Ym0B6pEhgPahfHexkecCOS5s9FwduEIDfO+ePf0tsVEl
 dE5iEwByImrtITuPAg7zDnUtP9cOImeXPlUOHbKfRd8xiotu8sFEbBpeSeReVAoj
 0tLaE+olaB3e+ST/W+AoUSCtpKFjeeA5laSRvbXObOHl18QxnE9baMzE1rcCvr/x
 +4Rl8SGtmaBM/sJ4BCiuCxKCPpV7cJBKr7KREthl7pHv+Lib+nQ+LK+gIJXYOufu
 kQlTlfFimvPe7VJY3B+8QmHEcyX/nnhYAMdn08+/7Xuq8k+jxXc=
 =V8H5
 -----END PGP SIGNATURE-----

Merge 4.19.48 into android-4.19

Changes in 4.19.48
	bonding/802.3ad: fix slave link initialization transition states
	cxgb4: offload VLAN flows regardless of VLAN ethtype
	inet: switch IP ID generator to siphash
	ipv4/igmp: fix another memory leak in igmpv3_del_delrec()
	ipv4/igmp: fix build error if !CONFIG_IP_MULTICAST
	ipv6: Consider sk_bound_dev_if when binding a raw socket to an address
	ipv6: Fix redirect with VRF
	llc: fix skb leak in llc_build_and_send_ui_pkt()
	net: dsa: mv88e6xxx: fix handling of upper half of STATS_TYPE_PORT
	net: fec: fix the clk mismatch in failed_reset path
	net-gro: fix use-after-free read in napi_gro_frags()
	net: mvneta: Fix err code path of probe
	net: mvpp2: fix bad MVPP2_TXQ_SCHED_TOKEN_CNTR_REG queue value
	net: phy: marvell10g: report if the PHY fails to boot firmware
	net: sched: don't use tc_action->order during action dump
	net: stmmac: fix reset gpio free missing
	usbnet: fix kernel crash after disconnect
	net/mlx5: Avoid double free in fs init error unwinding path
	tipc: Avoid copying bytes beyond the supplied data
	net/mlx5: Allocate root ns memory using kzalloc to match kfree
	net/mlx5e: Disable rxhash when CQE compress is enabled
	net: stmmac: dma channel control register need to be init first
	bnxt_en: Fix aggregation buffer leak under OOM condition.
	net/tls: fix state removal with feature flags off
	net/tls: don't ignore netdev notifications if no TLS features
	crypto: vmx - ghash: do nosimd fallback manually
	include/linux/compiler*.h: define asm_volatile_goto
	compiler.h: give up __compiletime_assert_fallback()
	jump_label: move 'asm goto' support test to Kconfig
	xen/pciback: Don't disable PCI_COMMAND on PCI device reset.
	Revert "tipc: fix modprobe tipc failed after switch order of device registration"
	tipc: fix modprobe tipc failed after switch order of device registration
	Linux 4.19.48

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2019-06-04 08:27:48 +02:00
Junwei Hu
ca75a9fc5b tipc: fix modprobe tipc failed after switch order of device registration 
commit 526f5b851a upstream.

Error message printed:
modprobe: ERROR: could not insert 'tipc': Address family not
supported by protocol.
when modprobe tipc after the following patch: switch order of
device registration, commit 7e27e8d613
("tipc: switch order of device registration to fix a crash")

Because sock_create_kern(net, AF_TIPC, ...) called by
tipc_topsrv_create_listener() in the initialization process
of tipc_init_net(), so tipc_socket_init() must be execute before that.
Meanwhile, tipc_net_id need to be initialized when sock_create()
called, and tipc_socket_init() is no need to be called for each namespace.

I add a variable tipc_topsrv_net_ops, and split the
register_pernet_subsys() of tipc into two parts, and split
tipc_socket_init() with initialization of pernet params.

By the way, I fixed resources rollback error when tipc_bcast_init()
failed in tipc_init_net().

Fixes: 7e27e8d613 ("tipc: switch order of device registration to fix a crash")
Signed-off-by: Junwei Hu <hujunwei4@huawei.com>
Reported-by: Wang Wang <wangwang2@huawei.com>
Reported-by: syzbot+1e8114b61079bfe9cbc5@syzkaller.appspotmail.com
Reviewed-by: Kang Zhou <zhoukang7@huawei.com>
Reviewed-by: Suanming Mou <mousuanming@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-04 08:02:34 +02:00
David S. Miller
ab69a23042 Revert "tipc: fix modprobe tipc failed after switch order of device registration" 
commit 5593530e56 upstream.

This reverts commit 532b0f7ece.

More revisions coming up.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-04 08:02:34 +02:00
Masahiro Yamada
0276ebf166 jump_label: move 'asm goto' support test to Kconfig 
commit e9666d10a5 upstream.

Currently, CONFIG_JUMP_LABEL just means "I _want_ to use jump label".

The jump label is controlled by HAVE_JUMP_LABEL, which is defined
like this:

  #if defined(CC_HAVE_ASM_GOTO) && defined(CONFIG_JUMP_LABEL)
  # define HAVE_JUMP_LABEL
  #endif

We can improve this by testing 'asm goto' support in Kconfig, then
make JUMP_LABEL depend on CC_HAS_ASM_GOTO.

Ugly #ifdef HAVE_JUMP_LABEL will go away, and CONFIG_JUMP_LABEL will
match to the real kernel capability.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
[nc: Fix trivial conflicts in 4.19
     arch/xtensa/kernel/jump_label.c doesn't exist yet
     Ensured CC_HAVE_ASM_GOTO and HAVE_JUMP_LABEL were sufficiently
     eliminated]
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-04 08:02:34 +02:00
Jakub Kicinski
fb6cf4f370 net/tls: don't ignore netdev notifications if no TLS features 
[ Upstream commit c3f4a6c39c ]

On device surprise removal path (the notifier) we can't
bail just because the features are disabled.  They may
have been enabled during the lifetime of the device.
This bug leads to leaking netdev references and
use-after-frees if there are active connections while
device features are cleared.

Fixes: e8f6979981 ("net/tls: Add generic NIC offload infrastructure")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-04 08:02:33 +02:00
Jakub Kicinski
fb69403ec2 net/tls: fix state removal with feature flags off 
[ Upstream commit 3686637e50 ]

TLS offload drivers shouldn't (and currently don't) block
the TLS offload feature changes based on whether there are
active offloaded connections or not.

This seems to be a good idea, because we want the admin to
be able to disable the TLS offload at any time, and there
is no clean way of disabling it for active connections
(TX side is quite problematic).  So if features are cleared
existing connections will stay offloaded until they close,
and new connections will not attempt offload to a given
device.

However, the offload state removal handling is currently
broken if feature flags get cleared while there are
active TLS offloads.

RX side will completely bail from cleanup, even on normal
remove path, leaving device state dangling, potentially
causing issues when the 5-tuple is reused.  It will also
fail to release the netdev reference.

Remove the RX-side warning message, in next release cycle
it should be printed when features are disabled, rather
than when connection dies, but for that we need a more
efficient method of finding connection of a given netdev
(a'la BPF offload code).

Fixes: 4799ac81e5 ("tls: Add rx inline crypto offload")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-04 08:02:33 +02:00
Vlad Buslov
6ab9684731 net: sched: don't use tc_action->order during action dump 
[ Upstream commit 4097e9d250 ]

Function tcf_action_dump() relies on tc_action->order field when starting
nested nla to send action data to userspace. This approach breaks in
several cases:

- When multiple filters point to same shared action, tc_action->order field
  is overwritten each time it is attached to filter. This causes filter
  dump to output action with incorrect attribute for all filters that have
  the action in different position (different order) from the last set
  tc_action->order value.

- When action data is displayed using tc action API (RTM_GETACTION), action
  order is overwritten by tca_action_gd() according to its position in
  resulting array of nl attributes, which will break filter dump for all
  filters attached to that shared action that expect it to have different
  order value.

Don't rely on tc_action->order when dumping actions. Set nla according to
action position in resulting array of actions instead.

Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-04 08:02:32 +02:00
Eric Dumazet
39fd0dc4a5 net-gro: fix use-after-free read in napi_gro_frags() 
[ Upstream commit a4270d6795 ]

If a network driver provides to napi_gro_frags() an
skb with a page fragment of exactly 14 bytes, the call
to gro_pull_from_frag0() will 'consume' the fragment
by calling skb_frag_unref(skb, 0), and the page might
be freed and reused.

Reading eth->h_proto at the end of napi_frags_skb() might
read mangled data, or crash under specific debugging features.

BUG: KASAN: use-after-free in napi_frags_skb net/core/dev.c:5833 [inline]
BUG: KASAN: use-after-free in napi_gro_frags+0xc6f/0xd10 net/core/dev.c:5841
Read of size 2 at addr ffff88809366840c by task syz-executor599/8957

CPU: 1 PID: 8957 Comm: syz-executor599 Not tainted 5.2.0-rc1+ #32
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:188
 __kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
 kasan_report+0x12/0x20 mm/kasan/common.c:614
 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/generic_report.c:142
 napi_frags_skb net/core/dev.c:5833 [inline]
 napi_gro_frags+0xc6f/0xd10 net/core/dev.c:5841
 tun_get_user+0x2f3c/0x3ff0 drivers/net/tun.c:1991
 tun_chr_write_iter+0xbd/0x156 drivers/net/tun.c:2037
 call_write_iter include/linux/fs.h:1872 [inline]
 do_iter_readv_writev+0x5f8/0x8f0 fs/read_write.c:693
 do_iter_write fs/read_write.c:970 [inline]
 do_iter_write+0x184/0x610 fs/read_write.c:951
 vfs_writev+0x1b3/0x2f0 fs/read_write.c:1015
 do_writev+0x15b/0x330 fs/read_write.c:1058

Fixes: a50e233c50 ("net-gro: restore frag0 optimization")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-04 08:02:32 +02:00
Eric Dumazet
2d04f32c88 llc: fix skb leak in llc_build_and_send_ui_pkt() 
[ Upstream commit 8fb44d60d4 ]

If llc_mac_hdr_init() returns an error, we must drop the skb
since no llc_build_and_send_ui_pkt() caller will take care of this.

BUG: memory leak
unreferenced object 0xffff8881202b6800 (size 2048):
  comm "syz-executor907", pid 7074, jiffies 4294943781 (age 8.590s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    1a 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............
  backtrace:
    [<00000000e25b5abe>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
    [<00000000e25b5abe>] slab_post_alloc_hook mm/slab.h:439 [inline]
    [<00000000e25b5abe>] slab_alloc mm/slab.c:3326 [inline]
    [<00000000e25b5abe>] __do_kmalloc mm/slab.c:3658 [inline]
    [<00000000e25b5abe>] __kmalloc+0x161/0x2c0 mm/slab.c:3669
    [<00000000a1ae188a>] kmalloc include/linux/slab.h:552 [inline]
    [<00000000a1ae188a>] sk_prot_alloc+0xd6/0x170 net/core/sock.c:1608
    [<00000000ded25bbe>] sk_alloc+0x35/0x2f0 net/core/sock.c:1662
    [<000000002ecae075>] llc_sk_alloc+0x35/0x170 net/llc/llc_conn.c:950
    [<00000000551f7c47>] llc_ui_create+0x7b/0x140 net/llc/af_llc.c:173
    [<0000000029027f0e>] __sock_create+0x164/0x250 net/socket.c:1430
    [<000000008bdec225>] sock_create net/socket.c:1481 [inline]
    [<000000008bdec225>] __sys_socket+0x69/0x110 net/socket.c:1523
    [<00000000b6439228>] __do_sys_socket net/socket.c:1532 [inline]
    [<00000000b6439228>] __se_sys_socket net/socket.c:1530 [inline]
    [<00000000b6439228>] __x64_sys_socket+0x1e/0x30 net/socket.c:1530
    [<00000000cec820c1>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:301
    [<000000000c32554f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811d750d00 (size 224):
  comm "syz-executor907", pid 7074, jiffies 4294943781 (age 8.600s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 f0 0c 24 81 88 ff ff 00 68 2b 20 81 88 ff ff  ...$.....h+ ....
  backtrace:
    [<0000000053026172>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
    [<0000000053026172>] slab_post_alloc_hook mm/slab.h:439 [inline]
    [<0000000053026172>] slab_alloc_node mm/slab.c:3269 [inline]
    [<0000000053026172>] kmem_cache_alloc_node+0x153/0x2a0 mm/slab.c:3579
    [<00000000fa8f3c30>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:198
    [<00000000d96fdafb>] alloc_skb include/linux/skbuff.h:1058 [inline]
    [<00000000d96fdafb>] alloc_skb_with_frags+0x5f/0x250 net/core/skbuff.c:5327
    [<000000000a34a2e7>] sock_alloc_send_pskb+0x269/0x2a0 net/core/sock.c:2225
    [<00000000ee39999b>] sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2242
    [<00000000e034d810>] llc_ui_sendmsg+0x10a/0x540 net/llc/af_llc.c:933
    [<00000000c0bc8445>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000c0bc8445>] sock_sendmsg+0x54/0x70 net/socket.c:671
    [<000000003b687167>] __sys_sendto+0x148/0x1f0 net/socket.c:1964
    [<00000000922d78d9>] __do_sys_sendto net/socket.c:1976 [inline]
    [<00000000922d78d9>] __se_sys_sendto net/socket.c:1972 [inline]
    [<00000000922d78d9>] __x64_sys_sendto+0x2a/0x30 net/socket.c:1972
    [<00000000cec820c1>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:301
    [<000000000c32554f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-04 08:02:31 +02:00
David Ahern
442176668e ipv6: Fix redirect with VRF 
[ Upstream commit 31680ac265 ]

IPv6 redirect is broken for VRF. __ip6_route_redirect walks the FIB
entries looking for an exact match on ifindex. With VRF the flowi6_oif
is updated by l3mdev_update_flow to the l3mdev index and the
FLOWI_FLAG_SKIP_NH_OIF set in the flags to tell the lookup to skip the
device match. For redirects the device match is requires so use that
flag to know when the oif needs to be reset to the skb device index.

Fixes: ca254490c8 ("net: Add VRF support to IPv6 stack")
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-04 08:02:31 +02:00
Mike Manning
ed753b3943 ipv6: Consider sk_bound_dev_if when binding a raw socket to an address 
[ Upstream commit 72f7cfab6f ]

IPv6 does not consider if the socket is bound to a device when binding
to an address. The result is that a socket can be bound to eth0 and
then bound to the address of eth1. If the device is a VRF, the result
is that a socket can only be bound to an address in the default VRF.

Resolve by considering the device if sk_bound_dev_if is set.

Signed-off-by: Mike Manning <mmanning@vyatta.att-mail.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Tested-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-04 08:02:31 +02:00
Eric Dumazet
46702dd5d5 ipv4/igmp: fix build error if !CONFIG_IP_MULTICAST 
[ Upstream commit 903869bd10 ]

ip_sf_list_clear_all() needs to be defined even if !CONFIG_IP_MULTICAST

Fixes: 3580d04aa6 ("ipv4/igmp: fix another memory leak in igmpv3_del_delrec()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-04 08:02:31 +02:00
Eric Dumazet
e9f94e480f ipv4/igmp: fix another memory leak in igmpv3_del_delrec() 
[ Upstream commit 3580d04aa6 ]

syzbot reported memory leaks [1] that I have back tracked to
a missing cleanup from igmpv3_del_delrec() when
(im->sfmode != MCAST_INCLUDE)

Add ip_sf_list_clear_all() and kfree_pmc() helpers to explicitely
handle the cleanups before freeing.

[1]

BUG: memory leak
unreferenced object 0xffff888123e32b00 (size 64):
  comm "softirq", pid 0, jiffies 4294942968 (age 8.010s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 e0 00 00 01 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000006105011b>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
    [<000000006105011b>] slab_post_alloc_hook mm/slab.h:439 [inline]
    [<000000006105011b>] slab_alloc mm/slab.c:3326 [inline]
    [<000000006105011b>] kmem_cache_alloc_trace+0x13d/0x280 mm/slab.c:3553
    [<000000004bba8073>] kmalloc include/linux/slab.h:547 [inline]
    [<000000004bba8073>] kzalloc include/linux/slab.h:742 [inline]
    [<000000004bba8073>] ip_mc_add1_src net/ipv4/igmp.c:1961 [inline]
    [<000000004bba8073>] ip_mc_add_src+0x36b/0x400 net/ipv4/igmp.c:2085
    [<00000000a46a65a0>] ip_mc_msfilter+0x22d/0x310 net/ipv4/igmp.c:2475
    [<000000005956ca89>] do_ip_setsockopt.isra.0+0x1795/0x1930 net/ipv4/ip_sockglue.c:957
    [<00000000848e2d2f>] ip_setsockopt+0x3b/0xb0 net/ipv4/ip_sockglue.c:1246
    [<00000000b9db185c>] udp_setsockopt+0x4e/0x90 net/ipv4/udp.c:2616
    [<000000003028e438>] sock_common_setsockopt+0x38/0x50 net/core/sock.c:3130
    [<0000000015b65589>] __sys_setsockopt+0x98/0x120 net/socket.c:2078
    [<00000000ac198ef0>] __do_sys_setsockopt net/socket.c:2089 [inline]
    [<00000000ac198ef0>] __se_sys_setsockopt net/socket.c:2086 [inline]
    [<00000000ac198ef0>] __x64_sys_setsockopt+0x26/0x30 net/socket.c:2086
    [<000000000a770437>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:301
    [<00000000d3adb93b>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 9c8bb163ae ("igmp, mld: Fix memory leak in igmpv3/mld_del_delrec()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Hangbin Liu <liuhangbin@gmail.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-04 08:02:31 +02:00
Eric Dumazet
07480da0c8 inet: switch IP ID generator to siphash 
[ Upstream commit df453700e8 ]

According to Amit Klein and Benny Pinkas, IP ID generation is too weak
and might be used by attackers.

Even with recent net_hash_mix() fix (netns: provide pure entropy for net_hash_mix())
having 64bit key and Jenkins hash is risky.

It is time to switch to siphash and its 128bit keys.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Amit Klein <aksecurity@gmail.com>
Reported-by: Benny Pinkas <benny@pinkas.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-06-04 08:02:30 +02:00
Greg Kroah-Hartman
cab4399ebf This is the 4.19.47 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlzxMDsACgkQONu9yGCS
 aT6kjxAAvyKCDNGaQgBXGXe6xvBK7ad+mk+MU6WVycN+PIQzA8zVfR7RcGJgEP8t
 65QrePyacMe5bmSgTnUKGz6DpwpWbCMamyftjoaPWIhxDFmQy7FB9ANOVoPDBw49
 +jKT30ioBSI6LYQDU4xhxDO01HVEXmmLZquqYDfLoHOMLeXCivfTlM7PQPfxMZzn
 fdeLtvfCnfMiftkXZjGqaWoUAnrlTmncQk9nXMcDgxrGy9pHJ6B1WWE5ygqr4Z5s
 MaKfHotCSYD/eP8JsyIdJg+iMESv5Z0ZDCjbVslm81fCLeUD6atdnmpYxCphmT7Q
 ifN23i4FJrXBX4xLpD9RYzavH3+hQzqb2pt02aBZRW0OLFK0qjYrkdayjwWGOIUI
 zK9bgfHiiNKtoyvakQJ09uMhpO2thWeTMh8a6iBLTQ5Koi60adW1l5GrPuTTZYG7
 V8xNB2cLsUktDsAr1I/kwrCMlE/oNFgy2La5zMzmELnFTUJRlMAoAGaa1DPcOFLt
 QVdT8luJMu+1KTeMZPoK/7QQGszMDTAot4+Ys56KyPQ6zN/rGr2vm7kHYn41FyEp
 KXpyeIm0/RKxUysz2Fyx+dL75e4ZhBof+amQ7Kotz6bF45o+ZwJ7THT6XKIOoln5
 E7iI5RhQMZ2WuVIHLKa0QFBRn4RPpzie1lwOXWAAF6oqNgewXHw=
 =fjPE
 -----END PGP SIGNATURE-----

Merge 4.19.47 into android-4.19

Changes in 4.19.47
	x86: Hide the int3_emulate_call/jmp functions from UML
	ext4: do not delete unlinked inode from orphan list on failed truncate
	ext4: wait for outstanding dio during truncate in nojournal mode
	f2fs: Fix use of number of devices
	KVM: x86: fix return value for reserved EFER
	bio: fix improper use of smp_mb__before_atomic()
	sbitmap: fix improper use of smp_mb__before_atomic()
	Revert "scsi: sd: Keep disk read-only when re-reading partition"
	crypto: vmx - CTR: always increment IV as quadword
	mmc: sdhci-iproc: cygnus: Set NO_HISPD bit to fix HS50 data hold time problem
	mmc: sdhci-iproc: Set NO_HISPD bit to fix HS50 data hold time problem
	kvm: svm/avic: fix off-by-one in checking host APIC ID
	libnvdimm/pmem: Bypass CONFIG_HARDENED_USERCOPY overhead
	arm64/kernel: kaslr: reduce module randomization range to 2 GB
	arm64/iommu: handle non-remapped addresses in ->mmap and ->get_sgtable
	gfs2: Fix sign extension bug in gfs2_update_stats
	btrfs: don't double unlock on error in btrfs_punch_hole
	Btrfs: do not abort transaction at btrfs_update_root() after failure to COW path
	Btrfs: avoid fallback to transaction commit during fsync of files with holes
	Btrfs: fix race between ranged fsync and writeback of adjacent ranges
	btrfs: sysfs: Fix error path kobject memory leak
	btrfs: sysfs: don't leak memory when failing add fsid
	udlfb: fix some inconsistent NULL checking
	fbdev: fix divide error in fb_var_to_videomode
	NFSv4.2 fix unnecessary retry in nfs4_copy_file_range
	NFSv4.1 fix incorrect return value in copy_file_range
	bpf: add bpf_jit_limit knob to restrict unpriv allocations
	brcmfmac: assure SSID length from firmware is limited
	brcmfmac: add subtype check for event handling in data path
	arm64: errata: Add workaround for Cortex-A76 erratum #1463225
	btrfs: honor path->skip_locking in backref code
	ovl: relax WARN_ON() for overlapping layers use case
	fbdev: fix WARNING in __alloc_pages_nodemask bug
	media: cpia2: Fix use-after-free in cpia2_exit
	media: serial_ir: Fix use-after-free in serial_ir_init_module
	media: vb2: add waiting_in_dqbuf flag
	media: vivid: use vfree() instead of kfree() for dev->bitmap_cap
	ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
	bpf: devmap: fix use-after-free Read in __dev_map_entry_free
	batman-adv: mcast: fix multicast tt/tvlv worker locking
	at76c50x-usb: Don't register led_trigger if usb_register_driver failed
	acct_on(): don't mess with freeze protection
	Revert "btrfs: Honour FITRIM range constraints during free space trim"
	gfs2: Fix lru_count going negative
	cxgb4: Fix error path in cxgb4_init_module
	NFS: make nfs_match_client killable
	IB/hfi1: Fix WQ_MEM_RECLAIM warning
	gfs2: Fix occasional glock use-after-free
	mmc: core: Verify SD bus width
	tools/bpf: fix perf build error with uClibc (seen on ARC)
	selftests/bpf: set RLIMIT_MEMLOCK properly for test_libbpf_open.c
	bpftool: exclude bash-completion/bpftool from .gitignore pattern
	dmaengine: tegra210-dma: free dma controller in remove()
	net: ena: gcc 8: fix compilation warning
	hv_netvsc: fix race that may miss tx queue wakeup
	Bluetooth: Ignore CC events not matching the last HCI command
	pinctrl: zte: fix leaked of_node references
	ASoC: Intel: kbl_da7219_max98357a: Map BTN_0 to KEY_PLAYPAUSE
	usb: dwc2: gadget: Increase descriptors count for ISOC's
	usb: dwc3: move synchronize_irq() out of the spinlock protected block
	ASoC: hdmi-codec: unlock the device on startup errors
	powerpc/perf: Return accordingly on invalid chip-id in
	powerpc/boot: Fix missing check of lseek() return value
	powerpc/perf: Fix loop exit condition in nest_imc_event_init
	ASoC: imx: fix fiq dependencies
	spi: pxa2xx: fix SCR (divisor) calculation
	brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler()
	ACPI / property: fix handling of data_nodes in acpi_get_next_subnode()
	drm/nouveau/bar/nv50: ensure BAR is mapped
	media: stm32-dcmi: return appropriate error codes during probe
	ARM: vdso: Remove dependency with the arch_timer driver internals
	arm64: Fix compiler warning from pte_unmap() with -Wunused-but-set-variable
	powerpc/watchdog: Use hrtimers for per-CPU heartbeat
	sched/cpufreq: Fix kobject memleak
	scsi: qla2xxx: Fix a qla24xx_enable_msix() error path
	scsi: qla2xxx: Fix abort handling in tcm_qla2xxx_write_pending()
	scsi: qla2xxx: Avoid that lockdep complains about unsafe locking in tcm_qla2xxx_close_session()
	scsi: qla2xxx: Fix hardirq-unsafe locking
	x86/modules: Avoid breaking W^X while loading modules
	Btrfs: fix data bytes_may_use underflow with fallocate due to failed quota reserve
	btrfs: fix panic during relocation after ENOSPC before writeback happens
	btrfs: Don't panic when we can't find a root key
	iwlwifi: pcie: don't crash on invalid RX interrupt
	rtc: 88pm860x: prevent use-after-free on device remove
	rtc: stm32: manage the get_irq probe defer case
	scsi: qedi: Abort ep termination if offload not scheduled
	s390/kexec_file: Fix detection of text segment in ELF loader
	sched/nohz: Run NOHZ idle load balancer on HK_FLAG_MISC CPUs
	w1: fix the resume command API
	s390: qeth: address type mismatch warning
	dmaengine: pl330: _stop: clear interrupt status
	mac80211/cfg80211: update bss channel on channel switch
	libbpf: fix samples/bpf build failure due to undefined UINT32_MAX
	slimbus: fix a potential NULL pointer dereference in of_qcom_slim_ngd_register
	ASoC: fsl_sai: Update is_slave_mode with correct value
	mwifiex: prevent an array overflow
	rsi: Fix NULL pointer dereference in kmalloc
	net: cw1200: fix a NULL pointer dereference
	nvme: set 0 capacity if namespace block size exceeds PAGE_SIZE
	nvme-rdma: fix a NULL deref when an admin connect times out
	crypto: sun4i-ss - Fix invalid calculation of hash end
	bcache: avoid potential memleak of list of journal_replay(s) in the CACHE_SYNC branch of run_cache_set
	bcache: return error immediately in bch_journal_replay()
	bcache: fix failure in journal relplay
	bcache: add failure check to run_cache_set() for journal replay
	bcache: avoid clang -Wunintialized warning
	RDMA/cma: Consider scope_id while binding to ipv6 ll address
	vfio-ccw: Do not call flush_workqueue while holding the spinlock
	vfio-ccw: Release any channel program when releasing/removing vfio-ccw mdev
	x86/build: Move _etext to actual end of .text
	smpboot: Place the __percpu annotation correctly
	x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault()
	mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions
	Bluetooth: hci_qca: Give enough time to ROME controller to bootup.
	HID: logitech-hidpp: use RAP instead of FAP to get the protocol version
	pinctrl: pistachio: fix leaked of_node references
	pinctrl: samsung: fix leaked of_node references
	clk: rockchip: undo several noc and special clocks as critical on rk3288
	perf/arm-cci: Remove broken race mitigation
	dmaengine: at_xdmac: remove BUG_ON macro in tasklet
	media: coda: clear error return value before picture run
	media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper
	media: au0828: stop video streaming only when last user stops
	media: ov2659: make S_FMT succeed even if requested format doesn't match
	audit: fix a memory leak bug
	media: stm32-dcmi: fix crash when subdev do not expose any formats
	media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable()
	media: pvrusb2: Prevent a buffer overflow
	iio: adc: stm32-dfsdm: fix unmet direct dependencies detected
	block: fix use-after-free on gendisk
	powerpc/numa: improve control of topology updates
	powerpc/64: Fix booting large kernels with STRICT_KERNEL_RWX
	random: fix CRNG initialization when random.trust_cpu=1
	random: add a spinlock_t to struct batched_entropy
	cgroup: protect cgroup->nr_(dying_)descendants by css_set_lock
	sched/core: Check quota and period overflow at usec to nsec conversion
	sched/rt: Check integer overflow at usec to nsec conversion
	sched/core: Handle overflow in cpu_shares_write_u64
	staging: vc04_services: handle kzalloc failure
	drm/msm: a5xx: fix possible object reference leak
	irq_work: Do not raise an IPI when queueing work on the local CPU
	thunderbolt: Take domain lock in switch sysfs attribute callbacks
	s390/qeth: handle error from qeth_update_from_chp_desc()
	USB: core: Don't unbind interfaces following device reset failure
	x86/irq/64: Limit IST stack overflow check to #DB stack
	drm: etnaviv: avoid DMA API warning when importing buffers
	phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode
	phy: mapphone-mdm6600: add gpiolib dependency
	i40e: Able to add up to 16 MAC filters on an untrusted VF
	i40e: don't allow changes to HW VLAN stripping on active port VLANs
	ACPI/IORT: Reject platform device creation on NUMA node mapping failure
	arm64: vdso: Fix clock_getres() for CLOCK_REALTIME
	RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure
	perf/x86/msr: Add Icelake support
	perf/x86/intel/rapl: Add Icelake support
	perf/x86/intel/cstate: Add Icelake support
	hwmon: (vt1211) Use request_muxed_region for Super-IO accesses
	hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses
	hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses
	hwmon: (pc87427) Use request_muxed_region for Super-IO accesses
	hwmon: (f71805f) Use request_muxed_region for Super-IO accesses
	scsi: libsas: Do discovery on empty PHY to update PHY info
	mmc: core: make pwrseq_emmc (partially) support sleepy GPIO controllers
	mmc_spi: add a status check for spi_sync_locked
	mmc: sdhci-of-esdhc: add erratum eSDHC5 support
	mmc: sdhci-of-esdhc: add erratum A-009204 support
	mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support
	drm/amdgpu: fix old fence check in amdgpu_fence_emit
	PM / core: Propagate dev->power.wakeup_path when no callbacks
	clk: rockchip: Fix video codec clocks on rk3288
	extcon: arizona: Disable mic detect if running when driver is removed
	clk: rockchip: Make rkpwm a critical clock on rk3288
	s390: zcrypt: initialize variables before_use
	x86/microcode: Fix the ancient deprecated microcode loading method
	s390/mm: silence compiler warning when compiling without CONFIG_PGSTE
	s390: cio: fix cio_irb declaration
	selftests: cgroup: fix cleanup path in test_memcg_subtree_control()
	qmi_wwan: Add quirk for Quectel dynamic config
	cpufreq: ppc_cbe: fix possible object reference leak
	cpufreq/pasemi: fix possible object reference leak
	cpufreq: pmac32: fix possible object reference leak
	cpufreq: kirkwood: fix possible object reference leak
	block: sed-opal: fix IOC_OPAL_ENABLE_DISABLE_MBR
	x86/build: Keep local relocations with ld.lld
	drm/pl111: fix possible object reference leak
	iio: ad_sigma_delta: Properly handle SPI bus locking vs CS assertion
	iio: hmc5843: fix potential NULL pointer dereferences
	iio: common: ssp_sensors: Initialize calculated_time in ssp_common_process_data
	iio: adc: ti-ads7950: Fix improper use of mlock
	selftests/bpf: ksym_search won't check symbols exists
	rtlwifi: fix a potential NULL pointer dereference
	mwifiex: Fix mem leak in mwifiex_tm_cmd
	brcmfmac: fix missing checks for kmemdup
	b43: shut up clang -Wuninitialized variable warning
	brcmfmac: convert dev_init_lock mutex to completion
	brcmfmac: fix WARNING during USB disconnect in case of unempty psq
	brcmfmac: fix race during disconnect when USB completion is in progress
	brcmfmac: fix Oops when bringing up interface during USB disconnect
	rtc: xgene: fix possible race condition
	rtlwifi: fix potential NULL pointer dereference
	scsi: ufs: Fix regulator load and icc-level configuration
	scsi: ufs: Avoid configuring regulator with undefined voltage range
	drm/panel: otm8009a: Add delay at the end of initialization
	arm64: cpu_ops: fix a leaked reference by adding missing of_node_put
	wil6210: fix return code of wmi_mgmt_tx and wmi_mgmt_tx_ext
	x86/uaccess, ftrace: Fix ftrace_likely_update() vs. SMAP
	x86/uaccess, signal: Fix AC=1 bloat
	x86/ia32: Fix ia32_restore_sigcontext() AC leak
	x86/uaccess: Fix up the fixup
	chardev: add additional check for minor range overlap
	RDMA/hns: Fix bad endianess of port_pd variable
	sh: sh7786: Add explicit I/O cast to sh7786_mm_sel()
	HID: core: move Usage Page concatenation to Main item
	ASoC: eukrea-tlv320: fix a leaked reference by adding missing of_node_put
	ASoC: fsl_utils: fix a leaked reference by adding missing of_node_put
	cxgb3/l2t: Fix undefined behaviour
	HID: logitech-hidpp: change low battery level threshold from 31 to 30 percent
	spi: tegra114: reset controller on probe
	kobject: Don't trigger kobject_uevent(KOBJ_REMOVE) twice.
	media: video-mux: fix null pointer dereferences
	media: wl128x: prevent two potential buffer overflows
	media: gspca: Kill URBs on USB device disconnect
	efifb: Omit memory map check on legacy boot
	thunderbolt: property: Fix a missing check of kzalloc
	thunderbolt: Fix to check the return value of kmemdup
	timekeeping: Force upper bound for setting CLOCK_REALTIME
	scsi: qedf: Add missing return in qedf_post_io_req() in the fcport offload check
	virtio_console: initialize vtermno value for ports
	tty: ipwireless: fix missing checks for ioremap
	overflow: Fix -Wtype-limits compilation warnings
	x86/mce: Fix machine_check_poll() tests for error types
	rcutorture: Fix cleanup path for invalid torture_type strings
	x86/mce: Handle varying MCA bank counts
	rcuperf: Fix cleanup path for invalid perf_type strings
	usb: core: Add PM runtime calls to usb_hcd_platform_shutdown
	scsi: qla4xxx: avoid freeing unallocated dma memory
	scsi: lpfc: avoid uninitialized variable warning
	selinux: avoid uninitialized variable warning
	batman-adv: allow updating DAT entry timeouts on incoming ARP Replies
	dmaengine: tegra210-adma: use devm_clk_*() helpers
	hwrng: omap - Set default quality
	thunderbolt: Fix to check return value of ida_simple_get
	thunderbolt: Fix to check for kmemdup failure
	drm/amd/display: fix releasing planes when exiting odm
	thunderbolt: property: Fix a NULL pointer dereference
	e1000e: Disable runtime PM on CNP+
	tinydrm/mipi-dbi: Use dma-safe buffers for all SPI transfers
	igb: Exclude device from suspend direct complete optimization
	media: si2165: fix a missing check of return value
	media: dvbsky: Avoid leaking dvb frontend
	media: m88ds3103: serialize reset messages in m88ds3103_set_frontend
	media: staging: davinci_vpfe: disallow building with COMPILE_TEST
	drm/amd/display: Fix Divide by 0 in memory calculations
	drm/amd/display: Set stream->mode_changed when connectors change
	scsi: ufs: fix a missing check of devm_reset_control_get
	media: vimc: stream: fix thread state before sleep
	media: gspca: do not resubmit URBs when streaming has stopped
	media: go7007: avoid clang frame overflow warning with KASAN
	media: vimc: zero the media_device on probe
	scsi: lpfc: Fix FDMI manufacturer attribute value
	scsi: lpfc: Fix fc4type information for FDMI
	media: saa7146: avoid high stack usage with clang
	scsi: lpfc: Fix SLI3 commands being issued on SLI4 devices
	spi : spi-topcliff-pch: Fix to handle empty DMA buffers
	drm/omap: dsi: Fix PM for display blank with paired dss_pll calls
	spi: rspi: Fix sequencer reset during initialization
	spi: imx: stop buffer overflow in RX FIFO flush
	spi: Fix zero length xfer bug
	ASoC: davinci-mcasp: Fix clang warning without CONFIG_PM
	drm/v3d: Handle errors from IRQ setup.
	drm/drv: Hold ref on parent device during drm_device lifetime
	drm: Wake up next in drm_read() chain if we are forced to putback the event
	drm/sun4i: dsi: Change the start delay calculation
	vfio-ccw: Prevent quiesce function going into an infinite loop
	drm/sun4i: dsi: Enforce boundaries on the start delay
	NFS: Fix a double unlock from nfs_match,get_client
	Linux 4.19.47

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2019-05-31 08:14:29 -07:00
Linus Lüssing
25204fe6a3 batman-adv: allow updating DAT entry timeouts on incoming ARP Replies 
[ Upstream commit 099e6cc158 ]

Currently incoming ARP Replies, for example via a DHT-PUT message, do
not update the timeout for an already existing DAT entry. These ARP
Replies are dropped instead.

This however defeats the purpose of the DHCPACK snooping, for instance.
Right now, a DAT entry in the DHT will be purged every five minutes,
likely leading to a mesh-wide ARP Request broadcast after this timeout.
Which then recreates the entry. The idea of the DHCPACK snooping is to
be able to update an entry before a timeout happens, to avoid ARP Request
flooding.

This patch fixes this issue by updating a DAT entry on incoming
ARP Replies even if a matching DAT entry already exists. While still
filtering the ARP Reply towards the soft-interface, to avoid duplicate
messages on the client device side.

Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Acked-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2019-05-31 06:46:31 -07:00
Sergey Matyukevich
ca5b9d63e9 mac80211/cfg80211: update bss channel on channel switch 
[ Upstream commit 5dc8cdce1d ]

FullMAC STAs have no way to update bss channel after CSA channel switch
completion. As a result, user-space tools may provide inconsistent
channel info. For instance, consider the following two commands:
$ sudo iw dev wlan0 link
$ sudo iw dev wlan0 info
The latter command gets channel info from the hardware, so most probably
its output will be correct. However the former command gets channel info
from scan cache, so its output will contain outdated channel info.
In fact, current bss channel info will not be updated until the
next [re-]connect.

Note that mac80211 STAs have a workaround for this, but it requires
access to internal cfg80211 data, see ieee80211_chswitch_work:

	/* XXX: shouldn't really modify cfg80211-owned data! */
	ifmgd->associated->channel = sdata->csa_chandef.chan;

This patch suggests to convert mac80211 workaround into cfg80211 behavior
and to update current bss channel in cfg80211_ch_switch_notify.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2019-05-31 06:46:14 -07:00
João Paulo Rechi Vita
8603d49906 Bluetooth: Ignore CC events not matching the last HCI command 
[ Upstream commit f80c5dad7b ]

This commit makes the kernel not send the next queued HCI command until
a command complete arrives for the last HCI command sent to the
controller. This change avoids a problem with some buggy controllers
(seen on two SKUs of QCA9377) that send an extra command complete event
for the previous command after the kernel had already sent a new HCI
command to the controller.

The problem was reproduced when starting an active scanning procedure,
where an extra command complete event arrives for the LE_SET_RANDOM_ADDR
command. When this happends the kernel ends up not processing the
command complete for the following commmand, LE_SET_SCAN_PARAM, and
ultimately behaving as if a passive scanning procedure was being
performed, when in fact controller is performing an active scanning
procedure. This makes it impossible to discover BLE devices as no device
found events are sent to userspace.

This problem is reproducible on 100% of the attempts on the affected
controllers. The extra command complete event can be seen at timestamp
27.420131 on the btmon logs bellow.

Bluetooth monitor ver 5.50
= Note: Linux version 5.0.0+ (x86_64)                                  0.352340
= Note: Bluetooth subsystem version 2.22                               0.352343
= New Index: 80:C5:F2:8F:87:84 (Primary,USB,hci0)               [hci0] 0.352344
= Open Index: 80:C5:F2:8F:87:84                                 [hci0] 0.352345
= Index Info: 80:C5:F2:8F:87:84 (Qualcomm)                      [hci0] 0.352346
@ MGMT Open: bluetoothd (privileged) version 1.14             {0x0001} 0.352347
@ MGMT Open: btmon (privileged) version 1.14                  {0x0002} 0.352366
@ MGMT Open: btmgmt (privileged) version 1.14                {0x0003} 27.302164
@ MGMT Command: Start Discovery (0x0023) plen 1       {0x0003} [hci0] 27.302310
        Address type: 0x06
          LE Public
          LE Random
< HCI Command: LE Set Random Address (0x08|0x0005) plen 6   #1 [hci0] 27.302496
        Address: 15:60:F2:91:B2:24 (Non-Resolvable)
> HCI Event: Command Complete (0x0e) plen 4                 #2 [hci0] 27.419117
      LE Set Random Address (0x08|0x0005) ncmd 1
        Status: Success (0x00)
< HCI Command: LE Set Scan Parameters (0x08|0x000b) plen 7  #3 [hci0] 27.419244
        Type: Active (0x01)
        Interval: 11.250 msec (0x0012)
        Window: 11.250 msec (0x0012)
        Own address type: Random (0x01)
        Filter policy: Accept all advertisement (0x00)
> HCI Event: Command Complete (0x0e) plen 4                 #4 [hci0] 27.420131
      LE Set Random Address (0x08|0x0005) ncmd 1
        Status: Success (0x00)
< HCI Command: LE Set Scan Enable (0x08|0x000c) plen 2      #5 [hci0] 27.420259
        Scanning: Enabled (0x01)
        Filter duplicates: Enabled (0x01)
> HCI Event: Command Complete (0x0e) plen 4                 #6 [hci0] 27.420969
      LE Set Scan Parameters (0x08|0x000b) ncmd 1
        Status: Success (0x00)
> HCI Event: Command Complete (0x0e) plen 4                 #7 [hci0] 27.421983
      LE Set Scan Enable (0x08|0x000c) ncmd 1
        Status: Success (0x00)
@ MGMT Event: Command Complete (0x0001) plen 4        {0x0003} [hci0] 27.422059
      Start Discovery (0x0023) plen 1
        Status: Success (0x00)
        Address type: 0x06
          LE Public
          LE Random
@ MGMT Event: Discovering (0x0013) plen 2             {0x0003} [hci0] 27.422067
        Address type: 0x06
          LE Public
          LE Random
        Discovery: Enabled (0x01)
@ MGMT Event: Discovering (0x0013) plen 2             {0x0002} [hci0] 27.422067
        Address type: 0x06
          LE Public
          LE Random
        Discovery: Enabled (0x01)
@ MGMT Event: Discovering (0x0013) plen 2             {0x0001} [hci0] 27.422067
        Address type: 0x06
          LE Public
          LE Random
        Discovery: Enabled (0x01)

Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2019-05-31 06:46:09 -07:00
Linus Lüssing
363aa80a51 batman-adv: mcast: fix multicast tt/tvlv worker locking 
commit a3c7cd0cdf upstream.

Syzbot has reported some issues with the locking assumptions made for
the multicast tt/tvlv worker: It was able to trigger the WARN_ON() in
batadv_mcast_mla_tt_retract() and batadv_mcast_mla_tt_add().
While hard/not reproduceable for us so far it seems that the
delayed_work_pending() we use might not be quite safe from reordering.

Therefore this patch adds an explicit, new spinlock to protect the
update of the mla_list and flags in bat_priv and then removes the
WARN_ON(delayed_work_pending()).

Reported-by: syzbot+83f2d54ec6b7e417e13f@syzkaller.appspotmail.com
Reported-by: syzbot+050927a651272b145a5d@syzkaller.appspotmail.com
Reported-by: syzbot+979ffc89b87309b1b94b@syzkaller.appspotmail.com
Reported-by: syzbot+f9f3f388440283da2965@syzkaller.appspotmail.com
Fixes: cbebd363b2 ("batman-adv: Use own timer for multicast TT and TVLV updates")
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-05-31 06:46:05 -07:00
Daniel Borkmann
43caa29c99 bpf: add bpf_jit_limit knob to restrict unpriv allocations 
commit ede95a63b5 upstream.

Rick reported that the BPF JIT could potentially fill the entire module
space with BPF programs from unprivileged users which would prevent later
attempts to load normal kernel modules or privileged BPF programs, for
example. If JIT was enabled but unsuccessful to generate the image, then
before commit 290af86629 ("bpf: introduce BPF_JIT_ALWAYS_ON config")
we would always fall back to the BPF interpreter. Nowadays in the case
where the CONFIG_BPF_JIT_ALWAYS_ON could be set, then the load will abort
with a failure since the BPF interpreter was compiled out.

Add a global limit and enforce it for unprivileged users such that in case
of BPF interpreter compiled out we fail once the limit has been reached
or we fall back to BPF interpreter earlier w/o using module mem if latter
was compiled in. In a next step, fair share among unprivileged users can
be resolved in particular for the case where we would fail hard once limit
is reached.

Fixes: 290af86629 ("bpf: introduce BPF_JIT_ALWAYS_ON config")
Fixes: 0a14842f5a ("net: filter: Just In Time compiler for x86-64")
Co-Developed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Jann Horn <jannh@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: LKML <linux-kernel@vger.kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-05-31 06:46:03 -07:00
Greg Kroah-Hartman
aa07ecba6f This is the 4.19.46 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlzpbCYACgkQONu9yGCS
 aT6aJhAAjh1h5q6oRAWZ7k3CTbx7abpi3FwqlGsrinxRkwdDvy6TXTo8gBn0emS0
 8TEiQXLm/6M3IGyR8m7w2TGxThyk5xtUqEbxldHwzU/wsZzJ8KegnQUbpmdmJtrh
 BnvPygwOSldm8fqNZsFNWNCwt0m9LqPm5m57lHOj4PsxRFkr6jVYjtrynTbyDBus
 fT4Dec/jD/0hZbP2aeS5YWNee1ElgiiRewU5q5+Dn8yIDlaX81hkiu+J/EUS/97n
 8Irn7Zs7wgjEwVe9xz1SEqAO0TtDH7wgxV2JMcXMRCbj45vmiUPh9IrSqqhvjqbf
 Gr36rGyuA2AIlMlzppEgP8ZiL6b5/2+e0mZFVfV4Ck3zThWq/pi8xrNk/AGVbXSA
 yE7j7PMVC0Pr9zFOBEsdb6HEOkwy4drGlSWiGkN5jZ5/yexGT4LhEpoMwqSd6tZ8
 p12OdVmrEYZyasKOEGyOLFvUWKDT+aClFXcnB0Vi3GNtw6K4aHJU1dtPcpeD+PvO
 qMY2ePAj3GXKcg+r4dQPcbO+xEer8JZS/clTXNVwArGMQ/KII6hz2XCeSXe+aVnA
 5SJZQnyimgaEev1Y1C7VVYBa4T+S54O+tjvKhv4fuX4vL622rLkUmMJyb2XWNSIC
 HagZOcEN7PY9KWqaMiP5GtcumfAUQCtNfXY0QMYhR+9B2Sl2zGg=
 =P21c
 -----END PGP SIGNATURE-----

Merge 4.19.46 into android-4.19

Changes in 4.19.46
	ipv6: fix src addr routing with the exception table
	ipv6: prevent possible fib6 leaks
	net: Always descend into dsa/
	net: avoid weird emergency message
	net/mlx4_core: Change the error print to info print
	net: test nouarg before dereferencing zerocopy pointers
	net: usb: qmi_wwan: add Telit 0x1260 and 0x1261 compositions
	nfp: flower: add rcu locks when accessing netdev for tunnels
	ppp: deflate: Fix possible crash in deflate_init
	rtnetlink: always put IFLA_LINK for links with a link-netnsid
	tipc: switch order of device registration to fix a crash
	vsock/virtio: free packets during the socket release
	tipc: fix modprobe tipc failed after switch order of device registration
	vsock/virtio: Initialize core virtio vsock before registering the driver
	net/mlx5: Imply MLXFW in mlx5_core
	net/mlx5e: Fix ethtool rxfh commands when CONFIG_MLX5_EN_RXNFC is disabled
	parisc: Export running_on_qemu symbol for modules
	parisc: Skip registering LED when running in QEMU
	parisc: Use PA_ASM_LEVEL in boot code
	parisc: Rename LEVEL to PA_ASM_LEVEL to avoid name clash with DRBD code
	stm class: Fix channel free in stm output free path
	stm class: Fix channel bitmap on 32-bit systems
	brd: re-enable __GFP_HIGHMEM in brd_insert_page()
	proc: prevent changes to overridden credentials
	Revert "MD: fix lock contention for flush bios"
	md: batch flush requests.
	md: add mddev->pers to avoid potential NULL pointer dereference
	dcache: sort the freeing-without-RCU-delay mess for good.
	intel_th: msu: Fix single mode with IOMMU
	p54: drop device reference count if fails to enable device
	of: fix clang -Wunsequenced for be32_to_cpu()
	cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
	phy: ti-pipe3: fix missing bit-wise or operator when assigning val
	media: ov6650: Fix sensor possibly not detected on probe
	media: imx: csi: Allow unknown nearest upstream entities
	media: imx: Clear fwnode link struct for each endpoint iteration
	NFS4: Fix v4.0 client state corruption when mount
	PNFS fallback to MDS if no deviceid found
	clk: hi3660: Mark clk_gate_ufs_subsys as critical
	clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider
	clk: mediatek: Disable tuner_en before change PLL rate
	clk: rockchip: fix wrong clock definitions for rk3328
	udlfb: delete the unused parameter for dlfb_handle_damage
	udlfb: fix sleeping inside spinlock
	udlfb: introduce a rendering mutex
	fuse: fix writepages on 32bit
	fuse: honor RLIMIT_FSIZE in fuse_file_fallocate
	ovl: fix missing upper fs freeze protection on copy up for ioctl
	iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114
	ceph: flush dirty inodes before proceeding with remount
	x86_64: Add gap to int3 to allow for call emulation
	x86_64: Allow breakpoints to emulate call instructions
	ftrace/x86_64: Emulate call function while updating in breakpoint handler
	tracing: Fix partial reading of trace event's id file
	memory: tegra: Fix integer overflow on tick value calculation
	perf intel-pt: Fix instructions sampling rate
	perf intel-pt: Fix improved sample timestamp
	perf intel-pt: Fix sample timestamp wrt non-taken branches
	MIPS: perf: Fix build with CONFIG_CPU_BMIPS5000 enabled
	objtool: Allow AR to be overridden with HOSTAR
	fbdev/efifb: Ignore framebuffer memmap entries that lack any memory types
	fbdev: sm712fb: fix brightness control on reboot, don't set SR30
	fbdev: sm712fb: fix VRAM detection, don't set SR70/71/74/75
	fbdev: sm712fb: fix white screen of death on reboot, don't set CR3B-CR3F
	fbdev: sm712fb: fix boot screen glitch when sm712fb replaces VGA
	fbdev: sm712fb: fix crashes during framebuffer writes by correctly mapping VRAM
	fbdev: sm712fb: fix support for 1024x768-16 mode
	fbdev: sm712fb: use 1024x768 by default on non-MIPS, fix garbled display
	fbdev: sm712fb: fix crashes and garbled display during DPMS modesetting
	PCI: Mark AMD Stoney Radeon R7 GPU ATS as broken
	PCI: Mark Atheros AR9462 to avoid bus reset
	PCI: Init PCIe feature bits for managed host bridge alloc
	PCI/AER: Change pci_aer_init() stub to return void
	PCI: rcar: Add the initialization of PCIe link in resume_noirq()
	PCI: Factor out pcie_retrain_link() function
	PCI: Work around Pericom PCIe-to-PCI bridge Retrain Link erratum
	dm cache metadata: Fix loading discard bitset
	dm zoned: Fix zone report handling
	dm delay: fix a crash when invalid device is specified
	dm integrity: correctly calculate the size of metadata area
	dm mpath: always free attached_handler_name in parse_path()
	fuse: Add FOPEN_STREAM to use stream_open()
	xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink
	xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module
	vti4: ipip tunnel deregistration fixes.
	xfrm: clean up xfrm protocol checks
	esp4: add length check for UDP encapsulation
	xfrm: Honor original L3 slave device in xfrmi policy lookup
	xfrm4: Fix uninitialized memory read in _decode_session4
	clk: sunxi-ng: nkmp: Avoid GENMASK(-1, 0)
	power: supply: cpcap-battery: Fix division by zero
	securityfs: fix use-after-free on symlink traversal
	apparmorfs: fix use-after-free on symlink traversal
	PCI: Fix issue with "pci=disable_acs_redir" parameter being ignored
	x86: kvm: hyper-v: deal with buggy TLB flush requests from WS2012
	mac80211: Fix kernel panic due to use of txq after free
	net: ieee802154: fix missing checks for regmap_update_bits
	KVM: arm/arm64: Ensure vcpu target is unset on reset failure
	power: supply: sysfs: prevent endless uevent loop with CONFIG_POWER_SUPPLY_DEBUG
	bpf: Fix preempt_enable_no_resched() abuse
	qmi_wwan: new Wistron, ZTE and D-Link devices
	iwlwifi: mvm: check for length correctness in iwl_mvm_create_skb()
	sched/cpufreq: Fix kobject memleak
	x86/mm/mem_encrypt: Disable all instrumentation for early SME setup
	ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour
	perf bench numa: Add define for RUSAGE_THREAD if not present
	perf/x86/intel: Fix race in intel_pmu_disable_event()
	Revert "Don't jump to compute_result state from check_result state"
	md/raid: raid5 preserve the writeback action after the parity check
	driver core: Postpone DMA tear-down until after devres release for probe failure
	Revert "selftests/bpf: skip verifier tests for unsupported program types"
	bpf: relax inode permission check for retrieving bpf program
	bpf: add map_lookup_elem_sys_only for lookups from syscall side
	bpf, lru: avoid messing with eviction heuristics upon syscall lookup
	fbdev: sm712fb: fix memory frequency by avoiding a switch/case fallthrough
	Linux 4.19.46

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2019-05-25 19:09:59 +02:00
Bhagavathi Perumal S
9c045d8c97 mac80211: Fix kernel panic due to use of txq after free 
[ Upstream commit f1267cf3c0 ]

The txq of vif is added to active_txqs list for ATF TXQ scheduling
in the function ieee80211_queue_skb(), but it was not properly removed
before freeing the txq object. It was causing use after free of the txq
objects from the active_txqs list, result was kernel panic
due to invalid memory access.

Fix kernel invalid memory access by properly removing txq object
from active_txqs list before free the object.

Signed-off-by: Bhagavathi Perumal S <bperumal@codeaurora.org>
Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2019-05-25 18:23:43 +02:00
Steffen Klassert
a654a73de2 xfrm4: Fix uninitialized memory read in _decode_session4 
[ Upstream commit 8742dc86d0 ]

We currently don't reload pointers pointing into skb header
after doing pskb_may_pull() in _decode_session4(). So in case
pskb_may_pull() changed the pointers, we read from random
memory. Fix this by putting all the needed infos on the
stack, so that we don't need to access the header pointers
after doing pskb_may_pull().

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2019-05-25 18:23:41 +02:00