summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* net: Use helper function fdput()Miaohe Lin2020-08-081-4/+2
| | | | | | | Use helper function fdput() to fput() the file iff FDPUT_FPUT is set. Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: phy: fix memory leak in device-create error pathJohan Hovold2020-08-081-4/+4
| | | | | | | | | | A recent commit introduced a late error path in phy_device_create() which fails to release the device name allocated by dev_set_name(). Fixes: 13d0ab6750b2 ("net: phy: check return code when requesting PHY driver module") Cc: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* net/tls: allow MSG_CMSG_COMPAT in sendmsgRouven Czerwinski2020-08-081-1/+2
| | | | | | | | | | | | | | | | | | | | | | Trying to use ktls on a system with 32-bit userspace and 64-bit kernel results in a EOPNOTSUPP message during sendmsg: setsockopt(3, SOL_TLS, TLS_TX, …, 40) = 0 sendmsg(3, …, msg_flags=0}, 0) = -1 EOPNOTSUPP (Operation not supported) The tls_sw implementation does strict flag checking and does not allow the MSG_CMSG_COMPAT flag, which is set if the message comes in through the compat syscall. This patch adds MSG_CMSG_COMPAT to the flag check to allow the usage of the TLS SW implementation on systems using the compat syscall path. Note that the same check is present in the sendmsg path for the TLS device implementation, however the flag hasn't been added there for lack of testing hardware. Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfDavid S. Miller2020-08-0824-135/+216
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Daniel Borkmann says: ==================== pull-request: bpf 2020-08-08 The following pull-request contains BPF updates for your *net* tree. We've added 11 non-merge commits during the last 2 day(s) which contain a total of 24 files changed, 216 insertions(+), 135 deletions(-). The main changes are: 1) Fix UAPI for BPF map iterator before it gets frozen to allow for more extensions/customization in future, from Yonghong Song. 2) Fix selftests build to undo verbose build output, from Andrii Nakryiko. 3) Fix inlining compilation error on bpf_do_trace_printk() due to variable argument lists, from Stanislav Fomichev. 4) Fix an uninitialized pointer warning at btf__parse_raw() in libbpf, from Daniel T. Lee. 5) Fix several compilation warnings in selftests with regards to ignoring return value, from Jianlin Lv. 6) Fix interruptions by switching off timeout for BPF tests, from Jiri Benc. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * bpf: Delete repeated words in commentsRandy Dunlap2020-08-072-2/+2
| | | | | | | | | | | | | | | | Drop repeated words in kernel/bpf/: {has, the} Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20200807033141.10437-1-rdunlap@infradead.org
| * selftests/bpf: Fix silent Makefile outputAndrii Nakryiko2020-08-071-22/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 99aacebecb75 ("selftests: do not use .ONESHELL") removed .ONESHELL, which changes how Makefile "silences" multi-command target recipes. selftests/bpf's Makefile relied (a somewhat unknowingly) on .ONESHELL behavior of silencing all commands within the recipe if the first command contains @ symbol. Removing .ONESHELL exposed this hack. This patch fixes the issue by explicitly silencing each command with $(Q). Also explicitly define fallback rule for building *.o from *.c, instead of relying on non-silent inherited rule. This was causing a non-silent output for bench.o object file. Fixes: 92f7440ecc93 ("selftests/bpf: More succinct Makefile output") Signed-off-by: Andrii Nakryiko <andriin@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20200807033058.848677-1-andriin@fb.com
| * bpf, doc: Remove references to warning message when using bpf_trace_printk()Alan Maguire2020-08-071-11/+0
| | | | | | | | | | | | | | | | | | | | | | | | The BPF helper bpf_trace_printk() no longer uses trace_printk(); it is now triggers a dedicated trace event. Hence the described warning is no longer present, so remove the discussion of it as it may confuse people. Fixes: ac5a72ea5c89 ("bpf: Use dedicated bpf_trace_printk event instead of trace_printk()") Signed-off-by: Alan Maguire <alan.maguire@oracle.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/1596801029-32395-1-git-send-email-alan.maguire@oracle.com
| * bpf: Fix compilation warning of selftestsJianlin Lv2020-08-073-14/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Clang compiler version: 12.0.0 The following warning appears during the selftests/bpf compilation: prog_tests/send_signal.c:51:3: warning: ignoring return value of ‘write’, declared with attribute warn_unused_result [-Wunused-result] 51 | write(pipe_c2p[1], buf, 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~ prog_tests/send_signal.c:54:3: warning: ignoring return value of ‘read’, declared with attribute warn_unused_result [-Wunused-result] 54 | read(pipe_p2c[0], buf, 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~ ...... prog_tests/stacktrace_build_id_nmi.c:13:2: warning: ignoring return value of ‘fscanf’,declared with attribute warn_unused_result [-Wunused-resul] 13 | fscanf(f, "%llu", &sample_freq); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ test_tcpnotify_user.c:133:2: warning:ignoring return value of ‘system’, declared with attribute warn_unused_result [-Wunused-result] 133 | system(test_script); | ^~~~~~~~~~~~~~~~~~~ test_tcpnotify_user.c:138:2: warning:ignoring return value of ‘system’, declared with attribute warn_unused_result [-Wunused-result] 138 | system(test_script); | ^~~~~~~~~~~~~~~~~~~ test_tcpnotify_user.c:143:2: warning:ignoring return value of ‘system’, declared with attribute warn_unused_result [-Wunused-result] 143 | system(test_script); | ^~~~~~~~~~~~~~~~~~~ Add code that fix compilation warning about ignoring return value and handles any errors; Check return value of library`s API make the code more secure. Signed-off-by: Jianlin Lv <Jianlin.Lv@arm.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200806104224.95306-1-Jianlin.Lv@arm.com
| * selftests: bpf: Switch off timeoutJiri Benc2020-08-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Several bpf tests are interrupted by the default timeout of 45 seconds added by commit 852c8cbf34d3 ("selftests/kselftest/runner.sh: Add 45 second timeout per test"). In my case it was test_progs, test_tunnel.sh, test_lwt_ip_encap.sh and test_xdping.sh. There's not much value in having a timeout for bpf tests, switch it off. Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/7a9198ed10917f4ecab4a3dd74bcda1200791efd.1596739059.git.jbenc@redhat.com
| * bpf: Remove inline from bpf_do_trace_printkStanislav Fomichev2020-08-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | I get the following error during compilation on my side: kernel/trace/bpf_trace.c: In function 'bpf_do_trace_printk': kernel/trace/bpf_trace.c:386:34: error: function 'bpf_do_trace_printk' can never be inlined because it uses variable argument lists static inline __printf(1, 0) int bpf_do_trace_printk(const char *fmt, ...) ^ Fixes: ac5a72ea5c89 ("bpf: Use dedicated bpf_trace_printk event instead of trace_printk()") Signed-off-by: Stanislav Fomichev <sdf@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200806182612.1390883-1-sdf@google.com
| * bpf: Add missing return to resolve_btfidsStanislav Fomichev2020-08-071-0/+1
| | | | | | | | | | | | | | | | | | int sets_patch(struct object *obj) doesn't have a 'return 0' at the end. Fixes: fbbb68de80a4 ("bpf: Add resolve_btfids tool to resolve BTF IDs in ELF object") Signed-off-by: Stanislav Fomichev <sdf@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200806155225.637202-1-sdf@google.com
| * libbf: Fix uninitialized pointer at btf__parse_raw()Daniel T. Lee2020-08-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Recently, from commit 94a1fedd63ed ("libbpf: Add btf__parse_raw() and generic btf__parse() APIs"), new API has been added to libbpf that allows to parse BTF from raw data file (btf__parse_raw()). The commit derives build failure of samples/bpf due to improper access of uninitialized pointer at btf_parse_raw(). btf.c: In function btf__parse_raw: btf.c:625:28: error: btf may be used uninitialized in this function 625 | return err ? ERR_PTR(err) : btf; | ~~~~~~~~~~~~~~~~~~~^~~~~ This commit fixes the build failure of samples/bpf by adding code of initializing btf pointer as NULL. Fixes: 94a1fedd63ed ("libbpf: Add btf__parse_raw() and generic btf__parse() APIs") Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200805223359.32109-1-danieltimlee@gmail.com
| * Merge branch 'bpf_iter-uapi-fix'Alexei Starovoitov2020-08-0713-82/+160
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Yonghong Song says: ==================== Andrii raised a concern that current uapi for bpf iterator map element is a little restrictive and not suitable for future potential complex customization. This is a valid suggestion, considering people may indeed add more complex custimization to the iterator, e.g., cgroup_id + user_id, etc. for task or task_file. Another example might be map_id plus additional control so that the bpf iterator may bail out a bucket earlier if a bucket has too many elements which may hold lock too long and impact other parts of systems. Patch #1 modified uapi with kernel changes. Patch #2 adjusted libbpf api accordingly. Changelogs: v3 -> v4: . add a forward declaration of bpf_iter_link_info in tools/lib/bpf/bpf.h in case that libbpf is built against not-latest uapi bpf.h. . target the patch set to "bpf" instead of "bpf-next" v2 -> v3: . undo "not reject iter_info.map.map_fd == 0" from v1. In the future map_fd may become optional, so let us use map_fd == 0 indicating the map_fd is not set by user space. . add link_info_len to bpf_iter_attach_opts to ensure always correct link_info_len from user. Otherwise, libbpf may deduce incorrect link_info_len if it uses different uapi header than the user app. v1 -> v2: . ensure link_create target_fd/flags == 0 since they are not used. (Andrii) . if either of iter_info ptr == 0 or iter_info_len == 0, but not both, return error to user space. (Andrii) . do not reject iter_info.map.map_fd == 0, go ahead to use it trying to get a map reference since the map_fd is required for map_elem iterator. . use bpf_iter_link_info in bpf_iter_attach_opts instead of map_fd. this way, user space is responsible to set up bpf_iter_link_info and libbpf just passes the data to the kernel, simplifying libbpf design. (Andrii) ==================== Signed-off-by: Alexei Starovoitov <ast@kernel.org>
| | * tools/bpf: Support new uapi for map element bpf iteratorYonghong Song2020-08-077-25/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previous commit adjusted kernel uapi for map element bpf iterator. This patch adjusted libbpf API due to uapi change. bpftool and bpf_iter selftests are also changed accordingly. Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Andrii Nakryiko <andriin@fb.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200805055058.1457623-1-yhs@fb.com
| | * bpf: Change uapi for bpf iterator map elementsYonghong Song2020-08-076-57/+102
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit a5cbe05a6673 ("bpf: Implement bpf iterator for map elements") added bpf iterator support for map elements. The map element bpf iterator requires info to identify a particular map. In the above commit, the attr->link_create.target_fd is used to carry map_fd and an enum bpf_iter_link_info is added to uapi to specify the target_fd actually representing a map_fd: enum bpf_iter_link_info { BPF_ITER_LINK_UNSPEC = 0, BPF_ITER_LINK_MAP_FD = 1, MAX_BPF_ITER_LINK_INFO, }; This is an extensible approach as we can grow enumerator for pid, cgroup_id, etc. and we can unionize target_fd for pid, cgroup_id, etc. But in the future, there are chances that more complex customization may happen, e.g., for tasks, it could be filtered based on both cgroup_id and user_id. This patch changed the uapi to have fields __aligned_u64 iter_info; __u32 iter_info_len; for additional iter_info for link_create. The iter_info is defined as union bpf_iter_link_info { struct { __u32 map_fd; } map; }; So future extension for additional customization will be easier. The bpf_iter_link_info will be passed to target callback to validate and generic bpf_iter framework does not need to deal it any more. Note that map_fd = 0 will be considered invalid and -EBADF will be returned to user space. Fixes: a5cbe05a6673 ("bpf: Implement bpf iterator for map elements") Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Andrii Nakryiko <andriin@fb.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200805055056.1457463-1-yhs@fb.com
| * selftests/bpf: Prevent runqslower from racing on building bpftoolAndrii Nakryiko2020-08-071-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | runqslower's Makefile is building/installing bpftool into $(OUTPUT)/sbin/bpftool, which coincides with $(DEFAULT_BPFTOOL). In practice this means that often when building selftests from scratch (after `make clean`), selftests are racing with runqslower to simultaneously build bpftool and one of the two processes fail due to file being busy. Prevent this race by explicitly order-depending on $(BPFTOOL_DEFAULT). Fixes: a2c9652f751e ("selftests: Refactor build to remove tools/lib/bpf from include path") Signed-off-by: Andrii Nakryiko <andriin@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200805004757.2960750-1-andriin@fb.com
* | mptcp: fix warn at shutdown time for unaccepted msk socketsPaolo Abeni2020-08-081-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With commit b93df08ccda3 ("mptcp: explicitly track the fully established status"), the status of unaccepted mptcp closed in mptcp_sock_destruct() changes from TCP_SYN_RECV to TCP_ESTABLISHED. As a result mptcp_sock_destruct() does not perform the proper cleanup and inet_sock_destruct() will later emit a warn. Address the issue updating the condition tested in mptcp_sock_destruct(). Also update the related comment. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/66 Reported-and-tested-by: Christoph Paasch <cpaasch@apple.com> Fixes: b93df08ccda3 ("mptcp: explicitly track the fully established status") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | mptcp: more stable diag self-testsPaolo Abeni2020-08-081-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During diag self-tests we introduce long wait in the mptcp test program to give the script enough time to access the sockets dump. Such wait is introduced after shutting down one sockets end. Since commit 43b54c6ee382 ("mptcp: Use full MPTCP-level disconnect state machine") if both sides shutdown the socket is correctly transitioned into CLOSED status. As a side effect some sockets are not dumped via the diag interface, because the socket state (CLOSED) does not match the default filter, and this cause self-tests instability. Address the issue moving the above mentioned wait before shutting down the socket. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/68 Fixes: df62f2ec3df6 ("selftests/mptcp: add diag interface tests") Tested-and-acked-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | selftests: mptcp: fix dependeciesPaolo Abeni2020-08-081-0/+2
| | | | | | | | | | | | | | | | | | | | | | Since commit df62f2ec3df6 ("selftests/mptcp: add diag interface tests") the MPTCP selftests relies on the MPTCP diag interface which is enabled by a specific kconfig knob: be sure to include it. Fixes: df62f2ec3df6 ("selftests/mptcp: add diag interface tests") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | r8152: Use MAC address from correct device tree nodeThierry Reding2020-08-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Query the USB device's device tree node when looking for a MAC address. The struct device embedded into the struct net_device does not have a device tree node attached at all. The reason why this went unnoticed is because the system where this was tested was one of the few development units that had its OTP programmed, as opposed to production systems where the MAC address is stored in a separate EEPROM and is passed via device tree by the firmware. Reported-by: EJ Hsu <ejh@nvidia.com> Fixes: acb6d3771a03 ("r8152: Use MAC address from device tree if available") Signed-off-by: Thierry Reding <treding@nvidia.com> Reviewed-by: EJ Hsu <ejh@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | drivers/net/wan/lapbether: Added needed_headroom and a skb->len checkXie He2020-08-071-1/+9
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Added a skb->len check This driver expects upper layers to include a pseudo header of 1 byte when passing down a skb for transmission. This driver will read this 1-byte header. This patch added a skb->len check before reading the header to make sure the header exists. 2. Changed to use needed_headroom instead of hard_header_len to request necessary headroom to be allocated In net/packet/af_packet.c, the function packet_snd first reserves a headroom of length (dev->hard_header_len + dev->needed_headroom). Then if the socket is a SOCK_DGRAM socket, it calls dev_hard_header, which calls dev->header_ops->create, to create the link layer header. If the socket is a SOCK_RAW socket, it "un-reserves" a headroom of length (dev->hard_header_len), and assumes the user to provide the appropriate link layer header. So according to the logic of af_packet.c, dev->hard_header_len should be the length of the header that would be created by dev->header_ops->create. However, this driver doesn't provide dev->header_ops, so logically dev->hard_header_len should be 0. So we should use dev->needed_headroom instead of dev->hard_header_len to request necessary headroom to be allocated. This change fixes kernel panic when this driver is used with AF_PACKET SOCK_RAW sockets. Call stack when panic: [ 168.399197] skbuff: skb_under_panic: text:ffffffff819d95fb len:20 put:14 head:ffff8882704c0a00 data:ffff8882704c09fd tail:0x11 end:0xc0 dev:veth0 ... [ 168.399255] Call Trace: [ 168.399259] skb_push.cold+0x14/0x24 [ 168.399262] eth_header+0x2b/0xc0 [ 168.399267] lapbeth_data_transmit+0x9a/0xb0 [lapbether] [ 168.399275] lapb_data_transmit+0x22/0x2c [lapb] [ 168.399277] lapb_transmit_buffer+0x71/0xb0 [lapb] [ 168.399279] lapb_kick+0xe3/0x1c0 [lapb] [ 168.399281] lapb_data_request+0x76/0xc0 [lapb] [ 168.399283] lapbeth_xmit+0x56/0x90 [lapbether] [ 168.399286] dev_hard_start_xmit+0x91/0x1f0 [ 168.399289] ? irq_init_percpu_irqstack+0xc0/0x100 [ 168.399291] __dev_queue_xmit+0x721/0x8e0 [ 168.399295] ? packet_parse_headers.isra.0+0xd2/0x110 [ 168.399297] dev_queue_xmit+0x10/0x20 [ 168.399298] packet_sendmsg+0xbf0/0x19b0 ...... Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com> Cc: Martin Schiller <ms@dev.tdt.de> Cc: Brian Norris <briannorris@chromium.org> Signed-off-by: Xie He <xie.he.0141@gmail.com> Acked-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: hns3: fix spelling mistake "could'nt" -> "couldn't"Colin Ian King2020-08-061-1/+1
| | | | | | | There is a spelling mistake in a dev_err message. Fix it. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge tag 'Smack-for-5.9' of git://github.com/cschaufler/smack-nextLinus Torvalds2020-08-061-3/+16
|\ | | | | | | | | | | | | | | | | | | | | | | | | Pull smack updates from Casey Schaufler: "Minor fixes to Smack for the v5.9 release. All were found by automated checkers and have straightforward resolution" * tag 'Smack-for-5.9' of git://github.com/cschaufler/smack-next: Smack: prevent underflow in smk_set_cipso() Smack: fix another vsscanf out of bounds Smack: fix use-after-free in smk_write_relabel_self()
| * Smack: prevent underflow in smk_set_cipso()Dan Carpenter2020-07-271-1/+1
| | | | | | | | | | | | | | | | | | We have an upper bound on "maplevel" but forgot to check for negative values. Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
| * Smack: fix another vsscanf out of boundsDan Carpenter2020-07-271-0/+4
| | | | | | | | | | | | | | | | | | | | This is similar to commit 84e99e58e8d1 ("Smack: slab-out-of-bounds in vsscanf") where we added a bounds check on "rule". Reported-by: syzbot+a22c6092d003d6fe1122@syzkaller.appspotmail.com Fixes: f7112e6c9abf ("Smack: allow for significantly longer Smack labels v4") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
| * Smack: fix use-after-free in smk_write_relabel_self()Eric Biggers2020-07-141-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | smk_write_relabel_self() frees memory from the task's credentials with no locking, which can easily cause a use-after-free because multiple tasks can share the same credentials structure. Fix this by using prepare_creds() and commit_creds() to correctly modify the task's credentials. Reproducer for "BUG: KASAN: use-after-free in smk_write_relabel_self": #include <fcntl.h> #include <pthread.h> #include <unistd.h> static void *thrproc(void *arg) { int fd = open("/sys/fs/smackfs/relabel-self", O_WRONLY); for (;;) write(fd, "foo", 3); } int main() { pthread_t t; pthread_create(&t, NULL, thrproc, NULL); thrproc(NULL); } Reported-by: syzbot+e6416dabb497a650da40@syzkaller.appspotmail.com Fixes: 38416e53936e ("Smack: limited capability for changing process label") Cc: <stable@vger.kernel.org> # v4.4+ Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
* | Merge tag 'mips_5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linuxLinus Torvalds2020-08-06108-1608/+3139
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull MIPS upates from Thomas Bogendoerfer: - improvements for Loongson64 - extended ingenic support - removal of not maintained paravirt system type - cleanups and fixes * tag 'mips_5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (81 commits) MIPS: SGI-IP27: always enable NUMA in Kconfig MAINTAINERS: Update KVM/MIPS maintainers MIPS: Update default config file for Loongson-3 MIPS: KVM: Add kvm guest support for Loongson-3 dt-bindings: mips: Document Loongson kvm guest board MIPS: handle Loongson-specific GSExc exception MIPS: add definitions for Loongson-specific CP0.Diag1 register MIPS: only register FTLBPar exception handler for supported models MIPS: ingenic: Hardcode mem size for qi,lb60 board MIPS: DTS: ingenic/qi,lb60: Add model and memory node MIPS: ingenic: Use fw_passed_dtb even if CONFIG_BUILTIN_DTB MIPS: head.S: Init fw_passed_dtb to builtin DTB of: address: Fix parser address/size cells initialization of_address: Guard of_bus_pci_get_flags with CONFIG_PCI MIPS: DTS: Fix number of msi vectors for Loongson64G MIPS: Loongson64: Add ISA node for LS7A PCH MIPS: Loongson64: DTS: Fix ISA and PCI I/O ranges for RS780E PCH MIPS: Loongson64: Enlarge IO_SPACE_LIMIT MIPS: Loongson64: Process ISA Node in DeviceTree of_address: Add bus type match for pci ranges parser ...
| * | MIPS: SGI-IP27: always enable NUMA in KconfigMike Rapoport2020-08-051-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a configuration has NUMA disabled and SGI_IP27 enabled, the build fails: CC kernel/bounds.s CC arch/mips/kernel/asm-offsets.s In file included from arch/mips/include/asm/topology.h:11, from include/linux/topology.h:36, from include/linux/gfp.h:9, from include/linux/slab.h:15, from include/linux/crypto.h:19, from include/crypto/hash.h:11, from include/linux/uio.h:10, from include/linux/socket.h:8, from include/linux/compat.h:15, from arch/mips/kernel/asm-offsets.c:12: include/linux/topology.h: In function 'numa_node_id': arch/mips/include/asm/mach-ip27/topology.h:16:27: error: implicit declaration of function 'cputonasid'; did you mean 'cpu_vpe_id'? [-Werror=implicit-function-declaration] #define cpu_to_node(cpu) (cputonasid(cpu)) ^~~~~~~~~~ include/linux/topology.h:119:9: note: in expansion of macro 'cpu_to_node' return cpu_to_node(raw_smp_processor_id()); ^~~~~~~~~~~ include/linux/topology.h: In function 'cpu_cpu_mask': arch/mips/include/asm/mach-ip27/topology.h:19:7: error: implicit declaration of function 'hub_data' [-Werror=implicit-function-declaration] &hub_data(node)->h_cpus) ^~~~~~~~ include/linux/topology.h:210:9: note: in expansion of macro 'cpumask_of_node' return cpumask_of_node(cpu_to_node(cpu)); ^~~~~~~~~~~~~~~ arch/mips/include/asm/mach-ip27/topology.h:19:21: error: invalid type argument of '->' (have 'int') &hub_data(node)->h_cpus) ^~ include/linux/topology.h:210:9: note: in expansion of macro 'cpumask_of_node' return cpumask_of_node(cpu_to_node(cpu)); ^~~~~~~~~~~~~~~ Before switch from discontigmem to sparsemem, there always was CONFIG_NEED_MULTIPLE_NODES=y because it was selected by DISCONTIGMEM. Without DISCONTIGMEM it is possible to have SPARSEMEM without NUMA for SGI_IP27 and as many things there rely on custom node definition, the build breaks. As Thomas noted "... there are right now too many places in IP27 code, which assumes NUMA enabled", the simplest solution would be to always enable NUMA for SGI-IP27 builds. Reported-by: kernel test robot <lkp@intel.com> Fixes: 397dc00e249e ("mips: sgi-ip27: switch from DISCONTIGMEM to SPARSEMEM") Cc: stable@vger.kernel.org Signed-off-by: Mike Rapoport <rppt@linux.ibm.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MAINTAINERS: Update KVM/MIPS maintainersHuacai Chen2020-08-041-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | James Hogan has become inactive for a long time and leaves KVM for MIPS orphan. I'm working on KVM/Loongson and attempt to make it upstream both in kernel and QEMU, while Aleksandar Markovic is already a maintainer of QEMU/MIPS. We are both interested in QEMU/KVM/MIPS, and we have already made some contributions in kernel and QEMU. If possible, we want to take the KVM/MIPS maintainership. Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Signed-off-by: Huacai Chen <chenhc@lemote.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: Update default config file for Loongson-3Huacai Chen2020-08-041-6/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update Loongson-3's default config file: 1, Adjust NR_CPUS to 16; 2, Add a built-in cmdline "ieee754=relaxed"; 3, Enable MSA, CGROUPS, NAMESPACES, KVM, and XFS support; 4, Enable all possible virtio drivers to support KVM Host/Guest; 5, Enable all necessary netfilter modules to support virtual network; Signed-off-by: Huacai Chen <chenhc@lemote.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: KVM: Add kvm guest support for Loongson-3Huacai Chen2020-08-047-3/+125
| | | | | | | | | | | | | | | | | | | | | | | | Loongson-3 KVM guest is based on virtio, it use liointc as its interrupt controller and use GPEX as the pci controller. Signed-off-by: Huacai Chen <chenhc@lemote.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | dt-bindings: mips: Document Loongson kvm guest boardHuacai Chen2020-08-041-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Document loongson64v-4core-virtio, a virtio based kvm guest board for Loongson-3. Signed-off-by: Huacai Chen <chenhc@lemote.com> Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: handle Loongson-specific GSExc exceptionWANG Xuerui2020-07-316-0/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Newer Loongson cores (Loongson-3A R2 and newer) use the implementation-dependent ExcCode 16 to signal Loongson-specific exceptions. The extended cause is put in the non-standard CP0.Diag1 register which is CP0 Register 22 Select 1, called GSCause in Loongson manuals. Inside is an exception code bitfield called GSExcCode, only codes 0 to 6 inclusive are documented (so far, in the Loongson 3A3000 User Manual, Volume 2). During experiments, it was found that some undocumented unprivileged instructions can trigger the also-undocumented GSExcCode 8 on Loongson 3A4000. Processor state is not corrupted, but we cannot continue without further knowledge, and Loongson is not providing that information as of this writing. So we send SIGILL on seeing this exception code to thwart easy local DoS attacks. Other exception codes are made fatal, partly because of insufficient knowledge, also partly because they are not as easily reproduced. None of them are encountered in the wild with upstream kernels and userspace so far. Some older cores (Loongson-3A1000 and Loongson-3B1500) have ExcCode 16 too, but the semantic is equivalent to GSExcCode 0. Because the respective manuals did not mention the CP0.Diag1 register or its read behavior, these cores are not covered in this patch, as MFC0 from non-existent CP0 registers is UNDEFINED according to the MIPS architecture spec. Reviewed-by: Huacai Chen <chenhc@lemote.com> Signed-off-by: WANG Xuerui <git@xen0n.name> Cc: Huacai Chen <chenhc@lemote.com> Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> Cc: Tiezhu Yang <yangtiezhu@loongson.cn> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: add definitions for Loongson-specific CP0.Diag1 registerWANG Xuerui2020-07-311-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This 32-bit CP0 register is named GSCause in Loongson manuals. It carries Loongson extended exception information. We name it Diag1 because we fear the "GSCause" name might get changed in the future. Reviewed-by: Huacai Chen <chenhc@lemote.com> Signed-off-by: WANG Xuerui <git@xen0n.name> Cc: Huacai Chen <chenhc@lemote.com> Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> Cc: Tiezhu Yang <yangtiezhu@loongson.cn> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: only register FTLBPar exception handler for supported modelsWANG Xuerui2020-07-314-1/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously ExcCode 16 is unconditionally treated as the FTLB parity exception (FTLBPar), but in fact its semantic is implementation- dependent. Looking at various manuals it seems the FTLBPar exception is only present on some recent MIPS Technologies cores, so only register the handler on these. Fixes: 75b5b5e0a262790f ("MIPS: Add support for FTLBs") Reviewed-by: Huacai Chen <chenhc@lemote.com> Signed-off-by: WANG Xuerui <git@xen0n.name> Cc: Paul Burton <paulburton@kernel.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: ingenic: Hardcode mem size for qi,lb60 boardPaul Cercueil2020-07-311-29/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Old Device Tree for the qi,lb60 (aka. Ben Nanonote) did not have a 'memory' node. The kernel would then read the memory controller registers to know how much RAM was available. Since every other supported board has had a 'memory' node from the beginning, we can just hardcode a RAM size of 32 MiB when running with an old Device Tree without the 'memory' node. Signed-off-by: Paul Cercueil <paul@crapouillou.net> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: DTS: ingenic/qi,lb60: Add model and memory nodePaul Cercueil2020-07-311-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add a memory node, which was missing until now, and use the retail name "Ben Nanonote" as the model, as it is way more known under that name than under the name "LB60". Signed-off-by: Paul Cercueil <paul@crapouillou.net> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: ingenic: Use fw_passed_dtb even if CONFIG_BUILTIN_DTBPaul Cercueil2020-07-311-6/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fw_passed_dtb is now properly initialized even when CONFIG_BUILTIN_DTB is used, so there's no need to handle it in any particular way here. Note that the behaviour is slightly different, as the previous code used the built-in Device Tree unconditionally, while now the built-in Device Tree is only used when the bootloader did not provide one. Signed-off-by: Paul Cercueil <paul@crapouillou.net> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: head.S: Init fw_passed_dtb to builtin DTBPaul Cercueil2020-07-311-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | Init the 'fw_passed_dtb' pointer to the buit-in Device Tree blob when it has been compiled in with CONFIG_BUILTIN_DTB. Signed-off-by: Paul Cercueil <paul@crapouillou.net> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | of: address: Fix parser address/size cells initializationNicolas Saenz Julienne2020-07-311-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | bus->count_cells() parses cells starting from the node's parent. This is not good enough for parser_init() which is generally parsing a bus node. Revert to previous behavior using of_bus_n_*_cells(). Fixes: 2f96593ecc37 ("of_address: Add bus type match for pci ranges parser") Reported-by: Nathan Chancellor <natechancellor@gmail.com> Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | of_address: Guard of_bus_pci_get_flags with CONFIG_PCIJiaxun Yang2020-07-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After 2f96593ecc37 ("of_address: Add bus type match for pci ranges parser"), the last user of of_bus_pci_get_flags when CONFIG_PCI is disabled had gone. This caused unused function warning when compiling without CONFIG_PCI. Fix by guarding it with CONFIG_PCI. Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Fixes: 2f96593ecc37 ("of_address: Add bus type match for pci ranges parser") Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: DTS: Fix number of msi vectors for Loongson64GHuacai Chen2020-07-301-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | HT irqs vectors are 8 groups, each group has 32 irqs, Loongson64C CPUs can use only 4 groups and Loongson64G CPUs can use all 8 groups. So the number of msi vectors of Loongson64G is 192 (32*8 - 64 = 192). Fixes: 24af105962c8004edb9f5bf84 ("MIPS: Loongson64: DeviceTree for LS7A PCH") Signed-off-by: Huacai Chen <chenhc@lemote.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: Loongson64: Add ISA node for LS7A PCHJiaxun Yang2020-07-281-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | Although currently we're not enabling any ISA device in devicetree, but this node is required to express the ranges of address reserved for ISA. Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: Loongson64: DTS: Fix ISA and PCI I/O ranges for RS780E PCHJiaxun Yang2020-07-281-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Ranges should express the actual physical address on bus. Also enlarge the PCI I/O size to the actual hardware limit. Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: Loongson64: Enlarge IO_SPACE_LIMITJiaxun Yang2020-07-283-4/+5
| | | | | | | | | | | | | | | | | | | | | It can be very big on LS7A PCH systems. Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: Loongson64: Process ISA Node in DeviceTreeJiaxun Yang2020-07-281-25/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, we're hardcoding reserved ISA I/O Space in, now we're processing it I/O via DeviceTree directly. The ranges property if ISA node is used to determine the size and address of reserved I/O space. Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | of_address: Add bus type match for pci ranges parserJiaxun Yang2020-07-282-12/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | So the parser can be used to parse range property of ISA bus. As they're all using PCI-like method of range property, there is no need start a new parser. Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | memory: jz4780-nemc: Do not build by defaultKrzysztof Kozlowski2020-07-281-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | Enabling the JZ4780_NEMC driver makes sense only for specific hardware - the Ingenic SoC architecture. It is not an essential driver for the SoC support so do not enable it by default. Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: ingenic: Enable JZ4780_NEMC manuallyKrzysztof Kozlowski2020-07-283-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The CONFIG_JZ4780_NEMC was previously a default on MIPS but now it has to be enabled manually. Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Reviewed-by: Paul Cercueil <paul@crapouillou.net> Acked-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
| * | MIPS: qi_lb60: Fix routing to audio amplifierPaul Cercueil2020-07-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ROUT (right channel output of audio codec) was connected to INL (left channel of audio amplifier) instead of INR (right channel of audio amplifier). Fixes: 8ddebad15e9b ("MIPS: qi_lb60: Migrate to devicetree") Cc: stable@vger.kernel.org # v5.3 Signed-off-by: Paul Cercueil <paul@crapouillou.net> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-16 16:12:25 +0100