From patchwork Sat Apr 11 12:08:32 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 227975 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9DBBDC2BB85 for ; Sat, 11 Apr 2020 12:29:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6D42C20757 for ; Sat, 11 Apr 2020 12:29:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586608172; bh=ZhPfXwdhyzdj32voEjkcU8CfMlM/xNaQVegWyaKUHX4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=PXm472G5dUCRbNgHiz3VrkYU3rPPeo2Al5peruw5MDL1/zwrka9Rj/57exzoGivLM rQWnLV9kf+i2VwetiYjy6iAfl7t7k5CpsbLi/Vq73AwJVMCAKo7bZY5MJ2lO35Lr9M BM+2rTPoMr04octt/SWVuqkVLvdSBBjifST0aPqA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726673AbgDKMKl (ORCPT ); Sat, 11 Apr 2020 08:10:41 -0400 Received: from mail.kernel.org ([198.145.29.99]:42246 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726091AbgDKMKk (ORCPT ); Sat, 11 Apr 2020 08:10:40 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id CCCA02084D; Sat, 11 Apr 2020 12:10:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607039; bh=ZhPfXwdhyzdj32voEjkcU8CfMlM/xNaQVegWyaKUHX4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=F654Ntsv1baM+3XxpHOvJ6zq14VeBtPcfAJQSqZY95fb9bolGJ42K3Nl6yfGnLnE5 fgAirp8oIYzOs2fehwZxa6OeDYacTBs8rngUj1OIFnpTK97aCO1GMvzoKs6HNcpCU9 n9RmPTkUphT3Pgfg1kr0PwleBlLm1PZWf+NDU+VY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Qian Cai , Eric Dumazet , "David S. Miller" Subject: [PATCH 4.4 02/29] ipv4: fix a RCU-list lock in fib_triestat_seq_show Date: Sat, 11 Apr 2020 14:08:32 +0200 Message-Id: <20200411115407.957243103@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Qian Cai [ Upstream commit fbe4e0c1b298b4665ee6915266c9d6c5b934ef4a ] fib_triestat_seq_show() calls hlist_for_each_entry_rcu(tb, head, tb_hlist) without rcu_read_lock() will trigger a warning, net/ipv4/fib_trie.c:2579 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by proc01/115277: #0: c0000014507acf00 (&p->lock){+.+.}-{3:3}, at: seq_read+0x58/0x670 Call Trace: dump_stack+0xf4/0x164 (unreliable) lockdep_rcu_suspicious+0x140/0x164 fib_triestat_seq_show+0x750/0x880 seq_read+0x1a0/0x670 proc_reg_read+0x10c/0x1b0 __vfs_read+0x3c/0x70 vfs_read+0xac/0x170 ksys_read+0x7c/0x140 system_call+0x5c/0x68 Fix it by adding a pair of rcu_read_lock/unlock() and use cond_resched_rcu() to avoid the situation where walking of a large number of items may prevent scheduling for a long time. Signed-off-by: Qian Cai Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/fib_trie.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/ipv4/fib_trie.c +++ b/net/ipv4/fib_trie.c @@ -2230,6 +2230,7 @@ static int fib_triestat_seq_show(struct " %Zd bytes, size of tnode: %Zd bytes.\n", LEAF_SIZE, TNODE_SIZE(0)); + rcu_read_lock(); for (h = 0; h < FIB_TABLE_HASHSZ; h++) { struct hlist_head *head = &net->ipv4.fib_table_hash[h]; struct fib_table *tb; @@ -2249,7 +2250,9 @@ static int fib_triestat_seq_show(struct trie_show_usage(seq, t->stats); #endif } + cond_resched_rcu(); } + rcu_read_unlock(); return 0; } From patchwork Sat Apr 11 12:08:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228107 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 45068C2BB85 for ; Sat, 11 Apr 2020 12:10:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1CD782166E for ; Sat, 11 Apr 2020 12:10:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607050; bh=Lq+c0hsqiUVZu7vthld/EVB7dfPYmMTCezE13xmjMxk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=HTyNmWhvVSJ2sgE5NxiSVSKh2Z8Ir5qYoCjo6DuGJXiKI9U2/FoBWmpcE2tQOb0Ch NOr6OcNMAetW3domQpzG0Q4/5CCPSgLtdYveiHzln0EVe06p+a5AUU8Z2zZDo/zRC6 BS3ul/xrIGNoUXYBS/PbzG/bYgcLWLfbeeRHN07I= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726703AbgDKMKs (ORCPT ); Sat, 11 Apr 2020 08:10:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:42452 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726715AbgDKMKr (ORCPT ); Sat, 11 Apr 2020 08:10:47 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1A0B42084D; Sat, 11 Apr 2020 12:10:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607046; bh=Lq+c0hsqiUVZu7vthld/EVB7dfPYmMTCezE13xmjMxk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vbNNlrpRROXFUKWVnsCve8ghTQVG1FPONMsRuHeRobC0Fkb+05PaVv0sk1UNk+L5g 1FLzDl13tVf5CIUbljHpwi1zLl3spvrK1AYeS6wV2rvcqeIV1ixu4jC7qrVuPrCjTr 8Z8E2oPbfesbn0q2yIEMbHAYTwH7FuaQX4lcoMOY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Phil Turnbull , "David S. Miller" , Will Deacon Subject: [PATCH 4.4 05/29] l2tp: Correctly return -EBADF from pppol2tp_getname. Date: Sat, 11 Apr 2020 14:08:35 +0200 Message-Id: <20200411115408.341698005@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: phil.turnbull@oracle.com commit 4ac36a4adaf80013a60013d6f829f5863d5d0e05 upstream. If 'tunnel' is NULL we should return -EBADF but the 'end_put_sess' path unconditionally sets 'error' back to zero. Rework the error path so it more closely matches pppol2tp_sendmsg. Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") Signed-off-by: Phil Turnbull Signed-off-by: David S. Miller Signed-off-by: Will Deacon Signed-off-by: Greg Kroah-Hartman --- net/l2tp/l2tp_ppp.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -889,10 +889,8 @@ static int pppol2tp_getname(struct socke pls = l2tp_session_priv(session); tunnel = l2tp_sock_to_tunnel(pls->tunnel_sock); - if (tunnel == NULL) { - error = -EBADF; + if (tunnel == NULL) goto end_put_sess; - } inet = inet_sk(tunnel->sock); if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) { @@ -970,12 +968,11 @@ static int pppol2tp_getname(struct socke } *usockaddr_len = len; + error = 0; sock_put(pls->tunnel_sock); end_put_sess: sock_put(sk); - error = 0; - end: return error; } From patchwork Sat Apr 11 12:08:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 227976 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19DB2C2BB85 for ; Sat, 11 Apr 2020 12:29:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E013A20757 for ; Sat, 11 Apr 2020 12:29:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586608169; bh=VjfUFGR/xtBTcnZy5bIR28Rr7orkr52e/SB573hhVPU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=JWpo4niypSbNdGYES4tadwi9CAIpUZoaWC5U5W+5nfcvVTZtHKryU4dSx3zf1tP+V bkHOlS4nv1D+eULmnaDvKOvcnLCUOMtEL2ZJawmrVhpIj+PuUYBHAaMU/AsuhmYRUX xhGZUeffLKzx1PMFF3vjt57RiMvqeT3mEJyNH7I4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726741AbgDKMKv (ORCPT ); Sat, 11 Apr 2020 08:10:51 -0400 Received: from mail.kernel.org ([198.145.29.99]:42534 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726729AbgDKMKu (ORCPT ); Sat, 11 Apr 2020 08:10:50 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 893BF21655; Sat, 11 Apr 2020 12:10:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607049; bh=VjfUFGR/xtBTcnZy5bIR28Rr7orkr52e/SB573hhVPU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DrJc+CrD6lgXUr1Q54jsW6YHUKUcu1tWrF1+7GhfQRSiYqtsphCQ58F/3qZ045sxD zD16KB1Al5R89BnZfWyDPe4T3KrtV6rV0xP9BMSFHpMCCQy5NH81mNthgdSdTfCvY2 jhn36vEqlP0syVg1HaTQH1a1uTtGcJFx1Ol47K9o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shmulik Ladkani , "David S. Miller" , Will Deacon Subject: [PATCH 4.4 06/29] net: l2tp: Make l2tp_ip6 namespace aware Date: Sat, 11 Apr 2020 14:08:36 +0200 Message-Id: <20200411115408.535065386@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Shmulik Ladkani commit 0e6b5259824e97a0f7e7b450421ff12865d3b0e2 upstream. l2tp_ip6 tunnel and session lookups were still using init_net, although the l2tp core infrastructure already supports lookups keyed by 'net'. As a result, l2tp_ip6_recv discarded packets for tunnels/sessions created in namespaces other than the init_net. Fix, by using dev_net(skb->dev) or sock_net(sk) where appropriate. Signed-off-by: Shmulik Ladkani Signed-off-by: David S. Miller Signed-off-by: Will Deacon Signed-off-by: Greg Kroah-Hartman --- net/l2tp/l2tp_ip6.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) --- a/net/l2tp/l2tp_ip6.c +++ b/net/l2tp/l2tp_ip6.c @@ -127,6 +127,7 @@ static inline struct sock *l2tp_ip6_bind */ static int l2tp_ip6_recv(struct sk_buff *skb) { + struct net *net = dev_net(skb->dev); struct sock *sk; u32 session_id; u32 tunnel_id; @@ -153,7 +154,7 @@ static int l2tp_ip6_recv(struct sk_buff } /* Ok, this is a data packet. Lookup the session. */ - session = l2tp_session_find(&init_net, NULL, session_id); + session = l2tp_session_find(net, NULL, session_id); if (session == NULL) goto discard; @@ -190,7 +191,7 @@ pass_up: goto discard; tunnel_id = ntohl(*(__be32 *) &skb->data[4]); - tunnel = l2tp_tunnel_find(&init_net, tunnel_id); + tunnel = l2tp_tunnel_find(net, tunnel_id); if (tunnel) { sk = tunnel->sock; sock_hold(sk); @@ -198,7 +199,7 @@ pass_up: struct ipv6hdr *iph = ipv6_hdr(skb); read_lock_bh(&l2tp_ip6_lock); - sk = __l2tp_ip6_bind_lookup(&init_net, &iph->daddr, + sk = __l2tp_ip6_bind_lookup(net, &iph->daddr, 0, tunnel_id); if (!sk) { read_unlock_bh(&l2tp_ip6_lock); @@ -267,6 +268,7 @@ static int l2tp_ip6_bind(struct sock *sk struct inet_sock *inet = inet_sk(sk); struct ipv6_pinfo *np = inet6_sk(sk); struct sockaddr_l2tpip6 *addr = (struct sockaddr_l2tpip6 *) uaddr; + struct net *net = sock_net(sk); __be32 v4addr = 0; int addr_type; int err; @@ -288,7 +290,7 @@ static int l2tp_ip6_bind(struct sock *sk err = -EADDRINUSE; read_lock_bh(&l2tp_ip6_lock); - if (__l2tp_ip6_bind_lookup(&init_net, &addr->l2tp_addr, + if (__l2tp_ip6_bind_lookup(net, &addr->l2tp_addr, sk->sk_bound_dev_if, addr->l2tp_conn_id)) goto out_in_use; read_unlock_bh(&l2tp_ip6_lock); @@ -461,7 +463,7 @@ static int l2tp_ip6_backlog_recv(struct return 0; drop: - IP_INC_STATS(&init_net, IPSTATS_MIB_INDISCARDS); + IP_INC_STATS(sock_net(sk), IPSTATS_MIB_INDISCARDS); kfree_skb(skb); return -1; } From patchwork Sat Apr 11 12:08:39 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228106 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C1A35C2BBFD for ; Sat, 11 Apr 2020 12:11:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 93AE121655 for ; Sat, 11 Apr 2020 12:11:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607061; bh=0lrFH0n9Ij3mmcRCJY2XGS15SgAh/Dr7fwW22MbFbhM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=L8VJwFkxValSTubbadneIn7o2ntJjpHLx4/Q1toARMG1IeoYUTfoQJgX8050PQK0i SFAGRogr+BtQ1xrAUYHov/MKOA7nF/vHui+BHnd04N5/2LUiXJduQ9nM09zAgyEqUU zoFFCymqWYg3sO0kukbyM6b28ANPGmpvHdEF7Cxc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726801AbgDKMLA (ORCPT ); Sat, 11 Apr 2020 08:11:00 -0400 Received: from mail.kernel.org ([198.145.29.99]:42726 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726720AbgDKMK6 (ORCPT ); Sat, 11 Apr 2020 08:10:58 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D5C3E20787; Sat, 11 Apr 2020 12:10:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607056; bh=0lrFH0n9Ij3mmcRCJY2XGS15SgAh/Dr7fwW22MbFbhM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0F2zWiKZ4/K9Oex/SWTr6jyVXjFtkmrhkYEWEheNhOgTa2gfwj07SqLFmLmiUvqLV 9DOauzNRwP6lGmGQTnCVfqdlFu263NN7iZi2ZJLv60WcgNwjQMExPYxC/D9U4VZBdl f7L9kqrwqvWmabIILwU8ZAok0GM22LtqII0Qfil8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guillaume Nault , "David S. Miller" , Will Deacon Subject: [PATCH 4.4 09/29] l2tp: fix duplicate session creation Date: Sat, 11 Apr 2020 14:08:39 +0200 Message-Id: <20200411115409.210027991@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Guillaume Nault commit dbdbc73b44782e22b3b4b6e8b51e7a3d245f3086 upstream. l2tp_session_create() relies on its caller for checking for duplicate sessions. This is racy since a session can be concurrently inserted after the caller's verification. Fix this by letting l2tp_session_create() verify sessions uniqueness upon insertion. Callers need to be adapted to check for l2tp_session_create()'s return code instead of calling l2tp_session_find(). pppol2tp_connect() is a bit special because it has to work on existing sessions (if they're not connected) or to create a new session if none is found. When acting on a preexisting session, a reference must be held or it could go away on us. So we have to use l2tp_session_get() instead of l2tp_session_find() and drop the reference before exiting. Fixes: d9e31d17ceba ("l2tp: Add L2TP ethernet pseudowire support") Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") Signed-off-by: Guillaume Nault Signed-off-by: David S. Miller Signed-off-by: Will Deacon Signed-off-by: Greg Kroah-Hartman --- net/l2tp/l2tp_core.c | 70 ++++++++++++++++++++++++++++++++++++++------------- net/l2tp/l2tp_eth.c | 10 +------ net/l2tp/l2tp_ppp.c | 60 +++++++++++++++++++++---------------------- 3 files changed, 84 insertions(+), 56 deletions(-) --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -377,6 +377,48 @@ struct l2tp_session *l2tp_session_find_b } EXPORT_SYMBOL_GPL(l2tp_session_find_by_ifname); +static int l2tp_session_add_to_tunnel(struct l2tp_tunnel *tunnel, + struct l2tp_session *session) +{ + struct l2tp_session *session_walk; + struct hlist_head *g_head; + struct hlist_head *head; + struct l2tp_net *pn; + + head = l2tp_session_id_hash(tunnel, session->session_id); + + write_lock_bh(&tunnel->hlist_lock); + hlist_for_each_entry(session_walk, head, hlist) + if (session_walk->session_id == session->session_id) + goto exist; + + if (tunnel->version == L2TP_HDR_VER_3) { + pn = l2tp_pernet(tunnel->l2tp_net); + g_head = l2tp_session_id_hash_2(l2tp_pernet(tunnel->l2tp_net), + session->session_id); + + spin_lock_bh(&pn->l2tp_session_hlist_lock); + hlist_for_each_entry(session_walk, g_head, global_hlist) + if (session_walk->session_id == session->session_id) + goto exist_glob; + + hlist_add_head_rcu(&session->global_hlist, g_head); + spin_unlock_bh(&pn->l2tp_session_hlist_lock); + } + + hlist_add_head(&session->hlist, head); + write_unlock_bh(&tunnel->hlist_lock); + + return 0; + +exist_glob: + spin_unlock_bh(&pn->l2tp_session_hlist_lock); +exist: + write_unlock_bh(&tunnel->hlist_lock); + + return -EEXIST; +} + /* Lookup a tunnel by id */ struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id) @@ -1792,6 +1834,7 @@ EXPORT_SYMBOL_GPL(l2tp_session_set_heade struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg) { struct l2tp_session *session; + int err; session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL); if (session != NULL) { @@ -1847,6 +1890,13 @@ struct l2tp_session *l2tp_session_create l2tp_session_set_header_len(session, tunnel->version); + err = l2tp_session_add_to_tunnel(tunnel, session); + if (err) { + kfree(session); + + return ERR_PTR(err); + } + /* Bump the reference count. The session context is deleted * only when this drops to zero. */ @@ -1856,28 +1906,14 @@ struct l2tp_session *l2tp_session_create /* Ensure tunnel socket isn't deleted */ sock_hold(tunnel->sock); - /* Add session to the tunnel's hash list */ - write_lock_bh(&tunnel->hlist_lock); - hlist_add_head(&session->hlist, - l2tp_session_id_hash(tunnel, session_id)); - write_unlock_bh(&tunnel->hlist_lock); - - /* And to the global session list if L2TPv3 */ - if (tunnel->version != L2TP_HDR_VER_2) { - struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net); - - spin_lock_bh(&pn->l2tp_session_hlist_lock); - hlist_add_head_rcu(&session->global_hlist, - l2tp_session_id_hash_2(pn, session_id)); - spin_unlock_bh(&pn->l2tp_session_hlist_lock); - } - /* Ignore management session in session count value */ if (session->session_id != 0) atomic_inc(&l2tp_session_count); + + return session; } - return session; + return ERR_PTR(-ENOMEM); } EXPORT_SYMBOL_GPL(l2tp_session_create); --- a/net/l2tp/l2tp_eth.c +++ b/net/l2tp/l2tp_eth.c @@ -223,12 +223,6 @@ static int l2tp_eth_create(struct net *n goto out; } - session = l2tp_session_find(net, tunnel, session_id); - if (session) { - rc = -EEXIST; - goto out; - } - if (cfg->ifname) { dev = dev_get_by_name(net, cfg->ifname); if (dev) { @@ -242,8 +236,8 @@ static int l2tp_eth_create(struct net *n session = l2tp_session_create(sizeof(*spriv), tunnel, session_id, peer_session_id, cfg); - if (!session) { - rc = -ENOMEM; + if (IS_ERR(session)) { + rc = PTR_ERR(session); goto out; } --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -600,6 +600,7 @@ static int pppol2tp_connect(struct socke int error = 0; u32 tunnel_id, peer_tunnel_id; u32 session_id, peer_session_id; + bool drop_refcnt = false; int ver = 2; int fd; @@ -708,36 +709,36 @@ static int pppol2tp_connect(struct socke if (tunnel->peer_tunnel_id == 0) tunnel->peer_tunnel_id = peer_tunnel_id; - /* Create session if it doesn't already exist. We handle the - * case where a session was previously created by the netlink - * interface by checking that the session doesn't already have - * a socket and its tunnel socket are what we expect. If any - * of those checks fail, return EEXIST to the caller. - */ - session = l2tp_session_find(sock_net(sk), tunnel, session_id); - if (session == NULL) { - /* Default MTU must allow space for UDP/L2TP/PPP - * headers. + session = l2tp_session_get(sock_net(sk), tunnel, session_id, false); + if (session) { + drop_refcnt = true; + ps = l2tp_session_priv(session); + + /* Using a pre-existing session is fine as long as it hasn't + * been connected yet. */ - cfg.mtu = cfg.mru = 1500 - PPPOL2TP_HEADER_OVERHEAD; + if (ps->sock) { + error = -EEXIST; + goto end; + } - /* Allocate and initialize a new session context. */ - session = l2tp_session_create(sizeof(struct pppol2tp_session), - tunnel, session_id, - peer_session_id, &cfg); - if (session == NULL) { - error = -ENOMEM; + /* consistency checks */ + if (ps->tunnel_sock != tunnel->sock) { + error = -EEXIST; goto end; } } else { - ps = l2tp_session_priv(session); - error = -EEXIST; - if (ps->sock != NULL) - goto end; + /* Default MTU must allow space for UDP/L2TP/PPP headers */ + cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; + cfg.mru = cfg.mtu; - /* consistency checks */ - if (ps->tunnel_sock != tunnel->sock) + session = l2tp_session_create(sizeof(struct pppol2tp_session), + tunnel, session_id, + peer_session_id, &cfg); + if (IS_ERR(session)) { + error = PTR_ERR(session); goto end; + } } /* Associate session with its PPPoL2TP socket */ @@ -802,6 +803,8 @@ out_no_ppp: session->name); end: + if (drop_refcnt) + l2tp_session_dec_refcount(session); release_sock(sk); return error; @@ -829,12 +832,6 @@ static int pppol2tp_session_create(struc if (tunnel->sock == NULL) goto out; - /* Check that this session doesn't already exist */ - error = -EEXIST; - session = l2tp_session_find(net, tunnel, session_id); - if (session != NULL) - goto out; - /* Default MTU values. */ if (cfg->mtu == 0) cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; @@ -842,12 +839,13 @@ static int pppol2tp_session_create(struc cfg->mru = cfg->mtu; /* Allocate and initialize a new session context. */ - error = -ENOMEM; session = l2tp_session_create(sizeof(struct pppol2tp_session), tunnel, session_id, peer_session_id, cfg); - if (session == NULL) + if (IS_ERR(session)) { + error = PTR_ERR(session); goto out; + } ps = l2tp_session_priv(session); ps->tunnel_sock = tunnel->sock; From patchwork Sat Apr 11 12:08:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228108 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8F59C2BB85 for ; Sat, 11 Apr 2020 12:10:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B8A9D214D8 for ; Sat, 11 Apr 2020 12:10:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607039; bh=MBnlgJCq/hpAc2MfdH+OpEUIPzed0yzlsJiZXfZFFzM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=rlq6SHanUq4z/VeXyodi5mdIMn9AP/DaDwiy85fpfoAg2FynyNoFUtpL3PEvZQbQv 5zC1SqMgj+eygJR0g+r6XECT4Z8R97LqORfFo7C+blrwlzaX5ZYLaYy6yDbsL/fLkW rkdhwVnYdnllYsLgEHtPP6pDLbaoQYBL8cth9aI4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726563AbgDKMKi (ORCPT ); Sat, 11 Apr 2020 08:10:38 -0400 Received: from mail.kernel.org ([198.145.29.99]:42212 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726091AbgDKMKh (ORCPT ); Sat, 11 Apr 2020 08:10:37 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6410B2137B; Sat, 11 Apr 2020 12:10:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607036; bh=MBnlgJCq/hpAc2MfdH+OpEUIPzed0yzlsJiZXfZFFzM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HRTaWqnV2ZYSJSX2LQC2ccAIAfpNwTNKPXPogdiL6/H5wtsV1ui6R0Kv9FvwuVwWa 4667NWDErwypgFPjY2Vr978PYL7WlsB8VsqfZ9BChxrAXDpP4LafYYnakE0OqyyrtC Xp3l425JIvgr/r0hFvmI45oxWzVFVC1/zENDvgWI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guillaume Nault , "David S. Miller" , Will Deacon Subject: [PATCH 4.4 11/29] l2tp: ensure sessions are freed after their PPPOL2TP socket Date: Sat, 11 Apr 2020 14:08:41 +0200 Message-Id: <20200411115409.631912991@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Guillaume Nault commit cdd10c9627496ad25c87ce6394e29752253c69d3 upstream. If l2tp_tunnel_delete() or l2tp_tunnel_closeall() deletes a session right after pppol2tp_release() orphaned its socket, then the 'sock' variable of the pppol2tp_session_close() callback is NULL. Yet the session is still used by pppol2tp_release(). Therefore we need to take an extra reference in any case, to prevent l2tp_tunnel_delete() or l2tp_tunnel_closeall() from freeing the session. Since the pppol2tp_session_close() callback is only set if the session is associated to a PPPOL2TP socket and that both l2tp_tunnel_delete() and l2tp_tunnel_closeall() hold the PPPOL2TP socket before calling pppol2tp_session_close(), we're sure that pppol2tp_session_close() and pppol2tp_session_destruct() are paired and called in the right order. So the reference taken by the former will be released by the later. Signed-off-by: Guillaume Nault Signed-off-by: David S. Miller Signed-off-by: Will Deacon Signed-off-by: Greg Kroah-Hartman --- net/l2tp/l2tp_ppp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -452,11 +452,11 @@ static void pppol2tp_session_close(struc BUG_ON(session->magic != L2TP_SESSION_MAGIC); - if (sock) { + if (sock) inet_shutdown(sock, SEND_SHUTDOWN); - /* Don't let the session go away before our socket does */ - l2tp_session_inc_refcount(session); - } + + /* Don't let the session go away before our socket does */ + l2tp_session_inc_refcount(session); } /* Really kill the session socket. (Called from sock_put() if From patchwork Sat Apr 11 12:08:43 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 227977 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A345EC2BBC7 for ; Sat, 11 Apr 2020 12:29:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7164220732 for ; Sat, 11 Apr 2020 12:29:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586608165; bh=5j496D+bx/hd6QloePd89dncUPC+IWOpQMJuEPOhULw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ca/ipq7x6gts8Tg5+aS1P4l/8S0Bys7OJrhAqxWkb793vzf6LxxIooedVdntRXbAJ vMAhvkX4aIbpn8O5n4Bdsg7ngxlVPfz26GMoP0sAs5YlDBKhobgv/sdj9qLrmDWAzI 14bf1YRW9aDkYiKmtAbpEdjkD756J00oFFvyjVCc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726819AbgDKMLC (ORCPT ); Sat, 11 Apr 2020 08:11:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:42850 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726810AbgDKMLB (ORCPT ); Sat, 11 Apr 2020 08:11:01 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C17FB20787; Sat, 11 Apr 2020 12:11:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607061; bh=5j496D+bx/hd6QloePd89dncUPC+IWOpQMJuEPOhULw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HOR6+QxSHk+fTFW+FeAJHeuuW9z2joissIx5E8iIHsJ8utlz+PmbB7c73o0s4bicl URPe3g+7iBbz75Z1a90wY+it3XZnHQzgeS7tmpjjq9xZc6IEjDMCm+RDB9shu/fsnE 2HM0cQhVdY+R4h78pCcC3MmA2Q5FhbxuxatlQaiA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Opasiak , Krzysztof Opasiak , Felipe Balbi , Nick Desaulniers , Nathan Chancellor , kbuild test robot Subject: [PATCH 4.4 13/29] usb: gadget: uac2: Drop unused device qualifier descriptor Date: Sat, 11 Apr 2020 14:08:43 +0200 Message-Id: <20200411115409.935129037@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Krzysztof Opasiak commit d4529f9be1d72919f75f76f31773c4e98d03ce6b upstream. This descriptor is never used. Currently device qualifier descriptor is generated by compossite code so no need to keep it in function file. Signed-off-by: Krzysztof Opasiak Signed-off-by: Krzysztof Opasiak Signed-off-by: Felipe Balbi Cc: Nick Desaulniers Cc: Nathan Chancellor Cc: kbuild test robot Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/function/f_uac2.c | 12 ------------ 1 file changed, 12 deletions(-) --- a/drivers/usb/gadget/function/f_uac2.c +++ b/drivers/usb/gadget/function/f_uac2.c @@ -598,18 +598,6 @@ static struct usb_gadget_strings *fn_str NULL, }; -static struct usb_qualifier_descriptor devqual_desc = { - .bLength = sizeof devqual_desc, - .bDescriptorType = USB_DT_DEVICE_QUALIFIER, - - .bcdUSB = cpu_to_le16(0x200), - .bDeviceClass = USB_CLASS_MISC, - .bDeviceSubClass = 0x02, - .bDeviceProtocol = 0x01, - .bNumConfigurations = 1, - .bRESERVED = 0, -}; - static struct usb_interface_assoc_descriptor iad_desc = { .bLength = sizeof iad_desc, .bDescriptorType = USB_DT_INTERFACE_ASSOCIATION, From patchwork Sat Apr 11 12:08:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 227980 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 94431C2BA2B for ; Sat, 11 Apr 2020 12:29:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6B4AB20732 for ; Sat, 11 Apr 2020 12:29:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586608154; bh=TPs/zfXxgu5n1ahCUyC/YvqGIa4uQRBW16J8baoC9fM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=PM7AjW7PkY9Pp3zJLCJ/qtVvXrxCAS6V9vHXIGTjV0HICiFwtZnqZRhX+TxvKIjWS 7otl98dq7ZcqwNBUGbtNSjushGenbSfaZSGybmnzQ1gHcWammK/daBaIAAGiOJTA1w hBJJTGcoH5gG+Zj+8F9ayLhaotibGxuU31J3LK1c= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726713AbgDKM3K (ORCPT ); Sat, 11 Apr 2020 08:29:10 -0400 Received: from mail.kernel.org ([198.145.29.99]:43478 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726945AbgDKMLZ (ORCPT ); Sat, 11 Apr 2020 08:11:25 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 033AA214D8; Sat, 11 Apr 2020 12:11:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607085; bh=TPs/zfXxgu5n1ahCUyC/YvqGIa4uQRBW16J8baoC9fM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RX/2iTbL6PzCNVjAcGHwARTN5Rr218HkQmOLh3FE6jan2h7j8IKpZYJqDtb/A+SQE xQ21c01+yGKIBO6g9TEpU7mKc+a2lgrgE+jpib6h9qpwXbRfo5bG0OD+TlcHQ107PN IT5dFzE+bLpJ8evKLL1dLBchTXl2atbbcNiLBJN0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Jordan , Eric Biggers , Herbert Xu , Steffen Klassert , linux-crypto@vger.kernel.org Subject: [PATCH 4.4 15/29] padata: always acquire cpu_hotplug_lock before pinst->lock Date: Sat, 11 Apr 2020 14:08:45 +0200 Message-Id: <20200411115410.319586680@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Daniel Jordan commit 38228e8848cd7dd86ccb90406af32de0cad24be3 upstream. lockdep complains when padata's paths to update cpumasks via CPU hotplug and sysfs are both taken: # echo 0 > /sys/devices/system/cpu/cpu1/online # echo ff > /sys/kernel/pcrypt/pencrypt/parallel_cpumask ====================================================== WARNING: possible circular locking dependency detected 5.4.0-rc8-padata-cpuhp-v3+ #1 Not tainted ------------------------------------------------------ bash/205 is trying to acquire lock: ffffffff8286bcd0 (cpu_hotplug_lock.rw_sem){++++}, at: padata_set_cpumask+0x2b/0x120 but task is already holding lock: ffff8880001abfa0 (&pinst->lock){+.+.}, at: padata_set_cpumask+0x26/0x120 which lock already depends on the new lock. padata doesn't take cpu_hotplug_lock and pinst->lock in a consistent order. Which should be first? CPU hotplug calls into padata with cpu_hotplug_lock already held, so it should have priority. Fixes: 6751fb3c0e0c ("padata: Use get_online_cpus/put_online_cpus") Signed-off-by: Daniel Jordan Cc: Eric Biggers Cc: Herbert Xu Cc: Steffen Klassert Cc: linux-crypto@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- kernel/padata.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/kernel/padata.c +++ b/kernel/padata.c @@ -640,8 +640,8 @@ int padata_set_cpumask(struct padata_ins struct cpumask *serial_mask, *parallel_mask; int err = -EINVAL; - mutex_lock(&pinst->lock); get_online_cpus(); + mutex_lock(&pinst->lock); switch (cpumask_type) { case PADATA_CPU_PARALLEL: @@ -659,8 +659,8 @@ int padata_set_cpumask(struct padata_ins err = __padata_set_cpumasks(pinst, parallel_mask, serial_mask); out: - put_online_cpus(); mutex_unlock(&pinst->lock); + put_online_cpus(); return err; } From patchwork Sat Apr 11 12:08:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 227981 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC9D4C2BBC7 for ; Sat, 11 Apr 2020 12:29:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C5F58206A1 for ; Sat, 11 Apr 2020 12:29:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586608149; bh=XfWmbngJg4IFQC3KppLZCh1786ZhpbZMns+PxUj0ehc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=0Xo73BYDMKE5oy3yb+p66Sf029jrjgV9QyHheFdUfDpqUSUhWzpD7kTmMGK1Ou8uy Wg+Ei3kZD+svNgzZ6Ja3QNEl4NaMaRBLKdAQ6o1sl+y1HUsKLluy6e1PHe1GUjejl1 Gwed+0HeZxFb/bM4W+s6/TbrxUOjjfOfemjdCJU4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726965AbgDKML3 (ORCPT ); Sat, 11 Apr 2020 08:11:29 -0400 Received: from mail.kernel.org ([198.145.29.99]:43526 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726964AbgDKML2 (ORCPT ); Sat, 11 Apr 2020 08:11:28 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6821820787; Sat, 11 Apr 2020 12:11:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607087; bh=XfWmbngJg4IFQC3KppLZCh1786ZhpbZMns+PxUj0ehc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=djG6MRzeGdF9K58DsRJmK1x65C5zrpRhkztiN+YJ0J76R0USHMm9iE9C1d3wg8+2V edS2LY3oxuXUYJX7jbR0QMNfJmU0EGAGwMEtIKbHnwgBcsJ6QVIpAWJMUe5fOCGkMd ZS010T9PfFg5pUc9r+W5WJvMQN9ttsY9FiDgznL8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Entropy Moe <3ntr0py1337@gmail.com>, syzbot+b055b1a6b2b958707a21@syzkaller.appspotmail.com, Randy Dunlap , Andrew Morton , Lee Schermerhorn , Linus Torvalds , Guenter Roeck Subject: [PATCH 4.4 16/29] mm: mempolicy: require at least one nodeid for MPOL_PREFERRED Date: Sat, 11 Apr 2020 14:08:46 +0200 Message-Id: <20200411115410.585657222@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Randy Dunlap commit aa9f7d5172fac9bf1f09e678c35e287a40a7b7dd upstream. Using an empty (malformed) nodelist that is not caught during mount option parsing leads to a stack-out-of-bounds access. The option string that was used was: "mpol=prefer:,". However, MPOL_PREFERRED requires a single node number, which is not being provided here. Add a check that 'nodes' is not empty after parsing for MPOL_PREFERRED's nodeid. Fixes: 095f1fc4ebf3 ("mempolicy: rework shmem mpol parsing and display") Reported-by: Entropy Moe <3ntr0py1337@gmail.com> Reported-by: syzbot+b055b1a6b2b958707a21@syzkaller.appspotmail.com Signed-off-by: Randy Dunlap Signed-off-by: Andrew Morton Tested-by: syzbot+b055b1a6b2b958707a21@syzkaller.appspotmail.com Cc: Lee Schermerhorn Link: http://lkml.kernel.org/r/89526377-7eb6-b662-e1d8-4430928abde9@infradead.org Signed-off-by: Linus Torvalds Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman --- mm/mempolicy.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -2725,7 +2725,9 @@ int mpol_parse_str(char *str, struct mem switch (mode) { case MPOL_PREFERRED: /* - * Insist on a nodelist of one node only + * Insist on a nodelist of one node only, although later + * we use first_node(nodes) to grab a single node, so here + * nodelist (or nodes) cannot be empty. */ if (nodelist) { char *rest = nodelist; @@ -2733,6 +2735,8 @@ int mpol_parse_str(char *str, struct mem rest++; if (*rest) goto out; + if (nodes_empty(nodes)) + goto out; } break; case MPOL_INTERLEAVE: From patchwork Sat Apr 11 12:08:49 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228103 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 902CEC2BBC7 for ; Sat, 11 Apr 2020 12:11:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 653FA21744 for ; Sat, 11 Apr 2020 12:11:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607096; bh=n9rmmBrENhy6TDpT9Axt8H10o6yNclgku19ixyVaLpM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=SaY9k/fTgZe2phTc2am+1AED3vhJlDkR0m/icAbtNdo04pGLTD3l87TbvwNhpmNiS folyPu2d9AcrrUpCbtuJ+JgbzsJ4x8kqrKxa7DH7md8GMvdM4dmTdxRsoB24dbVWes dXU/2ckBo2/e7wMVA7lSkxGNo9IOhP/oGbBhmP0U= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727001AbgDKMLf (ORCPT ); Sat, 11 Apr 2020 08:11:35 -0400 Received: from mail.kernel.org ([198.145.29.99]:43744 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726995AbgDKMLe (ORCPT ); Sat, 11 Apr 2020 08:11:34 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A029421D79; Sat, 11 Apr 2020 12:11:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607095; bh=n9rmmBrENhy6TDpT9Axt8H10o6yNclgku19ixyVaLpM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wWpTJG5rONBIpixT0aLmnilQ4l881bMFlulp2j3A+Utk944D7jlvOB4V2vo3WUHes yf/dMDqTauICqcqYDLwQjYp93yqz6lGlxMvSL6ujT6fg6RNyPk53wJHCX2dw8mraLs f28JoHF1c0HHQUD7XQYeQRrrz2DiOZdIUNa4GcnM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Jason A. Donenfeld" , Theodore Tso Subject: [PATCH 4.4 19/29] random: always use batched entropy for get_random_u{32, 64} Date: Sat, 11 Apr 2020 14:08:49 +0200 Message-Id: <20200411115411.092282795@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jason A. Donenfeld commit 69efea712f5b0489e67d07565aad5c94e09a3e52 upstream. It turns out that RDRAND is pretty slow. Comparing these two constructions: for (i = 0; i < CHACHA_BLOCK_SIZE; i += sizeof(ret)) arch_get_random_long(&ret); and long buf[CHACHA_BLOCK_SIZE / sizeof(long)]; extract_crng((u8 *)buf); it amortizes out to 352 cycles per long for the top one and 107 cycles per long for the bottom one, on Coffee Lake Refresh, Intel Core i9-9880H. And importantly, the top one has the drawback of not benefiting from the real rng, whereas the bottom one has all the nice benefits of using our own chacha rng. As get_random_u{32,64} gets used in more places (perhaps beyond what it was originally intended for when it was introduced as get_random_{int,long} back in the md5 monstrosity era), it seems like it might be a good thing to strengthen its posture a tiny bit. Doing this should only be stronger and not any weaker because that pool is already initialized with a bunch of rdrand data (when available). This way, we get the benefits of the hardware rng as well as our own rng. Another benefit of this is that we no longer hit pitfalls of the recent stream of AMD bugs in RDRAND. One often used code pattern for various things is: do { val = get_random_u32(); } while (hash_table_contains_key(val)); That recent AMD bug rendered that pattern useless, whereas we're really very certain that chacha20 output will give pretty distributed numbers, no matter what. So, this simplification seems better both from a security perspective and from a performance perspective. Signed-off-by: Jason A. Donenfeld Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20200221201037.30231-1-Jason@zx2c4.com Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman --- drivers/char/random.c | 6 ------ 1 file changed, 6 deletions(-) --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -1824,9 +1824,6 @@ unsigned int get_random_int(void) __u32 *hash; unsigned int ret; - if (arch_get_random_int(&ret)) - return ret; - hash = get_cpu_var(get_random_int_hash); hash[0] += current->pid + jiffies + random_get_entropy(); @@ -1846,9 +1843,6 @@ unsigned long get_random_long(void) __u32 *hash; unsigned long ret; - if (arch_get_random_long(&ret)) - return ret; - hash = get_cpu_var(get_random_int_hash); hash[0] += current->pid + jiffies + random_get_entropy(); From patchwork Sat Apr 11 12:08:51 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 227982 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3EB3BC2BA2B for ; Sat, 11 Apr 2020 12:29:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1861720644 for ; Sat, 11 Apr 2020 12:29:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586608143; bh=GqvXIaxjuuMVkWbvgmnDJJlqisLZZymgyjdUpE30ZoQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=LkCflHZQ5qcFtmenKMXxNyh5YKLk2tzNOVepjINpl1OPMz1JbsgbS/9aQWwOztR12 T4vv/fdPpH3AhcvymHocgNNDVcfCEGluH4qGZbMjDRT4WhrvHFvaFJy3V5uE0KjbyN a0/1h6d0WW4AY6kiSkiIHY4HKns4OpCh4DDypNyw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726936AbgDKM26 (ORCPT ); Sat, 11 Apr 2020 08:28:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:43828 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727018AbgDKMLl (ORCPT ); Sat, 11 Apr 2020 08:11:41 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 72A3A21744; Sat, 11 Apr 2020 12:11:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607099; bh=GqvXIaxjuuMVkWbvgmnDJJlqisLZZymgyjdUpE30ZoQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q6l+u8KzNhNmkrKe/Aezuj9XLGhrSp55ELTnKaUVXe4+eDFybXxb1VcfgrwLP/8sH 8qPWWjAwaBG/3AWNcQdyEaix5ImHkxp6IRaLp9K4yfcuxAKwt5vi+bO9Bqi91p6Kzw 4tkXXzKD/j4H9kZYy6byAsJrDnYzWfjeV9z6qFoc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Gustavo A. R. Silva" , Hans de Goede , Sebastian Reichel , "Nobuhiro Iwamatsu (CIP)" Subject: [PATCH 4.4 21/29] power: supply: axp288_charger: Fix unchecked return value Date: Sat, 11 Apr 2020 14:08:51 +0200 Message-Id: <20200411115411.408033079@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Gustavo A. R. Silva commit c3422ad5f84a66739ec6a37251ca27638c85b6be upstream. Currently there is no check on platform_get_irq() return value in case it fails, hence never actually reporting any errors and causing unexpected behavior when using such value as argument for function regmap_irq_get_virq(). Fix this by adding a proper check, a message reporting any errors and returning *pirq* Addresses-Coverity-ID: 1443940 ("Improper use of negative value") Fixes: 843735b788a4 ("power: axp288_charger: axp288 charger driver") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Reviewed-by: Hans de Goede Signed-off-by: Sebastian Reichel Signed-off-by: Greg Kroah-Hartman Signed-off-by: Nobuhiro Iwamatsu (CIP) --- drivers/power/axp288_charger.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/power/axp288_charger.c +++ b/drivers/power/axp288_charger.c @@ -883,6 +883,10 @@ static int axp288_charger_probe(struct p /* Register charger interrupts */ for (i = 0; i < CHRG_INTR_END; i++) { pirq = platform_get_irq(info->pdev, i); + if (pirq < 0) { + dev_err(&pdev->dev, "Failed to get IRQ: %d\n", pirq); + return pirq; + } info->irq[i] = regmap_irq_get_virq(info->regmap_irqc, pirq); if (info->irq[i] < 0) { dev_warn(&info->pdev->dev, From patchwork Sat Apr 11 12:08:52 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 227978 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46B59C2BBC7 for ; Sat, 11 Apr 2020 12:29:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1680920732 for ; Sat, 11 Apr 2020 12:29:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586608162; bh=DX7Y/bTjcDckIPhehW9XWnDnMdMo6W/bQggp6rDI8+U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=rp1+1/JunlfZPRsUKotVEgi17ayIv6Ny2PN5+9xKCCMuus53xw/fAGVpzT7N0OpGE OY2Iqao0rxj3HuYQ0mp0MEWfLBqBJJz54+4sx5+PIslfRhUCXhknBdYAu5/wFmJaVp YKtRWHTY+viO82c5uNcJOFnjAmErkG8SFoayZO/0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726845AbgDKMLF (ORCPT ); Sat, 11 Apr 2020 08:11:05 -0400 Received: from mail.kernel.org ([198.145.29.99]:42920 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726834AbgDKMLE (ORCPT ); Sat, 11 Apr 2020 08:11:04 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3C50521655; Sat, 11 Apr 2020 12:11:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607063; bh=DX7Y/bTjcDckIPhehW9XWnDnMdMo6W/bQggp6rDI8+U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0/Rb44oZRiop+ksQVKq5NYzYSSolZnNm63xeD+zlsGYK+kkE9E6iU29yKV2oSUrxS 5TSh+aPzvr8CYa6wDqM5nkJO1ux/TslUBMlx5FbMWXbA0jE7sGfR0RiofLT2U0NwsM DVgHDESLnEMihvLXtzyNJ9w+yDhEB2yOE0pnfYG0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ben Hutchings , Ross Lagerwall , Juergen Gross , "David S. Miller" , "Nobuhiro Iwamatsu (CIP)" Subject: [PATCH 4.4 22/29] xen-netfront: Fix mismatched rtnl_unlock Date: Sat, 11 Apr 2020 14:08:52 +0200 Message-Id: <20200411115411.523635527@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Ross Lagerwall commit cb257783c2927b73614b20f915a91ff78aa6f3e8 upstream. Fixes: f599c64fdf7d ("xen-netfront: Fix race between device setup and open") Reported-by: Ben Hutchings Signed-off-by: Ross Lagerwall Reviewed-by: Juergen Gross Signed-off-by: David S. Miller Signed-off-by: Nobuhiro Iwamatsu (CIP) Signed-off-by: Greg Kroah-Hartman --- drivers/net/xen-netfront.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -1835,7 +1835,7 @@ static int talk_to_netback(struct xenbus err = xen_net_read_mac(dev, info->netdev->dev_addr); if (err) { xenbus_dev_fatal(dev, err, "parsing %s/mac", dev->nodename); - goto out; + goto out_unlocked; } rtnl_lock(); @@ -1950,6 +1950,7 @@ abort_transaction_no_dev_fatal: xennet_destroy_queues(info); out: rtnl_unlock(); +out_unlocked: device_unregister(&dev->dev); return err; } From patchwork Sat Apr 11 12:08:55 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228105 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6785DC2BA2B for ; Sat, 11 Apr 2020 12:11:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4285920787 for ; Sat, 11 Apr 2020 12:11:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607075; bh=aDGK5rQcXBA9uGsDFP25cA3dCh5xzG68JG0usjQxYLY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=rWSJ0zchmz5k3Ow5hb8tjs4SFgYLWYd+cOmSPGvl6rz0xzQBBN4rgxHs+H9WG7mgc /Lspuo2FegrO0gfLi3G3ZDPpoeXgp4/sS/XHX+0T2zZcVUwbbVXD9e/2u8PtSfx9s6 kfZERbOtA2xZWeTY7FEuMk4K0ZUIinGjB9yFmvNM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726885AbgDKMLN (ORCPT ); Sat, 11 Apr 2020 08:11:13 -0400 Received: from mail.kernel.org ([198.145.29.99]:43098 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726872AbgDKMLM (ORCPT ); Sat, 11 Apr 2020 08:11:12 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 823DE20787; Sat, 11 Apr 2020 12:11:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607071; bh=aDGK5rQcXBA9uGsDFP25cA3dCh5xzG68JG0usjQxYLY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dbJpzsDqQkUndtEcFHPJn+WL7Xp1QktLIebKKP2lxpMWEcieKTcODh3NEsVyaUOaq Swxuvh2TUzLU5vCER/FgX5EcZiG4oZJlAB3AFTTEYsReqDTsNuQYxJpQqUWfhd74zi CU32y+qjWhVylku97JA+H+x1I7P97O75MGy1NewE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mike Marciniszyn , Kaike Wan , Dennis Dalessandro , Jason Gunthorpe Subject: [PATCH 4.4 25/29] IB/hfi1: Call kobject_put() when kobject_init_and_add() fails Date: Sat, 11 Apr 2020 14:08:55 +0200 Message-Id: <20200411115412.036558577@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Kaike Wan commit dfb5394f804ed4fcea1fc925be275a38d66712ab upstream. When kobject_init_and_add() returns an error in the function hfi1_create_port_files(), the function kobject_put() is not called for the corresponding kobject, which potentially leads to memory leak. This patch fixes the issue by calling kobject_put() even if kobject_init_and_add() fails. Cc: Link: https://lore.kernel.org/r/20200326163813.21129.44280.stgit@awfm-01.aw.intel.com Reviewed-by: Mike Marciniszyn Signed-off-by: Kaike Wan Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rdma/hfi1/sysfs.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) --- a/drivers/staging/rdma/hfi1/sysfs.c +++ b/drivers/staging/rdma/hfi1/sysfs.c @@ -620,7 +620,11 @@ int hfi1_create_port_files(struct ib_dev dd_dev_err(dd, "Skipping sc2vl sysfs info, (err %d) port %u\n", ret, port_num); - goto bail; + /* + * Based on the documentation for kobject_init_and_add(), the + * caller should call kobject_put even if this call fails. + */ + goto bail_sc2vl; } kobject_uevent(&ppd->sc2vl_kobj, KOBJ_ADD); @@ -630,7 +634,7 @@ int hfi1_create_port_files(struct ib_dev dd_dev_err(dd, "Skipping sl2sc sysfs info, (err %d) port %u\n", ret, port_num); - goto bail_sc2vl; + goto bail_sl2sc; } kobject_uevent(&ppd->sl2sc_kobj, KOBJ_ADD); @@ -640,7 +644,7 @@ int hfi1_create_port_files(struct ib_dev dd_dev_err(dd, "Skipping vl2mtu sysfs info, (err %d) port %u\n", ret, port_num); - goto bail_sl2sc; + goto bail_vl2mtu; } kobject_uevent(&ppd->vl2mtu_kobj, KOBJ_ADD); @@ -651,7 +655,7 @@ int hfi1_create_port_files(struct ib_dev dd_dev_err(dd, "Skipping Congestion Control sysfs info, (err %d) port %u\n", ret, port_num); - goto bail_vl2mtu; + goto bail_cc; } kobject_uevent(&ppd->pport_cc_kobj, KOBJ_ADD); @@ -691,7 +695,6 @@ bail_sl2sc: kobject_put(&ppd->sl2sc_kobj); bail_sc2vl: kobject_put(&ppd->sc2vl_kobj); -bail: return ret; } From patchwork Sat Apr 11 12:08:56 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 227979 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EFE56C2BA2B for ; Sat, 11 Apr 2020 12:29:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C438E20732 for ; Sat, 11 Apr 2020 12:29:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586608159; bh=Jttk726tXOUzFy4Zy+whTq1rsrkJW0mjXnvp9/CaKi0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=q9BHroVjqpP+yNCvnMDFL/hdzx2KJXJ+A0HwAIfn7Epr1d4dN5WXEm/blqLfAV/66 OnY559Kt4vH6LdxcYDcEv5WfXXaxKvudf2x6HNj/m3U0QQ/0WAUUWolZAn1X9qvGQT a7roC+ETFscAKkyi8ACjkPqcfwuGZUxhsMejpfwQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726945AbgDKM3P (ORCPT ); Sat, 11 Apr 2020 08:29:15 -0400 Received: from mail.kernel.org ([198.145.29.99]:43196 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726892AbgDKMLO (ORCPT ); Sat, 11 Apr 2020 08:11:14 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E2CC6215A4; Sat, 11 Apr 2020 12:11:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607073; bh=Jttk726tXOUzFy4Zy+whTq1rsrkJW0mjXnvp9/CaKi0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MmsAfVC9yREbaPCFETivkAC1UAjVpy/+lGXX/BjMMmSjzB4Hwj8LGLfVNQK0og01W g7GAzviEAVG34E8+OidQuVPRSTyZuxLXozHwxmZ4/yBCAwqIc6UMxJ52Yp8vbSiIw/ aEnY69dMth4WIBAa3m33T5X7MQGHV3VehAoxHmE8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+4496e82090657320efc6@syzkaller.appspotmail.com, Qiujun Huang , Hillf Danton , Marcel Holtmann Subject: [PATCH 4.4 26/29] Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl Date: Sat, 11 Apr 2020 14:08:56 +0200 Message-Id: <20200411115412.206046292@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Qiujun Huang commit 71811cac8532b2387b3414f7cd8fe9e497482864 upstream. Needn't call 'rfcomm_dlc_put' here, because 'rfcomm_dlc_exists' didn't increase dlc->refcnt. Reported-by: syzbot+4496e82090657320efc6@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang Suggested-by: Hillf Danton Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman --- net/bluetooth/rfcomm/tty.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) --- a/net/bluetooth/rfcomm/tty.c +++ b/net/bluetooth/rfcomm/tty.c @@ -413,10 +413,8 @@ static int __rfcomm_create_dev(struct so dlc = rfcomm_dlc_exists(&req.src, &req.dst, req.channel); if (IS_ERR(dlc)) return PTR_ERR(dlc); - else if (dlc) { - rfcomm_dlc_put(dlc); + if (dlc) return -EBUSY; - } dlc = rfcomm_dlc_alloc(GFP_KERNEL); if (!dlc) return -ENOMEM; From patchwork Sat Apr 11 12:08:59 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228104 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5EF5DC2BA2B for ; Sat, 11 Apr 2020 12:11:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 389EB215A4 for ; Sat, 11 Apr 2020 12:11:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607085; bh=MesyVyOKCevRf+2TnmIg4GCFkNmuAs9DzQo/LPs8jfg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=WkM4q68fA4e0l/YRYyimlOzOV8JcvwN+VIn/+FvZN4qikB9HodlDQFzQNapf5lmcI qg5bW0CyYqBJJR/gvUk/iDTsXYivdL6mrTK8XzD0A4gHFwf0s1CpzcU+2wDDrAI1m2 fhFTg4io7oses8kbVo8Li86xHNsjMzQgjRHfTIRA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726915AbgDKMLX (ORCPT ); Sat, 11 Apr 2020 08:11:23 -0400 Received: from mail.kernel.org ([198.145.29.99]:43328 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726926AbgDKMLV (ORCPT ); Sat, 11 Apr 2020 08:11:21 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3346E20787; Sat, 11 Apr 2020 12:11:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586607080; bh=MesyVyOKCevRf+2TnmIg4GCFkNmuAs9DzQo/LPs8jfg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tlxn/cIGHJwETNGG3tF4Nflkdvxs7BZU08TIog3246WfnsMgpkaASgrRzCWZ54A+c hqVWJ84XbInLtwUHdBsIBL0lGwxuGFzW0ulZP+0/3W78Mh1r3xohRfu6vDN0pKoi3x 3o2J86VbfPmdqGogZ6kry2gOdcG3FzSfHcM6HfnY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hans Verkuil , Lyude Paul , Alex Deucher , Lee Jones Subject: [PATCH 4.4 29/29] drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read() Date: Sat, 11 Apr 2020 14:08:59 +0200 Message-Id: <20200411115412.719714953@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200411115407.651296755@linuxfoundation.org> References: <20200411115407.651296755@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Hans Verkuil commit a4c30a4861c54af78c4eb8b7855524c1a96d9f80 upstream. When parsing the reply of a DP_REMOTE_DPCD_READ DPCD command the result is wrong due to a missing idx increment. This was never noticed since DP_REMOTE_DPCD_READ is currently not used, but if you enable it, then it is all wrong. Signed-off-by: Hans Verkuil Reviewed-by: Lyude Paul Acked-by: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/e72ddac2-1dc0-100a-d816-9ac98ac009dd@xs4all.nl Signed-off-by: Lee Jones Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/drm_dp_mst_topology.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -431,6 +431,7 @@ static bool drm_dp_sideband_parse_remote if (idx > raw->curlen) goto fail_len; repmsg->u.remote_dpcd_read_ack.num_bytes = raw->msg[idx]; + idx++; if (idx > raw->curlen) goto fail_len;