- Kernel - mailweb.openeuler.org

[PATCH] netfilter: nat: check the bounds of nf_nat_l3protos and nf_nat_l4protos
by Yang Yingliang 29 Jul '20

29 Jul '20

hulk inclusion category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- famliy can be passed from user space and will be out of range of nf_nat_l3protos or nf_nat_l4protos, so we need check the family when call __nf_nat_l3proto_find() or __nf_nat_l4proto_find(). nfnetlink_parse_nat_setup() need return EAGAIN, if __nf_nat_l3proto_find() returns null, so we return a error number to distinguish this case. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 4 +++- net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 4 +++- net/netfilter/nf_nat_core.c | 21 ++++++++++++++++++++- 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c index 6115bf1ff6f0..52e3f9c7bc69 100644 --- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c +++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c @@ -218,6 +218,8 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb, return 1; l4proto = __nf_nat_l4proto_find(NFPROTO_IPV4, inside->ip.protocol); + if (!l4proto) + return 1; if (!nf_nat_ipv4_manip_pkt(skb, hdrlen + sizeof(inside->icmp), l4proto, &ct->tuplehash[!dir].tuple, !manip)) return 0; @@ -234,7 +236,7 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb, /* Change outer to look like the reply to an incoming packet */ nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple); l4proto = __nf_nat_l4proto_find(NFPROTO_IPV4, 0); - if (!nf_nat_ipv4_manip_pkt(skb, 0, l4proto, &target, manip)) + if (l4proto && !nf_nat_ipv4_manip_pkt(skb, 0, l4proto, &target, manip)) return 0; return 1; diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c index ca6d38698b1a..bf25263b2dcd 100644 --- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c @@ -228,6 +228,8 @@ int nf_nat_icmpv6_reply_translation(struct sk_buff *skb, return 1; l4proto = __nf_nat_l4proto_find(NFPROTO_IPV6, inside->ip6.nexthdr); + if (!l4proto) + return 1; if (!nf_nat_ipv6_manip_pkt(skb, hdrlen + sizeof(inside->icmp6), l4proto, &ct->tuplehash[!dir].tuple, !manip)) return 0; @@ -245,7 +247,7 @@ int nf_nat_icmpv6_reply_translation(struct sk_buff *skb, nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple); l4proto = __nf_nat_l4proto_find(NFPROTO_IPV6, IPPROTO_ICMPV6); - if (!nf_nat_ipv6_manip_pkt(skb, 0, l4proto, &target, manip)) + if (l4proto && !nf_nat_ipv6_manip_pkt(skb, 0, l4proto, &target, manip)) return 0; return 1; diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c index 2268b10a9dcf..f1576e46ee2c 100644 --- a/net/netfilter/nf_nat_core.c +++ b/net/netfilter/nf_nat_core.c @@ -64,12 +64,18 @@ struct nat_net { inline const struct nf_nat_l3proto * __nf_nat_l3proto_find(u8 family) { + if (unlikely(family >= NFPROTO_NUMPROTO)) + return ERR_PTR(-EPROTONOSUPPORT); + return rcu_dereference(nf_nat_l3protos[family]); } inline const struct nf_nat_l4proto * __nf_nat_l4proto_find(u8 family, u8 protonum) { + if (unlikely(family >= NFPROTO_NUMPROTO || nf_nat_l4protos[family] == NULL)) + return NULL; + return rcu_dereference(nf_nat_l4protos[family][protonum]); } EXPORT_SYMBOL_GPL(__nf_nat_l4proto_find); @@ -90,7 +96,7 @@ static void __nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl) family = nf_ct_l3num(ct); l3proto = __nf_nat_l3proto_find(family); - if (l3proto == NULL) + if (IS_ERR_OR_NULL(l3proto)) return; dir = CTINFO2DIR(ctinfo); @@ -333,8 +339,12 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple, rcu_read_lock(); l3proto = __nf_nat_l3proto_find(orig_tuple->src.l3num); + if (IS_ERR_OR_NULL(l3proto)) + goto out; l4proto = __nf_nat_l4proto_find(orig_tuple->src.l3num, orig_tuple->dst.protonum); + if (!l4proto) + goto out; /* 1) If this srcip/proto/src-proto-part is currently mapped, * and that same mapping gives a unique tuple within the given @@ -509,8 +519,12 @@ static unsigned int nf_nat_manip_pkt(struct sk_buff *skb, struct nf_conn *ct, nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple); l3proto = __nf_nat_l3proto_find(target.src.l3num); + if (IS_ERR_OR_NULL(l3proto)) + return NF_DROP; l4proto = __nf_nat_l4proto_find(target.src.l3num, target.dst.protonum); + if (!l4proto) + return NF_DROP; if (!l3proto->manip_pkt(skb, 0, l4proto, &target, mtype)) return NF_DROP; @@ -816,6 +830,9 @@ static int nfnetlink_parse_nat_proto(struct nlattr *attr, return err; l4proto = __nf_nat_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct)); + if (!l4proto) + return -EPROTONOSUPPORT; + if (l4proto->nlattr_to_range) err = l4proto->nlattr_to_range(tb, range); @@ -876,6 +893,8 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct, l3proto = __nf_nat_l3proto_find(nf_ct_l3num(ct)); if (l3proto == NULL) return -EAGAIN; + if (IS_ERR(l3proto)) + return PTR_ERR(l3proto); /* No NAT information has been passed, allocate the null-binding */ if (attr == NULL) -- 2.25.1

1 0

[PATCH 1/6] net/hinic: Delete unused functions and macro definitions in ossl
by Yang Yingliang 29 Jul '20

29 Jul '20

From: Chiqijun <chiqijun(a)huawei.com> driver inclusion category: bugfix bugzilla: 4472 ----------------------------------------------------------------------- Delete unused functions and macro definitions in ossl. Signed-off-by: Chiqijun <chiqijun(a)huawei.com> Reviewed-by: Zengweiliang <zengweiliang.zengweiliang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/huawei/hinic/ossl_knl.h | 16 -- .../ethernet/huawei/hinic/ossl_knl_linux.c | 85 ------ .../ethernet/huawei/hinic/ossl_knl_linux.h | 255 ------------------ .../net/ethernet/huawei/hinic/ossl_types.h | 41 --- 4 files changed, 397 deletions(-) delete mode 100644 drivers/net/ethernet/huawei/hinic/ossl_types.h diff --git a/drivers/net/ethernet/huawei/hinic/ossl_knl.h b/drivers/net/ethernet/huawei/hinic/ossl_knl.h index 7f19deba7d4c..1dae5ca63d04 100644 --- a/drivers/net/ethernet/huawei/hinic/ossl_knl.h +++ b/drivers/net/ethernet/huawei/hinic/ossl_knl.h @@ -18,22 +18,6 @@ #include "ossl_knl_linux.h" -#if defined(__WIN__) || defined(__VMWARE__) -#define __WIN_OR_VMWARE__ -#endif - -#if defined(__WIN__) || defined(__VMWARE__) || defined(__UEFI__) -#define __WIN_OR_VMWARE_OR_UEFI__ -#endif - -#if (defined(__WIN__) || defined(__VMWARE__)) && !defined(__HIFC__) -#define __WIN_OR_VMWARE_AND_NONHIFC__ -#endif - -#if defined(__WIN__) || defined(__UEFI__) -#define __WIN_OR_UEFI__ -#endif - #define sdk_err(dev, format, ...) \ dev_err(dev, "[COMM]"format, ##__VA_ARGS__) #define sdk_warn(dev, format, ...) \ diff --git a/drivers/net/ethernet/huawei/hinic/ossl_knl_linux.c b/drivers/net/ethernet/huawei/hinic/ossl_knl_linux.c index 798faa6f401d..daed2eca32c1 100644 --- a/drivers/net/ethernet/huawei/hinic/ossl_knl_linux.c +++ b/drivers/net/ethernet/huawei/hinic/ossl_knl_linux.c @@ -17,91 +17,6 @@ #include "ossl_knl_linux.h" -#define OSSL_MINUTE_BASE (60) - -sdk_file *file_creat(const char *file_name) -{ - return filp_open(file_name, O_CREAT | O_RDWR | O_APPEND, 0); -} - -sdk_file *file_open(const char *file_name) -{ - return filp_open(file_name, O_RDONLY, 0); -} - -void file_close(sdk_file *file_handle) -{ - (void)filp_close(file_handle, NULL); -} - -u32 get_file_size(sdk_file *file_handle) -{ - struct inode *file_inode; - - file_inode = file_handle->f_inode; - - return (u32)(file_inode->i_size); -} - -void set_file_position(sdk_file *file_handle, u32 position) -{ - file_handle->f_pos = position; -} - -int file_read(sdk_file *file_handle, char *log_buffer, - u32 rd_length, u32 *file_pos) -{ - return (int)file_handle->f_op->read(file_handle, log_buffer, - rd_length, &file_handle->f_pos); -} - -u32 file_write(sdk_file *file_handle, char *log_buffer, u32 wr_length) -{ - return (u32)file_handle->f_op->write(file_handle, log_buffer, - wr_length, &file_handle->f_pos); -} - -static int _linux_thread_func(void *thread) -{ - struct sdk_thread_info *info = (struct sdk_thread_info *)thread; - - while (!kthread_should_stop()) - info->thread_fn(info->data); - - return 0; -} - -int creat_thread(struct sdk_thread_info *thread_info) -{ - thread_info->thread_obj = kthread_run(_linux_thread_func, - thread_info, thread_info->name); - if (!thread_info->thread_obj) - return -EFAULT; - - return 0; -} - -void stop_thread(struct sdk_thread_info *thread_info) -{ - if (thread_info->thread_obj) - (void)kthread_stop(thread_info->thread_obj); -} - -void utctime_to_localtime(u64 utctime, u64 *localtime) -{ - *localtime = utctime - sys_tz.tz_minuteswest * OSSL_MINUTE_BASE; -} - -#ifndef HAVE_TIMER_SETUP -void initialize_timer(void *adapter_hdl, struct timer_list *timer) -{ - if (!adapter_hdl || !timer) - return; - - init_timer(timer); -} -#endif - void add_to_timer(struct timer_list *timer, long period) { if (!timer) diff --git a/drivers/net/ethernet/huawei/hinic/ossl_knl_linux.h b/drivers/net/ethernet/huawei/hinic/ossl_knl_linux.h index f99e1dbf3fda..dd5d0fc949d7 100644 --- a/drivers/net/ethernet/huawei/hinic/ossl_knl_linux.h +++ b/drivers/net/ethernet/huawei/hinic/ossl_knl_linux.h @@ -29,16 +29,6 @@ #include <linux/udp.h> #include <linux/highmem.h> -/* UTS_RELEASE is in a different header starting in kernel 2.6.18 */ -#ifndef UTS_RELEASE -/* utsrelease.h changed locations in 2.6.33 */ -#include <generated/utsrelease.h> -#endif - -#ifndef NETIF_F_SCTP_CSUM -#define NETIF_F_SCTP_CSUM 0 -#endif - #ifndef __GFP_COLD #define __GFP_COLD 0 #endif @@ -74,99 +64,15 @@ #define ADVERTISED_25000baseCR_Full 0 #endif -#ifndef ETHTOOL_GLINKSETTINGS -enum ethtool_link_mode_bit_indices { - ETHTOOL_LINK_MODE_1000baseKX_Full_BIT = 17, - ETHTOOL_LINK_MODE_10000baseKR_Full_BIT = 19, - ETHTOOL_LINK_MODE_40000baseKR4_Full_BIT = 23, - ETHTOOL_LINK_MODE_40000baseCR4_Full_BIT = 24, - ETHTOOL_LINK_MODE_25000baseCR_Full_BIT = 31, - ETHTOOL_LINK_MODE_25000baseKR_Full_BIT = 32, - ETHTOOL_LINK_MODE_100000baseKR4_Full_BIT = 36, - ETHTOOL_LINK_MODE_100000baseCR4_Full_BIT = 38, -}; -#endif - #ifndef RHEL_RELEASE_VERSION #define RHEL_RELEASE_VERSION(a, b) (((a) << 8) + (b)) #endif -#ifndef AX_RELEASE_VERSION -#define AX_RELEASE_VERSION(a, b) (((a) << 8) + (b)) -#endif - -#ifndef AX_RELEASE_CODE -#define AX_RELEASE_CODE 0 -#endif - -#if (AX_RELEASE_CODE && AX_RELEASE_CODE == AX_RELEASE_VERSION(3, 0)) -#define RHEL_RELEASE_CODE RHEL_RELEASE_VERSION(5, 0) -#elif (AX_RELEASE_CODE && AX_RELEASE_CODE == AX_RELEASE_VERSION(3, 1)) -#define RHEL_RELEASE_CODE RHEL_RELEASE_VERSION(5, 1) -#elif (AX_RELEASE_CODE && AX_RELEASE_CODE == AX_RELEASE_VERSION(3, 2)) -#define RHEL_RELEASE_CODE RHEL_RELEASE_VERSION(5, 3) -#endif #ifndef RHEL_RELEASE_CODE /* NOTE: RHEL_RELEASE_* introduced in RHEL4.5. */ #define RHEL_RELEASE_CODE 0 #endif -/* RHEL 7 didn't backport the parameter change in - * create_singlethread_workqueue. - * If/when RH corrects this we will want to tighten up the version check. - */ -#if (RHEL_RELEASE_CODE && RHEL_RELEASE_CODE >= RHEL_RELEASE_VERSION(7, 0)) -#undef create_singlethread_workqueue -#define create_singlethread_workqueue(name) \ - alloc_ordered_workqueue("%s", WQ_MEM_RECLAIM, name) -#endif - -/* Ubuntu Release ABI is the 4th digit of their kernel version. You can find - * it in /usr/src/linux/$(uname -r)/include/generated/utsrelease.h for new - * enough versions of Ubuntu. Otherwise you can simply see it in the output of - * uname as the 4th digit of the kernel. The UTS_UBUNTU_RELEASE_ABI is not in - * the linux-source package, but in the linux-headers package. It begins to - * appear in later releases of 14.04 and 14.10. - * - * Ex: - * <Ubuntu 14.04.1> - * $uname -r - * 3.13.0-45-generic - * ABI is 45 - * - * <Ubuntu 14.10> - * $uname -r - * 3.16.0-23-generic - * ABI is 23. - */ -#ifndef UTS_UBUNTU_RELEASE_ABI -#define UTS_UBUNTU_RELEASE_ABI 0 -#define UBUNTU_VERSION_CODE 0 -#else - -#if UTS_UBUNTU_RELEASE_ABI > 255 -#error UTS_UBUNTU_RELEASE_ABI is too large... -#endif /* UTS_UBUNTU_RELEASE_ABI > 255 */ - -#endif - -/* Note that the 3rd digit is always zero, and will be ignored. This is - * because Ubuntu kernels are based on x.y.0-ABI values, and while their linux - * version codes are 3 digit, this 3rd digit is superseded by the ABI value. - */ -#define UBUNTU_VERSION(a, b, c, d) ((KERNEL_VERSION(a, b, 0) << 8) + (d)) - -#ifndef DEEPIN_PRODUCT_VERSION -#define DEEPIN_PRODUCT_VERSION(a, b, c) (((a) << 16) + ((b) << 8) + (c)) -#endif - -#ifdef CONFIG_DEEPIN_KERNEL -#endif - -#ifndef DEEPIN_VERSION_CODE -#define DEEPIN_VERSION_CODE 0 -#endif - /* SuSE version macros are the same as Linux kernel version macro. */ #ifndef SLE_VERSION #define SLE_VERSION(a, b, c) KERNEL_VERSION(a, b, c) @@ -199,13 +105,6 @@ enum ethtool_link_mode_bit_indices { #define SLE_LOCALVERSION_CODE 0 #endif /* SLE_LOCALVERSION_CODE */ -#ifndef ALIGN_DOWN -#ifndef __ALIGN_KERNEL -#define __ALIGN_KERNEL(x, a) __ALIGN_MASK(x, (typeof(x))(a) - 1) -#endif -#define ALIGN_DOWN(x, a) __ALIGN_KERNEL((x) - ((a) - 1), (a)) -#endif - /*****************************************************************************/ #define ETH_TYPE_TRANS_SETS_DEV #define HAVE_NETDEV_STATS_IN_NETDEV @@ -224,23 +123,9 @@ enum ethtool_link_mode_bit_indices { #define HAVE_NDO_SET_FEATURES #endif /* RHEL >= 6.6 && RHEL < 7.0 */ -/*****************************************************************************/ - -/*****************************************************************************/ -#ifndef HAVE_SET_RX_MODE -#define HAVE_SET_RX_MODE -#endif -#define HAVE_INET6_IFADDR_LIST - -/*****************************************************************************/ - #define HAVE_NDO_GET_STATS64 /*****************************************************************************/ - -#ifndef HAVE_MQPRIO -#define HAVE_MQPRIO -#endif #ifndef HAVE_SETUP_TC #define HAVE_SETUP_TC #endif @@ -248,45 +133,21 @@ enum ethtool_link_mode_bit_indices { #ifndef HAVE_NDO_SET_FEATURES #define HAVE_NDO_SET_FEATURES #endif -#define HAVE_IRQ_AFFINITY_NOTIFY /*****************************************************************************/ #define HAVE_ETHTOOL_SET_PHYS_ID /*****************************************************************************/ -#define HAVE_NETDEV_WANTED_FEAUTES - -/*****************************************************************************/ -#ifndef HAVE_PCI_DEV_FLAGS_ASSIGNED -#define HAVE_PCI_DEV_FLAGS_ASSIGNED #define HAVE_VF_SPOOFCHK_CONFIGURE -#endif -#ifndef HAVE_SKB_L4_RXHASH -#define HAVE_SKB_L4_RXHASH -#endif #define HAVE_NDO_SET_VF_TRUST -/*****************************************************************************/ -#define HAVE_ETHTOOL_GRXFHINDIR_SIZE -#define HAVE_INT_NDO_VLAN_RX_ADD_VID -#ifdef ETHTOOL_SRXNTUPLE -#undef ETHTOOL_SRXNTUPLE -#endif - /*****************************************************************************/ #include <linux/kconfig.h> #define _kc_kmap_atomic(page) kmap_atomic(page) #define _kc_kunmap_atomic(addr) kunmap_atomic(addr) -/*****************************************************************************/ -#include <linux/of_net.h> -#define HAVE_FDB_OPS -#define HAVE_ETHTOOL_GET_TS_INFO - -/*****************************************************************************/ - /*****************************************************************************/ #define HAVE_NAPI_GRO_FLUSH_OLD @@ -295,62 +156,11 @@ enum ethtool_link_mode_bit_indices { #define HAVE_SRIOV_CONFIGURE #endif -/*****************************************************************************/ -#define HAVE_ENCAP_TSO_OFFLOAD -#define HAVE_SKB_INNER_NETWORK_HEADER -#if (RHEL_RELEASE_CODE && \ - (RHEL_RELEASE_VERSION(7, 0) <= RHEL_RELEASE_CODE) && \ - (RHEL_RELEASE_VERSION(8, 0) > RHEL_RELEASE_CODE)) -#define HAVE_RHEL7_PCI_DRIVER_RH -#if (RHEL_RELEASE_VERSION(7, 2) <= RHEL_RELEASE_CODE) -#define HAVE_RHEL7_PCI_RESET_NOTIFY -#endif /* RHEL >= 7.2 */ -#if (RHEL_RELEASE_VERSION(7, 3) <= RHEL_RELEASE_CODE) -#define HAVE_GENEVE_RX_OFFLOAD -#if !defined(HAVE_UDP_ENC_TUNNEL) && IS_ENABLED(CONFIG_GENEVE) -#define HAVE_UDP_ENC_TUNNEL -#endif -#ifdef ETHTOOL_GLINKSETTINGS -/* pay attention pangea platform when use this micro */ -#define HAVE_ETHTOOL_25G_BITS -#endif /* ETHTOOL_GLINKSETTINGS */ -#endif /* RHEL >= 7.3 */ - -/* new hooks added to net_device_ops_extended in RHEL7.4 */ -#if (RHEL_RELEASE_VERSION(7, 4) <= RHEL_RELEASE_CODE) -#define HAVE_RHEL7_NETDEV_OPS_EXT_NDO_UDP_TUNNEL -#define HAVE_UDP_ENC_RX_OFFLOAD -#endif /* RHEL >= 7.4 */ - -#if (RHEL_RELEASE_VERSION(7, 5) <= RHEL_RELEASE_CODE) -#define HAVE_NDO_SETUP_TC_REMOVE_TC_TO_NETDEV -#endif /* RHEL > 7.5 */ - -#endif /* RHEL >= 7.0 && RHEL < 8.0 */ - /*****************************************************************************/ #define HAVE_NDO_SET_VF_LINK_STATE -#define HAVE_SKB_INNER_PROTOCOL -#define HAVE_MPLS_FEATURES /*****************************************************************************/ -#if (SLE_VERSION_CODE && SLE_VERSION_CODE >= SLE_VERSION(12, 0, 0)) -#define HAVE_NDO_SELECT_QUEUE_ACCEL_FALLBACK -#endif -#define HAVE_NDO_GET_PHYS_PORT_ID -#define HAVE_NETIF_SET_XPS_QUEUE_CONST_MASK - -/*****************************************************************************/ -#define HAVE_VXLAN_CHECKS -#if (UBUNTU_VERSION_CODE && UBUNTU_VERSION_CODE >= UBUNTU_VERSION(3, 13, 0, 24)) -#define HAVE_NDO_SELECT_QUEUE_ACCEL_FALLBACK -#else #define HAVE_NDO_SELECT_QUEUE_ACCEL -#endif -#define HAVE_NET_GET_RANDOM_ONCE -#define HAVE_HWMON_DEVICE_REGISTER_WITH_GROUPS - -/*****************************************************************************/ #define HAVE_NDO_SELECT_QUEUE_ACCEL_FALLBACK @@ -364,32 +174,14 @@ enum ethtool_link_mode_bit_indices { /*****************************************************************************/ #define HAVE_RXFH_HASHFUNC -/*****************************************************************************/ - -/****************************************************************/ - -/****************************************************************/ - -/****************************************************************/ - -/****************************************************************/ - -/****************************************************************/ - -#define HAVE_IO_MAP_WC_SIZE - /*****************************************************************************/ #define HAVE_NETDEVICE_MIN_MAX_MTU /*****************************************************************************/ #define HAVE_VOID_NDO_GET_STATS64 -#define HAVE_VM_OPS_FAULT_NO_VMA /*****************************************************************************/ -#define HAVE_HWTSTAMP_FILTER_NTP_ALL #define HAVE_NDO_SETUP_TC_CHAIN_INDEX -#define HAVE_PCI_ERROR_HANDLER_RESET_PREPARE -#define HAVE_PTP_CLOCK_DO_AUX_WORK /*****************************************************************************/ #define HAVE_NDO_SETUP_TC_REMOVE_TC_TO_NETDEV @@ -416,56 +208,9 @@ enum ethtool_link_mode_bit_indices { #define HAVE_ENCAPSULATION_CSUM -#ifndef eth_zero_addr -static inline void __kc_eth_zero_addr(u8 *addr) -{ - memset(addr, 0x00, ETH_ALEN); -} - -#define eth_zero_addr(_addr) __kc_eth_zero_addr(_addr) -#endif - -#ifndef netdev_hw_addr_list_for_each -#define netdev_hw_addr_list_for_each(ha, l) \ - list_for_each_entry(ha, &(l)->list, list) -#endif - #define spin_lock_deinit(lock) -typedef struct file sdk_file; - -sdk_file *file_creat(const char *file_name); - -sdk_file *file_open(const char *file_name); - -void file_close(sdk_file *file_handle); - -u32 get_file_size(sdk_file *file_handle); - -void set_file_position(sdk_file *file_handle, u32 position); - -int file_read(sdk_file *file_handle, char *log_buffer, - u32 rd_length, u32 *file_pos); - -u32 file_write(sdk_file *file_handle, char *log_buffer, u32 wr_length); - -struct sdk_thread_info { - struct task_struct *thread_obj; - char *name; - void (*thread_fn)(void *x); - void *thread_event; - void *data; -}; - -int creat_thread(struct sdk_thread_info *thread_info); - -void stop_thread(struct sdk_thread_info *thread_info); - #define destroy_work(work) -void utctime_to_localtime(u64 utctime, u64 *localtime); -#ifndef HAVE_TIMER_SETUP -void initialize_timer(void *adapter_hdl, struct timer_list *timer); -#endif void add_to_timer(struct timer_list *timer, long period); void stop_timer(struct timer_list *timer); void delete_timer(struct timer_list *timer); diff --git a/drivers/net/ethernet/huawei/hinic/ossl_types.h b/drivers/net/ethernet/huawei/hinic/ossl_types.h deleted file mode 100644 index b8591541bb7c..000000000000 --- a/drivers/net/ethernet/huawei/hinic/ossl_types.h +++ /dev/null @@ -1,41 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0*/ -/* Huawei HiNIC PCI Express Linux driver - * Copyright(c) 2017 Huawei Technologies Co., Ltd - * - * This program is free software; you can redistribute it and/or modify it - * under the terms and conditions of the GNU General Public License, - * version 2, as published by the Free Software Foundation. - * - * This program is distributed in the hope it will be useful, but WITHOUT - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - * - * Statement: - * It must include "ossl_knl.h" or "ossl_user.h" before include "ossl_types.h" - */ - -#ifndef _OSSL_TYPES_H -#define _OSSL_TYPES_H - -#undef NULL -#if defined(__cplusplus) -#define NULL 0 -#else -#define NULL ((void *)0) -#endif - -#define uda_handle void * - -#define UDA_TRUE 1 -#define UDA_FALSE 0 - -#ifndef UINT8_MAX -#define UINT8_MAX (u8)(~((u8)0)) /* 0xFF */ -#define UINT16_MAX (u16)(~((u16)0)) /* 0xFFFF */ -#define UINT32_MAX (u32)(~((u32)0)) /* 0xFFFFFFFF */ -#define UINT64_MAX (u64)(~((u64)0)) /* 0xFFFFFFFFFFFFFFFF */ -#define ASCII_MAX (0x7F) -#endif - -#endif /* OSSL_TYPES_H */ -- 2.25.1

1 5

[PATCH 1/3] arm64: Add support for SB barrier and patch in over DSB; ISB sequences
by Yang Yingliang 29 Jul '20

29 Jul '20

From: Will Deacon <will.deacon(a)arm.com> mainline inclusion from v5.0-rc1 commit bd4fb6d270bc423a9a4098108784f7f9254c4e6d category: feature bugzilla: 30102 CVE: NA ------------------------------------------------- We currently use a DSB; ISB sequence to inhibit speculation in set_fs(). Whilst this works for current CPUs, future CPUs may implement a new SB barrier instruction which acts as an architected speculation barrier. On CPUs that support it, patch in an SB; NOP sequence over the DSB; ISB sequence and advertise the presence of the new instruction to userspace. Conflicts: arch/arm64/include/asm/barrier.h arch/arm64/include/asm/cpucaps.h arch/arm64/include/asm/sysreg.h arch/arm64/kernel/cpufeature.c [wangshaobo: adjust context] Signed-off-by: Will Deacon <will.deacon(a)arm.com> Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/include/asm/assembler.h | 13 +++++++++++++ arch/arm64/include/asm/barrier.h | 4 ++++ arch/arm64/include/asm/cpucaps.h | 3 ++- arch/arm64/include/asm/sysreg.h | 6 ++++++ arch/arm64/include/asm/uaccess.h | 3 +-- arch/arm64/include/uapi/asm/hwcap.h | 1 + arch/arm64/kernel/cpufeature.c | 12 ++++++++++++ arch/arm64/kernel/cpuinfo.c | 1 + 8 files changed, 40 insertions(+), 3 deletions(-) diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h index becb5454151e..5446b34f4a26 100644 --- a/arch/arm64/include/asm/assembler.h +++ b/arch/arm64/include/asm/assembler.h @@ -118,6 +118,19 @@ hint #20 .endm +/* + * Speculation barrier + */ + .macro sb +alternative_if_not ARM64_HAS_SB + dsb nsh + isb +alternative_else + SB_BARRIER_INSN + nop +alternative_endif + .endm + /* * Sanitise a 64-bit bounded index wrt speculation, returning zero if out * of bounds. diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h index 3cae78c1ce33..1b3e1194b511 100644 --- a/arch/arm64/include/asm/barrier.h +++ b/arch/arm64/include/asm/barrier.h @@ -34,6 +34,10 @@ #define psb_csync() asm volatile("hint #17" : : : "memory") #define csdb() asm volatile("hint #20" : : : "memory") +#define spec_bar() asm volatile(ALTERNATIVE("dsb nsh\nisb\n", \ + SB_BARRIER_INSN"nop\n", \ + ARM64_HAS_SB)) + #ifdef CONFIG_ARM64_PSEUDO_NMI #define pmr_sync() \ do { \ diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h index d56d815b9960..cd57225af16e 100644 --- a/arch/arm64/include/asm/cpucaps.h +++ b/arch/arm64/include/asm/cpucaps.h @@ -58,7 +58,8 @@ #define ARM64_SSBS 37 #define ARM64_CLEARPAGE_STNP 38 #define ARM64_WORKAROUND_1542419 39 +#define ARM64_HAS_SB 40 -#define ARM64_NCAPS 40 +#define ARM64_NCAPS 41 #endif /* __ASM_CPUCAPS_H */ diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h index 0ba65a14d398..9d4235995ebd 100644 --- a/arch/arm64/include/asm/sysreg.h +++ b/arch/arm64/include/asm/sysreg.h @@ -97,6 +97,11 @@ #define SET_PSTATE_SSBS(x) __emit_inst(0xd5000000 | REG_PSTATE_SSBS_IMM | \ (!!x)<<8 | 0x1f) +#define __SYS_BARRIER_INSN(CRm, op2, Rt) \ + __emit_inst(0xd5000000 | sys_insn(0, 3, 3, (CRm), (op2)) | ((Rt) & 0x1f)) + +#define SB_BARRIER_INSN __SYS_BARRIER_INSN(0, 7, 31) + #define SYS_DC_ISW sys_insn(1, 0, 7, 6, 2) #define SYS_DC_CSW sys_insn(1, 0, 7, 10, 2) #define SYS_DC_CISW sys_insn(1, 0, 7, 14, 2) @@ -524,6 +529,7 @@ #define ID_AA64ISAR0_AES_SHIFT 4 /* id_aa64isar1 */ +#define ID_AA64ISAR1_SB_SHIFT 36 #define ID_AA64ISAR1_LRCPC_SHIFT 20 #define ID_AA64ISAR1_FCMA_SHIFT 16 #define ID_AA64ISAR1_JSCVT_SHIFT 12 diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h index bde376077167..35482c9076db 100644 --- a/arch/arm64/include/asm/uaccess.h +++ b/arch/arm64/include/asm/uaccess.h @@ -46,8 +46,7 @@ static inline void set_fs(mm_segment_t fs) * Prevent a mispredicted conditional call to set_fs from forwarding * the wrong address limit to access_ok under speculation. */ - dsb(nsh); - isb(); + spec_bar(); /* On user-mode return, check fs is correct */ set_thread_flag(TIF_FSCHECK); diff --git a/arch/arm64/include/uapi/asm/hwcap.h b/arch/arm64/include/uapi/asm/hwcap.h index 2bcd6e4f3474..7784f7cba16c 100644 --- a/arch/arm64/include/uapi/asm/hwcap.h +++ b/arch/arm64/include/uapi/asm/hwcap.h @@ -49,5 +49,6 @@ #define HWCAP_ILRCPC (1 << 26) #define HWCAP_FLAGM (1 << 27) #define HWCAP_SSBS (1 << 28) +#define HWCAP_SB (1 << 29) #endif /* _UAPI__ASM_HWCAP_H */ diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 8b84a47d0112..64b85f2015c6 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -141,6 +141,7 @@ static const struct arm64_ftr_bits ftr_id_aa64isar0[] = { }; static const struct arm64_ftr_bits ftr_id_aa64isar1[] = { + ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_SB_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_LRCPC_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_FCMA_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_JSCVT_SHIFT, 4, 0), @@ -1501,6 +1502,16 @@ static const struct arm64_cpu_capabilities arm64_features[] = { .type = ARM64_CPUCAP_SYSTEM_FEATURE, .matches = can_clearpage_use_stnp, }, + { + .desc = "Speculation barrier (SB)", + .capability = ARM64_HAS_SB, + .type = ARM64_CPUCAP_SYSTEM_FEATURE, + .matches = has_cpuid_feature, + .sys_reg = SYS_ID_AA64ISAR1_EL1, + .field_pos = ID_AA64ISAR1_SB_SHIFT, + .sign = FTR_UNSIGNED, + .min_field_value = 1, + }, {}, }; @@ -1555,6 +1566,7 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = { HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_FCMA_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, HWCAP_FCMA), HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_LRCPC_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, HWCAP_LRCPC), HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_LRCPC_SHIFT, FTR_UNSIGNED, 2, CAP_HWCAP, HWCAP_ILRCPC), + HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_SB_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, HWCAP_SB), HWCAP_CAP(SYS_ID_AA64MMFR2_EL1, ID_AA64MMFR2_AT_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, HWCAP_USCAT), #ifdef CONFIG_ARM64_SVE HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_SVE_SHIFT, FTR_UNSIGNED, ID_AA64PFR0_SVE, CAP_HWCAP, HWCAP_SVE), diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c index bcc2831399cb..7cb0b08ab0a7 100644 --- a/arch/arm64/kernel/cpuinfo.c +++ b/arch/arm64/kernel/cpuinfo.c @@ -82,6 +82,7 @@ static const char *const hwcap_str[] = { "ilrcpc", "flagm", "ssbs", + "sb", NULL }; -- 2.25.1

1 2

[PATCH] kernel/notifier.c: intercept duplicate registrations to avoid infinite loops
by Yang Yingliang 29 Jul '20

29 Jul '20

From: Xiaoming Ni <nixiaoming(a)huawei.com> mainline inclusion from mainline-v5.5-rc1 commit 1a50cb80f219c44adb6265f5071b81fc3c1deced category: bugfix bugzilla: NA CVE: NA --------------------------------------------- [ Upstream commit 1a50cb80f219c44adb6265f5071b81fc3c1deced ] Registering the same notifier to a hook repeatedly can cause the hook list to form a ring or lose other members of the list. case1: An infinite loop in notifier_chain_register() can cause soft lockup atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_chain_register(&test_notifier_list, &test2); case2: An infinite loop in notifier_chain_register() can cause soft lockup atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_call_chain(&test_notifier_list, 0, NULL); case3: lose other hook test2 atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_chain_register(&test_notifier_list, &test2); atomic_notifier_chain_register(&test_notifier_list, &test1); case4: Unregister returns 0, but the hook is still in the linked list, and it is not really registered. If you call notifier_call_chain after ko is unloaded, it will trigger oops. If the system is configured with softlockup_panic and the same hook is repeatedly registered on the panic_notifier_list, it will cause a loop panic. Add a check in notifier_chain_register(), intercepting duplicate registrations to avoid infinite loops Link: http://lkml.kernel.org/r/1568861888-34045-2-git-send-email-nixiaoming@huawe… Signed-off-by: Xiaoming Ni <nixiaoming(a)huawei.com> Reviewed-by: Vasily Averin <vvs(a)virtuozzo.com> Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org> Cc: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: Arjan van de Ven <arjan(a)linux.intel.com> Cc: J. Bruce Fields <bfields(a)fieldses.org> Cc: Chuck Lever <chuck.lever(a)oracle.com> Cc: David S. Miller <davem(a)davemloft.net> Cc: Jeff Layton <jlayton(a)kernel.org> Cc: Andy Lutomirski <luto(a)kernel.org> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Nadia Derbey <Nadia.Derbey(a)bull.net> Cc: "Paul E. McKenney" <paulmck(a)kernel.org> Cc: Sam Protsenko <semen.protsenko(a)linaro.org> Cc: Alan Stern <stern(a)rowland.harvard.edu> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Viresh Kumar <viresh.kumar(a)linaro.org> Cc: Xiaoming Ni <nixiaoming(a)huawei.com> Cc: YueHaibing <yuehaibing(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Ding Tianhong <dingtianhong(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/notifier.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/notifier.c b/kernel/notifier.c index 6196af8a8223..c6de38836f50 100644 --- a/kernel/notifier.c +++ b/kernel/notifier.c @@ -22,6 +22,11 @@ static int notifier_chain_register(struct notifier_block **nl, struct notifier_block *n) { while ((*nl) != NULL) { + if (unlikely((*nl) == n)) { + WARN(1, "double register detected"); + return 0; + } + if (n->priority > (*nl)->priority) break; nl = &((*nl)->next); -- 2.25.1

1 1

[PATCH 001/132] net: rmnet: fix lower interface leak
by Yang Yingliang 24 Jul '20

24 Jul '20

From: Taehee Yoo <ap420073(a)gmail.com> commit 2a762e9e8cd1cf1242e4269a2244666ed02eecd1 upstream. There are two types of the lower interface of rmnet that are VND and BRIDGE. Each lower interface can have only one type either VND or BRIDGE. But, there is a case, which uses both lower interface types. Due to this unexpected behavior, lower interface leak occurs. Test commands: ip link add dummy0 type dummy ip link add dummy1 type dummy ip link add rmnet0 link dummy0 type rmnet mux_id 1 ip link set dummy1 master rmnet0 ip link add rmnet1 link dummy1 type rmnet mux_id 2 ip link del rmnet0 The dummy1 was attached as BRIDGE interface of rmnet0. Then, it also was attached as VND interface of rmnet1. This is unexpected behavior and there is no code for handling this case. So that below splat occurs when the rmnet0 interface is deleted. Splat looks like: [ 53.254112][ C1] WARNING: CPU: 1 PID: 1192 at net/core/dev.c:8992 rollback_registered_many+0x986/0xcf0 [ 53.254117][ C1] Modules linked in: rmnet dummy openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nfx [ 53.254182][ C1] CPU: 1 PID: 1192 Comm: ip Not tainted 5.8.0-rc1+ #620 [ 53.254188][ C1] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 53.254192][ C1] RIP: 0010:rollback_registered_many+0x986/0xcf0 [ 53.254200][ C1] Code: 41 8b 4e cc 45 31 c0 31 d2 4c 89 ee 48 89 df e8 e0 47 ff ff 85 c0 0f 84 cd fc ff ff 0f 0b e5 [ 53.254205][ C1] RSP: 0018:ffff888050a5f2e0 EFLAGS: 00010287 [ 53.254214][ C1] RAX: ffff88805756d658 RBX: ffff88804d99c000 RCX: ffffffff8329d323 [ 53.254219][ C1] RDX: 1ffffffff0be6410 RSI: 0000000000000008 RDI: ffffffff85f32080 [ 53.254223][ C1] RBP: dffffc0000000000 R08: fffffbfff0be6411 R09: fffffbfff0be6411 [ 53.254228][ C1] R10: ffffffff85f32087 R11: 0000000000000001 R12: ffff888050a5f480 [ 53.254233][ C1] R13: ffff88804d99c0b8 R14: ffff888050a5f400 R15: ffff8880548ebe40 [ 53.254238][ C1] FS: 00007f6b86b370c0(0000) GS:ffff88806c200000(0000) knlGS:0000000000000000 [ 53.254243][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 53.254248][ C1] CR2: 0000562c62438758 CR3: 000000003f600005 CR4: 00000000000606e0 [ 53.254253][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 53.254257][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 53.254261][ C1] Call Trace: [ 53.254266][ C1] ? lockdep_hardirqs_on_prepare+0x379/0x540 [ 53.254270][ C1] ? netif_set_real_num_tx_queues+0x780/0x780 [ 53.254275][ C1] ? rmnet_unregister_real_device+0x56/0x90 [rmnet] [ 53.254279][ C1] ? __kasan_slab_free+0x126/0x150 [ 53.254283][ C1] ? kfree+0xdc/0x320 [ 53.254288][ C1] ? rmnet_unregister_real_device+0x56/0x90 [rmnet] [ 53.254293][ C1] unregister_netdevice_many.part.135+0x13/0x1b0 [ 53.254297][ C1] rtnl_delete_link+0xbc/0x100 [ 53.254301][ C1] ? rtnl_af_register+0xc0/0xc0 [ 53.254305][ C1] rtnl_dellink+0x2dc/0x840 [ 53.254309][ C1] ? find_held_lock+0x39/0x1d0 [ 53.254314][ C1] ? valid_fdb_dump_strict+0x620/0x620 [ 53.254318][ C1] ? rtnetlink_rcv_msg+0x457/0x890 [ 53.254322][ C1] ? lock_contended+0xd20/0xd20 [ 53.254326][ C1] rtnetlink_rcv_msg+0x4a8/0x890 [ ... ] [ 73.813696][ T1192] unregister_netdevice: waiting for rmnet0 to become free. Usage count = 1 Fixes: 037f9cdf72fb ("net: rmnet: use upper/lower device infrastructure") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- .../ethernet/qualcomm/rmnet/rmnet_config.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c index 7389648d0fea..05c438f47ff1 100644 --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c @@ -56,15 +56,23 @@ static int rmnet_unregister_real_device(struct net_device *real_dev) return 0; } -static int rmnet_register_real_device(struct net_device *real_dev) +static int rmnet_register_real_device(struct net_device *real_dev, + struct netlink_ext_ack *extack) { struct rmnet_port *port; int rc, entry; ASSERT_RTNL(); - if (rmnet_is_real_dev_registered(real_dev)) + if (rmnet_is_real_dev_registered(real_dev)) { + port = rmnet_get_port_rtnl(real_dev); + if (port->rmnet_mode != RMNET_EPMODE_VND) { + NL_SET_ERR_MSG_MOD(extack, "bridge device already exists"); + return -EINVAL; + } + return 0; + } port = kzalloc(sizeof(*port), GFP_ATOMIC); if (!port) @@ -143,7 +151,7 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev, mux_id = nla_get_u16(data[IFLA_RMNET_MUX_ID]); - err = rmnet_register_real_device(real_dev); + err = rmnet_register_real_device(real_dev, extack); if (err) goto err0; @@ -425,13 +433,10 @@ int rmnet_add_bridge(struct net_device *rmnet_dev, if (port->nr_rmnet_devs > 1) return -EINVAL; - if (port->rmnet_mode != RMNET_EPMODE_VND) - return -EINVAL; - if (rmnet_is_real_dev_registered(slave_dev)) return -EBUSY; - err = rmnet_register_real_device(slave_dev); + err = rmnet_register_real_device(slave_dev, extack); if (err) return -EBUSY; -- 2.25.1

1 131

[PATCH] defconfig: Update hulk_defconfig in default
by Yang Yingliang 24 Jul '20

24 Jul '20

From: Hanjun Guo <guohanjun(a)huawei.com> hulk inclusion category: cleanup bugzilla: NA CVE: NA --------------------------- When some patches are merged, the config file wasn't updated, so update them all together, no functional change. Signed-off-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/configs/hulk_defconfig | 39 ++++++++++++++++--------------- 1 file changed, 20 insertions(+), 19 deletions(-) diff --git a/arch/arm64/configs/hulk_defconfig b/arch/arm64/configs/hulk_defconfig index 4580f4a82635..488ea95474e7 100644 --- a/arch/arm64/configs/hulk_defconfig +++ b/arch/arm64/configs/hulk_defconfig @@ -1,14 +1,15 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 4.19.25 Kernel Configuration +# Linux/arm64 4.19.132 Kernel Configuration # # -# Compiler: gcc (GCC) 6.3.0 +# Compiler: gcc (GCC) 7.3.0 # CONFIG_CC_IS_GCC=y -CONFIG_GCC_VERSION=60300 +CONFIG_GCC_VERSION=70300 CONFIG_CLANG_VERSION=0 +CONFIG_CC_HAS_ASM_GOTO=y CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_EXTABLE_SORT=y CONFIG_THREAD_INFO_IN_TASK=y @@ -145,8 +146,8 @@ CONFIG_IPC_NS=y CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y -CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_STEAL=y +CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set CONFIG_RELAY=y @@ -178,6 +179,7 @@ CONFIG_ELF_CORE=y CONFIG_BASE_FULL=y CONFIG_FUTEX=y CONFIG_FUTEX_PI=y +CONFIG_HAVE_FUTEX_CMPXCHG=y CONFIG_EPOLL=y CONFIG_SIGNALFD=y CONFIG_TIMERFD=y @@ -279,8 +281,6 @@ CONFIG_ARCH_XGENE=y # CONFIG_ARCH_ZX is not set # CONFIG_ARCH_ZYNQMP is not set CONFIG_HAVE_LIVEPATCH_WO_FTRACE=y -CONFIG_SOC_HISILICON_SYSCTL=m -CONFIG_SOC_HISILICON_LBC=m # # Enable Livepatch @@ -355,10 +355,10 @@ CONFIG_PCIE_DW=y CONFIG_PCIE_DW_HOST=y # CONFIG_PCIE_DW_PLAT_HOST is not set CONFIG_PCI_HISI=y -CONFIG_HISILICON_PCIE_CAE=m # CONFIG_PCIE_QCOM is not set # CONFIG_PCIE_KIRIN is not set # CONFIG_PCIE_HISI_STB is not set +CONFIG_HISILICON_PCIE_CAE=m # # PCI Endpoint @@ -420,7 +420,6 @@ CONFIG_NUMA_AWARE_SPINLOCKS=y CONFIG_USE_PERCPU_NUMA_NODE_ID=y CONFIG_HAVE_SETUP_PER_CPU_AREA=y CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y -CONFIG_COHERENT_DEVICE=y CONFIG_HOLES_IN_ZONE=y # CONFIG_HZ_100 is not set CONFIG_HZ_250=y @@ -557,7 +556,6 @@ CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y # # CONFIG_CPUFREQ_DT is not set CONFIG_ACPI_CPPC_CPUFREQ=y -CONFIG_HISILICON_CPPC_CPUFREQ_WORKAROUND=y # CONFIG_ARM_BIG_LITTLE_CPUFREQ is not set CONFIG_ARM_SCPI_CPUFREQ=m # CONFIG_QORIQ_CPUFREQ is not set @@ -573,8 +571,8 @@ CONFIG_ARM_SCPI_POWER_DOMAIN=m CONFIG_ARM_SDE_INTERFACE=y CONFIG_DMIID=y CONFIG_DMI_SYSFS=y -CONFIG_FW_CFG_SYSFS=y # CONFIG_ISCSI_IBFT is not set +CONFIG_FW_CFG_SYSFS=y # CONFIG_FW_CFG_SYSFS_CMDLINE is not set CONFIG_HAVE_ARM_SMCCC=y # CONFIG_GOOGLE_FIRMWARE is not set @@ -643,6 +641,7 @@ CONFIG_ACPI_APEI_EINJ=m # CONFIG_ACPI_CONFIGFS is not set CONFIG_ACPI_IORT=y CONFIG_ACPI_GTDT=y +CONFIG_ACPI_MPAM=y CONFIG_ACPI_PPTT=y CONFIG_HAVE_KVM_IRQCHIP=y CONFIG_HAVE_KVM_IRQFD=y @@ -678,7 +677,6 @@ CONFIG_CRYPTO_SM3_ARM64_CE=m CONFIG_CRYPTO_SM4_ARM64_CE=m CONFIG_CRYPTO_GHASH_ARM64_CE=m CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=m -CONFIG_CRYPTO_CRC32_ARM64_CE=m CONFIG_CRYPTO_AES_ARM64=y CONFIG_CRYPTO_AES_ARM64_CE=m CONFIG_CRYPTO_AES_ARM64_CE_CCM=m @@ -720,6 +718,7 @@ CONFIG_HAVE_PERF_REGS=y CONFIG_HAVE_PERF_USER_STACK_DUMP=y CONFIG_HAVE_ARCH_JUMP_LABEL=y CONFIG_HAVE_RCU_TABLE_FREE=y +CONFIG_HAVE_RCU_TABLE_INVALIDATE=y CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y CONFIG_HAVE_CMPXCHG_LOCAL=y @@ -932,6 +931,8 @@ CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y CONFIG_SPARSEMEM_VMEMMAP=y CONFIG_HAVE_MEMBLOCK=y CONFIG_HAVE_MEMBLOCK_NODE_MAP=y +CONFIG_HAVE_MEMBLOCK_PFN_VALID=y +CONFIG_COHERENT_DEVICE=y CONFIG_NO_BOOTMEM=y CONFIG_MEMORY_ISOLATION=y CONFIG_MEMORY_HOTPLUG=y @@ -1757,6 +1758,7 @@ CONFIG_ALLOW_DEV_COREDUMP=y # CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set # CONFIG_TEST_ASYNC_DRIVER_PROBE is not set CONFIG_GENERIC_CPU_AUTOPROBE=y +CONFIG_GENERIC_CPU_VULNERABILITIES=y CONFIG_REGMAP=y CONFIG_REGMAP_I2C=y CONFIG_REGMAP_SPI=y @@ -1793,7 +1795,6 @@ CONFIG_MTD=m # CONFIG_MTD_CMDLINE_PARTS is not set # CONFIG_MTD_AFS_PARTS is not set CONFIG_MTD_OF_PARTS=m -CONFIG_MTD_HISILICON_SFC=m # CONFIG_MTD_AR7_PARTS is not set # @@ -1879,6 +1880,7 @@ CONFIG_MTD_UBI_BEB_LIMIT=20 # CONFIG_MTD_UBI_FASTMAP is not set # CONFIG_MTD_UBI_GLUEBI is not set # CONFIG_MTD_UBI_BLOCK is not set +CONFIG_MTD_HISILICON_SFC=m CONFIG_DTC=y CONFIG_OF=y # CONFIG_OF_UNITTEST is not set @@ -2914,7 +2916,6 @@ CONFIG_HW_RANDOM_VIRTIO=m CONFIG_HW_RANDOM_HISI=y CONFIG_HW_RANDOM_XGENE=y CONFIG_HW_RANDOM_CAVIUM=y -# CONFIG_R3964 is not set # CONFIG_APPLICOM is not set # @@ -2939,6 +2940,7 @@ CONFIG_TCG_CRB=y # CONFIG_DEVPORT is not set # CONFIG_XILLYBUS is not set CONFIG_HISI_SVM=y + # # I2C support # @@ -3686,10 +3688,10 @@ CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y # # Frame buffer Devices # -CONFIG_FB=y -# CONFIG_FIRMWARE_EDID is not set CONFIG_FB_CMDLINE=y CONFIG_FB_NOTIFY=y +CONFIG_FB=y +# CONFIG_FIRMWARE_EDID is not set CONFIG_FB_CFB_FILLRECT=y CONFIG_FB_CFB_COPYAREA=y CONFIG_FB_CFB_IMAGEBLIT=y @@ -4081,7 +4083,6 @@ CONFIG_USB_EMI62=m CONFIG_USB_EMI26=m CONFIG_USB_ADUTUX=m CONFIG_USB_SEVSEG=m -# CONFIG_USB_RIO500 is not set CONFIG_USB_LEGOTOWER=m CONFIG_USB_LCD=m # CONFIG_USB_CYPRESS_CY7C63 is not set @@ -4494,7 +4495,6 @@ CONFIG_VFIO_PLATFORM=m # CONFIG_VFIO_PLATFORM_AMDXGBE_RESET is not set CONFIG_VFIO_MDEV=m CONFIG_VFIO_MDEV_DEVICE=m -CONFIG_VFIO_SPIMDEV=m # CONFIG_VIRT_DRIVERS is not set CONFIG_VIRTIO=y CONFIG_VIRTIO_MENU=y @@ -4650,6 +4650,8 @@ CONFIG_SMMU_BYPASS_DEV=y # Xilinx SoC drivers # # CONFIG_XILINX_VCU is not set +CONFIG_SOC_HISILICON_LBC=m +CONFIG_SOC_HISILICON_SYSCTL=m # CONFIG_PM_DEVFREQ is not set CONFIG_EXTCON=y @@ -4862,7 +4864,6 @@ CONFIG_VFAT_FS=y CONFIG_FAT_DEFAULT_CODEPAGE=437 CONFIG_FAT_DEFAULT_IOCHARSET="ascii" # CONFIG_FAT_DEFAULT_UTF8 is not set -# CONFIG_NTFS_FS is not set # # Pseudo filesystems @@ -5286,7 +5287,6 @@ CONFIG_CRYPTO_DEV_HISI_QM=m CONFIG_CRYPTO_QM_UACCE=y CONFIG_CRYPTO_DEV_HISI_ZIP=m CONFIG_CRYPTO_DEV_HISI_HPRE=m -CONFIG_CRYPTO_HISI_SGL=m CONFIG_CRYPTO_DEV_HISI_SEC2=m CONFIG_CRYPTO_DEV_HISI_RDE=m CONFIG_ASYMMETRIC_KEY_TYPE=y @@ -5336,6 +5336,7 @@ CONFIG_CRC32_SLICEBY8=y CONFIG_CRC7=m CONFIG_LIBCRC32C=y CONFIG_CRC8=m +CONFIG_XXHASH=y CONFIG_AUDIT_GENERIC=y CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y CONFIG_AUDIT_COMPAT_GENERIC=y -- 2.25.1

1 0

[PATCH] scsi: qedf: remove memset/memcpy to nfunc and use func instead
by Yang Yingliang 24 Jul '20

24 Jul '20

From: Colin Ian King <colin.king(a)canonical.com> mainline inclusion from mainline-v5.2-rc3 commit 65b1dc99008de592f7c1c8e5fad446824791b4da category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- Currently the qedf_dbg_* family of functions can overrun the end of the source string if it is less than the destination buffer length because of the use of a fixed sized memcpy. Remove the memset/memcpy calls to nfunc and just use func instead as it is always a null terminated string. Addresses-Coverity: ("Out-of-bounds access") Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") Signed-off-by: Colin Ian King <colin.king(a)canonical.com> Acked-by: Saurav Kashyap <skashyap(a)marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/qedf/qedf_dbg.c | 32 ++++++++------------------------ 1 file changed, 8 insertions(+), 24 deletions(-) diff --git a/drivers/scsi/qedf/qedf_dbg.c b/drivers/scsi/qedf/qedf_dbg.c index f2397ee9ba69..f7d170bffc82 100644 --- a/drivers/scsi/qedf/qedf_dbg.c +++ b/drivers/scsi/qedf/qedf_dbg.c @@ -15,10 +15,6 @@ qedf_dbg_err(struct qedf_dbg_ctx *qedf, const char *func, u32 line, { va_list va; struct va_format vaf; - char nfunc[32]; - - memset(nfunc, 0, sizeof(nfunc)); - memcpy(nfunc, func, sizeof(nfunc) - 1); va_start(va, fmt); @@ -27,9 +23,9 @@ qedf_dbg_err(struct qedf_dbg_ctx *qedf, const char *func, u32 line, if (likely(qedf) && likely(qedf->pdev)) pr_err("[%s]:[%s:%d]:%d: %pV", dev_name(&(qedf->pdev->dev)), - nfunc, line, qedf->host_no, &vaf); + func, line, qedf->host_no, &vaf); else - pr_err("[0000:00:00.0]:[%s:%d]: %pV", nfunc, line, &vaf); + pr_err("[0000:00:00.0]:[%s:%d]: %pV", func, line, &vaf); va_end(va); } @@ -40,10 +36,6 @@ qedf_dbg_warn(struct qedf_dbg_ctx *qedf, const char *func, u32 line, { va_list va; struct va_format vaf; - char nfunc[32]; - - memset(nfunc, 0, sizeof(nfunc)); - memcpy(nfunc, func, sizeof(nfunc) - 1); va_start(va, fmt); @@ -55,9 +47,9 @@ qedf_dbg_warn(struct qedf_dbg_ctx *qedf, const char *func, u32 line, if (likely(qedf) && likely(qedf->pdev)) pr_warn("[%s]:[%s:%d]:%d: %pV", dev_name(&(qedf->pdev->dev)), - nfunc, line, qedf->host_no, &vaf); + func, line, qedf->host_no, &vaf); else - pr_warn("[0000:00:00.0]:[%s:%d]: %pV", nfunc, line, &vaf); + pr_warn("[0000:00:00.0]:[%s:%d]: %pV", func, line, &vaf); ret: va_end(va); @@ -69,10 +61,6 @@ qedf_dbg_notice(struct qedf_dbg_ctx *qedf, const char *func, u32 line, { va_list va; struct va_format vaf; - char nfunc[32]; - - memset(nfunc, 0, sizeof(nfunc)); - memcpy(nfunc, func, sizeof(nfunc) - 1); va_start(va, fmt); @@ -84,10 +72,10 @@ qedf_dbg_notice(struct qedf_dbg_ctx *qedf, const char *func, u32 line, if (likely(qedf) && likely(qedf->pdev)) pr_notice("[%s]:[%s:%d]:%d: %pV", - dev_name(&(qedf->pdev->dev)), nfunc, line, + dev_name(&(qedf->pdev->dev)), func, line, qedf->host_no, &vaf); else - pr_notice("[0000:00:00.0]:[%s:%d]: %pV", nfunc, line, &vaf); + pr_notice("[0000:00:00.0]:[%s:%d]: %pV", func, line, &vaf); ret: va_end(va); @@ -99,10 +87,6 @@ qedf_dbg_info(struct qedf_dbg_ctx *qedf, const char *func, u32 line, { va_list va; struct va_format vaf; - char nfunc[32]; - - memset(nfunc, 0, sizeof(nfunc)); - memcpy(nfunc, func, sizeof(nfunc) - 1); va_start(va, fmt); @@ -114,9 +98,9 @@ qedf_dbg_info(struct qedf_dbg_ctx *qedf, const char *func, u32 line, if (likely(qedf) && likely(qedf->pdev)) pr_info("[%s]:[%s:%d]:%d: %pV", dev_name(&(qedf->pdev->dev)), - nfunc, line, qedf->host_no, &vaf); + func, line, qedf->host_no, &vaf); else - pr_info("[0000:00:00.0]:[%s:%d]: %pV", nfunc, line, &vaf); + pr_info("[0000:00:00.0]:[%s:%d]: %pV", func, line, &vaf); ret: va_end(va); -- 2.25.1

1 0

[PATCH] ext4: Send ext4_handle_error message after set sb->s_flags
by Yang Yingliang 24 Jul '20

24 Jul '20

From: Ye Bin <yebin10(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- Sysmonitor will check sb->s_flags if set SB_RDONLY, then judge if report exception message. Fixes: 3cfdac228065 ("ext4: report error to userspace by netlink") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 4fdd17055dc5..5a09d52b864c 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -512,8 +512,6 @@ static void ext4_handle_error(struct super_block *sb) jbd2_journal_abort(journal, -EIO); } - ext4_netlink_send_info(sb, 1); - /* * We force ERRORS_RO behavior when system is rebooting. Otherwise we * could panic during 'reboot -f' as the underlying device got already @@ -531,6 +529,8 @@ static void ext4_handle_error(struct super_block *sb) panic("EXT4-fs (device %s): panic forced after error\n", sb->s_id); } + + ext4_netlink_send_info(sb, 1); } #define ext4_error_ratelimit(sb) \ -- 2.25.1

1 0

[PATCH] net: hns3: fix for ping failed when resume from s3 or s4
by Yonglong Liu 20 Jul '20

20 Jul '20

When resume from s3 or s4, the mac table will lose, and the network will be broken. This patch adds mac table restore operation to fix this problem. Fixes: 3fc746a2967a ("net: hns3: add suspend/resume function for hns3 driver") Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 478a3b5..d7da2c8 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -3864,6 +3864,10 @@ static int hclge_resume(struct hnae3_ae_dev *ae_dev) if (ret) goto err_reset_lock; + ret = hclge_notify_client(hdev, HNAE3_RESTORE_CLIENT); + if (ret) + goto err_reset_lock; + rtnl_unlock(); ret = hclge_notify_roce_client(hdev, HNAE3_INIT_CLIENT); -- 2.8.1

1 0

[PATCH] lib : kobject: fix refcount imblance on kobject_rename
by Yang Yingliang 14 Jul '20

14 Jul '20

From: Lin Yi <teroincn(a)163.com> mainline inclusion from mainline-v5.3-rc1 commit 122f8ec7b78e category: bugfix bugzilla: 18462 CVE: NA ------------------------------------------------- the kobj refcount increased by kobject_get should be released before error return, otherwise lead to a memory leak. Signed-off-by: Lin Yi <teroincn(a)163.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Heng <liheng40(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- lib/kobject.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/kobject.c b/lib/kobject.c index 97d86dc17c42..c82b88b2e860 100644 --- a/lib/kobject.c +++ b/lib/kobject.c @@ -478,8 +478,10 @@ int kobject_rename(struct kobject *kobj, const char *new_name) kobj = kobject_get(kobj); if (!kobj) return -EINVAL; - if (!kobj->parent) + if (!kobj->parent) { + kobject_put(kobj); return -EINVAL; + } devpath = kobject_get_path(kobj, GFP_KERNEL); if (!devpath) { -- 2.25.1

1 0