Re: [PATCH] docs-rst: networking: wire up msg_zerocopy

2018-01-09 Thread David Miller
From: Jonathan Corbet Date: Tue, 9 Jan 2018 09:55:27 -0700 > On Tue, 09 Jan 2018 11:50:49 -0500 (EST) > David Miller wrote: > >> From: Mike Rapoport >> Date: Mon, 8 Jan 2018 08:50:17 +0200 >> >> > Fix the following 'make

Re: [PATCH 24/31] aio: remove an outdated comment in aio_complete

2018-01-09 Thread Jeff Moyer
Christoph Hellwig writes: > These days we don't treat sync iocbs special in the aio completion code as > they never use it. Remove the old comment, and move the BUG_ON for a sync > iocb to the top of the function. > > Signed-off-by: Christoph Hellwig Right, this

tipc: memory leak in tipc_nl_node_get_link

2018-01-09 Thread Dmitry Vyukov
Hello, syzkaller has hit the following memory leak on 4.15-rc7. It seems that tipc_nl_node_get_link() fails to free the skb when tipc_node_find_by_name() fails. 5:58:28 KMEMLEAK READ1 1071 [ 386.810943] kmemleak: 2 new suspected memory leaks, 0 unleaked (see /sys/kernel/debug/kmemleak)

Re: [PATCH 16/18] net: mpls: prevent bounds-check bypass via speculative execution

2018-01-09 Thread Dan Williams
On Tue, Jan 9, 2018 at 8:17 AM, Eric W. Biederman wrote: > Dan Williams writes: [..] > The user controlled value condition of your patchset implies that you > assume indirect branch predictor poisoning is handled in other ways. > > Which means

Re: [PATCH bpf] bpf: avoid false sharing of map refcount with max_entries

2018-01-09 Thread Alexei Starovoitov
On Tue, Jan 09, 2018 at 04:23:08PM +, Edward Cree wrote: > > > > Quoting from Goolge's Project Zero blog [1]: > typo "Goolge". Applied with typo fixed, thanks Daniel!

net/8021q: memory leak in register_vlan_dev

2018-01-09 Thread Dmitry Vyukov
Hello, syzkaller has hit the following memory leak on 4.15-rc7: unreferenced object 0x88007b704140 (size 256): comm "syz-executor6", pid 5661, jiffies 4294856803 (age 9.848s) hex dump (first 32 bytes): 00 40 b7 2c 00 88 ff ff 00 00 00 00 00 00 00 00 .@., 00 00 00 00

Re: net: memory leak in socket

2018-01-09 Thread Al Viro
On Tue, Jan 09, 2018 at 07:39:50PM +0100, Dmitry Vyukov wrote: > Hello, > > syzkaller has hit the following memory leak on 4.15-rc7: > > unreferenced object 0x88002713fb20 (size 16): > comm "syz-executor3", pid 6576, jiffies 4295029354 (age 10.166s) > hex dump (first 16 bytes): > 69

[net-next 13/13] ixgbe: Drop l2_accel_priv data pointer from ring struct

2018-01-09 Thread Jeff Kirsher
From: Alexander Duyck The l2 acceleration private pointer isn't needed in the ring struct. It isn't really used anywhere other than to test and see if we are supporting an offloaded macvlan netdev, and it is much easier to test netdev for not being ixgbe based to

[net-next 11/13] ixgbe: Fix limitations on macvlan so we can support up to 63 offloaded devices

2018-01-09 Thread Jeff Kirsher
From: Alexander Duyck This change is a fix of the macvlan offload so that we correctly handle macvlan offloaded devices. Specifically we were configuring our limits based on the assumption that we were going to max out the RSS indices for every mode. As a result when

[net-next 06/13] ixgbevf: remove redundant setting of xcast_mode

2018-01-09 Thread Jeff Kirsher
From: Emil Tantilov Removed leftover assignment of xcast_mode. Signed-off-by: Emil Tantilov Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher ---

[net-next 08/13] ixgbe: Perform reinit any time number of VFs change

2018-01-09 Thread Jeff Kirsher
From: Alexander Duyck If the number of VFs are changed we need to reinitialize the part since the offset for the device and the number of pools will be incorrect. Without this change we can end up seeing Tx hangs and dropped Rx frames for incoming traffic. In

[net-next 05/13] ixgbe: Remove an obsolete comment about ITR

2018-01-09 Thread Jeff Kirsher
From: Tonghao Zhang The InterruptThrottleRate has been removed from ixgbe. Then Update the comment. Signed-off-by: Tonghao Zhang Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher ---

[net-next 07/13] ixgbe: Fix interaction between SR-IOV and macvlan offload

2018-01-09 Thread Jeff Kirsher
From: Alexander Duyck When SR-IOV was enabled the macvlan offload was configuring several filters with the wrong pool value. This would result in the macvlan interfaces not being able to receive traffic that had to pass over the physical interface. To fix it wrap

[net-next 10/13] ixgbe: There is no need to update num_rx_pools in L2 fwd offload

2018-01-09 Thread Jeff Kirsher
From: Alexander Duyck The num_rx_pools value is overwritten when we reinitialize the queue configuration. In reality we shouldn't need to be updating the value since it is redone every time we call into ixgbe_setup_tc so for now just drop the spots where we were

[net-next 09/13] ixgbe: Add support for macvlan offload RSS on X550 and clean-up pool handling

2018-01-09 Thread Jeff Kirsher
From: Alexander Duyck In order for RSS to work on the macvlan pools of the X550 we need to populate the MRQC, RETA, and RSS key values for each pool. This patch makes it so that we now take care of that. In addition I have dropped the macvlan specific configuration

[net-next 02/13] ixgbe: remove unused enum latency_range

2018-01-09 Thread Jeff Kirsher
From: Emil Tantilov This enum is no longer needed after commit: b4ded8327fe ("ixgbe: Update adaptive ITR algorithm") Signed-off-by: Emil Tantilov Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher

[net-next 12/13] ixgbe: Use ring values to test for Tx pending

2018-01-09 Thread Jeff Kirsher
From: Alexander Duyck This patch simplifies the check for Tx pending traffic and makes it more holistic as there being any difference between next_to_use and next_to_clean is much more informative than if head and tail are equal, as it is possible for us to either

[net-next 03/13] ixgbe: advertise highest capable link speed

2018-01-09 Thread Jeff Kirsher
From: Paul Greenwalt On module insert advertise highest capable link speed. If module is capable of 10G, then advertise 10G, else advertise modules capable link speeds. Signed-off-by: Paul Greenwalt Tested-by: Andrew Bowers

[PATCH net-next v4 08/10] net/dim: use struct net_dim_sample as arg to net_dim

2018-01-09 Thread Andy Gospodarek
From: Andy Gospodarek Simplify the arguments net_dim() by formatting them into a struct net_dim_sample before calling the function. Signed-off-by: Andy Gospodarek Suggested-by: Tal Gilboa Acked-by: Tal Gilboa

[PATCH bpf-next v5 02/11] bpf: Make SOCK_OPS_GET_TCP struct independent

2018-01-09 Thread Lawrence Brakmo
Changed SOCK_OPS_GET_TCP to SOCK_OPS_GET_FIELD and added 2 arguments so now it can also work with struct sock fields. The first argument is the name of the field in the bpf_sock_ops struct, the 2nd argument is the name of the field in the OBJ struct. Previous: SOCK_OPS_GET_TCP(FIELD_NAME) New:

[PATCH 21/36] ip: Define usercopy region in IP proto slab cache

2018-01-09 Thread Kees Cook
From: David Windsor The ICMP filters for IPv4 and IPv6 raw sockets need to be copied to/from userspace. In support of usercopy hardening, this patch defines a region in the struct proto slab cache in which userspace copy operations are allowed. example usage trace:

[PATCH bpf-next v5 05/11] bpf: Adds field bpf_sock_ops_flags to tcp_sock

2018-01-09 Thread Lawrence Brakmo
Adds field bpf_sock_ops_flags to tcp_sock and bpf_sock_ops. Its primary use is to determine if there should be calls to sock_ops bpf program at various points in the TCP code. The field is initialized to zero, disabling the calls. A sock_ops BPF program can set, per connection and as necessary,

[PATCH bpf-next v5 11/11] bpf: add selftest for tcpbpf

2018-01-09 Thread Lawrence Brakmo
Added a selftest for tcpbpf (sock_ops) that checks that the appropriate callbacks occured and that it can access tcp_sock fields and that their values are correct. Run with command: ./test_tcpbpf_user Signed-off-by: Lawrence Brakmo --- tools/include/uapi/linux/bpf.h

[PATCH net-next v4 07/10] net/mlx5e: Move dynamic interrupt coalescing code to include/linux

2018-01-09 Thread Andy Gospodarek
From: Andy Gospodarek This move allows drivers to add private structure elements to track the number of packets, bytes, and interrupts events per ring. A driver also defines a workqueue handler to act on this collected data once per poll and modify the coalescing parameters

[PATCH bpf-next v5 06/11] bpf: Add sock_ops RTO callback

2018-01-09 Thread Lawrence Brakmo
Adds an optional call to sock_ops BPF program based on whether the BPF_SOCK_OPS_RTO_CB_FLAG is set in bpf_sock_ops_flags. The BPF program is passed 2 arguments: icsk_retransmits and whether the RTO has expired. Signed-off-by: Lawrence Brakmo --- include/uapi/linux/bpf.h | 5 +

[PATCH net-next v4 09/10] bnxt_en: add support for software dynamic interrupt moderation

2018-01-09 Thread Andy Gospodarek
From: Andy Gospodarek This implements the changes needed for the bnxt_en driver to add support for dynamic interrupt moderation per ring. This does add additional counters in the receive path, but testing shows that any additional instructions are offset by throughput gain

[PATCH bpf-next v5 10/11] bpf: Add BPF_SOCK_OPS_STATE_CB

2018-01-09 Thread Lawrence Brakmo
Adds support for calling sock_ops BPF program when there is a TCP state change. Two arguments are used; one for the old state and another for the new state. There is a new enum in include/uapi/linux/bpf.h that exports the TCP states that prepends BPF_ to the current TCP state names. If it is ever

[PATCH bpf-next v5 08/11] bpf: Add sock_ops R/W access to tclass & sk_txhash

2018-01-09 Thread Lawrence Brakmo
Adds direct R/W access to sk_txhash and access to tclass for ipv6 flows through getsockopt and setsockopt. Sample usage for tclass: bpf_getsockopt(skops, SOL_IPV6, IPV6_TCLASS, , sizeof(v)) where skops is a pointer to the ctx (struct bpf_sock_ops). Signed-off-by: Lawrence Brakmo

[PATCH bpf-next v5 04/11] bpf: Support passing args to sock_ops bpf function

2018-01-09 Thread Lawrence Brakmo
Adds support for passing up to 4 arguments to sock_ops bpf functions. It reusues the reply union, so the bpf_sock_ops structures are not increased in size. Signed-off-by: Lawrence Brakmo --- include/linux/filter.h | 1 + include/net/tcp.h| 64

[PATCH net-next v4 10/10] MAINTAINERS: add entry for Dynamic Interrupt Moderation

2018-01-09 Thread Andy Gospodarek
From: Andy Gospodarek Signed-off-by: Andy Gospodarek Signed-off-by: Tal Gilboa Acked-by: Saeed Mahameed --- MAINTAINERS | 5 + 1 file changed, 5 insertions(+) diff --git a/MAINTAINERS b/MAINTAINERS index

[PATCH 28/36] fork: Provide usercopy whitelisting for task_struct

2018-01-09 Thread Kees Cook
While the blocked and saved_sigmask fields of task_struct are copied to userspace (via sigmask_to_save() and setup_rt_frame()), it is always copied with a static length (i.e. sizeof(sigset_t)). The only portion of task_struct that is potentially dynamically sized and may be copied to userspace is

[PATCH 06/36] usercopy: Mark kmalloc caches as usercopy caches

2018-01-09 Thread Kees Cook
From: David Windsor Mark the kmalloc slab caches as entirely whitelisted. These caches are frequently used to fulfill kernel allocations that contain data to be copied to/from userspace. Internal-only uses are also common, but are scattered in the kernel. For now, mark all the

[PATCH 07/36] dcache: Define usercopy region in dentry_cache slab cache

2018-01-09 Thread Kees Cook
From: David Windsor When a dentry name is short enough, it can be stored directly in the dentry itself (instead in a separate kmalloc allocation). These dentry short names, stored in struct dentry.d_iname and therefore contained in the dentry_cache slab cache, need to be coped

[PATCH 34/36] usercopy: Allow strict enforcement of whitelists

2018-01-09 Thread Kees Cook
This introduces CONFIG_HARDENED_USERCOPY_FALLBACK to control the behavior of hardened usercopy whitelist violations. By default, whitelist violations will continue to WARN() so that any bad or missing usercopy whitelists can be discovered without being too disruptive. If this config is disabled

[PATCH 35/36] usercopy: Restrict non-usercopy caches to size 0

2018-01-09 Thread Kees Cook
With all known usercopied cache whitelists now defined in the kernel, switch the default usercopy region of kmem_cache_create() to size 0. Any new caches with usercopy regions will now need to use kmem_cache_create_usercopy() instead of kmem_cache_create(). This patch is modified from Brad

[PATCH net-next v4 01/10] net/mlx5e: Move interrupt moderation structs to new file

2018-01-09 Thread Andy Gospodarek
From: Andy Gospodarek Create new header file to prepare to move code that handles irq moderation to a library that lives in a header file. Signed-off-by: Andy Gospodarek Acked-by: Tal Gilboa Acked-by: Saeed Mahameed

[PATCH bpf-next v5 03/11] bpf: Add write access to tcp_sock and sock fields

2018-01-09 Thread Lawrence Brakmo
This patch adds a macro, SOCK_OPS_SET_FIELD, for writing to struct tcp_sock or struct sock fields. This required adding a new field "temp" to struct bpf_sock_ops_kern for temporary storage that is used by sock_ops_convert_ctx_access. It is used to store and recover the contents of a register, so

[PATCH net-next v4 00/10] net: create dynamic software irq moderation library

2018-01-09 Thread Andy Gospodarek
From: Andy Gospodarek This converts the dynamic interrupt moderation library from the mlx5e driver into a library so it can be used by any driver. The penultimate patch in this set adds support for this new dynamic interrupt moderation library in the bnxt_en driver and the

[PATCH bpf-next v5 09/11] bpf: Add BPF_SOCK_OPS_RETRANS_CB

2018-01-09 Thread Lawrence Brakmo
Adds support for calling sock_ops BPF program when there is a retransmission. Two arguments are used; one for the sequence number and other for the number of segments retransmitted. Does not include syn-ack retransmissions. New op: BPF_SOCK_OPS_RETRANS_CB. Signed-off-by: Lawrence Brakmo

[PATCH bpf-next v5 00/11] bpf: More sock_ops callbacks

2018-01-09 Thread Lawrence Brakmo
This patchset adds support for: - direct R or R/W access to many tcp_sock fields - passing up to 4 arguments to sock_ops BPF functions - tcp_sock field bpf_sock_ops_flags for controlling callbacks - optionally calling sock_ops BPF program when RTO fires - optionally calling sock_ops BPF program

[PATCH 01/36] usercopy: Remove pointer from overflow report

2018-01-09 Thread Kees Cook
Using %p was already mostly useless in the usercopy overflow reports, so this removes it entirely to avoid confusion now that %p-hashing is enabled. Fixes: ad67b74d2469d9b8 ("printk: hash addresses printed with %p") Signed-off-by: Kees Cook --- mm/usercopy.c | 9 -

Re: [PATCH] MAINTAINERS: Mark some staging directories as "Obsolete"

2018-01-09 Thread Greg KH
On Tue, Jan 09, 2018 at 11:33:56AM -0800, Joe Perches wrote: > Several staging directories have TODO files that indicate a > subsystem will be removed in the future. > > Using a status entry of "S: Obsolete" helps indicate the > subsystem files should not be modified unnecessarily. > >

Re: [PATCH net-next v3 06/10] net/mlx5e: Change Mellanox references in DIM code

2018-01-09 Thread Andy Gospodarek
On Tue, Jan 09, 2018 at 08:22:15PM +0200, Tal Gilboa wrote: > On 1/9/2018 6:06 PM, Andy Gospodarek wrote: > > On Mon, Jan 08, 2018 at 11:06:28PM -0800, Saeed Mahameed wrote: > > > > > > > > > On 01/08/2018 10:13 PM, Andy Gospodarek wrote: > > > > From: Andy Gospodarek > > >

Re: [PATCH 00/18] prevent bounds-check bypass via speculative execution

2018-01-09 Thread Dan Williams
On Tue, Jan 9, 2018 at 11:34 AM, Jiri Kosina wrote: > On Fri, 5 Jan 2018, Dan Williams wrote: > > [ ... snip ... ] >> Andi Kleen (1): >> x86, barrier: stop speculation for failed access_ok >> >> Dan Williams (13): >> x86: implement nospec_barrier() >> [media]

Re: [PATCH 00/18] prevent bounds-check bypass via speculative execution

2018-01-09 Thread Jiri Kosina
On Fri, 5 Jan 2018, Dan Williams wrote: [ ... snip ... ] > Andi Kleen (1): > x86, barrier: stop speculation for failed access_ok > > Dan Williams (13): > x86: implement nospec_barrier() > [media] uvcvideo: prevent bounds-check bypass via speculative execution > carl9170:

[PATCH 12/36] jfs: Define usercopy region in jfs_ip slab cache

2018-01-09 Thread Kees Cook
From: David Windsor The jfs symlink pathnames, stored in struct jfs_inode_info.i_inline and therefore contained in the jfs_ip slab cache, need to be copied to/from userspace. cache object allocation: fs/jfs/super.c: jfs_alloc_inode(...): ...

[PATCH 08/36] vfs: Define usercopy region in names_cache slab caches

2018-01-09 Thread Kees Cook
From: David Windsor VFS pathnames are stored in the names_cache slab cache, either inline or across an entire allocation entry (when approaching PATH_MAX). These are copied to/from userspace, so they must be entirely whitelisted. cache object allocation:

[PATCH 32/36] kvm: whitelist struct kvm_vcpu_arch

2018-01-09 Thread Kees Cook
From: Paolo Bonzini On x86, ARM and s390, struct kvm_vcpu_arch has a usercopy region that is read and written by the KVM_GET/SET_CPUID2 ioctls (x86) or KVM_GET/SET_ONE_REG (ARM/s390). Without whitelisting the area, KVM is completely broken on those architectures with

[PATCH 31/36] arm: Implement thread_struct whitelist for hardened usercopy

2018-01-09 Thread Kees Cook
ARM does not carry FPU state in the thread structure, so it can declare no usercopy whitelist at all. Cc: Russell King Cc: Ingo Molnar Cc: Christian Borntraeger Cc: "Peter Zijlstra (Intel)" Cc:

[PATCH 33/36] kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl

2018-01-09 Thread Kees Cook
From: Paolo Bonzini This ioctl is obsolete (it was used by Xenner as far as I know) but still let's not break it gratuitously... Its handler is copying directly into struct kvm. Go through a bounce buffer instead, with the added benefit that we can actually do something

[PATCH net-next v4 06/10] net/mlx5e: Change Mellanox references in DIM code

2018-01-09 Thread Andy Gospodarek
From: Andy Gospodarek Change all appropriate mlx5_am* and MLX5_AM* references to net_dim and NET_DIM, respectively, in code that handles dynamic interrupt moderation. Also change all references from 'am' to 'dim' when used as local variables and add generic profile

[PATCH 30/36] arm64: Implement thread_struct whitelist for hardened usercopy

2018-01-09 Thread Kees Cook
This whitelists the FPU register state portion of the thread_struct for copying to userspace, instead of the default entire structure. Cc: Catalin Marinas Cc: Will Deacon Cc: Christian Borntraeger Cc: Ingo Molnar

[PATCH 20/36] net: Define usercopy region in struct proto slab cache

2018-01-09 Thread Kees Cook
From: David Windsor In support of usercopy hardening, this patch defines a region in the struct proto slab cache in which userspace copy operations are allowed. Some protocols need to copy objects to/from userspace, and they can declare the region via their proto structure

[PATCH 13/36] befs: Define usercopy region in befs_inode_cache slab cache

2018-01-09 Thread Kees Cook
From: David Windsor befs symlink pathnames, stored in struct befs_inode_info.i_data.symlink and therefore contained in the befs_inode_cache slab cache, need to be copied to/from userspace. cache object allocation: fs/befs/linuxvfs.c: befs_alloc_inode(...):

[PATCH 19/36] scsi: Define usercopy region in scsi_sense_cache slab cache

2018-01-09 Thread Kees Cook
From: David Windsor SCSI sense buffers, stored in struct scsi_cmnd.sense and therefore contained in the scsi_sense_cache slab cache, need to be copied to/from userspace. cache object allocation: drivers/scsi/scsi_lib.c: scsi_select_sense_cache(...):

[PATCH] MAINTAINERS: Mark some staging directories as "Obsolete"

2018-01-09 Thread Joe Perches
Several staging directories have TODO files that indicate a subsystem will be removed in the future. Using a status entry of "S: Obsolete" helps indicate the subsystem files should not be modified unnecessarily. checkpatch also tests this setting and emits a warning that the matching

Re: [PATCH net-next] ibmvnic: Don't handle RX interrupts when not up.

2018-01-09 Thread Thomas Falcon
On 01/08/2018 10:09 AM, Nathan Fontenot wrote: > Initiating a kdump via the command line can cause a pending interrupt > to be handled by the ibmvnic driver when initializing the sub-CRQ > irqs during driver initialization. > > NIP [d0ca34f0] ibmvnic_interrupt_rx+0x40/0xd0 [ibmvnic] > LR

Re: [PATCH 00/18] prevent bounds-check bypass via speculative execution

2018-01-09 Thread Josh Poimboeuf
On Tue, Jan 09, 2018 at 11:44:05AM -0800, Dan Williams wrote: > On Tue, Jan 9, 2018 at 11:34 AM, Jiri Kosina wrote: > > On Fri, 5 Jan 2018, Dan Williams wrote: > > > > [ ... snip ... ] > >> Andi Kleen (1): > >> x86, barrier: stop speculation for failed access_ok > >> > >>

[PATCH 36/36] lkdtm: Update usercopy tests for whitelisting

2018-01-09 Thread Kees Cook
This updates the USERCOPY_HEAP_FLAG_* tests to USERCOPY_HEAP_WHITELIST_*, since the final form of usercopy whitelisting ended up using an offset/size window instead of the earlier proposed allocation flags. Signed-off-by: Kees Cook --- drivers/misc/lkdtm.h | 4

[PATCH 25/36] net: Restrict unwhitelisted proto caches to size 0

2018-01-09 Thread Kees Cook
Now that protocols have been annotated (the copy of icsk_ca_ops->name is of an ops field from outside the slab cache): $ git grep 'copy_.*_user.*sk.*->' caif/caif_socket.c: copy_from_user(_sk->conn_req.param.data, ov, ol)) { ipv4/raw.c: if (copy_from_user(_sk(sk)->filter, optval, optlen))

[PATCH 29/36] x86: Implement thread_struct whitelist for hardened usercopy

2018-01-09 Thread Kees Cook
This whitelists the FPU register state portion of the thread_struct for copying to userspace, instead of the default entire struct. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: x...@kernel.org Cc: Borislav Petkov

[PATCH 26/36] fork: Define usercopy region in mm_struct slab caches

2018-01-09 Thread Kees Cook
From: David Windsor In support of usercopy hardening, this patch defines a region in the mm_struct slab caches in which userspace copy operations are allowed. Only the auxv field is copied to userspace. cache object allocation: kernel/fork.c: #define allocate_mm()

[PATCH 24/36] sctp: Copy struct sctp_sock.autoclose to userspace using put_user()

2018-01-09 Thread Kees Cook
From: David Windsor The autoclose field can be copied with put_user(), so there is no need to use copy_to_user(). In both cases, hardened usercopy is being bypassed since the size is constant, and not open to runtime manipulation. This patch is verbatim from Brad Spengler/PaX

[PATCH 22/36] caif: Define usercopy region in caif proto slab cache

2018-01-09 Thread Kees Cook
From: David Windsor The CAIF channel connection request parameters need to be copied to/from userspace. In support of usercopy hardening, this patch defines a region in the struct proto slab cache in which userspace copy operations are allowed. example usage trace:

Re: [patch iproute2 v7 1/2] lib/libnetlink: Add functions rtnl_talk_msg and rtnl_talk_iov

2018-01-09 Thread Phil Sutter
Hi, On Tue, Jan 09, 2018 at 03:59:07PM +0900, Chris Mi wrote: [...] > diff --git a/lib/libnetlink.c b/lib/libnetlink.c > index 00e6ce0c..ae0059f9 100644 > --- a/lib/libnetlink.c > +++ b/lib/libnetlink.c > @@ -581,39 +581,43 @@ static void rtnl_talk_error(struct nlmsghdr *h, struct > nlmsgerr

Re: net: memory leak in socket

2018-01-09 Thread Al Viro
On Tue, Jan 09, 2018 at 07:58:08PM +0100, Dmitry Vyukov wrote: > > Argh... Got broken by "make sock_alloc_file() do sock_release() on > > failures" - > > cleanup after sock_map_fd() failure got pulled all the way into > > sock_alloc_file(), > > but it used to serve the case when sock_map_fd()

[PATCH 27/36] fork: Define usercopy region in thread_stack slab caches

2018-01-09 Thread Kees Cook
From: David Windsor In support of usercopy hardening, this patch defines a region in the thread_stack slab caches in which userspace copy operations are allowed. Since the entire thread_stack needs to be available to userspace, the entire slab contents are whitelisted. Note

[PATCH 10/36] ext4: Define usercopy region in ext4_inode_cache slab cache

2018-01-09 Thread Kees Cook
From: David Windsor The ext4 symlink pathnames, stored in struct ext4_inode_info.i_data and therefore contained in the ext4_inode_cache slab cache, need to be copied to/from userspace. cache object allocation: fs/ext4/super.c: ext4_alloc_inode(...):

[PATCH 11/36] ext2: Define usercopy region in ext2_inode_cache slab cache

2018-01-09 Thread Kees Cook
From: David Windsor The ext2 symlink pathnames, stored in struct ext2_inode_info.i_data and therefore contained in the ext2_inode_cache slab cache, need to be copied to/from userspace. cache object allocation: fs/ext2/super.c: ext2_alloc_inode(...):

[PATCH 09/36] vfs: Copy struct mount.mnt_id to userspace using put_user()

2018-01-09 Thread Kees Cook
From: David Windsor The mnt_id field can be copied with put_user(), so there is no need to use copy_to_user(). In both cases, hardened usercopy is being bypassed since the size is constant, and not open to runtime manipulation. This patch is verbatim from Brad Spengler/PaX

[PATCH 05/36] usercopy: WARN() on slab cache usercopy region violations

2018-01-09 Thread Kees Cook
From: David Windsor This patch adds checking of usercopy cache whitelisting, and is modified from Brad Spengler/PaX Team's PAX_USERCOPY whitelisting code in the last public patch of grsecurity/PaX based on my understanding of the code. Changes or omissions from the original

[PATCH net-next v4 05/10] net/mlx5e: Move generic functions to new file

2018-01-09 Thread Andy Gospodarek
From: Andy Gospodarek These functions were identified as ones that could be made generic and used by multiple drivers. Most of the contents of en_rx_am.c are moved to net_dim.c. Signed-off-by: Andy Gospodarek Acked-by: Tal Gilboa

[PATCH bpf-next v5 07/11] bpf: Add support for reading sk_state and more

2018-01-09 Thread Lawrence Brakmo
Add support for reading many more tcp_sock fields state,same as sk->sk_state rtt_min same as sk->rtt_min.s[0].v (current rtt_min) snd_ssthresh rcv_nxt snd_nxt snd_una mss_cache ecn_flags rate_delivered rate_interval_us packets_out retrans_out total_retrans

[PATCH net-next v4 02/10] net/mlx5e: Move interrupt moderation forward declarations

2018-01-09 Thread Andy Gospodarek
From: Andy Gospodarek Move these to newly created file to prepare to move these functions to a library. Signed-off-by: Andy Gospodarek Acked-by: Tal Gilboa Acked-by: Saeed Mahameed ---

[PATCH bpf-next v5 01/11] bpf: Make SOCK_OPS_GET_TCP size independent

2018-01-09 Thread Lawrence Brakmo
Make SOCK_OPS_GET_TCP helper macro size independent (before only worked with 4-byte fields. Signed-off-by: Lawrence Brakmo --- net/core/filter.c | 13 - 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index

[PATCH 23/36] sctp: Define usercopy region in SCTP proto slab cache

2018-01-09 Thread Kees Cook
From: David Windsor The SCTP socket event notification subscription information need to be copied to/from userspace. In support of usercopy hardening, this patch defines a region in the struct proto slab cache in which userspace copy operations are allowed. Additionally moves

[PATCH net-next v4 04/10] net/mlx5e: Move AM logic enums

2018-01-09 Thread Andy Gospodarek
From: Andy Gospodarek More movement to help make this code more generic. Signed-off-by: Andy Gospodarek Acked-by: Tal Gilboa Acked-by: Saeed Mahameed --- drivers/net/ethernet/mellanox/mlx5/core/en_dim.h | 26

[PATCH net-next v4 03/10] net/mlx5e: Remove rq references in mlx5e_rx_am

2018-01-09 Thread Andy Gospodarek
From: Andy Gospodarek This makes mlx5e_am_sample more generic so that it can be called easily from a driver that does not use the same data structure to store these values in a single structure. Signed-off-by: Andy Gospodarek Acked-by: Tal Gilboa

[PATCH 18/36] cifs: Define usercopy region in cifs_request slab cache

2018-01-09 Thread Kees Cook
From: David Windsor CIFS request buffers, stored in the cifs_request slab cache, need to be copied to/from userspace. cache object allocation: fs/cifs/cifsfs.c: cifs_init_request_bufs(): ... cifs_req_poolp =

[PATCH 17/36] vxfs: Define usercopy region in vxfs_inode slab cache

2018-01-09 Thread Kees Cook
From: David Windsor vxfs symlink pathnames, stored in struct vxfs_inode_info field vii_immed.vi_immed and therefore contained in the vxfs_inode slab cache, need to be copied to/from userspace. cache object allocation: fs/freevxfs/vxfs_super.c:

[PATCH 14/36] exofs: Define usercopy region in exofs_inode_cache slab cache

2018-01-09 Thread Kees Cook
From: David Windsor The exofs short symlink names, stored in struct exofs_i_info.i_data and therefore contained in the exofs_inode_cache slab cache, need to be copied to/from userspace. cache object allocation: fs/exofs/super.c: exofs_alloc_inode(...):

[PATCH 16/36] ufs: Define usercopy region in ufs_inode_cache slab cache

2018-01-09 Thread Kees Cook
From: David Windsor The ufs symlink pathnames, stored in struct ufs_inode_info.i_u1.i_symlink and therefore contained in the ufs_inode_cache slab cache, need to be copied to/from userspace. cache object allocation: fs/ufs/super.c: ufs_alloc_inode(...):

Re: [PATCH] ipv6: use ARRAY_SIZE for array sizing calculation on array seg6_action_table

2018-01-09 Thread David Miller
From: Colin King Date: Sun, 7 Jan 2018 23:50:26 + > From: Colin Ian King > > Use the ARRAY_SIZE macro on array seg6_action_table to determine size of > the array. Improvement suggested by coccinelle. > > Signed-off-by: Colin Ian King

Aw: Re: dvb usb issues since kernel 4.9

2018-01-09 Thread Josef Griebichler
Hi Linus, your patch works very good for me and others (please see https://forum.libreelec.tv/thread/4235-dvb-issue-since-le-switched-to-kernel-4-9-x/?postID=77006#post77006). No errors in recordings any more. The patch was also tested on x86_64 (Revo 3700) with positive effect. I agree with

Re: [PATCH 23/31] aio: don't print the page size at boot time

2018-01-09 Thread Jeff Moyer
Christoph Hellwig writes: > The page size is in no way related to the aio code, and printing it in > the (debug) dmesg at every boot serves no purpose. > > Signed-off-by: Christoph Hellwig Acked-by: Jeff Moyer

Re: [PATCH] docs-rst: networking: wire up msg_zerocopy

2018-01-09 Thread David Miller
From: Mike Rapoport Date: Mon, 8 Jan 2018 08:50:17 +0200 > Fix the following 'make htmldocs' complaint: > > Documentation/networking/msg_zerocopy.rst:: WARNING: document isn't included > in any toctree. > > Signed-off-by: Mike Rapoport

Re: [PATCH net-next v3 06/10] net/mlx5e: Change Mellanox references in DIM code

2018-01-09 Thread Tal Gilboa
On 1/9/2018 6:06 PM, Andy Gospodarek wrote: On Mon, Jan 08, 2018 at 11:06:28PM -0800, Saeed Mahameed wrote: On 01/08/2018 10:13 PM, Andy Gospodarek wrote: From: Andy Gospodarek Change all appropriate mlx5_am* and MLX5_AM* references to net_dim and NET_DIM, respectively,

Re: [PATCH] net: phy: Fix phy_modify() semantic difference fallout

2018-01-09 Thread Russell King - ARM Linux
On Tue, Jan 09, 2018 at 07:25:40PM +0100, Geert Uytterhoeven wrote: > Hi Russell, > > On Tue, Jan 9, 2018 at 3:22 PM, Russell King - ARM Linux > wrote: > > On Tue, Jan 09, 2018 at 03:10:08PM +0100, Andrew Lunn wrote: > >> On Tue, Jan 09, 2018 at 12:11:21PM +0100, Geert

Re: net: memory leak in socket

2018-01-09 Thread Dmitry Vyukov
On Tue, Jan 9, 2018 at 7:53 PM, Al Viro wrote: > On Tue, Jan 09, 2018 at 07:39:50PM +0100, Dmitry Vyukov wrote: >> Hello, >> >> syzkaller has hit the following memory leak on 4.15-rc7: >> >> unreferenced object 0x88002713fb20 (size 16): >> comm "syz-executor3", pid

Re: Re: dvb usb issues since kernel 4.9

2018-01-09 Thread Linus Torvalds
On Tue, Jan 9, 2018 at 9:57 AM, Eric Dumazet wrote: > > Your patch considers TASKLET_SOFTIRQ being a candidate for 'immediate > handling', but TCP Small queues heavily use TASKLET, > so as far as I am concerned a revert would have the same effect. Does it actually? TCP ends

Re: [PATCH][next] rtlwifi: btcoexist: remove redundant variable fw_ps_state

2018-01-09 Thread Larry Finger
On 01/09/2018 10:43 AM, Colin King wrote: From: Colin Ian King Variable fw_ps_state is assigned a value but it is never read, hence it is redundant and can be removed. Acked-by: Larry Finger Thanks, Larry Cleans up clang warning:

Re: Re: dvb usb issues since kernel 4.9

2018-01-09 Thread Eric Dumazet
On Tue, Jan 9, 2018 at 8:51 AM, Josef Griebichler wrote: > Hi Linus, > > your patch works very good for me and others (please see > https://forum.libreelec.tv/thread/4235-dvb-issue-since-le-switched-to-kernel-4-9-x/?postID=77006#post77006). > No errors in recordings

Re: Re: dvb usb issues since kernel 4.9

2018-01-09 Thread Eric Dumazet
On Tue, Jan 9, 2018 at 9:48 AM, Linus Torvalds wrote: > On Tue, Jan 9, 2018 at 9:27 AM, Eric Dumazet wrote: >> >> So yes, commit 4cd13c21b207 ("softirq: Let ksoftirqd do its job") has >> shown up multiple times in various 'regressions' >>

[PATCH v3 bpf] bpf: introduce BPF_JIT_ALWAYS_ON config

2018-01-09 Thread Alexei Starovoitov
The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715. A quote from goolge project zero blog: "At this point, it would normally be necessary to locate gadgets in the host kernel code that can be used to actually leak data by reading from an attacker-controlled location,

Re: [PATCH] net: phy: Fix phy_modify() semantic difference fallout

2018-01-09 Thread Geert Uytterhoeven
Hi Russell, On Tue, Jan 9, 2018 at 3:22 PM, Russell King - ARM Linux wrote: > On Tue, Jan 09, 2018 at 03:10:08PM +0100, Andrew Lunn wrote: >> On Tue, Jan 09, 2018 at 12:11:21PM +0100, Geert Uytterhoeven wrote: >> > In case of success, the return values of (__)phy_write()

Re: [PATCH v2 2/3] net: Add BUG_ON() to get_net()

2018-01-09 Thread Eric Dumazet
On Tue, 2018-01-09 at 18:00 +0300, Kirill Tkhai wrote: > Since people may mistakenly obtain destroying net > from net_namespace_list and from net::netns_ids > without checking for its net::counter, let's protect > against such situations and insert BUG_ON() to stop > move on after this. > > Panic

Re: [PATCH] net: caif: use strlcpy() instead of strncpy()

2018-01-09 Thread David Miller
From: Xiongfeng Wang Date: Mon, 8 Jan 2018 19:43:00 +0800 > From: Xiongfeng Wang > > gcc-8 reports > > net/caif/caif_dev.c: In function 'caif_enroll_dev': > ./include/linux/string.h:245:9: warning: '__builtin_strncpy' output may > be

Re: [PATCH] wireless: broadcom: radio_2056: delete duplicated macro definitions

2018-01-09 Thread Larry Finger
On 01/08/2018 03:26 PM, Rasmus Villemoes wrote: Ctrl-V was hit twice when these macros were inserted: $ sed -n '9,527p' ./drivers/net/wireless/broadcom/b43/radio_2056.h | md5sum 4db53450c59d9939e903d4e4ba6bc9b1 - $ sed -n '528,1046p' ./drivers/net/wireless/broadcom/b43/radio_2056.h | md5sum

Re: [PATCH net v2] ipv6: remove null_entry before adding default route

2018-01-09 Thread David Miller
From: Wei Wang Date: Mon, 8 Jan 2018 10:34:00 -0800 > From: Wei Wang > > In the current code, when creating a new fib6 table, tb6_root.leaf gets > initialized to net->ipv6.ip6_null_entry. > If a default route is being added with rt->rt6i_metric =

Re: [patch iproute2 v7 2/2] tc: Add batchsize feature for filter and actions

2018-01-09 Thread Marcelo Ricardo Leitner
On Tue, Jan 09, 2018 at 03:59:08PM +0900, Chris Mi wrote: > Currently in tc batch mode, only one command is read from the batch > file and sent to kernel to process. With this support, at most 128 > commands can be accumulated before sending to kernel. > > Now it only works for the following

  1   2   3   4   >