Skip to content
  1. Dec 11, 2023
    • Zhipeng Lu's avatar
      octeontx2-af: fix a use-after-free in rvu_nix_register_reporters · 28a7cb04
      Zhipeng Lu authored 
      The rvu_dl will be freed in rvu_nix_health_reporters_destroy(rvu_dl)
after the create_workqueue fails, and after that free, the rvu_dl will
be translate back through the following call chain:

rvu_nix_health_reporters_destroy
  |-> rvu_nix_health_reporters_create
       |-> rvu_health_reporters_create
             |-> rvu_register_dl (label err_dl_health)

Finally. in the err_dl_health label, rvu_dl being freed again in
rvu_health_reporters_destroy(rvu) by rvu_nix_health_reporters_destroy.
In the second calls of rvu_nix_health_reporters_destroy, however,
it uses rvu_dl->rvu_nix_health_reporter, which is already freed at
the end of rvu_nix_health_reporters_destroy in the first call.

So this patch prevents the first destroy by instantly returning -ENONMEN
when create_workqueue fails. In addition, since the failure of
create_workqueue is the only entrence of label err, it has been
integrated into the error-handling path of create_workqueue.

Fixes: 5ed66306

 ("octeontx2-af: Add devlink health reporters for NIX")
Signed-off-by: default avatarZhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      28a7cb04
    • Radu Bulie's avatar
      net: fec: correct queue selection · 9fc95fe9
      Radu Bulie authored 
      The old implementation extracted VLAN TCI info from the payload
before the VLAN tag has been pushed in the payload.

Another problem was that the VLAN TCI was extracted even if the
packet did not have VLAN protocol header.

This resulted in invalid VLAN TCI and as a consequence a random
queue was computed.

This patch fixes the above issues and use the VLAN TCI from the
skb if it is present or VLAN TCI from payload if present. If no
VLAN header is present queue 0 is selected.

Fixes: 52c4a1a8

 ("net: fec: add ndo_select_queue to fix TX bandwidth fluctuations")
Signed-off-by: default avatarRadu Bulie <radu-andrei.bulie@nxp.com>
Signed-off-by: default avatarWei Fang <wei.fang@nxp.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9fc95fe9
  3. Dec 10, 2023
    • Pavel Begunkov's avatar
      io_uring/af_unix: disable sending io_uring over sockets · 69db702c
      Pavel Begunkov authored 
      File reference cycles have caused lots of problems for io_uring
in the past, and it still doesn't work exactly right and races with
unix_stream_read_generic(). The safest fix would be to completely
disallow sending io_uring files via sockets via SCM_RIGHT, so there
are no possible cycles invloving registered files and thus rendering
SCM accounting on the io_uring side unnecessary.

Cc: stable@vger.kernel.org
Fixes: 0091bfc8

 ("io_uring/af_unix: defer registered files gc to io_uring release")
Reported-and-suggested-by: default avatarJann Horn <jannh@google.com>
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Acked-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      69db702c
    • Chengfeng Ye's avatar
      atm: solos-pci: Fix potential deadlock on &tx_queue_lock · 15319a4e
      Chengfeng Ye authored 
      As &card->tx_queue_lock is acquired under softirq context along the
following call chain from solos_bh(), other acquisition of the same
lock inside process context should disable at least bh to avoid double
lock.

<deadlock #2>
pclose()
--> spin_lock(&card->tx_queue_lock)
<interrupt>
   --> solos_bh()
   --> fpga_tx()
   --> spin_lock(&card->tx_queue_lock)

This flaw was found by an experimental static analysis tool I am
developing for irq-related deadlock.

To prevent the potential deadlock, the patch uses spin_lock_bh()
on &card->tx_queue_lock under process context code consistently to
prevent the possible deadlock scenario.

Fixes: 213e85d3

 ("solos-pci: clean up pclose() function")
Signed-off-by: default avatarChengfeng Ye <dg573847474@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      15319a4e
    • Chengfeng Ye's avatar
      atm: solos-pci: Fix potential deadlock on &cli_queue_lock · d5dba32b
      Chengfeng Ye authored 
      As &card->cli_queue_lock is acquired under softirq context along the
following call chain from solos_bh(), other acquisition of the same
lock inside process context should disable at least bh to avoid double
lock.

<deadlock #1>
console_show()
--> spin_lock(&card->cli_queue_lock)
<interrupt>
   --> solos_bh()
   --> spin_lock(&card->cli_queue_lock)

This flaw was found by an experimental static analysis tool I am
developing for irq-related deadlock.

To prevent the potential deadlock, the patch uses spin_lock_bh()
on the card->cli_queue_lock under process context code consistently
to prevent the possible deadlock scenario.

Fixes: 9c54004e

 ("atm: Driver for Solos PCI ADSL2+ card.")
Signed-off-by: default avatarChengfeng Ye <dg573847474@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d5dba32b
  5. Dec 09, 2023
  7. Dec 08, 2023