Skip to content
  1. Apr 17, 2021
  3. Apr 16, 2021
  5. Apr 15, 2021
  7. Apr 14, 2021
    • Michael Brown's avatar
      xen-netback: Check for hotplug-status existence before watching · 2afeec08
      Michael Brown authored 
      The logic in connect() is currently written with the assumption that
xenbus_watch_pathfmt() will return an error for a node that does not
exist.  This assumption is incorrect: xenstore does allow a watch to
be registered for a nonexistent node (and will send notifications
should the node be subsequently created).

As of commit 1f256578

 ("xen-netback: remove 'hotplug-status' once it
has served its purpose"), this leads to a failure when a domU
transitions into XenbusStateConnected more than once.  On the first
domU transition into Connected state, the "hotplug-status" node will
be deleted by the hotplug_status_changed() callback in dom0.  On the
second or subsequent domU transition into Connected state, the
hotplug_status_changed() callback will therefore never be invoked, and
so the backend will remain stuck in InitWait.

This failure prevents scenarios such as reloading the xen-netfront
module within a domU, or booting a domU via iPXE.  There is
unfortunately no way for the domU to work around this dom0 bug.

Fix by explicitly checking for existence of the "hotplug-status" node,
thereby creating the behaviour that was previously assumed to exist.

Signed-off-by: default avatarMichael Brown <mbrown@fensystems.co.uk>
Reviewed-by: default avatarPaul Durrant <paul@xen.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2afeec08
    • Eric Dumazet's avatar
      gro: ensure frag0 meets IP header alignment · 38ec4944
      Eric Dumazet authored 
      After commit 0f6925b3 ("virtio_net: Do not pull payload in skb->head")
Guenter Roeck reported one failure in his tests using sh architecture.

After much debugging, we have been able to spot silent unaligned accesses
in inet_gro_receive()

The issue at hand is that upper networking stacks assume their header
is word-aligned. Low level drivers are supposed to reserve NET_IP_ALIGN
bytes before the Ethernet header to make that happen.

This patch hardens skb_gro_reset_offset() to not allow frag0 fast-path
if the fragment is not properly aligned.

Some arches like x86, arm64 and powerpc do not care and define NET_IP_ALIGN
as 0, this extra check will be a NOP for them.

Note that if frag0 is not used, GRO will call pskb_may_pull()
as many times as needed to pull network and transport headers.

Fixes: 0f6925b3 ("virtio_net: Do not pull payload in skb->head")
Fixes: 78a478d0

 ("gro: Inline skb_gro_header and cache frag0 virtual address")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarGuenter Roeck <linux@roeck-us.net>
Cc: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Tested-by: default avatarGuenter Roeck <linux@roeck-us.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      38ec4944
    • Or Cohen's avatar
      net/sctp: fix race condition in sctp_destroy_sock · b166a20b
      Or Cohen authored 
      

If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock
held and sp->do_auto_asconf is true, then an element is removed
from the auto_asconf_splist without any proper locking.

This can happen in the following functions:
1. In sctp_accept, if sctp_sock_migrate fails.
2. In inet_create or inet6_create, if there is a bpf program
   attached to BPF_CGROUP_INET_SOCK_CREATE which denies
   creation of the sctp socket.

The bug is fixed by acquiring addr_wq_lock in sctp_destroy_sock
instead of sctp_close.

This addresses CVE-2021-23133.

Reported-by: default avatarOr Cohen <orcohen@paloaltonetworks.com>
Reviewed-by: default avatarXin Long <lucien.xin@gmail.com>
Fixes: 61023658

 ("bpf: Add new cgroup attach type to enable sock modifications")
Signed-off-by: default avatarOr Cohen <orcohen@paloaltonetworks.com>
Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b166a20b
    • Lijun Pan's avatar
      ibmvnic: correctly use dev_consume/free_skb_irq · ca09bf7b
      Lijun Pan authored 
      It is more correct to use dev_kfree_skb_irq when packets are dropped,
and to use dev_consume_skb_irq when packets are consumed.

Fixes: 0d973388

 ("ibmvnic: Introduce xmit_more support using batched subCRQ hcalls")
Suggested-by: default avatarThomas Falcon <tlfalcon@linux.ibm.com>
Signed-off-by: default avatarLijun Pan <lijunp213@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ca09bf7b
    • Jonathon Reinhart's avatar
      net: Make tcp_allowed_congestion_control readonly in non-init netns · 97684f09
      Jonathon Reinhart authored 
      Currently, tcp_allowed_congestion_control is global and writable;
writing to it in any net namespace will leak into all other net
namespaces.

tcp_available_congestion_control and tcp_allowed_congestion_control are
the only sysctls in ipv4_net_table (the per-netns sysctl table) with a
NULL data pointer; their handlers (proc_tcp_available_congestion_control
and proc_allowed_congestion_control) have no other way of referencing a
struct net. Thus, they operate globally.

Because ipv4_net_table does not use designated initializers, there is no
easy way to fix up this one "bad" table entry. However, the data pointer
updating logic shouldn't be applied to NULL pointers anyway, so we
instead force these entries to be read-only.

These sysctls used to exist in ipv4_table (init-net only), but they were
moved to the per-net ipv4_net_table, presumably without realizing that
tcp_allowed_congestion_control was writable and thus introduced a leak.

Because the intent of that commit was only to know (i.e. read) "which
congestion algorithms are available or allowed", this read-only solution
should be sufficient.

The logic added in recent commit
31c4d2f1: ("net: Ensure net namespace isolation of sysctls")
does not and cannot check for NULL data pointers, because
other table entries (e.g. /proc/sys/net/netfilter/nf_log/) have
.data=NULL but use other methods (.extra2) to access the struct net.

Fixes: 9cb8e048

 ("net/ipv4/sysctl: show tcp_{allowed, available}_congestion_control in non-initial netns")
Signed-off-by: default avatarJonathon Reinhart <jonathon.reinhart@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      97684f09
    • David S. Miller's avatar
      Merge branch 'catch-all-devices' · 61aaa1aa
      David S. Miller authored 
      

Hristo Venev says:

====================
net: Fix two use-after-free bugs

The two patches fix two use-after-free bugs related to cleaning up
network namespaces, one in sit and one in ip6_tunnel. They are easy to
trigger if the user has the ability to create network namespaces.

The bugs can be used to trigger null pointer dereferences. I am not
sure if they can be exploited further, but I would guess that they
can. I am not sending them to the mailing list without confirmation
that doing so would be OK.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      61aaa1aa
    • Hristo Venev's avatar
      net: ip6_tunnel: Unregister catch-all devices · 941ea91e
      Hristo Venev authored 
      Similarly to the sit case, we need to remove the tunnels with no
addresses that have been moved to another network namespace.

Fixes: 0bd87628

 ("ip6tnl: add x-netns support")
Signed-off-by: default avatarHristo Venev <hristo@venev.name>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      941ea91e
    • Hristo Venev's avatar
      net: sit: Unregister catch-all devices · 610f8c0f
      Hristo Venev authored 
      A sit interface created without a local or a remote address is linked
into the `sit_net::tunnels_wc` list of its original namespace. When
deleting a network namespace, delete the devices that have been moved.

The following script triggers a null pointer dereference if devices
linked in a deleted `sit_net` remain:

    for i in `seq 1 30`; do
        ip netns add ns-test
        ip netns exec ns-test ip link add dev veth0 type veth peer veth1
        ip netns exec ns-test ip link add dev sit$i type sit dev veth0
        ip netns exec ns-test ip link set dev sit$i netns $$
        ip netns del ns-test
    done
    for i in `seq 1 30`; do
        ip link del dev sit$i
    done

Fixes: 5e6700b3

 ("sit: add support of x-netns")
Signed-off-by: default avatarHristo Venev <hristo@venev.name>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      610f8c0f
    • Colin Ian King's avatar
      ice: Fix potential infinite loop when using u8 loop counter · ef963ae4
      Colin Ian King authored 
      A for-loop is using a u8 loop counter that is being compared to
a u32 cmp_dcbcfg->numapp to check for the end of the loop. If
cmp_dcbcfg->numapp is larger than 255 then the counter j will wrap
around to zero and hence an infinite loop occurs. Fix this by making
counter j the same type as cmp_dcbcfg->numapp.

Addresses-Coverity: ("Infinite loop")
Fixes: aeac8ce8

 ("ice: Recognize 860 as iSCSI port in CEE mode")
Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
Tested-by: default avatarTony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      ef963ae4
    • Yongxin Liu's avatar
      ixgbe: fix unbalanced device enable/disable in suspend/resume · debb9df3
      Yongxin Liu authored 
      pci_disable_device() called in __ixgbe_shutdown() decreases
dev->enable_cnt by 1. pci_enable_device_mem() which increases
dev->enable_cnt by 1, was removed from ixgbe_resume() in commit
6f82b255 ("ixgbe: use generic power management"). This caused
unbalanced increase/decrease. So add pci_enable_device_mem() back.

Fix the following call trace.

  ixgbe 0000:17:00.1: disabling already-disabled device
  Call Trace:
   __ixgbe_shutdown+0x10a/0x1e0 [ixgbe]
   ixgbe_suspend+0x32/0x70 [ixgbe]
   pci_pm_suspend+0x87/0x160
   ? pci_pm_freeze+0xd0/0xd0
   dpm_run_callback+0x42/0x170
   __device_suspend+0x114/0x460
   async_suspend+0x1f/0xa0
   async_run_entry_fn+0x3c/0xf0
   process_one_work+0x1dd/0x410
   worker_thread+0x34/0x3f0
   ? cancel_delayed_work+0x90/0x90
   kthread+0x14c/0x170
   ? kthread_park+0x90/0x90
   ret_from_fork+0x1f/0x30

Fixes: 6f82b255

 ("ixgbe: use generic power management")
Signed-off-by: default avatarYongxin Liu <yongxin.liu@windriver.com>
Tested-by: default avatarDave Switzer <david.switzer@intel.com>
Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      debb9df3
    • Alexander Duyck's avatar
      ixgbe: Fix NULL pointer dereference in ethtool loopback test · 31166efb
      Alexander Duyck authored 
      The ixgbe driver currently generates a NULL pointer dereference when
performing the ethtool loopback test. This is due to the fact that there
isn't a q_vector associated with the test ring when it is setup as
interrupts are not normally added to the test rings.

To address this I have added code that will check for a q_vector before
returning a napi_id value. If a q_vector is not present it will return a
value of 0.

Fixes: b02e5a0e

 ("xsk: Propagate napi_id to XDP socket Rx path")
Signed-off-by: default avatarAlexander Duyck <alexanderduyck@fb.com>
Acked-by: default avatarBjörn Töpel <bjorn.topel@intel.com>
Tested-by: default avatarDave Switzer <david.switzer@intel.com>
Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      31166efb
  9. Apr 13, 2021
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · ccb39c62
      David S. Miller authored 
      

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) Fix NAT IPv6 offload in the flowtable.

2) icmpv6 is printed as unknown in /proc/net/nf_conntrack.

3) Use div64_u64() in nft_limit, from Eric Dumazet.

4) Use pre_exit to unregister ebtables and arptables hooks,
   from Florian Westphal.

5) Fix out-of-bound memset in x_tables compat match/target,
   also from Florian.

6) Clone set elements expression to ensure proper initialization.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ccb39c62
    • Pablo Neira Ayuso's avatar
      netfilter: nftables: clone set element expression template · 4d8f9065
      Pablo Neira Ayuso authored 
      

memcpy() breaks when using connlimit in set elements. Use
nft_expr_clone() to initialize the connlimit expression list, otherwise
connlimit garbage collector crashes when walking on the list head copy.

[  493.064656] Workqueue: events_power_efficient nft_rhash_gc [nf_tables]
[  493.064685] RIP: 0010:find_or_evict+0x5a/0x90 [nf_conncount]
[  493.064694] Code: 2b 43 40 83 f8 01 77 0d 48 c7 c0 f5 ff ff ff 44 39 63 3c 75 df 83 6d 18 01 48 8b 43 08 48 89 de 48 8b 13 48 8b 3d ee 2f 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 03 48 83
[  493.064699] RSP: 0018:ffffc90000417dc0 EFLAGS: 00010297
[  493.064704] RAX: 0000000000000000 RBX: ffff888134f38410 RCX: 0000000000000000
[  493.064708] RDX: 0000000000000000 RSI: ffff888134f38410 RDI: ffff888100060cc0
[  493.064711] RBP: ffff88812ce594a8 R08: ffff888134f38438 R09: 00000000ebb9025c
[  493.064714] R10: ffffffff8219f838 R11: 0000000000000017 R12: 0000000000000001
[  493.064718] R13: ffffffff82146740 R14: ffff888134f38410 R15: 0000000000000000
[  493.064721] FS:  0000000000000000(0000) GS:ffff88840e440000(0000) knlGS:0000000000000000
[  493.064725] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  493.064729] CR2: 0000000000000008 CR3: 00000001330aa002 CR4: 00000000001706e0
[  493.064733] Call Trace:
[  493.064737]  nf_conncount_gc_list+0x8f/0x150 [nf_conncount]
[  493.064746]  nft_rhash_gc+0x106/0x390 [nf_tables]

Reported-by: default avatarLaura Garcia Liebana <nevola@gmail.com>
Fixes: 40944452

 ("netfilter: nf_tables: add elements with stateful expressions")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      4d8f9065
    • Florian Westphal's avatar
      netfilter: x_tables: fix compat match/target pad out-of-bound write · b29c457a
      Florian Westphal authored 
      

xt_compat_match/target_from_user doesn't check that zeroing the area
to start of next rule won't write past end of allocated ruleset blob.

Remove this code and zero the entire blob beforehand.

Reported-by: default avatar <syzbot+cfc0247ac173f597aaaa@syzkaller.appspotmail.com>
Reported-by: default avatarAndy Nguyen <theflow@google.com>
Fixes: 9fa492cd

 ("[NETFILTER]: x_tables: simplify compat API")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      b29c457a
    • Jakub Kicinski's avatar
      ethtool: fix kdoc attr name · f33b0e19
      Jakub Kicinski authored 
      

Add missing 't' in attrtype.

Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f33b0e19
    • Pali Rohár's avatar
      net: phy: marvell: fix detection of PHY on Topaz switches · 1fe976d3
      Pali Rohár authored 
      Since commit fee2d546

 ("net: phy: marvell: mv88e6390 temperature
sensor reading"), Linux reports the temperature of Topaz hwmon as
constant -75°C.

This is because switches from the Topaz family (88E6141 / 88E6341) have
the address of the temperature sensor register different from Peridot.

This address is instead compatible with 88E1510 PHYs, as was used for
Topaz before the above mentioned commit.

Create a new mapping table between switch family and PHY ID for families
which don't have a model number. And define PHY IDs for Topaz and Peridot
families.

Create a new PHY ID and a new PHY driver for Topaz's internal PHY.
The only difference from Peridot's PHY driver is the HWMON probing
method.

Prior this change Topaz's internal PHY is detected by kernel as:

  PHY [...] driver [Marvell 88E6390] (irq=63)

And afterwards as:

  PHY [...] driver [Marvell 88E6341 Family] (irq=63)

Signed-off-by: default avatarPali Rohár <pali@kernel.org>
BugLink: https://github.com/globalscaletechnologies/linux/issues/1
Fixes: fee2d546

 ("net: phy: marvell: mv88e6390 temperature sensor reading")
Reviewed-by: default avatarMarek Behún <kabel@kernel.org>
Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1fe976d3
  11. Apr 12, 2021