<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/drivers/net/netdevsim, branch v5.4.148</title>
<subtitle>Clone of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git</subtitle>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/'/>
<entry>
<title>netdevsim: init u64 stats for 32bit hardware</title>
<updated>2021-03-17T16:03:35+00:00</updated>
<author>
<name>Hillf Danton</name>
<email>hdanton@sina.com</email>
</author>
<published>2021-03-04T18:30:09+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=6d599697e9a8958ea4ba1428e9dfebd7d0c560e0'/>
<id>6d599697e9a8958ea4ba1428e9dfebd7d0c560e0</id>
<content type='text'>
commit 863a42b289c22df63db62b10fc2c2ffc237e2125 upstream.

Init the u64 stats in order to avoid the lockdep prints on the 32bit
hardware like

 INFO: trying to register non-static key.
 the code is fine but needs lockdep annotation.
 turning off the locking correctness validator.
 CPU: 0 PID: 4695 Comm: syz-executor.0 Not tainted 5.11.0-rc5-syzkaller #0
 Hardware name: ARM-Versatile Express
 Backtrace:
 [&lt;826fc5b8&gt;] (dump_backtrace) from [&lt;826fc82c&gt;] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252)
 [&lt;826fc814&gt;] (show_stack) from [&lt;8270d1f8&gt;] (__dump_stack lib/dump_stack.c:79 [inline])
 [&lt;826fc814&gt;] (show_stack) from [&lt;8270d1f8&gt;] (dump_stack+0xa8/0xc8 lib/dump_stack.c:120)
 [&lt;8270d150&gt;] (dump_stack) from [&lt;802bf9c0&gt;] (assign_lock_key kernel/locking/lockdep.c:935 [inline])
 [&lt;8270d150&gt;] (dump_stack) from [&lt;802bf9c0&gt;] (register_lock_class+0xabc/0xb68 kernel/locking/lockdep.c:1247)
 [&lt;802bef04&gt;] (register_lock_class) from [&lt;802baa2c&gt;] (__lock_acquire+0x84/0x32d4 kernel/locking/lockdep.c:4711)
 [&lt;802ba9a8&gt;] (__lock_acquire) from [&lt;802be840&gt;] (lock_acquire.part.0+0xf0/0x554 kernel/locking/lockdep.c:5442)
 [&lt;802be750&gt;] (lock_acquire.part.0) from [&lt;802bed10&gt;] (lock_acquire+0x6c/0x74 kernel/locking/lockdep.c:5415)
 [&lt;802beca4&gt;] (lock_acquire) from [&lt;81560548&gt;] (seqcount_lockdep_reader_access include/linux/seqlock.h:103 [inline])
 [&lt;802beca4&gt;] (lock_acquire) from [&lt;81560548&gt;] (__u64_stats_fetch_begin include/linux/u64_stats_sync.h:164 [inline])
 [&lt;802beca4&gt;] (lock_acquire) from [&lt;81560548&gt;] (u64_stats_fetch_begin include/linux/u64_stats_sync.h:175 [inline])
 [&lt;802beca4&gt;] (lock_acquire) from [&lt;81560548&gt;] (nsim_get_stats64+0xdc/0xf0 drivers/net/netdevsim/netdev.c:70)
 [&lt;8156046c&gt;] (nsim_get_stats64) from [&lt;81e2efa0&gt;] (dev_get_stats+0x44/0xd0 net/core/dev.c:10405)
 [&lt;81e2ef5c&gt;] (dev_get_stats) from [&lt;81e53204&gt;] (rtnl_fill_stats+0x38/0x120 net/core/rtnetlink.c:1211)
 [&lt;81e531cc&gt;] (rtnl_fill_stats) from [&lt;81e59d58&gt;] (rtnl_fill_ifinfo+0x6d4/0x148c net/core/rtnetlink.c:1783)
 [&lt;81e59684&gt;] (rtnl_fill_ifinfo) from [&lt;81e5ceb4&gt;] (rtmsg_ifinfo_build_skb+0x9c/0x108 net/core/rtnetlink.c:3798)
 [&lt;81e5ce18&gt;] (rtmsg_ifinfo_build_skb) from [&lt;81e5d0ac&gt;] (rtmsg_ifinfo_event net/core/rtnetlink.c:3830 [inline])
 [&lt;81e5ce18&gt;] (rtmsg_ifinfo_build_skb) from [&lt;81e5d0ac&gt;] (rtmsg_ifinfo_event net/core/rtnetlink.c:3821 [inline])
 [&lt;81e5ce18&gt;] (rtmsg_ifinfo_build_skb) from [&lt;81e5d0ac&gt;] (rtmsg_ifinfo+0x44/0x70 net/core/rtnetlink.c:3839)
 [&lt;81e5d068&gt;] (rtmsg_ifinfo) from [&lt;81e45c2c&gt;] (register_netdevice+0x664/0x68c net/core/dev.c:10103)
 [&lt;81e455c8&gt;] (register_netdevice) from [&lt;815608bc&gt;] (nsim_create+0xf8/0x124 drivers/net/netdevsim/netdev.c:317)
 [&lt;815607c4&gt;] (nsim_create) from [&lt;81561184&gt;] (__nsim_dev_port_add+0x108/0x188 drivers/net/netdevsim/dev.c:941)
 [&lt;8156107c&gt;] (__nsim_dev_port_add) from [&lt;815620d8&gt;] (nsim_dev_port_add_all drivers/net/netdevsim/dev.c:990 [inline])
 [&lt;8156107c&gt;] (__nsim_dev_port_add) from [&lt;815620d8&gt;] (nsim_dev_probe+0x5cc/0x750 drivers/net/netdevsim/dev.c:1119)
 [&lt;81561b0c&gt;] (nsim_dev_probe) from [&lt;815661dc&gt;] (nsim_bus_probe+0x10/0x14 drivers/net/netdevsim/bus.c:287)
 [&lt;815661cc&gt;] (nsim_bus_probe) from [&lt;811724c0&gt;] (really_probe+0x100/0x50c drivers/base/dd.c:554)
 [&lt;811723c0&gt;] (really_probe) from [&lt;811729c4&gt;] (driver_probe_device+0xf8/0x1c8 drivers/base/dd.c:740)
 [&lt;811728cc&gt;] (driver_probe_device) from [&lt;81172fe4&gt;] (__device_attach_driver+0x8c/0xf0 drivers/base/dd.c:846)
 [&lt;81172f58&gt;] (__device_attach_driver) from [&lt;8116fee0&gt;] (bus_for_each_drv+0x88/0xd8 drivers/base/bus.c:431)
 [&lt;8116fe58&gt;] (bus_for_each_drv) from [&lt;81172c6c&gt;] (__device_attach+0xdc/0x1d0 drivers/base/dd.c:914)
 [&lt;81172b90&gt;] (__device_attach) from [&lt;8117305c&gt;] (device_initial_probe+0x14/0x18 drivers/base/dd.c:961)
 [&lt;81173048&gt;] (device_initial_probe) from [&lt;81171358&gt;] (bus_probe_device+0x90/0x98 drivers/base/bus.c:491)
 [&lt;811712c8&gt;] (bus_probe_device) from [&lt;8116e77c&gt;] (device_add+0x320/0x824 drivers/base/core.c:3109)
 [&lt;8116e45c&gt;] (device_add) from [&lt;8116ec9c&gt;] (device_register+0x1c/0x20 drivers/base/core.c:3182)
 [&lt;8116ec80&gt;] (device_register) from [&lt;81566710&gt;] (nsim_bus_dev_new drivers/net/netdevsim/bus.c:336 [inline])
 [&lt;8116ec80&gt;] (device_register) from [&lt;81566710&gt;] (new_device_store+0x178/0x208 drivers/net/netdevsim/bus.c:215)
 [&lt;81566598&gt;] (new_device_store) from [&lt;8116fcb4&gt;] (bus_attr_store+0x2c/0x38 drivers/base/bus.c:122)
 [&lt;8116fc88&gt;] (bus_attr_store) from [&lt;805b4b8c&gt;] (sysfs_kf_write+0x48/0x54 fs/sysfs/file.c:139)
 [&lt;805b4b44&gt;] (sysfs_kf_write) from [&lt;805b3c90&gt;] (kernfs_fop_write_iter+0x128/0x1ec fs/kernfs/file.c:296)
 [&lt;805b3b68&gt;] (kernfs_fop_write_iter) from [&lt;804d22fc&gt;] (call_write_iter include/linux/fs.h:1901 [inline])
 [&lt;805b3b68&gt;] (kernfs_fop_write_iter) from [&lt;804d22fc&gt;] (new_sync_write fs/read_write.c:518 [inline])
 [&lt;805b3b68&gt;] (kernfs_fop_write_iter) from [&lt;804d22fc&gt;] (vfs_write+0x3dc/0x57c fs/read_write.c:605)
 [&lt;804d1f20&gt;] (vfs_write) from [&lt;804d2604&gt;] (ksys_write+0x68/0xec fs/read_write.c:658)
 [&lt;804d259c&gt;] (ksys_write) from [&lt;804d2698&gt;] (__do_sys_write fs/read_write.c:670 [inline])
 [&lt;804d259c&gt;] (ksys_write) from [&lt;804d2698&gt;] (sys_write+0x10/0x14 fs/read_write.c:667)
 [&lt;804d2688&gt;] (sys_write) from [&lt;80200060&gt;] (ret_fast_syscall+0x0/0x2c arch/arm/mm/proc-v7.S:64)

Fixes: 83c9e13aa39a ("netdevsim: add software driver for testing offloads")
Reported-by: syzbot+e74a6857f2d0efe3ad81@syzkaller.appspotmail.com
Tested-by: Dmitry Vyukov &lt;dvyukov@google.com&gt;
Signed-off-by: Hillf Danton &lt;hdanton@sina.com&gt;
Signed-off-by: Jakub Kicinski &lt;kuba@kernel.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 863a42b289c22df63db62b10fc2c2ffc237e2125 upstream.

Init the u64 stats in order to avoid the lockdep prints on the 32bit
hardware like

 INFO: trying to register non-static key.
 the code is fine but needs lockdep annotation.
 turning off the locking correctness validator.
 CPU: 0 PID: 4695 Comm: syz-executor.0 Not tainted 5.11.0-rc5-syzkaller #0
 Hardware name: ARM-Versatile Express
 Backtrace:
 [&lt;826fc5b8&gt;] (dump_backtrace) from [&lt;826fc82c&gt;] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252)
 [&lt;826fc814&gt;] (show_stack) from [&lt;8270d1f8&gt;] (__dump_stack lib/dump_stack.c:79 [inline])
 [&lt;826fc814&gt;] (show_stack) from [&lt;8270d1f8&gt;] (dump_stack+0xa8/0xc8 lib/dump_stack.c:120)
 [&lt;8270d150&gt;] (dump_stack) from [&lt;802bf9c0&gt;] (assign_lock_key kernel/locking/lockdep.c:935 [inline])
 [&lt;8270d150&gt;] (dump_stack) from [&lt;802bf9c0&gt;] (register_lock_class+0xabc/0xb68 kernel/locking/lockdep.c:1247)
 [&lt;802bef04&gt;] (register_lock_class) from [&lt;802baa2c&gt;] (__lock_acquire+0x84/0x32d4 kernel/locking/lockdep.c:4711)
 [&lt;802ba9a8&gt;] (__lock_acquire) from [&lt;802be840&gt;] (lock_acquire.part.0+0xf0/0x554 kernel/locking/lockdep.c:5442)
 [&lt;802be750&gt;] (lock_acquire.part.0) from [&lt;802bed10&gt;] (lock_acquire+0x6c/0x74 kernel/locking/lockdep.c:5415)
 [&lt;802beca4&gt;] (lock_acquire) from [&lt;81560548&gt;] (seqcount_lockdep_reader_access include/linux/seqlock.h:103 [inline])
 [&lt;802beca4&gt;] (lock_acquire) from [&lt;81560548&gt;] (__u64_stats_fetch_begin include/linux/u64_stats_sync.h:164 [inline])
 [&lt;802beca4&gt;] (lock_acquire) from [&lt;81560548&gt;] (u64_stats_fetch_begin include/linux/u64_stats_sync.h:175 [inline])
 [&lt;802beca4&gt;] (lock_acquire) from [&lt;81560548&gt;] (nsim_get_stats64+0xdc/0xf0 drivers/net/netdevsim/netdev.c:70)
 [&lt;8156046c&gt;] (nsim_get_stats64) from [&lt;81e2efa0&gt;] (dev_get_stats+0x44/0xd0 net/core/dev.c:10405)
 [&lt;81e2ef5c&gt;] (dev_get_stats) from [&lt;81e53204&gt;] (rtnl_fill_stats+0x38/0x120 net/core/rtnetlink.c:1211)
 [&lt;81e531cc&gt;] (rtnl_fill_stats) from [&lt;81e59d58&gt;] (rtnl_fill_ifinfo+0x6d4/0x148c net/core/rtnetlink.c:1783)
 [&lt;81e59684&gt;] (rtnl_fill_ifinfo) from [&lt;81e5ceb4&gt;] (rtmsg_ifinfo_build_skb+0x9c/0x108 net/core/rtnetlink.c:3798)
 [&lt;81e5ce18&gt;] (rtmsg_ifinfo_build_skb) from [&lt;81e5d0ac&gt;] (rtmsg_ifinfo_event net/core/rtnetlink.c:3830 [inline])
 [&lt;81e5ce18&gt;] (rtmsg_ifinfo_build_skb) from [&lt;81e5d0ac&gt;] (rtmsg_ifinfo_event net/core/rtnetlink.c:3821 [inline])
 [&lt;81e5ce18&gt;] (rtmsg_ifinfo_build_skb) from [&lt;81e5d0ac&gt;] (rtmsg_ifinfo+0x44/0x70 net/core/rtnetlink.c:3839)
 [&lt;81e5d068&gt;] (rtmsg_ifinfo) from [&lt;81e45c2c&gt;] (register_netdevice+0x664/0x68c net/core/dev.c:10103)
 [&lt;81e455c8&gt;] (register_netdevice) from [&lt;815608bc&gt;] (nsim_create+0xf8/0x124 drivers/net/netdevsim/netdev.c:317)
 [&lt;815607c4&gt;] (nsim_create) from [&lt;81561184&gt;] (__nsim_dev_port_add+0x108/0x188 drivers/net/netdevsim/dev.c:941)
 [&lt;8156107c&gt;] (__nsim_dev_port_add) from [&lt;815620d8&gt;] (nsim_dev_port_add_all drivers/net/netdevsim/dev.c:990 [inline])
 [&lt;8156107c&gt;] (__nsim_dev_port_add) from [&lt;815620d8&gt;] (nsim_dev_probe+0x5cc/0x750 drivers/net/netdevsim/dev.c:1119)
 [&lt;81561b0c&gt;] (nsim_dev_probe) from [&lt;815661dc&gt;] (nsim_bus_probe+0x10/0x14 drivers/net/netdevsim/bus.c:287)
 [&lt;815661cc&gt;] (nsim_bus_probe) from [&lt;811724c0&gt;] (really_probe+0x100/0x50c drivers/base/dd.c:554)
 [&lt;811723c0&gt;] (really_probe) from [&lt;811729c4&gt;] (driver_probe_device+0xf8/0x1c8 drivers/base/dd.c:740)
 [&lt;811728cc&gt;] (driver_probe_device) from [&lt;81172fe4&gt;] (__device_attach_driver+0x8c/0xf0 drivers/base/dd.c:846)
 [&lt;81172f58&gt;] (__device_attach_driver) from [&lt;8116fee0&gt;] (bus_for_each_drv+0x88/0xd8 drivers/base/bus.c:431)
 [&lt;8116fe58&gt;] (bus_for_each_drv) from [&lt;81172c6c&gt;] (__device_attach+0xdc/0x1d0 drivers/base/dd.c:914)
 [&lt;81172b90&gt;] (__device_attach) from [&lt;8117305c&gt;] (device_initial_probe+0x14/0x18 drivers/base/dd.c:961)
 [&lt;81173048&gt;] (device_initial_probe) from [&lt;81171358&gt;] (bus_probe_device+0x90/0x98 drivers/base/bus.c:491)
 [&lt;811712c8&gt;] (bus_probe_device) from [&lt;8116e77c&gt;] (device_add+0x320/0x824 drivers/base/core.c:3109)
 [&lt;8116e45c&gt;] (device_add) from [&lt;8116ec9c&gt;] (device_register+0x1c/0x20 drivers/base/core.c:3182)
 [&lt;8116ec80&gt;] (device_register) from [&lt;81566710&gt;] (nsim_bus_dev_new drivers/net/netdevsim/bus.c:336 [inline])
 [&lt;8116ec80&gt;] (device_register) from [&lt;81566710&gt;] (new_device_store+0x178/0x208 drivers/net/netdevsim/bus.c:215)
 [&lt;81566598&gt;] (new_device_store) from [&lt;8116fcb4&gt;] (bus_attr_store+0x2c/0x38 drivers/base/bus.c:122)
 [&lt;8116fc88&gt;] (bus_attr_store) from [&lt;805b4b8c&gt;] (sysfs_kf_write+0x48/0x54 fs/sysfs/file.c:139)
 [&lt;805b4b44&gt;] (sysfs_kf_write) from [&lt;805b3c90&gt;] (kernfs_fop_write_iter+0x128/0x1ec fs/kernfs/file.c:296)
 [&lt;805b3b68&gt;] (kernfs_fop_write_iter) from [&lt;804d22fc&gt;] (call_write_iter include/linux/fs.h:1901 [inline])
 [&lt;805b3b68&gt;] (kernfs_fop_write_iter) from [&lt;804d22fc&gt;] (new_sync_write fs/read_write.c:518 [inline])
 [&lt;805b3b68&gt;] (kernfs_fop_write_iter) from [&lt;804d22fc&gt;] (vfs_write+0x3dc/0x57c fs/read_write.c:605)
 [&lt;804d1f20&gt;] (vfs_write) from [&lt;804d2604&gt;] (ksys_write+0x68/0xec fs/read_write.c:658)
 [&lt;804d259c&gt;] (ksys_write) from [&lt;804d2698&gt;] (__do_sys_write fs/read_write.c:670 [inline])
 [&lt;804d259c&gt;] (ksys_write) from [&lt;804d2698&gt;] (sys_write+0x10/0x14 fs/read_write.c:667)
 [&lt;804d2688&gt;] (sys_write) from [&lt;80200060&gt;] (ret_fast_syscall+0x0/0x2c arch/arm/mm/proc-v7.S:64)

Fixes: 83c9e13aa39a ("netdevsim: add software driver for testing offloads")
Reported-by: syzbot+e74a6857f2d0efe3ad81@syzkaller.appspotmail.com
Tested-by: Dmitry Vyukov &lt;dvyukov@google.com&gt;
Signed-off-by: Hillf Danton &lt;hdanton@sina.com&gt;
Signed-off-by: Jakub Kicinski &lt;kuba@kernel.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>netdevsim: fix unbalaced locking in nsim_create()</title>
<updated>2020-07-29T08:18:33+00:00</updated>
<author>
<name>Taehee Yoo</name>
<email>ap420073@gmail.com</email>
</author>
<published>2020-07-21T14:51:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=8d416c038a914c2b5c9f7042db932130c47b8ba4'/>
<id>8d416c038a914c2b5c9f7042db932130c47b8ba4</id>
<content type='text'>
[ Upstream commit 2c9d8e01f0c6017317eee7638496173d4a64e6bc ]

In the nsim_create(), rtnl_lock() is called before nsim_bpf_init().
If nsim_bpf_init() is failed, rtnl_unlock() should be called,
but it isn't called.
So, unbalanced locking would occur.

Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
Signed-off-by: Taehee Yoo &lt;ap420073@gmail.com&gt;
Reviewed-by: Jakub Kicinski &lt;kuba@kernel.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 2c9d8e01f0c6017317eee7638496173d4a64e6bc ]

In the nsim_create(), rtnl_lock() is called before nsim_bpf_init().
If nsim_bpf_init() is failed, rtnl_unlock() should be called,
but it isn't called.
So, unbalanced locking would occur.

Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
Signed-off-by: Taehee Yoo &lt;ap420073@gmail.com&gt;
Reviewed-by: Jakub Kicinski &lt;kuba@kernel.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>netdevsim: fix stack-out-of-bounds in nsim_dev_debugfs_init()</title>
<updated>2020-02-11T12:35:06+00:00</updated>
<author>
<name>Taehee Yoo</name>
<email>ap420073@gmail.com</email>
</author>
<published>2020-02-01T16:43:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=fddd3f73ad0891dcafd78a6b8595ea7dda30bcab'/>
<id>fddd3f73ad0891dcafd78a6b8595ea7dda30bcab</id>
<content type='text'>
[ Upstream commit 6fb8852b1298200da39bd85788bc5755d1d56f32 ]

When netdevsim dev is being created, a debugfs directory is created.
The variable "dev_ddir_name" is 16bytes device name pointer and device
name is "netdevsim&lt;dev id&gt;".
The maximum dev id length is 10.
So, 16bytes for device name isn't enough.

Test commands:
    modprobe netdevsim
    echo "1000000000 0" &gt; /sys/bus/netdevsim/new_device

Splat looks like:
[  249.622710][  T900] BUG: KASAN: stack-out-of-bounds in number+0x824/0x880
[  249.623658][  T900] Write of size 1 at addr ffff88804c527988 by task bash/900
[  249.624521][  T900]
[  249.624830][  T900] CPU: 1 PID: 900 Comm: bash Not tainted 5.5.0+ #322
[  249.625691][  T900] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[  249.626712][  T900] Call Trace:
[  249.627103][  T900]  dump_stack+0x96/0xdb
[  249.627639][  T900]  ? number+0x824/0x880
[  249.628173][  T900]  print_address_description.constprop.5+0x1be/0x360
[  249.629022][  T900]  ? number+0x824/0x880
[  249.629569][  T900]  ? number+0x824/0x880
[  249.630105][  T900]  __kasan_report+0x12a/0x170
[  249.630717][  T900]  ? number+0x824/0x880
[  249.631201][  T900]  kasan_report+0xe/0x20
[  249.631723][  T900]  number+0x824/0x880
[  249.632235][  T900]  ? put_dec+0xa0/0xa0
[  249.632716][  T900]  ? rcu_read_lock_sched_held+0x90/0xc0
[  249.633392][  T900]  vsnprintf+0x63c/0x10b0
[  249.633983][  T900]  ? pointer+0x5b0/0x5b0
[  249.634543][  T900]  ? mark_lock+0x11d/0xc40
[  249.635200][  T900]  sprintf+0x9b/0xd0
[  249.635750][  T900]  ? scnprintf+0xe0/0xe0
[  249.636370][  T900]  nsim_dev_probe+0x63c/0xbf0 [netdevsim]
[ ... ]

Reviewed-by: Jakub Kicinski &lt;kuba@kernel.org&gt;
Fixes: ab1d0cc004d7 ("netdevsim: change debugfs tree topology")
Signed-off-by: Taehee Yoo &lt;ap420073@gmail.com&gt;
Signed-off-by: Jakub Kicinski &lt;kuba@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 6fb8852b1298200da39bd85788bc5755d1d56f32 ]

When netdevsim dev is being created, a debugfs directory is created.
The variable "dev_ddir_name" is 16bytes device name pointer and device
name is "netdevsim&lt;dev id&gt;".
The maximum dev id length is 10.
So, 16bytes for device name isn't enough.

Test commands:
    modprobe netdevsim
    echo "1000000000 0" &gt; /sys/bus/netdevsim/new_device

Splat looks like:
[  249.622710][  T900] BUG: KASAN: stack-out-of-bounds in number+0x824/0x880
[  249.623658][  T900] Write of size 1 at addr ffff88804c527988 by task bash/900
[  249.624521][  T900]
[  249.624830][  T900] CPU: 1 PID: 900 Comm: bash Not tainted 5.5.0+ #322
[  249.625691][  T900] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[  249.626712][  T900] Call Trace:
[  249.627103][  T900]  dump_stack+0x96/0xdb
[  249.627639][  T900]  ? number+0x824/0x880
[  249.628173][  T900]  print_address_description.constprop.5+0x1be/0x360
[  249.629022][  T900]  ? number+0x824/0x880
[  249.629569][  T900]  ? number+0x824/0x880
[  249.630105][  T900]  __kasan_report+0x12a/0x170
[  249.630717][  T900]  ? number+0x824/0x880
[  249.631201][  T900]  kasan_report+0xe/0x20
[  249.631723][  T900]  number+0x824/0x880
[  249.632235][  T900]  ? put_dec+0xa0/0xa0
[  249.632716][  T900]  ? rcu_read_lock_sched_held+0x90/0xc0
[  249.633392][  T900]  vsnprintf+0x63c/0x10b0
[  249.633983][  T900]  ? pointer+0x5b0/0x5b0
[  249.634543][  T900]  ? mark_lock+0x11d/0xc40
[  249.635200][  T900]  sprintf+0x9b/0xd0
[  249.635750][  T900]  ? scnprintf+0xe0/0xe0
[  249.636370][  T900]  nsim_dev_probe+0x63c/0xbf0 [netdevsim]
[ ... ]

Reviewed-by: Jakub Kicinski &lt;kuba@kernel.org&gt;
Fixes: ab1d0cc004d7 ("netdevsim: change debugfs tree topology")
Signed-off-by: Taehee Yoo &lt;ap420073@gmail.com&gt;
Signed-off-by: Jakub Kicinski &lt;kuba@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>devlink: disallow reload operation during device cleanup</title>
<updated>2019-11-10T03:38:36+00:00</updated>
<author>
<name>Jiri Pirko</name>
<email>jiri@mellanox.com</email>
</author>
<published>2019-11-09T10:29:46+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=5a508a254bed9a2e36a5fb96c9065532a6bf1e9c'/>
<id>5a508a254bed9a2e36a5fb96c9065532a6bf1e9c</id>
<content type='text'>
There is a race between driver code that does setup/cleanup of device
and devlink reload operation that in some drivers works with the same
code. Use after free could we easily obtained by running:

while true; do
        echo "0000:00:10.0" &gt;/sys/bus/pci/drivers/mlxsw_spectrum2/bind
        devlink dev reload pci/0000:00:10.0 &amp;
        echo "0000:00:10.0" &gt;/sys/bus/pci/drivers/mlxsw_spectrum2/unbind
done

Fix this by enabling reload only after setup of device is complete and
disabling it at the beginning of the cleanup process.

Reported-by: Ido Schimmel &lt;idosch@mellanox.com&gt;
Fixes: 2d8dc5bbf4e7 ("devlink: Add support for reload")
Signed-off-by: Jiri Pirko &lt;jiri@mellanox.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
There is a race between driver code that does setup/cleanup of device
and devlink reload operation that in some drivers works with the same
code. Use after free could we easily obtained by running:

while true; do
        echo "0000:00:10.0" &gt;/sys/bus/pci/drivers/mlxsw_spectrum2/bind
        devlink dev reload pci/0000:00:10.0 &amp;
        echo "0000:00:10.0" &gt;/sys/bus/pci/drivers/mlxsw_spectrum2/unbind
done

Fix this by enabling reload only after setup of device is complete and
disabling it at the beginning of the cleanup process.

Reported-by: Ido Schimmel &lt;idosch@mellanox.com&gt;
Fixes: 2d8dc5bbf4e7 ("devlink: Add support for reload")
Signed-off-by: Jiri Pirko &lt;jiri@mellanox.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>netdevsim: Fix use-after-free during device dismantle</title>
<updated>2019-10-31T19:35:14+00:00</updated>
<author>
<name>Ido Schimmel</name>
<email>idosch@mellanox.com</email>
</author>
<published>2019-10-31T16:20:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=6d6f0383b697f004c65823c2b64240912f18515d'/>
<id>6d6f0383b697f004c65823c2b64240912f18515d</id>
<content type='text'>
Commit da58f90f11f5 ("netdevsim: Add devlink-trap support") added
delayed work to netdevsim that periodically iterates over the registered
netdevsim ports and reports various packet traps via devlink.

While the delayed work takes the 'port_list_lock' mutex to protect
against concurrent addition / deletion of ports, during device creation
/ dismantle ports are added / deleted without this lock, which can
result in a use-after-free [1].

Fix this by making sure that the ports list is always modified under the
lock.

[1]
[   59.205543] ==================================================================
[   59.207748] BUG: KASAN: use-after-free in nsim_dev_trap_report_work+0xa67/0xad0
[   59.210247] Read of size 8 at addr ffff8883cbdd3398 by task kworker/3:1/38
[   59.212584]
[   59.213148] CPU: 3 PID: 38 Comm: kworker/3:1 Not tainted 5.4.0-rc3-custom-16119-ge6abb5f0261e #2013
[   59.215896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20180724_192412-buildhw-07.phx2.fedoraproject.org-1.fc29 04/01/2014
[   59.218384] Workqueue: events nsim_dev_trap_report_work
[   59.219428] Call Trace:
[   59.219924]  dump_stack+0xa9/0x10e
[   59.220623]  print_address_description.constprop.4+0x21/0x340
[   59.221976]  ? vprintk_func+0x66/0x240
[   59.222752]  __kasan_report.cold.8+0x78/0x91
[   59.223602]  ? nsim_dev_trap_report_work+0xa67/0xad0
[   59.224603]  kasan_report+0xe/0x20
[   59.225296]  nsim_dev_trap_report_work+0xa67/0xad0
[   59.226435]  ? rcu_read_lock_sched_held+0xaf/0xe0
[   59.227512]  ? trace_event_raw_event_rcu_quiescent_state_report+0x360/0x360
[   59.228851]  process_one_work+0x98f/0x1760
[   59.229684]  ? pwq_dec_nr_in_flight+0x330/0x330
[   59.230656]  worker_thread+0x91/0xc40
[   59.231587]  ? process_one_work+0x1760/0x1760
[   59.232451]  kthread+0x34a/0x410
[   59.233104]  ? __kthread_queue_delayed_work+0x240/0x240
[   59.234141]  ret_from_fork+0x3a/0x50
[   59.234982]
[   59.235371] Allocated by task 187:
[   59.236189]  save_stack+0x19/0x80
[   59.236853]  __kasan_kmalloc.constprop.5+0xc1/0xd0
[   59.237822]  kmem_cache_alloc_trace+0x14c/0x380
[   59.238769]  __nsim_dev_port_add+0xaf/0x5c0
[   59.239627]  nsim_dev_probe+0x4fc/0x1140
[   59.240550]  really_probe+0x264/0xc00
[   59.241418]  driver_probe_device+0x208/0x2e0
[   59.242255]  __device_attach_driver+0x215/0x2d0
[   59.243150]  bus_for_each_drv+0x154/0x1d0
[   59.243944]  __device_attach+0x1ba/0x2b0
[   59.244923]  bus_probe_device+0x1dd/0x290
[   59.245805]  device_add+0xbac/0x1550
[   59.246528]  new_device_store+0x1f4/0x400
[   59.247306]  bus_attr_store+0x7b/0xa0
[   59.248047]  sysfs_kf_write+0x10f/0x170
[   59.248941]  kernfs_fop_write+0x283/0x430
[   59.249843]  __vfs_write+0x81/0x100
[   59.250546]  vfs_write+0x1ce/0x510
[   59.251190]  ksys_write+0x104/0x200
[   59.251873]  do_syscall_64+0xa4/0x4e0
[   59.252642]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   59.253837]
[   59.254203] Freed by task 187:
[   59.254811]  save_stack+0x19/0x80
[   59.255463]  __kasan_slab_free+0x125/0x170
[   59.256265]  kfree+0x100/0x440
[   59.256870]  nsim_dev_remove+0x98/0x100
[   59.257651]  nsim_bus_remove+0x16/0x20
[   59.258382]  device_release_driver_internal+0x20b/0x4d0
[   59.259588]  bus_remove_device+0x2e9/0x5a0
[   59.260551]  device_del+0x410/0xad0
[   59.263777]  device_unregister+0x26/0xc0
[   59.264616]  nsim_bus_dev_del+0x16/0x60
[   59.265381]  del_device_store+0x2d6/0x3c0
[   59.266295]  bus_attr_store+0x7b/0xa0
[   59.267192]  sysfs_kf_write+0x10f/0x170
[   59.267960]  kernfs_fop_write+0x283/0x430
[   59.268800]  __vfs_write+0x81/0x100
[   59.269551]  vfs_write+0x1ce/0x510
[   59.270252]  ksys_write+0x104/0x200
[   59.270910]  do_syscall_64+0xa4/0x4e0
[   59.271680]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   59.272812]
[   59.273211] The buggy address belongs to the object at ffff8883cbdd3200
[   59.273211]  which belongs to the cache kmalloc-512 of size 512
[   59.275838] The buggy address is located 408 bytes inside of
[   59.275838]  512-byte region [ffff8883cbdd3200, ffff8883cbdd3400)
[   59.278151] The buggy address belongs to the page:
[   59.279215] page:ffffea000f2f7400 refcount:1 mapcount:0 mapping:ffff8883ecc0ce00 index:0x0 compound_mapcount: 0
[   59.281449] flags: 0x200000000010200(slab|head)
[   59.282356] raw: 0200000000010200 ffffea000f2f3a08 ffffea000f2fd608 ffff8883ecc0ce00
[   59.283949] raw: 0000000000000000 0000000000150015 00000001ffffffff 0000000000000000
[   59.285608] page dumped because: kasan: bad access detected
[   59.286981]
[   59.287337] Memory state around the buggy address:
[   59.288310]  ffff8883cbdd3280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.289763]  ffff8883cbdd3300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.291452] &gt;ffff8883cbdd3380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.292945]                             ^
[   59.293815]  ffff8883cbdd3400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   59.295220]  ffff8883cbdd3480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   59.296872] ==================================================================

Fixes: da58f90f11f5 ("netdevsim: Add devlink-trap support")
Signed-off-by: Ido Schimmel &lt;idosch@mellanox.com&gt;
Reported-by: syzbot+9ed8f68ab30761f3678e@syzkaller.appspotmail.com
Acked-by: Jakub Kicinski &lt;jakub.kicinski@netronome.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Commit da58f90f11f5 ("netdevsim: Add devlink-trap support") added
delayed work to netdevsim that periodically iterates over the registered
netdevsim ports and reports various packet traps via devlink.

While the delayed work takes the 'port_list_lock' mutex to protect
against concurrent addition / deletion of ports, during device creation
/ dismantle ports are added / deleted without this lock, which can
result in a use-after-free [1].

Fix this by making sure that the ports list is always modified under the
lock.

[1]
[   59.205543] ==================================================================
[   59.207748] BUG: KASAN: use-after-free in nsim_dev_trap_report_work+0xa67/0xad0
[   59.210247] Read of size 8 at addr ffff8883cbdd3398 by task kworker/3:1/38
[   59.212584]
[   59.213148] CPU: 3 PID: 38 Comm: kworker/3:1 Not tainted 5.4.0-rc3-custom-16119-ge6abb5f0261e #2013
[   59.215896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20180724_192412-buildhw-07.phx2.fedoraproject.org-1.fc29 04/01/2014
[   59.218384] Workqueue: events nsim_dev_trap_report_work
[   59.219428] Call Trace:
[   59.219924]  dump_stack+0xa9/0x10e
[   59.220623]  print_address_description.constprop.4+0x21/0x340
[   59.221976]  ? vprintk_func+0x66/0x240
[   59.222752]  __kasan_report.cold.8+0x78/0x91
[   59.223602]  ? nsim_dev_trap_report_work+0xa67/0xad0
[   59.224603]  kasan_report+0xe/0x20
[   59.225296]  nsim_dev_trap_report_work+0xa67/0xad0
[   59.226435]  ? rcu_read_lock_sched_held+0xaf/0xe0
[   59.227512]  ? trace_event_raw_event_rcu_quiescent_state_report+0x360/0x360
[   59.228851]  process_one_work+0x98f/0x1760
[   59.229684]  ? pwq_dec_nr_in_flight+0x330/0x330
[   59.230656]  worker_thread+0x91/0xc40
[   59.231587]  ? process_one_work+0x1760/0x1760
[   59.232451]  kthread+0x34a/0x410
[   59.233104]  ? __kthread_queue_delayed_work+0x240/0x240
[   59.234141]  ret_from_fork+0x3a/0x50
[   59.234982]
[   59.235371] Allocated by task 187:
[   59.236189]  save_stack+0x19/0x80
[   59.236853]  __kasan_kmalloc.constprop.5+0xc1/0xd0
[   59.237822]  kmem_cache_alloc_trace+0x14c/0x380
[   59.238769]  __nsim_dev_port_add+0xaf/0x5c0
[   59.239627]  nsim_dev_probe+0x4fc/0x1140
[   59.240550]  really_probe+0x264/0xc00
[   59.241418]  driver_probe_device+0x208/0x2e0
[   59.242255]  __device_attach_driver+0x215/0x2d0
[   59.243150]  bus_for_each_drv+0x154/0x1d0
[   59.243944]  __device_attach+0x1ba/0x2b0
[   59.244923]  bus_probe_device+0x1dd/0x290
[   59.245805]  device_add+0xbac/0x1550
[   59.246528]  new_device_store+0x1f4/0x400
[   59.247306]  bus_attr_store+0x7b/0xa0
[   59.248047]  sysfs_kf_write+0x10f/0x170
[   59.248941]  kernfs_fop_write+0x283/0x430
[   59.249843]  __vfs_write+0x81/0x100
[   59.250546]  vfs_write+0x1ce/0x510
[   59.251190]  ksys_write+0x104/0x200
[   59.251873]  do_syscall_64+0xa4/0x4e0
[   59.252642]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   59.253837]
[   59.254203] Freed by task 187:
[   59.254811]  save_stack+0x19/0x80
[   59.255463]  __kasan_slab_free+0x125/0x170
[   59.256265]  kfree+0x100/0x440
[   59.256870]  nsim_dev_remove+0x98/0x100
[   59.257651]  nsim_bus_remove+0x16/0x20
[   59.258382]  device_release_driver_internal+0x20b/0x4d0
[   59.259588]  bus_remove_device+0x2e9/0x5a0
[   59.260551]  device_del+0x410/0xad0
[   59.263777]  device_unregister+0x26/0xc0
[   59.264616]  nsim_bus_dev_del+0x16/0x60
[   59.265381]  del_device_store+0x2d6/0x3c0
[   59.266295]  bus_attr_store+0x7b/0xa0
[   59.267192]  sysfs_kf_write+0x10f/0x170
[   59.267960]  kernfs_fop_write+0x283/0x430
[   59.268800]  __vfs_write+0x81/0x100
[   59.269551]  vfs_write+0x1ce/0x510
[   59.270252]  ksys_write+0x104/0x200
[   59.270910]  do_syscall_64+0xa4/0x4e0
[   59.271680]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   59.272812]
[   59.273211] The buggy address belongs to the object at ffff8883cbdd3200
[   59.273211]  which belongs to the cache kmalloc-512 of size 512
[   59.275838] The buggy address is located 408 bytes inside of
[   59.275838]  512-byte region [ffff8883cbdd3200, ffff8883cbdd3400)
[   59.278151] The buggy address belongs to the page:
[   59.279215] page:ffffea000f2f7400 refcount:1 mapcount:0 mapping:ffff8883ecc0ce00 index:0x0 compound_mapcount: 0
[   59.281449] flags: 0x200000000010200(slab|head)
[   59.282356] raw: 0200000000010200 ffffea000f2f3a08 ffffea000f2fd608 ffff8883ecc0ce00
[   59.283949] raw: 0000000000000000 0000000000150015 00000001ffffffff 0000000000000000
[   59.285608] page dumped because: kasan: bad access detected
[   59.286981]
[   59.287337] Memory state around the buggy address:
[   59.288310]  ffff8883cbdd3280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.289763]  ffff8883cbdd3300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.291452] &gt;ffff8883cbdd3380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.292945]                             ^
[   59.293815]  ffff8883cbdd3400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   59.295220]  ffff8883cbdd3480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   59.296872] ==================================================================

Fixes: da58f90f11f5 ("netdevsim: Add devlink-trap support")
Signed-off-by: Ido Schimmel &lt;idosch@mellanox.com&gt;
Reported-by: syzbot+9ed8f68ab30761f3678e@syzkaller.appspotmail.com
Acked-by: Jakub Kicinski &lt;jakub.kicinski@netronome.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>netdevsim: Fix error handling in nsim_fib_init and nsim_fib_exit</title>
<updated>2019-10-13T18:30:14+00:00</updated>
<author>
<name>YueHaibing</name>
<email>yuehaibing@huawei.com</email>
</author>
<published>2019-10-11T09:46:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=33902b4a4227877896dd9368ac10f4ca0d100de5'/>
<id>33902b4a4227877896dd9368ac10f4ca0d100de5</id>
<content type='text'>
In nsim_fib_init(), if register_fib_notifier failed, nsim_fib_net_ops
should be unregistered before return.

In nsim_fib_exit(), unregister_fib_notifier should be called before
nsim_fib_net_ops be unregistered, otherwise may cause use-after-free:

BUG: KASAN: use-after-free in nsim_fib_event_nb+0x342/0x570 [netdevsim]
Read of size 8 at addr ffff8881daaf4388 by task kworker/0:3/3499

CPU: 0 PID: 3499 Comm: kworker/0:3 Not tainted 5.3.0-rc7+ #30
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Workqueue: ipv6_addrconf addrconf_dad_work [ipv6]
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xa9/0x10e lib/dump_stack.c:113
 print_address_description+0x65/0x380 mm/kasan/report.c:351
 __kasan_report+0x149/0x18d mm/kasan/report.c:482
 kasan_report+0xe/0x20 mm/kasan/common.c:618
 nsim_fib_event_nb+0x342/0x570 [netdevsim]
 notifier_call_chain+0x52/0xf0 kernel/notifier.c:95
 __atomic_notifier_call_chain+0x78/0x140 kernel/notifier.c:185
 call_fib_notifiers+0x30/0x60 net/core/fib_notifier.c:30
 call_fib6_entry_notifiers+0xc1/0x100 [ipv6]
 fib6_add+0x92e/0x1b10 [ipv6]
 __ip6_ins_rt+0x40/0x60 [ipv6]
 ip6_ins_rt+0x84/0xb0 [ipv6]
 __ipv6_ifa_notify+0x4b6/0x550 [ipv6]
 ipv6_ifa_notify+0xa5/0x180 [ipv6]
 addrconf_dad_completed+0xca/0x640 [ipv6]
 addrconf_dad_work+0x296/0x960 [ipv6]
 process_one_work+0x5c0/0xc00 kernel/workqueue.c:2269
 worker_thread+0x5c/0x670 kernel/workqueue.c:2415
 kthread+0x1d7/0x200 kernel/kthread.c:255
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

Allocated by task 3388:
 save_stack+0x19/0x80 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77 [inline]
 __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:493
 kmalloc include/linux/slab.h:557 [inline]
 kzalloc include/linux/slab.h:748 [inline]
 ops_init+0xa9/0x220 net/core/net_namespace.c:127
 __register_pernet_operations net/core/net_namespace.c:1135 [inline]
 register_pernet_operations+0x1d4/0x420 net/core/net_namespace.c:1212
 register_pernet_subsys+0x24/0x40 net/core/net_namespace.c:1253
 nsim_fib_init+0x12/0x70 [netdevsim]
 veth_get_link_ksettings+0x2b/0x50 [veth]
 do_one_initcall+0xd4/0x454 init/main.c:939
 do_init_module+0xe0/0x330 kernel/module.c:3490
 load_module+0x3c2f/0x4620 kernel/module.c:3841
 __do_sys_finit_module+0x163/0x190 kernel/module.c:3931
 do_syscall_64+0x72/0x2e0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 3534:
 save_stack+0x19/0x80 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77 [inline]
 __kasan_slab_free+0x130/0x180 mm/kasan/common.c:455
 slab_free_hook mm/slub.c:1423 [inline]
 slab_free_freelist_hook mm/slub.c:1474 [inline]
 slab_free mm/slub.c:3016 [inline]
 kfree+0xe9/0x2d0 mm/slub.c:3957
 ops_free net/core/net_namespace.c:151 [inline]
 ops_free_list.part.7+0x156/0x220 net/core/net_namespace.c:184
 ops_free_list net/core/net_namespace.c:182 [inline]
 __unregister_pernet_operations net/core/net_namespace.c:1165 [inline]
 unregister_pernet_operations+0x221/0x2a0 net/core/net_namespace.c:1224
 unregister_pernet_subsys+0x1d/0x30 net/core/net_namespace.c:1271
 nsim_fib_exit+0x11/0x20 [netdevsim]
 nsim_module_exit+0x16/0x21 [netdevsim]
 __do_sys_delete_module kernel/module.c:1015 [inline]
 __se_sys_delete_module kernel/module.c:958 [inline]
 __x64_sys_delete_module+0x244/0x330 kernel/module.c:958
 do_syscall_64+0x72/0x2e0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Reported-by: Hulk Robot &lt;hulkci@huawei.com&gt;
Fixes: 59c84b9fcf42 ("netdevsim: Restore per-network namespace accounting for fib entries")
Signed-off-by: YueHaibing &lt;yuehaibing@huawei.com&gt;
Acked-by: Jakub Kicinski &lt;jakub.kicinski@netronome.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In nsim_fib_init(), if register_fib_notifier failed, nsim_fib_net_ops
should be unregistered before return.

In nsim_fib_exit(), unregister_fib_notifier should be called before
nsim_fib_net_ops be unregistered, otherwise may cause use-after-free:

BUG: KASAN: use-after-free in nsim_fib_event_nb+0x342/0x570 [netdevsim]
Read of size 8 at addr ffff8881daaf4388 by task kworker/0:3/3499

CPU: 0 PID: 3499 Comm: kworker/0:3 Not tainted 5.3.0-rc7+ #30
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Workqueue: ipv6_addrconf addrconf_dad_work [ipv6]
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xa9/0x10e lib/dump_stack.c:113
 print_address_description+0x65/0x380 mm/kasan/report.c:351
 __kasan_report+0x149/0x18d mm/kasan/report.c:482
 kasan_report+0xe/0x20 mm/kasan/common.c:618
 nsim_fib_event_nb+0x342/0x570 [netdevsim]
 notifier_call_chain+0x52/0xf0 kernel/notifier.c:95
 __atomic_notifier_call_chain+0x78/0x140 kernel/notifier.c:185
 call_fib_notifiers+0x30/0x60 net/core/fib_notifier.c:30
 call_fib6_entry_notifiers+0xc1/0x100 [ipv6]
 fib6_add+0x92e/0x1b10 [ipv6]
 __ip6_ins_rt+0x40/0x60 [ipv6]
 ip6_ins_rt+0x84/0xb0 [ipv6]
 __ipv6_ifa_notify+0x4b6/0x550 [ipv6]
 ipv6_ifa_notify+0xa5/0x180 [ipv6]
 addrconf_dad_completed+0xca/0x640 [ipv6]
 addrconf_dad_work+0x296/0x960 [ipv6]
 process_one_work+0x5c0/0xc00 kernel/workqueue.c:2269
 worker_thread+0x5c/0x670 kernel/workqueue.c:2415
 kthread+0x1d7/0x200 kernel/kthread.c:255
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

Allocated by task 3388:
 save_stack+0x19/0x80 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77 [inline]
 __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:493
 kmalloc include/linux/slab.h:557 [inline]
 kzalloc include/linux/slab.h:748 [inline]
 ops_init+0xa9/0x220 net/core/net_namespace.c:127
 __register_pernet_operations net/core/net_namespace.c:1135 [inline]
 register_pernet_operations+0x1d4/0x420 net/core/net_namespace.c:1212
 register_pernet_subsys+0x24/0x40 net/core/net_namespace.c:1253
 nsim_fib_init+0x12/0x70 [netdevsim]
 veth_get_link_ksettings+0x2b/0x50 [veth]
 do_one_initcall+0xd4/0x454 init/main.c:939
 do_init_module+0xe0/0x330 kernel/module.c:3490
 load_module+0x3c2f/0x4620 kernel/module.c:3841
 __do_sys_finit_module+0x163/0x190 kernel/module.c:3931
 do_syscall_64+0x72/0x2e0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 3534:
 save_stack+0x19/0x80 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77 [inline]
 __kasan_slab_free+0x130/0x180 mm/kasan/common.c:455
 slab_free_hook mm/slub.c:1423 [inline]
 slab_free_freelist_hook mm/slub.c:1474 [inline]
 slab_free mm/slub.c:3016 [inline]
 kfree+0xe9/0x2d0 mm/slub.c:3957
 ops_free net/core/net_namespace.c:151 [inline]
 ops_free_list.part.7+0x156/0x220 net/core/net_namespace.c:184
 ops_free_list net/core/net_namespace.c:182 [inline]
 __unregister_pernet_operations net/core/net_namespace.c:1165 [inline]
 unregister_pernet_operations+0x221/0x2a0 net/core/net_namespace.c:1224
 unregister_pernet_subsys+0x1d/0x30 net/core/net_namespace.c:1271
 nsim_fib_exit+0x11/0x20 [netdevsim]
 nsim_module_exit+0x16/0x21 [netdevsim]
 __do_sys_delete_module kernel/module.c:1015 [inline]
 __se_sys_delete_module kernel/module.c:958 [inline]
 __x64_sys_delete_module+0x244/0x330 kernel/module.c:958
 do_syscall_64+0x72/0x2e0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Reported-by: Hulk Robot &lt;hulkci@huawei.com&gt;
Fixes: 59c84b9fcf42 ("netdevsim: Restore per-network namespace accounting for fib entries")
Signed-off-by: YueHaibing &lt;yuehaibing@huawei.com&gt;
Acked-by: Jakub Kicinski &lt;jakub.kicinski@netronome.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>netdevsim: Set offsets to various protocol layers</title>
<updated>2019-09-16T19:39:27+00:00</updated>
<author>
<name>Ido Schimmel</name>
<email>idosch@mellanox.com</email>
</author>
<published>2019-09-15T06:46:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=58a406def4374c08d063ec9ff97da74a74e1a9bf'/>
<id>58a406def4374c08d063ec9ff97da74a74e1a9bf</id>
<content type='text'>
The driver periodically generates "trapped" UDP packets that it then
passes on to devlink. Set the offsets to the various protocol layers.

This is a prerequisite to the next patch, where drop monitor is taught
to check that the offset to the MAC header was set.

Acked-by: Jiri Pirko &lt;jiri@mellanox.com&gt;
Signed-off-by: Ido Schimmel &lt;idosch@mellanox.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The driver periodically generates "trapped" UDP packets that it then
passes on to devlink. Set the offsets to the various protocol layers.

This is a prerequisite to the next patch, where drop monitor is taught
to check that the offset to the MAC header was set.

Acked-by: Jiri Pirko &lt;jiri@mellanox.com&gt;
Signed-off-by: Ido Schimmel &lt;idosch@mellanox.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: devlink: split reload op into two</title>
<updated>2019-09-13T20:11:14+00:00</updated>
<author>
<name>Jiri Pirko</name>
<email>jiri@mellanox.com</email>
</author>
<published>2019-09-12T08:49:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=97691069dc5a4135e413d3d92200d70b46df9fe5'/>
<id>97691069dc5a4135e413d3d92200d70b46df9fe5</id>
<content type='text'>
In order to properly implement failure indication during reload,
split the reload op into two ops, one for down phase and one for
up phase.

Signed-off-by: Jiri Pirko &lt;jiri@mellanox.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In order to properly implement failure indication during reload,
split the reload op into two ops, one for down phase and one for
up phase.

Signed-off-by: Jiri Pirko &lt;jiri@mellanox.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>netdevsim: Fix build error without CONFIG_INET</title>
<updated>2019-08-20T20:46:32+00:00</updated>
<author>
<name>YueHaibing</name>
<email>yuehaibing@huawei.com</email>
</author>
<published>2019-08-20T14:14:46+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=d9bd6d279236a1c90c1e73220c2ae52996c8ff52'/>
<id>d9bd6d279236a1c90c1e73220c2ae52996c8ff52</id>
<content type='text'>
If CONFIG_INET is not set, building fails:

drivers/net/netdevsim/dev.o: In function `nsim_dev_trap_report_work':
dev.c:(.text+0x67b): undefined reference to `ip_send_check'

Use ip_fast_csum instead of ip_send_check to avoid
dependencies on CONFIG_INET.

Reported-by: Hulk Robot &lt;hulkci@huawei.com&gt;
Fixes: da58f90f11f5 ("netdevsim: Add devlink-trap support")
Signed-off-by: YueHaibing &lt;yuehaibing@huawei.com&gt;
Acked-by: Jakub Kicinski &lt;jakub.kicinski@netronome.com&gt;
Reviewed-by: Ido Schimmel &lt;idosch@mellanox.com&gt;
Tested-by: Ido Schimmel &lt;idosch@mellanox.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
If CONFIG_INET is not set, building fails:

drivers/net/netdevsim/dev.o: In function `nsim_dev_trap_report_work':
dev.c:(.text+0x67b): undefined reference to `ip_send_check'

Use ip_fast_csum instead of ip_send_check to avoid
dependencies on CONFIG_INET.

Reported-by: Hulk Robot &lt;hulkci@huawei.com&gt;
Fixes: da58f90f11f5 ("netdevsim: Add devlink-trap support")
Signed-off-by: YueHaibing &lt;yuehaibing@huawei.com&gt;
Acked-by: Jakub Kicinski &lt;jakub.kicinski@netronome.com&gt;
Reviewed-by: Ido Schimmel &lt;idosch@mellanox.com&gt;
Tested-by: Ido Schimmel &lt;idosch@mellanox.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net</title>
<updated>2019-08-19T18:54:03+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2019-08-19T18:54:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=446bf64b613c4433dac4b15f4eaf326beaad3c8e'/>
<id>446bf64b613c4433dac4b15f4eaf326beaad3c8e</id>
<content type='text'>
Merge conflict of mlx5 resolved using instructions in merge
commit 9566e650bf7fdf58384bb06df634f7531ca3a97e.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Merge conflict of mlx5 resolved using instructions in merge
commit 9566e650bf7fdf58384bb06df634f7531ca3a97e.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
</feed>
