Searched hist:14408 (Results 1 - 11 of 11) sorted by relevance

/linux-master/drivers/staging/rtl8712/
H A Drecv_linux.cdiff c7c42826 Sun Feb 22 23:42:56 MST 2015 Melike Yurtoglu <aysemelikeyurtoglu@gmail.com> Staging: rtl8712: replace memcpy() by ether_addr_copy() using coccinelle and pack variable

This patch focuses on fixing the following warning generated
by checkpatch.pl for the file rxtx.c

Prefer ether_addr_copy() over memcpy() if the Ethernet addresses
are __aligned(2)

@@ expression e1, e2; @@

- memcpy(e1, e2, ETH_ALEN);
+ ether_addr_copy(e1, e2);

struct _adapter {
struct dvobj_priv dvobjpriv; /* 0 40*/
struct mlme_priv mlmepriv; /* 40 1560*/
/* --- cacheline 25 boundary (1600 bytes) --- */
struct cmd_priv cmdpriv; /* 1600 136*/
/* --- cacheline 27 boundary (1728 bytes) was 8 bytes ago --- */
struct evt_priv evtpriv; /* 1736 96*/
/* --- cacheline 28 boundary (1792 bytes) was 40 bytes ago --- * */
struct io_queue * pio_queue; /* 1832 8*/
struct xmit_priv xmitpriv; /* 1840 912*/
/* --- cacheline 43 boundary (2752 bytes) --- */
struct recv_priv recvpriv; /* 2752 1088*/
/* --- cacheline 60 boundary (3840 bytes) --- */
struct sta_priv stapriv; /* 3840 672*/
/* --- cacheline 70 boundary (4480 bytes) was 32 bytes ago --- * */
struct security_priv securitypriv; /* 4512 4816*/
/* --- cacheline 145 boundary (9280 bytes) was 48 bytes ago --- * */
struct registry_priv registrypriv; /* 9328 968*/
/* --- cacheline 160 boundary (10240 bytes) was 56 bytes ago --- * */
struct wlan_acl_pool acl_list; /* 10296 1536*/
/* --- cacheline 184 boundary (11776 bytes) was 56 bytes ago --- * */
struct pwrctrl_priv pwrctrlpriv; /* 11832 224*/
/* --- cacheline 188 boundary (12032 bytes) was 24 bytes ago --- * */
struct eeprom_priv eeprompriv; /* 12056 508*/

/* XXX 4 bytes hole, try to pack */

/* --- cacheline 196 boundary (12544 bytes) was 24 bytes ago --- * */
struct hal_priv halpriv; /* 12568 88*/
/* --- cacheline 197 boundary (12608 bytes) was 48 bytes ago --- * */
struct led_priv ledpriv; /* 12656 304*/
/* --- cacheline 202 boundary (12928 bytes) was 32 bytes ago --- * */
struct mp_priv mppriv; /* 12960 1080*/
/* --- cacheline 219 boundary (14016 bytes) was 24 bytes ago --- * */
s32 bDriverStopped; /* 14040 4*/
s32 bSurpriseRemoved; /* 14044 4*/
u32 IsrContent; /* 14048 4*/
u32 ImrContent; /* 14052 4*/
u8 EepromAddressSize; /* 14056 1*/
u8 hw_init_completed; /* 14057 1*/

/* XXX 6 bytes hole, try to pack */

struct task_struct * cmdThread; /* 14064 8*/
pid_t evtThread; /* 14072 4*/

/* XXX 4 bytes hole, try to pack */

/* --- cacheline 220 boundary (14080 bytes) --- */
struct task_struct * xmitThread; /* 14080 8*/
pid_t recvThread; /* 14088 4*/

/* XXX 4 bytes hole, try to pack */

uint (*dvobj_init)(struct _adapter *); /*14096 8 */
void (*dvobj_deinit)(struct _adapter *);/* 14104 8 */
struct net_device * pnetdev; /* 14112 8*/
int bup; /* 14120 4*/

/* XXX 4 bytes hole, try to pack */

struct net_device_stats stats; /* 14128 184*/
/* --- cacheline 223 boundary (14272 bytes) was 40 bytes ago --- * */
struct iw_statistics iwstats; /* 14312 32*/
/* --- cacheline 224 boundary (14336 bytes) was 8 bytes ago --- * */
int pid; /* 14344 4*/

/* XXX 4 bytes hole, try to pack */

struct work_struct wkFilterRxFF0; /* 14352 32*/
u8 blnEnableRxFF0Filter; /* 14384 1*/

/* XXX 3 bytes hole, try to pack */

spinlock_t lockRxFF0Filter; /* 14388 4*/
const struct firmware * fw; /* 14392 8*/
u8 EepromAddressSize; /* 14056 1*/
u8 hw_init_completed; /* 14057 1*/

/* XXX 6 bytes hole, try to pack */

struct task_struct * cmdThread; /* 14064 8*/
pid_t evtThread; /* 14072 4*/

/* XXX 4 bytes hole, try to pack */

/* --- cacheline 220 boundary (14080 bytes) --- */
struct task_struct * xmitThread; /* 14080 8*/
pid_t recvThread; /* 14088 4*/

/* XXX 4 bytes hole, try to pack */

uint (*dvobj_init)(struct _adapter *); /*14096 8 */
void (*dvobj_deinit)(struct _adapter *);/* 14104 8 */
struct net_device * pnetdev; /* 14112 8*/
int bup; /* 14120 4*/

/* XXX 4 bytes hole, try to pack */

struct net_device_stats stats; /* 14128 184*/
/* --- cacheline 223 boundary (14272 bytes) was 40 bytes ago --- * */
struct iw_statistics iwstats; /* 14312 32*/
/* --- cacheline 224 boundary (14336 bytes) was 8 bytes ago --- * */
int pid; /* 14344 4*/

/* XXX 4 bytes hole, try to pack */

struct work_struct wkFilterRxFF0; /* 14352 32*/
u8 blnEnableRxFF0Filter; /* 14384 1*/

/* XXX 3 bytes hole, try to pack */

spinlock_t lockRxFF0Filter; /* 14388 4*/
const struct firmware * fw; /* 14392 8*/
/* --- cacheline 225 boundary (14400 bytes) --- */
struct usb_interface * pusb_intf; /* 14400 8*/
struct mutex mutex_start; /* 14408 40*/

/* XXX last struct has 4 bytes of padding */

struct completion rtl8712_fw_ready; /* 14448 32*/
/* --- cacheline 226 boundary (14464 bytes) was 16 bytes ago --- * */

/* size: 14480, cachelines: 227, members: 40 */
/* sum members: 14451, holes: 7, sum holes: 29 */
/* paddings: 1, sum paddings: 4 */
/* last cacheline: 16 bytes */
};

Signed-off-by: Melike Yurtoglu <aysemelikeyurtoglu@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
H A Drtl871x_cmd.cdiff d55519ab Mon Feb 23 00:11:57 MST 2015 Melike Yurtoglu <aysemelikeyurtoglu@gmail.com> Staging: rtl8712: replace memcpy() by ether_addr_copy() using coccinelle and pack variable

This patch focuses on fixing the following warning generated
by checkpatch.pl for the file rtl871x_cmd.c

Prefer ether_addr_copy() over memcpy() if the Ethernet addresses
are __aligned(2)

@@ expression e1, e2; @@

- memcpy(e1, e2, ETH_ALEN);
+ ether_addr_copy(e1, e2);

struct _adapter {
struct dvobj_priv dvobjpriv; /* 0 40*/
struct mlme_priv mlmepriv; /* 40 1560*/
/* --- cacheline 25 boundary (1600 bytes) --- */
struct cmd_priv cmdpriv; /* 1600 136*/
/* --- cacheline 27 boundary (1728 bytes) was 8 bytes ago --- */
struct evt_priv evtpriv; /* 1736 96*/
/* --- cacheline 28 boundary (1792 bytes) was 40 bytes ago --- * */
struct io_queue * pio_queue; /* 1832 8*/
struct xmit_priv xmitpriv; /* 1840 912*/
/* --- cacheline 43 boundary (2752 bytes) --- */
struct recv_priv recvpriv; /* 2752 1088*/
/* --- cacheline 60 boundary (3840 bytes) --- */
struct sta_priv stapriv; /* 3840 672*/
/* --- cacheline 70 boundary (4480 bytes) was 32 bytes ago --- * */
struct security_priv securitypriv; /* 4512 4816*/
/* --- cacheline 145 boundary (9280 bytes) was 48 bytes ago --- * */
struct registry_priv registrypriv; /* 9328 968*/
/* --- cacheline 160 boundary (10240 bytes) was 56 bytes ago --- * */
struct wlan_acl_pool acl_list; /* 10296 1536*/
/* --- cacheline 184 boundary (11776 bytes) was 56 bytes ago --- * */
struct pwrctrl_priv pwrctrlpriv; /* 11832 224*/
/* --- cacheline 188 boundary (12032 bytes) was 24 bytes ago --- * */
struct eeprom_priv eeprompriv; /* 12056 508*/

/* XXX 4 bytes hole, try to pack */

/* --- cacheline 196 boundary (12544 bytes) was 24 bytes ago --- * */
struct hal_priv halpriv; /* 12568 88*/
/* --- cacheline 197 boundary (12608 bytes) was 48 bytes ago --- * */
struct led_priv ledpriv; /* 12656 304*/
/* --- cacheline 202 boundary (12928 bytes) was 32 bytes ago --- * */
struct mp_priv mppriv; /* 12960 1080*/
/* --- cacheline 219 boundary (14016 bytes) was 24 bytes ago * --- */
s32 bDriverStopped; /* 14040 4*/
s32 bSurpriseRemoved; /* 14044 4*/
u32 IsrContent; /* 14048 4*/
u32 ImrContent; /* 14052 4*/
u8 EepromAddressSize; /* 14056 1*/
u8 hw_init_completed; /* 14057 1*/

/* XXX 6 bytes hole, try to pack */

struct task_struct * cmdThread; /* 14064 8*/
pid_t evtThread; /* 14072 4*/

/* XXX 4 bytes hole, try to pack */

/* --- cacheline 220 boundary (14080 bytes) --- */
struct task_struct * xmitThread; /* 14080 8*/
pid_t recvThread; /* 14088 4*/

/* XXX 4 bytes hole, try to pack */

uint (*dvobj_init)(struct _adapter *); /*14096 8 */
void (*dvobj_deinit)(struct _adapter *);/* 14104 8 */
struct net_device * pnetdev; /* 14112 8*/
int bup; /* 14120 4*/

/* XXX 4 bytes hole, try to pack */

struct net_device_stats stats; /* 14128 184*/
/* --- cacheline 223 boundary (14272 bytes) was 40 bytes ago --- * */
struct iw_statistics iwstats; /* 14312 32*/
/* --- cacheline 224 boundary (14336 bytes) was 8 bytes ago --- * */
int pid; /* 14344 4*/

/* XXX 4 bytes hole, try to pack */

struct work_struct wkFilterRxFF0; /* 14352 32*/
u8 blnEnableRxFF0Filter; /* 14384 1*/

/* XXX 3 bytes hole, try to pack */

spinlock_t lockRxFF0Filter; /* 14388 4*/
const struct firmware * fw; /* 14392 8*/
/* --- cacheline 225 boundary (14400 bytes) --- */
struct usb_interface * pusb_intf; /* 14400 8*/
struct mutex mutex_start; /* 14408 40*/

/* XXX last struct has 4 bytes of padding */

struct completion rtl8712_fw_ready; /* 14448 32*/
/* --- cacheline 226 boundary (14464 bytes) was 16 bytes ago --- * */

/* size: 14480, cachelines: 227, members: 40 */
/* sum members: 14451, holes: 7, sum holes: 29 */
/* paddings: 1, sum paddings: 4 */
/* last cacheline: 16 bytes */
};

Signed-off-by: Melike Yurtoglu <aysemelikeyurtoglu@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
/linux-master/arch/mips/kernel/
H A Dentry.Sdiff e11124d8 Mon Oct 17 08:34:35 MDT 2016 Paul Burton <paulburton@kernel.org> MIPS: Remove r2_emul_return from struct thread_info

The r2_emul_return field in struct thread_info was used in order to take
an alternate codepath when returning to userland, which (besides not
implementing certain features) effectively used the eretnc instruction
in place of eret. The difference is that eretnc doesn't clear LLBit, and
therefore doesn't cause a linked load & store sequence to fail due to
emulation like eret would.

The reason eret would usually be used to clear LLBit is so that after
context switching we ensure that a load performed by one task doesn't
influence another task. However commit 7c151d3d5d7a ("MIPS: Make use of
the ERETNC instruction on MIPS R6") which introduced the r2_emul_return
field and conditional use of eretnc also for some reason began
explicitly clearing LLBit during context switches - despite retaining
the use of eret for everything but returns from the pre-r6 instruction
emulation code.

As LLBit is cleared upon context switches anyway, simplify this by using
eretnc unconditionally for MIPSr6 kernels. This allows us to remove the
4 byte r2_emul_return boolean from struct thread_info, simplify the
return to user code in entry.S and avoid the overhead of tracking &
checking state which we don't need.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14408/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
H A Dasm-offsets.cdiff e11124d8 Mon Oct 17 08:34:35 MDT 2016 Paul Burton <paulburton@kernel.org> MIPS: Remove r2_emul_return from struct thread_info

The r2_emul_return field in struct thread_info was used in order to take
an alternate codepath when returning to userland, which (besides not
implementing certain features) effectively used the eretnc instruction
in place of eret. The difference is that eretnc doesn't clear LLBit, and
therefore doesn't cause a linked load & store sequence to fail due to
emulation like eret would.

The reason eret would usually be used to clear LLBit is so that after
context switching we ensure that a load performed by one task doesn't
influence another task. However commit 7c151d3d5d7a ("MIPS: Make use of
the ERETNC instruction on MIPS R6") which introduced the r2_emul_return
field and conditional use of eretnc also for some reason began
explicitly clearing LLBit during context switches - despite retaining
the use of eret for everything but returns from the pre-r6 instruction
emulation code.

As LLBit is cleared upon context switches anyway, simplify this by using
eretnc unconditionally for MIPSr6 kernels. This allows us to remove the
4 byte r2_emul_return boolean from struct thread_info, simplify the
return to user code in entry.S and avoid the overhead of tracking &
checking state which we don't need.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14408/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
H A Dtraps.cdiff e11124d8 Mon Oct 17 08:34:35 MDT 2016 Paul Burton <paulburton@kernel.org> MIPS: Remove r2_emul_return from struct thread_info

The r2_emul_return field in struct thread_info was used in order to take
an alternate codepath when returning to userland, which (besides not
implementing certain features) effectively used the eretnc instruction
in place of eret. The difference is that eretnc doesn't clear LLBit, and
therefore doesn't cause a linked load & store sequence to fail due to
emulation like eret would.

The reason eret would usually be used to clear LLBit is so that after
context switching we ensure that a load performed by one task doesn't
influence another task. However commit 7c151d3d5d7a ("MIPS: Make use of
the ERETNC instruction on MIPS R6") which introduced the r2_emul_return
field and conditional use of eretnc also for some reason began
explicitly clearing LLBit during context switches - despite retaining
the use of eret for everything but returns from the pre-r6 instruction
emulation code.

As LLBit is cleared upon context switches anyway, simplify this by using
eretnc unconditionally for MIPSr6 kernels. This allows us to remove the
4 byte r2_emul_return boolean from struct thread_info, simplify the
return to user code in entry.S and avoid the overhead of tracking &
checking state which we don't need.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14408/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
/linux-master/arch/mips/include/asm/
H A Dstackframe.hdiff e11124d8 Mon Oct 17 08:34:35 MDT 2016 Paul Burton <paulburton@kernel.org> MIPS: Remove r2_emul_return from struct thread_info

The r2_emul_return field in struct thread_info was used in order to take
an alternate codepath when returning to userland, which (besides not
implementing certain features) effectively used the eretnc instruction
in place of eret. The difference is that eretnc doesn't clear LLBit, and
therefore doesn't cause a linked load & store sequence to fail due to
emulation like eret would.

The reason eret would usually be used to clear LLBit is so that after
context switching we ensure that a load performed by one task doesn't
influence another task. However commit 7c151d3d5d7a ("MIPS: Make use of
the ERETNC instruction on MIPS R6") which introduced the r2_emul_return
field and conditional use of eretnc also for some reason began
explicitly clearing LLBit during context switches - despite retaining
the use of eret for everything but returns from the pre-r6 instruction
emulation code.

As LLBit is cleared upon context switches anyway, simplify this by using
eretnc unconditionally for MIPSr6 kernels. This allows us to remove the
4 byte r2_emul_return boolean from struct thread_info, simplify the
return to user code in entry.S and avoid the overhead of tracking &
checking state which we don't need.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14408/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
H A Dthread_info.hdiff e11124d8 Mon Oct 17 08:34:35 MDT 2016 Paul Burton <paulburton@kernel.org> MIPS: Remove r2_emul_return from struct thread_info

The r2_emul_return field in struct thread_info was used in order to take
an alternate codepath when returning to userland, which (besides not
implementing certain features) effectively used the eretnc instruction
in place of eret. The difference is that eretnc doesn't clear LLBit, and
therefore doesn't cause a linked load & store sequence to fail due to
emulation like eret would.

The reason eret would usually be used to clear LLBit is so that after
context switching we ensure that a load performed by one task doesn't
influence another task. However commit 7c151d3d5d7a ("MIPS: Make use of
the ERETNC instruction on MIPS R6") which introduced the r2_emul_return
field and conditional use of eretnc also for some reason began
explicitly clearing LLBit during context switches - despite retaining
the use of eret for everything but returns from the pre-r6 instruction
emulation code.

As LLBit is cleared upon context switches anyway, simplify this by using
eretnc unconditionally for MIPSr6 kernels. This allows us to remove the
4 byte r2_emul_return boolean from struct thread_info, simplify the
return to user code in entry.S and avoid the overhead of tracking &
checking state which we don't need.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14408/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
/linux-master/include/linux/
H A Dbpf-cgroup.hdiff 9dfc685e Tue Oct 26 15:30:14 MDT 2021 Eric Dumazet <edumazet@google.com> inet: remove races in inet{6}_getname()

syzbot reported data-races in inet_getname() multiple times,
it is time we fix this instead of pretending applications
should not trigger them.

getsockname() and getpeername() are not really considered fast path.

v2: added the missing BPF_CGROUP_RUN_SA_PROG() declaration
needed when CONFIG_CGROUP_BPF=n, as reported by
kernel test robot <lkp@intel.com>

syzbot typical report:

BUG: KCSAN: data-race in __inet_hash_connect / inet_getname

write to 0xffff888136d66cf8 of 2 bytes by task 14374 on cpu 1:
__inet_hash_connect+0x7ec/0x950 net/ipv4/inet_hashtables.c:831
inet_hash_connect+0x85/0x90 net/ipv4/inet_hashtables.c:853
tcp_v4_connect+0x782/0xbb0 net/ipv4/tcp_ipv4.c:275
__inet_stream_connect+0x156/0x6e0 net/ipv4/af_inet.c:664
inet_stream_connect+0x44/0x70 net/ipv4/af_inet.c:728
__sys_connect_file net/socket.c:1896 [inline]
__sys_connect+0x254/0x290 net/socket.c:1913
__do_sys_connect net/socket.c:1923 [inline]
__se_sys_connect net/socket.c:1920 [inline]
__x64_sys_connect+0x3d/0x50 net/socket.c:1920
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888136d66cf8 of 2 bytes by task 14408 on cpu 0:
inet_getname+0x11f/0x170 net/ipv4/af_inet.c:790
__sys_getsockname+0x11d/0x1b0 net/socket.c:1946
__do_sys_getsockname net/socket.c:1961 [inline]
__se_sys_getsockname net/socket.c:1958 [inline]
__x64_sys_getsockname+0x3e/0x50 net/socket.c:1958
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x0000 -> 0xdee0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 14408 Comm: syz-executor.3 Not tainted 5.15.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Link: https://lore.kernel.org/r/20211026213014.3026708-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
diff 9dfc685e Tue Oct 26 15:30:14 MDT 2021 Eric Dumazet <edumazet@google.com> inet: remove races in inet{6}_getname()

syzbot reported data-races in inet_getname() multiple times,
it is time we fix this instead of pretending applications
should not trigger them.

getsockname() and getpeername() are not really considered fast path.

v2: added the missing BPF_CGROUP_RUN_SA_PROG() declaration
needed when CONFIG_CGROUP_BPF=n, as reported by
kernel test robot <lkp@intel.com>

syzbot typical report:

BUG: KCSAN: data-race in __inet_hash_connect / inet_getname

write to 0xffff888136d66cf8 of 2 bytes by task 14374 on cpu 1:
__inet_hash_connect+0x7ec/0x950 net/ipv4/inet_hashtables.c:831
inet_hash_connect+0x85/0x90 net/ipv4/inet_hashtables.c:853
tcp_v4_connect+0x782/0xbb0 net/ipv4/tcp_ipv4.c:275
__inet_stream_connect+0x156/0x6e0 net/ipv4/af_inet.c:664
inet_stream_connect+0x44/0x70 net/ipv4/af_inet.c:728
__sys_connect_file net/socket.c:1896 [inline]
__sys_connect+0x254/0x290 net/socket.c:1913
__do_sys_connect net/socket.c:1923 [inline]
__se_sys_connect net/socket.c:1920 [inline]
__x64_sys_connect+0x3d/0x50 net/socket.c:1920
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888136d66cf8 of 2 bytes by task 14408 on cpu 0:
inet_getname+0x11f/0x170 net/ipv4/af_inet.c:790
__sys_getsockname+0x11d/0x1b0 net/socket.c:1946
__do_sys_getsockname net/socket.c:1961 [inline]
__se_sys_getsockname net/socket.c:1958 [inline]
__x64_sys_getsockname+0x3e/0x50 net/socket.c:1958
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x0000 -> 0xdee0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 14408 Comm: syz-executor.3 Not tainted 5.15.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Link: https://lore.kernel.org/r/20211026213014.3026708-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
/linux-master/net/ipv6/
H A Daf_inet6.cdiff 9dfc685e Tue Oct 26 15:30:14 MDT 2021 Eric Dumazet <edumazet@google.com> inet: remove races in inet{6}_getname()

syzbot reported data-races in inet_getname() multiple times,
it is time we fix this instead of pretending applications
should not trigger them.

getsockname() and getpeername() are not really considered fast path.

v2: added the missing BPF_CGROUP_RUN_SA_PROG() declaration
needed when CONFIG_CGROUP_BPF=n, as reported by
kernel test robot <lkp@intel.com>

syzbot typical report:

BUG: KCSAN: data-race in __inet_hash_connect / inet_getname

write to 0xffff888136d66cf8 of 2 bytes by task 14374 on cpu 1:
__inet_hash_connect+0x7ec/0x950 net/ipv4/inet_hashtables.c:831
inet_hash_connect+0x85/0x90 net/ipv4/inet_hashtables.c:853
tcp_v4_connect+0x782/0xbb0 net/ipv4/tcp_ipv4.c:275
__inet_stream_connect+0x156/0x6e0 net/ipv4/af_inet.c:664
inet_stream_connect+0x44/0x70 net/ipv4/af_inet.c:728
__sys_connect_file net/socket.c:1896 [inline]
__sys_connect+0x254/0x290 net/socket.c:1913
__do_sys_connect net/socket.c:1923 [inline]
__se_sys_connect net/socket.c:1920 [inline]
__x64_sys_connect+0x3d/0x50 net/socket.c:1920
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888136d66cf8 of 2 bytes by task 14408 on cpu 0:
inet_getname+0x11f/0x170 net/ipv4/af_inet.c:790
__sys_getsockname+0x11d/0x1b0 net/socket.c:1946
__do_sys_getsockname net/socket.c:1961 [inline]
__se_sys_getsockname net/socket.c:1958 [inline]
__x64_sys_getsockname+0x3e/0x50 net/socket.c:1958
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x0000 -> 0xdee0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 14408 Comm: syz-executor.3 Not tainted 5.15.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Link: https://lore.kernel.org/r/20211026213014.3026708-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
diff 9dfc685e Tue Oct 26 15:30:14 MDT 2021 Eric Dumazet <edumazet@google.com> inet: remove races in inet{6}_getname()

syzbot reported data-races in inet_getname() multiple times,
it is time we fix this instead of pretending applications
should not trigger them.

getsockname() and getpeername() are not really considered fast path.

v2: added the missing BPF_CGROUP_RUN_SA_PROG() declaration
needed when CONFIG_CGROUP_BPF=n, as reported by
kernel test robot <lkp@intel.com>

syzbot typical report:

BUG: KCSAN: data-race in __inet_hash_connect / inet_getname

write to 0xffff888136d66cf8 of 2 bytes by task 14374 on cpu 1:
__inet_hash_connect+0x7ec/0x950 net/ipv4/inet_hashtables.c:831
inet_hash_connect+0x85/0x90 net/ipv4/inet_hashtables.c:853
tcp_v4_connect+0x782/0xbb0 net/ipv4/tcp_ipv4.c:275
__inet_stream_connect+0x156/0x6e0 net/ipv4/af_inet.c:664
inet_stream_connect+0x44/0x70 net/ipv4/af_inet.c:728
__sys_connect_file net/socket.c:1896 [inline]
__sys_connect+0x254/0x290 net/socket.c:1913
__do_sys_connect net/socket.c:1923 [inline]
__se_sys_connect net/socket.c:1920 [inline]
__x64_sys_connect+0x3d/0x50 net/socket.c:1920
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888136d66cf8 of 2 bytes by task 14408 on cpu 0:
inet_getname+0x11f/0x170 net/ipv4/af_inet.c:790
__sys_getsockname+0x11d/0x1b0 net/socket.c:1946
__do_sys_getsockname net/socket.c:1961 [inline]
__se_sys_getsockname net/socket.c:1958 [inline]
__x64_sys_getsockname+0x3e/0x50 net/socket.c:1958
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x0000 -> 0xdee0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 14408 Comm: syz-executor.3 Not tainted 5.15.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Link: https://lore.kernel.org/r/20211026213014.3026708-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
/linux-master/net/openvswitch/
H A Ddatapath.cdiff 14408dba Wed Jan 09 15:27:35 MST 2013 Jarno Rajahalme <jarno.rajahalme@nsn.com> openvswitch: Change ENOENT return value to ENODEV in lookup_vport().

This reduces the number of valid "no such device" error values that
need special attention by the caller.

Userspace code will need to keep on checking for both ENODEV and
ENOENT as long as older kernel modules are around.

Signed-off-by: Jarno Rajahalme <jarno.rajahalme@nsn.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
/linux-master/net/ipv4/
H A Daf_inet.cdiff 9dfc685e Tue Oct 26 15:30:14 MDT 2021 Eric Dumazet <edumazet@google.com> inet: remove races in inet{6}_getname()

syzbot reported data-races in inet_getname() multiple times,
it is time we fix this instead of pretending applications
should not trigger them.

getsockname() and getpeername() are not really considered fast path.

v2: added the missing BPF_CGROUP_RUN_SA_PROG() declaration
needed when CONFIG_CGROUP_BPF=n, as reported by
kernel test robot <lkp@intel.com>

syzbot typical report:

BUG: KCSAN: data-race in __inet_hash_connect / inet_getname

write to 0xffff888136d66cf8 of 2 bytes by task 14374 on cpu 1:
__inet_hash_connect+0x7ec/0x950 net/ipv4/inet_hashtables.c:831
inet_hash_connect+0x85/0x90 net/ipv4/inet_hashtables.c:853
tcp_v4_connect+0x782/0xbb0 net/ipv4/tcp_ipv4.c:275
__inet_stream_connect+0x156/0x6e0 net/ipv4/af_inet.c:664
inet_stream_connect+0x44/0x70 net/ipv4/af_inet.c:728
__sys_connect_file net/socket.c:1896 [inline]
__sys_connect+0x254/0x290 net/socket.c:1913
__do_sys_connect net/socket.c:1923 [inline]
__se_sys_connect net/socket.c:1920 [inline]
__x64_sys_connect+0x3d/0x50 net/socket.c:1920
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888136d66cf8 of 2 bytes by task 14408 on cpu 0:
inet_getname+0x11f/0x170 net/ipv4/af_inet.c:790
__sys_getsockname+0x11d/0x1b0 net/socket.c:1946
__do_sys_getsockname net/socket.c:1961 [inline]
__se_sys_getsockname net/socket.c:1958 [inline]
__x64_sys_getsockname+0x3e/0x50 net/socket.c:1958
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x0000 -> 0xdee0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 14408 Comm: syz-executor.3 Not tainted 5.15.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Link: https://lore.kernel.org/r/20211026213014.3026708-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
diff 9dfc685e Tue Oct 26 15:30:14 MDT 2021 Eric Dumazet <edumazet@google.com> inet: remove races in inet{6}_getname()

syzbot reported data-races in inet_getname() multiple times,
it is time we fix this instead of pretending applications
should not trigger them.

getsockname() and getpeername() are not really considered fast path.

v2: added the missing BPF_CGROUP_RUN_SA_PROG() declaration
needed when CONFIG_CGROUP_BPF=n, as reported by
kernel test robot <lkp@intel.com>

syzbot typical report:

BUG: KCSAN: data-race in __inet_hash_connect / inet_getname

write to 0xffff888136d66cf8 of 2 bytes by task 14374 on cpu 1:
__inet_hash_connect+0x7ec/0x950 net/ipv4/inet_hashtables.c:831
inet_hash_connect+0x85/0x90 net/ipv4/inet_hashtables.c:853
tcp_v4_connect+0x782/0xbb0 net/ipv4/tcp_ipv4.c:275
__inet_stream_connect+0x156/0x6e0 net/ipv4/af_inet.c:664
inet_stream_connect+0x44/0x70 net/ipv4/af_inet.c:728
__sys_connect_file net/socket.c:1896 [inline]
__sys_connect+0x254/0x290 net/socket.c:1913
__do_sys_connect net/socket.c:1923 [inline]
__se_sys_connect net/socket.c:1920 [inline]
__x64_sys_connect+0x3d/0x50 net/socket.c:1920
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888136d66cf8 of 2 bytes by task 14408 on cpu 0:
inet_getname+0x11f/0x170 net/ipv4/af_inet.c:790
__sys_getsockname+0x11d/0x1b0 net/socket.c:1946
__do_sys_getsockname net/socket.c:1961 [inline]
__se_sys_getsockname net/socket.c:1958 [inline]
__x64_sys_getsockname+0x3e/0x50 net/socket.c:1958
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x0000 -> 0xdee0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 14408 Comm: syz-executor.3 Not tainted 5.15.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Link: https://lore.kernel.org/r/20211026213014.3026708-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Completed in 734 milliseconds