linux-stable.git/drivers/net/hamradio, branch linux-5.14.y

hamradio: baycom_epp: fix build for UML

2021-10-27T07:59:36+00:00

[ Upstream commit 0a9bb11a5e298e72b675255a4bb2893513000584 ]

On i386, the baycom_epp driver wants to inspect X86 CPU features (TSC)
and then act on that data, but that info is not available when running
on UML, so prevent that test and do the default action.

Prevents this build error on UML + i386:

../drivers/net/hamradio/baycom_epp.c: In function ‘epp_bh’:
../drivers/net/hamradio/baycom_epp.c:630:6: error: implicit declaration of function ‘boot_cpu_has’; did you mean ‘get_cpu_mask’? [-Werror=implicit-function-declaration]
  if (boot_cpu_has(X86_FEATURE_TSC))   \
      ^
../drivers/net/hamradio/baycom_epp.c:658:2: note: in expansion of macro ‘GETTICK’
  GETTICK(time1);

Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver")
Signed-off-by: Randy Dunlap 
Cc: linux-um@lists.infradead.org
Cc: Jeff Dike 
Cc: Richard Weinberger 
Cc: Anton Ivanov 
Cc: "David S. Miller" 
Cc: Jakub Kicinski 
Cc: Thomas Sailer 
Cc: linux-hams@vger.kernel.org
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net: 6pack: Fix tx timeout and slot time

2021-09-30T08:13:06+00:00

[ Upstream commit 3c0d2a46c0141913dc6fd126c57d0615677d946e ]

tx timeout and slot time are currently specified in units of HZ.  On
Alpha, HZ is defined as 1024.  When building alpha:allmodconfig, this
results in the following error message.

  drivers/net/hamradio/6pack.c: In function 'sixpack_open':
  drivers/net/hamradio/6pack.c:71:41: error:
  	unsigned conversion from 'int' to 'unsigned char'
  	changes value from '256' to '0'

In the 6PACK protocol, tx timeout is specified in units of 10 ms and
transmitted over the wire:

    https://www.linux-ax25.org/wiki/6PACK

Defining a value dependent on HZ doesn't really make sense, and
presumably comes from the (very historical) situation where HZ was
originally 100.

Note that the SIXP_SLOTTIME use explicitly is about 10ms granularity:

        mod_timer(&sp->tx_t, jiffies + ((when + 1) * HZ) / 100);

and the SIXP_TXDELAY walue is sent as a byte over the wire.

Signed-off-by: Guenter Roeck 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

net: 6pack: fix slab-out-of-bounds in decode_data

2021-08-16T10:08:05+00:00

Syzbot reported slab-out-of bounds write in decode_data().
The problem was in missing validation checks.

Syzbot's reproducer generated malicious input, which caused
decode_data() to be called a lot in sixpack_decode(). Since
rx_count_cooked is only 400 bytes and noone reported before,
that 400 bytes is not enough, let's just check if input is malicious
and complain about buffer overrun.

Fail log:
==================================================================
BUG: KASAN: slab-out-of-bounds in drivers/net/hamradio/6pack.c:843
Write of size 1 at addr ffff888087c5544e by task kworker/u4:0/7

CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.6.0-rc3-syzkaller #0
...
Workqueue: events_unbound flush_to_ldisc
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
 __kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:641
 __asan_report_store1_noabort+0x17/0x20 mm/kasan/generic_report.c:137
 decode_data.part.0+0x23b/0x270 drivers/net/hamradio/6pack.c:843
 decode_data drivers/net/hamradio/6pack.c:965 [inline]
 sixpack_decode drivers/net/hamradio/6pack.c:968 [inline]

Reported-and-tested-by: syzbot+fc8cd9a673d4577fb2e4@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Pavel Skripkin 
Reviewed-by: Dan Carpenter 
Signed-off-by: David S. Miller

Merge tag 'tty-5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2021-07-05T21:08:24+00:00

Pull tty / serial updates from Greg KH:
 "Here is the big set of tty and serial driver patches for 5.14-rc1.

  A bit more than normal, but nothing major, lots of cleanups.
  Highlights are:

   - lots of tty api cleanups and mxser driver cleanups from Jiri

   - build warning fixes

   - various serial driver updates

   - coding style cleanups

   - various tty driver minor fixes and updates

   - removal of broken and disable r3964 line discipline (finally!)

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'tty-5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (227 commits)
  serial: mvebu-uart: remove unused member nb from struct mvebu_uart
  arm64: dts: marvell: armada-37xx: Fix reg for standard variant of UART
  dt-bindings: mvebu-uart: fix documentation
  serial: mvebu-uart: correctly calculate minimal possible baudrate
  serial: mvebu-uart: do not allow changing baudrate when uartclk is not available
  serial: mvebu-uart: fix calculation of clock divisor
  tty: make linux/tty_flip.h self-contained
  serial: Prefer unsigned int to bare use of unsigned
  serial: 8250: 8250_omap: Fix possible interrupt storm on K3 SoCs
  serial: qcom_geni_serial: use DT aliases according to DT bindings
  Revert "tty: serial: Add UART driver for Cortina-Access platform"
  tty: serial: Add UART driver for Cortina-Access platform
  MAINTAINERS: add me back as mxser maintainer
  mxser: Documentation, fix typos
  mxser: Documentation, make the docs up-to-date
  mxser: Documentation, remove traces of callout device
  mxser: introduce mxser_16550A_or_MUST helper
  mxser: rename flags to old_speed in mxser_set_serial_info
  mxser: use port variable in mxser_set_serial_info
  mxser: access info->MCR under info->slock
  ...

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2021-06-19T02:47:02+00:00

Trivial conflicts in net/can/isotp.c and
tools/testing/selftests/net/mptcp/mptcp_connect.sh

scaled_ppm_to_ppb() was moved from drivers/ptp/ptp_clock.c
to include/linux/ptp_clock_kernel.h in -next so re-apply
the fix there.

Signed-off-by: Jakub Kicinski

net: hamradio: fix memory leak in mkiss_close

2021-06-17T18:24:54+00:00

My local syzbot instance hit memory leak in
mkiss_open()[1]. The problem was in missing
free_netdev() in mkiss_close().

In mkiss_open() netdevice is allocated and then
registered, but in mkiss_close() netdevice was
only unregistered, but not freed.

Fail log:

BUG: memory leak
unreferenced object 0xffff8880281ba000 (size 4096):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00  ax0.............
    00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00  .'.*............
  backtrace:
    [] kvmalloc_node+0x61/0xf0
    [] alloc_netdev_mqs+0x98/0xe80
    [] mkiss_open+0xb2/0x6f0 [1]
    [] tty_ldisc_open+0x9b/0x110
    [] tty_set_ldisc+0x2e8/0x670
    [] tty_ioctl+0xda3/0x1440
    [] __x64_sys_ioctl+0x193/0x200
    [] do_syscall_64+0x3a/0xb0
    [] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff8880141a9a00 (size 96):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    e8 a2 1b 28 80 88 ff ff e8 a2 1b 28 80 88 ff ff  ...(.......(....
    98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00  .....@..........
  backtrace:
    [] __hw_addr_create_ex+0x5b/0x310
    [] __hw_addr_add_ex+0x1f8/0x2b0
    [] dev_addr_init+0x10b/0x1f0
    [] alloc_netdev_mqs+0x13b/0xe80
    [] mkiss_open+0xb2/0x6f0 [1]
    [] tty_ldisc_open+0x9b/0x110
    [] tty_set_ldisc+0x2e8/0x670
    [] tty_ioctl+0xda3/0x1440
    [] __x64_sys_ioctl+0x193/0x200
    [] do_syscall_64+0x3a/0xb0
    [] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff8880219bfc00 (size 512):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    00 a0 1b 28 80 88 ff ff 80 8f b1 8d ff ff ff ff  ...(............
    80 8f b1 8d ff ff ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kvmalloc_node+0x61/0xf0
    [] alloc_netdev_mqs+0x777/0xe80
    [] mkiss_open+0xb2/0x6f0 [1]
    [] tty_ldisc_open+0x9b/0x110
    [] tty_set_ldisc+0x2e8/0x670
    [] tty_ioctl+0xda3/0x1440
    [] __x64_sys_ioctl+0x193/0x200
    [] do_syscall_64+0x3a/0xb0
    [] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff888029b2b200 (size 256):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kvmalloc_node+0x61/0xf0
    [] alloc_netdev_mqs+0x912/0xe80
    [] mkiss_open+0xb2/0x6f0 [1]
    [] tty_ldisc_open+0x9b/0x110
    [] tty_set_ldisc+0x2e8/0x670
    [] tty_ioctl+0xda3/0x1440
    [] __x64_sys_ioctl+0x193/0x200
    [] do_syscall_64+0x3a/0xb0
    [] entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: 815f62bf7427 ("[PATCH] SMP rewrite of mkiss")
Signed-off-by: Pavel Skripkin 
Signed-off-by: David S. Miller

hamradio: bpqether: Fix -Wunused-const-variable warning

2021-06-02T00:00:51+00:00

If CONFIG_PROC_FS is n, gcc warns:

drivers/net/hamradio/bpqether.c:437:36:
 warning: ‘bpq_seqops’ defined but not used [-Wunused-const-variable=]
 static const struct seq_operations bpq_seqops = {
                                    ^~~~~~~~~~
Use #ifdef macro to gurad this.

Signed-off-by: YueHaibing 
Signed-off-by: David S. Miller

net/hamradio/6pack: Fix inconsistent indenting

2021-05-25T22:28:12+00:00

Eliminate the follow smatch warning:

drivers/net/hamradio/6pack.c:728 sixpack_ioctl() warn: inconsistent
indenting.

Reported-by: Abaci Robot 
Signed-off-by: Jiapeng Chong 
Signed-off-by: David S. Miller

net: hamradio: remove leading spaces before tabs

2021-05-20T22:10:57+00:00

There are a few leading spaces before tabs and remove it by running
the following commard:

    $ find . -name '*.[ch]' | xargs sed -r -i 's/^[ ]+\t/\t/'

Cc: Jiri Slaby 
Signed-off-by: Hui Tang 
Signed-off-by: David S. Miller

tty: no checking of tty_unregister_ldisc

2021-05-13T14:57:17+00:00

tty_unregister_ldisc now returns 0 = success. No need to check the
return value. In fact, the users only warned if an error occured and
didn't do anything useful anyway -- the ldisc module was unloaded in any
case.

Signed-off-by: Jiri Slaby 
Cc: William Hubbs 
Cc: Chris Brannon 
Cc: Kirk Reiser 
Cc: Samuel Thibault 
Cc: Marcel Holtmann 
Cc: Johan Hedberg 
Cc: Luiz Augusto von Dentz 
Cc: Arnd Bergmann 
Cc: Wolfgang Grandegger 
Cc: Marc Kleine-Budde 
Cc: "David S. Miller" 
Cc: Jakub Kicinski 
Cc: Andreas Koensgen 
Cc: Paul Mackerras 
Cc: Rodolfo Giometti 
Cc: Peter Ujfalusi 
Cc: Liam Girdwood 
Cc: Mark Brown 
Cc: Jaroslav Kysela 
Cc: Takashi Iwai 
Link: https://lore.kernel.org/r/20210505091928.22010-19-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman