linux-stable.git/drivers/net, branch v3.16.84

bonding/alb: properly access headers in bond_alb_xmit()

2020-05-22T20:19:43+00:00

commit 38f88c45404293bbc027b956def6c10cbd45c616 upstream.

syzbot managed to send an IPX packet through bond_alb_xmit()
and af_packet and triggered a use-after-free.

First, bond_alb_xmit() was using ipx_hdr() helper to reach
the IPX header, but ipx_hdr() was using the transport offset
instead of the network offset. In the particular syzbot
report transport offset was 0xFFFF

This patch removes ipx_hdr() since it was only (mis)used from bonding.

Then we need to make sure IPv4/IPv6/IPX headers are pulled
in skb->head before dereferencing anything.

BUG: KASAN: use-after-free in bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452
Read of size 2 at addr ffff8801ce56dfff by task syz-executor.2/18108
 (if (ipx_hdr(skb)->ipx_checksum != IPX_NO_CHECKSUM) ...)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 [] __dump_stack lib/dump_stack.c:17 [inline]
 [] dump_stack+0x14d/0x20b lib/dump_stack.c:53
 [] print_address_description+0x6f/0x20b mm/kasan/report.c:282
 [] kasan_report_error mm/kasan/report.c:380 [inline]
 [] kasan_report mm/kasan/report.c:438 [inline]
 [] kasan_report.cold+0x8c/0x2a0 mm/kasan/report.c:422
 [] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:469
 [] bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452
 [] __bond_start_xmit drivers/net/bonding/bond_main.c:4199 [inline]
 [] bond_start_xmit+0x4f4/0x1570 drivers/net/bonding/bond_main.c:4224
 [] __netdev_start_xmit include/linux/netdevice.h:4525 [inline]
 [] netdev_start_xmit include/linux/netdevice.h:4539 [inline]
 [] xmit_one net/core/dev.c:3611 [inline]
 [] dev_hard_start_xmit+0x168/0x910 net/core/dev.c:3627
 [] __dev_queue_xmit+0x1f55/0x33b0 net/core/dev.c:4238
 [] dev_queue_xmit+0x18/0x20 net/core/dev.c:4278
 [] packet_snd net/packet/af_packet.c:3226 [inline]
 [] packet_sendmsg+0x4919/0x70b0 net/packet/af_packet.c:3252
 [] sock_sendmsg_nosec net/socket.c:673 [inline]
 [] sock_sendmsg+0x12c/0x160 net/socket.c:684
 [] __sys_sendto+0x262/0x380 net/socket.c:1996
 [] SYSC_sendto net/socket.c:2008 [inline]
 [] SyS_sendto+0x40/0x60 net/socket.c:2004

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet 
Reported-by: syzbot 
Cc: Jay Vosburgh 
Cc: Veaceslav Falico 
Cc: Andy Gospodarek 
Signed-off-by: David S. Miller 
[bwh: Backported to 3.16:
 - Don't delete ipx_hdr() as it's still used by net/ipx here
 - Adjust context]
Signed-off-by: Ben Hutchings

iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop

2020-05-22T20:19:35+00:00

commit c2f9a4e4a5abfc84c01b738496b3fd2d471e0b18 upstream.

The loop counter addr is a u16 where as the upper limit of the loop
is an int. In the unlikely event that the il->cfg->eeprom_size is
greater than 64K then we end up with an infinite loop since addr will
wrap around an never reach upper loop limit. Fix this by making addr
an int.

Addresses-Coverity: ("Infinite loop")
Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices 3945/4965")
Signed-off-by: Colin Ian King 
Acked-by: Stanislaw Gruszka 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings

gianfar: Fix TX timestamping with a stacked DSA driver

2020-05-22T20:19:22+00:00

commit c26a2c2ddc0115eb088873f5c309cf46b982f522 upstream.

The driver wrongly assumes that it is the only entity that can set the
SKBTX_IN_PROGRESS bit of the current skb. Therefore, in the
gfar_clean_tx_ring function, where the TX timestamp is collected if
necessary, the aforementioned bit is used to discriminate whether or not
the TX timestamp should be delivered to the socket's error queue.

But a stacked driver such as a DSA switch can also set the
SKBTX_IN_PROGRESS bit, which is actually exactly what it should do in
order to denote that the hardware timestamping process is undergoing.

Therefore, gianfar would misinterpret the "in progress" bit as being its
own, and deliver a second skb clone in the socket's error queue,
completely throwing off a PTP process which is not expecting to receive
it, _even though_ TX timestamping is not enabled for gianfar.

There have been discussions [0] as to whether non-MAC drivers need or
not to set SKBTX_IN_PROGRESS at all (whose purpose is to avoid sending 2
timestamps, a sw and a hw one, to applications which only expect one).
But as of this patch, there are at least 2 PTP drivers that would break
in conjunction with gianfar: the sja1105 DSA switch and the felix
switch, by way of its ocelot core driver.

So regardless of that conclusion, fix the gianfar driver to not do stuff
based on flags set by others and not intended for it.

[0]: https://www.spinics.net/lists/netdev/msg619699.html

Fixes: f0ee7acfcdd4 ("gianfar: Add hardware TX timestamping support")
Signed-off-by: Vladimir Oltean 
Acked-by: Richard Cochran 
Signed-off-by: David S. Miller 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

brcmfmac: Fix memory leak in brcmf_usbdev_qinit

2020-05-22T20:19:20+00:00

commit 4282dc057d750c6a7dd92953564b15c26b54c22c upstream.

In the implementation of brcmf_usbdev_qinit() the allocated memory for
reqs is leaking if usb_alloc_urb() fails. Release reqs in the error
handling path.

Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
Signed-off-by: Navid Emamdoost 
Signed-off-by: Kalle Valo 
Signed-off-by: Ben Hutchings

zd1211rw: fix storage endpoint lookup

2020-05-22T20:19:20+00:00

commit 2d68bb2687abb747558b933e80845ff31570a49c upstream.

Make sure to use the current alternate setting when verifying the
storage interface descriptors to avoid submitting an URB to an invalid
endpoint.

Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: a1030e92c150 ("[PATCH] zd1211rw: Convert installer CDROM device into WLAN device")
Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings

rsi_91x_usb: fix interface sanity check

2020-05-22T20:19:20+00:00

commit 3139b180906af43bc09bd3373fc2338a8271d9d9 upstream.

Make sure to use the current alternate setting when verifying the
interface descriptors to avoid binding to an invalid interface.

Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
Cc: Fariya Fatima 
Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo 
Signed-off-by: Ben Hutchings

orinoco_usb: fix interface sanity check

2020-05-22T20:19:19+00:00

commit b73e05aa543cf8db4f4927e36952360d71291d41 upstream.

Make sure to use the current alternate setting when verifying the
interface descriptors to avoid binding to an invalid interface.

Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: 9afac70a7305 ("orinoco: add orinoco_usb driver")
Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings

brcmfmac: fix interface sanity check

2020-05-22T20:19:19+00:00

commit 3428fbcd6e6c0850b1a8b2a12082b7b2aabb3da3 upstream.

Make sure to use the current alternate setting when verifying the
interface descriptors to avoid binding to an invalid interface.

Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
Cc: Arend van Spriel 
Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16:
 - Altsetting lookup is done by the IFALTS() macro
 - Adjust filename]
Signed-off-by: Ben Hutchings

brcmfmac: abort and release host after error

2020-05-22T20:19:18+00:00

commit 863844ee3bd38219c88e82966d1df36a77716f3e upstream.

With commit 216b44000ada ("brcmfmac: Fix use after free in
brcmf_sdio_readframes()") applied, we see locking timeouts in
brcmf_sdio_watchdog_thread().

brcmfmac: brcmf_escan_timeout: timer expired
INFO: task brcmf_wdog/mmc1:621 blocked for more than 120 seconds.
Not tainted 4.19.94-07984-g24ff99a0f713 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
brcmf_wdog/mmc1 D    0   621      2 0x00000000 last_sleep: 2440793077.  last_runnable: 2440766827
[] (__schedule) from [] (schedule+0x98/0xc4)
[] (schedule) from [] (__mmc_claim_host+0x154/0x274)
[] (__mmc_claim_host) from [] (brcmf_sdio_watchdog_thread+0x1b0/0x1f8 [brcmfmac])
[] (brcmf_sdio_watchdog_thread [brcmfmac]) from [] (kthread+0x178/0x180)

In addition to restarting or exiting the loop, it is also necessary to
abort the command and to release the host.

Fixes: 216b44000ada ("brcmfmac: Fix use after free in brcmf_sdio_readframes()")
Cc: Dan Carpenter 
Cc: Matthias Kaehlcke 
Cc: Brian Norris 
Cc: Douglas Anderson 
Signed-off-by: Guenter Roeck 
Reviewed-by: Douglas Anderson 
Acked-by: franky.lin@broadcom.com
Acked-by: Dan Carpenter 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16:
 - Use bus->sdiodev->func[1] instead of ->func1
 - Adjust filename]
Signed-off-by: Ben Hutchings

brcmfmac: Fix use after free in brcmf_sdio_readframes()

2020-05-22T20:19:18+00:00

commit 216b44000ada87a63891a8214c347e05a4aea8fe upstream.

The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
static checker warning:

    drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
    error: dereferencing freed memory 'pkt'

It looks like there was supposed to be a continue after we free "pkt".

Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
Signed-off-by: Dan Carpenter 
Acked-by: Franky Lin 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings