linux-stable.git/drivers/net, branch v4.4.274

net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY

2021-06-30T12:49:38+00:00

[ Upstream commit f6396341194234e9b01cd7538bc2c6ac4501ab14 ]

As documented in Documentation/networking/driver.rst, the ndo_start_xmit
method must not return NETDEV_TX_BUSY under any normal circumstances, and
as recommended, we simply stop the tx queue in advance, when there is a
risk that the next xmit would cause a NETDEV_TX_BUSY return.

Signed-off-by: Esben Haabendal 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

r8169: Avoid memcpy() over-reading of ETH_SS_STATS

2021-06-30T12:49:38+00:00

[ Upstream commit da5ac772cfe2a03058b0accfac03fad60c46c24d ]

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields.

The memcpy() is copying the entire structure, not just the first array.
Adjust the source argument so the compiler can do appropriate bounds
checking.

Signed-off-by: Kees Cook 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

sh_eth: Avoid memcpy() over-reading of ETH_SS_STATS

2021-06-30T12:49:38+00:00

[ Upstream commit 224004fbb033600715dbd626bceec10bfd9c58bc ]

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields.

The memcpy() is copying the entire structure, not just the first array.
Adjust the source argument so the compiler can do appropriate bounds
checking.

Signed-off-by: Kees Cook 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

r8152: Avoid memcpy() over-reading of ETH_SS_STATS

2021-06-30T12:49:37+00:00

[ Upstream commit 99718abdc00e86e4f286dd836408e2834886c16e ]

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields.

The memcpy() is copying the entire structure, not just the first array.
Adjust the source argument so the compiler can do appropriate bounds
checking.

Signed-off-by: Kees Cook 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net: caif: fix memory leak in ldisc_open

2021-06-30T12:49:37+00:00

[ Upstream commit 58af3d3d54e87bfc1f936e16c04ade3369d34011 ]

Syzbot reported memory leak in tty_init_dev().
The problem was in unputted tty in ldisc_open()

static int ldisc_open(struct tty_struct *tty)
{
...
	ser->tty = tty_kref_get(tty);
...
	result = register_netdevice(dev);
	if (result) {
		rtnl_unlock();
		free_netdev(dev);
		return -ENODEV;
	}
...
}

Ser pointer is netdev private_data, so after free_netdev()
this pointer goes away with unputted tty reference. So, fix
it by adding tty_kref_put() before freeing netdev.

Reported-and-tested-by: syzbot+f303e045423e617d2cad@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net: fec_ptp: add clock rate zero check

2021-06-30T12:49:35+00:00

commit cb3cefe3f3f8af27c6076ef7d1f00350f502055d upstream.

Add clock rate zero check to fix coverity issue of "divide by 0".

Fixes: commit 85bd1798b24a ("net: fec: fix spin_lock dead lock")
Signed-off-by: Fugang Duan 
Signed-off-by: Joakim Zhang 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: ethernet: fix potential use-after-free in ec_bhf_remove

2021-06-30T12:49:34+00:00

[ Upstream commit 9cca0c2d70149160407bda9a9446ce0c29b6e6c6 ]

static void ec_bhf_remove(struct pci_dev *dev)
{
...
	struct ec_bhf_priv *priv = netdev_priv(net_dev);

	unregister_netdev(net_dev);
	free_netdev(net_dev);

	pci_iounmap(dev, priv->dma_io);
	pci_iounmap(dev, priv->io);
...
}

priv is netdev private data, but it is used
after free_netdev(). It can cause use-after-free when accessing priv
pointer. So, fix it by moving free_netdev() after pci_iounmap()
calls.

Fixes: 6af55ff52b02 ("Driver for Beckhoff CX5020 EtherCAT master module.")
Signed-off-by: Pavel Skripkin 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net: cdc_eem: fix tx fixup skb leak

2021-06-30T12:49:34+00:00

[ Upstream commit c3b26fdf1b32f91c7a3bc743384b4a298ab53ad7 ]

when usbnet transmit a skb, eem fixup it in eem_tx_fixup(),
if skb_copy_expand() failed, it return NULL,
usbnet_start_xmit() will have no chance to free original skb.

fix it by free orginal skb in eem_tx_fixup() first,
then check skb clone status, if failed, return NULL to usbnet.

Fixes: 9f722c0978b0 ("usbnet: CDC EEM support (v5)")
Signed-off-by: Linyu Yuan 
Reviewed-by: Greg Kroah-Hartman 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net: hamradio: fix memory leak in mkiss_close

2021-06-30T12:49:34+00:00

[ Upstream commit 7edcc682301492380fbdd604b4516af5ae667a13 ]

My local syzbot instance hit memory leak in
mkiss_open()[1]. The problem was in missing
free_netdev() in mkiss_close().

In mkiss_open() netdevice is allocated and then
registered, but in mkiss_close() netdevice was
only unregistered, but not freed.

Fail log:

BUG: memory leak
unreferenced object 0xffff8880281ba000 (size 4096):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00  ax0.............
    00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00  .'.*............
  backtrace:
    [] kvmalloc_node+0x61/0xf0
    [] alloc_netdev_mqs+0x98/0xe80
    [] mkiss_open+0xb2/0x6f0 [1]
    [] tty_ldisc_open+0x9b/0x110
    [] tty_set_ldisc+0x2e8/0x670
    [] tty_ioctl+0xda3/0x1440
    [] __x64_sys_ioctl+0x193/0x200
    [] do_syscall_64+0x3a/0xb0
    [] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff8880141a9a00 (size 96):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    e8 a2 1b 28 80 88 ff ff e8 a2 1b 28 80 88 ff ff  ...(.......(....
    98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00  .....@..........
  backtrace:
    [] __hw_addr_create_ex+0x5b/0x310
    [] __hw_addr_add_ex+0x1f8/0x2b0
    [] dev_addr_init+0x10b/0x1f0
    [] alloc_netdev_mqs+0x13b/0xe80
    [] mkiss_open+0xb2/0x6f0 [1]
    [] tty_ldisc_open+0x9b/0x110
    [] tty_set_ldisc+0x2e8/0x670
    [] tty_ioctl+0xda3/0x1440
    [] __x64_sys_ioctl+0x193/0x200
    [] do_syscall_64+0x3a/0xb0
    [] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff8880219bfc00 (size 512):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    00 a0 1b 28 80 88 ff ff 80 8f b1 8d ff ff ff ff  ...(............
    80 8f b1 8d ff ff ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kvmalloc_node+0x61/0xf0
    [] alloc_netdev_mqs+0x777/0xe80
    [] mkiss_open+0xb2/0x6f0 [1]
    [] tty_ldisc_open+0x9b/0x110
    [] tty_set_ldisc+0x2e8/0x670
    [] tty_ioctl+0xda3/0x1440
    [] __x64_sys_ioctl+0x193/0x200
    [] do_syscall_64+0x3a/0xb0
    [] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff888029b2b200 (size 256):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kvmalloc_node+0x61/0xf0
    [] alloc_netdev_mqs+0x912/0xe80
    [] mkiss_open+0xb2/0x6f0 [1]
    [] tty_ldisc_open+0x9b/0x110
    [] tty_set_ldisc+0x2e8/0x670
    [] tty_ioctl+0xda3/0x1440
    [] __x64_sys_ioctl+0x193/0x200
    [] do_syscall_64+0x3a/0xb0
    [] entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: 815f62bf7427 ("[PATCH] SMP rewrite of mkiss")
Signed-off-by: Pavel Skripkin 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

be2net: Fix an error handling path in 'be_probe()'

2021-06-30T12:49:33+00:00

[ Upstream commit c19c8c0e666f9259e2fc4d2fa4b9ff8e3b40ee5d ]

If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it
must be undone by a corresponding 'pci_disable_pcie_error_reporting()'
call, as already done in the remove function.

Fixes: d6b6d9877878 ("be2net: use PCIe AER capability")
Signed-off-by: Christophe JAILLET 
Acked-by: Somnath Kotur 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin