linux-stable.git/net/vmw_vsock, branch v6.1.2

net: vmw_vsock: vmci: Check memcpy_from_msg()

2022-12-31T12:32:26+00:00

[ Upstream commit 44aa5a6dba8283bfda28b1517af4de711c5652a4 ]

vmci_transport_dgram_enqueue() does not check the return value
of memcpy_from_msg().  If memcpy_from_msg() fails, it is possible that
uninitialized memory contents are sent unintentionally instead of user's
message in the datagram to the destination.  Return with an error if
memcpy_from_msg() fails.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 0f7db23a07af ("vmci_transport: switch ->enqeue_dgram, ->enqueue_stream and ->dequeue_stream to msghdr")
Signed-off-by: Artem Chernyshev 
Reviewed-by: Stefano Garzarella 
Reviewed-by: Vishnu Dasa 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

vsock: fix possible infinite sleep in vsock_connectible_wait_data()

2022-11-03T09:49:29+00:00

Currently vsock_connectible_has_data() may miss a wakeup operation
between vsock_connectible_has_data() == 0 and the prepare_to_wait().

Fix the race by adding the process to the wait queue before checking
vsock_connectible_has_data().

Fixes: b3f7fd54881b ("af_vsock: separate wait data loop")
Signed-off-by: Dexuan Cui 
Reviewed-by: Stefano Garzarella 
Reported-by: Frédéric Dalleau 
Tested-by: Frédéric Dalleau 
Signed-off-by: Paolo Abeni

vsock: remove the unused 'wait' in vsock_connectible_recvmsg()

2022-11-03T09:49:29+00:00

Remove the unused variable introduced by 19c1b90e1979.

Fixes: 19c1b90e1979 ("af_vsock: separate receive data loop")
Signed-off-by: Dexuan Cui 
Reviewed-by: Stefano Garzarella 
Signed-off-by: Paolo Abeni

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2022-10-04T00:44:18+00:00

Merge in the left-over fixes before the net-next pull-request.

Conflicts:

drivers/net/ethernet/mediatek/mtk_ppe.c
  ae3ed15da588 ("net: ethernet: mtk_eth_soc: fix state in __mtk_foe_entry_clear")
  9d8cb4c096ab ("net: ethernet: mtk_eth_soc: add foe_entry_size to mtk_eth_soc")
https://lore.kernel.org/all/6cb6893b-4921-a068-4c30-1109795110bb@tessares.net/

kernel/bpf/helpers.c
  8addbfc7b308 ("bpf: Gate dynptr API behind CAP_BPF")
  5679ff2f138f ("bpf: Move bpf_loop and bpf_for_each_map_elem under CAP_BPF")
  8a67f2de9b1d ("bpf: expose bpf_strtol and bpf_strtoul to all program types")
https://lore.kernel.org/all/20221003201957.13149-1-daniel@iogearbox.net/

Signed-off-by: Jakub Kicinski

vhost/vsock: Use kvmalloc/kvfree for larger packets.

2022-09-30T01:34:08+00:00

When copying a large file over sftp over vsock, data size is usually 32kB,
and kmalloc seems to fail to try to allocate 32 32kB regions.

 vhost-5837: page allocation failure: order:4, mode:0x24040c0
 Call Trace:
  [] dump_stack+0x97/0xdb
  [] warn_alloc_failed+0x10f/0x138
  [] ? __alloc_pages_direct_compact+0x38/0xc8
  [] __alloc_pages_nodemask+0x84c/0x90d
  [] alloc_kmem_pages+0x17/0x19
  [] kmalloc_order_trace+0x2b/0xdb
  [] __kmalloc+0x177/0x1f7
  [] ? copy_from_iter+0x8d/0x31d
  [] vhost_vsock_handle_tx_kick+0x1fa/0x301 [vhost_vsock]
  [] vhost_worker+0xf7/0x157 [vhost]
  [] kthread+0xfd/0x105
  [] ? vhost_dev_set_owner+0x22e/0x22e [vhost]
  [] ? flush_kthread_worker+0xf3/0xf3
  [] ret_from_fork+0x4e/0x80
  [] ? flush_kthread_worker+0xf3/0xf3

Work around by doing kvmalloc instead.

Fixes: 433fc58e6bf2 ("VSOCK: Introduce vhost_vsock.ko")
Signed-off-by: Junichi Uekawa 
Reviewed-by: Stefano Garzarella 
Acked-by: Michael S. Tsirkin 
Link: https://lore.kernel.org/r/20220928064538.667678-1-uekawa@chromium.org
Signed-off-by: Jakub Kicinski

vsock/vmci: fix repeated words in comments

2022-09-16T08:31:29+00:00

Delete the redundant word 'that'.

Signed-off-by: Jilin Yuan 
Reviewed-by: Stefano Garzarella 
Signed-off-by: David S. Miller

vmci/vsock: check SO_RCVLOWAT before wake up reader

2022-08-23T08:43:12+00:00

This adds extra condition to wake up data reader: do it only when number
of readable bytes >= SO_RCVLOWAT. Otherwise, there is no sense to kick
user, because it will wait until SO_RCVLOWAT bytes will be dequeued. This
check is performed in vsock_data_ready().

Signed-off-by: Arseniy Krasnov 
Reviewed-by: Vishnu Dasa 
Signed-off-by: Paolo Abeni

virtio/vsock: check SO_RCVLOWAT before wake up reader

2022-08-23T08:43:11+00:00

This adds extra condition to wake up data reader: do it only when number
of readable bytes >= SO_RCVLOWAT. Otherwise, there is no sense to kick
user,because it will wait until SO_RCVLOWAT bytes will be dequeued. This
check is performed in vsock_data_ready().

Signed-off-by: Arseniy Krasnov 
Reviewed-by: Stefano Garzarella 
Signed-off-by: Paolo Abeni

vsock: add API call for data ready

2022-08-23T08:43:11+00:00

This adds 'vsock_data_ready()' which must be called by transport to kick
sleeping data readers. It checks for SO_RCVLOWAT value before waking
user, thus preventing spurious wake ups. Based on 'tcp_data_ready()' logic.

Signed-off-by: Arseniy Krasnov 
Reviewed-by: Stefano Garzarella 
Signed-off-by: Paolo Abeni

vsock: pass sock_rcvlowat to notify_poll_in as target

2022-08-23T08:43:11+00:00

Passing 1 as the target to notify_poll_in(), we don't honor
what the user has set via SO_RCVLOWAT, going to set POLLIN
and POLLRDNORM, even if we don't have the amount of bytes
expected by the user.

Let's use sock_rcvlowat() to get the right target to pass to
notify_poll_in();

Signed-off-by: Arseniy Krasnov 
Reviewed-by: Stefano Garzarella 
Signed-off-by: Paolo Abeni