linux-toradex.git/drivers/net/hamradio, branch v5.14

net: 6pack: fix slab-out-of-bounds in decode_data

2021-08-16T10:08:05+00:00

Syzbot reported slab-out-of bounds write in decode_data().
The problem was in missing validation checks.

Syzbot's reproducer generated malicious input, which caused
decode_data() to be called a lot in sixpack_decode(). Since
rx_count_cooked is only 400 bytes and noone reported before,
that 400 bytes is not enough, let's just check if input is malicious
and complain about buffer overrun.

Fail log:
==================================================================
BUG: KASAN: slab-out-of-bounds in drivers/net/hamradio/6pack.c:843
Write of size 1 at addr ffff888087c5544e by task kworker/u4:0/7

CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.6.0-rc3-syzkaller #0
...
Workqueue: events_unbound flush_to_ldisc
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
 __kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:641
 __asan_report_store1_noabort+0x17/0x20 mm/kasan/generic_report.c:137
 decode_data.part.0+0x23b/0x270 drivers/net/hamradio/6pack.c:843
 decode_data drivers/net/hamradio/6pack.c:965 [inline]
 sixpack_decode drivers/net/hamradio/6pack.c:968 [inline]

Reported-and-tested-by: syzbot+fc8cd9a673d4577fb2e4@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Pavel Skripkin 
Reviewed-by: Dan Carpenter 
Signed-off-by: David S. Miller

Merge tag 'tty-5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2021-07-05T21:08:24+00:00

Pull tty / serial updates from Greg KH:
 "Here is the big set of tty and serial driver patches for 5.14-rc1.

  A bit more than normal, but nothing major, lots of cleanups.
  Highlights are:

   - lots of tty api cleanups and mxser driver cleanups from Jiri

   - build warning fixes

   - various serial driver updates

   - coding style cleanups

   - various tty driver minor fixes and updates

   - removal of broken and disable r3964 line discipline (finally!)

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'tty-5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (227 commits)
  serial: mvebu-uart: remove unused member nb from struct mvebu_uart
  arm64: dts: marvell: armada-37xx: Fix reg for standard variant of UART
  dt-bindings: mvebu-uart: fix documentation
  serial: mvebu-uart: correctly calculate minimal possible baudrate
  serial: mvebu-uart: do not allow changing baudrate when uartclk is not available
  serial: mvebu-uart: fix calculation of clock divisor
  tty: make linux/tty_flip.h self-contained
  serial: Prefer unsigned int to bare use of unsigned
  serial: 8250: 8250_omap: Fix possible interrupt storm on K3 SoCs
  serial: qcom_geni_serial: use DT aliases according to DT bindings
  Revert "tty: serial: Add UART driver for Cortina-Access platform"
  tty: serial: Add UART driver for Cortina-Access platform
  MAINTAINERS: add me back as mxser maintainer
  mxser: Documentation, fix typos
  mxser: Documentation, make the docs up-to-date
  mxser: Documentation, remove traces of callout device
  mxser: introduce mxser_16550A_or_MUST helper
  mxser: rename flags to old_speed in mxser_set_serial_info
  mxser: use port variable in mxser_set_serial_info
  mxser: access info->MCR under info->slock
  ...

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2021-06-19T02:47:02+00:00

Trivial conflicts in net/can/isotp.c and
tools/testing/selftests/net/mptcp/mptcp_connect.sh

scaled_ppm_to_ppb() was moved from drivers/ptp/ptp_clock.c
to include/linux/ptp_clock_kernel.h in -next so re-apply
the fix there.

Signed-off-by: Jakub Kicinski

net: hamradio: fix memory leak in mkiss_close

2021-06-17T18:24:54+00:00

My local syzbot instance hit memory leak in
mkiss_open()[1]. The problem was in missing
free_netdev() in mkiss_close().

In mkiss_open() netdevice is allocated and then
registered, but in mkiss_close() netdevice was
only unregistered, but not freed.

Fail log:

BUG: memory leak
unreferenced object 0xffff8880281ba000 (size 4096):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00  ax0.............
    00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00  .'.*............
  backtrace:
    [] kvmalloc_node+0x61/0xf0
    [] alloc_netdev_mqs+0x98/0xe80
    [] mkiss_open+0xb2/0x6f0 [1]
    [] tty_ldisc_open+0x9b/0x110
    [] tty_set_ldisc+0x2e8/0x670
    [] tty_ioctl+0xda3/0x1440
    [] __x64_sys_ioctl+0x193/0x200
    [] do_syscall_64+0x3a/0xb0
    [] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff8880141a9a00 (size 96):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    e8 a2 1b 28 80 88 ff ff e8 a2 1b 28 80 88 ff ff  ...(.......(....
    98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00  .....@..........
  backtrace:
    [] __hw_addr_create_ex+0x5b/0x310
    [] __hw_addr_add_ex+0x1f8/0x2b0
    [] dev_addr_init+0x10b/0x1f0
    [] alloc_netdev_mqs+0x13b/0xe80
    [] mkiss_open+0xb2/0x6f0 [1]
    [] tty_ldisc_open+0x9b/0x110
    [] tty_set_ldisc+0x2e8/0x670
    [] tty_ioctl+0xda3/0x1440
    [] __x64_sys_ioctl+0x193/0x200
    [] do_syscall_64+0x3a/0xb0
    [] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff8880219bfc00 (size 512):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    00 a0 1b 28 80 88 ff ff 80 8f b1 8d ff ff ff ff  ...(............
    80 8f b1 8d ff ff ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kvmalloc_node+0x61/0xf0
    [] alloc_netdev_mqs+0x777/0xe80
    [] mkiss_open+0xb2/0x6f0 [1]
    [] tty_ldisc_open+0x9b/0x110
    [] tty_set_ldisc+0x2e8/0x670
    [] tty_ioctl+0xda3/0x1440
    [] __x64_sys_ioctl+0x193/0x200
    [] do_syscall_64+0x3a/0xb0
    [] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff888029b2b200 (size 256):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kvmalloc_node+0x61/0xf0
    [] alloc_netdev_mqs+0x912/0xe80
    [] mkiss_open+0xb2/0x6f0 [1]
    [] tty_ldisc_open+0x9b/0x110
    [] tty_set_ldisc+0x2e8/0x670
    [] tty_ioctl+0xda3/0x1440
    [] __x64_sys_ioctl+0x193/0x200
    [] do_syscall_64+0x3a/0xb0
    [] entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: 815f62bf7427 ("[PATCH] SMP rewrite of mkiss")
Signed-off-by: Pavel Skripkin 
Signed-off-by: David S. Miller

hamradio: bpqether: Fix -Wunused-const-variable warning

2021-06-02T00:00:51+00:00

If CONFIG_PROC_FS is n, gcc warns:

drivers/net/hamradio/bpqether.c:437:36:
 warning: ‘bpq_seqops’ defined but not used [-Wunused-const-variable=]
 static const struct seq_operations bpq_seqops = {
                                    ^~~~~~~~~~
Use #ifdef macro to gurad this.

Signed-off-by: YueHaibing 
Signed-off-by: David S. Miller

net/hamradio/6pack: Fix inconsistent indenting

2021-05-25T22:28:12+00:00

Eliminate the follow smatch warning:

drivers/net/hamradio/6pack.c:728 sixpack_ioctl() warn: inconsistent
indenting.

Reported-by: Abaci Robot 
Signed-off-by: Jiapeng Chong 
Signed-off-by: David S. Miller

net: hamradio: remove leading spaces before tabs

2021-05-20T22:10:57+00:00

There are a few leading spaces before tabs and remove it by running
the following commard:

    $ find . -name '*.[ch]' | xargs sed -r -i 's/^[ ]+\t/\t/'

Cc: Jiri Slaby 
Signed-off-by: Hui Tang 
Signed-off-by: David S. Miller

tty: no checking of tty_unregister_ldisc

2021-05-13T14:57:17+00:00

tty_unregister_ldisc now returns 0 = success. No need to check the
return value. In fact, the users only warned if an error occured and
didn't do anything useful anyway -- the ldisc module was unloaded in any
case.

Signed-off-by: Jiri Slaby 
Cc: William Hubbs 
Cc: Chris Brannon 
Cc: Kirk Reiser 
Cc: Samuel Thibault 
Cc: Marcel Holtmann 
Cc: Johan Hedberg 
Cc: Luiz Augusto von Dentz 
Cc: Arnd Bergmann 
Cc: Wolfgang Grandegger 
Cc: Marc Kleine-Budde 
Cc: "David S. Miller" 
Cc: Jakub Kicinski 
Cc: Andreas Koensgen 
Cc: Paul Mackerras 
Cc: Rodolfo Giometti 
Cc: Peter Ujfalusi 
Cc: Liam Girdwood 
Cc: Mark Brown 
Cc: Jaroslav Kysela 
Cc: Takashi Iwai 
Link: https://lore.kernel.org/r/20210505091928.22010-19-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman

tty: make tty_ldisc_ops a param in tty_unregister_ldisc

2021-05-13T14:57:16+00:00

Make tty_unregister_ldisc symmetric to tty_register_ldisc by accepting
struct tty_ldisc_ops as a parameter instead of ldisc number. This avoids
checking of the ldisc number bounds in tty_unregister_ldisc.

Signed-off-by: Jiri Slaby 
Cc: William Hubbs 
Cc: Chris Brannon 
Cc: Kirk Reiser 
Cc: Samuel Thibault 
Cc: Marcel Holtmann 
Cc: Johan Hedberg 
Cc: Luiz Augusto von Dentz 
Cc: Dmitry Torokhov 
Cc: Arnd Bergmann 
Cc: "David S. Miller" 
Cc: Jakub Kicinski 
Cc: Wolfgang Grandegger 
Cc: Marc Kleine-Budde 
Cc: Andreas Koensgen 
Cc: Paul Mackerras 
Cc: Rodolfo Giometti 
Cc: Peter Ujfalusi 
Cc: Liam Girdwood 
Cc: Mark Brown 
Cc: Jaroslav Kysela 
Cc: Takashi Iwai 
Link: https://lore.kernel.org/r/20210505091928.22010-17-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman

tty: set tty_ldisc_ops::num statically

2021-05-13T14:57:16+00:00

There is no reason to pass the ldisc number to tty_register_ldisc
separately. Just set it in the already defined tty_ldisc_ops in all the
ldiscs.

This simplifies tty_register_ldisc a bit too (no need to set the num
member there).

Signed-off-by: Jiri Slaby 
Cc: William Hubbs 
Cc: Chris Brannon 
Cc: Kirk Reiser 
Cc: Samuel Thibault 
Cc: Marcel Holtmann 
Cc: Johan Hedberg 
Cc: Luiz Augusto von Dentz 
Cc: Dmitry Torokhov 
Cc: Arnd Bergmann 
Cc: "David S. Miller" 
Cc: Jakub Kicinski 
Cc: Wolfgang Grandegger 
Cc: Marc Kleine-Budde 
Cc: Andreas Koensgen 
Cc: Paul Mackerras 
Cc: Rodolfo Giometti 
Cc: Peter Ujfalusi 
Cc: Liam Girdwood 
Cc: Mark Brown 
Cc: Jaroslav Kysela 
Cc: Takashi Iwai 
Link: https://lore.kernel.org/r/20210505091928.22010-15-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman