Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Conflicts: drivers/net/can/dev.c commit 03f16c5075b2 ("can: dev: can_restart: fix use after free bug") commit 3e77f70e7345 ("can: dev: move driver related infrastructure into separate subdir") Code move. drivers/net/dsa/b53/b53_common.c commit 8e4052c32d6b ("net: dsa: b53: fix an off by one in checking "vlan->vid"") commit b7a9e0da2d1c ("net: switchdev: remove vid_begin -> vid_end range from VLAN objects") Field rename.

Jakub Kicinski committed 5 years ago

Commit 0fe2f272 parents 7b8fc01 75439bc285 files · +3212 −1446Browse files

Showing the changes to kernel (8 of 285 files). Show all

Unified · Split

8 files

kernel/bpf/bpf_inode_storage.c +6 −3
kernel/bpf/bpf_task_storage.c +4 −1
kernel/bpf/btf.c +1 −1
kernel/bpf/cgroup.c +3 −2
kernel/bpf/helpers.c +1 −1
kernel/bpf/syscall.c +4 −2
kernel/bpf/verifier.c +5 −3
kernel/signal.c +3 −0

kernel/bpf/bpf_inode_storage.c+6−3

 	 * bpf_local_storage_update expects the owner to have a
 	 * valid storage pointer.
 	 */
-	if (!inode_storage_ptr(inode))
+	if (!inode || !inode_storage_ptr(inode))
 		return (unsigned long)NULL;
 	sdata = inode_storage_lookup(inode, map, true);
 	if (sdata)
 		return (unsigned long)sdata->data;
-	/* This helper must only called from where the inode is gurranteed
+	/* This helper must only called from where the inode is guaranteed
 	 * to have a refcount and cannot be freed.
 	 */
 	if (flags & BPF_LOCAL_STORAGE_GET_F_CREATE) {
 BPF_CALL_2(bpf_inode_storage_delete,
 	   struct bpf_map *, map, struct inode *, inode)
 {
-	/* This helper must only called from where the inode is gurranteed
+	if (!inode)
+		return -EINVAL;
+	/* This helper must only called from where the inode is guaranteed
 	 * to have a refcount and cannot be freed.
 	 */
 	return inode_storage_delete(inode, map);

kernel/bpf/bpf_task_storage.c+4−1

 	 * bpf_local_storage_update expects the owner to have a
 	 * valid storage pointer.
 	 */
-	if (!task_storage_ptr(task))
+	if (!task || !task_storage_ptr(task))
 		return (unsigned long)NULL;
 	sdata = task_storage_lookup(task, map, true);
 BPF_CALL_2(bpf_task_storage_delete, struct bpf_map *, map, struct task_struct *,
 	   task)
 {
+	if (!task)
+		return -EINVAL;
 	/* This helper must only be called from places where the lifetime of the task
 	 * is guaranteed. Either by being refcounted or by being protected
 	 * by an RCU read-side critical section.

kernel/bpf/btf.c+1−1

@@ -4172,7 +4172,7 @@ static int btf_parse_hdr(struct btf_verifier_env *env) · 4171 unmodified lines
4172	return -ENOTSUPP;	4172	return -ENOTSUPP;
4173	}	4173	}
4174		4174
4175	if (btf_data_size == hdr->hdr_len) {	4175	if (!btf->base_btf && btf_data_size == hdr->hdr_len) {
4176	btf_verifier_log(env, "No data");	4176	btf_verifier_log(env, "No data");
4177	return -EINVAL;	4177	return -EINVAL;
4178	}	4178	}

kernel/bpf/cgroup.c+3−2

 		if (ctx.optlen != 0) {
 			*optlen = ctx.optlen;
 			*kernel_optval = ctx.optval;
+			/* export and don't free sockopt buf */
+			return 0;
 		}
 	}
 out:
-	if (ret)
+	sockopt_free_buf(&ctx);
-		sockopt_free_buf(&ctx);
 	return ret;
 }

kernel/bpf/helpers.c+1−1

@@ -108,7 +108,7 @@ BPF_CALL_2(bpf_map_peek_elem, struct bpf_map , map, void , value) · 107 unmodified lines
108	}	108	}
109		109
110	const struct bpf_func_proto bpf_map_peek_elem_proto = {	110	const struct bpf_func_proto bpf_map_peek_elem_proto = {
111	.func = bpf_map_pop_elem,	111	.func = bpf_map_peek_elem,
112	.gpl_only = false,	112	.gpl_only = false,
113	.ret_type = RET_INTEGER,	113	.ret_type = RET_INTEGER,
114	.arg1_type = ARG_CONST_MAP_PTR,	114	.arg1_type = ARG_CONST_MAP_PTR,

kernel/bpf/syscall.c+4−2

 out_put_prog:
 	if (tgt_prog_fd && tgt_prog)
 		bpf_prog_put(tgt_prog);
-	bpf_prog_put(prog);
 	return err;
 }
 			tp_name = prog->aux->attach_func_name;
 			break;
 		}
-		return bpf_tracing_prog_attach(prog, 0, 0);
+		err = bpf_tracing_prog_attach(prog, 0, 0);
+		if (err >= 0)
+			return err;
+		goto out_put_prog;
 	case BPF_PROG_TYPE_RAW_TRACEPOINT:
 	case BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE:
 		if (strncpy_from_user(buf,

kernel/bpf/verifier.c+5−3

 	case PTR_TO_RDWR_BUF:
 	case PTR_TO_RDWR_BUF_OR_NULL:
 	case PTR_TO_PERCPU_BTF_ID:
+	case PTR_TO_MEM:
+	case PTR_TO_MEM_OR_NULL:
 		return true;
 	default:
 		return false;
 	return res < a;
 }
-static bool signed_add32_overflows(s64 a, s64 b)
+static bool signed_add32_overflows(s32 a, s32 b)
 {
 	/* Do the add in u32, where overflow is well-defined */
 	s32 res = (s32)((u32)a + (u32)b);
 	return res < a;
 }
-static bool signed_sub_overflows(s32 a, s32 b)
+static bool signed_sub_overflows(s64 a, s64 b)
 {
 	/* Do the sub in u64, where overflow is well-defined */
 	s64 res = (s64)((u64)a - (u64)b);
 static bool signed_sub32_overflows(s32 a, s32 b)
 {
-	/* Do the sub in u64, where overflow is well-defined */
+	/* Do the sub in u32, where overflow is well-defined */
 	s32 res = (s32)((u32)a - (u32)b);
 	if (b < 0)

kernel/signal.c+3−0

@@ -2550,6 +2550,9 @@ bool get_signal(struct ksignal *ksig) · 2549 unmodified lines
2550	struct signal_struct *signal = current->signal;	2550	struct signal_struct *signal = current->signal;
2551	int signr;	2551	int signr;
2552		2552
		2553	if (unlikely(current->task_works))
		2554	task_work_run();
		2555
2553	/*	2556	/*
2554	* For non-generic architectures, check for TIF_NOTIFY_SIGNAL so	2557	* For non-generic architectures, check for TIF_NOTIFY_SIGNAL so
2555	* that the arch handlers don't all have to do it. If we get here	2558	* that the arch handlers don't all have to do it. If we get here

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code