aboutsummaryrefslogtreecommitdiffstats
path: root/kernel
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2015-09-10 16:53:15 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2015-09-10 16:53:15 -0400
commit65c61bc5dbbcfa1ff38e58aa834cb9a88e84a886 (patch)
treeccafacfe41411a5627b02cf17e68ea98f561bdf1 /kernel
parentb8889c4fc6ba03e289cec6a4d692f6f080a55e53 (diff)
parent30927520dbae297182990bb21d08762bcc35ce1d (diff)
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller: 1) Fix out-of-bounds array access in netfilter ipset, from Jozsef Kadlecsik. 2) Use correct free operation on netfilter conntrack templates, from Daniel Borkmann. 3) Fix route leak in SCTP, from Marcelo Ricardo Leitner. 4) Fix sizeof(pointer) in mac80211, from Thierry Reding. 5) Fix cache pointer comparison in ip6mr leading to missed unlock of mrt_lock. From Richard Laing. 6) rds_conn_lookup() needs to consider network namespace in key comparison, from Sowmini Varadhan. 7) Fix deadlock in TIPC code wrt broadcast link wakeups, from Kolmakov Dmitriy. 8) Fix fd leaks in bpf syscall, from Daniel Borkmann. 9) Fix error recovery when installing ipv6 multipath routes, we would delete the old route before we would know if we could fully commit to the new set of nexthops. Fix from Roopa Prabhu. 10) Fix run-time suspend problems in r8152, from Hayes Wang. 11) In fec, don't program the MAC address into the chip when the clocks are gated off. From Fugang Duan. 12) Fix poll behavior for netlink sockets when using rx ring mmap, from Daniel Borkmann. 13) Don't allocate memory with GFP_KERNEL from get_stats64 in r8169 driver, from Corinna Vinschen. 14) In TCP Cubic congestion control, handle idle periods better where we are application limited, in order to keep cwnd from growing out of control. From Eric Dumzet. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (65 commits) tcp_cubic: better follow cubic curve after idle period tcp: generate CA_EVENT_TX_START on data frames xen-netfront: respect user provided max_queues xen-netback: respect user provided max_queues r8169: Fix sleeping function called during get_stats64, v2 ether: add IEEE 1722 ethertype - TSN netlink, mmap: fix edge-case leakages in nf queue zero-copy netlink, mmap: don't walk rx ring on poll if receive queue non-empty cxgb4: changes for new firmware 1.14.4.0 net: fec: add netif status check before set mac address r8152: fix the runtime suspend issues r8152: split DRIVER_VERSION ipv6: fix ifnullfree.cocci warnings add microchip LAN88xx phy driver stmmac: fix check for phydev being open net: qlcnic: delete redundant memsets net: mv643xx_eth: use kzalloc net: jme: use kzalloc() instead of kmalloc+memset net: cavium: liquidio: use kzalloc in setup_glist() net: ipv6: use common fib_default_rule_pref ...
Diffstat (limited to 'kernel')
-rw-r--r--kernel/bpf/syscall.c12
-rw-r--r--kernel/bpf/verifier.c4
2 files changed, 10 insertions, 6 deletions
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index dc9b464fefa9..35bac8e8b071 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -155,14 +155,15 @@ static int map_lookup_elem(union bpf_attr *attr)
155 void __user *ukey = u64_to_ptr(attr->key); 155 void __user *ukey = u64_to_ptr(attr->key);
156 void __user *uvalue = u64_to_ptr(attr->value); 156 void __user *uvalue = u64_to_ptr(attr->value);
157 int ufd = attr->map_fd; 157 int ufd = attr->map_fd;
158 struct fd f = fdget(ufd);
159 struct bpf_map *map; 158 struct bpf_map *map;
160 void *key, *value, *ptr; 159 void *key, *value, *ptr;
160 struct fd f;
161 int err; 161 int err;
162 162
163 if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM)) 163 if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM))
164 return -EINVAL; 164 return -EINVAL;
165 165
166 f = fdget(ufd);
166 map = bpf_map_get(f); 167 map = bpf_map_get(f);
167 if (IS_ERR(map)) 168 if (IS_ERR(map))
168 return PTR_ERR(map); 169 return PTR_ERR(map);
@@ -213,14 +214,15 @@ static int map_update_elem(union bpf_attr *attr)
213 void __user *ukey = u64_to_ptr(attr->key); 214 void __user *ukey = u64_to_ptr(attr->key);
214 void __user *uvalue = u64_to_ptr(attr->value); 215 void __user *uvalue = u64_to_ptr(attr->value);
215 int ufd = attr->map_fd; 216 int ufd = attr->map_fd;
216 struct fd f = fdget(ufd);
217 struct bpf_map *map; 217 struct bpf_map *map;
218 void *key, *value; 218 void *key, *value;
219 struct fd f;
219 int err; 220 int err;
220 221
221 if (CHECK_ATTR(BPF_MAP_UPDATE_ELEM)) 222 if (CHECK_ATTR(BPF_MAP_UPDATE_ELEM))
222 return -EINVAL; 223 return -EINVAL;
223 224
225 f = fdget(ufd);
224 map = bpf_map_get(f); 226 map = bpf_map_get(f);
225 if (IS_ERR(map)) 227 if (IS_ERR(map))
226 return PTR_ERR(map); 228 return PTR_ERR(map);
@@ -265,14 +267,15 @@ static int map_delete_elem(union bpf_attr *attr)
265{ 267{
266 void __user *ukey = u64_to_ptr(attr->key); 268 void __user *ukey = u64_to_ptr(attr->key);
267 int ufd = attr->map_fd; 269 int ufd = attr->map_fd;
268 struct fd f = fdget(ufd);
269 struct bpf_map *map; 270 struct bpf_map *map;
271 struct fd f;
270 void *key; 272 void *key;
271 int err; 273 int err;
272 274
273 if (CHECK_ATTR(BPF_MAP_DELETE_ELEM)) 275 if (CHECK_ATTR(BPF_MAP_DELETE_ELEM))
274 return -EINVAL; 276 return -EINVAL;
275 277
278 f = fdget(ufd);
276 map = bpf_map_get(f); 279 map = bpf_map_get(f);
277 if (IS_ERR(map)) 280 if (IS_ERR(map))
278 return PTR_ERR(map); 281 return PTR_ERR(map);
@@ -305,14 +308,15 @@ static int map_get_next_key(union bpf_attr *attr)
305 void __user *ukey = u64_to_ptr(attr->key); 308 void __user *ukey = u64_to_ptr(attr->key);
306 void __user *unext_key = u64_to_ptr(attr->next_key); 309 void __user *unext_key = u64_to_ptr(attr->next_key);
307 int ufd = attr->map_fd; 310 int ufd = attr->map_fd;
308 struct fd f = fdget(ufd);
309 struct bpf_map *map; 311 struct bpf_map *map;
310 void *key, *next_key; 312 void *key, *next_key;
313 struct fd f;
311 int err; 314 int err;
312 315
313 if (CHECK_ATTR(BPF_MAP_GET_NEXT_KEY)) 316 if (CHECK_ATTR(BPF_MAP_GET_NEXT_KEY))
314 return -EINVAL; 317 return -EINVAL;
315 318
319 f = fdget(ufd);
316 map = bpf_map_get(f); 320 map = bpf_map_get(f);
317 if (IS_ERR(map)) 321 if (IS_ERR(map))
318 return PTR_ERR(map); 322 return PTR_ERR(map);
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index ed12e385fb75..b074b23000d6 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -283,7 +283,7 @@ static const char *const bpf_class_string[] = {
283 [BPF_ALU64] = "alu64", 283 [BPF_ALU64] = "alu64",
284}; 284};
285 285
286static const char *const bpf_alu_string[] = { 286static const char *const bpf_alu_string[16] = {
287 [BPF_ADD >> 4] = "+=", 287 [BPF_ADD >> 4] = "+=",
288 [BPF_SUB >> 4] = "-=", 288 [BPF_SUB >> 4] = "-=",
289 [BPF_MUL >> 4] = "*=", 289 [BPF_MUL >> 4] = "*=",
@@ -307,7 +307,7 @@ static const char *const bpf_ldst_string[] = {
307 [BPF_DW >> 3] = "u64", 307 [BPF_DW >> 3] = "u64",
308}; 308};
309 309
310static const char *const bpf_jmp_string[] = { 310static const char *const bpf_jmp_string[16] = {
311 [BPF_JA >> 4] = "jmp", 311 [BPF_JA >> 4] = "jmp",
312 [BPF_JEQ >> 4] = "==", 312 [BPF_JEQ >> 4] = "==",
313 [BPF_JGT >> 4] = ">", 313 [BPF_JGT >> 4] = ">",