Dmitry Antipov
9fd003edab
wifi: mac80211: use kstrtobool_from_user() in debugfs callbacks
...
Prefer 'kstrtobool_from_user()' over an ad-hoc quirks in
'aql_enable_write()' and 'force_tx_status_write()' callbacks.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://patch.msgid.link/20260417105556.2886928-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2026-04-28 09:31:27 +02:00
Dmitry Antipov
d1a0919586
securityfs: use kstrdup_const() to manage symlink targets
...
Since 'target' argument of 'securityfs_create_symlink()' is (for
now at least) a compile-time constant, it may be reasonable to
use 'kstrdup_const()' / 'kree_const()' to manage 'i_link' member
of the corresponding inode in attempt to reuse .rodata instance
rather than making a copy.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Paul Moore <paul@paul-moore.com >
2026-03-17 17:13:36 -04:00
Dmitry Antipov
0a83293322
doc: development-process: add notice on testing
...
Add testing notice to "Before creating patches" section.
Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com >
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Randy Dunlap <rdunlap@infradead.org >
Acked-by: Andy Shevchenko <andriy.shevchenko@intel.com >
Signed-off-by: Jonathan Corbet <corbet@lwn.net >
Message-ID: <20260123071523.1392729-1-dmantipov@yandex.ru >
2026-02-02 10:02:05 -07:00
Dmitry Antipov
29300f929e
ocfs2: annotate more flexible array members with __counted_by_le()
...
Annotate flexible array members of 'struct ocfs2_local_alloc' and 'struct
ocfs2_inline_data' with '__counted_by_le()' attribute to improve array
bounds checking when CONFIG_UBSAN_BOUNDS is enabled, and prefer the
convenient 'memset()' over an explicit loop to simplify
'ocfs2_clear_local_alloc()'.
Link: https://lkml.kernel.org/r/20251021105518.119953-1-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reviewed-by: Heming Zhao <heming.zhao@suse.com >
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Joseph Qi <jiangqi903@gmail.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2026-01-20 19:44:18 -08:00
Dmitry Antipov
d3cd8de2e1
ocfs2: adjust ocfs2_xa_remove_entry() to match UBSAN boundary checks
...
After introducing 2f26f58df0https://lkml.kernel.org/r/20251211155949.774485-1-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reported-by: syzbot+cf96bc82a588a27346a8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cf96bc82a588a27346a8
Reviewed-by: Heming Zhao <heming.zhao@suse.com >
Acked-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Cc: Deepanshu Kartikey <kartikey406@gmail.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Joseph Qi <jiangqi903@gmail.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2026-01-20 19:44:17 -08:00
Dmitry Antipov
42bf68dfef
media: v4l2-core: simplify v4l2_m2m_register_entity()
...
Avoid 'strlen()'/'kmalloc()'/'snprintf()' sequence by using
the convenient 'kasprintf()' in 'v4l2_m2m_register_entity()'.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org >
2026-01-13 13:10:07 +01:00
Dmitry Antipov
cbf0dc37bb
wifi: mac80211: fix list iteration in ieee80211_add_virtual_monitor()
...
Since 'mon_list' of 'struct ieee80211_local' is RCU-protected and
an instances of 'struct ieee80211_sub_if_data' are linked there
via 'u.mntr.list' member, adjust the corresponding list iteration
in 'ieee80211_add_virtual_monitor()' accordingly.
Reported-by: syzbot+bc1aabf52d0a31e91f96@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=bc1aabf52d0a31e91f96
Fixes: a5aa46f1acdmantipov@yandex.ru >
Link: https://patch.msgid.link/20251204130533.340069-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2025-12-16 10:21:12 +01:00
Dmitry Antipov
2214ec4bf8
ocfs2: fix memory leak in ocfs2_merge_rec_left()
...
In 'ocfs2_merge_rec_left()', do not reset 'left_path' to NULL after
move, thus allowing 'ocfs2_free_path()' to free it before return.
Link: https://lkml.kernel.org/r/20251205065159.392749-1-dmantipov@yandex.ru
Fixes: 677b975282dmantipov@yandex.ru >
Reported-by: syzbot+cfc7cab3bb6eaa7c4de2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cfc7cab3bb6eaa7c4de2
Reviewed-by: Heming Zhao <heming.zhao@suse.com >
Acked-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2025-12-10 16:07:43 -08:00
Dmitry Antipov
e1c70505ee
ocfs2: add extra consistency checks for chain allocator dinodes
...
When validating chain allocator dinode in 'ocfs2_validate_inode_block()',
add an extra checks whether a) the maximum amount of chain records in
'struct ocfs2_chain_list' matches the value calculated based on the
filesystem block size, and b) the next free slot index is within the valid
range.
Link: https://lkml.kernel.org/r/20251030153003.1934585-1-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reported-by: syzbot+77026564530dbc29b854@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=77026564530dbc29b854
Reported-by: syzbot+5054473a31f78f735416@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5054473a31f78f735416
Suggested-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Jun Piao <piaojun@huawei.com >
Cc: Deepanshu Kartikey <kartikey406@gmail.com >
Cc: Heming Zhao <heming.zhao@suse.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Mark Fasheh <mark@fasheh.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2025-11-20 14:03:40 -08:00
Dmitry Antipov
a2b1c419ff
ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
...
In 'ocfs2_validate_inode_block()', add an extra check whether an inode
with inline data (i.e. self-contained) has no clusters, thus preventing
an invalid inode from being passed to 'ocfs2_evict_inode()' and below.
Link: https://lkml.kernel.org/r/20251023141650.417129-1-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reported-by: syzbot+c16daba279a1161acfb0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c16daba279a1161acfb0
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Cc: Joseph Qi <jiangqi903@gmail.com >
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Cc: Heming Zhao <heming.zhao@suse.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2025-11-12 10:00:16 -08:00
Dmitry Antipov
390ac56cf0
ocfs2: add boundary check to ocfs2_check_dir_entry()
...
In 'ocfs2_check_dir_entry()', add extra check whether at least the
smallest possible dirent may be located at the specified offset within
bh's data, thus preventing an out-of-bounds accesses below.
Link: https://lkml.kernel.org/r/20251013062826.122586-1-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reported-by: syzbot+b20bbf680bb0f2ecedae@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b20bbf680bb0f2ecedae
Reviewed-by: Heming Zhao <heming.zhao@suse.com >
Cc: Joseph Qi <jiangqi903@gmail.com >
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2025-11-12 10:00:16 -08:00
Dmitry Antipov
aa5b6a72cc
ocfs2: add directory size check to ocfs2_find_dir_space_id()
...
Fix a null-pointer-deref which was detected by UBSAN:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 5317 Comm: syz-executor310 Not tainted 6.15.0-syzkaller-12141-gec7714e49479 #0 PREEMPT(full)
In 'ocfs2_find_dir_space_id()', add extra check whether the directory data
block is large enough to hold at least one directory entry, and raise
'ocfs2_error()' if the former is unexpectedly small.
Link: https://lkml.kernel.org/r/20251013103709.146001-1-dmantipov@yandex.ru
Reported-by: syzbot+ded9116588a7b73c34bc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ded9116588a7b73c34bc
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reviewed-by: Heming Zhao <heming.zhao@suse.com >
Cc: Joseph Qi <jiangqi903@gmail.com >
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2025-11-12 10:00:15 -08:00
Dmitry Antipov
1b34743c31
ocfs2: add extra consistency check to ocfs2_dx_dir_lookup_rec()
...
In 'ocfs2_dx_dir_lookup_rec()', check whether an extent list length of the
directory indexing block matches the one configured via the superblock
parameters established at mount, thus preventing an out-of-bounds accesses
while iterating over the extent records below.
Link: https://lkml.kernel.org/r/20251007094626.196143-1-dmantipov@yandex.ru
Reported-by: syzbot+30b53487d00b4f7f0922@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=30b53487d00b4f7f0922
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Reviewed-by: Heming Zhao <heming.zhao@suse.com >>
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2025-11-12 10:00:14 -08:00
Dmitry Antipov
2f26f58df0
ocfs2: annotate flexible array members with __counted_by_le()
...
Annotate flexible array members of 'struct ocfs2_extent_list',
'struct ocfs2_chain_list', 'struct ocfs2_truncate_log',
'struct ocfs2_dx_entry_list', 'ocfs2_refcount_list' and
'struct ocfs2_xattr_header' with '__counted_by_le()'
attribute to improve array bounds checking when
CONFIG_UBSAN_BOUNDS is enabled.
[dmantipov@yandex.ru: fix __counted_by_le() usage in ocfs2_expand_inline_dx_root()]
Link: https://lkml.kernel.org/r/20251014070324.130313-1-dmantipov@yandex.ru
Link: https://lkml.kernel.org/r/20251007123526.213150-1-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Reviewed-by: Heming Zhao <heming.zhao@suse.com >
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2025-11-12 10:00:14 -08:00
Dmitry Antipov
8a7d58845f
ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
...
In '__ocfs2_move_extent()', relax 'BUG()' to 'ocfs2_error()' just
to avoid crashing the whole kernel due to a filesystem corruption.
Fixes: 8f603e567ahttps://lkml.kernel.org/r/20251009102349.181126-2-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Closes: https://syzkaller.appspot.com/bug?extid=727d161855d11d81e411
Reported-by: syzbot+727d161855d11d81e411@syzkaller.appspotmail.com
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2025-11-12 10:00:02 -08:00
Dmitry Antipov
41a5e87770
ocfs2: add extra flags check in ocfs2_ioctl_move_extents()
...
In 'ocfs2_ioctl_move_extents()', add extra check whether only actually
supported flags are passed via 'ioctl(..., OCFS2_IOC_MOVE_EXT, ...)',
and reject anything beyond OCFS2_MOVE_EXT_FL_AUTO_DEFRAG and
OCFS2_MOVE_EXT_FL_PART_DEFRAG with -EINVAL. In particular,
OCFS2_MOVE_EXT_FL_COMPLETE may be set by the kernel only and
should never be passed from userspace.
Link: https://lkml.kernel.org/r/20251009102349.181126-1-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Jun Piao <piaojun@huawei.com >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Mark Fasheh <mark@fasheh.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2025-11-11 16:48:29 -08:00
Dmitry Antipov
9c64c5d91e
Revert "media: xc2028: avoid use-after-free in load_firmware_cb()"
...
Revert commit 68594cec29dmantipov@yandex.ru >
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org >
2025-10-14 15:07:36 +02:00
Dmitry Antipov
2ade91705b
tipc: adjust tipc_nodeid2string() to return string length
...
Since the value returned by 'tipc_nodeid2string()' is not used, the
function may be adjusted to return the length of the result, which
is helpful to drop a few calls to 'strlen()' in 'tipc_link_create()'
and 'tipc_link_bc_create()'. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reviewed-by: Simon Horman <horms@kernel.org >
Link: https://patch.msgid.link/20250926074113.914399-1-dmantipov@yandex.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com >
2025-09-30 11:22:39 +02:00
Dmitry Antipov
3437819c5e
ocfs2: avoid extra calls to strlen() after ocfs2_sprintf_system_inode_name()
...
Since 'ocfs2_sprintf_system_inode_name()' uses 'snprintf()' and returns
the number of characters emitted, callers of the former are better to use
that return value instead of an explicit calls to 'strlen()'.
Link: https://lkml.kernel.org/r/20250917060229.1854335-1-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Reviewed-by: Joel Becker <jlbec@evilplan.org >
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2025-09-22 20:11:00 -07:00
Dmitry Antipov
fc0d192303
xfs: scrub: use kstrdup_const() for metapath scan setups
...
Except 'xchk_setup_metapath_rtginode()' case, 'path' argument of
'xchk_setup_metapath_scan()' is a compile-time constant. So it may
be reasonable to use 'kstrdup_const()' / 'kree_const()' to manage
'path' field of 'struct xchk_metapath' in attempt to reuse .rodata
instance rather than making a copy. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reviewed-by: Darrick J. Wong <djwong@kernel.org >
Signed-off-by: Carlos Maiolino <cem@kernel.org >
2025-09-22 12:57:34 +02:00
Dmitry Antipov
8ca944fea4
ACPICA: Fix largest possible resource descriptor index
...
ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually
used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT).
Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be
clamped incorrectly and resulting value may issue an out-of-bounds
access for 'acpi_gbl_resource_types' array. Compile tested only.
Fixes: 520d4a0ee5https://github.com/acpica/acpica/commit/cf00116c
Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com >
2025-09-15 12:20:13 +02:00
Dmitry Antipov
fe7a283b39
ocfs2: add suballoc slot check in ocfs2_validate_inode_block()
...
In 'ocfs2_validate_inode_block()', add suballoc slot check similar to one
in 'ocfs2_get_suballoc_slot_bit()', thus preventing an out-of-bounds
accesses for 'local_system_inodes' in 'get_local_system_inode()'.
Most likely this fixes
https://syzkaller.appspot.com/bug?extid=a77d690840e60bc2ddd8 as well.
Link: https://lkml.kernel.org/r/20250826095106.666980-1-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reported-by: syzbot+900962ac9bf1860033f2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=900962ac9bf1860033f2
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2025-09-13 17:32:53 -07:00
Dmitry Antipov
26e84445f0
wifi: cfg80211: fix use-after-free in cmp_bss()
...
Following bss_free() quirk introduced in commit 776b358017syzbot+30754ca335e6fb7e3092@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=30754ca335e6fb7e3092
Fixes: 3ab8227d3edmantipov@yandex.ru >
Link: https://patch.msgid.link/20250813135236.799384-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2025-08-26 13:45:09 +02:00
Dmitry Antipov
a3191475d1
dm-ima: more strlen() drops
...
Following commit ebbd17695edmantipov@yandex.ru >
Reviewed-by: Hou Tao <houtao1@huawei.com >
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com >
2025-08-19 11:12:49 +02:00
Dmitry Antipov
d7f1affc55
cifs: avoid extra calls to strlen() in cifs_get_spnego_key()
...
Since 'snprintf()' returns the number of characters emitted, an
output position may be advanced with this return value rather
than using an explicit calls to 'strlen()'. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Steve French <stfrench@microsoft.com >
2025-08-11 23:20:26 -05:00
Dmitry Antipov
2fb5e56f52
btrfs: send: avoid extra calls to strlen() in gen_unique_name()
...
Since 'snprintf()' returns the number of characters which would
be emitted and output truncation is handled by 'ASSERT()', it
should be safe to use that return value instead of the subsequent
calls to 'strlen()' in 'gen_unique_name()'.
This also reduces the module's text size.
Before:
$ size fs/btrfs/btrfs.ko
text data bss dec hex filename
1897006 161571 16136 2074713 1fa859 fs/btrfs/btrfs.ko
After:
$ size fs/btrfs/btrfs.ko
text data bss dec hex filename
1896848 161571 16136 2074555 1fa7bb fs/btrfs/btrfs.ko
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com >
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reviewed-by: Filipe Manana <fdmanana@suse.com >
Signed-off-by: Filipe Manana <fdmanana@suse.com >
Reviewed-by: David Sterba <dsterba@suse.com >
Signed-off-by: David Sterba <dsterba@suse.com >
2025-07-21 23:58:05 +02:00
Dmitry Antipov
01afddcac6
binder: use guards for plain mutex- and spinlock-protected sections
...
Use 'guard(mutex)' and 'guard(spinlock)' for plain (i.e. non-scoped)
mutex- and spinlock-protected sections, respectively, thus making
locking a bit simpler. Briefly tested with 'stress-ng --binderfs'.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reviewed-by: Alice Ryhl <aliceryhl@google.com >
Acked-by: Carlos Llamas <cmllamas@google.com >
Link: https://lore.kernel.org/r/20250626073054.7706-2-dmantipov@yandex.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2025-07-16 14:11:20 +02:00
Dmitry Antipov
1da2dca2fb
binder: use kstrdup() in binderfs_binder_device_create()
...
In 'binderfs_binder_device_create()', use 'kstrdup()' to copy the
newly created device's name, thus making the former a bit simpler.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Carlos Llamas <cmllamas@google.com >
Reviewed-by: "Tiffany Y. Yang" <ynaffit@google.com >
Reviewed-by: Alice Ryhl <aliceryhl@google.com >
Link: https://lore.kernel.org/r/20250626073054.7706-1-dmantipov@yandex.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2025-07-16 14:11:20 +02:00
Dmitry Antipov
ebbd17695e
dm: ima: avoid extra calls to strlen()
...
Since 'scnprintf()' returns the number of characters emitted (not
including the trailing '\0'), use that return value instead of the
subsequent calls to 'strlen()' where appropriate. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com >
2025-06-27 13:07:17 +02:00
Dmitry Antipov
2b7c9664c3
fs: annotate suspected data race between poll_schedule_timeout() and pollwake()
...
When running almost any select()/poll() workload intense enough,
KCSAN is likely to report data races around using 'triggered' flag
of 'struct poll_wqueues'. For example, running 'find /' on a tty
console may trigger the following:
BUG: KCSAN: data-race in poll_schedule_timeout / pollwake
write to 0xffffc900030cfb90 of 4 bytes by task 97 on cpu 5:
pollwake+0xd1/0x130
__wake_up_common_lock+0x7f/0xd0
n_tty_receive_buf_common+0x776/0xc30
n_tty_receive_buf2+0x3d/0x60
tty_ldisc_receive_buf+0x6b/0x100
tty_port_default_receive_buf+0x63/0xa0
flush_to_ldisc+0x169/0x3c0
process_scheduled_works+0x6fe/0xf40
worker_thread+0x53b/0x7b0
kthread+0x4f8/0x590
ret_from_fork+0x28c/0x450
ret_from_fork_asm+0x1a/0x30
read to 0xffffc900030cfb90 of 4 bytes by task 5802 on cpu 4:
poll_schedule_timeout+0x96/0x160
do_sys_poll+0x966/0xb30
__se_sys_ppoll+0x1c3/0x210
__x64_sys_ppoll+0x71/0x90
x64_sys_call+0x3079/0x32b0
do_syscall_64+0xfa/0x3b0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
According to Jan, "there's no practical issue here because it is hard
to imagine how the compiler could compile the above code using some
intermediate values stored into 'triggered' or multiple fetches from
'triggered'". Nevertheless, silence KCSAN by using WRITE_ONCE() in
__pollwake() and READ_ONCE() in poll_schedule_timeout(), respectively.
Link: https://lore.kernel.org/linux-fsdevel/bwx72orsztfjx6aoftzzkl7wle3hi4syvusuwc7x36nw6t235e@bjwrosehblty
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://lore.kernel.org/20250620063059.1800689-1-dmantipov@yandex.ru
Acked-by: Marco Elver <elver@google.com >
Reviewed-by: Jan Kara <jack@suse.cz >
Signed-off-by: Christian Brauner <brauner@kernel.org >
2025-06-23 12:36:51 +02:00
Dmitry Antipov
15d2530769
wifi: carl9170: do not ping device which has failed to load firmware
...
Syzkaller reports [1, 2] crashes caused by an attempts to ping
the device which has failed to load firmware. Since such a device
doesn't pass 'ieee80211_register_hw()', an internal workqueue
managed by 'ieee80211_queue_work()' is not yet created and an
attempt to queue work on it causes null-ptr-deref.
[1] https://syzkaller.appspot.com/bug?extid=9a4aec827829942045ff
[2] https://syzkaller.appspot.com/bug?extid=0d8afba53e8fb2633217
Fixes: e4a668c590dmantipov@yandex.ru >
Acked-by: Christian Lamparter <chunkeey@gmail.com >
Link: https://patch.msgid.link/20250616181205.38883-1-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com >
2025-06-17 16:28:35 -07:00
Dmitry Antipov
40ee2afafc
ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()
...
Enlarge the critical section in ring_buffer_subbuf_order_set() to
ensure that error handling takes place with per-buffer mutex held,
thus preventing list corruption and other concurrency-related issues.
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org >
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com >
Cc: Tzvetomir Stoyanov <tz.stoyanov@gmail.com >
Link: https://lore.kernel.org/20250606112242.1510605-1-dmantipov@yandex.ru
Reported-by: syzbot+05d673e83ec640f0ced9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=05d673e83ec640f0ced9
Fixes: f9b94daa54dmantipov@yandex.ru >
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org >
2025-06-06 20:25:55 -04:00
Dmitry Antipov
03f1700b9b
Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands
...
In 'mgmt_hci_cmd_sync()', check whether the size of parameters passed
in 'struct mgmt_cp_hci_cmd_sync' matches the total size of the data
(i.e. 'sizeof(struct mgmt_cp_hci_cmd_sync)' plus trailing bytes).
Otherwise, large invalid 'params_len' will cause 'hci_cmd_sync_alloc()'
to do 'skb_put_data()' from an area beyond the one actually passed to
'mgmt_hci_cmd_sync()'.
Reported-by: syzbot+5fe2d5bfbfbec0b675a0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5fe2d5bfbfbec0b675a0
Fixes: 827af4787edmantipov@yandex.ru >
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com >
2025-05-30 13:29:30 -04:00
Dmitry Antipov
3bb88524b7
Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach()
...
In 'mgmt_mesh_foreach()', iterate over mesh commands
rather than generic mgmt ones. Compile tested only.
Fixes: b338d91703dmantipov@yandex.ru >
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com >
2025-05-22 13:06:11 -04:00
Dmitry Antipov
8c0a559825
binder: fix use-after-free in binderfs_evict_inode()
...
Running 'stress-ng --binderfs 16 --timeout 300' under KASAN-enabled
kernel, I've noticed the following:
BUG: KASAN: slab-use-after-free in binderfs_evict_inode+0x1de/0x2d0
Write of size 8 at addr ffff88807379bc08 by task stress-ng-binde/1699
CPU: 0 UID: 0 PID: 1699 Comm: stress-ng-binde Not tainted 6.14.0-rc7-g586de92313fc-dirty #13
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x1c2/0x2a0
? __pfx_dump_stack_lvl+0x10/0x10
? __pfx__printk+0x10/0x10
? __pfx_lock_release+0x10/0x10
? __virt_addr_valid+0x18c/0x540
? __virt_addr_valid+0x469/0x540
print_report+0x155/0x840
? __virt_addr_valid+0x18c/0x540
? __virt_addr_valid+0x469/0x540
? __phys_addr+0xba/0x170
? binderfs_evict_inode+0x1de/0x2d0
kasan_report+0x147/0x180
? binderfs_evict_inode+0x1de/0x2d0
binderfs_evict_inode+0x1de/0x2d0
? __pfx_binderfs_evict_inode+0x10/0x10
evict+0x524/0x9f0
? __pfx_lock_release+0x10/0x10
? __pfx_evict+0x10/0x10
? do_raw_spin_unlock+0x4d/0x210
? _raw_spin_unlock+0x28/0x50
? iput+0x697/0x9b0
__dentry_kill+0x209/0x660
? shrink_kill+0x8d/0x2c0
shrink_kill+0xa9/0x2c0
shrink_dentry_list+0x2e0/0x5e0
shrink_dcache_parent+0xa2/0x2c0
? __pfx_shrink_dcache_parent+0x10/0x10
? __pfx_lock_release+0x10/0x10
? __pfx_do_raw_spin_lock+0x10/0x10
do_one_tree+0x23/0xe0
shrink_dcache_for_umount+0xa0/0x170
generic_shutdown_super+0x67/0x390
kill_litter_super+0x76/0xb0
binderfs_kill_super+0x44/0x90
deactivate_locked_super+0xb9/0x130
cleanup_mnt+0x422/0x4c0
? lockdep_hardirqs_on+0x9d/0x150
task_work_run+0x1d2/0x260
? __pfx_task_work_run+0x10/0x10
resume_user_mode_work+0x52/0x60
syscall_exit_to_user_mode+0x9a/0x120
do_syscall_64+0x103/0x210
? asm_sysvec_apic_timer_interrupt+0x1a/0x20
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0xcac57b
Code: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8
RSP: 002b:00007ffecf4226a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007ffecf422720 RCX: 0000000000cac57b
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffecf422850
RBP: 00007ffecf422850 R08: 0000000028d06ab1 R09: 7fffffffffffffff
R10: 3fffffffffffffff R11: 0000000000000246 R12: 00007ffecf422718
R13: 00007ffecf422710 R14: 00007f478f87b658 R15: 00007ffecf422830
</TASK>
Allocated by task 1705:
kasan_save_track+0x3e/0x80
__kasan_kmalloc+0x8f/0xa0
__kmalloc_cache_noprof+0x213/0x3e0
binderfs_binder_device_create+0x183/0xa80
binder_ctl_ioctl+0x138/0x190
__x64_sys_ioctl+0x120/0x1b0
do_syscall_64+0xf6/0x210
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 1705:
kasan_save_track+0x3e/0x80
kasan_save_free_info+0x46/0x50
__kasan_slab_free+0x62/0x70
kfree+0x194/0x440
evict+0x524/0x9f0
do_unlinkat+0x390/0x5b0
__x64_sys_unlink+0x47/0x50
do_syscall_64+0xf6/0x210
entry_SYSCALL_64_after_hwframe+0x77/0x7f
This 'stress-ng' workload causes the concurrent deletions from
'binder_devices' and so requires full-featured synchronization
to prevent list corruption.
I've found this issue independently but pretty sure that syzbot did
the same, so Reported-by: and Closes: should be applicable here as well.
Cc: stable@vger.kernel.org
Reported-by: syzbot+353d7b75658a95aa955a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=353d7b75658a95aa955a
Fixes: e77aff5528dmantipov@yandex.ru >
Acked-by: Carlos Llamas <cmllamas@google.com >
Signed-off-by: Carlos Llamas <cmllamas@google.com >
Reviewed-by: Alice Ryhl <aliceryhl@google.com >
Link: https://lore.kernel.org/r/20250517170957.1317876-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2025-05-21 14:38:49 +02:00
Dmitry Antipov
a6aeb73997
module: ensure that kobject_put() is safe for module type kobjects
...
In 'lookup_or_create_module_kobject()', an internal kobject is created
using 'module_ktype'. So call to 'kobject_put()' on error handling
path causes an attempt to use an uninitialized completion pointer in
'module_kobject_release()'. In this scenario, we just want to release
kobject without an extra synchronization required for a regular module
unloading process, so adding an extra check whether 'complete()' is
actually required makes 'kobject_put()' safe.
Reported-by: syzbot+7fb8a372e1f6add936dd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7fb8a372e1f6add936dd
Fixes: 942e443127stable@vger.kernel.org
Suggested-by: Petr Pavlu <petr.pavlu@suse.com >
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://lore.kernel.org/r/20250507065044.86529-1-dmantipov@yandex.ru
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com >
2025-05-07 20:24:59 +02:00
Dmitry Antipov
ad748a7367
wifi: rt2x00: remove weird self-assignment in rt2800_loft_search()
...
Remove weird self-assignment in 'rt2800_loft_search()' assuming
that it was just a typo. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl >
Link: https://patch.msgid.link/20250321134256.821596-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2025-04-23 15:08:28 +02:00
Dmitry Antipov
20d3c19bd8
wifi: rtw88: do not ignore hardware read error during DPK
...
In 'rtw8822c_dpk_cal_coef1()', do not ignore error returned
by 'check_hw_ready()' but issue a warning to denote possible
DPK issue. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 5227c2ee45pkshih@realtek.com >
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com >
Link: https://patch.msgid.link/20250415090720.194048-1-dmantipov@yandex.ru
2025-04-17 13:55:15 +08:00
Dmitry Antipov
7f7573bd4f
Input: pm8941-pwrkey - fix dev_dbg() output in pm8941_pwrkey_irq()
...
Since 'sw_debounce_end_time' of 'struct pm8941_pwrkey' is of type
'ktime_t', use 'ktime_to_us()' to print the value in microseconds
as it is announced in a call to 'dev_dbg()'. Compile tested only.
Fixes: 0b65118e6bdmantipov@yandex.ru >
Reviewed-by: David Collins <quic_collinsd@quicinc.com >
Link: https://lore.kernel.org/r/20250216170336.861025-1-dmantipov@yandex.ru
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com >
2025-02-25 12:58:54 -08:00
Dmitry Antipov
bfc8e71ef6
wifi: rtw89: rtw8852b{t}: fix TSSI debug timestamps
...
Since the vendor driver is claimed to measure 'tssi_alimk_time' of
'struct rtw89_tssi_info' in microseconds, adjust rtw8852b{t}-specific
'_tssi_alimentk()' to not mess the former with nanoseconds and print
both per-call and accumulated times. Compile tested only.
Fixes: 7f18a70d7bdmantipov@yandex.ru >
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com >
Link: https://patch.msgid.link/20250213095006.1308810-1-dmantipov@yandex.ru
2025-02-21 09:29:31 +08:00
Dmitry Antipov
8c3f9a70d2
jfs: reject on-disk inodes of an unsupported type
...
Syzbot has reported the following BUG:
kernel BUG at fs/inode.c:668!
Oops: invalid opcode: 0000 [#1 ] PREEMPT SMP KASAN PTI
CPU: 3 UID: 0 PID: 139 Comm: jfsCommit Not tainted 6.12.0-rc4-syzkaller-00085-g4e46774408d9 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
RIP: 0010:clear_inode+0x168/0x190
Code: 4c 89 f7 e8 ba fe e5 ff e9 61 ff ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 7c c1 4c 89 f7 e8 90 ff e5 ff eb b7
0b e8 01 5d 7f ff 90 0f 0b e8 f9 5c 7f ff 90 0f 0b e8 f1 5c 7f
RSP: 0018:ffffc900027dfae8 EFLAGS: 00010093
RAX: ffffffff82157a87 RBX: 0000000000000001 RCX: ffff888104d4b980
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900027dfc90 R08: ffffffff82157977 R09: fffff520004fbf38
R10: dffffc0000000000 R11: fffff520004fbf38 R12: dffffc0000000000
R13: ffff88811315bc00 R14: ffff88811315bda8 R15: ffff88811315bb80
FS: 0000000000000000(0000) GS:ffff888135f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005565222e0578 CR3: 0000000026ef0000 CR4: 00000000000006f0
Call Trace:
<TASK>
? __die_body+0x5f/0xb0
? die+0x9e/0xc0
? do_trap+0x15a/0x3a0
? clear_inode+0x168/0x190
? do_error_trap+0x1dc/0x2c0
? clear_inode+0x168/0x190
? __pfx_do_error_trap+0x10/0x10
? report_bug+0x3cd/0x500
? handle_invalid_op+0x34/0x40
? clear_inode+0x168/0x190
? exc_invalid_op+0x38/0x50
? asm_exc_invalid_op+0x1a/0x20
? clear_inode+0x57/0x190
? clear_inode+0x167/0x190
? clear_inode+0x168/0x190
? clear_inode+0x167/0x190
jfs_evict_inode+0xb5/0x440
? __pfx_jfs_evict_inode+0x10/0x10
evict+0x4ea/0x9b0
? __pfx_evict+0x10/0x10
? iput+0x713/0xa50
txUpdateMap+0x931/0xb10
? __pfx_txUpdateMap+0x10/0x10
jfs_lazycommit+0x49a/0xb80
? _raw_spin_unlock_irqrestore+0x8f/0x140
? lockdep_hardirqs_on+0x99/0x150
? __pfx_jfs_lazycommit+0x10/0x10
? __pfx_default_wake_function+0x10/0x10
? __kthread_parkme+0x169/0x1d0
? __pfx_jfs_lazycommit+0x10/0x10
kthread+0x2f2/0x390
? __pfx_jfs_lazycommit+0x10/0x10
? __pfx_kthread+0x10/0x10
ret_from_fork+0x4d/0x80
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
This happens when 'clear_inode()' makes an attempt to finalize an underlying
JFS inode of unknown type. According to JFS layout description from
https://jfs.sourceforge.net/project/pub/jfslayout.pdf , inode types from 5 to
15 are reserved for future extensions and should not be encountered on a valid
filesystem. So add an extra check for valid inode type in 'copy_from_dinode()'.
Reported-by: syzbot+ac2116e48989e84a2893@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ac2116e48989e84a2893
Fixes: 79ac5a46c5dmantipov@yandex.ru >
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com >
2025-02-19 15:06:44 -06:00
Dmitry Antipov
0f2b59a980
wifi: ath9k: do not submit zero bytes to the entropy pool
...
In 'ath_cmn_process_fft()', it doesn't make too much sense to
add zero bytes in attempt to improve randomness. So swap calls
to 'memset()' and 'add_device_randomness()' to feed the pool
with actual FFT results rather than zeroes. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Fixes: 2aa56cca35toke@toke.dk >
Link: https://patch.msgid.link/20250123141058.1696502-1-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com >
2025-01-29 08:56:33 -08:00
Dmitry Antipov
8fe64b0fed
wifi: ath9k: use unsigned long for activity check timestamp
...
Since 'rx_active_check_time' of 'struct ath_softc' is in jiffies,
prefer 'unsigned long' over 'u32' to avoid possible truncation in
'ath_hw_rx_inactive_check()'. Found with clang's -Wshorten-64-to-32,
compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk >
Link: https://patch.msgid.link/20250115171750.259917-2-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com >
2025-01-17 15:39:22 -08:00
Dmitry Antipov
7f2e104f2e
wifi: ath9k: cleanup struct ath_tx_control and ath_tx_prepare()
...
After switching to mac80211 software queues, pointer to 'struct ath_node'
in 'struct ath_tx_control' is still assigned but not actually used. So drop
it and cleanup related things in 'ath_tx_prepare()'. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk >
Link: https://patch.msgid.link/20250115171750.259917-1-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com >
2025-01-17 15:39:22 -08:00
Dmitry Antipov
1a0d24775c
wifi: cfg80211: adjust allocation of colocated AP data
...
In 'cfg80211_scan_6ghz()', an instances of 'struct cfg80211_colocated_ap'
are allocated as if they would have 'ssid' as trailing VLA member. Since
this is not so, extra IEEE80211_MAX_SSID_LEN bytes are not needed.
Briefly tested with KUnit.
Fixes: c8cb5b854bdmantipov@yandex.ru >
Link: https://patch.msgid.link/20250113155417.552587-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2025-01-15 14:42:14 +01:00
Dmitry Antipov
a0f8a9a963
ocfs2: miscellaneous spelling fixes
...
Correct spelling here and there as suggested by codespell.
Link: https://lkml.kernel.org/r/20241115151013.1404929-1-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2025-01-12 20:21:07 -08:00
Dmitry Antipov
a72eaa1756
wifi: ath9k: cleanup ath9k_hw_get_nf_hist_mid()
...
In 'ath9k_hw_get_nf_hist_mid()', prefer 'memcpy()' and 'sort()'
over an ad-hoc things. Briefly tested as a separate module.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk >
Link: https://patch.msgid.link/20250109080703.106692-1-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com >
2025-01-10 14:42:51 -08:00
Dmitry Antipov
0cc6510ca4
wifi: ath9k: simplify internal time management
...
Prefer 'ktime_t' over 'struct timespec64' for 'struct ath_chanctx' and
'struct ath_softc' timestamps, choose standard kernel time API over an
ad-hoc math in 'chanctx_event_delta()' and 'ath9k_hw_get_tsf_offset()',
adjust related users. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk >
Link: https://patch.msgid.link/20241209155027.636400-3-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com >
2024-12-19 09:41:03 -08:00
Dmitry Antipov
d19ac7ef6e
wifi: ath9k: cleanup a few (mostly) TX-related routines
...
Remove unused 'struct ath_softc *' argument of 'ath_pkt_duration()',
'ath_tx_update_baw()', 'ath_get_skb_tid()', 'ath_tx_addto_baw()' and
'ath_tx_count_frames()', adjust related users. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk >
Link: https://patch.msgid.link/20241209155027.636400-2-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com >
2024-12-19 09:41:03 -08:00
Dmitry Antipov
2a7e02fa91
wifi: ath9k: cleanup ath_txq_skb_done()
...
Since 'txq' argument of 'ath_txq_skb_done()' is actually
(mis|un)used, convert the former to local variable and
adjust all related users. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk >
Link: https://patch.msgid.link/20241209155027.636400-1-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com >
2024-12-19 09:41:03 -08:00
Dmitry Antipov
76f01376df
f2fs: ensure that node info flags are always initialized
...
Syzbot has reported the following KMSAN splat:
BUG: KMSAN: uninit-value in f2fs_new_node_page+0x1494/0x1630
f2fs_new_node_page+0x1494/0x1630
f2fs_new_inode_page+0xb9/0x100
f2fs_init_inode_metadata+0x176/0x1e90
f2fs_add_inline_entry+0x723/0xc90
f2fs_do_add_link+0x48f/0xa70
f2fs_symlink+0x6af/0xfc0
vfs_symlink+0x1f1/0x470
do_symlinkat+0x471/0xbc0
__x64_sys_symlink+0xcf/0x140
x64_sys_call+0x2fcc/0x3d90
do_syscall_64+0xd9/0x1b0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable new_ni created at:
f2fs_new_node_page+0x9d/0x1630
f2fs_new_inode_page+0xb9/0x100
So adjust 'f2fs_get_node_info()' to ensure that 'flag'
field of 'struct node_info' is always initialized.
Reported-by: syzbot+5141f6db57a2f7614352@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5141f6db57a2f7614352
Fixes: e05df3b115chao@kernel.org >
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reviewed-by: Chao Yu <chao@kernel.org >
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org >
2024-12-16 16:12:54 +00:00
Dmitry Antipov
3f4a0948c3
wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
...
In 'wlc_phy_iqcal_gainparams_nphy()', add gain range check to WARN()
instead of possible out-of-bounds 'tbl_iqcal_gainparams_nphy' access.
Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com >
Signed-off-by: Kalle Valo <kvalo@kernel.org >
Link: https://patch.msgid.link/20241210070441.836362-1-dmantipov@yandex.ru
2024-12-13 14:54:42 +02:00
Dmitry Antipov
a8c695005b
can: j1939: j1939_session_new(): fix skb reference counting
...
Since j1939_session_skb_queue() does an extra skb_get() for each new
skb, do the same for the initial one in j1939_session_new() to avoid
refcount underflow.
Reported-by: syzbot+d4e8dc385d9258220c31@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d4e8dc385d9258220c31
Fixes: 9d71dd0c70dmantipov@yandex.ru >
Tested-by: Oleksij Rempel <o.rempel@pengutronix.de >
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de >
Link: https://patch.msgid.link/20241105094823.2403806-1-dmantipov@yandex.ru
[mkl: clean up commit message]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de >
2024-12-02 09:53:39 +01:00
Dmitry Antipov
04317f4eb2
netfilter: x_tables: fix LED ID check in led_tg_check()
...
Syzbot has reported the following BUG detected by KASAN:
BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70
Read of size 1 at addr ffff8881022da0c8 by task repro/5879
...
Call Trace:
<TASK>
dump_stack_lvl+0x241/0x360
? __pfx_dump_stack_lvl+0x10/0x10
? __pfx__printk+0x10/0x10
? _printk+0xd5/0x120
? __virt_addr_valid+0x183/0x530
? __virt_addr_valid+0x183/0x530
print_report+0x169/0x550
? __virt_addr_valid+0x183/0x530
? __virt_addr_valid+0x183/0x530
? __virt_addr_valid+0x45f/0x530
? __phys_addr+0xba/0x170
? strlen+0x58/0x70
kasan_report+0x143/0x180
? strlen+0x58/0x70
strlen+0x58/0x70
kstrdup+0x20/0x80
led_tg_check+0x18b/0x3c0
xt_check_target+0x3bb/0xa40
? __pfx_xt_check_target+0x10/0x10
? stack_depot_save_flags+0x6e4/0x830
? nft_target_init+0x174/0xc30
nft_target_init+0x82d/0xc30
? __pfx_nft_target_init+0x10/0x10
? nf_tables_newrule+0x1609/0x2980
? nf_tables_newrule+0x1609/0x2980
? rcu_is_watching+0x15/0xb0
? nf_tables_newrule+0x1609/0x2980
? nf_tables_newrule+0x1609/0x2980
? __kmalloc_noprof+0x21a/0x400
nf_tables_newrule+0x1860/0x2980
? __pfx_nf_tables_newrule+0x10/0x10
? __nla_parse+0x40/0x60
nfnetlink_rcv+0x14e5/0x2ab0
? __pfx_validate_chain+0x10/0x10
? __pfx_nfnetlink_rcv+0x10/0x10
? __lock_acquire+0x1384/0x2050
? netlink_deliver_tap+0x2e/0x1b0
? __pfx_lock_release+0x10/0x10
? netlink_deliver_tap+0x2e/0x1b0
netlink_unicast+0x7f8/0x990
? __pfx_netlink_unicast+0x10/0x10
? __virt_addr_valid+0x183/0x530
? __check_object_size+0x48e/0x900
netlink_sendmsg+0x8e4/0xcb0
? __pfx_netlink_sendmsg+0x10/0x10
? aa_sock_msg_perm+0x91/0x160
? __pfx_netlink_sendmsg+0x10/0x10
__sock_sendmsg+0x223/0x270
____sys_sendmsg+0x52a/0x7e0
? __pfx_____sys_sendmsg+0x10/0x10
__sys_sendmsg+0x292/0x380
? __pfx___sys_sendmsg+0x10/0x10
? lockdep_hardirqs_on_prepare+0x43d/0x780
? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
? exc_page_fault+0x590/0x8c0
? do_syscall_64+0xb6/0x230
do_syscall_64+0xf3/0x230
entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
</TASK>
Since an invalid (without '\0' byte at all) byte sequence may be passed
from userspace, add an extra check to ensure that such a sequence is
rejected as possible ID and so never passed to 'kstrdup()' and further.
Reported-by: syzbot+6c8215822f35fdb35667@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c8215822f35fdb35667
Fixes: 268cb38e18dmantipov@yandex.ru >
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org >
2024-11-28 13:14:24 +01:00
Dmitry Antipov
8f5e8e7efb
wifi: ath11k: miscellaneous spelling fixes
...
Correct spelling here and there as suggested by codespell.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Kalle Valo <kvalo@kernel.org >
Link: https://patch.msgid.link/20241111070152.85140-4-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com >
2024-11-21 07:52:50 -08:00
Dmitry Antipov
93962446ef
wifi: ath11k: cleanup struct ath11k_mon_data
...
Remove initialized but otherwise unused 'rx_status_q' member of
'struct ath11k_mon_data' and adjust 'ath11k_dp_rx_pdev_mon_status_attach'
accordingly. Compile tested only.
Fixes: 67a9d399fcdmantipov@yandex.ru >
Acked-by: Kalle Valo <kvalo@kernel.org >
Link: https://patch.msgid.link/20241111070152.85140-3-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com >
2024-11-21 07:52:49 -08:00
Dmitry Antipov
95e5de4aae
wifi: ath11k: cleanup struct ath11k_reg_tpc_power_info
...
Remove unused 'ap_constraint_power' field of 'struct
ath11k_reg_tpc_power_info' and adjust related comment.
Compile tested only.
Fixes: 6f4e235be6dmantipov@yandex.ru >
Acked-by: Kalle Valo <kvalo@kernel.org >
Link: https://patch.msgid.link/20241111070152.85140-2-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com >
2024-11-21 07:52:49 -08:00
Dmitry Antipov
733a8c69de
wifi: ath11k: cleanup struct ath11k_vif
...
Remove set but otherwise unused 'tx_seq_no' member of 'struct ath11k_vif',
adjust 'ath11k_control_beaconing()' accordingly. This field was actually
unused since an initial commit of the driver. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Kalle Valo <kvalo@kernel.org >
Link: https://patch.msgid.link/20241111070152.85140-1-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com >
2024-11-21 07:52:49 -08:00
Dmitry Antipov
e64285ff41
rocker: fix link status detection in rocker_carrier_init()
...
Since '1 << rocker_port->pport' may be undefined for port >= 32,
cast the left operand to 'unsigned long long' like it's done in
'rocker_port_set_enable()' above. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://patch.msgid.link/20241114151946.519047-1-dmantipov@yandex.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org >
2024-11-18 18:39:21 -08:00
Dmitry Antipov
3500000bb1
ceph: miscellaneous spelling fixes
...
Correct spelling here and there as suggested by codespell.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reviewed-by: Ilya Dryomov <idryomov@gmail.com >
Signed-off-by: Ilya Dryomov <idryomov@gmail.com >
2024-11-18 17:34:36 +01:00
Dmitry Antipov
737f341378
ocfs2: uncache inode which has failed entering the group
...
Syzbot has reported the following BUG:
kernel BUG at fs/ocfs2/uptodate.c:509!
...
Call Trace:
<TASK>
? __die_body+0x5f/0xb0
? die+0x9e/0xc0
? do_trap+0x15a/0x3a0
? ocfs2_set_new_buffer_uptodate+0x145/0x160
? do_error_trap+0x1dc/0x2c0
? ocfs2_set_new_buffer_uptodate+0x145/0x160
? __pfx_do_error_trap+0x10/0x10
? handle_invalid_op+0x34/0x40
? ocfs2_set_new_buffer_uptodate+0x145/0x160
? exc_invalid_op+0x38/0x50
? asm_exc_invalid_op+0x1a/0x20
? ocfs2_set_new_buffer_uptodate+0x2e/0x160
? ocfs2_set_new_buffer_uptodate+0x144/0x160
? ocfs2_set_new_buffer_uptodate+0x145/0x160
ocfs2_group_add+0x39f/0x15a0
? __pfx_ocfs2_group_add+0x10/0x10
? __pfx_lock_acquire+0x10/0x10
? mnt_get_write_access+0x68/0x2b0
? __pfx_lock_release+0x10/0x10
? rcu_read_lock_any_held+0xb7/0x160
? __pfx_rcu_read_lock_any_held+0x10/0x10
? smack_log+0x123/0x540
? mnt_get_write_access+0x68/0x2b0
? mnt_get_write_access+0x68/0x2b0
? mnt_get_write_access+0x226/0x2b0
ocfs2_ioctl+0x65e/0x7d0
? __pfx_ocfs2_ioctl+0x10/0x10
? smack_file_ioctl+0x29e/0x3a0
? __pfx_smack_file_ioctl+0x10/0x10
? lockdep_hardirqs_on_prepare+0x43d/0x780
? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
? __pfx_ocfs2_ioctl+0x10/0x10
__se_sys_ioctl+0xfb/0x170
do_syscall_64+0xf3/0x230
entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
</TASK>
When 'ioctl(OCFS2_IOC_GROUP_ADD, ...)' has failed for the particular
inode in 'ocfs2_verify_group_and_input()', corresponding buffer head
remains cached and subsequent call to the same 'ioctl()' for the same
inode issues the BUG() in 'ocfs2_set_new_buffer_uptodate()' (trying
to cache the same buffer head of that inode). Fix this by uncaching
the buffer head with 'ocfs2_remove_from_cache()' on error path in
'ocfs2_group_add()'.
Link: https://lkml.kernel.org/r/20241114043844.111847-1-dmantipov@yandex.ru
Fixes: 7909f2bf83dmantipov@yandex.ru >
Reported-by: syzbot+453873f1588c2d75b447@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=453873f1588c2d75b447
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Cc: Dmitry Antipov <dmantipov@yandex.ru >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Cc: <stable@vger.kernel.org >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2024-11-14 22:43:48 -08:00
Dmitry Antipov
27aabf27fd
Bluetooth: fix use-after-free in device_for_each_child()
...
Syzbot has reported the following KASAN splat:
BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0
Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980
CPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x100/0x190
? device_for_each_child+0x18f/0x1a0
print_report+0x13a/0x4cb
? __virt_addr_valid+0x5e/0x590
? __phys_addr+0xc6/0x150
? device_for_each_child+0x18f/0x1a0
kasan_report+0xda/0x110
? device_for_each_child+0x18f/0x1a0
? __pfx_dev_memalloc_noio+0x10/0x10
device_for_each_child+0x18f/0x1a0
? __pfx_device_for_each_child+0x10/0x10
pm_runtime_set_memalloc_noio+0xf2/0x180
netdev_unregister_kobject+0x1ed/0x270
unregister_netdevice_many_notify+0x123c/0x1d80
? __mutex_trylock_common+0xde/0x250
? __pfx_unregister_netdevice_many_notify+0x10/0x10
? trace_contention_end+0xe6/0x140
? __mutex_lock+0x4e7/0x8f0
? __pfx_lock_acquire.part.0+0x10/0x10
? rcu_is_watching+0x12/0xc0
? unregister_netdev+0x12/0x30
unregister_netdevice_queue+0x30d/0x3f0
? __pfx_unregister_netdevice_queue+0x10/0x10
? __pfx_down_write+0x10/0x10
unregister_netdev+0x1c/0x30
bnep_session+0x1fb3/0x2ab0
? __pfx_bnep_session+0x10/0x10
? __pfx_lock_release+0x10/0x10
? __pfx_woken_wake_function+0x10/0x10
? __kthread_parkme+0x132/0x200
? __pfx_bnep_session+0x10/0x10
? kthread+0x13a/0x370
? __pfx_bnep_session+0x10/0x10
kthread+0x2b7/0x370
? __pfx_kthread+0x10/0x10
ret_from_fork+0x48/0x80
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 4974:
kasan_save_stack+0x30/0x50
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
__kmalloc_noprof+0x1d1/0x440
hci_alloc_dev_priv+0x1d/0x2820
__vhci_create_device+0xef/0x7d0
vhci_write+0x2c7/0x480
vfs_write+0x6a0/0xfc0
ksys_write+0x12f/0x260
do_syscall_64+0xc7/0x250
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 4979:
kasan_save_stack+0x30/0x50
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x4f/0x70
kfree+0x141/0x490
hci_release_dev+0x4d9/0x600
bt_host_release+0x6a/0xb0
device_release+0xa4/0x240
kobject_put+0x1ec/0x5a0
put_device+0x1f/0x30
vhci_release+0x81/0xf0
__fput+0x3f6/0xb30
task_work_run+0x151/0x250
do_exit+0xa79/0x2c30
do_group_exit+0xd5/0x2a0
get_signal+0x1fcd/0x2210
arch_do_signal_or_restart+0x93/0x780
syscall_exit_to_user_mode+0x140/0x290
do_syscall_64+0xd4/0x250
entry_SYSCALL_64_after_hwframe+0x77/0x7f
In 'hci_conn_del_sysfs()', 'device_unregister()' may be called when
an underlying (kobject) reference counter is greater than 1. This
means that reparenting (happened when the device is actually freed)
is delayed and, during that delay, parent controller device (hciX)
may be deleted. Since the latter may create a dangling pointer to
freed parent, avoid that scenario by reparenting to NULL explicitly.
Reported-by: syzbot+6cf5652d3df49fae2e3f@syzkaller.appspotmail.com
Tested-by: syzbot+6cf5652d3df49fae2e3f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6cf5652d3df49fae2e3f
Fixes: a85fb91e3ddmantipov@yandex.ru >
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com >
2024-11-14 15:41:13 -05:00
Dmitry Antipov
1053987a6b
wifi: ath9k: miscellaneous spelling fixes
...
Correct spelling here and there as suggested by codespell.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk >
Link: https://patch.msgid.link/20241111104724.484586-1-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com >
2024-11-12 16:44:54 -08:00
Dmitry Antipov
23aab03710
ocfs2: fix UBSAN warning in ocfs2_verify_volume()
...
Syzbot has reported the following splat triggered by UBSAN:
UBSAN: shift-out-of-bounds in fs/ocfs2/super.c:2336:10
shift exponent 32768 is too large for 32-bit type 'int'
CPU: 2 UID: 0 PID: 5255 Comm: repro Not tainted 6.12.0-rc4-syzkaller-00047-gc2ee9f594da8 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x241/0x360
? __pfx_dump_stack_lvl+0x10/0x10
? __pfx__printk+0x10/0x10
? __asan_memset+0x23/0x50
? lockdep_init_map_type+0xa1/0x910
__ubsan_handle_shift_out_of_bounds+0x3c8/0x420
ocfs2_fill_super+0xf9c/0x5750
? __pfx_ocfs2_fill_super+0x10/0x10
? __pfx_validate_chain+0x10/0x10
? __pfx_validate_chain+0x10/0x10
? validate_chain+0x11e/0x5920
? __lock_acquire+0x1384/0x2050
? __pfx_validate_chain+0x10/0x10
? string+0x26a/0x2b0
? widen_string+0x3a/0x310
? string+0x26a/0x2b0
? bdev_name+0x2b1/0x3c0
? pointer+0x703/0x1210
? __pfx_pointer+0x10/0x10
? __pfx_format_decode+0x10/0x10
? __lock_acquire+0x1384/0x2050
? vsnprintf+0x1ccd/0x1da0
? snprintf+0xda/0x120
? __pfx_lock_release+0x10/0x10
? do_raw_spin_lock+0x14f/0x370
? __pfx_snprintf+0x10/0x10
? set_blocksize+0x1f9/0x360
? sb_set_blocksize+0x98/0xf0
? setup_bdev_super+0x4e6/0x5d0
mount_bdev+0x20c/0x2d0
? __pfx_ocfs2_fill_super+0x10/0x10
? __pfx_mount_bdev+0x10/0x10
? vfs_parse_fs_string+0x190/0x230
? __pfx_vfs_parse_fs_string+0x10/0x10
legacy_get_tree+0xf0/0x190
? __pfx_ocfs2_mount+0x10/0x10
vfs_get_tree+0x92/0x2b0
do_new_mount+0x2be/0xb40
? __pfx_do_new_mount+0x10/0x10
__se_sys_mount+0x2d6/0x3c0
? __pfx___se_sys_mount+0x10/0x10
? do_syscall_64+0x100/0x230
? __x64_sys_mount+0x20/0xc0
do_syscall_64+0xf3/0x230
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f37cae96fda
Code: 48 8b 0d 51 ce 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1e ce 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007fff6c1aa228 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff6c1aa240 RCX: 00007f37cae96fda
RDX: 00000000200002c0 RSI: 0000000020000040 RDI: 00007fff6c1aa240
RBP: 0000000000000004 R08: 00007fff6c1aa280 R09: 0000000000000000
R10: 00000000000008c0 R11: 0000000000000206 R12: 00000000000008c0
R13: 00007fff6c1aa280 R14: 0000000000000003 R15: 0000000001000000
</TASK>
For a really damaged superblock, the value of 'i_super.s_blocksize_bits'
may exceed the maximum possible shift for an underlying 'int'. So add an
extra check whether the aforementioned field represents the valid block
size, which is 512 bytes, 1K, 2K, or 4K.
Link: https://lkml.kernel.org/r/20241106092100.2661330-1-dmantipov@yandex.ru
Fixes: ccd979bdbcdmantipov@yandex.ru >
Reported-by: syzbot+56f7cd1abe4b8e475180@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=56f7cd1abe4b8e475180
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com >
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Cc: <stable@vger.kernel.org >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2024-11-11 17:20:23 -08:00
Dmitry Antipov
adc77b19f6
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
...
Syzbot has reported the following KMSAN splat:
BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80
ocfs2_file_read_iter+0x9a4/0xf80
__io_read+0x8d4/0x20f0
io_read+0x3e/0xf0
io_issue_sqe+0x42b/0x22c0
io_wq_submit_work+0xaf9/0xdc0
io_worker_handle_work+0xd13/0x2110
io_wq_worker+0x447/0x1410
ret_from_fork+0x6f/0x90
ret_from_fork_asm+0x1a/0x30
Uninit was created at:
__alloc_pages_noprof+0x9a7/0xe00
alloc_pages_mpol_noprof+0x299/0x990
alloc_pages_noprof+0x1bf/0x1e0
allocate_slab+0x33a/0x1250
___slab_alloc+0x12ef/0x35e0
kmem_cache_alloc_bulk_noprof+0x486/0x1330
__io_alloc_req_refill+0x84/0x560
io_submit_sqes+0x172f/0x2f30
__se_sys_io_uring_enter+0x406/0x41c0
__x64_sys_io_uring_enter+0x11f/0x1a0
x64_sys_call+0x2b54/0x3ba0
do_syscall_64+0xcd/0x1e0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Since an instance of 'struct kiocb' may be passed from the block layer
with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()'
and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in
'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'.
Link: https://lkml.kernel.org/r/20241029091736.1501946-1-dmantipov@yandex.ru
Fixes: 7cdfc3a1c3dmantipov@yandex.ru >
Reported-by: syzbot+a73e253cca4f0230a5a5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a73e253cca4f0230a5a5
Cc: Mark Fasheh <mark@fasheh.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Joseph Qi <jiangqi903@gmail.com >
Cc: Changwei Ge <gechangwei@live.cn >
Cc: Jun Piao <piaojun@huawei.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
2024-11-11 17:17:04 -08:00
Dmitry Antipov
b22db8b8be
net: sched: use RCU read-side critical section in taprio_dump()
...
Fix possible use-after-free in 'taprio_dump()' by adding RCU
read-side critical section there. Never seen on x86 but
found on a KASAN-enabled arm64 system when investigating
https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa :
[T15862] BUG: KASAN: slab-use-after-free in taprio_dump+0xa0c/0xbb0
[T15862] Read of size 4 at addr ffff0000d4bb88f8 by task repro/15862
[T15862]
[T15862] CPU: 0 UID: 0 PID: 15862 Comm: repro Not tainted 6.11.0-rc1-00293-gdefaf1a2113a-dirty #2
[T15862] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-20240524-5.fc40 05/24/2024
[T15862] Call trace:
[T15862] dump_backtrace+0x20c/0x220
[T15862] show_stack+0x2c/0x40
[T15862] dump_stack_lvl+0xf8/0x174
[T15862] print_report+0x170/0x4d8
[T15862] kasan_report+0xb8/0x1d4
[T15862] __asan_report_load4_noabort+0x20/0x2c
[T15862] taprio_dump+0xa0c/0xbb0
[T15862] tc_fill_qdisc+0x540/0x1020
[T15862] qdisc_notify.isra.0+0x330/0x3a0
[T15862] tc_modify_qdisc+0x7b8/0x1838
[T15862] rtnetlink_rcv_msg+0x3c8/0xc20
[T15862] netlink_rcv_skb+0x1f8/0x3d4
[T15862] rtnetlink_rcv+0x28/0x40
[T15862] netlink_unicast+0x51c/0x790
[T15862] netlink_sendmsg+0x79c/0xc20
[T15862] __sock_sendmsg+0xe0/0x1a0
[T15862] ____sys_sendmsg+0x6c0/0x840
[T15862] ___sys_sendmsg+0x1ac/0x1f0
[T15862] __sys_sendmsg+0x110/0x1d0
[T15862] __arm64_sys_sendmsg+0x74/0xb0
[T15862] invoke_syscall+0x88/0x2e0
[T15862] el0_svc_common.constprop.0+0xe4/0x2a0
[T15862] do_el0_svc+0x44/0x60
[T15862] el0_svc+0x50/0x184
[T15862] el0t_64_sync_handler+0x120/0x12c
[T15862] el0t_64_sync+0x190/0x194
[T15862]
[T15862] Allocated by task 15857:
[T15862] kasan_save_stack+0x3c/0x70
[T15862] kasan_save_track+0x20/0x3c
[T15862] kasan_save_alloc_info+0x40/0x60
[T15862] __kasan_kmalloc+0xd4/0xe0
[T15862] __kmalloc_cache_noprof+0x194/0x334
[T15862] taprio_change+0x45c/0x2fe0
[T15862] tc_modify_qdisc+0x6a8/0x1838
[T15862] rtnetlink_rcv_msg+0x3c8/0xc20
[T15862] netlink_rcv_skb+0x1f8/0x3d4
[T15862] rtnetlink_rcv+0x28/0x40
[T15862] netlink_unicast+0x51c/0x790
[T15862] netlink_sendmsg+0x79c/0xc20
[T15862] __sock_sendmsg+0xe0/0x1a0
[T15862] ____sys_sendmsg+0x6c0/0x840
[T15862] ___sys_sendmsg+0x1ac/0x1f0
[T15862] __sys_sendmsg+0x110/0x1d0
[T15862] __arm64_sys_sendmsg+0x74/0xb0
[T15862] invoke_syscall+0x88/0x2e0
[T15862] el0_svc_common.constprop.0+0xe4/0x2a0
[T15862] do_el0_svc+0x44/0x60
[T15862] el0_svc+0x50/0x184
[T15862] el0t_64_sync_handler+0x120/0x12c
[T15862] el0t_64_sync+0x190/0x194
[T15862]
[T15862] Freed by task 6192:
[T15862] kasan_save_stack+0x3c/0x70
[T15862] kasan_save_track+0x20/0x3c
[T15862] kasan_save_free_info+0x4c/0x80
[T15862] poison_slab_object+0x110/0x160
[T15862] __kasan_slab_free+0x3c/0x74
[T15862] kfree+0x134/0x3c0
[T15862] taprio_free_sched_cb+0x18c/0x220
[T15862] rcu_core+0x920/0x1b7c
[T15862] rcu_core_si+0x10/0x1c
[T15862] handle_softirqs+0x2e8/0xd64
[T15862] __do_softirq+0x14/0x20
Fixes: 18cdd2f099vinicius.gomes@intel.com >
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://patch.msgid.link/20241018051339.418890-2-dmantipov@yandex.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com >
2024-10-23 13:26:15 +02:00
Dmitry Antipov
f504465970
net: sched: fix use-after-free in taprio_change()
...
In 'taprio_change()', 'admin' pointer may become dangling due to sched
switch / removal caused by 'advance_sched()', and critical section
protected by 'q->current_entry_lock' is too small to prevent from such
a scenario (which causes use-after-free detected by KASAN). Fix this
by prefer 'rcu_replace_pointer()' over 'rcu_assign_pointer()' to update
'admin' immediately before an attempt to schedule freeing.
Fixes: a3d43c0d56syzbot+b65e0af58423fc8a73aa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com >
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://patch.msgid.link/20241018051339.418890-1-dmantipov@yandex.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com >
2024-10-23 13:26:15 +02:00
Dmitry Antipov
6dc9445772
wifi: mwifiex: cleanup struct mwifiex_private
...
Remove set but otherwise unused 'adhoc_is_link_sensed' and
'assoc_resp_ht_param' members of 'struct mwifiex_private' and
simplify related code in 'mwifiex_ret_802_11_associate()'.
Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Kalle Valo <kvalo@kernel.org >
Link: https://patch.msgid.link/20240927084317.96687-2-dmantipov@yandex.ru
2024-10-17 19:48:28 +03:00
Dmitry Antipov
d0847e16ca
wifi: mwifiex: cleanup struct mwifiex_auto_tdls_peer
...
Remove set but otherwise unused 'do_setup' member of
'struct mwifiex_auto_tdls_peer'. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Kalle Valo <kvalo@kernel.org >
Link: https://patch.msgid.link/20240927084317.96687-1-dmantipov@yandex.ru
2024-10-17 19:48:28 +03:00
Dmitry Antipov
4b482281ee
wifi: mac80211, cfg80211: miscellaneous spelling fixes
...
Correct spelling here and there as suggested by codespell.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://patch.msgid.link/20240913084919.118862-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2024-10-08 21:52:09 +02:00
Dmitry Antipov
9d301de12d
wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
...
Since '__dev_queue_xmit()' should be called with interrupts enabled,
the following backtrace:
ieee80211_do_stop()
...
spin_lock_irqsave(&local->queue_stop_reason_lock, flags)
...
ieee80211_free_txskb()
ieee80211_report_used_skb()
ieee80211_report_ack_skb()
cfg80211_mgmt_tx_status_ext()
nl80211_frame_tx_status()
genlmsg_multicast_netns()
genlmsg_multicast_netns_filtered()
nlmsg_multicast_filtered()
netlink_broadcast_filtered()
do_one_broadcast()
netlink_broadcast_deliver()
__netlink_sendskb()
netlink_deliver_tap()
__netlink_deliver_tap_skb()
dev_queue_xmit()
__dev_queue_xmit() ; with IRQS disabled
...
spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags)
issues the warning (as reported by syzbot reproducer):
WARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120
Fix this by implementing a two-phase skb reclamation in
'ieee80211_do_stop()', where actual work is performed
outside of a section with interrupts disabled.
Fixes: 5061b0c2b9syzbot+1a3986bbd3169c307819@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1a3986bbd3169c307819
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://patch.msgid.link/20240906123151.351647-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2024-09-09 11:45:06 +02:00
Dmitry Antipov
15ea13b1b1
wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
...
Although not reproduced in practice, these two cases may be
considered by UBSAN as off-by-one errors. So fix them in the
same way as in commit a26a5107bc807f8a8c305ba63533bbdmantipov@yandex.ru >
Link: https://patch.msgid.link/20240909090806.1091956-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2024-09-09 11:43:21 +02:00
Dmitry Antipov
d5c4546062
net: sched: consistently use rcu_replace_pointer() in taprio_change()
...
According to Vinicius (and carefully looking through the whole
https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa
once again), txtime branch of 'taprio_change()' is not going to
race against 'advance_sched()'. But using 'rcu_replace_pointer()'
in the former may be a good idea as well.
Suggested-by: Vinicius Costa Gomes <vinicius.gomes@intel.com >
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com >
Signed-off-by: David S. Miller <davem@davemloft.net >
2024-09-08 11:18:57 +01:00
Dmitry Antipov
a26a5107bc
wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
...
Looking at https://syzkaller.appspot.com/bug?extid=1a3986bbd3169c307819
and running reproducer with CONFIG_UBSAN_BOUNDS, I've noticed the
following:
[ T4985] UBSAN: array-index-out-of-bounds in net/wireless/scan.c:3479:25
[ T4985] index 164 is out of range for type 'struct ieee80211_channel *[]'
<...skipped...>
[ T4985] Call Trace:
[ T4985] <TASK>
[ T4985] dump_stack_lvl+0x1c2/0x2a0
[ T4985] ? __pfx_dump_stack_lvl+0x10/0x10
[ T4985] ? __pfx__printk+0x10/0x10
[ T4985] __ubsan_handle_out_of_bounds+0x127/0x150
[ T4985] cfg80211_wext_siwscan+0x11a4/0x1260
<...the rest is not too useful...>
Even if we do 'creq->n_channels = n_channels' before 'creq->ssids =
(void *)&creq->channels[n_channels]', UBSAN treats the latter as
off-by-one error. Fix this by using pointer arithmetic rather than
an expression with explicit array indexing and use convenient
'struct_size()' to simplify the math here and in 'kzalloc()' above.
Fixes: 5ba63533bbdmantipov@yandex.ru >
Reviewed-by: Kees Cook <kees@kernel.org >
Link: https://patch.msgid.link/20240905150400.126386-1-dmantipov@yandex.ru
[fix coding style for multi-line calculation]
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2024-09-06 12:54:57 +02:00
Dmitry Antipov
ea63fb7199
wifi: mac80211: refactor block ack management code
...
Introduce 'ieee80211_mgmt_ba()' to avoid code duplication between
'ieee80211_send_addba_resp()', 'ieee80211_send_addba_request()',
and 'ieee80211_send_delba()', ensure that all related addresses
are '__aligned(2)', and prefer convenient 'ether_addr_copy()'
over generic 'memcpy()'. No functional changes expected.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://patch.msgid.link/20240725090925.6022-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2024-08-27 10:12:50 +02:00
Dmitry Antipov
786c5be9ac
wifi: mac80211: free skb on error path in ieee80211_beacon_get_ap()
...
In 'ieee80211_beacon_get_ap()', free allocated skb in case of error
returned by 'ieee80211_beacon_protect()'. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://patch.msgid.link/20240805142035.227847-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2024-08-26 17:45:45 +02:00
Dmitry Antipov
c531e63871
Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
...
Add missing call to 'l2cap_chan_unlock()' on receive error handling
path in 'l2cap_conless_channel()'.
Fixes: a24cce144bsyzbot+45ac74737e866894acb0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=45ac74737e866894acb0
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com >
2024-08-07 16:35:56 -04:00
Dmitry Antipov
f94074687d
net: core: annotate socks of struct sock_reuseport with __counted_by
...
According to '__reuseport_alloc()', annotate flexible array member
'sock' of 'struct sock_reuseport' with '__counted_by()' and use
convenient 'struct_size()' to simplify the math used in 'kzalloc()'.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org >
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com >
Link: https://patch.msgid.link/20240801142311.42837-1-dmantipov@yandex.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org >
2024-08-02 17:16:59 -07:00
Dmitry Antipov
0e735a4c61
wifi: rtw88: always wait for both firmware loading attempts
...
In 'rtw_wait_firmware_completion()', always wait for both (regular and
wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()'
has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue
'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually
the wowlan one) is still in progress, causing UAF detected by KASAN.
Fixes: c8e5695eaesyzbot+6c6c08700f9480c41fe3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c6c08700f9480c41fe3
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com >
Link: https://patch.msgid.link/20240726114657.25396-1-dmantipov@yandex.ru
2024-08-02 09:31:12 +08:00
Dmitry Antipov
3ba74b2f28
Bluetooth: hci_core: cleanup struct hci_dev
...
Remove unused and set but otherwise unused 'discovery_old_state'
and 'sco_last_tx' members of 'struct hci_dev'. The first one is
a leftover after commit 182ee45da0dmantipov@yandex.ru >
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de >
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com >
2024-07-15 10:11:19 -04:00
Dmitry Antipov
da63f33135
Bluetooth: hci_core, hci_sync: cleanup struct discovery_state
...
After commit 78db544b5d78db544b5ddmantipov@yandex.ru >
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com >
2024-07-14 21:34:43 -04:00
Dmitry Antipov
f2aeb7306a
ppp: reject claimed-as-LCP but actually malformed packets
...
Since 'ppp_async_encode()' assumes valid LCP packets (with code
from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that
LCP packet has an actual body beyond PPP_LCP header bytes, and
reject claimed-as-LCP but actually malformed data otherwise.
Reported-by: syzbot+ec0723ba9605678b14bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ec0723ba9605678b14bf
Fixes: 1da177e4c3dmantipov@yandex.ru >
Signed-off-by: Paolo Abeni <pabeni@redhat.com >
2024-07-11 11:00:08 +02:00
Dmitry Antipov
6ef09cdc5b
wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
...
In 'cfg80211_wext_siwscan()', add extra check whether number of
channels passed via 'ioctl(sock, SIOCSIWSCAN, ...)' doesn't exceed
IW_MAX_FREQUENCIES and reject invalid request with -EINVAL otherwise.
Reported-by: syzbot+253cd2d2491df77c93ac@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=253cd2d2491df77c93ac
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://msgid.link/20240531032010.451295-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2024-06-12 10:07:56 +02:00
Dmitry Antipov
92ecbb3ac6
wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()
...
When testing the previous patch with CONFIG_UBSAN_BOUNDS, I've
noticed the following:
UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:372:4
index 0 is out of range for type 'struct ieee80211_channel *[]'
CPU: 0 PID: 1435 Comm: wpa_supplicant Not tainted 6.9.0+ #1
Hardware name: LENOVO 20UN005QRT/20UN005QRT <...BIOS details...>
Call Trace:
<TASK>
dump_stack_lvl+0x2d/0x90
__ubsan_handle_out_of_bounds+0xe7/0x140
? timerqueue_add+0x98/0xb0
ieee80211_prep_hw_scan+0x2db/0x480 [mac80211]
? __kmalloc+0xe1/0x470
__ieee80211_start_scan+0x541/0x760 [mac80211]
rdev_scan+0x1f/0xe0 [cfg80211]
nl80211_trigger_scan+0x9b6/0xae0 [cfg80211]
...<the rest is not too useful...>
Since '__ieee80211_start_scan()' leaves 'hw_scan_req->req.n_channels'
uninitialized, actual boundaries of 'hw_scan_req->req.channels' can't
be checked in 'ieee80211_prep_hw_scan()'. Although an initialization
of 'hw_scan_req->req.n_channels' introduces some confusion around
allocated vs. used VLA members, this shouldn't be a problem since
everything is correctly adjusted soon in 'ieee80211_prep_hw_scan()'.
Cleanup 'kmalloc()' math in '__ieee80211_start_scan()' by using the
convenient 'struct_size()' as well.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://msgid.link/20240517153332.18271-2-dmantipov@yandex.ru
[improve (imho) indentation a bit]
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2024-05-29 15:58:54 +02:00
Dmitry Antipov
aa4ec06c45
wifi: cfg80211: use __counted_by where appropriate
...
Annotate 'sub_specs' of 'struct cfg80211_sar_specs', 'channels'
of 'struct cfg80211_sched_scan_request', 'channels' of 'struct
cfg80211_wowlan_nd_match', and 'matches' of 'struct
cfg80211_wowlan_nd_info' with '__counted_by' attribute. Briefly
tested with clang 18.1.1 and CONFIG_UBSAN_BOUNDS running iwlwifi.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://msgid.link/20240517153332.18271-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2024-05-23 11:32:05 +02:00
Dmitry Antipov
2785ea9673
wifi: rt2x00: remove unused delayed work data from link description
...
Remove unused 'agc_work' and 'vco_work' members of 'struct link'.
This follows commit d96324703fdmantipov@yandex.ru >
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl >
Signed-off-by: Kalle Valo <kvalo@kernel.org >
Link: https://msgid.link/20240515152824.143537-1-dmantipov@yandex.ru
2024-05-20 08:05:52 +03:00
Dmitry Antipov
07aa33988a
mac802154: fix time calculation in ieee802154_configure_durations()
...
Since 'symbol_duration' of 'struct wpan_phy' is in nanoseconds but
'lifs_period' and 'sifs_period' are both in microseconds, fix time
calculation in 'ieee802154_configure_durations()' and use convenient
'NSEC_PER_USEC' in 'ieee802154_setup_wpan_phy_pib()' as well.
Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 781830c800dmantipov@yandex.ru >
Acked-by: Miquel Raynal <miquel.raynal@bootlin.com >
Message-ID: <20240508114010.219527-1-dmantipov@yandex.ru >
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org >
2024-05-18 23:46:25 +02:00
Dmitry Antipov
45d355a926
Bluetooth: Fix memory leak in hci_req_sync_complete()
...
In 'hci_req_sync_complete()', always free the previous sync
request state before assigning reference to a new one.
Reported-by: syzbot+39ec16ff6cc18b1d066d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=39ec16ff6cc18b1d066d
Cc: stable@vger.kernel.org
Fixes: f60cb30579dmantipov@yandex.ru >
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com >
2024-04-10 15:03:44 -04:00
Dmitry Antipov
537db05da2
batman-adv: prefer kfree_rcu() over call_rcu() with free-only callbacks
...
Drop 'batadv_tt_local_entry_free_rcu()', 'batadv_tt_global_entry_free_rcu()'
and 'batadv_tt_orig_list_entry_free_rcu()' in favor of 'kfree_rcu()' in
'batadv_tt_local_entry_release()', 'batadv_tt_global_entry_release()' and
'batadv_tt_orig_list_entry_release()', respectively.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Sven Eckelmann <sven@narfation.org >
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de >
2024-03-29 20:18:21 +01:00
Dmitry Antipov
634cae9791
wifi: rtlwifi: always assume QoS mode in rtl8192cu
...
In 'rtl92cu_set_hw_reg()', always assume that QoS mode is enabled
as it was hardcoded since an initial commit. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com >
Link: https://msgid.link/20240320084324.109506-2-dmantipov@yandex.ru
2024-03-22 14:50:25 +08:00
Dmitry Antipov
f8a6fc99c2
wifi: rtlwifi: drop WMM stubs from rtl8192cu
...
Since WMM support was never actually implemented and related TODO is
more than 13 years old, it might be reasonable to remove all of the
WMM stubs from rtl8192cu and simplify related code. Minor comment
style adjustments suggested by checkpatch.pl, compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com >
Link: https://msgid.link/20240320084324.109506-1-dmantipov@yandex.ru
2024-03-22 14:47:48 +08:00
Dmitry Antipov
0611a640e6
eventpoll: prefer kfree_rcu() in __ep_remove()
...
In '__ep_remove()', prefer 'kfree_rcu()' over 'call_rcu()' with
dummy 'epi_rcu_free()' callback. This follows commit d0089603fadmantipov@yandex.ru >
Link: https://lore.kernel.org/r/20240221112205.48389-2-dmantipov@yandex.ru
Signed-off-by: Christian Brauner <brauner@kernel.org >
2024-02-22 10:03:31 +01:00
Dmitry Antipov
4e45170d9a
net: sctp: fix skb leak in sctp_inq_free()
...
In case of GSO, 'chunk->skb' pointer may point to an entry from
fraglist created in 'sctp_packet_gso_append()'. To avoid freeing
random fraglist entry (and so undefined behavior and/or memory
leak), introduce 'sctp_inq_chunk_free()' helper to ensure that
'chunk->skb' is set to 'chunk->head_skb' (i.e. fraglist head)
before calling 'sctp_chunk_free()', and use the aforementioned
helper in 'sctp_inq_pop()' as well.
Reported-by: syzbot+8bb053b5d63595ab47db@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=0d8351bbe54fd04a492c2daab0164138db008042
Fixes: 90017accfflucien.xin@gmail.com >
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Xin Long <lucien.xin@gmail.com >
Link: https://lore.kernel.org/r/20240214082224.10168-1-dmantipov@yandex.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org >
2024-02-15 07:34:52 -08:00
Dmitry Antipov
6cf9ff4633
net: smc: fix spurious error message from __sock_release()
...
Commit 67f562e3e167f562e3e1dmantipov@yandex.ru >
Signed-off-by: David S. Miller <davem@davemloft.net >
2024-02-14 10:56:02 +00:00
Dmitry Antipov
425c33264e
wifi: mwifiex: use kstrtoX_from_user() in debugfs handlers
...
Use convenient 'kstrtou32_from_user()' in 'mwifiex_verext_write()'
and 'kstrtobool_from_user()' in 'mwifiex_timeshare_coex_write()',
respectively. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Kalle Valo <kvalo@kernel.org >
Link: https://msgid.link/20240110115314.421298-1-dmantipov@yandex.ru
2024-02-12 17:36:12 +02:00
Dmitry Antipov
d0089603fa
fs: prefer kfree_rcu() in fasync_remove_entry()
...
In 'fasync_remove_entry()', prefer 'kfree_rcu()' over 'call_rcu()' with dummy
'fasync_free_rcu()' callback. This is mostly intended in attempt to fix weird
https://syzkaller.appspot.com/bug?id=6a64ad907e361e49e92d1c4c114128a1bda2ed7f ,
where kmemleak may consider 'fa' as unreferenced during RCU grace period. See
https://lore.kernel.org/stable/20230930174657.800551-1-joel@joelfernandes.org
as well. Comments are highly appreciated.
Ever since ae65a5211dae65a5211ddmantipov@yandex.ru >
Link: https://lore.kernel.org/r/20240209125220.330383-1-dmantipov@yandex.ru
Signed-off-by: Christian Brauner <brauner@kernel.org >
2024-02-12 11:00:10 +01:00
Dmitry Antipov
7f78840cf4
wifi: wireless: avoid strlen() in cfg80211_michael_mic_failure()
...
In 'cfg80211_michael_mic_failure()', avoid extra call to 'strlen()'
by using the value returned by 'sprintf()'. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Link: https://msgid.link/20240110054246.371651-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2024-01-26 09:28:26 +01:00
Dmitry Antipov
173b0fb47c
wifi: rt2x00: simplify rt2x00crypto_rx_insert_iv()
...
In 'rt2x00crypto_rx_insert_iv()', added alignment can't exceed 3
bytes and ICV size is either 4 or 8 bytes, so skb space adjustment
may be simplified. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Signed-off-by: Kalle Valo <kvalo@kernel.org >
Link: https://msgid.link/20231019070750.17911-1-dmantipov@yandex.ru
2024-01-18 15:07:19 +02:00
Dmitry Antipov
23b8330156
wifi: rtw88: use kstrtoX_from_user() in debugfs handlers
...
When 'sscanf()' is not needed to scan an input, prefer common
'kstrtoX_from_user()' over 'rtw_debugfs_copy_from_user()' with
following 'kstrtoX()'. Minor adjustments, compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru >
Acked-by: Ping-Ke Shih <pkshih@realtek.com >
Signed-off-by: Kalle Valo <kvalo@kernel.org >
Link: https://msgid.link/20240110132930.438828-1-dmantipov@yandex.ru
2024-01-18 11:32:47 +02:00
Dmitry Antipov
be50df31c4
block: bio-integrity: fix kcalloc() arguments order
...
When compiling with gcc version 14.0.1 20240116 (experimental)
and W=1, I've noticed the following warning:
block/bio-integrity.c: In function 'bio_integrity_map_user':
block/bio-integrity.c:339:38: warning: 'kcalloc' sizes specified with 'sizeof'
in the earlier argument and not in the later argument [-Wcalloc-transposed-args]
339 | bvec = kcalloc(sizeof(*bvec), nr_vecs, GFP_KERNEL);
| ^
block/bio-integrity.c:339:38: note: earlier argument should specify number of
elements, later size of each element
Since 'n' and 'size' arguments of 'kcalloc()' are multiplied to
calculate the final size, their actual order doesn't affect the
result and so this is not a bug. But it's still worth to fix it.
Fixes: 492c5d4559dmantipov@yandex.ru >
Reviewed-by: Keith Busch <kbusch@kernel.org >
Link: https://lore.kernel.org/r/20240116143437.89060-1-dmantipov@yandex.ru
Signed-off-by: Jens Axboe <axboe@kernel.dk >
2024-01-16 09:51:22 -07:00
Dmitry Antipov