1. 02 Nov, 2017 1 commit
    • Greg Kroah-Hartman's avatar
      License cleanup: add SPDX GPL-2.0 license identifier to files with no license · b2441318
      Greg Kroah-Hartman authored
      Many source files in the tree are missing licensing information, which
      makes it harder for compliance tools to determine the correct license.
      By default all files without license information are under the default
      license of the kernel, which is GPL version 2.
      Update the files which contain no license information with the 'GPL-2.0'
      SPDX license identifier.  The SPDX identifier is a legally binding
      shorthand, which can be used instead of the full boiler plate text.
      This patch is based on work done by Thomas Gleixner and Kate Stewart and
      Philippe Ombredanne.
      How this work was done:
      Patches were generated and checked against linux-4.14-rc6 for a subset of
      the use cases:
       - file had no licensing information it it.
       - file was a */uapi/* one with no licensing information in it,
       - file was a */uapi/* one with existing licensing information,
      Further patches will be generated in subsequent months to fix up cases
      where non-standard license headers were used, and references to license
      had to be inferred by heuristics based on keywords.
      The analysis to determine which SPDX License Identifier to be applied to
      a file was done in a spreadsheet of side by side results from of the
      output of two independent scanners (ScanCode & Windriver) producing SPDX
      tag:value files created by Philippe Ombredanne.  Philippe prepared the
      base worksheet, and did an initial spot review of a few 1000 files.
      The 4.13 kernel was the starting point of the analysis with 60,537 files
      assessed.  Kate Stewart did a file by file comparison of the scanner
      results in the spreadsheet to determine which SPDX license identifier(s)
      to be applied to the file. She confirmed any determination that was not
      immediately clear with lawyers working with the Linux Foundation.
      Criteria used to select files for SPDX license identifier tagging was:
       - Files considered eligible had to be source code files.
       - Make and config files were included as candidates if they contained >5
         lines of source
       - File already had some variant of a license header in it (even if <5
      All documentation files were explicitly excluded.
      The following heuristics were used to determine which SPDX license
      identifiers to apply.
       - when both scanners couldn't find any license traces, file was
         considered to have no license information in it, and the top level
         COPYING file license applied.
         For non */uapi/* files that summary was:
         SPDX license identifier                            # files
         GPL-2.0                                              11139
         and resulted in the first patch in this series.
         If that file was a */uapi/* path one, it was "GPL-2.0 WITH
         Linux-syscall-note" otherwise it was "GPL-2.0".  Results of that was:
         SPDX license identifier                            # files
         GPL-2.0 WITH Linux-syscall-note                        930
         and resulted in the second patch in this series.
       - if a file had some form of licensing information in it, and was one
         of the */uapi/* ones, it was denoted with the Linux-syscall-note if
         any GPL family license was found in the file or had no licensing in
         it (per prior point).  Results summary:
         SPDX license identifier                            # files
         GPL-2.0 WITH Linux-syscall-note                       270
         GPL-2.0+ WITH Linux-syscall-note                      169
         ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause)    21
         ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause)    17
         LGPL-2.1+ WITH Linux-syscall-note                      15
         GPL-1.0+ WITH Linux-syscall-note                       14
         ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause)    5
         LGPL-2.0+ WITH Linux-syscall-note                       4
         LGPL-2.1 WITH Linux-syscall-note                        3
         ((GPL-2.0 WITH Linux-syscall-note) OR MIT)              3
         ((GPL-2.0 WITH Linux-syscall-note) AND MIT)             1
         and that resulted in the third patch in this series.
       - when the two scanners agreed on the detected license(s), that became
         the concluded license(s).
       - when there was disagreement between the two scanners (one detected a
         license but the other didn't, or they both detected different
         licenses) a manual inspection of the file occurred.
       - In most cases a manual inspection of the information in the file
         resulted in a clear resolution of the license that should apply (and
         which scanner probably needed to revisit its heuristics).
       - When it was not immediately clear, the license identifier was
         confirmed with lawyers working with the Linux Foundation.
       - If there was any question as to the appropriate license identifier,
         the file was flagged for further research and to be revisited later
         in time.
      In total, over 70 hours of logged manual review was done on the
      spreadsheet to determine the SPDX license identifiers to apply to the
      source files by Kate, Philippe, Thomas and, in some cases, confirmation
      by lawyers working with the Linux Foundation.
      Kate also obtained a third independent scan of the 4.13 code base from
      FOSSology, and compared selected files where the other two scanners
      disagreed against that SPDX file, to see if there was new insights.  The
      Windriver scanner is based on an older version of FOSSology in part, so
      they are related.
      Thomas did random spot checks in about 500 files from the spreadsheets
      for the uapi headers and agreed with SPDX license identifier in the
      files he inspected. For the non-uapi files Thomas did random spot checks
      in about 15000 files.
      In initial set of patches against 4.14-rc6, 3 files were found to have
      copy/paste license identifier errors, and have been fixed to reflect the
      correct identifier.
      Additionally Philippe spent 10 hours this week doing a detailed manual
      inspection and review of the 12,461 patched files from the initial patch
      version early this week with:
       - a full scancode scan run, collecting the matched texts, detected
         license ids and scores
       - reviewing anything where there was a license detected (about 500+
         files) to ensure that the applied SPDX license was correct
       - reviewing anything where there was no detection but the patch license
         was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied
         SPDX license was correct
      This produced a worksheet with 20 files needing minor correction.  This
      worksheet was then exported into 3 different .csv files for the
      different types of files to be modified.
      These .csv files were then reviewed by Greg.  Thomas wrote a script to
      parse the csv files and add the proper SPDX tag to the file, in the
      format that the file expected.  This script was further refined by Greg
      based on the output to detect more types of files automatically and to
      distinguish between header and source .c files (which need different
      comment types.)  Finally Greg ran the script using the .csv files to
      generate the patches.
      Reviewed-by: default avatarKate Stewart <[email protected]>
      Reviewed-by: default avatarPhilippe Ombredanne <[email protected]>
      Reviewed-by: default avatarThomas Gleixner <[email protected]>
      Signed-off-by: default avatarGreg Kroah-Hartman <[email protected]>
  2. 26 Sep, 2017 1 commit
  3. 30 Aug, 2017 1 commit
  4. 25 Aug, 2017 1 commit
    • Eric Biggers's avatar
      strparser: initialize all callbacks · 3fd87127
      Eric Biggers authored
      commit bbb03029 ("strparser: Generalize strparser") added more
      function pointers to 'struct strp_callbacks'; however, kcm_attach() was
      not updated to initialize them.  This could cause the ->lock() and/or
      ->unlock() function pointers to be set to garbage values, causing a
      crash in strp_work().
      Fix the bug by moving the callback structs into static memory, so
      unspecified members are zeroed.  Also constify them while we're at it.
      This bug was found by syzkaller, which encountered the following splat:
          IP: 0x55
          PGD 3b1ca067
          P4D 3b1ca067
          PUD 3b12f067
          PMD 0
          Oops: 0010 [#1] SMP KASAN
          Dumping ftrace buffer:
             (ftrace buffer empty)
          Modules linked in:
          CPU: 2 PID: 1194 Comm: kworker/u8:1 Not tainted 4.13.0-rc4-next-20170811 #2
          Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
          Workqueue: kstrp strp_work
          task: ffff88006bb0e480 task.stack: ffff88006bb10000
          RIP: 0010:0x55
          RSP: 0018:ffff88006bb17540 EFLAGS: 00010246
          RAX: dffffc0000000000 RBX: ffff88006ce4bd60 RCX: 0000000000000000
          RDX: 1ffff1000d9c97bd RSI: 0000000000000000 RDI: ffff88006ce4bc48
          RBP: ffff88006bb17558 R08: ffffffff81467ab2 R09: 0000000000000000
          R10: ffff88006bb17438 R11: ffff88006bb17940 R12: ffff88006ce4bc48
          R13: ffff88003c683018 R14: ffff88006bb17980 R15: ffff88003c683000
          FS:  0000000000000000(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000
          CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
          CR2: 0000000000000055 CR3: 000000003c145000 CR4: 00000000000006e0
          DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
          DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
          Call Trace:
           process_one_work+0xbf3/0x1bc0 kernel/workqueue.c:2098
           worker_thread+0x223/0x1860 kernel/workqueue.c:2233
           kthread+0x35e/0x430 kernel/kthread.c:231
           ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
          Code:  Bad RIP value.
          RIP: 0x55 RSP: ffff88006bb17540
          CR2: 0000000000000055
          ---[ end trace f0e4920047069cee ]---
      Here is a C reproducer (requires CONFIG_BPF_SYSCALL=y and
          #include <linux/bpf.h>
          #include <linux/kcm.h>
          #include <linux/types.h>
          #include <stdint.h>
          #include <sys/ioctl.h>
          #include <sys/socket.h>
          #include <sys/syscall.h>
          #include <unistd.h>
          static const struct bpf_insn bpf_insns[3] = {
              { .code = 0xb7 }, /* BPF_MOV64_IMM(0, 0) */
              { .code = 0x95 }, /* BPF_EXIT_INSN() */
          static const union bpf_attr bpf_attr = {
              .prog_type = 1,
              .insn_cnt = 2,
              .insns = (uintptr_t)&bpf_insns,
              .license = (uintptr_t)"",
          int main(void)
              int bpf_fd = syscall(__NR_bpf, BPF_PROG_LOAD,
                                   &bpf_attr, sizeof(bpf_attr));
              int inet_fd = socket(AF_INET, SOCK_STREAM, 0);
              int kcm_fd = socket(AF_KCM, SOCK_DGRAM, 0);
              ioctl(kcm_fd, SIOCKCMATTACH,
                    &(struct kcm_attach) { .fd = inet_fd, .bpf_fd = bpf_fd });
      Fixes: bbb03029 ("strparser: Generalize strparser")
      Cc: Dmitry Vyukov <[email protected]>
      Cc: Tom Herbert <[email protected]>
      Signed-off-by: default avatarEric Biggers <[email protected]>
      Signed-off-by: default avatarDavid S. Miller <[email protected]>
  5. 01 Aug, 2017 1 commit
  6. 01 Jul, 2017 1 commit
  7. 16 May, 2017 1 commit
  8. 17 Apr, 2017 1 commit
  9. 24 Mar, 2017 1 commit
  10. 02 Mar, 2017 1 commit
  11. 14 Feb, 2017 1 commit
  12. 09 Feb, 2017 1 commit
    • WANG Cong's avatar
      kcm: fix 0-length case for kcm_sendmsg() · 98e3862c
      WANG Cong authored
      Dmitry reported a kernel warning:
       WARNING: CPU: 3 PID: 2936 at net/kcm/kcmsock.c:627
       kcm_write_msgs+0x12e3/0x1b90 net/kcm/kcmsock.c:627
       CPU: 3 PID: 2936 Comm: a.out Not tainted 4.10.0-rc6+ #209
       Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
       Call Trace:
        __dump_stack lib/dump_stack.c:15 [inline]
        dump_stack+0x2ee/0x3ef lib/dump_stack.c:51
        panic+0x1fb/0x412 kernel/panic.c:179
        __warn+0x1c4/0x1e0 kernel/panic.c:539
        warn_slowpath_null+0x2c/0x40 kernel/panic.c:582
        kcm_write_msgs+0x12e3/0x1b90 net/kcm/kcmsock.c:627
        kcm_sendmsg+0x163a/0x2200 net/kcm/kcmsock.c:1029
        sock_sendmsg_nosec net/socket.c:635 [inline]
        sock_sendmsg+0xca/0x110 net/socket.c:645
        sock_write_iter+0x326/0x600 net/socket.c:848
        new_sync_write fs/read_write.c:499 [inline]
        __vfs_write+0x483/0x740 fs/read_write.c:512
        vfs_write+0x187/0x530 fs/read_write.c:560
        SYSC_write fs/read_write.c:607 [inline]
        SyS_write+0xfb/0x230 fs/read_write.c:599
      when calling syscall(__NR_write, sock2, 0x208aaf27ul, 0x0ul) on a KCM
      seqpacket socket. It appears that kcm_sendmsg() does not handle len==0
      case correctly, which causes an empty skb is allocated and queued.
      Fix this by skipping the skb allocation for len==0 case.
      Reported-by: default avatarDmitry Vyukov <[email protected]>
      Cc: Tom Herbert <[email protected]>
      Signed-off-by: default avatarCong Wang <[email protected]>
      Signed-off-by: default avatarDavid S. Miller <[email protected]>
  13. 04 Oct, 2016 1 commit
    • Al Viro's avatar
      skb_splice_bits(): get rid of callback · 25869262
      Al Viro authored
      since pipe_lock is the outermost now, we don't need to drop/regain
      socket locks around the call of splice_to_pipe() from skb_splice_bits(),
      which kills the need to have a socket-specific callback; we can just
      call splice_to_pipe() and be done with that.
      Signed-off-by: default avatarAl Viro <[email protected]>
  14. 01 Sep, 2016 1 commit
    • WANG Cong's avatar
      kcm: fix a socket double free · c0338aff
      WANG Cong authored
      Dmitry reported a double free on kcm socket, which could
      be easily reproduced by:
      	#include <unistd.h>
      	#include <sys/syscall.h>
      	int main()
      	  int fd = syscall(SYS_socket, 0x29ul, 0x5ul, 0x0ul, 0, 0, 0);
      	  syscall(SYS_ioctl, fd, 0x89e2ul, 0x20a98000ul, 0, 0, 0);
      	  return 0;
      This is because on the error path, after we install
      the new socket file, we call sock_release() to clean
      up the socket, which leaves the fd pointing to a freed
      socket. Fix this by calling sys_close() on that fd
      Fixes: ab7ac4eb ("kcm: Kernel Connection Multiplexor module")
      Reported-by: default avatarDmitry Vyukov <[email protected]>
      Cc: Tom Herbert <[email protected]>
      Signed-off-by: default avatarCong Wang <[email protected]>
      Signed-off-by: default avatarDavid S. Miller <[email protected]>
  15. 29 Aug, 2016 1 commit
  16. 23 Aug, 2016 1 commit
  17. 17 Aug, 2016 1 commit
  18. 25 Jul, 2016 1 commit
  19. 01 Jul, 2016 1 commit
    • Daniel Borkmann's avatar
      bpf: refactor bpf_prog_get and type check into helper · 113214be
      Daniel Borkmann authored
      Since bpf_prog_get() and program type check is used in a couple of places,
      refactor this into a small helper function that we can make use of. Since
      the non RO prog->aux part is not used in performance critical paths and a
      program destruction via RCU is rather very unlikley when doing the put, we
      shouldn't have an issue just doing the bpf_prog_get() + prog->type != type
      check, but actually not taking the ref at all (due to being in fdget() /
      fdput() section of the bpf fd) is even cleaner and makes the diff smaller
      as well, so just go for that. Callsites are changed to make use of the new
      helper where possible.
      Signed-off-by: default avatarDaniel Borkmann <[email protected]>
      Acked-by: default avatarAlexei Starovoitov <[email protected]>
      Signed-off-by: default avatarDavid S. Miller <[email protected]>
  20. 22 Jun, 2016 1 commit
    • Jiri Slaby's avatar
      kcm: fix /proc memory leak · d19af0a7
      Jiri Slaby authored
      Every open of /proc/net/kcm leaks 16 bytes of memory as is reported by
      unreferenced object 0xffff88059c0e3458 (size 192):
        comm "cat", pid 1401, jiffies 4294935742 (age 310.720s)
        hex dump (first 32 bytes):
          28 45 71 96 05 88 ff ff 00 10 00 00 00 00 00 00  (Eq.............
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          [<ffffffff8156a2de>] kmem_cache_alloc_trace+0x16e/0x230
          [<ffffffff8162a479>] seq_open+0x79/0x1d0
          [<ffffffffa0578510>] kcm_seq_open+0x0/0x30 [kcm]
          [<ffffffff8162a479>] seq_open+0x79/0x1d0
          [<ffffffff8162a8cf>] __seq_open_private+0x2f/0xa0
          [<ffffffff81712548>] seq_open_net+0x38/0xa0
      It is caused by a missing free in the ->release path. So fix it by
      providing seq_release_net as the ->release method.
      Signed-off-by: default avatarJiri Slaby <[email protected]>
      Fixes: cd6e111b (kcm: Add statistics and proc interfaces)
      Cc: "David S. Miller" <[email protected]>
      Cc: Tom Herbert <[email protected]>
      Cc: [email protected]
      Signed-off-by: default avatarDavid S. Miller <[email protected]>
  21. 19 May, 2016 1 commit
  22. 09 Mar, 2016 6 commits
    • Tom Herbert's avatar
      kcm: Add receive message timeout · 29152a34
      Tom Herbert authored
      This patch adds receive timeout for message assembly on the attached TCP
      sockets. The timeout is set when a new messages is started and the whole
      message has not been received by TCP (not in the receive queue). If the
      completely message is subsequently received the timer is cancelled, if the
      timer expires the RX side is aborted.
      The timeout value is taken from the socket timeout (SO_RCVTIMEO) that is
      set on a TCP socket (i.e. set by get sockopt before attaching a TCP socket
      to KCM.
      Signed-off-by: default avatarTom Herbert <[email protected]>
      Signed-off-by: default avatarDavid S. Miller <[email protected]>
    • Tom Herbert's avatar
      kcm: Add memory limit for receive message construction · 7ced95ef
      Tom Herbert authored
      Message assembly is performed on the TCP socket. This is logically
      equivalent of an application that performs a peek on the socket to find
      out how much memory is needed for a receive buffer. The receive socket
      buffer also provides the maximum message size which is checked.
      The receive algorithm is something like:
         1) Receive the first skbuf for a message (or skbufs if multiple are
            needed to determine message length).
         2) Check the message length against the number of bytes in the TCP
            receive queue (tcp_inq()).
      	- If all the bytes of the message are in the queue (incluing the
      	  skbuf received), then proceed with message assembly (it should
      	  complete with the tcp_read_sock)
              - Else, mark the psock with the number of bytes needed to
      	  complete the message.
         3) In TCP data ready function, if the psock indicates that we are
            waiting for the rest of the bytes of a messages, check the number
            of queued bytes against that.
              - If there are still not enough bytes for the message, just
              - Else, clear the waiting bytes and proceed to receive the
      	  skbufs.  The message should now be received in one
      Signed-off-by: default avatarTom Herbert <[email protected]>
      Signed-off-by: default avatarDavid S. Miller <[email protected]>
    • Tom Herbert's avatar
      kcm: Sendpage support · f29698fc
      Tom Herbert authored
      Implement kcm_sendpage. Set in sendpage to kcm_sendpage in both
      dgram and seqpacket ops.
      Signed-off-by: default avatarTom Herbert <[email protected]>
      Signed-off-by: default avatarDavid S. Miller <[email protected]>
    • Tom Herbert's avatar
      kcm: Splice support · 91687355
      Tom Herbert authored
      Implement kcm_splice_read. This is supported only for seqpacket.
      Add kcm_seqpacket_ops and set splice read to kcm_splice_read.
      Signed-off-by: default avatarTom Herbert <[email protected]>
      Signed-off-by: default avatarDavid S. Miller <[email protected]>
    • Tom Herbert's avatar
      kcm: Add statistics and proc interfaces · cd6e111b
      Tom Herbert authored
      This patch adds various counters for KCM. These include counters for
      messages and bytes received or sent, as well as counters for number of
      attached/unattached TCP sockets and other error or edge events.
      The statistics are exposed via a proc interface. /proc/net/kcm provides
      statistics per KCM socket and per psock (attached TCP sockets).
      /proc/net/kcm_stats provides aggregate statistics.
      Signed-off-by: default avatarTom Herbert <[email protected]>
      Signed-off-by: default avatarDavid S. Miller <[email protected]>
    • Tom Herbert's avatar
      kcm: Kernel Connection Multiplexor module · ab7ac4eb
      Tom Herbert authored
      This module implements the Kernel Connection Multiplexor.
      Kernel Connection Multiplexor (KCM) is a facility that provides a
      message based interface over TCP for generic application protocols.
      With KCM an application can efficiently send and receive application
      protocol messages over TCP using datagram sockets.
      For more information see the included Documentation/networking/kcm.txt
      Signed-off-by: default avatarTom Herbert <[email protected]>
      Signed-off-by: default avatarDavid S. Miller <[email protected]>