* refs/heads/tmp-d6bbe8b Linux 4.4.127 Revert "ip6_vti: adjust vti mtu according to mtu of lower device" net: cavium: liquidio: fix up "Avoid dma_unmap_single on uninitialized ndata" spi: davinci: fix up dma_mapping_error() incorrect patch Revert "mtip32xx: use runtime tag to initialize command header" Revert "cpufreq: Fix governor module removal race" Revert "ARM: dts: omap3-n900: Fix the audio CODEC's reset pin" Revert "ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin" Revert "PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown()" nospec: Kill array_index_nospec_mask_check() nospec: Move array_index_nospec() parameter checking into separate macro net: hns: Fix ethtool private flags md/raid10: reset the 'first' at the end of loop ARM: dts: am57xx-beagle-x15-common: Add overide powerhold property ARM: dts: dra7: Add power hold and power controller properties to palmas Documentation: pinctrl: palmas: Add ti,palmas-powerhold-override property definition vt: change SGR 21 to follow the standards Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list staging: comedi: ni_mio_common: ack ai fifo error interrupts. fs/proc: Stop trying to report thread stacks crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one crypto: ahash - Fix early termination in hash walk parport_pc: Add support for WCH CH382L PCI-E single parallel port card. media: usbtv: prevent double free in error case mei: remove dev_err message on an unsupported ioctl USB: serial: cp210x: add ELDAT Easywave RX09 id USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator USB: serial: ftdi_sio: add RT Systems VX-8 cable usb: dwc2: Improve gadget state disconnection handling scsi: virtio_scsi: always read VPD pages for multiqueue too llist: clang: introduce member_address_is_nonnull() Bluetooth: Fix missing encryption refresh on Security Request netfilter: x_tables: add and use xt_check_proc_name netfilter: bridge: ebt_among: add more missing match size checks xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms() RDMA/ucma: Introduce safer rdma_addr_size() variants RDMA/ucma: Don't allow join attempts for unsupported AF family RDMA/ucma: Check that device exists prior to accessing it RDMA/ucma: Check that device is connected prior to access it RDMA/ucma: Ensure that CM_ID exists prior to access it RDMA/ucma: Fix use-after-free access in ucma_close RDMA/ucma: Check AF family prior resolving address xfrm_user: uncoditionally validate esn replay attribute struct arm64: avoid overflow in VA_START and PAGE_OFFSET selinux: Remove redundant check for unknown labeling behavior netfilter: ctnetlink: Make some parameters integer to avoid enum mismatch tty: provide tty_name() even without CONFIG_TTY audit: add tty field to LOGIN event frv: declare jiffies to be located in the .data section jiffies.h: declare jiffies and jiffies_64 with ____cacheline_aligned_in_smp fs: compat: Remove warning from COMPATIBLE_IOCTL selinux: Remove unnecessary check of array base in selinux_set_mapping() cpumask: Add helper cpumask_available() genirq: Use cpumask_available() for check of cpumask variable netfilter: nf_nat_h323: fix logical-not-parentheses warning Input: mousedev - fix implicit conversion warning dm ioctl: remove double parentheses PCI: Make PCI_ROM_ADDRESS_MASK a 32-bit constant writeback: fix the wrong congested state variable definition ACPI, PCI, irq: remove redundant check for null string pointer kprobes/x86: Fix to set RWX bits correctly before releasing trampoline usb: gadget: f_hid: fix: Prevent accessing released memory usb: gadget: align buffer size when allocating for OUT endpoint usb: gadget: fix usb_ep_align_maybe endianness and new usb_ep_align usb: gadget: change len to size_t on alloc_ep_req() usb: gadget: define free_ep_req as universal function partitions/msdos: Unable to mount UFS 44bsd partitions perf/hwbp: Simplify the perf-hwbp code, fix documentation ALSA: pcm: potential uninitialized return values ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent() mtd: jedec_probe: Fix crash in jedec_read_mfr() Replace #define with enum for better compilation errors. Add missing include to drivers/tty/goldfish.c Fix whitespace in drivers/tty/goldfish.c ANDROID: fuse: Add null terminator to path in canonical path to avoid issue ANDROID: sdcardfs: Fix sdcardfs to stop creating cases-sensitive duplicate entries. ANDROID: add missing include to pdev_bus ANDROID: pdev_bus: replace writel with gf_write_ptr ANDROID: Cleanup type casting in goldfish.h ANDROID: Include missing headers in goldfish.h ANDROID: cpufreq: times: skip printing invalid frequencies ANDROID: xt_qtaguid: Remove unnecessary null checks to device's name ANDROID: xt_qtaguid: Remove unnecessary null checks to ifa_label ANDROID: cpufreq: times: allocate enough space for a uid_entry Linux 4.4.126 net: systemport: Rewrite __bcm_sysport_tx_reclaim() net: fec: Fix unbalanced PM runtime calls ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event() s390/qeth: on channel error, reject further cmd requests s390/qeth: lock read device while queueing next buffer s390/qeth: when thread completes, wake up all waiters s390/qeth: free netdevice when removing a card team: Fix double free in error path skbuff: Fix not waking applications when errors are enqueued net: Only honor ifindex in IP_PKTINFO if non-0 netlink: avoid a double skb free in genlmsg_mcast() net/iucv: Free memory obtained by kzalloc net: ethernet: ti: cpsw: add check for in-band mode setting with RGMII PHY interface net: ethernet: arc: Fix a potential memory leak if an optional regulator is deferred l2tp: do not accept arbitrary sockets ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option() dccp: check sk for closed state in dccp_sendmsg() net: Fix hlist corruptions in inet_evict_bucket() Revert "genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs" scsi: sg: don't return bogus Sg_requests Revert "genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs" UPSTREAM: drm: virtio-gpu: set atomic flag UPSTREAM: drm: virtio-gpu: transfer dumb buffers to host on plane update UPSTREAM: drm: virtio-gpu: ensure plane is flushed to host on atomic update UPSTREAM: drm: virtio-gpu: get the fb from the plane state for atomic updates Linux 4.4.125 bpf, x64: increase number of passes bpf: skip unnecessary capability check kbuild: disable clang's default use of -fmerge-all-constants staging: lustre: ptlrpc: kfree used instead of kvfree perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period() x86/entry/64: Don't use IST entry for #BP stack x86/boot/64: Verify alignment of the LOAD segment x86/build/64: Force the linker to use 2MB page size kvm/x86: fix icebp instruction handling tty: vt: fix up tabstops properly can: cc770: Fix use after free in cc770_tx_interrupt() can: cc770: Fix queue stall & dropped RTR reply can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack staging: ncpfs: memory corruption in ncp_read_kernel() mtd: nand: fsl_ifc: Fix nand waitfunc return value tracing: probeevent: Fix to support minus offset from symbol rtlwifi: rtl8723be: Fix loss of signal brcmfmac: fix P2P_DEVICE ethernet address generation acpi, numa: fix pxm to online numa node associations drm: udl: Properly check framebuffer mmap offsets drm/radeon: Don't turn off DP sink when disconnected drm/vmwgfx: Fix a destoy-while-held mutex problem. x86/mm: implement free pmd/pte page interfaces mm/vmalloc: add interfaces to free unmapped page table libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs libata: Enable queued TRIM for Samsung SSD 860 libata: disable LPM for Crucial BX100 SSD 500GB drive libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs libata: remove WARN() for DMA or PIO command without data libata: fix length validation of ATAPI-relayed SCSI commands Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174 clk: bcm2835: Protect sections updating shared registers ahci: Add PCI-id for the Highpoint Rocketraid 644L card PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs ALSA: hda/realtek - Always immediately update mute LED with pin VREF ALSA: aloop: Fix access to not-yet-ready substream via cable ALSA: aloop: Sync stale timer before release ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit iio: st_pressure: st_accel: pass correct platform data to init MIPS: ralink: Remove ralink_halt() ANDROID: cpufreq: times: fix proc_time_in_state_show dtc: turn off dtc unit address warnings by default Linux 4.4.124 RDMA/ucma: Fix access to non-initialized CM_ID object dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63 clk: si5351: Rename internal plls to avoid name collisions nfsd4: permit layoutget of executable-only files RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS ip6_vti: adjust vti mtu according to mtu of lower device iommu/vt-d: clean up pr_irq if request_threaded_irq fails pinctrl: Really force states during suspend/resume coresight: Fix disabling of CoreSight TPIU pty: cancel pty slave port buf's work in tty_release drm/omap: DMM: Check for DMM readiness after successful transaction commit vgacon: Set VGA struct resource types IB/umem: Fix use of npages/nmap fields RDMA/cma: Use correct size when writing netlink stats IB/ipoib: Avoid memory leak if the SA returns a different DGID mmc: avoid removing non-removable hosts during suspend platform/chrome: Use proper protocol transfer function cros_ec: fix nul-termination for firmware build info media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart media: bt8xx: Fix err 'bt878_probe()' rtlwifi: rtl_pci: Fix the bug when inactiveps is enabled. RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo() drm/msm: fix leak in failed get_pages media: c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt Bluetooth: hci_qca: Avoid setup failure on missing rampatch perf tests kmod-path: Don't fail if compressed modules aren't supported rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks cifs: small underflow in cnvrtDosUnixTm() net: hns: fix ethtool_get_strings overflow in hns driver sm501fb: don't return zero on failure path in sm501fb_start() video: fbdev: udlfb: Fix buffer on stack tcm_fileio: Prevent information leak for short reads ia64: fix module loading for gcc-5.4 md/raid10: skip spare disk as 'first' disk Input: twl4030-pwrbutton - use correct device for irq request power: supply: pda_power: move from timer to delayed_work bnx2x: Align RX buffers drm/nouveau/kms: Increase max retries in scanout position queries. ACPI / PMIC: xpower: Fix power_table addresses ipmi/watchdog: fix wdog hang on panic waiting for ipmi response ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a staging: wilc1000: fix unchecked return value staging: unisys: visorhba: fix s-Par to boot with option CONFIG_VMAP_STACK set to y mtip32xx: use runtime tag to initialize command header mfd: palmas: Reset the POWERHOLD mux during power off mac80211: don't parse encrypted management frames in ieee80211_frame_acked Btrfs: send, fix file hole not being preserved due to inline extent rndis_wlan: add return value validation mt7601u: check return value of alloc_skb iio: st_pressure: st_accel: Initialise sensor platform data properly NFS: don't try to cross a mountpount when there isn't one there. infiniband/uverbs: Fix integer overflows scsi: mac_esp: Replace bogus memory barrier with spinlock qlcnic: fix unchecked return value wan: pc300too: abort path on failure mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR() openvswitch: Delete conntrack entry clashing with an expectation. netfilter: xt_CT: fix refcnt leak on error path Fix driver usage of 128B WQEs when WQ_CREATE is V1. ASoC: Intel: Skylake: Uninitialized variable in probe_codec() IB/mlx4: Change vma from shared to private IB/mlx4: Take write semaphore when changing the vma struct HSI: ssi_protocol: double free in ssip_pn_xmit() IB/ipoib: Update broadcast object if PKey value was changed in index 0 IB/ipoib: Fix deadlock between ipoib_stop and mcast join flow ALSA: hda - Fix headset microphone detection for ASUS N551 and N751 e1000e: fix timing for 82579 Gigabit Ethernet controller tcp: remove poll() flakes with FastOpen NFS: Fix missing pg_cleanup after nfs_pageio_cond_complete() md/raid10: wait up frozen array in handle_write_completed iommu/omap: Register driver before setting IOMMU ops ARM: 8668/1: ftrace: Fix dynamic ftrace with DEBUG_RODATA and !FRAME_POINTER KVM: PPC: Book3S PR: Exit KVM on failed mapping scsi: virtio_scsi: Always try to read VPD pages clk: ns2: Correct SDIO bits ath: Fix updating radar flags for coutry code India spi: dw: Disable clock after unregistering the host media/dvb-core: Race condition when writing to CAM net: ipv6: send unsolicited NA on admin up i2c: i2c-scmi: add a MS HID genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs cpufreq/sh: Replace racy task affinity logic ACPI/processor: Replace racy task affinity logic ACPI/processor: Fix error handling in __acpi_processor_start() time: Change posix clocks ops interfaces to use timespec64 Input: ar1021_i2c - fix too long name in driver's device table rtc: cmos: Do not assume irq 8 for rtc when there are no legacy irqs x86: i8259: export legacy_pic symbol regulator: anatop: set default voltage selector for pcie platform/x86: asus-nb-wmi: Add wapf4 quirk for the X302UA staging: android: ashmem: Fix possible deadlock in ashmem_ioctl CIFS: Enable encryption during session setup phase SMB3: Validate negotiate request must always be signed tpm_tis: fix potential buffer overruns caused by bit glitches on the bus tpm: fix potential buffer overruns caused by bit glitches on the bus BACKPORT, FROMLIST: crypto: arm64/speck - add NEON-accelerated implementation of Speck-XTS Linux 4.4.123 bpf: fix incorrect sign extension in check_alu_op() usb: gadget: bdc: 64-bit pointer capability check USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe() btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device btrfs: alloc_chunk: fix DUP stripe size handling ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux scsi: sg: only check for dxfer_len greater than 256M scsi: sg: fix static checker warning in sg_is_valid_dxfer scsi: sg: fix SG_DXFER_FROM_DEV transfers irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis fs/aio: Use RCU accessors for kioctx_table->table[] fs/aio: Add explicit RCU grace period when freeing kioctx lock_parent() needs to recheck if dentry got __dentry_kill'ed under it fs: Teach path_connected to handle nfs filesystems with multiple roots. drm/amdgpu/dce: Don't turn off DP sink when disconnected ALSA: seq: Clear client entry before deleting else at closing ALSA: seq: Fix possible UAF in snd_seq_check_queue() ALSA: hda - Revert power_save option default value ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() x86/mm: Fix vmalloc_fault to use pXd_large x86/vm86/32: Fix POPF emulation selftests/x86/entry_from_vm86: Add test cases for POPF selftests/x86: Add tests for the STR and SLDT instructions selftests/x86: Add tests for User-Mode Instruction Prevention selftests/x86/entry_from_vm86: Exit with 1 if we fail ima: relax requiring a file signature for new files with zero length rcutorture/configinit: Fix build directory error message ipvlan: add L2 check for packets arriving via virtual devices ASoC: nuc900: Fix a loop timeout test mac80211: remove BUG() when interface type is invalid mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED agp/intel: Flush all chipset writes after updating the GGTT drm/amdkfd: Fix memory leaks in kfd topology veth: set peer GSO values media: cpia2: Fix a couple off by one bugs scsi: dh: add new rdac devices scsi: devinfo: apply to HP XP the same flags as Hitachi VSP scsi: core: scsi_get_device_flags_keyed(): Always return device flags spi: sun6i: disable/unprepare clocks on remove tools/usbip: fixes build with musl libc toolchain ath10k: fix invalid STS_CAP_OFFSET_MASK clk: qcom: msm8916: fix mnd_width for codec_digcodec cpufreq: Fix governor module removal race ath10k: update tdls teardown state to target ARM: dts: omap3-n900: Fix the audio CODEC's reset pin ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]() net: xfrm: allow clearing socket xfrm policies. test_firmware: fix setting old custom fw path back on exit sched: Stop resched_cpu() from sending IPIs to offline CPUs sched: Stop switched_to_rt() from sending IPIs to offline CPUs ARM: dts: exynos: Correct Trats2 panel reset line HID: elo: clear BTN_LEFT mapping video/hdmi: Allow "empty" HDMI infoframes drm/edid: set ELD connector type in drm_edid_to_eld() wil6210: fix memory access violation in wil_memcpy_from/toio_32 pwm: tegra: Increase precision in PWM rate calculation kprobes/x86: Set kprobes pages read-only kprobes/x86: Fix kprobe-booster not to boost far call instructions scsi: sg: close race condition in sg_remove_sfp_usercontext() scsi: sg: check for valid direction before starting the request perf session: Don't rely on evlist in pipe mode perf inject: Copy events when reordering events in pipe mode drivers/perf: arm_pmu: handle no platform_device usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control() usb: dwc2: Make sure we disconnect the gadget state md/raid6: Fix anomily when recovering a single device in RAID6. regulator: isl9305: fix array size MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification MIPS: BPF: Fix multiple problems in JIT skb access helpers. MIPS: BPF: Quit clobbering callee saved registers in JIT code. coresight: Fixes coresight DT parse to get correct output port ID. drm/amdgpu: Fail fb creation from imported dma-bufs. (v2) drm/radeon: Fail fb creation from imported dma-bufs. video: ARM CLCD: fix dma allocation size iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range apparmor: Make path_max parameter readonly scsi: ses: don't get power status of SES device slot on probe fm10k: correctly check if interface is removed ALSA: firewire-digi00x: handle all MIDI messages on streaming packets reiserfs: Make cancel_old_flush() reliable ARM: dts: koelsch: Correct clock frequency of X2 DU clock input net/faraday: Add missing include of of.h powerpc: Avoid taking a data miss on every userspace instruction miss ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks NFC: nfcmrvl: double free on error path NFC: nfcmrvl: Include unaligned.h instead of access_ok.h vxlan: vxlan dev should inherit lowerdev's gso_max_size drm/vmwgfx: Fixes to vmwgfx_fb braille-console: Fix value returned by _braille_console_setup bonding: refine bond_fold_stats() wrap detection f2fs: relax node version check for victim data in gc blk-throttle: make sure expire time isn't too big mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative() driver: (adm1275) set the m,b and R coefficients correctly for power dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped tcp: sysctl: Fix a race to avoid unexpected 0 window from space spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer ASoC: rcar: ssi: don't set SSICR.CKDV = 000 with SSIWSR.CONT sched: act_csum: don't mangle TCP and UDP GSO packets Input: qt1070 - add OF device ID table sysrq: Reset the watchdog timers while displaying high-resolution timers timers, sched_clock: Update timeout for clock wrap media: i2c/soc_camera: fix ov6650 sensor getting wrong clock scsi: ipr: Fix missed EH wakeup solo6x10: release vb2 buffers in solo_stop_streaming() of: fix of_device_get_modalias returned length when truncating buffers batman-adv: handle race condition for claims between gateways ARM: dts: Adjust moxart IRQ controller and flags net/8021q: create device with all possible features in wanted_features HID: clamp input to logical range if no null state perf probe: Return errno when not hitting any event ath10k: disallow DFS simulation if DFS channel is not enabled drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off) drivers: net: xgene: Fix hardware checksum setting perf tools: Make perf_event__synthesize_mmap_events() scale i40e: fix ethtool to get EEPROM data from X722 interface i40e: Acquire NVM lock before reads on all devices perf sort: Fix segfault with basic block 'cycles' sort dimension selinux: check for address length in selinux_socket_bind() PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown() ath10k: fix a warning during channel switch with multiple vaps drm: qxl: Don't alloc fbdev if emulation is not supported HID: reject input outside logical range only if null state is set staging: wilc1000: add check for kmalloc allocation failure. staging: speakup: Replace BUG_ON() with WARN_ON(). Input: tsc2007 - check for presence and power down tsc2007 during probe blkcg: fix double free of new_blkg in blkcg_init_queue ANDROID: cpufreq: times: avoid prematurely freeing uid_entry ANDROID: Use standard logging functions in goldfish_pipe ANDROID: Fix whitespace in goldfish staging: android: ashmem: Fix possible deadlock in ashmem_ioctl llist: clang: introduce member_address_is_nonnull() Linux 4.4.122 fixup: sctp: verify size of a new chunk in _sctp_make_chunk() serial: 8250_pci: Add Brainboxes UC-260 4 port serial device usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb() usb: usbmon: Read text within supplied buffer size USB: usbmon: remove assignment from IS_ERR argument usb: quirks: add control message delay for 1b1c:1b20 USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h staging: android: ashmem: Fix lockdep issue during llseek staging: comedi: fix comedi_nsamples_left. uas: fix comparison for error code tty/serial: atmel: add new version check for usart serial: sh-sci: prevent lockup on full TTY buffers x86: Treat R_X86_64_PLT32 as R_X86_64_PC32 x86/module: Detect and skip invalid relocations Revert "ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux" NFS: Fix an incorrect type in struct nfs_direct_req scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport ubi: Fix race condition between ubi volume creation and udev ext4: inplace xattr block update fails to deduplicate blocks netfilter: x_tables: pack percpu counter allocations netfilter: x_tables: pass xt_counters struct to counter allocator netfilter: x_tables: pass xt_counters struct instead of packet counter netfilter: use skb_to_full_sk in ip_route_me_harder netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt netfilter: bridge: ebt_among: add missing match size checks netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets netfilter: IDLETIMER: be syzkaller friendly netfilter: nat: cope with negative port range netfilter: x_tables: fix missing timer initialization in xt_LED netfilter: add back stackpointer size checks tc358743: fix register i2c_rd/wr function fix Input: tca8418_keypad - remove double read of key event register ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds netfilter: nfnetlink_queue: fix timestamp attribute watchdog: hpwdt: fix unused variable warning watchdog: hpwdt: Check source of NMI watchdog: hpwdt: SMBIOS check nospec: Include <asm/barrier.h> dependency ALSA: hda: add dock and led support for HP ProBook 640 G2 ALSA: hda: add dock and led support for HP EliteBook 820 G3 ALSA: seq: More protection for concurrent write and ioctl races ALSA: seq: Don't allow resizing pool in use ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520 x86/MCE: Serialize sysfs changes bcache: don't attach backing with duplicate UUID kbuild: Handle builtin dtb file names containing hyphens loop: Fix lost writes caused by missing flag Input: matrix_keypad - fix race when disabling interrupts MIPS: OCTEON: irq: Check for null return on kzalloc allocation MIPS: ath25: Check for kzalloc allocation failure MIPS: BMIPS: Do not mask IPIs during suspend drm/amdgpu: fix KV harvesting drm/radeon: fix KV harvesting drm/amdgpu: Notify sbios device ready before send request drm/amdgpu: Fix deadlock on runtime suspend drm/radeon: Fix deadlock on runtime suspend drm/nouveau: Fix deadlock on runtime suspend drm: Allow determining if current task is output poll worker workqueue: Allow retrieval of current task's work struct scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS RDMA/mlx5: Fix integer overflow while resizing CQ RDMA/ucma: Check that user doesn't overflow QP state RDMA/ucma: Limit possible option size ANDROID: ranchu: 32 bit framebuffer support ANDROID: Address checkpatch warnings in goldfishfb ANDROID: Address checkpatch.pl warnings in goldfish_pipe ANDROID: sdcardfs: fix lock issue on 32 bit/SMP architectures ANDROID: goldfish: Fix typo in goldfish_cmd_locked() call ANDROID: Address checkpatch.pl warnings in goldfish_pipe_v2 FROMLIST: f2fs: don't put dentry page in pagecache into highmem Linux 4.4.121 btrfs: preserve i_mode if __btrfs_set_acl() fails bpf, x64: implement retpoline for tail call dm io: fix duplicate bio completion due to missing ref count mpls, nospec: Sanitize array index in mpls_label_ok() net: mpls: Pull common label check into helper sctp: verify size of a new chunk in _sctp_make_chunk() s390/qeth: fix IPA command submission race s390/qeth: fix SETIP command handling sctp: fix dst refcnt leak in sctp_v6_get_dst() sctp: fix dst refcnt leak in sctp_v4_get_dst udplite: fix partial checksum initialization ppp: prevent unregistered channels from connecting to PPP units netlink: ensure to loop over all netns in genlmsg_multicast_allns() net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68 net: fix race on decreasing number of TX queues ipv6 sit: work around bogus gcc-8 -Wrestrict warning hdlc_ppp: carrier detect ok, don't turn off negotiation fib_semantics: Don't match route with mismatching tclassid bridge: check brport attr show in brport_show Revert "led: core: Fix brightness setting when setting delay_off=0" x86/spectre: Fix an error message leds: do not overflow sysfs buffer in led_trigger_show x86/apic/vector: Handle legacy irq data correctly ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux btrfs: Don't clear SGID when inheriting ACLs x86/syscall: Sanitize syscall table de-references under speculation fix KVM: mmu: Fix overlap between public and private memslots ARM: mvebu: Fix broken PL310_ERRATA_753970 selects nospec: Allow index argument to have const-qualified type media: m88ds3103: don't call a non-initalized function cpufreq: s3c24xx: Fix broken s3c_cpufreq_init() ALSA: hda: Add a power_save blacklist ALSA: usb-audio: Add a quirck for B&W PX headphones tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus ANDROID: Delete the goldfish_nand driver. ANDROID: Add input support for Android Wear. ANDROID: proc: fix config & includes for /proc/uid FROMLIST: ARM: amba: Don't read past the end of sysfs "driver_override" buffer UPSTREAM: ANDROID: binder: remove WARN() for redundant txn error ANDROID: cpufreq: times: Add missing includes ANDROID: cpufreq: Add time_in_state to /proc/uid directories ANDROID: proc: Add /proc/uid directory ANDROID: cpufreq: times: track per-uid time in state ANDROID: cpufreq: track per-task time in state Conflicts: drivers/gpu/drm/msm/msm_gem.c drivers/net/wireless/ath/regd.c kernel/sched/core.c Change-Id: I9bb7b5a062415da6925a5a56a34e6eb066a53320 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
1178 lines
26 KiB
C
1178 lines
26 KiB
C
/*
|
|
* NETLINK Generic Netlink Family
|
|
*
|
|
* Authors: Jamal Hadi Salim
|
|
* Thomas Graf <tgraf@suug.ch>
|
|
* Johannes Berg <johannes@sipsolutions.net>
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/errno.h>
|
|
#include <linux/types.h>
|
|
#include <linux/socket.h>
|
|
#include <linux/string.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/mutex.h>
|
|
#include <linux/bitmap.h>
|
|
#include <linux/rwsem.h>
|
|
#include <net/sock.h>
|
|
#include <net/genetlink.h>
|
|
|
|
static DEFINE_MUTEX(genl_mutex); /* serialization of message processing */
|
|
static DECLARE_RWSEM(cb_lock);
|
|
|
|
atomic_t genl_sk_destructing_cnt = ATOMIC_INIT(0);
|
|
DECLARE_WAIT_QUEUE_HEAD(genl_sk_destructing_waitq);
|
|
|
|
void genl_lock(void)
|
|
{
|
|
mutex_lock(&genl_mutex);
|
|
}
|
|
EXPORT_SYMBOL(genl_lock);
|
|
|
|
void genl_unlock(void)
|
|
{
|
|
mutex_unlock(&genl_mutex);
|
|
}
|
|
EXPORT_SYMBOL(genl_unlock);
|
|
|
|
#ifdef CONFIG_LOCKDEP
|
|
bool lockdep_genl_is_held(void)
|
|
{
|
|
return lockdep_is_held(&genl_mutex);
|
|
}
|
|
EXPORT_SYMBOL(lockdep_genl_is_held);
|
|
#endif
|
|
|
|
static void genl_lock_all(void)
|
|
{
|
|
down_write(&cb_lock);
|
|
genl_lock();
|
|
}
|
|
|
|
static void genl_unlock_all(void)
|
|
{
|
|
genl_unlock();
|
|
up_write(&cb_lock);
|
|
}
|
|
|
|
#define GENL_FAM_TAB_SIZE 16
|
|
#define GENL_FAM_TAB_MASK (GENL_FAM_TAB_SIZE - 1)
|
|
|
|
static struct list_head family_ht[GENL_FAM_TAB_SIZE];
|
|
/*
|
|
* Bitmap of multicast groups that are currently in use.
|
|
*
|
|
* To avoid an allocation at boot of just one unsigned long,
|
|
* declare it global instead.
|
|
* Bit 0 is marked as already used since group 0 is invalid.
|
|
* Bit 1 is marked as already used since the drop-monitor code
|
|
* abuses the API and thinks it can statically use group 1.
|
|
* That group will typically conflict with other groups that
|
|
* any proper users use.
|
|
* Bit 16 is marked as used since it's used for generic netlink
|
|
* and the code no longer marks pre-reserved IDs as used.
|
|
* Bit 17 is marked as already used since the VFS quota code
|
|
* also abused this API and relied on family == group ID, we
|
|
* cater to that by giving it a static family and group ID.
|
|
* Bit 18 is marked as already used since the PMCRAID driver
|
|
* did the same thing as the VFS quota code (maybe copied?)
|
|
*/
|
|
static unsigned long mc_group_start = 0x3 | BIT(GENL_ID_CTRL) |
|
|
BIT(GENL_ID_VFS_DQUOT) |
|
|
BIT(GENL_ID_PMCRAID);
|
|
static unsigned long *mc_groups = &mc_group_start;
|
|
static unsigned long mc_groups_longs = 1;
|
|
|
|
static int genl_ctrl_event(int event, struct genl_family *family,
|
|
const struct genl_multicast_group *grp,
|
|
int grp_id);
|
|
|
|
static inline unsigned int genl_family_hash(unsigned int id)
|
|
{
|
|
return id & GENL_FAM_TAB_MASK;
|
|
}
|
|
|
|
static inline struct list_head *genl_family_chain(unsigned int id)
|
|
{
|
|
return &family_ht[genl_family_hash(id)];
|
|
}
|
|
|
|
static struct genl_family *genl_family_find_byid(unsigned int id)
|
|
{
|
|
struct genl_family *f;
|
|
|
|
list_for_each_entry(f, genl_family_chain(id), family_list)
|
|
if (f->id == id)
|
|
return f;
|
|
|
|
return NULL;
|
|
}
|
|
|
|
static struct genl_family *genl_family_find_byname(char *name)
|
|
{
|
|
struct genl_family *f;
|
|
int i;
|
|
|
|
for (i = 0; i < GENL_FAM_TAB_SIZE; i++)
|
|
list_for_each_entry(f, genl_family_chain(i), family_list)
|
|
if (strcmp(f->name, name) == 0)
|
|
return f;
|
|
|
|
return NULL;
|
|
}
|
|
|
|
static const struct genl_ops *genl_get_cmd(u8 cmd, struct genl_family *family)
|
|
{
|
|
int i;
|
|
|
|
for (i = 0; i < family->n_ops; i++)
|
|
if (family->ops[i].cmd == cmd)
|
|
return &family->ops[i];
|
|
|
|
return NULL;
|
|
}
|
|
|
|
/* Of course we are going to have problems once we hit
|
|
* 2^16 alive types, but that can only happen by year 2K
|
|
*/
|
|
static u16 genl_generate_id(void)
|
|
{
|
|
static u16 id_gen_idx = GENL_MIN_ID;
|
|
int i;
|
|
|
|
for (i = 0; i <= GENL_MAX_ID - GENL_MIN_ID; i++) {
|
|
if (id_gen_idx != GENL_ID_VFS_DQUOT &&
|
|
id_gen_idx != GENL_ID_PMCRAID &&
|
|
!genl_family_find_byid(id_gen_idx))
|
|
return id_gen_idx;
|
|
if (++id_gen_idx > GENL_MAX_ID)
|
|
id_gen_idx = GENL_MIN_ID;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int genl_allocate_reserve_groups(int n_groups, int *first_id)
|
|
{
|
|
unsigned long *new_groups;
|
|
int start = 0;
|
|
int i;
|
|
int id;
|
|
bool fits;
|
|
|
|
do {
|
|
if (start == 0)
|
|
id = find_first_zero_bit(mc_groups,
|
|
mc_groups_longs *
|
|
BITS_PER_LONG);
|
|
else
|
|
id = find_next_zero_bit(mc_groups,
|
|
mc_groups_longs * BITS_PER_LONG,
|
|
start);
|
|
|
|
fits = true;
|
|
for (i = id;
|
|
i < min_t(int, id + n_groups,
|
|
mc_groups_longs * BITS_PER_LONG);
|
|
i++) {
|
|
if (test_bit(i, mc_groups)) {
|
|
start = i;
|
|
fits = false;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (id >= mc_groups_longs * BITS_PER_LONG) {
|
|
unsigned long new_longs = mc_groups_longs +
|
|
BITS_TO_LONGS(n_groups);
|
|
size_t nlen = new_longs * sizeof(unsigned long);
|
|
|
|
if (mc_groups == &mc_group_start) {
|
|
new_groups = kzalloc(nlen, GFP_KERNEL);
|
|
if (!new_groups)
|
|
return -ENOMEM;
|
|
mc_groups = new_groups;
|
|
*mc_groups = mc_group_start;
|
|
} else {
|
|
new_groups = krealloc(mc_groups, nlen,
|
|
GFP_KERNEL);
|
|
if (!new_groups)
|
|
return -ENOMEM;
|
|
mc_groups = new_groups;
|
|
for (i = 0; i < BITS_TO_LONGS(n_groups); i++)
|
|
mc_groups[mc_groups_longs + i] = 0;
|
|
}
|
|
mc_groups_longs = new_longs;
|
|
}
|
|
} while (!fits);
|
|
|
|
for (i = id; i < id + n_groups; i++)
|
|
set_bit(i, mc_groups);
|
|
*first_id = id;
|
|
return 0;
|
|
}
|
|
|
|
static struct genl_family genl_ctrl;
|
|
|
|
static int genl_validate_assign_mc_groups(struct genl_family *family)
|
|
{
|
|
int first_id;
|
|
int n_groups = family->n_mcgrps;
|
|
int err = 0, i;
|
|
bool groups_allocated = false;
|
|
|
|
if (!n_groups)
|
|
return 0;
|
|
|
|
for (i = 0; i < n_groups; i++) {
|
|
const struct genl_multicast_group *grp = &family->mcgrps[i];
|
|
|
|
if (WARN_ON(grp->name[0] == '\0'))
|
|
return -EINVAL;
|
|
if (WARN_ON(memchr(grp->name, '\0', GENL_NAMSIZ) == NULL))
|
|
return -EINVAL;
|
|
}
|
|
|
|
/* special-case our own group and hacks */
|
|
if (family == &genl_ctrl) {
|
|
first_id = GENL_ID_CTRL;
|
|
BUG_ON(n_groups != 1);
|
|
} else if (strcmp(family->name, "NET_DM") == 0) {
|
|
first_id = 1;
|
|
BUG_ON(n_groups != 1);
|
|
} else if (family->id == GENL_ID_VFS_DQUOT) {
|
|
first_id = GENL_ID_VFS_DQUOT;
|
|
BUG_ON(n_groups != 1);
|
|
} else if (family->id == GENL_ID_PMCRAID) {
|
|
first_id = GENL_ID_PMCRAID;
|
|
BUG_ON(n_groups != 1);
|
|
} else {
|
|
groups_allocated = true;
|
|
err = genl_allocate_reserve_groups(n_groups, &first_id);
|
|
if (err)
|
|
return err;
|
|
}
|
|
|
|
family->mcgrp_offset = first_id;
|
|
|
|
/* if still initializing, can't and don't need to to realloc bitmaps */
|
|
if (!init_net.genl_sock)
|
|
return 0;
|
|
|
|
if (family->netnsok) {
|
|
struct net *net;
|
|
|
|
netlink_table_grab();
|
|
rcu_read_lock();
|
|
for_each_net_rcu(net) {
|
|
err = __netlink_change_ngroups(net->genl_sock,
|
|
mc_groups_longs * BITS_PER_LONG);
|
|
if (err) {
|
|
/*
|
|
* No need to roll back, can only fail if
|
|
* memory allocation fails and then the
|
|
* number of _possible_ groups has been
|
|
* increased on some sockets which is ok.
|
|
*/
|
|
break;
|
|
}
|
|
}
|
|
rcu_read_unlock();
|
|
netlink_table_ungrab();
|
|
} else {
|
|
err = netlink_change_ngroups(init_net.genl_sock,
|
|
mc_groups_longs * BITS_PER_LONG);
|
|
}
|
|
|
|
if (groups_allocated && err) {
|
|
for (i = 0; i < family->n_mcgrps; i++)
|
|
clear_bit(family->mcgrp_offset + i, mc_groups);
|
|
}
|
|
|
|
return err;
|
|
}
|
|
|
|
static void genl_unregister_mc_groups(struct genl_family *family)
|
|
{
|
|
struct net *net;
|
|
int i;
|
|
|
|
netlink_table_grab();
|
|
rcu_read_lock();
|
|
for_each_net_rcu(net) {
|
|
for (i = 0; i < family->n_mcgrps; i++)
|
|
__netlink_clear_multicast_users(
|
|
net->genl_sock, family->mcgrp_offset + i);
|
|
}
|
|
rcu_read_unlock();
|
|
netlink_table_ungrab();
|
|
|
|
for (i = 0; i < family->n_mcgrps; i++) {
|
|
int grp_id = family->mcgrp_offset + i;
|
|
|
|
if (grp_id != 1)
|
|
clear_bit(grp_id, mc_groups);
|
|
genl_ctrl_event(CTRL_CMD_DELMCAST_GRP, family,
|
|
&family->mcgrps[i], grp_id);
|
|
}
|
|
}
|
|
|
|
static int genl_validate_ops(const struct genl_family *family)
|
|
{
|
|
const struct genl_ops *ops = family->ops;
|
|
unsigned int n_ops = family->n_ops;
|
|
int i, j;
|
|
|
|
if (WARN_ON(n_ops && !ops))
|
|
return -EINVAL;
|
|
|
|
if (!n_ops)
|
|
return 0;
|
|
|
|
for (i = 0; i < n_ops; i++) {
|
|
if (ops[i].dumpit == NULL && ops[i].doit == NULL)
|
|
return -EINVAL;
|
|
for (j = i + 1; j < n_ops; j++)
|
|
if (ops[i].cmd == ops[j].cmd)
|
|
return -EINVAL;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* __genl_register_family - register a generic netlink family
|
|
* @family: generic netlink family
|
|
*
|
|
* Registers the specified family after validating it first. Only one
|
|
* family may be registered with the same family name or identifier.
|
|
* The family id may equal GENL_ID_GENERATE causing an unique id to
|
|
* be automatically generated and assigned.
|
|
*
|
|
* The family's ops array must already be assigned, you can use the
|
|
* genl_register_family_with_ops() helper function.
|
|
*
|
|
* Return 0 on success or a negative error code.
|
|
*/
|
|
int __genl_register_family(struct genl_family *family)
|
|
{
|
|
int err = -EINVAL, i;
|
|
|
|
if (family->id && family->id < GENL_MIN_ID)
|
|
goto errout;
|
|
|
|
if (family->id > GENL_MAX_ID)
|
|
goto errout;
|
|
|
|
err = genl_validate_ops(family);
|
|
if (err)
|
|
return err;
|
|
|
|
genl_lock_all();
|
|
|
|
if (genl_family_find_byname(family->name)) {
|
|
err = -EEXIST;
|
|
goto errout_locked;
|
|
}
|
|
|
|
if (family->id == GENL_ID_GENERATE) {
|
|
u16 newid = genl_generate_id();
|
|
|
|
if (!newid) {
|
|
err = -ENOMEM;
|
|
goto errout_locked;
|
|
}
|
|
|
|
family->id = newid;
|
|
} else if (genl_family_find_byid(family->id)) {
|
|
err = -EEXIST;
|
|
goto errout_locked;
|
|
}
|
|
|
|
if (family->maxattr && !family->parallel_ops) {
|
|
family->attrbuf = kmalloc((family->maxattr+1) *
|
|
sizeof(struct nlattr *), GFP_KERNEL);
|
|
if (family->attrbuf == NULL) {
|
|
err = -ENOMEM;
|
|
goto errout_locked;
|
|
}
|
|
} else
|
|
family->attrbuf = NULL;
|
|
|
|
err = genl_validate_assign_mc_groups(family);
|
|
if (err)
|
|
goto errout_locked;
|
|
|
|
list_add_tail(&family->family_list, genl_family_chain(family->id));
|
|
genl_unlock_all();
|
|
|
|
/* send all events */
|
|
genl_ctrl_event(CTRL_CMD_NEWFAMILY, family, NULL, 0);
|
|
for (i = 0; i < family->n_mcgrps; i++)
|
|
genl_ctrl_event(CTRL_CMD_NEWMCAST_GRP, family,
|
|
&family->mcgrps[i], family->mcgrp_offset + i);
|
|
|
|
return 0;
|
|
|
|
errout_locked:
|
|
genl_unlock_all();
|
|
errout:
|
|
return err;
|
|
}
|
|
EXPORT_SYMBOL(__genl_register_family);
|
|
|
|
/**
|
|
* genl_unregister_family - unregister generic netlink family
|
|
* @family: generic netlink family
|
|
*
|
|
* Unregisters the specified family.
|
|
*
|
|
* Returns 0 on success or a negative error code.
|
|
*/
|
|
int genl_unregister_family(struct genl_family *family)
|
|
{
|
|
struct genl_family *rc;
|
|
|
|
genl_lock_all();
|
|
|
|
list_for_each_entry(rc, genl_family_chain(family->id), family_list) {
|
|
if (family->id != rc->id || strcmp(rc->name, family->name))
|
|
continue;
|
|
|
|
genl_unregister_mc_groups(family);
|
|
|
|
list_del(&rc->family_list);
|
|
family->n_ops = 0;
|
|
up_write(&cb_lock);
|
|
wait_event(genl_sk_destructing_waitq,
|
|
atomic_read(&genl_sk_destructing_cnt) == 0);
|
|
genl_unlock();
|
|
|
|
kfree(family->attrbuf);
|
|
genl_ctrl_event(CTRL_CMD_DELFAMILY, family, NULL, 0);
|
|
return 0;
|
|
}
|
|
|
|
genl_unlock_all();
|
|
|
|
return -ENOENT;
|
|
}
|
|
EXPORT_SYMBOL(genl_unregister_family);
|
|
|
|
/**
|
|
* genlmsg_new_unicast - Allocate generic netlink message for unicast
|
|
* @payload: size of the message payload
|
|
* @info: information on destination
|
|
* @flags: the type of memory to allocate
|
|
*
|
|
* Allocates a new sk_buff large enough to cover the specified payload
|
|
* plus required Netlink headers. Will check receiving socket for
|
|
* memory mapped i/o capability and use it if enabled. Will fall back
|
|
* to non-mapped skb if message size exceeds the frame size of the ring.
|
|
*/
|
|
struct sk_buff *genlmsg_new_unicast(size_t payload, struct genl_info *info,
|
|
gfp_t flags)
|
|
{
|
|
size_t len = nlmsg_total_size(genlmsg_total_size(payload));
|
|
|
|
return netlink_alloc_skb(info->dst_sk, len, info->snd_portid, flags);
|
|
}
|
|
EXPORT_SYMBOL_GPL(genlmsg_new_unicast);
|
|
|
|
/**
|
|
* genlmsg_put - Add generic netlink header to netlink message
|
|
* @skb: socket buffer holding the message
|
|
* @portid: netlink portid the message is addressed to
|
|
* @seq: sequence number (usually the one of the sender)
|
|
* @family: generic netlink family
|
|
* @flags: netlink message flags
|
|
* @cmd: generic netlink command
|
|
*
|
|
* Returns pointer to user specific header
|
|
*/
|
|
void *genlmsg_put(struct sk_buff *skb, u32 portid, u32 seq,
|
|
struct genl_family *family, int flags, u8 cmd)
|
|
{
|
|
struct nlmsghdr *nlh;
|
|
struct genlmsghdr *hdr;
|
|
|
|
nlh = nlmsg_put(skb, portid, seq, family->id, GENL_HDRLEN +
|
|
family->hdrsize, flags);
|
|
if (nlh == NULL)
|
|
return NULL;
|
|
|
|
hdr = nlmsg_data(nlh);
|
|
hdr->cmd = cmd;
|
|
hdr->version = family->version;
|
|
hdr->reserved = 0;
|
|
|
|
return (char *) hdr + GENL_HDRLEN;
|
|
}
|
|
EXPORT_SYMBOL(genlmsg_put);
|
|
|
|
static int genl_lock_start(struct netlink_callback *cb)
|
|
{
|
|
/* our ops are always const - netlink API doesn't propagate that */
|
|
const struct genl_ops *ops = cb->data;
|
|
int rc = 0;
|
|
|
|
if (ops->start) {
|
|
genl_lock();
|
|
rc = ops->start(cb);
|
|
genl_unlock();
|
|
}
|
|
return rc;
|
|
}
|
|
|
|
static int genl_lock_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
|
|
{
|
|
/* our ops are always const - netlink API doesn't propagate that */
|
|
const struct genl_ops *ops = cb->data;
|
|
int rc;
|
|
|
|
genl_lock();
|
|
rc = ops->dumpit(skb, cb);
|
|
genl_unlock();
|
|
return rc;
|
|
}
|
|
|
|
static int genl_lock_done(struct netlink_callback *cb)
|
|
{
|
|
/* our ops are always const - netlink API doesn't propagate that */
|
|
const struct genl_ops *ops = cb->data;
|
|
int rc = 0;
|
|
|
|
if (ops->done) {
|
|
genl_lock();
|
|
rc = ops->done(cb);
|
|
genl_unlock();
|
|
}
|
|
return rc;
|
|
}
|
|
|
|
static int genl_family_rcv_msg(struct genl_family *family,
|
|
struct sk_buff *skb,
|
|
struct nlmsghdr *nlh)
|
|
{
|
|
const struct genl_ops *ops;
|
|
struct net *net = sock_net(skb->sk);
|
|
struct genl_info info;
|
|
struct genlmsghdr *hdr = nlmsg_data(nlh);
|
|
struct nlattr **attrbuf;
|
|
int hdrlen, err;
|
|
|
|
/* this family doesn't exist in this netns */
|
|
if (!family->netnsok && !net_eq(net, &init_net))
|
|
return -ENOENT;
|
|
|
|
hdrlen = GENL_HDRLEN + family->hdrsize;
|
|
if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen))
|
|
return -EINVAL;
|
|
|
|
ops = genl_get_cmd(hdr->cmd, family);
|
|
if (ops == NULL)
|
|
return -EOPNOTSUPP;
|
|
|
|
if ((ops->flags & GENL_ADMIN_PERM) &&
|
|
!netlink_capable(skb, CAP_NET_ADMIN))
|
|
return -EPERM;
|
|
|
|
if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
|
|
int rc;
|
|
|
|
if (ops->dumpit == NULL)
|
|
return -EOPNOTSUPP;
|
|
|
|
if (!family->parallel_ops) {
|
|
struct netlink_dump_control c = {
|
|
.module = family->module,
|
|
/* we have const, but the netlink API doesn't */
|
|
.data = (void *)ops,
|
|
.start = genl_lock_start,
|
|
.dump = genl_lock_dumpit,
|
|
.done = genl_lock_done,
|
|
};
|
|
|
|
genl_unlock();
|
|
rc = __netlink_dump_start(net->genl_sock, skb, nlh, &c);
|
|
genl_lock();
|
|
|
|
} else {
|
|
struct netlink_dump_control c = {
|
|
.module = family->module,
|
|
.start = ops->start,
|
|
.dump = ops->dumpit,
|
|
.done = ops->done,
|
|
};
|
|
|
|
rc = __netlink_dump_start(net->genl_sock, skb, nlh, &c);
|
|
}
|
|
|
|
return rc;
|
|
}
|
|
|
|
if (ops->doit == NULL)
|
|
return -EOPNOTSUPP;
|
|
|
|
if (family->maxattr && family->parallel_ops) {
|
|
attrbuf = kmalloc((family->maxattr+1) *
|
|
sizeof(struct nlattr *), GFP_KERNEL);
|
|
if (attrbuf == NULL)
|
|
return -ENOMEM;
|
|
} else
|
|
attrbuf = family->attrbuf;
|
|
|
|
if (attrbuf) {
|
|
err = nlmsg_parse(nlh, hdrlen, attrbuf, family->maxattr,
|
|
ops->policy);
|
|
if (err < 0)
|
|
goto out;
|
|
}
|
|
|
|
info.snd_seq = nlh->nlmsg_seq;
|
|
info.snd_portid = NETLINK_CB(skb).portid;
|
|
info.nlhdr = nlh;
|
|
info.genlhdr = nlmsg_data(nlh);
|
|
info.userhdr = nlmsg_data(nlh) + GENL_HDRLEN;
|
|
info.attrs = attrbuf;
|
|
info.dst_sk = skb->sk;
|
|
genl_info_net_set(&info, net);
|
|
memset(&info.user_ptr, 0, sizeof(info.user_ptr));
|
|
|
|
if (family->pre_doit) {
|
|
err = family->pre_doit(ops, skb, &info);
|
|
if (err)
|
|
goto out;
|
|
}
|
|
|
|
err = ops->doit(skb, &info);
|
|
|
|
if (family->post_doit)
|
|
family->post_doit(ops, skb, &info);
|
|
|
|
out:
|
|
if (family->parallel_ops)
|
|
kfree(attrbuf);
|
|
|
|
return err;
|
|
}
|
|
|
|
static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
|
|
{
|
|
struct genl_family *family;
|
|
int err;
|
|
|
|
family = genl_family_find_byid(nlh->nlmsg_type);
|
|
if (family == NULL)
|
|
return -ENOENT;
|
|
|
|
if (!family->parallel_ops)
|
|
genl_lock();
|
|
|
|
err = genl_family_rcv_msg(family, skb, nlh);
|
|
|
|
if (!family->parallel_ops)
|
|
genl_unlock();
|
|
|
|
return err;
|
|
}
|
|
|
|
static void genl_rcv(struct sk_buff *skb)
|
|
{
|
|
down_read(&cb_lock);
|
|
netlink_rcv_skb(skb, &genl_rcv_msg);
|
|
up_read(&cb_lock);
|
|
}
|
|
|
|
/**************************************************************************
|
|
* Controller
|
|
**************************************************************************/
|
|
|
|
static struct genl_family genl_ctrl = {
|
|
.id = GENL_ID_CTRL,
|
|
.name = "nlctrl",
|
|
.version = 0x2,
|
|
.maxattr = CTRL_ATTR_MAX,
|
|
.netnsok = true,
|
|
};
|
|
|
|
static int ctrl_fill_info(struct genl_family *family, u32 portid, u32 seq,
|
|
u32 flags, struct sk_buff *skb, u8 cmd)
|
|
{
|
|
void *hdr;
|
|
|
|
hdr = genlmsg_put(skb, portid, seq, &genl_ctrl, flags, cmd);
|
|
if (hdr == NULL)
|
|
return -1;
|
|
|
|
if (nla_put_string(skb, CTRL_ATTR_FAMILY_NAME, family->name) ||
|
|
nla_put_u16(skb, CTRL_ATTR_FAMILY_ID, family->id) ||
|
|
nla_put_u32(skb, CTRL_ATTR_VERSION, family->version) ||
|
|
nla_put_u32(skb, CTRL_ATTR_HDRSIZE, family->hdrsize) ||
|
|
nla_put_u32(skb, CTRL_ATTR_MAXATTR, family->maxattr))
|
|
goto nla_put_failure;
|
|
|
|
if (family->n_ops) {
|
|
struct nlattr *nla_ops;
|
|
int i;
|
|
|
|
nla_ops = nla_nest_start(skb, CTRL_ATTR_OPS);
|
|
if (nla_ops == NULL)
|
|
goto nla_put_failure;
|
|
|
|
for (i = 0; i < family->n_ops; i++) {
|
|
struct nlattr *nest;
|
|
const struct genl_ops *ops = &family->ops[i];
|
|
u32 op_flags = ops->flags;
|
|
|
|
if (ops->dumpit)
|
|
op_flags |= GENL_CMD_CAP_DUMP;
|
|
if (ops->doit)
|
|
op_flags |= GENL_CMD_CAP_DO;
|
|
if (ops->policy)
|
|
op_flags |= GENL_CMD_CAP_HASPOL;
|
|
|
|
nest = nla_nest_start(skb, i + 1);
|
|
if (nest == NULL)
|
|
goto nla_put_failure;
|
|
|
|
if (nla_put_u32(skb, CTRL_ATTR_OP_ID, ops->cmd) ||
|
|
nla_put_u32(skb, CTRL_ATTR_OP_FLAGS, op_flags))
|
|
goto nla_put_failure;
|
|
|
|
nla_nest_end(skb, nest);
|
|
}
|
|
|
|
nla_nest_end(skb, nla_ops);
|
|
}
|
|
|
|
if (family->n_mcgrps) {
|
|
struct nlattr *nla_grps;
|
|
int i;
|
|
|
|
nla_grps = nla_nest_start(skb, CTRL_ATTR_MCAST_GROUPS);
|
|
if (nla_grps == NULL)
|
|
goto nla_put_failure;
|
|
|
|
for (i = 0; i < family->n_mcgrps; i++) {
|
|
struct nlattr *nest;
|
|
const struct genl_multicast_group *grp;
|
|
|
|
grp = &family->mcgrps[i];
|
|
|
|
nest = nla_nest_start(skb, i + 1);
|
|
if (nest == NULL)
|
|
goto nla_put_failure;
|
|
|
|
if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID,
|
|
family->mcgrp_offset + i) ||
|
|
nla_put_string(skb, CTRL_ATTR_MCAST_GRP_NAME,
|
|
grp->name))
|
|
goto nla_put_failure;
|
|
|
|
nla_nest_end(skb, nest);
|
|
}
|
|
nla_nest_end(skb, nla_grps);
|
|
}
|
|
|
|
genlmsg_end(skb, hdr);
|
|
return 0;
|
|
|
|
nla_put_failure:
|
|
genlmsg_cancel(skb, hdr);
|
|
return -EMSGSIZE;
|
|
}
|
|
|
|
static int ctrl_fill_mcgrp_info(struct genl_family *family,
|
|
const struct genl_multicast_group *grp,
|
|
int grp_id, u32 portid, u32 seq, u32 flags,
|
|
struct sk_buff *skb, u8 cmd)
|
|
{
|
|
void *hdr;
|
|
struct nlattr *nla_grps;
|
|
struct nlattr *nest;
|
|
|
|
hdr = genlmsg_put(skb, portid, seq, &genl_ctrl, flags, cmd);
|
|
if (hdr == NULL)
|
|
return -1;
|
|
|
|
if (nla_put_string(skb, CTRL_ATTR_FAMILY_NAME, family->name) ||
|
|
nla_put_u16(skb, CTRL_ATTR_FAMILY_ID, family->id))
|
|
goto nla_put_failure;
|
|
|
|
nla_grps = nla_nest_start(skb, CTRL_ATTR_MCAST_GROUPS);
|
|
if (nla_grps == NULL)
|
|
goto nla_put_failure;
|
|
|
|
nest = nla_nest_start(skb, 1);
|
|
if (nest == NULL)
|
|
goto nla_put_failure;
|
|
|
|
if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID, grp_id) ||
|
|
nla_put_string(skb, CTRL_ATTR_MCAST_GRP_NAME,
|
|
grp->name))
|
|
goto nla_put_failure;
|
|
|
|
nla_nest_end(skb, nest);
|
|
nla_nest_end(skb, nla_grps);
|
|
|
|
genlmsg_end(skb, hdr);
|
|
return 0;
|
|
|
|
nla_put_failure:
|
|
genlmsg_cancel(skb, hdr);
|
|
return -EMSGSIZE;
|
|
}
|
|
|
|
static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
|
|
{
|
|
|
|
int i, n = 0;
|
|
struct genl_family *rt;
|
|
struct net *net = sock_net(skb->sk);
|
|
int chains_to_skip = cb->args[0];
|
|
int fams_to_skip = cb->args[1];
|
|
|
|
for (i = chains_to_skip; i < GENL_FAM_TAB_SIZE; i++) {
|
|
n = 0;
|
|
list_for_each_entry(rt, genl_family_chain(i), family_list) {
|
|
if (!rt->netnsok && !net_eq(net, &init_net))
|
|
continue;
|
|
if (++n < fams_to_skip)
|
|
continue;
|
|
if (ctrl_fill_info(rt, NETLINK_CB(cb->skb).portid,
|
|
cb->nlh->nlmsg_seq, NLM_F_MULTI,
|
|
skb, CTRL_CMD_NEWFAMILY) < 0)
|
|
goto errout;
|
|
}
|
|
|
|
fams_to_skip = 0;
|
|
}
|
|
|
|
errout:
|
|
cb->args[0] = i;
|
|
cb->args[1] = n;
|
|
|
|
return skb->len;
|
|
}
|
|
|
|
static struct sk_buff *ctrl_build_family_msg(struct genl_family *family,
|
|
u32 portid, int seq, u8 cmd)
|
|
{
|
|
struct sk_buff *skb;
|
|
int err;
|
|
|
|
skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
|
|
if (skb == NULL)
|
|
return ERR_PTR(-ENOBUFS);
|
|
|
|
err = ctrl_fill_info(family, portid, seq, 0, skb, cmd);
|
|
if (err < 0) {
|
|
nlmsg_free(skb);
|
|
return ERR_PTR(err);
|
|
}
|
|
|
|
return skb;
|
|
}
|
|
|
|
static struct sk_buff *
|
|
ctrl_build_mcgrp_msg(struct genl_family *family,
|
|
const struct genl_multicast_group *grp,
|
|
int grp_id, u32 portid, int seq, u8 cmd)
|
|
{
|
|
struct sk_buff *skb;
|
|
int err;
|
|
|
|
skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
|
|
if (skb == NULL)
|
|
return ERR_PTR(-ENOBUFS);
|
|
|
|
err = ctrl_fill_mcgrp_info(family, grp, grp_id, portid,
|
|
seq, 0, skb, cmd);
|
|
if (err < 0) {
|
|
nlmsg_free(skb);
|
|
return ERR_PTR(err);
|
|
}
|
|
|
|
return skb;
|
|
}
|
|
|
|
static const struct nla_policy ctrl_policy[CTRL_ATTR_MAX+1] = {
|
|
[CTRL_ATTR_FAMILY_ID] = { .type = NLA_U16 },
|
|
[CTRL_ATTR_FAMILY_NAME] = { .type = NLA_NUL_STRING,
|
|
.len = GENL_NAMSIZ - 1 },
|
|
};
|
|
|
|
static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
|
|
{
|
|
struct sk_buff *msg;
|
|
struct genl_family *res = NULL;
|
|
int err = -EINVAL;
|
|
|
|
if (info->attrs[CTRL_ATTR_FAMILY_ID]) {
|
|
u16 id = nla_get_u16(info->attrs[CTRL_ATTR_FAMILY_ID]);
|
|
res = genl_family_find_byid(id);
|
|
err = -ENOENT;
|
|
}
|
|
|
|
if (info->attrs[CTRL_ATTR_FAMILY_NAME]) {
|
|
char *name;
|
|
|
|
name = nla_data(info->attrs[CTRL_ATTR_FAMILY_NAME]);
|
|
res = genl_family_find_byname(name);
|
|
#ifdef CONFIG_MODULES
|
|
if (res == NULL) {
|
|
genl_unlock();
|
|
up_read(&cb_lock);
|
|
request_module("net-pf-%d-proto-%d-family-%s",
|
|
PF_NETLINK, NETLINK_GENERIC, name);
|
|
down_read(&cb_lock);
|
|
genl_lock();
|
|
res = genl_family_find_byname(name);
|
|
}
|
|
#endif
|
|
err = -ENOENT;
|
|
}
|
|
|
|
if (res == NULL)
|
|
return err;
|
|
|
|
if (!res->netnsok && !net_eq(genl_info_net(info), &init_net)) {
|
|
/* family doesn't exist here */
|
|
return -ENOENT;
|
|
}
|
|
|
|
msg = ctrl_build_family_msg(res, info->snd_portid, info->snd_seq,
|
|
CTRL_CMD_NEWFAMILY);
|
|
if (IS_ERR(msg))
|
|
return PTR_ERR(msg);
|
|
|
|
return genlmsg_reply(msg, info);
|
|
}
|
|
|
|
static int genl_ctrl_event(int event, struct genl_family *family,
|
|
const struct genl_multicast_group *grp,
|
|
int grp_id)
|
|
{
|
|
struct sk_buff *msg;
|
|
|
|
/* genl is still initialising */
|
|
if (!init_net.genl_sock)
|
|
return 0;
|
|
|
|
switch (event) {
|
|
case CTRL_CMD_NEWFAMILY:
|
|
case CTRL_CMD_DELFAMILY:
|
|
WARN_ON(grp);
|
|
msg = ctrl_build_family_msg(family, 0, 0, event);
|
|
break;
|
|
case CTRL_CMD_NEWMCAST_GRP:
|
|
case CTRL_CMD_DELMCAST_GRP:
|
|
BUG_ON(!grp);
|
|
msg = ctrl_build_mcgrp_msg(family, grp, grp_id, 0, 0, event);
|
|
break;
|
|
default:
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (IS_ERR(msg))
|
|
return PTR_ERR(msg);
|
|
|
|
if (!family->netnsok) {
|
|
genlmsg_multicast_netns(&genl_ctrl, &init_net, msg, 0,
|
|
0, GFP_KERNEL);
|
|
} else {
|
|
rcu_read_lock();
|
|
genlmsg_multicast_allns(&genl_ctrl, msg, 0,
|
|
0, GFP_ATOMIC);
|
|
rcu_read_unlock();
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static struct genl_ops genl_ctrl_ops[] = {
|
|
{
|
|
.cmd = CTRL_CMD_GETFAMILY,
|
|
.doit = ctrl_getfamily,
|
|
.dumpit = ctrl_dumpfamily,
|
|
.policy = ctrl_policy,
|
|
},
|
|
};
|
|
|
|
static struct genl_multicast_group genl_ctrl_groups[] = {
|
|
{ .name = "notify", },
|
|
};
|
|
|
|
static int genl_bind(struct net *net, int group)
|
|
{
|
|
int i, err = 0;
|
|
|
|
down_read(&cb_lock);
|
|
for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
|
|
struct genl_family *f;
|
|
|
|
list_for_each_entry(f, genl_family_chain(i), family_list) {
|
|
if (group >= f->mcgrp_offset &&
|
|
group < f->mcgrp_offset + f->n_mcgrps) {
|
|
int fam_grp = group - f->mcgrp_offset;
|
|
|
|
if (!f->netnsok && net != &init_net)
|
|
err = -ENOENT;
|
|
else if (f->mcast_bind)
|
|
err = f->mcast_bind(net, fam_grp);
|
|
else
|
|
err = 0;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
up_read(&cb_lock);
|
|
|
|
return err;
|
|
}
|
|
|
|
static void genl_unbind(struct net *net, int group)
|
|
{
|
|
int i;
|
|
|
|
down_read(&cb_lock);
|
|
for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
|
|
struct genl_family *f;
|
|
|
|
list_for_each_entry(f, genl_family_chain(i), family_list) {
|
|
if (group >= f->mcgrp_offset &&
|
|
group < f->mcgrp_offset + f->n_mcgrps) {
|
|
int fam_grp = group - f->mcgrp_offset;
|
|
|
|
if (f->mcast_unbind)
|
|
f->mcast_unbind(net, fam_grp);
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
up_read(&cb_lock);
|
|
}
|
|
|
|
static int __net_init genl_pernet_init(struct net *net)
|
|
{
|
|
struct netlink_kernel_cfg cfg = {
|
|
.input = genl_rcv,
|
|
.flags = NL_CFG_F_NONROOT_RECV,
|
|
.bind = genl_bind,
|
|
.unbind = genl_unbind,
|
|
};
|
|
|
|
/* we'll bump the group number right afterwards */
|
|
net->genl_sock = netlink_kernel_create(net, NETLINK_GENERIC, &cfg);
|
|
|
|
if (!net->genl_sock && net_eq(net, &init_net))
|
|
panic("GENL: Cannot initialize generic netlink\n");
|
|
|
|
if (!net->genl_sock)
|
|
return -ENOMEM;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void __net_exit genl_pernet_exit(struct net *net)
|
|
{
|
|
netlink_kernel_release(net->genl_sock);
|
|
net->genl_sock = NULL;
|
|
}
|
|
|
|
static struct pernet_operations genl_pernet_ops = {
|
|
.init = genl_pernet_init,
|
|
.exit = genl_pernet_exit,
|
|
};
|
|
|
|
static int __init genl_init(void)
|
|
{
|
|
int i, err;
|
|
|
|
for (i = 0; i < GENL_FAM_TAB_SIZE; i++)
|
|
INIT_LIST_HEAD(&family_ht[i]);
|
|
|
|
err = genl_register_family_with_ops_groups(&genl_ctrl, genl_ctrl_ops,
|
|
genl_ctrl_groups);
|
|
if (err < 0)
|
|
goto problem;
|
|
|
|
err = register_pernet_subsys(&genl_pernet_ops);
|
|
if (err)
|
|
goto problem;
|
|
|
|
return 0;
|
|
|
|
problem:
|
|
panic("GENL: Cannot register controller: %d\n", err);
|
|
}
|
|
|
|
subsys_initcall(genl_init);
|
|
|
|
static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
|
|
gfp_t flags)
|
|
{
|
|
struct sk_buff *tmp;
|
|
struct net *net, *prev = NULL;
|
|
bool delivered = false;
|
|
int err;
|
|
|
|
for_each_net_rcu(net) {
|
|
if (prev) {
|
|
tmp = skb_clone(skb, flags);
|
|
if (!tmp) {
|
|
err = -ENOMEM;
|
|
goto error;
|
|
}
|
|
err = nlmsg_multicast(prev->genl_sock, tmp,
|
|
portid, group, flags);
|
|
if (!err)
|
|
delivered = true;
|
|
else if (err != -ESRCH)
|
|
goto error;
|
|
}
|
|
|
|
prev = net;
|
|
}
|
|
|
|
err = nlmsg_multicast(prev->genl_sock, skb, portid, group, flags);
|
|
if (!err)
|
|
delivered = true;
|
|
else if (err != -ESRCH)
|
|
return err;
|
|
return delivered ? 0 : -ESRCH;
|
|
error:
|
|
kfree_skb(skb);
|
|
return err;
|
|
}
|
|
|
|
int genlmsg_multicast_allns(struct genl_family *family, struct sk_buff *skb,
|
|
u32 portid, unsigned int group, gfp_t flags)
|
|
{
|
|
if (WARN_ON_ONCE(group >= family->n_mcgrps))
|
|
return -EINVAL;
|
|
group = family->mcgrp_offset + group;
|
|
return genlmsg_mcast(skb, portid, group, flags);
|
|
}
|
|
EXPORT_SYMBOL(genlmsg_multicast_allns);
|
|
|
|
void genl_notify(struct genl_family *family, struct sk_buff *skb,
|
|
struct genl_info *info, u32 group, gfp_t flags)
|
|
{
|
|
struct net *net = genl_info_net(info);
|
|
struct sock *sk = net->genl_sock;
|
|
int report = 0;
|
|
|
|
if (info->nlhdr)
|
|
report = nlmsg_report(info->nlhdr);
|
|
|
|
if (WARN_ON_ONCE(group >= family->n_mcgrps))
|
|
return;
|
|
group = family->mcgrp_offset + group;
|
|
nlmsg_notify(sk, skb, info->snd_portid, group, report, flags);
|
|
}
|
|
EXPORT_SYMBOL(genl_notify);
|