[net-next v4 0/8] seg6: add support for SRv6 End.DT4/DT6 behavior

2020-12-02 Thread Andrea Mayer
d.DT6 (VRF mode) behaviors, is provided in a different patchset that will follow shortly. I would like to thank David Ahern for his support during the development of this patchset. Comments, suggestions and improvements are very welcome! Thanks, Andrea Mayer v4 seg6: add support for the SRv6 End.DT

[net-next v4 6/8] seg6: add VRF support for SRv6 End.DT6 behavior

2020-12-02 Thread Andrea Mayer
that the instances of SRv6 End.DT6 legacy and End.DT6 VRF mode can coexist in the same system/configuration without problems. [1] https://tools.ietf.org/html/draft-ietf-spring-srv6-network-programming Signed-off-by: Andrea Mayer --- net/ipv6/seg6_local.c | 76 +++ 1 file

[PATCH v2 5/7] Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind()

2020-12-02 Thread Andrea Parri (Microsoft)
ree can be avoided by noticing that this load/check is redundant if device_obj is non-NULL: primary_channel must be NULL if device_obj is non-NULL, cf. vmbus_add_channel_work(). Fixes: 54a66265d6754b ("Drivers: hv: vmbus: Fix rescind handling") Reported-by: Juan Vazquez Signed-off-by:

[PATCH v2 6/7] Drivers: hv: vmbus: Resolve race condition in vmbus_onoffer_rescind()

2020-12-02 Thread Andrea Parri (Microsoft)
to an use-after-free. Add a new flag to the channel structure to make sure that only one instance of vmbus_onoffer_rescind() can get the reference to the channel object. Reported-by: Juan Vazquez Signed-off-by: Andrea Parri (Microsoft) --- drivers/hv/channel_mgmt.c | 12 include

[PATCH v2 3/7] Drivers: hv: vmbus: Avoid double fetch of payload_size in vmbus_on_msg_dpc()

2020-12-02 Thread Andrea Parri (Microsoft)
vmbus_on_msg_dpc() double fetches from payload_size. The double fetch can lead to a buffer overflow when (mem)copying the hv_message object. Avoid the double fetch by saving the value of payload_size into a local variable. Reported-by: Juan Vazquez Signed-off-by: Andrea Parri (Microsoft

[PATCH v2 4/7] Drivers: hv: vmbus: Copy the hv_message object in vmbus_on_msg_dpc()

2020-12-02 Thread Andrea Parri (Microsoft)
The hv_message object is in memory shared with the host. To prevent an erroneous or a malicious host from 'corrupting' such object, copy the object into private memory. Suggested-by: Juan Vazquez Signed-off-by: Andrea Parri (Microsoft) --- drivers/hv/vmbus_drv.c | 26

[PATCH v2 7/7] Drivers: hv: vmbus: Do not allow overwriting vmbus_connection.channels[]

2020-12-02 Thread Andrea Parri (Microsoft)
not allow overwriting an entry vmbus_connection.channels[]. Reported-by: Juan Vazquez Signed-off-by: Andrea Parri (Microsoft) --- Changes since v1: - Don't corrupt oldchannel if offer->child_relid is invalid drivers/hv/channel_mgmt.c | 38 -- drivers

[PATCH v2 0/7] Drivers: hv: vmbus: More VMBus-hardening changes

2020-12-02 Thread Andrea Parri (Microsoft)
Hi all, This is v2 of [1], integrating feedback from Juan and Wei and adding patch 4/7 (after Juan's suggestion). Changelogs are in the patches. Thanks, Andrea [1] https://lkml.kernel.org/r/20201118143649.108465-1-parri.and...@gmail.com Andrea Parri (Microsoft) (7): Drivers: hv: vmbus

[PATCH v2 1/7] Drivers: hv: vmbus: Initialize memory to be sent to the host

2020-12-02 Thread Andrea Parri (Microsoft)
, potentially leaking guest data. Zero initialize such fields to avoid leaking sensitive information to the host. Reported-by: Juan Vazquez Signed-off-by: Andrea Parri (Microsoft) --- drivers/hv/channel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hv/channel.c b

[PATCH v2 2/7] Drivers: hv: vmbus: Avoid double fetch of msgtype in vmbus_on_msg_dpc()

2020-12-02 Thread Andrea Parri (Microsoft)
ing the value of msgtype into a local variable. Reported-by: Juan Vazquez Signed-off-by: Andrea Parri (Microsoft) --- drivers/hv/vmbus_drv.c | 18 +- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c index 0a2711aa63

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-12-01 Thread Andrea Arcangeli
Hello Mike, On Sun, Nov 29, 2020 at 02:32:57PM +0200, Mike Rapoport wrote: > Hello Andrea, > > On Thu, Nov 26, 2020 at 07:46:05PM +0200, Mike Rapoport wrote: > > On Thu, Nov 26, 2020 at 11:05:14AM +0100, David Hildenbrand wrote: > > > > Let's try to me

Re: [PATCH v2] mm: Don't fault around userfaultfd-registered regions on reads

2020-12-01 Thread Andrea Arcangeli
> > > page can be writable within the small window). That's severe data loss. > > > > This still doesn't make sense. If the page is Uptodate in the page > > cache, then userspace gets to access it. If you don't want the page to > > be accessible, ClearP

Re: [PATCH] mm: Don't fault around userfaultfd-registered regions on reads

2020-12-01 Thread Andrea Arcangeli
it just needs to "eventually" stop the shmem_fault activity, it doesn't need to catch those faults already in flight, so it cannot relied upon as the form of serialization to zap the pageteables while truncating the page. > But Andrea in next mail goes on to see other issues with UFF

Re: [PATCH] mm: Don't fault around userfaultfd-registered regions on reads

2020-12-01 Thread Andrea Arcangeli
and whatever solution that works to retain the _PAGE_UFFD_WP information during shmem swapping should also solve the above without extra changes to filemap_map_pages and the fault around logic if the uffd is armed. What I'm really saying is that there's no point to apply this patch, until we see the full patchset of shmem uffd-wp and then it's possible to evaluate if there are no other losses for the _PAGE_UFFD_WP bit. Anon memory is completely different, it's impossible to lose _PAGE_UFFD_WP there, since the swap entry format contains it, for shmem the pte is zero instead during swap. Thanks! Andrea

Re: [PATCH] Drivers: hv: vmbus: Introduce the CHANNELMSG_MODIFYCHANNEL_RESPONSE message type

2020-11-30 Thread Andrea Parri
On Sun, Nov 29, 2020 at 06:29:55PM +, Michael Kelley wrote: > From: Andrea Parri (Microsoft) Sent: Thursday, > November 26, 2020 11:12 AM > > > > Quoting from commit 7527810573436f ("Drivers: hv: vmbus: Introduce > > the CHANNELMSG_MODIFYCHANNEL message type&quo

[PATCH] ring-buffer: set the right timestamp in the slow path of __rb_reserve_next()

2020-11-28 Thread Andrea Righi
the event that we are currently processing is not the last event in the buffer. Link: https://lwn.net/Articles/831207 Fixes: a389d86f7fd0 ("ring-buffer: Have nested events still record running time stamp") Signed-off-by: Andrea Righi --- kernel/trace/ring_buffer.c | 6 +++--- 1 file

Re: [PATCH] mm: Don't fault around userfaultfd-registered regions on reads

2020-11-27 Thread Andrea Arcangeli
faulting ptes of a shmem page that is about to be truncated (whose original ptes had _PAGE_RW unset and _PAGE_UFFD_WP set) there would be no problem with the uffd interaction. So a proper shmem_map_pages could co-exist with uffd, the userfaultfd_armed check would be only an optimization but it wouldn't

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-26 Thread Andrea Arcangeli
alk to the memblock.reserve and that requires adding even more memblock_reserve to e820__memblock_setup for type 20, we can add a walk for the memblock.memory holes and then we can remove the memblock_reserve for E820_TYPE_SOFT_RESERVED too. Thanks, Andrea

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-26 Thread Andrea Arcangeli
st of direct compaction which is only worth paying for, for MADV_HUGEPAGE ranges doing long-lived allocations (we know by now that defrag=always was a suboptimal default). https://www.kernel.org/pub/linux/kernel/people/andrea/ebpf/thp-comm.bp https://www.kernel.org/pub/linux/kernel/people/an

[PATCH] Drivers: hv: vmbus: Introduce the CHANNELMSG_MODIFYCHANNEL_RESPONSE message type

2020-11-26 Thread Andrea Parri (Microsoft)
a CHANNELMSG_MODIFYCHANNEL message associated to that CPU." Introduce the CHANNELMSG_MODIFYCHANNEL_RESPONSE(24) message type, which embodies the type of the CHANNELMSG_MODIFYCHANNEL ACK. Signed-off-by: Andrea Parri (Microsoft) --- drivers/hv/channel.c | 108 +

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-26 Thread Andrea Arcangeli
rve overlaps fully, it makes perfect sense and it has to stay for it. I was really only thinking at the usage like above of memblock_reserve that looks like it should be turned into a noop and deleted. Thanks, Andrea

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-26 Thread Andrea Arcangeli
On Thu, Nov 26, 2020 at 11:05:14AM +0100, David Hildenbrand wrote: > I agree that this is sub-optimal, as such pages are impossible to detect > (PageReserved is just not clear as discussed with Andrea). The basic > question is how we want to proceed: > > a) Make sure any online

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-25 Thread Andrea Arcangeli
On Wed, Nov 25, 2020 at 12:34:41AM -0500, Andrea Arcangeli wrote: > pfnphysaddr page->flags > 500224 0x7a20 0x1fff1000 reserved True > 500225 0x7a201000 0x1fff1000 reserved True > *snip* > 500245 0x7a215000 0x1fff1000 reserved True &

Re: [net-next v3 0/8] seg6: add support for SRv6 End.DT4/DT6 behavior

2020-11-25 Thread Andrea Mayer
e2 patch in two separate patchsets. Thank you all, Andrea

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-25 Thread Andrea Arcangeli
start doing pfn_valid(addr>>PAGE_SHIFT) if PageReserved(pfn_to_page(addr>>PAGE_SHIFT)) instead. At best memory.reserved should be calculated automatically by the page_alloc.c based on the zone_start_pfn/zone_end_pfn and not passed by the e820 caller, instead of adding the memory_reserve call for type 20 we should delete the memory_reserve function. Thanks, Andrea

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-25 Thread Andrea Arcangeli
On Wed, Nov 25, 2020 at 08:27:21PM +0100, David Hildenbrand wrote: > On 25.11.20 19:28, Andrea Arcangeli wrote: > > On Wed, Nov 25, 2020 at 07:45:30AM +0100, David Hildenbrand wrote: > >> Before that change, the memmap of memory holes were only zeroed > >> out. So t

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-25 Thread Andrea Arcangeli
[zone_start_pfn, zone_end_pfn] with > memblock.memory and for x86 reserved ranges are not in memblock.memory, > so the memmap for them remains semi-initialized. That would matches the symptoms. I'll test it as first thing after confirming older kernels had the right zoneid/nid on the reserved pages. Thanks, Andrea

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-25 Thread Andrea Arcangeli
over two different zones. Thanks, Andrea

Re: [net-next v3 5/8] seg6: add support for the SRv6 End.DT4 behavior

2020-11-25 Thread Andrea Mayer
Hi Jakub, thanks for your review. On Tue, 24 Nov 2020 15:40:17 -0800 Jakub Kicinski wrote: > On Mon, 23 Nov 2020 19:28:53 +0100 Andrea Mayer wrote: > > +static int cmp_nla_vrftable(struct seg6_local_lwt *a, struct > > seg6_local_lwt *b) > > +{ > > + stru

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-25 Thread Andrea Arcangeli
On Wed, Nov 25, 2020 at 12:41:55PM +0100, David Hildenbrand wrote: > On 25.11.20 12:04, David Hildenbrand wrote: > > On 25.11.20 11:39, Mel Gorman wrote: > >> On Wed, Nov 25, 2020 at 07:45:30AM +0100, David Hildenbrand wrote: > Something must have changed more recently than v5.1 that caused

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-25 Thread Andrea Arcangeli
worry about it since nobody can possibly get a wrong value out of the page struct because there's no page struct in the case. Last but not the least, RAM pages can be marked reserved and assigned to hardware and so it'd be really messy if real reserved RAM pages given to hw, behaved different than non-RAM that accidentally got a struct page because of section alignment issues. Thanks, Andrea

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-25 Thread Andrea Arcangeli
On Wed, Nov 25, 2020 at 10:30:53AM +, Mel Gorman wrote: > On Tue, Nov 24, 2020 at 03:56:22PM -0500, Andrea Arcangeli wrote: > > Hello, > > > > On Tue, Nov 24, 2020 at 01:32:05PM +, Mel Gorman wrote: > > > I would hope that is not the case because

Re: [PATCH] leds: trigger: fix potential deadlock with libata

2020-11-25 Thread Andrea Righi
On Wed, Nov 25, 2020 at 03:15:18PM +0100, Andrea Righi wrote: ... > > I'd hate to see this in stable 3 days after Linus merges it... > > > > Do these need _irqsave, too? > > > > drivers/leds/led-triggers.c: read_lock(>leddev_list_lock); > > dri

[PATCH v2] leds: trigger: fix potential deadlock with libata

2020-11-25 Thread Andrea Righi
lar usages. Link: https://lore.kernel.org/lkml/20201101092614.GB3989@xps-13-7390/ Fixes: eb25cb9956cc ("leds: convert IDE trigger to common disk trigger") Signed-off-by: Andrea Righi --- drivers/leds/led-triggers.c | 10 ++ 1 file changed, 6 insertions(+), 4 deletions(-) Cha

Re: [PATCH] leds: trigger: fix potential deadlock with libata

2020-11-25 Thread Andrea Righi
- - > > led_trigger_event(): > >read_lock(>leddev_list_lock); > > > > ata_hsm_qc_complete(): > > spin_lock_irqsave(>lock)

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-24 Thread Andrea Arcangeli
Hello, On Mon, Nov 23, 2020 at 02:01:16PM +0100, Vlastimil Babka wrote: > On 11/21/20 8:45 PM, Andrea Arcangeli wrote: > > A corollary issue was fixed in > > 39639000-39814fff : Unknown E820 type > > > > pfn 0x7a200 -> 0x7a20 min_pfn hit non-RAM: > >

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-24 Thread Andrea Arcangeli
71e88723b3074251189004ceae39dcd1689d Mon Sep 17 00:00:00 2001 From: Andrea Arcangeli Date: Sat, 21 Nov 2020 12:55:58 -0500 Subject: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages A corollary issue was fixed in e577c8b64d58fe307ea4d5149d

Re: [PATCH 4/6] Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind()

2020-11-24 Thread Andrea Parri
On Tue, Nov 24, 2020 at 04:26:33PM +, Wei Liu wrote: > On Wed, Nov 18, 2020 at 03:36:47PM +0100, Andrea Parri (Microsoft) wrote: > > When channel->device_obj is non-NULL, vmbus_onoffer_rescind() could > > invoke put_device(), that will eventually release the device and fr

[net-next v3 8/8] selftests: add selftest for the SRv6 End.DT6 (VRF) behavior

2020-11-23 Thread Andrea Mayer
this selftest is designed for evaluating the new SRv6 End.DT6 (VRF) behavior used, in this example, for implementing IPv6 L3 VPN use cases. Signed-off-by: Andrea Mayer Signed-off-by: Paolo Lungaroni --- .../selftests/net/srv6_end_dt6_l3vpn_test.sh | 502 ++ 1 file changed, 502

[net-next v3 3/8] seg6: add support for optional attributes in SRv6 behaviors

2020-11-23 Thread Andrea Mayer
. >From the userspace point of view, the support for optional attributes DO NOT require any changes to the userspace applications, i.e: iproute2 unless new attributes (required or optional) are needed. Signed-off-by: Andrea Mayer --- net/ipv6/seg6_local.c |

[net-next v3 2/8] seg6: improve management of behavior attributes

2020-11-23 Thread Andrea Mayer
the information needed to handle a given attribute are contained in only one place; 4) it facilitates the integration with new features introduced in further patches. Signed-off-by: Andrea Mayer --- net/ipv6/seg6_local.c | 80 +-- 1 file changed, 70

[net-next v3 6/8] seg6: add VRF support for SRv6 End.DT6 behavior

2020-11-23 Thread Andrea Mayer
that the instances of SRv6 End.DT6 legacy and End.DT6 VRF mode can coexist in the same system/configuration without problems. [1] https://tools.ietf.org/html/draft-ietf-spring-srv6-network-programming Signed-off-by: Andrea Mayer --- net/ipv6/seg6_local.c | 76 +++ 1 file

[net-next v3 1/8] vrf: add mac header for tunneled packets when sniffer is attached

2020-11-23 Thread Andrea Mayer
is not set. In this case, the mac address of the VRF is copied in both the destination and the source address of the ethernet header. The protocol type is set either to IPv4 or IPv6, depending on which L3 packet is received. Signed-off-by: Andrea Mayer Reviewed-by: David Ahern --- drivers/net

[net-next v3 0/8] seg6: add support for SRv6 End.DT4/DT6 behavior

2020-11-23 Thread Andrea Mayer
are very welcome! Thanks, Andrea Mayer v3 notes about the build bot: - apparently the ',' (comma) in the subject prefix confused the build bot. Removed the ',' in favor of ' ' (space). Thanks to David Ahern and Konstantin Ryabitsev for shedding light on this fact. Thanks also

[iproute2-next v1 1/1] seg6: add support for vrftable attribute in End.DT4/DT6 behaviors

2020-11-23 Thread Andrea Mayer
t;, "vrftable": 200, "dev": "eth0", "metric": 1024, "flags": [ ], "pref": "medium" } ] Signed-off-by: Paolo Lungaroni Signed-off-by: Andrea Mayer --- include/uapi/linux/seg6_local.h | 1 + ip/

[net-next v3 5/8] seg6: add support for the SRv6 End.DT4 behavior

2020-11-23 Thread Andrea Mayer
v6-network-programming [2] https://speakerdeck.com/line_developers/line-data-center-networking-with-srv6 Signed-off-by: Andrea Mayer --- include/uapi/linux/seg6_local.h | 1 + net/ipv6/seg6_local.c | 290 2 files changed, 291 insertions(+) diff --git

[net-next v3 4/8] seg6: add callbacks for customizing the creation/destruction of a behavior

2020-11-23 Thread Andrea Mayer
during its initialization phase and after all the attributes have been parsed successfully; - destroy_state(...): used for calling the custom destructor of the behavior before it is completely destroyed. Signed-off-by: Andrea Mayer --- net/ipv6/seg6_local.c | 49

[net-next v3 7/8] selftests: add selftest for the SRv6 End.DT4 behavior

2020-11-23 Thread Andrea Mayer
this selftest is designed for evaluating the new SRv6 End.DT4 behavior used, in this example, for implementing IPv4 L3 VPN use cases. Signed-off-by: Andrea Mayer Reviewed-by: David Ahern --- .../selftests/net/srv6_end_dt4_l3vpn_test.sh | 494 ++ 1 file changed, 494 insertions

Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-21 Thread Andrea Arcangeli
On Sat, Nov 21, 2020 at 02:45:06PM -0500, Andrea Arcangeli wrote: > + if (likely(!PageReserved(page))) NOTE: this line will have to become "likely(page && !PageReserved(page))" to handle the case of non contiguous zones, since pageblock_pfn

[PATCH 0/1] VM_BUG_ON_PAGE(!zone_spans_pfn) in set_pfnblock_flags_mask

2020-11-21 Thread Andrea Arcangeli
IFT; I didn't try to inject the bug to validate the fix and it'd be great if someone can try that to validate this or any other fix. Andrea Arcangeli (1): mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages mm/compaction.c | 5 - 1 file changed, 4 insertions(+), 1 deletion(-)

[PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock_skip on reserved pages

2020-11-21 Thread Andrea Arcangeli
xcept in the new fast_isolate_around() path). Fixes: 5a811889de10 ("mm, compaction: use free lists to quickly locate a migration target") Signed-off-by: Andrea Arcangeli --- mm/compaction.c | 5 - 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/mm/compaction.c b/mm/compa

Re: [PATCH 0/1] x86: restore the write back cache of reserved RAM in iounmap()

2020-11-19 Thread Andrea Arcangeli
I looked at the callee (iounmap). Thanks, Andrea

[PATCH 1/1] x86: restore the write back cache of reserved RAM in iounmap()

2020-11-19 Thread Andrea Arcangeli
er would need to still enforce they all have the same memtype, so it is more likely able to enforce that it doesn't do overlapping ioremaps at once than to be able to undo the changes to the direct mapping pagetables Fixes: f56d005d3034 ("x86: no CPA on iounmap") Signed-off-

[PATCH 0/1] x86: restore the write back cache of reserved RAM in iounmap()

2020-11-19 Thread Andrea Arcangeli
LICENSE("GPL"); == Andrea Arcangeli (1): x86: restore the write back cache of reserved RAM in iounmap() arch/x86/mm/ioremap.c | 8 +++- 1 file changed, 7 insertions(+), 1 deletion(-)

Re: [PATCH v2] Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer

2020-11-18 Thread Andrea Parri
On Mon, Nov 09, 2020 at 11:07:27AM +0100, Andrea Parri (Microsoft) wrote: > From: Andres Beltran > > Pointers to ring-buffer packets sent by Hyper-V are used within the > guest VM. Hyper-V can send packets with erroneous values or modify > packet fields after they are process

Re: [PATCH v4] hv_utils: Add validation for untrusted Hyper-V values

2020-11-18 Thread Andrea Parri
On Mon, Nov 09, 2020 at 11:07:04AM +0100, Andrea Parri (Microsoft) wrote: > From: Andres Beltran > > For additional robustness in the face of Hyper-V errors or malicious > behavior, validate all values that originate from packets that Hyper-V > has sent to the guest in the hos

[PATCH] hv_netvsc: Validate number of allocated sub-channels

2020-11-18 Thread Andrea Parri (Microsoft)
Lack of validation could lead to out-of-bound reads and information leaks (cf. usage of nvdev->chan_table[]). Check that the number of allocated sub-channels fits into the expected range. Suggested-by: Saruhan Karademir Signed-off-by: Andrea Parri (Microsoft) Cc: "David S. Miller&quo

[PATCH] scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback()

2020-11-18 Thread Andrea Parri (Microsoft)
Check that the packet is of the expected size at least, don't copy data past the packet. Reported-by: Saruhan Karademir Signed-off-by: Andrea Parri (Microsoft) Cc: "James E.J. Bottomley" Cc: "Martin K. Petersen" Cc: linux-s...@vger.kernel.org --- Based on hyperv-

[PATCH 5/6] Drivers: hv: vmbus: Resolve race condition in vmbus_onoffer_rescind()

2020-11-18 Thread Andrea Parri (Microsoft)
to an use-after-free. Add a new flag to the channel structure to make sure that only one instance of vmbus_onoffer_rescind() can get the reference to the channel object. Reported-by: Juan Vazquez Signed-off-by: Andrea Parri (Microsoft) --- drivers/hv/channel_mgmt.c | 12 include

[PATCH 3/6] Drivers: hv: vmbus: Avoid double fetch of payload_size in vmbus_on_msg_dpc()

2020-11-18 Thread Andrea Parri (Microsoft)
vmbus_on_msg_dpc() double fetches from payload_size. The double fetch can lead to a buffer overflow when (mem)copying the hv_message object. Avoid the double fetch by saving the value of payload_size into a local variable. Reported-by: Juan Vazquez Signed-off-by: Andrea Parri (Microsoft

[PATCH 6/6] Drivers: hv: vmbus: Do not allow overwriting vmbus_connection.channels[]

2020-11-18 Thread Andrea Parri (Microsoft)
not allow overwriting an entry vmbus_connection.channels[]. Reported-by: Juan Vazquez Signed-off-by: Andrea Parri (Microsoft) --- drivers/hv/channel_mgmt.c | 30 ++ drivers/hv/hyperv_vmbus.h | 2 +- 2 files changed, 19 insertions(+), 13 deletions(-) diff --git a/drivers/hv

[PATCH 1/6] Drivers: hv: vmbus: Initialize memory to be sent to the host

2020-11-18 Thread Andrea Parri (Microsoft)
, potentially leaking guest data. Zero initialize such fields to avoid leaking sensitive information to the host. Reported-by: Juan Vazquez Signed-off-by: Andrea Parri (Microsoft) --- drivers/hv/channel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hv/channel.c b

[PATCH 4/6] Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind()

2020-11-18 Thread Andrea Parri (Microsoft)
ree can be avoided by noticing that this load/check is redundant if device_obk is non-NULL: primary_channel must be NULL if device_obj is non-NULL, cf. vmbus_add_channel_work(). Reported-by: Juan Vazquez Signed-off-by: Andrea Parri (Microsoft) --- drivers/hv/channel_mgmt.c | 3 +-- 1 file changed

[PATCH 2/6] Drivers: hv: vmbus: Avoid double fetch of msgtype in vmbus_on_msg_dpc()

2020-11-18 Thread Andrea Parri (Microsoft)
ing the value of msgtype into a local variable. Reported-by: Juan Vazquez Signed-off-by: Andrea Parri (Microsoft) --- drivers/hv/vmbus_drv.c | 18 +- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c index 0a2711aa63

[PATCH 0/6] Drivers: hv: vmbus: More VMBus-hardening changes

2020-11-18 Thread Andrea Parri (Microsoft)
Hi all, This set is a continuation of the work for hardening the VMBus drivers against an erroneous or malicious host. This is based on hyperv-next. Thanks, Andrea Andrea Parri (Microsoft) (6): Drivers: hv: vmbus: Initialize memory to be sent to the host Drivers: hv: vmbus: Avoid double

Re: [net-next,v2,4/5] seg6: add support for the SRv6 End.DT4 behavior

2020-11-13 Thread Andrea Mayer
rate on tables (and so on the table ID) due to the spirit of the RFC. We have discussed in depth this design choice with David Ahern when implementing the DT4 patch and we are confident that operating with VRF strict mode is a sound approach also for DT6. Thanks Andrea,

Re: [net-next,v2,4/5] seg6: add support for the SRv6 End.DT4 behavior

2020-11-13 Thread Andrea Mayer
Hi Jakub, Please see my responses inline: On Fri, 13 Nov 2020 15:54:37 -0800 Jakub Kicinski wrote: > On Sat, 14 Nov 2020 00:00:24 +0100 Andrea Mayer wrote: > > On Fri, 13 Nov 2020 13:40:10 -0800 > > Jakub Kicinski wrote: > > > > I can tackle the v6 version but how d

Re: [net-next,v2,4/5] seg6: add support for the SRv6 End.DT4 behavior

2020-11-13 Thread Andrea Mayer
s the right call so I asked DaveM. > > DaveM raised a concern that unless we implement v6 now we can't be sure > the interface we create for v4 is going to fit there. > > So Andrea unless it's a major hurdle, could you take a stab at the v6 > version with VRFs as part of this seri

Re: [PATCH v9 2/3] scsi: storvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening

2020-11-13 Thread Andrea Parri
On Fri, Nov 13, 2020 at 06:54:24PM +, Wei Liu wrote: > On Fri, Nov 13, 2020 at 11:33:27AM +, Wei Liu wrote: > > On Mon, Nov 09, 2020 at 11:04:01AM +0100, Andrea Parri (Microsoft) wrote: > > > From: Andres Beltran > > > > > > Currently, pointers t

Re: [net-next,v2,4/5] seg6: add support for the SRv6 End.DT4 behavior

2020-11-12 Thread Andrea Mayer
Hi Jakub, many thanks for your review. Please see my responses inline: On Tue, 10 Nov 2020 15:12:55 -0800 Jakub Kicinski wrote: > On Sat, 7 Nov 2020 16:31:38 +0100 Andrea Mayer wrote: > > SRv6 End.DT4 is defined in the SRv6 Network Programming [1]. > > > > The

Re: [net-next,v2,3/5] seg6: add callbacks for customizing the creation/destruction of a behavior

2020-11-12 Thread Andrea Mayer
Hi Jakub, many thanks for your review. Please see my responses inline: On Tue, 10 Nov 2020 14:56:55 -0800 Jakub Kicinski wrote: > On Sat, 7 Nov 2020 16:31:37 +0100 Andrea Mayer wrote: > > We introduce two callbacks used for customizing the creation/destruction of > >

Re: [net-next,v2,2/5] seg6: improve management of behavior attributes

2020-11-12 Thread Andrea Mayer
Hi Jakub, many thanks for your review. Please see my responses inline: On Tue, 10 Nov 2020 14:50:21 -0800 Jakub Kicinski wrote: > On Sat, 7 Nov 2020 16:31:36 +0100 Andrea Mayer wrote: > > Depending on the attribute (i.e.: SEG6_LOCAL_SRH, SEG6_LOCAL_TABLE, etc), > > the p

Re: [net-next,v2,1/5] vrf: add mac header for tunneled packets when sniffer is attached

2020-11-12 Thread Andrea Mayer
Hi Jakub, On Tue, 10 Nov 2020 14:50:45 -0800 Jakub Kicinski wrote: > On Sat, 7 Nov 2020 16:31:35 +0100 Andrea Mayer wrote: > > Before this patch, a sniffer attached to a VRF used as the receiving > > interface of L3 tunneled packets detects them as malformed packets and > &g

Re: [PATCH] Drivers: hv: vmbus: Allow cleanup of VMBUS_CONNECT_CPU if disconnected

2020-11-10 Thread Andrea Parri
everything down while preserving the initial behavior of preventing > CPU offlining on the VMBUS_CONNECT_CPU while the VM is running. > > Fixes: 8a857c55420f29 ("Drivers: hv: vmbus: Always handle the VMBus messages > on CPU0") > Signed-off-by: Chris Co > Cc: sta...@vger.kernel.org Revie

[PATCH v2] Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer

2020-11-09 Thread Andrea Parri (Microsoft)
validating its length and offset fields in hv_pkt_iter_first(). In this way, the packet can no longer be modified by the host. Signed-off-by: Andres Beltran Co-developed-by: Andrea Parri (Microsoft) Signed-off-by: Andrea Parri (Microsoft) Cc: "David S. Miller" Cc: Jakub Kicinski Cc:

[PATCH v4] hv_utils: Add validation for untrusted Hyper-V values

2020-11-09 Thread Andrea Parri (Microsoft)
of the icversion_data array in vmbus_prep_negotiate_resp(). Signed-off-by: Andres Beltran Co-developed-by: Andrea Parri (Microsoft) Signed-off-by: Andrea Parri (Microsoft) --- Changes in v3: - Add size check for icframe_vercnt and icmsg_vercnt Changes in v2: - Use ratelimited form of kernel

[PATCH v9 3/3] hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening

2020-11-09 Thread Andrea Parri (Microsoft)
integers generated by vmbus_requestor as requests (transaction) IDs. Signed-off-by: Andres Beltran Co-developed-by: Andrea Parri (Microsoft) Signed-off-by: Andrea Parri (Microsoft) Reviewed-by: Michael Kelley Acked-by: Jakub Kicinski Cc: "David S. Miller" Cc: Jakub Kicinsk

[PATCH v9 2/3] scsi: storvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening

2020-11-09 Thread Andrea Parri (Microsoft)
integers generated by vmbus_requestor as requests (transaction) IDs. Signed-off-by: Andres Beltran Co-developed-by: Andrea Parri (Microsoft) Signed-off-by: Andrea Parri (Microsoft) Reviewed-by: Michael Kelley Cc: "James E.J. Bottomley" Cc: "Martin K. Petersen" Cc: linux-

[PATCH v9 0/3] Drivers: hv: vmbus: vmbus_requestor data structure for VMBus hardening

2020-11-09 Thread Andrea Parri (Microsoft)
, and allocates/frees the memory needed for vmbus_requestor. The second and third patches make use of vmbus_requestor to send request IDs to Hyper-V in storvsc and netvsc respectively. The series is based on 5.10-rc3. Changelog in the actual patches. Andrea Cc: James E.J. Bottomley Cc: Martin K. Petersen

[PATCH v9 1/3] Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening

2020-11-09 Thread Andrea Parri (Microsoft)
a bad request ID that is then treated as the address of a guest data structure with no validation. Instead, encapsulate these memory addresses and provide small integers as request IDs. Signed-off-by: Andres Beltran Co-developed-by: Andrea Parri (Microsoft) Signed-off-by: Andrea Parri (Microsoft

[net-next,v2,0/5] seg6: add support for SRv6 End.DT4 behavior

2020-11-07 Thread Andrea Mayer
. Comments, suggestions and improvements are very welcome! Thanks, Andrea Mayer v2 no changes made: resubmitted after false build report. v1 improve comments; add new patch 2/5 titled: seg6: improve management of behavior attributes seg6: add support for the SRv6 End.DT4 behavior - remove

[net-next,v2,2/5] seg6: improve management of behavior attributes

2020-11-07 Thread Andrea Mayer
the information needed to handle a given attribute are contained in only one place; 4) it facilitates the integration with new features introduced in further patches. Signed-off-by: Andrea Mayer --- net/ipv6/seg6_local.c | 103 ++ 1 file changed, 93

[net-next,v2,5/5] selftests: add selftest for the SRv6 End.DT4 behavior

2020-11-07 Thread Andrea Mayer
this selftest is designed for evaluating the new SRv6 End.DT4 behavior used, in this example, for implementing IPv4 L3 VPN use cases. Signed-off-by: Andrea Mayer --- .../selftests/net/srv6_end_dt4_l3vpn_test.sh | 494 ++ 1 file changed, 494 insertions(+) create mode 100755

[net-next,v2,4/5] seg6: add support for the SRv6 End.DT4 behavior

2020-11-07 Thread Andrea Mayer
-with-srv6 [3] https://patchwork.ozlabs.org/patch/799837/ Signed-off-by: Andrea Mayer --- net/ipv6/seg6_local.c | 205 ++ 1 file changed, 205 insertions(+) diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c index 4b0f155d641d..a41074acd43e 100644 --- a/net

[net-next,v2,1/5] vrf: add mac header for tunneled packets when sniffer is attached

2020-11-07 Thread Andrea Mayer
is not set. In this case, the mac address of the VRF is copied in both the destination and the source address of the ethernet header. The protocol type is set either to IPv4 or IPv6, depending on which L3 packet is received. Signed-off-by: Andrea Mayer --- drivers/net/vrf.c | 78

[net-next,v2,3/5] seg6: add callbacks for customizing the creation/destruction of a behavior

2020-11-07 Thread Andrea Mayer
during its initialization phase and after all the attributes have been parsed successfully; - destroy_state(...): used for calling the custom destructor of the behavior before it is completely destroyed. Signed-off-by: Andrea Mayer --- net/ipv6/seg6_local.c | 64

Re: lockdep: possible irq lock inversion dependency detected (trig->leddev_list_lock)

2020-11-05 Thread Andrea Righi
On Mon, Nov 02, 2020 at 10:09:28AM +0100, Andrea Righi wrote: > On Mon, Nov 02, 2020 at 09:56:58AM +0100, Pavel Machek wrote: > > Hi! > > > > > > > I'm getting the following lockdep splat (see below). > > > > > > > > > >

Re: [PATCH v8 1/3] Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening

2020-11-05 Thread Andrea Parri
+ if (rqst_id == VMBUS_RQST_ERROR) { > + pr_err("No request id available\n"); > + return -EAGAIN; FYI, the lkp kernel test robot reported a missing call to spin_unlock_irqrestore(_info->ring_lock, flags) before the above 'return': I'll address this in the next submission. Andrea

Re: [PATCH v8 3/3] hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening

2020-11-04 Thread Andrea Parri
On Wed, Nov 04, 2020 at 01:45:05PM -0800, Jakub Kicinski wrote: > On Wed, 4 Nov 2020 13:43:48 -0800 Jakub Kicinski wrote: > > On Wed, 4 Nov 2020 16:40:27 +0100 Andrea Parri (Microsoft) wrote: > > > From: Andres Beltran > > > > > > Currently, pointers t

[PATCH 0/1] x86: deduplicate the spectre_v2_user documentation

2020-11-04 Thread Andrea Arcangeli
, instead of keeping the dup around and applying the same update to the dup. Note: as far as I can tell spec_store_bypass_disable= documentation is not duplicated in spectre.rst, that's better in my view. The more dups we have the more one goes out of sync.. Andrea Arcangeli (1): x86: deduplicate

[PATCH 1/1] x86: deduplicate the spectre_v2_user documentation

2020-11-04 Thread Andrea Arcangeli
This would need updating to make prctl be the new default, but it's simpler to delete it and refer to the dup. Signed-off-by: Andrea Arcangeli --- Documentation/admin-guide/hw-vuln/spectre.rst | 51 +-- 1 file changed, 2 insertions(+), 49 deletions(-) diff --git a/Documentation

[PATCH 1/1] x86: change default to spec_store_bypass_disable=prctl spectre_v2_user=prctl

2020-11-04 Thread Andrea Arcangeli
ER_PRCTL (gdb) print spectre_v2_user_ibpb $2 = SPECTRE_V2_USER_PRCTL (gdb) print ssb_mode $3 = SPEC_STORE_BYPASS_PRCTL Acked-by: Kees Cook Signed-off-by: Andrea Arcangeli --- Documentation/admin-guide/hw-vuln/spectre.rst | 10 -- Documentation/admin-guide/kernel-parameters.txt | 5 ++---

Re: RFC: default to spec_store_bypass_disable=prctl spectre_v2_user=prctl

2020-11-04 Thread Andrea Arcangeli
On Thu, Nov 05, 2020 at 12:22:29AM +0100, Thomas Gleixner wrote: > On Wed, Nov 04 2020 at 16:57, Andrea Arcangeli wrote: > > --- > > Documentation/admin-guide/kernel-parameters.txt | 5 ++--- > > Is Documentation/admin-guide/hw-vuln/* still correct? If not, please > fix

RFC: default to spec_store_bypass_disable=prctl spectre_v2_user=prctl

2020-11-04 Thread Andrea Arcangeli
his codebase to the upstream kernel with both STIBP/SSBD enabled in seccomp jails. Here's below a tentative RFC, the code is actually trivial, if you could help reviewing/improving the commit header it would be great. Thanks, Andrea >From 3f7adb783262dc7f4e71cdbf07b4ef9f6b8d3ed9 Mon Sep 17 00

[PATCH v8 3/3] hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening

2020-11-04 Thread Andrea Parri (Microsoft)
integers generated by vmbus_requestor as requests (transaction) IDs. Signed-off-by: Andres Beltran Co-developed-by: Andrea Parri (Microsoft) Signed-off-by: Andrea Parri (Microsoft) Reviewed-by: Michael Kelley Cc: "David S. Miller" Cc: Jakub Kicinski Cc: net...@vger.kernel.org --- d

[PATCH v8 1/3] Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening

2020-11-04 Thread Andrea Parri (Microsoft)
a bad request ID that is then treated as the address of a guest data structure with no validation. Instead, encapsulate these memory addresses and provide small integers as request IDs. Signed-off-by: Andres Beltran Co-developed-by: Andrea Parri (Microsoft) Signed-off-by: Andrea Parri (Microsoft

[PATCH v8 2/3] scsi: storvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening

2020-11-04 Thread Andrea Parri (Microsoft)
integers generated by vmbus_requestor as requests (transaction) IDs. Signed-off-by: Andres Beltran Co-developed-by: Andrea Parri (Microsoft) Signed-off-by: Andrea Parri (Microsoft) Reviewed-by: Michael Kelley Cc: "James E.J. Bottomley" Cc: "Martin K. Petersen" Cc: linux-

[PATCH v8 0/3] Drivers: hv: vmbus: vmbus_requestor data structure for VMBus hardening

2020-11-04 Thread Andrea Parri (Microsoft)
Hi all, This is a resubmission of: https://lkml.kernel.org/r/20200907161920.71460-1-parri.and...@gmail.com based on 5.10-rc2. Andrea Cc: James E.J. Bottomley Cc: Martin K. Petersen Cc: "David S. Miller" Cc: Jakub Kicinski Cc: linux-s...@vger.kernel.org Cc: net...@vger.

[net-next,v1,3/5] seg6: add callbacks for customizing the creation/destruction of a behavior

2020-11-03 Thread Andrea Mayer
during its initialization phase and after all the attributes have been parsed successfully; - destroy_state(...): used for calling the custom destructor of the behavior before it is completely destroyed. Signed-off-by: Andrea Mayer --- net/ipv6/seg6_local.c | 64

[net-next,v1,1/5] vrf: add mac header for tunneled packets when sniffer is attached

2020-11-03 Thread Andrea Mayer
is not set. In this case, the mac address of the VRF is copied in both the destination and the source address of the ethernet header. The protocol type is set either to IPv4 or IPv6, depending on which L3 packet is received. Signed-off-by: Andrea Mayer --- drivers/net/vrf.c | 78

<    1   2   3   4   5   6   7   8   9   10   >