android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
21816b696c
android_kernel_xiaomi_sm8450/drivers
History
Nikolay Aleksandrov 21816b696c bonding: fix xfrm real_dev null pointer dereference 
[ Upstream commit f8cde9805981c50d0c029063dc7d82821806fc44 ]

We shouldn't set real_dev to NULL because packets can be in transit and
xfrm might call xdo_dev_offload_ok() in parallel. All callbacks assume
real_dev is set.

 Example trace:
 kernel: BUG: unable to handle page fault for address: 0000000000001030
 kernel: bond0: (slave eni0np1): making interface the new active one
 kernel: #PF: supervisor write access in kernel mode
 kernel: #PF: error_code(0x0002) - not-present page
 kernel: PGD 0 P4D 0
 kernel: Oops: 0002 [#1] PREEMPT SMP
 kernel: CPU: 4 PID: 2237 Comm: ping Not tainted 6.7.7+ #12
 kernel: Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014
 kernel: RIP: 0010:nsim_ipsec_offload_ok+0xc/0x20 [netdevsim]
 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA
 kernel: Code: e0 0f 0b 48 83 7f 38 00 74 de 0f 0b 48 8b 47 08 48 8b 37 48 8b 78 40 e9 b2 e5 9a d7 66 90 0f 1f 44 00 00 48 8b 86 80 02 00 00 <83> 80 30 10 00 00 01 b8 01 00 00 00 c3 0f 1f 80 00 00 00 00 0f 1f
 kernel: bond0: (slave eni0np1): making interface the new active one
 kernel: RSP: 0018:ffffabde81553b98 EFLAGS: 00010246
 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA
 kernel:
 kernel: RAX: 0000000000000000 RBX: ffff9eb404e74900 RCX: ffff9eb403d97c60
 kernel: RDX: ffffffffc090de10 RSI: ffff9eb404e74900 RDI: ffff9eb3c5de9e00
 kernel: RBP: ffff9eb3c0a42000 R08: 0000000000000010 R09: 0000000000000014
 kernel: R10: 7974203030303030 R11: 3030303030303030 R12: 0000000000000000
 kernel: R13: ffff9eb3c5de9e00 R14: ffffabde81553cc8 R15: ffff9eb404c53000
 kernel: FS:  00007f2a77a3ad00(0000) GS:ffff9eb43bd00000(0000) knlGS:0000000000000000
 kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 kernel: CR2: 0000000000001030 CR3: 00000001122ab000 CR4: 0000000000350ef0
 kernel: bond0: (slave eni0np1): making interface the new active one
 kernel: Call Trace:
 kernel:  <TASK>
 kernel:  ? __die+0x1f/0x60
 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA
 kernel:  ? page_fault_oops+0x142/0x4c0
 kernel:  ? do_user_addr_fault+0x65/0x670
 kernel:  ? kvm_read_and_reset_apf_flags+0x3b/0x50
 kernel: bond0: (slave eni0np1): making interface the new active one
 kernel:  ? exc_page_fault+0x7b/0x180
 kernel:  ? asm_exc_page_fault+0x22/0x30
 kernel:  ? nsim_bpf_uninit+0x50/0x50 [netdevsim]
 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA
 kernel:  ? nsim_ipsec_offload_ok+0xc/0x20 [netdevsim]
 kernel: bond0: (slave eni0np1): making interface the new active one
 kernel:  bond_ipsec_offload_ok+0x7b/0x90 [bonding]
 kernel:  xfrm_output+0x61/0x3b0
 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA
 kernel:  ip_push_pending_frames+0x56/0x80

Fixes: 18cb261afd ("bonding: support hardware encryption offload to slaves")
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-04 13:17:40 +02:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-16 13:31:59 +02:00
acpi ACPI: SBS: manage alarm sysfs attribute through psy core 2024-08-19 05:41:12 +02:00
amba amba: bus: fix refcount leak 2023-09-19 12:20:19 +02:00
android binder: fix hang of unregistered readers 2024-08-19 05:40:58 +02:00
ata ata: libata-core: Fix double free on error 2024-07-05 09:12:55 +02:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-09-04 13:17:31 +02:00
auxdisplay
base driver core: Fix uevent_show() vs driver detach race 2024-08-19 05:41:18 +02:00
bcma
block rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings 2024-08-19 05:41:02 +02:00
bluetooth Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591 2024-08-19 05:41:02 +02:00
bus bus: tegra-aconnect: Update dependency to ARCH_TEGRA 2024-03-26 18:21:50 -04:00
cdrom
char hwrng: amd - Convert PCIBIOS_* return codes to errnos 2024-08-19 05:40:58 +02:00
clk clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use 2024-08-19 05:40:59 +02:00
clocksource clocksource/drivers/sh_cmt: Address race condition for clock events 2024-08-19 05:41:12 +02:00
connector
counter counter: ti-eqep: enable clock at probe 2024-07-05 09:12:51 +02:00
cpufreq cpufreq: exit() callback is optional 2024-06-16 13:32:05 +02:00
cpuidle powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT 2023-09-19 12:20:15 +02:00
crypto crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak 2024-06-16 13:32:34 +02:00
dax dax: Introduce alloc_dev_dax_id() 2023-07-27 08:44:00 +02:00
dca
devfreq PM / devfreq: Fix buffer overflow in trans_stat_show 2024-05-02 16:23:44 +02:00
dio
dma dmaengine: ioatdma: Fix missing kmem_cache_destroy() 2024-07-05 09:12:40 +02:00
dma-buf dma-buf/sw-sync: don't enable IRQ from sync_print_obj() 2024-06-16 13:32:28 +02:00
edac EDAC, i10nm: make skx_common.o a separate module 2024-08-19 05:40:40 +02:00
eisa
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-16 13:32:20 +02:00
firewire firewire: nosy: ensure user_length is taken into account when fetching packet contents 2024-05-17 11:48:08 +02:00
firmware firmware: turris-mox-rwtm: Initialize completion before mailbox 2024-08-19 05:40:44 +02:00
fpga fpga: region: add owner module and take its refcount 2024-06-16 13:32:19 +02:00
fsi fsi: aspeed: Reset master errors after CFAM reset 2023-09-19 12:20:18 +02:00
gnss
gpio gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1) 2024-07-05 09:12:51 +02:00
gpu drm/lima: set gp bus_stop bit before hard reset 2024-09-04 13:17:35 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-07-05 09:12:32 +02:00
hid HID: wacom: Modify pen IDs 2024-08-19 05:41:09 +02:00
hsi
hv Drivers: hv: vmbus: Drop error message when 'No request id available' 2024-03-15 10:48:22 -04:00
hwmon hwmon: (max6697) Fix swapped temp{1,8} critical alarms 2024-08-19 05:40:41 +02:00
hwspinlock
hwtracing coresight: Fix ref leak when of_coresight_parse_endpoint() fails 2024-08-19 05:40:51 +02:00
i2c i2c: riic: avoid potential division by zero 2024-09-04 13:17:33 +02:00
i3c i3c: master: cdns: Update maximum prescaler value for i2c clock 2024-02-23 08:42:13 +01:00
ide
idle
iio iio: chemical: bme680: Fix sensor data read operation 2024-07-05 09:12:52 +02:00
infiniband IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock 2024-09-04 13:17:34 +02:00
input Input: elan_i2c - do not leave interrupt disabled on suspend failure 2024-08-19 05:40:52 +02:00
interconnect interconnect: Treat xlate() returning NULL node as an error 2024-01-05 15:12:26 +01:00
iommu iommu/arm-smmu-v3: Free MSIs in case of ENOMEM 2024-07-05 09:12:36 +02:00
ipack
irqchip irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc 2024-09-04 13:17:38 +02:00
isdn mISDN: Fix a use after free in hfcmulti_tx() 2024-08-19 05:41:05 +02:00
leds leds: ss4200: Convert PCIBIOS_* return codes to errnos 2024-08-19 05:40:57 +02:00
lightnvm
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-19 05:40:52 +02:00
mailbox mailbox: imx: fix suspend failue 2024-05-02 16:23:35 +02:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 16:54:58 +00:00
md dm suspend: return -ERESTARTSYS instead of -EINTR 2024-09-04 13:17:39 +02:00
media media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) 2024-09-04 13:17:39 +02:00
memory memory: stm32-fmc2-ebi: check regmap_read return value 2024-09-04 13:17:36 +02:00
memstick memstick r592: make memstick_debug_get_tpc_name() static 2023-07-27 08:43:40 +02:00
message scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition 2023-05-30 12:57:49 +01:00
mfd mfd: omap-usb-tll: Use struct_size to allocate tll 2024-08-19 05:40:50 +02:00
misc mei: demote client disconnect warning on suspend to debug 2024-07-27 10:40:18 +02:00
mmc mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro() 2024-07-05 09:12:51 +02:00
most
mtd ubi: eba: properly rollback inside self_check_eba 2024-08-19 05:40:59 +02:00
mux
net bonding: fix xfrm real_dev null pointer dereference 2024-09-04 13:17:40 +02:00
nfc NFC: trf7970a: disable all regulators on removal 2024-05-02 16:23:41 +02:00
ntb ntb: Fix calculation ntb_transport_tx_free_entry() 2023-09-19 12:20:22 +02:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-27 08:43:31 +02:00
nvdimm nd_btt: Make BTT lanes preemptible 2023-11-20 11:06:50 +01:00
nvme nvmet-rdma: fix possible bad dereference when freeing rsps 2024-09-04 13:17:39 +02:00
nvmem nvmem: meson-efuse: Fix return value of nvmem callbacks 2024-07-18 13:05:49 +02:00
of of: dynamic: Synchronize of_changeset_destroy() with the devlink removals 2024-04-13 12:59:35 +02:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-03-26 18:21:53 -04:00
oprofile
parisc parisc: iosapic.c: Fix sparse warnings 2023-10-10 21:53:32 +02:00
parport dev/parport: fix the array out-of-bounds risk 2024-08-19 05:40:59 +02:00
pci PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal 2024-08-19 05:41:22 +02:00
pcmcia pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() 2023-11-20 11:06:54 +01:00
perf perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7 2023-10-25 11:54:13 +02:00
phy phy: tegra: xusb: Add API to retrieve the port number of phy 2024-04-13 12:58:29 +02:00
pinctrl pinctrl: freescale: mxs: Fix refcount of child 2024-08-19 05:40:54 +02:00
platform platform/chrome: cros_ec_proto: Lock device when updating MKBP version 2024-08-19 05:41:09 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-23 08:42:03 +01:00
power power: supply: axp288_charger: Round constant_charge_voltage writes down 2024-08-19 05:41:20 +02:00
powercap powercap: RAPL: Fix CONFIG_IOSF_MBI dependency 2023-07-27 08:43:34 +02:00
pps
ps3
ptp ptp: Fix error message on failed pin verification 2024-07-05 09:12:22 +02:00
pwm pwm: stm32: Always do lazy disabling 2024-08-19 05:40:41 +02:00
rapidio
ras
regulator regulator: core: Fix modpost error "regulator_get_regmap" undefined 2024-07-05 09:12:39 +02:00
remoteproc remoteproc: imx_rproc: Skip over memory region when node value is NULL 2024-08-19 05:41:08 +02:00
reset reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning 2024-01-25 14:37:37 -08:00
rpmsg rpmsg: virtio: Free driver_override when rpmsg_remove() 2024-02-23 08:41:53 +01:00
rtc rtc: isl1208: Fix return value of nvmem callbacks 2024-08-19 05:41:01 +02:00
s390 s390/cio: rename bitmap_size() -> idset_bitmap_size() 2024-09-04 13:17:31 +02:00
sbus
scsi scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() 2024-09-04 13:17:35 +02:00
sfi
sh
siox
slimbus slimbus: core: Remove usage of the deprecated ida_simple_xx() API 2024-04-13 12:58:29 +02:00
soc drivers: soc: xilinx: check return status of get_api_version() 2024-08-19 05:41:07 +02:00
soundwire soundwire: cadence: fix invalid PDI offset 2024-06-16 13:32:16 +02:00
spi spi: spi-fsl-lpspi: Fix scldiv calculation 2024-08-19 05:41:17 +02:00
spmi spmi: Add a check for remove callback when removing a SPMI driver 2023-05-17 11:47:59 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-09-04 13:17:32 +02:00
staging staging: ks7010: disable bh on tx_dev_lock 2024-09-04 13:17:34 +02:00
target scsi: target: Fix SELinux error when systemd-modules loads the target module 2024-05-17 11:48:04 +02:00
tc
tee tee: optee: Fix kernel panic caused by incorrect error handling 2024-04-13 12:58:53 +02:00
thermal thermal: core: prevent potential string overflow 2023-11-20 11:06:45 +01:00
thunderbolt thunderbolt: Mark XDomain as unplugged when router is removed 2024-09-04 13:17:29 +02:00
tty serial: core: check uartclk for zero to avoid divide by zero 2024-08-19 05:41:19 +02:00
uio uio: Fix use-after-free in uio_open 2024-01-25 14:37:38 -08:00
usb usb: dwc3: core: Skip setting event buffers for host only controllers 2024-09-04 13:17:38 +02:00
vdpa
vfio vfio/fsl-mc: Block calling interrupt handler without trigger 2024-04-13 12:59:21 +02:00
vhost vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler 2024-08-19 05:41:23 +02:00
video fbdev: savage: Handle err return when savagefb_check_var failed 2024-06-16 13:32:34 +02:00
virt
virtio virtio: delete vq in vp_find_vqs_msix() when request_irq() fails 2024-06-16 13:32:27 +02:00
visorbus
vlynq
vme
w1 w1: fix loop in w1_fini() 2023-07-27 08:44:02 +02:00
watchdog watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin 2024-06-16 13:32:35 +02:00
xen xen/events: close evtchn after mapping cleanup 2024-04-13 12:58:54 +02:00
zorro
Kconfig
Makefile