]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.4-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 2 Jul 2019 04:40:41 +0000 (06:40 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 2 Jul 2019 04:40:41 +0000 (06:40 +0200)
added patches:
af_packet-block-execution-of-tasks-waiting-for-transmit-to-complete-in-af_packet.patch
bonding-always-enable-vlan-tx-offload.patch
ipv4-use-return-value-of-inet_iif-for-__raw_v4_lookup-in-the-while-loop.patch
sctp-change-to-hold-sk-after-auth-shkey-is-created-successfully.patch
team-always-enable-vlan-tx-offload.patch
tipc-change-to-use-register_pernet_device.patch
tipc-check-msg-req-data-len-in-tipc_nl_compat_bearer_disable.patch

queue-4.4/af_packet-block-execution-of-tasks-waiting-for-transmit-to-complete-in-af_packet.patch [new file with mode: 0644]
queue-4.4/bonding-always-enable-vlan-tx-offload.patch [new file with mode: 0644]
queue-4.4/ipv4-use-return-value-of-inet_iif-for-__raw_v4_lookup-in-the-while-loop.patch [new file with mode: 0644]
queue-4.4/sctp-change-to-hold-sk-after-auth-shkey-is-created-successfully.patch [new file with mode: 0644]
queue-4.4/series
queue-4.4/team-always-enable-vlan-tx-offload.patch [new file with mode: 0644]
queue-4.4/tipc-change-to-use-register_pernet_device.patch [new file with mode: 0644]
queue-4.4/tipc-check-msg-req-data-len-in-tipc_nl_compat_bearer_disable.patch [new file with mode: 0644]

diff --git a/queue-4.4/af_packet-block-execution-of-tasks-waiting-for-transmit-to-complete-in-af_packet.patch b/queue-4.4/af_packet-block-execution-of-tasks-waiting-for-transmit-to-complete-in-af_packet.patch
new file mode 100644 (file)
index 0000000..3ce540c
--- /dev/null
@@ -0,0 +1,153 @@
+From foo@baz Tue 02 Jul 2019 06:32:24 AM CEST
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Tue, 25 Jun 2019 17:57:49 -0400
+Subject: af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+[ Upstream commit 89ed5b519004a7706f50b70f611edbd3aaacff2c ]
+
+When an application is run that:
+a) Sets its scheduler to be SCHED_FIFO
+and
+b) Opens a memory mapped AF_PACKET socket, and sends frames with the
+MSG_DONTWAIT flag cleared, its possible for the application to hang
+forever in the kernel.  This occurs because when waiting, the code in
+tpacket_snd calls schedule, which under normal circumstances allows
+other tasks to run, including ksoftirqd, which in some cases is
+responsible for freeing the transmitted skb (which in AF_PACKET calls a
+destructor that flips the status bit of the transmitted frame back to
+available, allowing the transmitting task to complete).
+
+However, when the calling application is SCHED_FIFO, its priority is
+such that the schedule call immediately places the task back on the cpu,
+preventing ksoftirqd from freeing the skb, which in turn prevents the
+transmitting task from detecting that the transmission is complete.
+
+We can fix this by converting the schedule call to a completion
+mechanism.  By using a completion queue, we force the calling task, when
+it detects there are no more frames to send, to schedule itself off the
+cpu until such time as the last transmitted skb is freed, allowing
+forward progress to be made.
+
+Tested by myself and the reporter, with good results
+
+Change Notes:
+
+V1->V2:
+       Enhance the sleep logic to support being interruptible and
+allowing for honoring to SK_SNDTIMEO (Willem de Bruijn)
+
+V2->V3:
+       Rearrage the point at which we wait for the completion queue, to
+avoid needing to check for ph/skb being null at the end of the loop.
+Also move the complete call to the skb destructor to avoid needing to
+modify __packet_set_status.  Also gate calling complete on
+packet_read_pending returning zero to avoid multiple calls to complete.
+(Willem de Bruijn)
+
+       Move timeo computation within loop, to re-fetch the socket
+timeout since we also use the timeo variable to record the return code
+from the wait_for_complete call (Neil Horman)
+
+V3->V4:
+       Willem has requested that the control flow be restored to the
+previous state.  Doing so lets us eliminate the need for the
+po->wait_on_complete flag variable, and lets us get rid of the
+packet_next_frame function, but introduces another complexity.
+Specifically, but using the packet pending count, we can, if an
+applications calls sendmsg multiple times with MSG_DONTWAIT set, each
+set of transmitted frames, when complete, will cause
+tpacket_destruct_skb to issue a complete call, for which there will
+never be a wait_on_completion call.  This imbalance will lead to any
+future call to wait_for_completion here to return early, when the frames
+they sent may not have completed.  To correct this, we need to re-init
+the completion queue on every call to tpacket_snd before we enter the
+loop so as to ensure we wait properly for the frames we send in this
+iteration.
+
+       Change the timeout and interrupted gotos to out_put rather than
+out_status so that we don't try to free a non-existant skb
+       Clean up some extra newlines (Willem de Bruijn)
+
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+Reported-by: Matteo Croce <mcroce@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/packet/af_packet.c |   20 +++++++++++++++++---
+ net/packet/internal.h  |    1 +
+ 2 files changed, 18 insertions(+), 3 deletions(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2345,6 +2345,9 @@ static void tpacket_destruct_skb(struct
+               ts = __packet_set_timestamp(po, ph, skb);
+               __packet_set_status(po, ph, TP_STATUS_AVAILABLE | ts);
++
++              if (!packet_read_pending(&po->tx_ring))
++                      complete(&po->skb_completion);
+       }
+       sock_wfree(skb);
+@@ -2483,7 +2486,7 @@ static int tpacket_fill_skb(struct packe
+ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ {
+-      struct sk_buff *skb;
++      struct sk_buff *skb = NULL;
+       struct net_device *dev;
+       __be16 proto;
+       int err, reserve = 0;
+@@ -2495,6 +2498,7 @@ static int tpacket_snd(struct packet_soc
+       int len_sum = 0;
+       int status = TP_STATUS_AVAILABLE;
+       int hlen, tlen;
++      long timeo = 0;
+       mutex_lock(&po->pg_vec_lock);
+@@ -2535,12 +2539,21 @@ static int tpacket_snd(struct packet_soc
+       if (size_max > dev->mtu + reserve + VLAN_HLEN)
+               size_max = dev->mtu + reserve + VLAN_HLEN;
++      reinit_completion(&po->skb_completion);
++
+       do {
+               ph = packet_current_frame(po, &po->tx_ring,
+                                         TP_STATUS_SEND_REQUEST);
+               if (unlikely(ph == NULL)) {
+-                      if (need_wait && need_resched())
+-                              schedule();
++                      if (need_wait && skb) {
++                              timeo = sock_sndtimeo(&po->sk, msg->msg_flags & MSG_DONTWAIT);
++                              timeo = wait_for_completion_interruptible_timeout(&po->skb_completion, timeo);
++                              if (timeo <= 0) {
++                                      err = !timeo ? -ETIMEDOUT : -ERESTARTSYS;
++                                      goto out_put;
++                              }
++                      }
++                      /* check for additional frames */
+                       continue;
+               }
+@@ -3127,6 +3140,7 @@ static int packet_create(struct net *net
+       sock_init_data(sock, sk);
+       po = pkt_sk(sk);
++      init_completion(&po->skb_completion);
+       sk->sk_family = PF_PACKET;
+       po->num = proto;
+       po->xmit = dev_queue_xmit;
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -125,6 +125,7 @@ struct packet_sock {
+       unsigned int            tp_hdrlen;
+       unsigned int            tp_reserve;
+       unsigned int            tp_tstamp;
++      struct completion       skb_completion;
+       struct net_device __rcu *cached_dev;
+       int                     (*xmit)(struct sk_buff *skb);
+       struct packet_type      prot_hook ____cacheline_aligned_in_smp;
diff --git a/queue-4.4/bonding-always-enable-vlan-tx-offload.patch b/queue-4.4/bonding-always-enable-vlan-tx-offload.patch
new file mode 100644 (file)
index 0000000..1dd59f6
--- /dev/null
@@ -0,0 +1,51 @@
+From foo@baz Tue 02 Jul 2019 06:20:09 AM CEST
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Wed, 26 Jun 2019 16:08:44 +0800
+Subject: bonding: Always enable vlan tx offload
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 30d8177e8ac776d89d387fad547af6a0f599210e ]
+
+We build vlan on top of bonding interface, which vlan offload
+is off, bond mode is 802.3ad (LACP) and xmit_hash_policy is
+BOND_XMIT_POLICY_ENCAP34.
+
+Because vlan tx offload is off, vlan tci is cleared and skb push
+the vlan header in validate_xmit_vlan() while sending from vlan
+devices. Then in bond_xmit_hash, __skb_flow_dissect() fails to
+get information from protocol headers encapsulated within vlan,
+because 'nhoff' is points to IP header, so bond hashing is based
+on layer 2 info, which fails to distribute packets across slaves.
+
+This patch always enable bonding's vlan tx offload, pass the vlan
+packets to the slave devices with vlan tci, let them to handle
+vlan implementation.
+
+Fixes: 278339a42a1b ("bonding: propogate vlan_features to bonding master")
+Suggested-by: Jiri Pirko <jiri@resnulli.us>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_main.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4164,13 +4164,13 @@ void bond_setup(struct net_device *bond_
+       bond_dev->features |= NETIF_F_NETNS_LOCAL;
+       bond_dev->hw_features = BOND_VLAN_FEATURES |
+-                              NETIF_F_HW_VLAN_CTAG_TX |
+                               NETIF_F_HW_VLAN_CTAG_RX |
+                               NETIF_F_HW_VLAN_CTAG_FILTER;
+       bond_dev->hw_features &= ~(NETIF_F_ALL_CSUM & ~NETIF_F_HW_CSUM);
+       bond_dev->hw_features |= NETIF_F_GSO_ENCAP_ALL;
+       bond_dev->features |= bond_dev->hw_features;
++      bond_dev->features |= NETIF_F_HW_VLAN_CTAG_TX;
+ }
+ /* Destroy a bonding device.
diff --git a/queue-4.4/ipv4-use-return-value-of-inet_iif-for-__raw_v4_lookup-in-the-while-loop.patch b/queue-4.4/ipv4-use-return-value-of-inet_iif-for-__raw_v4_lookup-in-the-while-loop.patch
new file mode 100644 (file)
index 0000000..e16c95a
--- /dev/null
@@ -0,0 +1,34 @@
+From foo@baz Tue 02 Jul 2019 06:26:14 AM CEST
+From: Stephen Suryaputra <ssuryaextr@gmail.com>
+Date: Mon, 24 Jun 2019 20:14:06 -0400
+Subject: ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop
+
+From: Stephen Suryaputra <ssuryaextr@gmail.com>
+
+[ Upstream commit 38c73529de13e1e10914de7030b659a2f8b01c3b ]
+
+In commit 19e4e768064a8 ("ipv4: Fix raw socket lookup for local
+traffic"), the dif argument to __raw_v4_lookup() is coming from the
+returned value of inet_iif() but the change was done only for the first
+lookup. Subsequent lookups in the while loop still use skb->dev->ifIndex.
+
+Fixes: 19e4e768064a8 ("ipv4: Fix raw socket lookup for local traffic")
+Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>
+Reviewed-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/raw.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -195,7 +195,7 @@ static int raw_v4_input(struct sk_buff *
+               }
+               sk = __raw_v4_lookup(net, sk_next(sk), iph->protocol,
+                                    iph->saddr, iph->daddr,
+-                                   skb->dev->ifindex);
++                                   dif);
+       }
+ out:
+       read_unlock(&raw_v4_hashinfo.lock);
diff --git a/queue-4.4/sctp-change-to-hold-sk-after-auth-shkey-is-created-successfully.patch b/queue-4.4/sctp-change-to-hold-sk-after-auth-shkey-is-created-successfully.patch
new file mode 100644 (file)
index 0000000..779e7a3
--- /dev/null
@@ -0,0 +1,51 @@
+From foo@baz Tue 02 Jul 2019 06:32:24 AM CEST
+From: Xin Long <lucien.xin@gmail.com>
+Date: Tue, 25 Jun 2019 00:21:45 +0800
+Subject: sctp: change to hold sk after auth shkey is created successfully
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 25bff6d5478b2a02368097015b7d8eb727c87e16 ]
+
+Now in sctp_endpoint_init(), it holds the sk then creates auth
+shkey. But when the creation fails, it doesn't release the sk,
+which causes a sk defcnf leak,
+
+Here to fix it by only holding the sk when auth shkey is created
+successfully.
+
+Fixes: a29a5bd4f5c3 ("[SCTP]: Implement SCTP-AUTH initializations.")
+Reported-by: syzbot+afabda3890cc2f765041@syzkaller.appspotmail.com
+Reported-by: syzbot+276ca1c77a19977c0130@syzkaller.appspotmail.com
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Neil Horman <nhorman@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/endpointola.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/sctp/endpointola.c
++++ b/net/sctp/endpointola.c
+@@ -126,10 +126,6 @@ static struct sctp_endpoint *sctp_endpoi
+       /* Initialize the bind addr area */
+       sctp_bind_addr_init(&ep->base.bind_addr, 0);
+-      /* Remember who we are attached to.  */
+-      ep->base.sk = sk;
+-      sock_hold(ep->base.sk);
+-
+       /* Create the lists of associations.  */
+       INIT_LIST_HEAD(&ep->asocs);
+@@ -165,6 +161,10 @@ static struct sctp_endpoint *sctp_endpoi
+       ep->auth_hmacs_list = auth_hmacs;
+       ep->auth_chunk_list = auth_chunks;
++      /* Remember who we are attached to.  */
++      ep->base.sk = sk;
++      sock_hold(ep->base.sk);
++
+       return ep;
+ nomem_hmacs:
index db75f7fdd5825888c9ea3b86c9546506208459d9..313ab09844c2b9c9016bd7026b6319f58a96723c 100644 (file)
@@ -37,3 +37,10 @@ kvm-x86-fix-scan-ioapic-use-before-initialization.patch
 ovl-modify-ovl_permission-to-do-checks-on-two-inodes.patch
 x86-speculation-allow-guests-to-use-ssbd-even-if-host-does-not.patch
 cpu-speculation-warn-on-unsupported-mitigations-parameter.patch
+sctp-change-to-hold-sk-after-auth-shkey-is-created-successfully.patch
+tipc-change-to-use-register_pernet_device.patch
+tipc-check-msg-req-data-len-in-tipc_nl_compat_bearer_disable.patch
+team-always-enable-vlan-tx-offload.patch
+ipv4-use-return-value-of-inet_iif-for-__raw_v4_lookup-in-the-while-loop.patch
+bonding-always-enable-vlan-tx-offload.patch
+af_packet-block-execution-of-tasks-waiting-for-transmit-to-complete-in-af_packet.patch
diff --git a/queue-4.4/team-always-enable-vlan-tx-offload.patch b/queue-4.4/team-always-enable-vlan-tx-offload.patch
new file mode 100644 (file)
index 0000000..1088a29
--- /dev/null
@@ -0,0 +1,37 @@
+From foo@baz Tue 02 Jul 2019 06:20:09 AM CEST
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 27 Jun 2019 00:03:39 +0800
+Subject: team: Always enable vlan tx offload
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit ee4297420d56a0033a8593e80b33fcc93fda8509 ]
+
+We should rather have vlan_tci filled all the way down
+to the transmitting netdevice and let it do the hw/sw
+vlan implementation.
+
+Suggested-by: Jiri Pirko <jiri@resnulli.us>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/team/team.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -2091,12 +2091,12 @@ static void team_setup(struct net_device
+       dev->features |= NETIF_F_NETNS_LOCAL;
+       dev->hw_features = TEAM_VLAN_FEATURES |
+-                         NETIF_F_HW_VLAN_CTAG_TX |
+                          NETIF_F_HW_VLAN_CTAG_RX |
+                          NETIF_F_HW_VLAN_CTAG_FILTER;
+       dev->hw_features &= ~(NETIF_F_ALL_CSUM & ~NETIF_F_HW_CSUM);
+       dev->features |= dev->hw_features;
++      dev->features |= NETIF_F_HW_VLAN_CTAG_TX;
+ }
+ static int team_newlink(struct net *src_net, struct net_device *dev,
diff --git a/queue-4.4/tipc-change-to-use-register_pernet_device.patch b/queue-4.4/tipc-change-to-use-register_pernet_device.patch
new file mode 100644 (file)
index 0000000..a7afaf8
--- /dev/null
@@ -0,0 +1,100 @@
+From foo@baz Tue 02 Jul 2019 06:32:24 AM CEST
+From: Xin Long <lucien.xin@gmail.com>
+Date: Thu, 20 Jun 2019 18:39:28 +0800
+Subject: tipc: change to use register_pernet_device
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit c492d4c74dd3f87559883ffa0f94a8f1ae3fe5f5 ]
+
+This patch is to fix a dst defcnt leak, which can be reproduced by doing:
+
+  # ip net a c; ip net a s; modprobe tipc
+  # ip net e s ip l a n eth1 type veth peer n eth1 netns c
+  # ip net e c ip l s lo up; ip net e c ip l s eth1 up
+  # ip net e s ip l s lo up; ip net e s ip l s eth1 up
+  # ip net e c ip a a 1.1.1.2/8 dev eth1
+  # ip net e s ip a a 1.1.1.1/8 dev eth1
+  # ip net e c tipc b e m udp n u1 localip 1.1.1.2
+  # ip net e s tipc b e m udp n u1 localip 1.1.1.1
+  # ip net d c; ip net d s; rmmod tipc
+
+and it will get stuck and keep logging the error:
+
+  unregister_netdevice: waiting for lo to become free. Usage count = 1
+
+The cause is that a dst is held by the udp sock's sk_rx_dst set on udp rx
+path with udp_early_demux == 1, and this dst (eventually holding lo dev)
+can't be released as bearer's removal in tipc pernet .exit happens after
+lo dev's removal, default_device pernet .exit.
+
+ "There are two distinct types of pernet_operations recognized: subsys and
+  device.  At creation all subsys init functions are called before device
+  init functions, and at destruction all device exit functions are called
+  before subsys exit function."
+
+So by calling register_pernet_device instead to register tipc_net_ops, the
+pernet .exit() will be invoked earlier than loopback dev's removal when a
+netns is being destroyed, as fou/gue does.
+
+Note that vxlan and geneve udp tunnels don't have this issue, as the udp
+sock is released in their device ndo_stop().
+
+This fix is also necessary for tipc dst_cache, which will hold dsts on tx
+path and I will introduce in my next patch.
+
+Reported-by: Li Shuang <shuali@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/core.c |   12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/net/tipc/core.c
++++ b/net/tipc/core.c
+@@ -129,7 +129,7 @@ static int __init tipc_init(void)
+       if (err)
+               goto out_sysctl;
+-      err = register_pernet_subsys(&tipc_net_ops);
++      err = register_pernet_device(&tipc_net_ops);
+       if (err)
+               goto out_pernet;
+@@ -137,7 +137,7 @@ static int __init tipc_init(void)
+       if (err)
+               goto out_socket;
+-      err = register_pernet_subsys(&tipc_topsrv_net_ops);
++      err = register_pernet_device(&tipc_topsrv_net_ops);
+       if (err)
+               goto out_pernet_topsrv;
+@@ -148,11 +148,11 @@ static int __init tipc_init(void)
+       pr_info("Started in single node mode\n");
+       return 0;
+ out_bearer:
+-      unregister_pernet_subsys(&tipc_topsrv_net_ops);
++      unregister_pernet_device(&tipc_topsrv_net_ops);
+ out_pernet_topsrv:
+       tipc_socket_stop();
+ out_socket:
+-      unregister_pernet_subsys(&tipc_net_ops);
++      unregister_pernet_device(&tipc_net_ops);
+ out_pernet:
+       tipc_unregister_sysctl();
+ out_sysctl:
+@@ -167,9 +167,9 @@ out_netlink:
+ static void __exit tipc_exit(void)
+ {
+       tipc_bearer_cleanup();
+-      unregister_pernet_subsys(&tipc_topsrv_net_ops);
++      unregister_pernet_device(&tipc_topsrv_net_ops);
+       tipc_socket_stop();
+-      unregister_pernet_subsys(&tipc_net_ops);
++      unregister_pernet_device(&tipc_net_ops);
+       tipc_netlink_stop();
+       tipc_netlink_compat_stop();
+       tipc_unregister_sysctl();
diff --git a/queue-4.4/tipc-check-msg-req-data-len-in-tipc_nl_compat_bearer_disable.patch b/queue-4.4/tipc-check-msg-req-data-len-in-tipc_nl_compat_bearer_disable.patch
new file mode 100644 (file)
index 0000000..1b6324f
--- /dev/null
@@ -0,0 +1,88 @@
+From foo@baz Tue 02 Jul 2019 06:32:24 AM CEST
+From: Xin Long <lucien.xin@gmail.com>
+Date: Tue, 25 Jun 2019 00:28:19 +0800
+Subject: tipc: check msg->req data len in tipc_nl_compat_bearer_disable
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 4f07b80c973348a99b5d2a32476a2e7877e94a05 ]
+
+This patch is to fix an uninit-value issue, reported by syzbot:
+
+  BUG: KMSAN: uninit-value in memchr+0xce/0x110 lib/string.c:981
+  Call Trace:
+    __dump_stack lib/dump_stack.c:77 [inline]
+    dump_stack+0x191/0x1f0 lib/dump_stack.c:113
+    kmsan_report+0x130/0x2a0 mm/kmsan/kmsan.c:622
+    __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:310
+    memchr+0xce/0x110 lib/string.c:981
+    string_is_valid net/tipc/netlink_compat.c:176 [inline]
+    tipc_nl_compat_bearer_disable+0x2a1/0x480 net/tipc/netlink_compat.c:449
+    __tipc_nl_compat_doit net/tipc/netlink_compat.c:327 [inline]
+    tipc_nl_compat_doit+0x3ac/0xb00 net/tipc/netlink_compat.c:360
+    tipc_nl_compat_handle net/tipc/netlink_compat.c:1178 [inline]
+    tipc_nl_compat_recv+0x1b1b/0x27b0 net/tipc/netlink_compat.c:1281
+
+TLV_GET_DATA_LEN() may return a negtive int value, which will be
+used as size_t (becoming a big unsigned long) passed into memchr,
+cause this issue.
+
+Similar to what it does in tipc_nl_compat_bearer_enable(), this
+fix is to return -EINVAL when TLV_GET_DATA_LEN() is negtive in
+tipc_nl_compat_bearer_disable(), as well as in
+tipc_nl_compat_link_stat_dump() and tipc_nl_compat_link_reset_stats().
+
+v1->v2:
+  - add the missing Fixes tags per Eric's request.
+
+Fixes: 0762216c0ad2 ("tipc: fix uninit-value in tipc_nl_compat_bearer_enable")
+Fixes: 8b66fee7f8ee ("tipc: fix uninit-value in tipc_nl_compat_link_reset_stats")
+Reported-by: syzbot+30eaa8bf392f7fafffaf@syzkaller.appspotmail.com
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/netlink_compat.c |   18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -430,7 +430,11 @@ static int tipc_nl_compat_bearer_disable
+       if (!bearer)
+               return -EMSGSIZE;
+-      len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
++      len = TLV_GET_DATA_LEN(msg->req);
++      if (len <= 0)
++              return -EINVAL;
++
++      len = min_t(int, len, TIPC_MAX_BEARER_NAME);
+       if (!string_is_valid(name, len))
+               return -EINVAL;
+@@ -505,7 +509,11 @@ static int tipc_nl_compat_link_stat_dump
+       name = (char *)TLV_DATA(msg->req);
+-      len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
++      len = TLV_GET_DATA_LEN(msg->req);
++      if (len <= 0)
++              return -EINVAL;
++
++      len = min_t(int, len, TIPC_MAX_BEARER_NAME);
+       if (!string_is_valid(name, len))
+               return -EINVAL;
+@@ -776,7 +784,11 @@ static int tipc_nl_compat_link_reset_sta
+       if (!link)
+               return -EMSGSIZE;
+-      len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
++      len = TLV_GET_DATA_LEN(msg->req);
++      if (len <= 0)
++              return -EINVAL;
++
++      len = min_t(int, len, TIPC_MAX_BEARER_NAME);
+       if (!string_is_valid(name, len))
+               return -EINVAL;