19 Mar, 2019

2 commits

  • [ Upstream commit 1e027960edfaa6a43f9ca31081729b716598112b ]

    syzbot found another add_timer() issue, this time in net/hsr [1]

    Let's use mod_timer() which is safe.

    [1]
    kernel BUG at kernel/time/timer.c:1136!
    invalid opcode: 0000 [#1] PREEMPT SMP KASAN
    CPU: 0 PID: 15909 Comm: syz-executor.3 Not tainted 5.0.0+ #97
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    kobject: 'loop2' (00000000f5629718): kobject_uevent_env
    RIP: 0010:add_timer kernel/time/timer.c:1136 [inline]
    RIP: 0010:add_timer+0x654/0xbe0 kernel/time/timer.c:1134
    Code: 0f 94 c5 31 ff 44 89 ee e8 09 61 0f 00 45 84 ed 0f 84 77 fd ff ff e8 bb 5f 0f 00 e8 07 10 a0 ff e9 68 fd ff ff e8 ac 5f 0f 00 0b e8 a5 5f 0f 00 0f 0b e8 9e 5f 0f 00 4c 89 b5 58 ff ff ff e9
    RSP: 0018:ffff8880656eeca0 EFLAGS: 00010246
    kobject: 'loop2' (00000000f5629718): fill_kobj_path: path = '/devices/virtual/block/loop2'
    RAX: 0000000000040000 RBX: 1ffff1100caddd9a RCX: ffffc9000c436000
    RDX: 0000000000040000 RSI: ffffffff816056c4 RDI: ffff88806a2f6cc8
    RBP: ffff8880656eed58 R08: ffff888067f4a300 R09: ffff888067f4abc8
    R10: 0000000000000000 R11: 0000000000000000 R12: ffff88806a2f6cc0
    R13: dffffc0000000000 R14: 0000000000000001 R15: ffff8880656eed30
    FS: 00007fc2019bf700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000738000 CR3: 0000000067e8e000 CR4: 00000000001406f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
    hsr_check_announce net/hsr/hsr_device.c:99 [inline]
    hsr_check_carrier_and_operstate+0x567/0x6f0 net/hsr/hsr_device.c:120
    hsr_netdev_notify+0x297/0xa00 net/hsr/hsr_main.c:51
    notifier_call_chain+0xc7/0x240 kernel/notifier.c:93
    __raw_notifier_call_chain kernel/notifier.c:394 [inline]
    raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401
    call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1739
    call_netdevice_notifiers_extack net/core/dev.c:1751 [inline]
    call_netdevice_notifiers net/core/dev.c:1765 [inline]
    dev_open net/core/dev.c:1436 [inline]
    dev_open+0x143/0x160 net/core/dev.c:1424
    team_port_add drivers/net/team/team.c:1203 [inline]
    team_add_slave+0xa07/0x15d0 drivers/net/team/team.c:1933
    do_set_master net/core/rtnetlink.c:2358 [inline]
    do_set_master+0x1d4/0x230 net/core/rtnetlink.c:2332
    do_setlink+0x966/0x3510 net/core/rtnetlink.c:2493
    rtnl_setlink+0x271/0x3b0 net/core/rtnetlink.c:2747
    rtnetlink_rcv_msg+0x465/0xb00 net/core/rtnetlink.c:5192
    netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2485
    rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5210
    netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
    netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1336
    netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1925
    sock_sendmsg_nosec net/socket.c:622 [inline]
    sock_sendmsg+0xdd/0x130 net/socket.c:632
    sock_write_iter+0x27c/0x3e0 net/socket.c:923
    call_write_iter include/linux/fs.h:1869 [inline]
    do_iter_readv_writev+0x5e0/0x8e0 fs/read_write.c:680
    do_iter_write fs/read_write.c:956 [inline]
    do_iter_write+0x184/0x610 fs/read_write.c:937
    vfs_writev+0x1b3/0x2f0 fs/read_write.c:1001
    do_writev+0xf6/0x290 fs/read_write.c:1036
    __do_sys_writev fs/read_write.c:1109 [inline]
    __se_sys_writev fs/read_write.c:1106 [inline]
    __x64_sys_writev+0x75/0xb0 fs/read_write.c:1106
    do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
    entry_SYSCALL_64_after_hwframe+0x49/0xbe
    RIP: 0033:0x457f29
    Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
    RSP: 002b:00007fc2019bec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
    RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457f29
    RDX: 0000000000000001 RSI: 00000000200000c0 RDI: 0000000000000003
    RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc2019bf6d4
    R13: 00000000004c4a60 R14: 00000000004dd218 R15: 00000000ffffffff

    Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)")
    Signed-off-by: Eric Dumazet
    Reported-by: syzbot
    Cc: Arvid Brodin
    Signed-off-by: David S. Miller
    Signed-off-by: Greg Kroah-Hartman

    Eric Dumazet
     
  • [ Upstream commit 6caabe7f197d3466d238f70915d65301f1716626 ]

    If hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER) failed to
    add port, it directly returns res and forgets to free the node
    that allocated in hsr_create_self_node(), and forgets to delete
    the node->mac_list linked in hsr->self_node_db.

    BUG: memory leak
    unreferenced object 0xffff8881cfa0c780 (size 64):
    comm "syz-executor.0", pid 2077, jiffies 4294717969 (age 2415.377s)
    hex dump (first 32 bytes):
    e0 c7 a0 cf 81 88 ff ff 00 02 00 00 00 00 ad de ................
    00 e6 49 cd 81 88 ff ff c0 9b 87 d0 81 88 ff ff ..I.............
    backtrace:
    [] hsr_dev_finalize+0x736/0x960 [hsr]
    [] hsr_newlink+0x2b2/0x3e0 [hsr]
    [] __rtnl_newlink+0xf1f/0x1600 net/core/rtnetlink.c:3182
    [] rtnl_newlink+0x66/0x90 net/core/rtnetlink.c:3240
    [] rtnetlink_rcv_msg+0x54e/0xb90 net/core/rtnetlink.c:5130
    [] netlink_rcv_skb+0x129/0x340 net/netlink/af_netlink.c:2477
    [] netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
    [] netlink_unicast+0x49a/0x650 net/netlink/af_netlink.c:1336
    [] netlink_sendmsg+0x88b/0xdf0 net/netlink/af_netlink.c:1917
    [] sock_sendmsg_nosec net/socket.c:621 [inline]
    [] sock_sendmsg+0xc3/0x100 net/socket.c:631
    [] __sys_sendto+0x33e/0x560 net/socket.c:1786
    [] __do_sys_sendto net/socket.c:1798 [inline]
    [] __se_sys_sendto net/socket.c:1794 [inline]
    [] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1794
    [] do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
    [] entry_SYSCALL_64_after_hwframe+0x49/0xbe
    [] 0xffffffffffffffff

    Fixes: c5a759117210 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.")
    Reported-by: Hulk Robot
    Signed-off-by: Mao Wenan
    Signed-off-by: David S. Miller
    Signed-off-by: Greg Kroah-Hartman

    Mao Wenan
     

25 Oct, 2017

1 commit

  • In preparation for unconditionally passing the struct timer_list pointer to
    all timer callbacks, switch to using the new timer_setup() and from_timer()
    to pass the timer pointer explicitly.

    Cc: Arvid Brodin
    Cc: "David S. Miller"
    Cc: netdev@vger.kernel.org
    Signed-off-by: Kees Cook
    Signed-off-by: David S. Miller

    Kees Cook
     

23 Aug, 2017

1 commit

  • skb_put_padto() will free the sk_buff passed as reference in case of
    errors, but we still need to check its return value and decide what to
    do.

    Detected by CoverityScan, CID#1416688 ("CHECKED_RETURN")

    Fixes: ee1c27977284 ("net/hsr: Added support for HSR v1")
    Signed-off-by: Florian Fainelli
    Signed-off-by: David S. Miller

    Florian Fainelli
     

27 Jun, 2017

1 commit


21 Jun, 2017

1 commit


13 Jun, 2017

1 commit

  • When HSR interface is setup using ip link command, an annoying warning
    appears with the trace as below:-

    [ 203.019828] hsr_get_node: Non-HSR frame
    [ 203.019833] Modules linked in:
    [ 203.019848] CPU: 0 PID: 158 Comm: sd-resolve Tainted: G W 4.12.0-rc3-00052-g9fa6bf70 #2
    [ 203.019853] Hardware name: Generic DRA74X (Flattened Device Tree)
    [ 203.019869] [] (unwind_backtrace) from [] (show_stack+0x10/0x14)
    [ 203.019880] [] (show_stack) from [] (dump_stack+0xac/0xe0)
    [ 203.019894] [] (dump_stack) from [] (__warn+0xd8/0x104)
    [ 203.019907] [] (__warn) from [] (warn_slowpath_fmt+0x34/0x44)
    root@am57xx-evm:~# [ 203.019921] [] (warn_slowpath_fmt) from [] (hsr_get_node+0x148/0x170)
    [ 203.019932] [] (hsr_get_node) from [] (hsr_forward_skb+0x110/0x7c0)
    [ 203.019942] [] (hsr_forward_skb) from [] (hsr_dev_xmit+0x2c/0x34)
    [ 203.019954] [] (hsr_dev_xmit) from [] (dev_hard_start_xmit+0xc4/0x3bc)
    [ 203.019963] [] (dev_hard_start_xmit) from [] (__dev_queue_xmit+0x7c4/0x98c)
    [ 203.019974] [] (__dev_queue_xmit) from [] (ip6_finish_output2+0x330/0xc1c)
    [ 203.019983] [] (ip6_finish_output2) from [] (ip6_output+0x58/0x454)
    [ 203.019994] [] (ip6_output) from [] (mld_sendpack+0x420/0x744)

    As this is an expected path to hsr_get_node() with frame coming from
    the master interface, add a check to ensure packet is not from the
    master port and then warn.

    Signed-off-by: Murali Karicheri
    Signed-off-by: David S. Miller

    Karicheri, Muralidharan
     

08 Jun, 2017

1 commit

  • Network devices can allocate reasources and private memory using
    netdev_ops->ndo_init(). However, the release of these resources
    can occur in one of two different places.

    Either netdev_ops->ndo_uninit() or netdev->destructor().

    The decision of which operation frees the resources depends upon
    whether it is necessary for all netdev refs to be released before it
    is safe to perform the freeing.

    netdev_ops->ndo_uninit() presumably can occur right after the
    NETDEV_UNREGISTER notifier completes and the unicast and multicast
    address lists are flushed.

    netdev->destructor(), on the other hand, does not run until the
    netdev references all go away.

    Further complicating the situation is that netdev->destructor()
    almost universally does also a free_netdev().

    This creates a problem for the logic in register_netdevice().
    Because all callers of register_netdevice() manage the freeing
    of the netdev, and invoke free_netdev(dev) if register_netdevice()
    fails.

    If netdev_ops->ndo_init() succeeds, but something else fails inside
    of register_netdevice(), it does call ndo_ops->ndo_uninit(). But
    it is not able to invoke netdev->destructor().

    This is because netdev->destructor() will do a free_netdev() and
    then the caller of register_netdevice() will do the same.

    However, this means that the resources that would normally be released
    by netdev->destructor() will not be.

    Over the years drivers have added local hacks to deal with this, by
    invoking their destructor parts by hand when register_netdevice()
    fails.

    Many drivers do not try to deal with this, and instead we have leaks.

    Let's close this hole by formalizing the distinction between what
    private things need to be freed up by netdev->destructor() and whether
    the driver needs unregister_netdevice() to perform the free_netdev().

    netdev->priv_destructor() performs all actions to free up the private
    resources that used to be freed by netdev->destructor(), except for
    free_netdev().

    netdev->needs_free_netdev is a boolean that indicates whether
    free_netdev() should be done at the end of unregister_netdevice().

    Now, register_netdevice() can sanely release all resources after
    ndo_ops->ndo_init() succeeds, by invoking both ndo_ops->ndo_uninit()
    and netdev->priv_destructor().

    And at the end of unregister_netdevice(), we invoke
    netdev->priv_destructor() and optionally call free_netdev().

    Signed-off-by: David S. Miller

    David S. Miller
     

14 Apr, 2017

1 commit

  • Add the base infrastructure and UAPI for netlink extended ACK
    reporting. All "manual" calls to netlink_ack() pass NULL for now and
    thus don't get extended ACK reporting.

    Big thanks goes to Pablo Neira Ayuso for not only bringing up the
    whole topic at netconf (again) but also coming up with the nlattr
    passing trick and various other ideas.

    Signed-off-by: Johannes Berg
    Reviewed-by: David Ahern
    Signed-off-by: David S. Miller

    Johannes Berg
     

22 Feb, 2017

1 commit


07 Feb, 2017

1 commit

  • This patch makes use of is_vlan_dev() function instead of flag
    comparison which is exactly done by is_vlan_dev() helper function.

    Signed-off-by: Parav Pandit
    Reviewed-by: Daniel Jurgens
    Acked-by: Stephen Hemminger
    Acked-by: Jon Maxwell
    Acked-by: Johannes Thumshirn
    Acked-by: Haiyang Zhang
    Signed-off-by: David S. Miller

    Parav Pandit
     

31 Oct, 2016

1 commit


28 Oct, 2016

3 commits

  • Now genl_register_family() is the only thing (other than the
    users themselves, perhaps, but I didn't find any doing that)
    writing to the family struct.

    In all families that I found, genl_register_family() is only
    called from __init functions (some indirectly, in which case
    I've add __init annotations to clarifly things), so all can
    actually be marked __ro_after_init.

    This protects the data structure from accidental corruption.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • Instead of providing macros/inline functions to initialize
    the families, make all users initialize them statically and
    get rid of the macros.

    This reduces the kernel code size by about 1.6k on x86-64
    (with allyesconfig).

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • Static family IDs have never really been used, the only
    use case was the workaround I introduced for those users
    that assumed their family ID was also their multicast
    group ID.

    Additionally, because static family IDs would never be
    reserved by the generic netlink code, using a relatively
    low ID would only work for built-in families that can be
    registered immediately after generic netlink is started,
    which is basically only the control family (apart from
    the workaround code, which I also had to add code for so
    it would reserve those IDs)

    Thus, anything other than GENL_ID_GENERATE is flawed and
    luckily not used except in the cases I mentioned. Move
    those workarounds into a few lines of code, and then get
    rid of GENL_ID_GENERATE entirely, making it more robust.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     

21 Oct, 2016

1 commit

  • firewire-net:
    - set min/max_mtu
    - remove fwnet_change_mtu

    nes:
    - set max_mtu
    - clean up nes_netdev_change_mtu

    xpnet:
    - set min/max_mtu
    - remove xpnet_dev_change_mtu

    hippi:
    - set min/max_mtu
    - remove hippi_change_mtu

    batman-adv:
    - set max_mtu
    - remove batadv_interface_change_mtu
    - initialization is a little async, not 100% certain that max_mtu is set
    in the optimal place, don't have hardware to test with

    rionet:
    - set min/max_mtu
    - remove rionet_change_mtu

    slip:
    - set min/max_mtu
    - streamline sl_change_mtu

    um/net_kern:
    - remove pointless ndo_change_mtu

    hsi/clients/ssi_protocol:
    - use core MTU range checking
    - remove now redundant ssip_pn_set_mtu

    ipoib:
    - set a default max MTU value
    - Note: ipoib's actual max MTU can vary, depending on if the device is in
    connected mode or not, so we'll just set the max_mtu value to the max
    possible, and let the ndo_change_mtu function continue to validate any new
    MTU change requests with checks for CM or not. Note that ipoib has no
    min_mtu set, and thus, the network core's mtu > 0 check is the only lower
    bounds here.

    mptlan:
    - use net core MTU range checking
    - remove now redundant mpt_lan_change_mtu

    fddi:
    - min_mtu = 21, max_mtu = 4470
    - remove now redundant fddi_change_mtu (including export)

    fjes:
    - min_mtu = 8192, max_mtu = 65536
    - The max_mtu value is actually one over IP_MAX_MTU here, but the idea is to
    get past the core net MTU range checks so fjes_change_mtu can validate a
    new MTU against what it supports (see fjes_support_mtu in fjes_hw.c)

    hsr:
    - min_mtu = 0 (calls ether_setup, max_mtu is 1500)

    f_phonet:
    - min_mtu = 6, max_mtu = 65541

    u_ether:
    - min_mtu = 14, max_mtu = 15412

    phonet/pep-gprs:
    - min_mtu = 576, max_mtu = 65530
    - remove redundant gprs_set_mtu

    CC: netdev@vger.kernel.org
    CC: linux-rdma@vger.kernel.org
    CC: Stefan Richter
    CC: Faisal Latif
    CC: linux-rdma@vger.kernel.org
    CC: Cliff Whickman
    CC: Robin Holt
    CC: Jes Sorensen
    CC: Marek Lindner
    CC: Simon Wunderlich
    CC: Antonio Quartulli
    CC: Sathya Prakash
    CC: Chaitra P B
    CC: Suganath Prabu Subramani
    CC: MPT-FusionLinux.pdl@broadcom.com
    CC: Sebastian Reichel
    CC: Felipe Balbi
    CC: Arvid Brodin
    CC: Remi Denis-Courmont
    Signed-off-by: Jarod Wilson
    Signed-off-by: David S. Miller

    Jarod Wilson
     

18 Oct, 2016

1 commit

  • Remove the unused but set variable master_dev in check_local_dest to fix
    the following GCC warning when building with 'W=1':

    net/hsr/hsr_forward.c: In function ‘check_local_dest’:
    net/hsr/hsr_forward.c:303:21: warning: variable ‘master_dev’ set but not used [-Wunused-but-set-variable]

    Signed-off-by: Tobias Klauser
    Signed-off-by: David S. Miller

    Tobias Klauser
     

17 May, 2016

1 commit

  • The function setup_timer combines the initialization of a timer with the
    initialization of the timer's function and data fields. The mulitiline
    code for timer initialization is now replaced with function setup_timer.

    Also, quoting the mod_timer() function comment:
    -> mod_timer() is a more efficient way to update the expire field of an
    active timer (if the timer is inactive it will be activated).

    Use setup_timer() and mod_timer() to setup and arm a timer, making the
    code compact and aid readablity.

    Signed-off-by: Muhammad Falak R Wani
    Signed-off-by: David S. Miller

    Muhammad Falak R Wani
     

22 Apr, 2016

1 commit


16 Apr, 2016

1 commit

  • This patch adds support for the newer version 1 of the HSR
    networking standard. Version 0 is still default and the new
    version has to be selected via iproute2.

    Main changes are in the supervision frame handling and its
    ethertype field.

    Signed-off-by: Peter Heise
    Signed-off-by: David S. Miller

    Peter Heise
     

24 Nov, 2015

1 commit


19 Aug, 2015

1 commit


02 Mar, 2015

1 commit

  • To repeat:

    $ sudo ip link del hsr0
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
    IP: [] hsr_del_port+0x15/0xa0
    etc...

    Bug description:

    As part of the hsr master device destruction, hsr_del_port() is called for each of
    the hsr ports. At each such call, the master device is updated regarding features
    and mtu. When the master device is freed before the slave interfaces, master will
    be NULL in hsr_del_port(), which led to a NULL pointer dereference.

    Additionally, dev_put() was called on the master device itself in hsr_del_port(),
    causing a refcnt error.

    A third bug in the same code path was that the rtnl lock was not taken before
    hsr_del_port() was called as part of hsr_dev_destroy().

    The reporter (Nicolas Dichtel) also said: "hsr_netdev_notify() supposes that the
    port will always be available when the notification is for an hsr interface. It's
    wrong. For example, netdev_wait_allrefs() may resend NETDEV_UNREGISTER.". As a
    precaution against this, a check for port == NULL was added in hsr_dev_notify().

    Reported-by: Nicolas Dichtel
    Fixes: 51f3c605318b056a ("net/hsr: Move slave init to hsr_slave.c.")
    Signed-off-by: Arvid Brodin
    Signed-off-by: David S. Miller

    Arvid Brodin
     

12 Jul, 2014

1 commit


09 Jul, 2014

10 commits


28 Mar, 2014

1 commit

  • Use del_timer_sync to ensure that the timer is stopped on all CPUs before
    the driver exists.

    This change was suggested by Thomas Gleixner.

    The semantic patch that makes this change is as follows:
    (http://coccinelle.lip6.fr/)

    //
    @r@
    declarer name module_exit;
    identifier ex;
    @@

    module_exit(ex);

    @@
    identifier r.ex;
    @@

    ex(...) {

    }
    //

    Signed-off-by: Julia Lawall
    Signed-off-by: David S. Miller

    Julia Lawall
     

06 Mar, 2014

1 commit

  • Conflicts:
    drivers/net/wireless/ath/ath9k/recv.c
    drivers/net/wireless/mwifiex/pcie.c
    net/ipv6/sit.c

    The SIT driver conflict consists of a bug fix being done by hand
    in 'net' (missing u64_stats_init()) whilst in 'net-next' a helper
    was created (netdev_alloc_pcpu_stats()) which takes care of this.

    The two wireless conflicts were overlapping changes.

    Signed-off-by: David S. Miller

    David S. Miller
     

04 Mar, 2014

1 commit


19 Feb, 2014

1 commit


18 Dec, 2013

1 commit


01 Dec, 2013

1 commit