02 May, 2019

1 commit

  • The commit ae97fd867aa3 ("MLK-19091 cfg80211: make phy index match
    after wiphy dev is released") manage wiphy_counter matching between
    creating and freeing wiphy device. Then for one wifi instance, the index
    of attached phy is not changed during loadable test. But it ignores
    multiple wifi cards loadable test case, that introduces the phy index
    confliction. So the patch revert the commit.

    Reviewed-by: Richard Zhu
    Signed-off-by: Fugang Duan
    Signed-off-by: Arulpandiyan Vadivel
    Signed-off-by: Shrikant Bobade
    (cherry picked from commit 4bfe854b650f1e8bc46624d5f3b559f0112f327a)

    Andy Duan
     

18 Apr, 2019

2 commits

  • During insmod/rmmod test, the phy index increases that cause troube
    for test case. To make global variable wiphy_counter match between
    creat and free wiphy device, it needs to decrease the atomic counter
    when wiphy device is freed.

    Reviewed-by: Richard Zhu
    Signed-off-by: Fugang Duan
    Signed-off-by: Vipul Kumar

    Andy Duan
     
  • [Patch] Pulling the following commits and some general changes
    from custom v3.10 kernel for supporting qcacld2.0 on kernel v4.9.11.
    1. cfg80211: Using new wiphy flag WIPHY_FLAG_DFS_OFFLOAD
    When flag WIPHY_FLAG_DFS_OFFLOAD is defined, the driver would handle
    all the DFS related operations. Therefore the kernel needs to ignore
    the DFS state that it uses to block the userspace calls to the driver
    through cfg80211 APIs. Also it should treat the userspace calls to
    start radar detection as a no-op.

    Please note that changes in util.c is not picked up explicitly.
    Kernel v4.9.11 uses wrapper cfg80211_get_chans_dfs_required which takes
    care of this change.

    Change-Id: I9dd2076945581ca67e54dfc96dd3dbc526c6f0a2
    IRs-Fixed: 202686

    2. New db.txt from git/sforshee/wireless-regdb.git
    CONFIG_CFG80211_INTERNAL_REGDB is enabled in build. This causes
    kernel warn messages as db.txt is empty. A new db.txt is added
    from:
    git://git.kernel.org/pub/scm/linux/kernel/git/sforshee/wireless-regdb.git

    IRs-Fixed: 202686

    3. Picked up the declaration and definition of the function
    cfg80211_is_gratuitous_arp_unsolicited_na

    Change-Id: I1e4083a2327c121073226aa6b75bb6b5b97cec00
    CRs-fixed: 1079453

    Signed-off-by: Nakul Kachhwaha
    Signed-off-by: Fugang Duan
    (Vipul: Fixed merge conflicts)
    (TODO: checkpatch warnings)
    Signed-off-by: Vipul Kumar

    Nakul Kachhwaha
     

06 Mar, 2019

1 commit

  • [ Upstream commit 93183bdbe73bbdd03e9566c8dc37c9d06b0d0db6 ]

    Recently, DMG frequency bands have been extended till 71GHz, so extend
    the range check till 20GHz (45-71GHZ), else some channels will be marked
    as disabled.

    Signed-off-by: Chaitanya Tata
    Signed-off-by: Johannes Berg
    Signed-off-by: Sasha Levin

    Chaitanya Tata
     

13 Jan, 2019

1 commit


13 Dec, 2018

1 commit

  • commit 312ca38ddda64bac6513ec68e0ac3789b4eb44dc upstream.

    This function was modified to support the information element extension
    case (WLAN_EID_EXTENSION) in a manner that would result in an infinite
    loop when going through set of IEs that include WLAN_EID_RIC_DATA and
    contain an IE that is in the after_ric array. The only place where this
    can currently happen is in mac80211 ieee80211_send_assoc() where
    ieee80211_ie_split_ric() is called with after_ric[].

    This can be triggered by valid data from user space nl80211
    association/connect request (i.e., requiring GENL_UNS_ADMIN_PERM). The
    only known application having an option to include WLAN_EID_RIC_DATA in
    these requests is wpa_supplicant and it had a bug that prevented this
    specific contents from being used (and because of that, not triggering
    this kernel bug in an automated test case ap_ft_ric) and now that this
    bug is fixed, it has a workaround to avoid this kernel issue.
    WLAN_EID_RIC_DATA is currently used only for testing purposes, so this
    does not cause significant harm for production use cases.

    Fixes: 2512b1b18d07 ("mac80211: extend ieee80211_ie_split to support EXTENSION")
    Cc: stable@vger.kernel.org
    Signed-off-by: Jouni Malinen
    Signed-off-by: Johannes Berg
    Signed-off-by: Greg Kroah-Hartman

    Jouni Malinen
     

01 Oct, 2018

2 commits

  • reg_process_hint_country_ie() can free regulatory_request and return
    REG_REQ_ALREADY_SET. We shouldn't use regulatory_request after it's
    called. KASAN error was observed when this happens.

    BUG: KASAN: use-after-free in reg_process_hint+0x839/0x8aa [cfg80211]
    Read of size 4 at addr ffff8800c430d434 by task kworker/1:3/89

    Workqueue: events reg_todo [cfg80211]
    Call Trace:
    dump_stack+0xc1/0x10c
    ? _atomic_dec_and_lock+0x1ad/0x1ad
    ? _raw_spin_lock_irqsave+0xa0/0xd2
    print_address_description+0x86/0x26f
    ? reg_process_hint+0x839/0x8aa [cfg80211]
    kasan_report+0x241/0x29b
    reg_process_hint+0x839/0x8aa [cfg80211]
    reg_todo+0x204/0x5b9 [cfg80211]
    process_one_work+0x55f/0x8d0
    ? worker_detach_from_pool+0x1b5/0x1b5
    ? _raw_spin_unlock_irq+0x65/0xdd
    ? _raw_spin_unlock_irqrestore+0xf3/0xf3
    worker_thread+0x5dd/0x841
    ? kthread_parkme+0x1d/0x1d
    kthread+0x270/0x285
    ? pr_cont_work+0xe3/0xe3
    ? rcu_read_unlock_sched_notrace+0xca/0xca
    ret_from_fork+0x22/0x40

    Allocated by task 2718:
    set_track+0x63/0xfa
    __kmalloc+0x119/0x1ac
    regulatory_hint_country_ie+0x38/0x329 [cfg80211]
    __cfg80211_connect_result+0x854/0xadd [cfg80211]
    cfg80211_rx_assoc_resp+0x3bc/0x4f0 [cfg80211]
    smsc95xx v1.0.6
    ieee80211_sta_rx_queued_mgmt+0x1803/0x7ed5 [mac80211]
    ieee80211_iface_work+0x411/0x696 [mac80211]
    process_one_work+0x55f/0x8d0
    worker_thread+0x5dd/0x841
    kthread+0x270/0x285
    ret_from_fork+0x22/0x40

    Freed by task 89:
    set_track+0x63/0xfa
    kasan_slab_free+0x6a/0x87
    kfree+0xdc/0x470
    reg_process_hint+0x31e/0x8aa [cfg80211]
    reg_todo+0x204/0x5b9 [cfg80211]
    process_one_work+0x55f/0x8d0
    worker_thread+0x5dd/0x841
    kthread+0x270/0x285
    ret_from_fork+0x22/0x40

    Signed-off-by: Yu Zhao
    Signed-off-by: Johannes Berg

    Yu Zhao
     
  • cfg80211_wext_giwrate and sinfo.pertid might allocate sinfo.pertid via
    rdev_get_station(), but never release it. Fix that.

    Fixes: 8689c051a201 ("cfg80211: dynamically allocate per-tid stats for station info")
    Signed-off-by: Stefan Seyfried
    [johannes: fix error path, use cfg80211_sinfo_release_content(), add Fixes]
    Signed-off-by: Johannes Berg

    Stefan Seyfried
     

27 Sep, 2018

1 commit


26 Sep, 2018

1 commit


10 Sep, 2018

1 commit

  • cfg80211_get_bss_channel() is used to update the RX channel based on the
    available frame payload information (channel number from DSSS Parameter
    Set element or HT Operation element). This is needed on 2.4 GHz channels
    where frames may be received on neighboring channels due to overlapping
    frequency range.

    This might of some use on the 5 GHz band in some corner cases, but
    things are more complex there since there is no n:1 or 1:n mapping
    between channel numbers and frequencies due to multiple different
    starting frequencies in different operating classes. This could result
    in ieee80211_channel_to_frequency() returning incorrect frequency and
    ieee80211_get_channel() returning incorrect channel information (or
    indication of no match). In the previous implementation, this could
    result in some scan results being dropped completely, e.g., for the 4.9
    GHz channels. That prevented connection to such BSSs.

    Fix this by using the driver-provided channel pointer if
    ieee80211_get_channel() does not find matching channel data for the
    channel number in the frame payload and if the scan is done with 5 MHz
    or 10 MHz channel bandwidth. While doing this, also add comments
    describing what the function is trying to achieve to make it easier to
    understand what happens here and why.

    Signed-off-by: Jouni Malinen
    Signed-off-by: Johannes Berg

    Jouni Malinen
     

05 Sep, 2018

1 commit

  • Core regulatory hints didn't set wiphy_idx to WIPHY_IDX_INVALID. Since
    the regulatory request is zeroed, wiphy_idx was always implicitly set to
    0. This resulted in updating only phy #0.
    Fix that.

    Fixes: 806a9e39670b ("cfg80211: make regulatory_request use wiphy_idx instead of wiphy")
    Signed-off-by: Andrei Otcheretianski
    Signed-off-by: Luca Coelho
    [add fixes tag]
    Signed-off-by: Johannes Berg

    Andrei Otcheretianski
     

04 Sep, 2018

1 commit

  • …kernel/git/jberg/mac80211

    Johannes Berg says:

    ====================
    Here are quite a large number of fixes, notably:
    * various A-MSDU building fixes (currently only affects mt76)
    * syzkaller & spectre fixes in hwsim
    * TXQ vs. teardown fix that was causing crashes
    * embed WMM info in reg rule, bad code here had been causing crashes
    * one compilation issue with fix from Arnd (rfkill-gpio includes)
    * fixes for a race and bad data during/after channel switch
    * nl80211: a validation fix, attribute type & unit fixes
    along with other small fixes.
    ====================

    Signed-off-by: David S. Miller <davem@davemloft.net>

    David S. Miller
     

03 Sep, 2018

1 commit


30 Aug, 2018

1 commit

  • nl80211_update_ft_ies() tried to validate NL80211_ATTR_IE with
    is_valid_ie_attr() before dereferencing it, but that helper function
    returns true in case of NULL pointer (i.e., attribute not included).
    This can result to dereferencing a NULL pointer. Fix that by explicitly
    checking that NL80211_ATTR_IE is included.

    Fixes: 355199e02b83 ("cfg80211: Extend support for IEEE 802.11r Fast BSS Transition")
    Signed-off-by: Arunk Khandavalli
    Signed-off-by: Jouni Malinen
    Signed-off-by: Johannes Berg

    Arunk Khandavalli
     

28 Aug, 2018

3 commits

  • freq_reg_info expects to get the frequency in kHz. Instead we
    accidently pass it in MHz. Thus, currently the function always
    return ERR rule. Fix that.

    Fixes: 50f32718e125 ("nl80211: Add wmm rule attribute to NL80211_CMD_GET_WIPHY dump command")
    Signed-off-by: Haim Dreyfuss
    Signed-off-by: Luca Coelho
    [fix kHz/MHz in commit message]
    Signed-off-by: Johannes Berg

    Haim Dreyfuss
     
  • TXOP (also known as Channel Occupancy Time) is u16 and should be
    added using nla_put_u16 instead of u8, fix that.

    Fixes: 50f32718e125 ("nl80211: Add wmm rule attribute to NL80211_CMD_GET_WIPHY dump command")
    Signed-off-by: Haim Dreyfuss
    Signed-off-by: Luca Coelho
    Signed-off-by: Johannes Berg

    Haim Dreyfuss
     
  • Make wmm_rule be part of the reg_rule structure. This simplifies the
    code a lot at the cost of having bigger memory usage. However in most
    cases we have only few reg_rule's and when we do have many like in
    iwlwifi we do not save memory as it allocates a separate wmm_rule for
    each channel anyway.

    This also fixes a bug reported in various places where somewhere the
    pointers were corrupted and we ended up doing a null-dereference.

    Fixes: 230ebaa189af ("cfg80211: read wmm rules from regulatory database")
    Signed-off-by: Stanislaw Gruszka
    [rephrase commit message slightly]
    Signed-off-by: Johannes Berg

    Stanislaw Gruszka
     

20 Aug, 2018

1 commit


25 Jul, 2018

1 commit


24 Jul, 2018

2 commits

  • In preparing to remove all stack VLA usage from the kernel[1], this
    removes the discouraged use of AHASH_REQUEST_ON_STACK in favor of
    the smaller SHASH_DESC_ON_STACK by converting from ahash-wrapped-shash
    to direct shash. The stack allocation will be made a fixed size in a
    later patch to the crypto subsystem.

    [1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com

    Signed-off-by: Kees Cook
    Signed-off-by: Johannes Berg

    Kees Cook
     
  • Currently user regulatory hint is ignored if all wiphys
    in the system are self managed. But the hint is not ignored
    if there is no wiphy in the system. This affects the global
    regulatory setting. Global regulatory setting needs to be
    maintained so that it can be applied to a new wiphy entering
    the system. Therefore, do not ignore user regulatory setting
    even if all wiphys in the system are self managed.

    Signed-off-by: Amar Singhal
    Signed-off-by: Johannes Berg

    Amar Singhal
     

09 Jul, 2018

1 commit

  • I was looking at usually suppressed gcc warnings,
    [-Wimplicit-fallthrough=] in this case:

    The code definitely looks like a break is missing here.
    However I am not able to test the NL80211_IFTYPE_MESH_POINT,
    nor do I actually know what might be :)
    So please use this patch with caution and only if you are
    able to do some testing.

    Signed-off-by: Bernd Edlinger
    [johannes: looks obvious enough to apply as is, interesting
    though that it never seems to have been a problem]
    Signed-off-by: Johannes Berg

    Bernd Edlinger
     

06 Jul, 2018

1 commit

  • The current implementation of cfg80211_rx_control_port assumed that the
    caller could provide a contiguous region of memory for the control port
    frame to be sent up to userspace. Unfortunately, many drivers produce
    non-linear skbs, especially for data frames. This resulted in userspace
    getting notified of control port frames with correct metadata (from
    address, port, etc) yet garbage / nonsense contents, resulting in bad
    handshakes, disconnections, etc.

    mac80211 linearizes skbs containing management frames. But it didn't
    seem worthwhile to do this for control port frames. Thus the signature
    of cfg80211_rx_control_port was changed to take the skb directly.
    nl80211 then takes care of obtaining control port frame data directly
    from the (linear | non-linear) skb.

    The caller is still responsible for freeing the skb,
    cfg80211_rx_control_port does not take ownership of it.

    Fixes: 6a671a50f819 ("nl80211: Add CMD_CONTROL_PORT_FRAME API")
    Signed-off-by: Denis Kenzior
    [fix some kernel-doc formatting, add fixes tag]
    Signed-off-by: Johannes Berg

    Denis Kenzior
     

03 Jul, 2018

1 commit


30 Jun, 2018

1 commit

  • …inux/kernel/git/jberg/mac80211-next

    Small merge conflict in net/mac80211/scan.c, I preserved
    the kcalloc() conversion. -DaveM

    Johannes Berg says:

    ====================
    This round's updates:
    * finally some of the promised HE code, but it turns
    out to be small - but everything kept changing, so
    one part I did in the driver was >30 patches for
    what was ultimately <200 lines of code ... similar
    here for this code.
    * improved scan privacy support - can now specify scan
    flags for randomizing the sequence number as well as
    reducing the probe request element content
    * rfkill cleanups
    * a timekeeping cleanup from Arnd
    * various other cleanups
    ====================

    Signed-off-by: David S. Miller <davem@davemloft.net>

    David S. Miller
     

29 Jun, 2018

4 commits

  • The BIT macro uses unsigned long which some architectures handle as 32 bit
    and therefore might cause macro's shift to overflow when used on a value
    equals or larger than 32 (NL80211_STA_INFO_RX_DURATION and afterwards).

    Since 'filled' member in station_info changed to u64, BIT_ULL macro
    should be used with all NL80211_STA_INFO_* attribute types instead of BIT
    to prevent future possible bugs when one will use BIT macro for higher
    attributes by mistake.

    This commit cleans up all usages of BIT macro with the above field
    in cfg80211 by changing it to BIT_ULL instead. In addition, there are
    some places which don't use BIT nor BIT_ULL macros so align those as well.

    Signed-off-by: Omer Efrat
    Signed-off-by: Johannes Berg

    Omer Efrat
     
  • The cfg80211 layer uses get_seconds() to read the current time
    in its supend handling. This function is deprecated because of the 32-bit
    time_t overflow, and it can cause unexpected behavior when the time
    changes due to settimeofday() calls or leap second updates.

    In many cases, we want to use monotonic time instead, however cfg80211
    explicitly tracks the time spent in suspend, so this changes the
    driver over to use ktime_get_boottime_seconds(), which is slightly
    slower, but not used in a fastpath here.

    Signed-off-by: Arnd Bergmann
    Signed-off-by: Johannes Berg

    Arnd Bergmann
     
  • At the very least we should check the return value if
    nla_parse_nested() is called with a non-NULL policy.

    Signed-off-by: Johannes Berg

    Johannes Berg
     
  • Commit 9757235f451c, "nl80211: correct checks for
    NL80211_MESHCONF_HT_OPMODE value") relaxed the range for the HT
    operation field in meshconf, while also adding checks requiring
    the non-greenfield and non-ht-sta bits to be set in certain
    circumstances. The latter bit is actually reserved for mesh BSSes
    according to Table 9-168 in 802.11-2016, so in fact it should not
    be set.

    wpa_supplicant sets these bits because the mesh and AP code share
    the same implementation, but authsae does not. As a result, some
    meshconf updates from authsae which set only the NONHT_MIXED
    protection bits were being rejected.

    In order to avoid breaking userspace by changing the rules again,
    simply accept the values with or without the bits set, and mask
    off the reserved bit to match the spec.

    While in here, update the 802.11-2012 reference to 802.11-2016.

    Fixes: 9757235f451c ("nl80211: correct checks for NL80211_MESHCONF_HT_OPMODE value")
    Cc: Masashi Honma
    Signed-off-by: Bob Copeland
    Reviewed-by: Masashi Honma
    Reviewed-by: Masashi Honma
    Signed-off-by: Johannes Berg

    Bob Copeland
     

16 Jun, 2018

1 commit

  • Pull networking fixes from David Miller:

    1) Various netfilter fixlets from Pablo and the netfilter team.

    2) Fix regression in IPVS caused by lack of PMTU exceptions on local
    routes in ipv6, from Julian Anastasov.

    3) Check pskb_trim_rcsum for failure in DSA, from Zhouyang Jia.

    4) Don't crash on poll in TLS, from Daniel Borkmann.

    5) Revert SO_REUSE{ADDR,PORT} change, it regresses various things
    including Avahi mDNS. From Bart Van Assche.

    6) Missing of_node_put in qcom/emac driver, from Yue Haibing.

    7) We lack checking of the TCP checking in one special case during SYN
    receive, from Frank van der Linden.

    8) Fix module init error paths of mac80211 hwsim, from Johannes Berg.

    9) Handle 802.1ad properly in stmmac driver, from Elad Nachman.

    10) Must grab HW caps before doing quirk checks in stmmac driver, from
    Jose Abreu.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (81 commits)
    net: stmmac: Run HWIF Quirks after getting HW caps
    neighbour: skip NTF_EXT_LEARNED entries during forced gc
    net: cxgb3: add error handling for sysfs_create_group
    tls: fix waitall behavior in tls_sw_recvmsg
    tls: fix use-after-free in tls_push_record
    l2tp: filter out non-PPP sessions in pppol2tp_tunnel_ioctl()
    l2tp: reject creation of non-PPP sessions on L2TPv2 tunnels
    mlxsw: spectrum_switchdev: Fix port_vlan refcounting
    mlxsw: spectrum_router: Align with new route replace logic
    mlxsw: spectrum_router: Allow appending to dev-only routes
    ipv6: Only emit append events for appended routes
    stmmac: added support for 802.1ad vlan stripping
    cfg80211: fix rcu in cfg80211_unregister_wdev
    mac80211: Move up init of TXQs
    mac80211_hwsim: fix module init error paths
    cfg80211: initialize sinfo in cfg80211_get_station
    nl80211: fix some kernel doc tag mistakes
    hv_netvsc: Fix the variable sizes in ipsecv2 and rsc offload
    rds: avoid unenecessary cong_update in loop transport
    l2tp: clean up stale tunnel or session in pppol2tp_connect's error path
    ...

    Linus Torvalds
     

15 Jun, 2018

7 commits

  • Add support for the HE in cfg80211 and also add userspace API to
    nl80211 to send rate information out, conforming with P802.11ax_D2.0.

    Signed-off-by: Liad Kaufman
    Signed-off-by: Johannes Berg
    Signed-off-by: Ilan Peer
    Signed-off-by: Ido Yariv
    Signed-off-by: Luca Coelho
    Signed-off-by: Johannes Berg

    Luca Coelho
     
  • User space tools might be interested in knowing the current
    status of the 4ADDR property of an interface (when supported).

    Send the status along with the other attributes when replying
    to a GET_INTERFACE netlink query.

    Signed-off-by: Antonio Quartulli
    Signed-off-by: Johannes Berg

    Antonio Quartulli
     
  • Add the scan flags for randomized SN and minimized probe request
    content for improved scan privacy.

    Signed-off-by: Johannes Berg
    Signed-off-by: Johannes Berg

    Johannes Berg
     
  • There's a very common pattern to check for a scan flag and
    then reject it if an extended feature flag isn't set, factor
    this out into a helper function.

    Signed-off-by: Johannes Berg
    Signed-off-by: Johannes Berg

    Johannes Berg
     
  • The arguments should be (# of elements, size of each) instead
    of the other way around, which really ends up being mostly
    equivalent but smatch complains about it, so swap them.

    Signed-off-by: Johannes Berg
    Signed-off-by: Johannes Berg

    Johannes Berg
     
  • Callers of cfg80211_unregister_wdev can free the wdev object
    immediately after this function returns. This may crash the kernel
    because this wdev object is still in use by other threads.
    Add synchronize_rcu() after list_del_rcu to make sure wdev object can
    be safely freed.

    Signed-off-by: Dedy Lansky
    Signed-off-by: Johannes Berg

    Dedy Lansky
     
  • Most of the implementations behind cfg80211_get_station will not initialize
    sinfo to zero before manipulating it. For example, the member "filled",
    which indicates the filled in parts of this struct, is often only modified
    by enabling certain bits in the bitfield while keeping the remaining bits
    in their original state. A caller without a preinitialized sinfo.filled can
    then no longer decide which parts of sinfo were filled in by
    cfg80211_get_station (or actually the underlying implementations).

    cfg80211_get_station must therefore take care that sinfo is initialized to
    zero. Otherwise, the caller may tries to read information which was not
    filled in and which must therefore also be considered uninitialized. In
    batadv_v_elp_get_throughput's case, an invalid "random" expected throughput
    may be stored for this neighbor and thus the B.A.T.M.A.N V algorithm may
    switch to non-optimal neighbors for certain destinations.

    Fixes: 7406353d43c8 ("cfg80211: implement cfg80211_get_station cfg80211 API")
    Reported-by: Thomas Lauer
    Reported-by: Marcel Schmidt
    Cc: b.a.t.m.a.n@lists.open-mesh.org
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Johannes Berg

    Sven Eckelmann
     

13 Jun, 2018

1 commit

  • The kzalloc() function has a 2-factor argument form, kcalloc(). This
    patch replaces cases of:

    kzalloc(a * b, gfp)

    with:
    kcalloc(a * b, gfp)

    as well as handling cases of:

    kzalloc(a * b * c, gfp)

    with:

    kzalloc(array3_size(a, b, c), gfp)

    as it's slightly less ugly than:

    kzalloc_array(array_size(a, b), c, gfp)

    This does, however, attempt to ignore constant size factors like:

    kzalloc(4 * 1024, gfp)

    though any constants defined via macros get caught up in the conversion.

    Any factors with a sizeof() of "unsigned char", "char", and "u8" were
    dropped, since they're redundant.

    The Coccinelle script used for this was:

    // Fix redundant parens around sizeof().
    @@
    type TYPE;
    expression THING, E;
    @@

    (
    kzalloc(
    - (sizeof(TYPE)) * E
    + sizeof(TYPE) * E
    , ...)
    |
    kzalloc(
    - (sizeof(THING)) * E
    + sizeof(THING) * E
    , ...)
    )

    // Drop single-byte sizes and redundant parens.
    @@
    expression COUNT;
    typedef u8;
    typedef __u8;
    @@

    (
    kzalloc(
    - sizeof(u8) * (COUNT)
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(__u8) * (COUNT)
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(char) * (COUNT)
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(unsigned char) * (COUNT)
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(u8) * COUNT
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(__u8) * COUNT
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(char) * COUNT
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(unsigned char) * COUNT
    + COUNT
    , ...)
    )

    // 2-factor product with sizeof(type/expression) and identifier or constant.
    @@
    type TYPE;
    expression THING;
    identifier COUNT_ID;
    constant COUNT_CONST;
    @@

    (
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * (COUNT_ID)
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * COUNT_ID
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * (COUNT_CONST)
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * COUNT_CONST
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * (COUNT_ID)
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * COUNT_ID
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * (COUNT_CONST)
    + COUNT_CONST, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * COUNT_CONST
    + COUNT_CONST, sizeof(THING)
    , ...)
    )

    // 2-factor product, only identifiers.
    @@
    identifier SIZE, COUNT;
    @@

    - kzalloc
    + kcalloc
    (
    - SIZE * COUNT
    + COUNT, SIZE
    , ...)

    // 3-factor product with 1 sizeof(type) or sizeof(expression), with
    // redundant parens removed.
    @@
    expression THING;
    identifier STRIDE, COUNT;
    type TYPE;
    @@

    (
    kzalloc(
    - sizeof(TYPE) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kzalloc(
    - sizeof(THING) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kzalloc(
    - sizeof(THING) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kzalloc(
    - sizeof(THING) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kzalloc(
    - sizeof(THING) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    )

    // 3-factor product with 2 sizeof(variable), with redundant parens removed.
    @@
    expression THING1, THING2;
    identifier COUNT;
    type TYPE1, TYPE2;
    @@

    (
    kzalloc(
    - sizeof(TYPE1) * sizeof(TYPE2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kzalloc(
    - sizeof(THING1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kzalloc(
    - sizeof(THING1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    )

    // 3-factor product, only identifiers, with redundant parens removed.
    @@
    identifier STRIDE, SIZE, COUNT;
    @@

    (
    kzalloc(
    - (COUNT) * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - COUNT * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - COUNT * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - (COUNT) * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - COUNT * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - (COUNT) * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - (COUNT) * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - COUNT * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    )

    // Any remaining multi-factor products, first at least 3-factor products,
    // when they're not all constants...
    @@
    expression E1, E2, E3;
    constant C1, C2, C3;
    @@

    (
    kzalloc(C1 * C2 * C3, ...)
    |
    kzalloc(
    - (E1) * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kzalloc(
    - (E1) * (E2) * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kzalloc(
    - (E1) * (E2) * (E3)
    + array3_size(E1, E2, E3)
    , ...)
    |
    kzalloc(
    - E1 * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    )

    // And then all remaining 2 factors products when they're not all constants,
    // keeping sizeof() as the second factor argument.
    @@
    expression THING, E1, E2;
    type TYPE;
    constant C1, C2, C3;
    @@

    (
    kzalloc(sizeof(THING) * C2, ...)
    |
    kzalloc(sizeof(TYPE) * C2, ...)
    |
    kzalloc(C1 * C2 * C3, ...)
    |
    kzalloc(C1 * C2, ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * (E2)
    + E2, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * E2
    + E2, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * (E2)
    + E2, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * E2
    + E2, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - (E1) * E2
    + E1, E2
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - (E1) * (E2)
    + E1, E2
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - E1 * E2
    + E1, E2
    , ...)
    )

    Signed-off-by: Kees Cook

    Kees Cook
     

07 Jun, 2018

1 commit

  • Pull networking updates from David Miller:

    1) Add Maglev hashing scheduler to IPVS, from Inju Song.

    2) Lots of new TC subsystem tests from Roman Mashak.

    3) Add TCP zero copy receive and fix delayed acks and autotuning with
    SO_RCVLOWAT, from Eric Dumazet.

    4) Add XDP_REDIRECT support to mlx5 driver, from Jesper Dangaard
    Brouer.

    5) Add ttl inherit support to vxlan, from Hangbin Liu.

    6) Properly separate ipv6 routes into their logically independant
    components. fib6_info for the routing table, and fib6_nh for sets of
    nexthops, which thus can be shared. From David Ahern.

    7) Add bpf_xdp_adjust_tail helper, which can be used to generate ICMP
    messages from XDP programs. From Nikita V. Shirokov.

    8) Lots of long overdue cleanups to the r8169 driver, from Heiner
    Kallweit.

    9) Add BTF ("BPF Type Format"), from Martin KaFai Lau.

    10) Add traffic condition monitoring to iwlwifi, from Luca Coelho.

    11) Plumb extack down into fib_rules, from Roopa Prabhu.

    12) Add Flower classifier offload support to igb, from Vinicius Costa
    Gomes.

    13) Add UDP GSO support, from Willem de Bruijn.

    14) Add documentation for eBPF helpers, from Quentin Monnet.

    15) Add TLS tx offload to mlx5, from Ilya Lesokhin.

    16) Allow applications to be given the number of bytes available to read
    on a socket via a control message returned from recvmsg(), from
    Soheil Hassas Yeganeh.

    17) Add x86_32 eBPF JIT compiler, from Wang YanQing.

    18) Add AF_XDP sockets, with zerocopy support infrastructure as well.
    From Björn Töpel.

    19) Remove indirect load support from all of the BPF JITs and handle
    these operations in the verifier by translating them into native BPF
    instead. From Daniel Borkmann.

    20) Add GRO support to ipv6 gre tunnels, from Eran Ben Elisha.

    21) Allow XDP programs to do lookups in the main kernel routing tables
    for forwarding. From David Ahern.

    22) Allow drivers to store hardware state into an ELF section of kernel
    dump vmcore files, and use it in cxgb4. From Rahul Lakkireddy.

    23) Various RACK and loss detection improvements in TCP, from Yuchung
    Cheng.

    24) Add TCP SACK compression, from Eric Dumazet.

    25) Add User Mode Helper support and basic bpfilter infrastructure, from
    Alexei Starovoitov.

    26) Support ports and protocol values in RTM_GETROUTE, from Roopa
    Prabhu.

    27) Support bulking in ->ndo_xdp_xmit() API, from Jesper Dangaard
    Brouer.

    28) Add lots of forwarding selftests, from Petr Machata.

    29) Add generic network device failover driver, from Sridhar Samudrala.

    * ra.kernel.org:/pub/scm/linux/kernel/git/davem/net-next: (1959 commits)
    strparser: Add __strp_unpause and use it in ktls.
    rxrpc: Fix terminal retransmission connection ID to include the channel
    net: hns3: Optimize PF CMDQ interrupt switching process
    net: hns3: Fix for VF mailbox receiving unknown message
    net: hns3: Fix for VF mailbox cannot receiving PF response
    bnx2x: use the right constant
    Revert "net: sched: cls: Fix offloading when ingress dev is vxlan"
    net: dsa: b53: Fix for brcm tag issue in Cygnus SoC
    enic: fix UDP rss bits
    netdev-FAQ: clarify DaveM's position for stable backports
    rtnetlink: validate attributes in do_setlink()
    mlxsw: Add extack messages for port_{un, }split failures
    netdevsim: Add extack error message for devlink reload
    devlink: Add extack to reload and port_{un, }split operations
    net: metrics: add proper netlink validation
    ipmr: fix error path when ipmr_new_table fails
    ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succeeds
    net: hns3: remove unused hclgevf_cfg_func_mta_filter
    netfilter: provide udp*_lib_lookup for nf_tproxy
    qed*: Utilize FW 8.37.2.0
    ...

    Linus Torvalds