Eric Lee / smarc-fsl-linux-kernel

01 Apr, 2020

1 commit

  • 80aa1e38e   hsr: use rcu_read_lock() in hsr_get_node_{list/status}() ... Browse Code »

    [ Upstream commit 173756b86803655d70af7732079b3aa935e6ab68 ]

    hsr_get_node_{list/status}() are not under rtnl_lock() because
    they are callback functions of generic netlink.
    But they use __dev_get_by_index() without rtnl_lock().
    So, it would use unsafe data.
    In order to fix it, rcu_read_lock() and dev_get_by_index_rcu()
    are used instead of __dev_get_by_index().

    Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)")
    Signed-off-by: Taehee Yoo
    Signed-off-by: David S. Miller
    Signed-off-by: Greg Kroah-Hartman

    Taehee Yoo
     

09 Jan, 2020

1 commit

  • 0fc906e60   hsr: fix a race condition in node list insertion and deletion ... Browse Code »

    [ Upstream commit 92a35678ec075100ce666a2fb6969151affb0e5d ]

    hsr nodes are protected by RCU and there is no write side lock.
    But node insertions and deletions could be being operated concurrently.
    So write side locking is needed.

    Test commands:
    ip netns add nst
    ip link add veth0 type veth peer name veth1
    ip link add veth2 type veth peer name veth3
    ip link set veth1 netns nst
    ip link set veth3 netns nst
    ip link set veth0 up
    ip link set veth2 up
    ip link add hsr0 type hsr slave1 veth0 slave2 veth2
    ip a a 192.168.100.1/24 dev hsr0
    ip link set hsr0 up
    ip netns exec nst ip link set veth1 up
    ip netns exec nst ip link set veth3 up
    ip netns exec nst ip link add hsr1 type hsr slave1 veth1 slave2 veth3
    ip netns exec nst ip a a 192.168.100.2/24 dev hsr1
    ip netns exec nst ip link set hsr1 up

    for i in {0..9}
    do
    for j in {0..9}
    do
    for k in {0..9}
    do
    for l in {0..9}
    do
    arping 192.168.100.2 -I hsr0 -s 00:01:3$i:4$j:5$k:6$l -c1 &
    done
    done
    done
    done

    Splat looks like:
    [ 236.066091][ T3286] list_add corruption. next->prev should be prev (ffff8880a5940300), but was ffff8880a5940d0.
    [ 236.069617][ T3286] ------------[ cut here ]------------
    [ 236.070545][ T3286] kernel BUG at lib/list_debug.c:25!
    [ 236.071391][ T3286] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
    [ 236.072343][ T3286] CPU: 0 PID: 3286 Comm: arping Tainted: G W 5.5.0-rc1+ #209
    [ 236.073463][ T3286] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
    [ 236.074695][ T3286] RIP: 0010:__list_add_valid+0x74/0xd0
    [ 236.075499][ T3286] Code: 48 39 da 75 27 48 39 f5 74 36 48 39 dd 74 31 48 83 c4 08 b8 01 00 00 00 5b 5d c3 48 b
    [ 236.078277][ T3286] RSP: 0018:ffff8880aaa97648 EFLAGS: 00010286
    [ 236.086991][ T3286] RAX: 0000000000000075 RBX: ffff8880d4624c20 RCX: 0000000000000000
    [ 236.088000][ T3286] RDX: 0000000000000075 RSI: 0000000000000008 RDI: ffffed1015552ebf
    [ 236.098897][ T3286] RBP: ffff88809b53d200 R08: ffffed101b3c04f9 R09: ffffed101b3c04f9
    [ 236.099960][ T3286] R10: 00000000308769a1 R11: ffffed101b3c04f8 R12: ffff8880d4624c28
    [ 236.100974][ T3286] R13: ffff8880d4624c20 R14: 0000000040310100 R15: ffff8880ce17ee02
    [ 236.138967][ T3286] FS: 00007f23479fa680(0000) GS:ffff8880d9c00000(0000) knlGS:0000000000000000
    [ 236.144852][ T3286] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 236.145720][ T3286] CR2: 00007f4a14bab210 CR3: 00000000a61c6001 CR4: 00000000000606f0
    [ 236.146776][ T3286] Call Trace:
    [ 236.147222][ T3286] hsr_add_node+0x314/0x490 [hsr]
    [ 236.153633][ T3286] hsr_forward_skb+0x2b6/0x1bc0 [hsr]
    [ 236.154362][ T3286] ? rcu_read_lock_sched_held+0x90/0xc0
    [ 236.155091][ T3286] ? rcu_read_lock_bh_held+0xa0/0xa0
    [ 236.156607][ T3286] hsr_dev_xmit+0x70/0xd0 [hsr]
    [ 236.157254][ T3286] dev_hard_start_xmit+0x160/0x740
    [ 236.157941][ T3286] __dev_queue_xmit+0x1961/0x2e10
    [ 236.158565][ T3286] ? netdev_core_pick_tx+0x2e0/0x2e0
    [ ... ]

    Reported-by: syzbot+3924327f9ad5f4d2b343@syzkaller.appspotmail.com
    Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)")
    Signed-off-by: Taehee Yoo
    Signed-off-by: David S. Miller
    Signed-off-by: Sasha Levin

    Taehee Yoo
     

06 Jul, 2019

1 commit

  • b9a1e6274   hsr: implement dellink to clean up resources ... Browse Code »

    hsr_link_ops implements ->newlink() but not ->dellink(),
    which leads that resources not released after removing the device,
    particularly the entries in self_node_db and node_db.

    So add ->dellink() implementation to replace the priv_destructor.
    This also makes the code slightly easier to understand.

    Reported-by: syzbot+c6167ec3de7def23d1e8@syzkaller.appspotmail.com
    Cc: Arvid Brodin
    Signed-off-by: Cong Wang
    Signed-off-by: David S. Miller

    Cong Wang
     

24 May, 2019

1 commit

  • d2daa127e   hsr: fix don't prune the master node from the node_db ... Browse Code »

    Don't prune the master node in the hsr_prune_nodes function.
    Neither time_in[HSR_PT_SLAVE_A] nor time_in[HSR_PT_SLAVE_B]
    will ever be updated by hsr_register_frame_in for the master port.
    Thus, the master node will be repeatedly pruned leading to
    repeated packet loss.
    This bug never appeared because the hsr_prune_nodes function
    was only called once. Since commit 5150b45fd355
    ("net: hsr: Fix node prune function for forget time expiry") this issue
    is fixed unveiling the issue described above.

    Fixes: 5150b45fd355 ("net: hsr: Fix node prune function for forget time expiry")
    Signed-off-by: Andreas Oetken
    Tested-by: Murali Karicheri
    Signed-off-by: David S. Miller

    Andreas Oetken
     

07 Apr, 2019

12 commits

07 Mar, 2019

1 commit

  • 6caabe7f1   net: hsr: fix memory leak in hsr_dev_finalize() ... Browse Code »

    If hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER) failed to
    add port, it directly returns res and forgets to free the node
    that allocated in hsr_create_self_node(), and forgets to delete
    the node->mac_list linked in hsr->self_node_db.

    BUG: memory leak
    unreferenced object 0xffff8881cfa0c780 (size 64):
    comm "syz-executor.0", pid 2077, jiffies 4294717969 (age 2415.377s)
    hex dump (first 32 bytes):
    e0 c7 a0 cf 81 88 ff ff 00 02 00 00 00 00 ad de ................
    00 e6 49 cd 81 88 ff ff c0 9b 87 d0 81 88 ff ff ..I.............
    backtrace:
    [] hsr_dev_finalize+0x736/0x960 [hsr]
    [] hsr_newlink+0x2b2/0x3e0 [hsr]
    [] __rtnl_newlink+0xf1f/0x1600 net/core/rtnetlink.c:3182
    [] rtnl_newlink+0x66/0x90 net/core/rtnetlink.c:3240
    [] rtnetlink_rcv_msg+0x54e/0xb90 net/core/rtnetlink.c:5130
    [] netlink_rcv_skb+0x129/0x340 net/netlink/af_netlink.c:2477
    [] netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
    [] netlink_unicast+0x49a/0x650 net/netlink/af_netlink.c:1336
    [] netlink_sendmsg+0x88b/0xdf0 net/netlink/af_netlink.c:1917
    [] sock_sendmsg_nosec net/socket.c:621 [inline]
    [] sock_sendmsg+0xc3/0x100 net/socket.c:631
    [] __sys_sendto+0x33e/0x560 net/socket.c:1786
    [] __do_sys_sendto net/socket.c:1798 [inline]
    [] __se_sys_sendto net/socket.c:1794 [inline]
    [] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1794
    [] do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
    [] entry_SYSCALL_64_after_hwframe+0x49/0xbe
    [] 0xffffffffffffffff

    Fixes: c5a759117210 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.")
    Reported-by: Hulk Robot
    Signed-off-by: Mao Wenan
    Signed-off-by: David S. Miller

    Mao Wenan
     

25 Oct, 2017

1 commit

  • dda436b7a   net: hsr: Convert timers to use timer_setup() ... Browse Code »

    In preparation for unconditionally passing the struct timer_list pointer to
    all timer callbacks, switch to using the new timer_setup() and from_timer()
    to pass the timer pointer explicitly.

    Cc: Arvid Brodin
    Cc: "David S. Miller"
    Cc: netdev@vger.kernel.org
    Signed-off-by: Kees Cook
    Signed-off-by: David S. Miller

    Kees Cook
     

13 Jun, 2017

1 commit

  • 675c8da04   hsr: fix incorrect warning ... Browse Code »

    When HSR interface is setup using ip link command, an annoying warning
    appears with the trace as below:-

    [ 203.019828] hsr_get_node: Non-HSR frame
    [ 203.019833] Modules linked in:
    [ 203.019848] CPU: 0 PID: 158 Comm: sd-resolve Tainted: G W 4.12.0-rc3-00052-g9fa6bf70 #2
    [ 203.019853] Hardware name: Generic DRA74X (Flattened Device Tree)
    [ 203.019869] [] (unwind_backtrace) from [] (show_stack+0x10/0x14)
    [ 203.019880] [] (show_stack) from [] (dump_stack+0xac/0xe0)
    [ 203.019894] [] (dump_stack) from [] (__warn+0xd8/0x104)
    [ 203.019907] [] (__warn) from [] (warn_slowpath_fmt+0x34/0x44)
    root@am57xx-evm:~# [ 203.019921] [] (warn_slowpath_fmt) from [] (hsr_get_node+0x148/0x170)
    [ 203.019932] [] (hsr_get_node) from [] (hsr_forward_skb+0x110/0x7c0)
    [ 203.019942] [] (hsr_forward_skb) from [] (hsr_dev_xmit+0x2c/0x34)
    [ 203.019954] [] (hsr_dev_xmit) from [] (dev_hard_start_xmit+0xc4/0x3bc)
    [ 203.019963] [] (dev_hard_start_xmit) from [] (__dev_queue_xmit+0x7c4/0x98c)
    [ 203.019974] [] (__dev_queue_xmit) from [] (ip6_finish_output2+0x330/0xc1c)
    [ 203.019983] [] (ip6_finish_output2) from [] (ip6_output+0x58/0x454)
    [ 203.019994] [] (ip6_output) from [] (mld_sendpack+0x420/0x744)

    As this is an expected path to hsr_get_node() with frame coming from
    the master interface, add a check to ensure packet is not from the
    master port and then warn.

    Signed-off-by: Murali Karicheri
    Signed-off-by: David S. Miller

    Karicheri, Muralidharan
     

16 Apr, 2016

1 commit

  • ee1c27977   net/hsr: Added support for HSR v1 ... Browse Code »

    This patch adds support for the newer version 1 of the HSR
    networking standard. Version 0 is still default and the new
    version has to be selected via iproute2.

    Main changes are in the supervision frame handling and its
    ethertype field.

    Signed-off-by: Peter Heise
    Signed-off-by: David S. Miller

    Peter Heise
     

12 Jul, 2014

1 commit

09 Jul, 2014

5 commits

06 Mar, 2014

1 commit

  • 67ddc87f1   Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net ... Browse Code »

    Conflicts:
    drivers/net/wireless/ath/ath9k/recv.c
    drivers/net/wireless/mwifiex/pcie.c
    net/ipv6/sit.c

    The SIT driver conflict consists of a bug fix being done by hand
    in 'net' (missing u64_stats_init()) whilst in 'net-next' a helper
    was created (netdev_alloc_pcpu_stats()) which takes care of this.

    The two wireless conflicts were overlapping changes.

    Signed-off-by: David S. Miller

    David S. Miller
     

04 Mar, 2014

1 commit

19 Feb, 2014

1 commit

18 Dec, 2013

1 commit

01 Dec, 2013

1 commit

04 Nov, 2013

1 commit

  • f421436a5   net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0) ... Browse Code »

    High-availability Seamless Redundancy ("HSR") provides instant failover
    redundancy for Ethernet networks. It requires a special network topology where
    all nodes are connected in a ring (each node having two physical network
    interfaces). It is suited for applications that demand high availability and
    very short reaction time.

    HSR acts on the Ethernet layer, using a registered Ethernet protocol type to
    send special HSR frames in both directions over the ring. The driver creates
    virtual network interfaces that can be used just like any ordinary Linux
    network interface, for IP/TCP/UDP traffic etc. All nodes in the network ring
    must be HSR capable.

    This code is a "best effort" to comply with the HSR standard as described in
    IEC 62439-3:2010 (HSRv0).

    Signed-off-by: Arvid Brodin
    Signed-off-by: David S. Miller

    Arvid Brodin