Eric Lee / smarc-fsl-linux-kernel

13 Mar, 2020

1 commit

18 Feb, 2020

2 commits

  • 8e8ce0819   batman-adv: Don't schedule OGM for disabled interface ... Browse Code »

    A transmission scheduling for an interface which is currently dropped by
    batadv_iv_ogm_iface_disable could still be in progress. The B.A.T.M.A.N. V
    is simply cancelling the workqueue item in an synchronous way but this is
    not possible with B.A.T.M.A.N. IV because the OGM submissions are
    intertwined.

    Instead it has to stop submitting the OGM when it detect that the buffer
    pointer is set to NULL.

    Reported-by: syzbot+a98f2016f40b9cd3818a@syzkaller.appspotmail.com
    Reported-by: syzbot+ac36b6a33c28a491e929@syzkaller.appspotmail.com
    Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
    Signed-off-by: Sven Eckelmann
    Cc: Hillf Danton
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     
  • 5f27eb055   batman-adv: Replace zero-length array with flexible-array member ... Browse Code »

    The current codebase makes use of the zero-length array language
    extension to the C90 standard, but the preferred mechanism to declare
    variable-length types such as these ones is a flexible array member[1][2],
    introduced in C99:

    struct foo {
    int stuff;
    struct boo array[];
    };

    By making use of the mechanism above, we will get a compiler warning
    in case the flexible array does not occur last in the structure, which
    will help us prevent some kind of undefined behavior bugs from being
    inadvertently introduced[3] to the codebase from now on.

    Also, notice that, dynamic memory allocations won't be affected by
    this change:

    "Flexible array members have incomplete type, and so the sizeof operator
    may not be applied. As a quirk of the original implementation of
    zero-length arrays, sizeof evaluates to zero."[1]

    This issue was found with the help of Coccinelle.

    [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html
    [2] https://github.com/KSPP/linux/issues/21
    [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour")

    Signed-off-by: Gustavo A. R. Silva
    Signed-off-by: Sven Eckelman
    Signed-off-by: Simon Wunderlich

    Gustavo A. R. Silva
     

17 Feb, 2020

1 commit

  • 3b2582c7a   batman-adv: Avoid RCU list-traversal in spinlock ... Browse Code »

    The new CONFIG_PROVE_RCU_LIST requires a condition statement in
    (h)list_for_each_entry_rcu when the code might be executed in a non RCU
    non-reader section with the writer lock. Otherwise lockdep might cause a
    false positive warning like

    =============================
    WARNING: suspicious RCU usage
    -----------------------------
    translation-table.c:940 RCU-list traversed in non-reader section!!

    batman-adv is (mostly) following the examples from the RCU documentation
    and is using the normal list-traversal primitives instead of the RCU
    list-traversal primitives when the writer (spin)lock is held.

    The remaining users of RCU list-traversal primitives with writer spinlock
    have to be converted to the same style as the rest of the code.

    Reported-by: Madhuparna Bhowmik
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     

16 Feb, 2020

1 commit

20 Jan, 2020

1 commit

16 Jan, 2020

2 commits

01 Jan, 2020

2 commits

10 Dec, 2019

1 commit

  • c593642c8   treewide: Use sizeof_field() macro ... Browse Code »

    Replace all the occurrences of FIELD_SIZEOF() with sizeof_field() except
    at places where these are defined. Later patches will remove the unused
    definition of FIELD_SIZEOF().

    This patch is generated using following script:

    EXCLUDE_FILES="include/linux/stddef.h|include/linux/kernel.h"

    git grep -l -e "\bFIELD_SIZEOF\b" | while read file;
    do

    if [[ "$file" =~ $EXCLUDE_FILES ]]; then
    continue
    fi
    sed -i -e 's/\bFIELD_SIZEOF\b/sizeof_field/g' $file;
    done

    Signed-off-by: Pankaj Bharadiya
    Link: https://lore.kernel.org/r/20190924105839.110713-3-pankaj.laxminarayan.bharadiya@intel.com
    Co-developed-by: Kees Cook
    Signed-off-by: Kees Cook
    Acked-by: David Miller # for net

    Pankaj Bharadiya
     

09 Dec, 2019

2 commits

  • 61a292860   batman-adv: Annotate bitwise integer pointer casts ... Browse Code »

    The sparse commit 6002ded74587 ("add a flag to warn on casts to/from
    bitwise pointers") introduced a check for non-direct casts from/to
    restricted datatypes (when -Wbitwise-pointer is enabled).

    This triggered various warnings in batman-adv when some (already big
    endian) buffer content was casted to/from the corresponding big endian
    integer data types. But these were correct and can therefore be marked with
    __force to signalize sparse an intended cast from/to a bitwise type.

    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     
  • 2b1aa5a4c   batman-adv: ELP - use wifi tx bitrate as fallback throughput ... Browse Code »

    Some wifi drivers (e.g. ath10k) provide per-station rx/tx values but no
    estimated throughput. Setting a better estimate than the default 1 MBit
    makes these devices work well with B.A.T.M.A.N. V.

    Signed-off-by: René Treffer
    Signed-off-by: Marek Lindner
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    René Treffer
     

28 Nov, 2019

1 commit

  • 4cc4a1708   batman-adv: Fix DAT candidate selection on little endian systems ... Browse Code »

    The distributed arp table is using a DHT to store and retrieve MAC address
    information for an IP address. This is done using unicast messages to
    selected peers. The potential peers are looked up using the IP address and
    the VID.

    While the IP address is always stored in big endian byte order, this is not
    the case of the VID. It can (depending on the host system) either be big
    endian or little endian. The host must therefore always convert it to big
    endian to ensure that all devices calculate the same peers for the same
    lookup data.

    Fixes: be1db4f6615b ("batman-adv: make the Distributed ARP Table vlan aware")
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     

25 Nov, 2019

3 commits

03 Nov, 2019

5 commits

29 Oct, 2019

1 commit

25 Oct, 2019

1 commit

  • ab92d68fc   net: core: add generic lockdep keys ... Browse Code »

    Some interface types could be nested.
    (VLAN, BONDING, TEAM, MACSEC, MACVLAN, IPVLAN, VIRT_WIFI, VXLAN, etc..)
    These interface types should set lockdep class because, without lockdep
    class key, lockdep always warn about unexisting circular locking.

    In the current code, these interfaces have their own lockdep class keys and
    these manage itself. So that there are so many duplicate code around the
    /driver/net and /net/.
    This patch adds new generic lockdep keys and some helper functions for it.

    This patch does below changes.
    a) Add lockdep class keys in struct net_device
    - qdisc_running, xmit, addr_list, qdisc_busylock
    - these keys are used as dynamic lockdep key.
    b) When net_device is being allocated, lockdep keys are registered.
    - alloc_netdev_mqs()
    c) When net_device is being free'd llockdep keys are unregistered.
    - free_netdev()
    d) Add generic lockdep key helper function
    - netdev_register_lockdep_key()
    - netdev_unregister_lockdep_key()
    - netdev_update_lockdep_key()
    e) Remove unnecessary generic lockdep macro and functions
    f) Remove unnecessary lockdep code of each interfaces.

    After this patch, each interface modules don't need to maintain
    their lockdep keys.

    Signed-off-by: Taehee Yoo
    Signed-off-by: David S. Miller

    Taehee Yoo
     

14 Oct, 2019

2 commits

  • 40e220b42   batman-adv: Avoid free/alloc race when handling OGM buffer ... Browse Code »

    Each slave interface of an B.A.T.M.A.N. IV virtual interface has an OGM
    packet buffer which is initialized using data from netdevice notifier and
    other rtnetlink related hooks. It is sent regularly via various slave
    interfaces of the batadv virtual interface and in this process also
    modified (realloced) to integrate additional state information via TVLV
    containers.

    It must be avoided that the worker item is executed without a common lock
    with the netdevice notifier/rtnetlink helpers. Otherwise it can either
    happen that half modified/freed data is sent out or functions modifying the
    OGM buffer try to access already freed memory regions.

    Reported-by: syzbot+0cc629f19ccb8534935b@syzkaller.appspotmail.com
    Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     
  • a8d23cbbf   batman-adv: Avoid free/alloc race when handling OGM2 buffer ... Browse Code »

    A B.A.T.M.A.N. V virtual interface has an OGM2 packet buffer which is
    initialized using data from the netdevice notifier and other rtnetlink
    related hooks. It is sent regularly via various slave interfaces of the
    batadv virtual interface and in this process also modified (realloced) to
    integrate additional state information via TVLV containers.

    It must be avoided that the worker item is executed without a common lock
    with the netdevice notifier/rtnetlink helpers. Otherwise it can either
    happen that half modified data is sent out or the functions modifying the
    OGM2 buffer try to access already freed memory regions.

    Fixes: 0da0035942d4 ("batman-adv: OGMv2 - add basic infrastructure")
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     

02 Oct, 2019

1 commit

  • 895b5c9f2   netfilter: drop bridge nf reset from nf_reset ... Browse Code »

    commit 174e23810cd31
    ("sk_buff: drop all skb extensions on free and skb scrubbing") made napi
    recycle always drop skb extensions. The additional skb_ext_del() that is
    performed via nf_reset on napi skb recycle is not needed anymore.

    Most nf_reset() calls in the stack are there so queued skb won't block
    'rmmod nf_conntrack' indefinitely.

    This removes the skb_ext_del from nf_reset, and renames it to a more
    fitting nf_reset_ct().

    In a few selected places, add a call to skb_ext_reset to make sure that
    no active extensions remain.

    I am submitting this for "net", because we're still early in the release
    cycle. The patch applies to net-next too, but I think the rename causes
    needless divergence between those trees.

    Suggested-by: Eric Dumazet
    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

26 Sep, 2019

1 commit

03 Sep, 2019

1 commit

28 Aug, 2019

1 commit

24 Aug, 2019

2 commits

  • 0ff0f15a3   batman-adv: Only read OGM2 tvlv_len after buffer len check ... Browse Code »

    Multiple batadv_ogm2_packet can be stored in an skbuff. The functions
    batadv_v_ogm_send_to_if() uses batadv_v_ogm_aggr_packet() to check if there
    is another additional batadv_ogm2_packet in the skb or not before they
    continue processing the packet.

    The length for such an OGM2 is BATADV_OGM2_HLEN +
    batadv_ogm2_packet->tvlv_len. The check must first check that at least
    BATADV_OGM2_HLEN bytes are available before it accesses tvlv_len (which is
    part of the header. Otherwise it might try read outside of the currently
    available skbuff to get the content of tvlv_len.

    Fixes: 9323158ef9f4 ("batman-adv: OGMv2 - implement originators logic")
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     
  • a15d56a60   batman-adv: Only read OGM tvlv_len after buffer len check ... Browse Code »

    Multiple batadv_ogm_packet can be stored in an skbuff. The functions
    batadv_iv_ogm_send_to_if()/batadv_iv_ogm_receive() use
    batadv_iv_ogm_aggr_packet() to check if there is another additional
    batadv_ogm_packet in the skb or not before they continue processing the
    packet.

    The length for such an OGM is BATADV_OGM_HLEN +
    batadv_ogm_packet->tvlv_len. The check must first check that at least
    BATADV_OGM_HLEN bytes are available before it accesses tvlv_len (which is
    part of the header. Otherwise it might try read outside of the currently
    available skbuff to get the content of tvlv_len.

    Fixes: ef26157747d4 ("batman-adv: tvlv - basic infrastructure")
    Reported-by: syzbot+355cab184197dbbfa384@syzkaller.appspotmail.com
    Signed-off-by: Sven Eckelmann
    Acked-by: Antonio Quartulli
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     

20 Aug, 2019

1 commit

15 Aug, 2019

1 commit

  • 3ee1bb7aa   batman-adv: fix uninit-value in batadv_netlink_get_ifindex() ... Browse Code »

    batadv_netlink_get_ifindex() needs to make sure user passed
    a correct u32 attribute.

    syzbot reported :
    BUG: KMSAN: uninit-value in batadv_netlink_dump_hardif+0x70d/0x880 net/batman-adv/netlink.c:968
    CPU: 1 PID: 11705 Comm: syz-executor888 Not tainted 5.1.0+ #1
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0x191/0x1f0 lib/dump_stack.c:113
    kmsan_report+0x130/0x2a0 mm/kmsan/kmsan.c:622
    __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:310
    batadv_netlink_dump_hardif+0x70d/0x880 net/batman-adv/netlink.c:968
    genl_lock_dumpit+0xc6/0x130 net/netlink/genetlink.c:482
    netlink_dump+0xa84/0x1ab0 net/netlink/af_netlink.c:2253
    __netlink_dump_start+0xa3a/0xb30 net/netlink/af_netlink.c:2361
    genl_family_rcv_msg net/netlink/genetlink.c:550 [inline]
    genl_rcv_msg+0xfc1/0x1a40 net/netlink/genetlink.c:627
    netlink_rcv_skb+0x431/0x620 net/netlink/af_netlink.c:2486
    genl_rcv+0x63/0x80 net/netlink/genetlink.c:638
    netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
    netlink_unicast+0xf3e/0x1020 net/netlink/af_netlink.c:1337
    netlink_sendmsg+0x127e/0x12f0 net/netlink/af_netlink.c:1926
    sock_sendmsg_nosec net/socket.c:651 [inline]
    sock_sendmsg net/socket.c:661 [inline]
    ___sys_sendmsg+0xcc6/0x1200 net/socket.c:2260
    __sys_sendmsg net/socket.c:2298 [inline]
    __do_sys_sendmsg net/socket.c:2307 [inline]
    __se_sys_sendmsg+0x305/0x460 net/socket.c:2305
    __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2305
    do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
    entry_SYSCALL_64_after_hwframe+0x63/0xe7
    RIP: 0033:0x440209

    Fixes: b60620cf567b ("batman-adv: netlink: hardif query")
    Signed-off-by: Eric Dumazet
    Reported-by: syzbot
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Eric Dumazet
     

05 Aug, 2019

2 commits

  • 9cb9a1781   batman-adv: BATMAN_V: aggregate OGMv2 packets ... Browse Code »

    Instead of transmitting individual OGMv2 packets from the aggregation
    queue merge those OGMv2 packets into a single one and transmit this
    aggregate instead.

    This reduces overhead as it saves an ethernet header and a transmission
    per aggregated OGMv2 packet.

    Signed-off-by: Linus Lüssing
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Linus Lüssing
     
  • f89255a02   batman-adv: BATMAN_V: introduce per hard-iface OGMv2 queues ... Browse Code »

    In preparation for the OGMv2 packet aggregation, hold OGMv2 packets for
    up to BATADV_MAX_AGGREGATION_MS milliseconds (100ms) on per
    hard-interface queues, before transmitting.

    This allows us to later squash multiple OGMs into a single frame
    and transmission for reduced overhead.

    Signed-off-by: Linus Lüssing
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Linus Lüssing
     

23 Jul, 2019

4 commits

  • f7af86ccf   batman-adv: Fix deletion of RTR(4|6) mcast list entries ... Browse Code »

    The multicast code uses the lists bat_priv->mcast.want_all_rtr*_list to
    store all all originator nodes which don't have the flag no-RTR4 or no-RTR6
    set. When an originator is purged, it has to be removed from these lists.

    Since all entries without the BATADV_MCAST_WANT_NO_RTR4/6 are stored in
    these lists, they have to be handled like entries which have these flags
    set to force the update routines to remove them from the lists when purging
    the originator.

    Not doing so will leave a pointer to a freed memory region inside the list.
    Trying to operate on these lists will then cause an use-after-free error:

    BUG: KASAN: use-after-free in batadv_mcast_want_rtr4_update+0x335/0x3a0 [batman_adv]
    Write of size 8 at addr ffff888007b41a38 by task swapper/0/0

    Fixes: 61caf3d109f5 ("batman-adv: mcast: detect, distribute and maintain multicast router presence")
    Signed-off-by: Sven Eckelmann
    Acked-by: Linus Lüssing
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     
  • fa3a03da5   batman-adv: Fix netlink dumping of all mcast_flags buckets ... Browse Code »

    The bucket variable is only updated outside the loop over the mcast_flags
    buckets. It will only be updated during a dumping run when the dumping has
    to be interrupted and a new message has to be started.

    This could result in repeated or missing entries when the multicast flags
    are dumped to userspace.

    Fixes: d2d489b7d851 ("batman-adv: Add inconsistent multicast netlink dump detection")
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     
  • 529a8f939   batman-adv: Replace usage of strlcpy with strscpy ... Browse Code »

    The strscpy was introduced to fix some API problems around strlcpy. And
    checkpatch started to report recently that strlcpy is deprecated and
    strscpy is preferred.

    The functionality introduced in commit 30035e45753b ("string: provide
    strscpy()") improves following points compared to strlcpy:

    * it doesn't read from memory beyond (src + size)
    * provides an easy way to check for destination buffer overflow
    * robust against asynchronous source buffer changes

    Since batman-adv doesn't depend on any of the previously mentioned behavior
    changes, the usage of strlcpy can simply be replaced by strscpy to silence
    checkpatch.

    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     
  • bc986391c   batman-adv: Start new development cycle ... Browse Code »

    Signed-off-by: Simon Wunderlich

    Simon Wunderlich