Eric Lee / smarc-fsl-linux-kernel

08 Jun, 2017

1 commit

  • cf124db56   net: Fix inconsistent teardown and release of private netdev state. ... Browse Code »

    Network devices can allocate reasources and private memory using
    netdev_ops->ndo_init(). However, the release of these resources
    can occur in one of two different places.

    Either netdev_ops->ndo_uninit() or netdev->destructor().

    The decision of which operation frees the resources depends upon
    whether it is necessary for all netdev refs to be released before it
    is safe to perform the freeing.

    netdev_ops->ndo_uninit() presumably can occur right after the
    NETDEV_UNREGISTER notifier completes and the unicast and multicast
    address lists are flushed.

    netdev->destructor(), on the other hand, does not run until the
    netdev references all go away.

    Further complicating the situation is that netdev->destructor()
    almost universally does also a free_netdev().

    This creates a problem for the logic in register_netdevice().
    Because all callers of register_netdevice() manage the freeing
    of the netdev, and invoke free_netdev(dev) if register_netdevice()
    fails.

    If netdev_ops->ndo_init() succeeds, but something else fails inside
    of register_netdevice(), it does call ndo_ops->ndo_uninit(). But
    it is not able to invoke netdev->destructor().

    This is because netdev->destructor() will do a free_netdev() and
    then the caller of register_netdevice() will do the same.

    However, this means that the resources that would normally be released
    by netdev->destructor() will not be.

    Over the years drivers have added local hacks to deal with this, by
    invoking their destructor parts by hand when register_netdevice()
    fails.

    Many drivers do not try to deal with this, and instead we have leaks.

    Let's close this hole by formalizing the distinction between what
    private things need to be freed up by netdev->destructor() and whether
    the driver needs unregister_netdevice() to perform the free_netdev().

    netdev->priv_destructor() performs all actions to free up the private
    resources that used to be freed by netdev->destructor(), except for
    free_netdev().

    netdev->needs_free_netdev is a boolean that indicates whether
    free_netdev() should be done at the end of unregister_netdevice().

    Now, register_netdevice() can sanely release all resources after
    ndo_ops->ndo_init() succeeds, by invoking both ndo_ops->ndo_uninit()
    and netdev->priv_destructor().

    And at the end of unregister_netdevice(), we invoke
    netdev->priv_destructor() and optionally call free_netdev().

    Signed-off-by: David S. Miller

    David S. Miller
     

21 Oct, 2016

1 commit

  • b3e3893e1   net: use core MTU range checking in misc drivers ... Browse Code »

    firewire-net:
    - set min/max_mtu
    - remove fwnet_change_mtu

    nes:
    - set max_mtu
    - clean up nes_netdev_change_mtu

    xpnet:
    - set min/max_mtu
    - remove xpnet_dev_change_mtu

    hippi:
    - set min/max_mtu
    - remove hippi_change_mtu

    batman-adv:
    - set max_mtu
    - remove batadv_interface_change_mtu
    - initialization is a little async, not 100% certain that max_mtu is set
    in the optimal place, don't have hardware to test with

    rionet:
    - set min/max_mtu
    - remove rionet_change_mtu

    slip:
    - set min/max_mtu
    - streamline sl_change_mtu

    um/net_kern:
    - remove pointless ndo_change_mtu

    hsi/clients/ssi_protocol:
    - use core MTU range checking
    - remove now redundant ssip_pn_set_mtu

    ipoib:
    - set a default max MTU value
    - Note: ipoib's actual max MTU can vary, depending on if the device is in
    connected mode or not, so we'll just set the max_mtu value to the max
    possible, and let the ndo_change_mtu function continue to validate any new
    MTU change requests with checks for CM or not. Note that ipoib has no
    min_mtu set, and thus, the network core's mtu > 0 check is the only lower
    bounds here.

    mptlan:
    - use net core MTU range checking
    - remove now redundant mpt_lan_change_mtu

    fddi:
    - min_mtu = 21, max_mtu = 4470
    - remove now redundant fddi_change_mtu (including export)

    fjes:
    - min_mtu = 8192, max_mtu = 65536
    - The max_mtu value is actually one over IP_MAX_MTU here, but the idea is to
    get past the core net MTU range checks so fjes_change_mtu can validate a
    new MTU against what it supports (see fjes_support_mtu in fjes_hw.c)

    hsr:
    - min_mtu = 0 (calls ether_setup, max_mtu is 1500)

    f_phonet:
    - min_mtu = 6, max_mtu = 65541

    u_ether:
    - min_mtu = 14, max_mtu = 15412

    phonet/pep-gprs:
    - min_mtu = 576, max_mtu = 65530
    - remove redundant gprs_set_mtu

    CC: netdev@vger.kernel.org
    CC: linux-rdma@vger.kernel.org
    CC: Stefan Richter
    CC: Faisal Latif
    CC: linux-rdma@vger.kernel.org
    CC: Cliff Whickman
    CC: Robin Holt
    CC: Jes Sorensen
    CC: Marek Lindner
    CC: Simon Wunderlich
    CC: Antonio Quartulli
    CC: Sathya Prakash
    CC: Chaitra P B
    CC: Suganath Prabu Subramani
    CC: MPT-FusionLinux.pdl@broadcom.com
    CC: Sebastian Reichel
    CC: Felipe Balbi
    CC: Arvid Brodin
    CC: Remi Denis-Courmont
    Signed-off-by: Jarod Wilson
    Signed-off-by: David S. Miller

    Jarod Wilson
     

12 Nov, 2014

1 commit

  • ba7a46f16   net: Convert LIMIT_NETDEBUG to net_dbg_ratelimited ... Browse Code »

    Use the more common dynamic_debug capable net_dbg_ratelimited
    and remove the LIMIT_NETDEBUG macro.

    All messages are still ratelimited.

    Some KERN_ uses are changed to KERN_DEBUG.

    This may have some negative impact on messages that were
    emitted at KERN_INFO that are not not enabled at all unless
    DEBUG is defined or dynamic_debug is enabled. Even so,
    these messages are now _not_ emitted by default.

    This also eliminates the use of the net_msg_warn sysctl
    "/proc/sys/net/core/warnings". For backward compatibility,
    the sysctl is not removed, but it has no function. The extern
    declaration of net_msg_warn is removed from sock.h and made
    static in net/core/sysctl_net_core.c

    Miscellanea:

    o Update the sysctl documentation
    o Remove the embedded uses of pr_fmt
    o Coalesce format fragments
    o Realign arguments

    Signed-off-by: Joe Perches
    Signed-off-by: David S. Miller

    Joe Perches
     

16 Jul, 2014

1 commit

  • c835a6773   net: set name_assign_type in alloc_netdev() ... Browse Code »

    Extend alloc_netdev{,_mq{,s}}() to take name_assign_type as argument, and convert
    all users to pass NET_NAME_UNKNOWN.

    Coccinelle patch:

    @@
    expression sizeof_priv, name, setup, txqs, rxqs, count;
    @@

    (
    -alloc_netdev_mqs(sizeof_priv, name, setup, txqs, rxqs)
    +alloc_netdev_mqs(sizeof_priv, name, NET_NAME_UNKNOWN, setup, txqs, rxqs)
    |
    -alloc_netdev_mq(sizeof_priv, name, setup, count)
    +alloc_netdev_mq(sizeof_priv, name, NET_NAME_UNKNOWN, setup, count)
    |
    -alloc_netdev(sizeof_priv, name, setup)
    +alloc_netdev(sizeof_priv, name, NET_NAME_UNKNOWN, setup)
    )

    v9: move comments here from the wrong commit

    Signed-off-by: Tom Gundersen
    Reviewed-by: David Herrmann
    Signed-off-by: David S. Miller

    Tom Gundersen
     

12 Apr, 2014

1 commit

  • 676d23690   net: Fix use after free by removing length arg from sk_data_ready callbacks. ... Browse Code »

    Several spots in the kernel perform a sequence like:

    skb_queue_tail(&sk->s_receive_queue, skb);
    sk->sk_data_ready(sk, skb->len);

    But at the moment we place the SKB onto the socket receive queue it
    can be consumed and freed up. So this skb->len access is potentially
    to freed up memory.

    Furthermore, the skb->len can be modified by the consumer so it is
    possible that the value isn't accurate.

    And finally, no actual implementation of this callback actually uses
    the length argument. And since nobody actually cared about it's
    value, lots of call sites pass arbitrary values in such as '0' and
    even '1'.

    So just remove the length argument from the callback, that way there
    is no confusion whatsoever and all of these use-after-free cases get
    fixed as a side effect.

    Based upon a patch by Eric Dumazet and his suggestion to audit this
    issue tree-wide.

    Signed-off-by: David S. Miller

    David S. Miller
     

18 Jun, 2012

1 commit

07 Jan, 2010

1 commit

01 Sep, 2009

1 commit

06 Jul, 2009

1 commit

09 Jun, 2009

1 commit

02 Jun, 2009

1 commit

11 Feb, 2009

1 commit

08 Jan, 2009

1 commit

18 Dec, 2008

2 commits

16 Dec, 2008

2 commits

15 Dec, 2008

1 commit

11 Nov, 2008

1 commit

07 Nov, 2008

1 commit

  • 5c7f03335   phonet: sparse annotations of protocol, remove forward declaration ... Browse Code »

    net/phonet/af_phonet.c:38:36: error: marked inline, but without a definition
    net/phonet/pep-gprs.c:63:10: warning: incorrect type in return expression (different base types)
    net/phonet/pep-gprs.c:63:10: expected int
    net/phonet/pep-gprs.c:63:10: got restricted __be16 [usertype]
    net/phonet/pep-gprs.c:65:10: warning: incorrect type in return expression (different base types)
    net/phonet/pep-gprs.c:65:10: expected int
    net/phonet/pep-gprs.c:65:10: got restricted __be16 [usertype]
    net/phonet/pep-gprs.c:124:16: warning: incorrect type in assignment (different base types)
    net/phonet/pep-gprs.c:124:16: expected restricted __be16 [usertype] protocol
    net/phonet/pep-gprs.c:124:16: got unsigned short [unsigned] [usertype] protocol

    Signed-off-by: Harvey Harrison
    Signed-off-by: David S. Miller

    Harvey Harrison
     

06 Oct, 2008

1 commit