Skip to content
Snippets Groups Projects
  1. Aug 24, 2021
  2. Aug 23, 2021
    • Vladimir Oltean's avatar
      net: dsa: track unique bridge numbers across all DSA switch trees · f5e165e7
      Vladimir Oltean authored
      
      Right now, cross-tree bridging setups work somewhat by mistake.
      
      In the case of cross-tree bridging with sja1105, all switch instances
      need to agree upon a common VLAN ID for forwarding a packet that belongs
      to a certain bridging domain.
      
      With TX forwarding offload, the VLAN ID is the bridge VLAN for
      VLAN-aware bridging, and the tag_8021q TX forwarding offload VID
      (a VLAN which has non-zero VBID bits) for VLAN-unaware bridging.
      
      The VBID for VLAN-unaware bridging is derived from the dp->bridge_num
      value calculated by DSA independently for each switch tree.
      
      If ports from one tree join one bridge, and ports from another tree join
      another bridge, DSA will assign them the same bridge_num, even though
      the bridges are different. If cross-tree bridging is supported, this
      is an issue.
      
      Modify DSA to calculate the bridge_num globally across all switch trees.
      This has the implication for a driver that the dp->bridge_num value that
      DSA will assign to its ports might not be contiguous, if there are
      boards with multiple DSA drivers instantiated. Additionally, all
      bridge_num values eat up towards each switch's
      ds->num_fwd_offloading_bridges maximum, which is potentially unfortunate,
      and can be seen as a limitation introduced by this patch. However, that
      is the lesser evil for now.
      
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f5e165e7
  3. Aug 20, 2021
    • Nikolay Aleksandrov's avatar
      net: bridge: vlan: convert mcast router global option to per-vlan entry · 2796d846
      Nikolay Aleksandrov authored
      
      The per-vlan router option controls the port/vlan and host vlan entries'
      mcast router config. The global option controlled only the host vlan
      config, but that is unnecessary and incosistent as it's not really a
      global vlan option, but rather bridge option to control host router
      config, so convert BRIDGE_VLANDB_GOPTS_MCAST_ROUTER to
      BRIDGE_VLANDB_ENTRY_MCAST_ROUTER which can be used to control both host
      vlan and port vlan mcast router config.
      
      Signed-off-by: default avatarNikolay Aleksandrov <nikolay@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2796d846
    • Nikolay Aleksandrov's avatar
      net: bridge: mcast: br_multicast_set_port_router takes multicast context as argument · a53581d5
      Nikolay Aleksandrov authored
      
      Change br_multicast_set_port_router to take port multicast context as
      its first argument so we can later use it to control port/vlan mcast
      router option.
      
      Signed-off-by: default avatarNikolay Aleksandrov <nikolay@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a53581d5
    • Linus Lüssing's avatar
      batman-adv: bcast: remove remaining skb-copy calls · a006aa51
      Linus Lüssing authored
      
      We currently have two code paths for broadcast packets:
      
      A) self-generated, via batadv_interface_tx()->
         batadv_send_bcast_packet().
      B) received/forwarded, via batadv_recv_bcast_packet()->
         batadv_forw_bcast_packet().
      
      For A), self-generated broadcast packets:
      
      The only modifications to the skb data is the ethernet header which is
      added/pushed to the skb in
      batadv_send_broadcast_skb()->batadv_send_skb_packet(). However before
      doing so, batadv_skb_head_push() is called which calls skb_cow_head() to
      unshare the space for the to be pushed ethernet header. So for this
      case, it is safe to use skb clones.
      
      For B), received/forwarded packets:
      
      The same applies as in A) for the to be forwarded packets. Only the
      ethernet header is added. However after (queueing for) forwarding the
      packet in batadv_recv_bcast_packet()->batadv_forw_bcast_packet(), a
      packet is additionally decapsulated and is sent up the stack through
      batadv_recv_bcast_packet()->batadv_interface_rx().
      
      Protocols higher up the stack are already required to check if the
      packet is shared and create a copy for further modifications. When the
      next (protocol) layer works correctly, it cannot happen that it tries to
      operate on the data behind the skb clone which is still queued up for
      forwarding.
      
      Co-authored-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarLinus Lüssing <linus.luessing@c0d3.blue>
      Signed-off-by: default avatarSimon Wunderlich <sw@simonwunderlich.de>
      a006aa51
    • Sven Eckelmann's avatar
      batman-adv: Drop NULL check before dropping references · a2b7b148
      Sven Eckelmann authored
      
      The check if a batman-adv related object is NULL or not is now directly in
      the batadv_*_put functions. It is not needed anymore to perform this check
      outside these function:
      
      The changes were generated using a coccinelle semantic patch:
      
        @@
        expression E;
        @@
        - if (likely(E != NULL))
        (
        batadv_backbone_gw_put
        |
        batadv_claim_put
        |
        batadv_dat_entry_put
        |
        batadv_gw_node_put
        |
        batadv_hardif_neigh_put
        |
        batadv_hardif_put
        |
        batadv_nc_node_put
        |
        batadv_nc_path_put
        |
        batadv_neigh_ifinfo_put
        |
        batadv_neigh_node_put
        |
        batadv_orig_ifinfo_put
        |
        batadv_orig_node_put
        |
        batadv_orig_node_vlan_put
        |
        batadv_softif_vlan_put
        |
        batadv_tp_vars_put
        |
        batadv_tt_global_entry_put
        |
        batadv_tt_local_entry_put
        |
        batadv_tt_orig_list_entry_put
        |
        batadv_tt_req_node_put
        |
        batadv_tvlv_container_put
        |
        batadv_tvlv_handler_put
        )(E);
      
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarSimon Wunderlich <sw@simonwunderlich.de>
      a2b7b148
    • Sven Eckelmann's avatar
      batman-adv: Check ptr for NULL before reducing its refcnt · e78783da
      Sven Eckelmann authored
      
      The commit b37a4668 ("netdevice: add the case if dev is NULL") changed
      the way how the NULL check for net_devices have to be handled when trying
      to reduce its reference counter. Before this commit, it was the
      responsibility of the caller to check whether the object is NULL or not.
      But it was changed to behave more like kfree. Now the callee has to handle
      the NULL-case.
      
      The batman-adv code was scanned via cocinelle for similar places. These
      were changed to use the paradigm
      
        @@
        identifier E, T, R, C;
        identifier put;
        @@
         void put(struct T *E)
         {
        +	if (!E)
        +		return;
        	kref_put(&E->C, R);
         }
      
      Functions which were used in other sources files were moved to the header
      to allow the compiler to inline the NULL check and the kref_put call.
      
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarSimon Wunderlich <sw@simonwunderlich.de>
      e78783da
    • Sven Eckelmann's avatar
      batman-adv: Switch to kstrtox.h for kstrtou64 · 55207227
      Sven Eckelmann authored
      
      The commit 4c527293 ("kernel.h: split out kstrtox() and simple_strtox()
      to a separate header") moved the kstrtou64 function to a new header called
      linux/kstrtox.h.
      
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarSimon Wunderlich <sw@simonwunderlich.de>
      55207227
  4. Aug 19, 2021
    • Kangmin Park's avatar
      Bluetooth: Fix return value in hci_dev_do_close() · 61969ef8
      Kangmin Park authored
      
      hci_error_reset() return without calling hci_dev_do_open() when
      hci_dev_do_close() return error value which is not 0.
      
      Also, hci_dev_close() return hci_dev_do_close() function's return
      value.
      
      But, hci_dev_do_close() return always 0 even if hdev->shutdown
      return error value. So, fix hci_dev_do_close() to save and return
      the return value of the hdev->shutdown when it is called.
      
      Signed-off-by: default avatarKangmin Park <l4stpr0gr4m@gmail.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      61969ef8
    • Pavel Skripkin's avatar
      Bluetooth: add timeout sanity check to hci_inquiry · f41a4b2b
      Pavel Skripkin authored
      
      Syzbot hit "task hung" bug in hci_req_sync(). The problem was in
      unreasonable huge inquiry timeout passed from userspace.
      Fix it by adding sanity check for timeout value to hci_inquiry().
      
      Since hci_inquiry() is the only user of hci_req_sync() with user
      controlled timeout value, it makes sense to check timeout value in
      hci_inquiry() and don't touch hci_req_sync().
      
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Reported-and-tested-by: default avatar <syzbot+be2baed593ea56c6a84c@syzkaller.appspotmail.com>
      Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      f41a4b2b
    • Kees Cook's avatar
      Bluetooth: mgmt: Pessimize compile-time bounds-check · a31e5a41
      Kees Cook authored
      
      After gaining __alloc_size hints, GCC thinks it can reach a memcpy()
      with eir_len == 0 (since it can't see into the rewrite of status).
      Instead, check eir_len == 0, avoiding this future warning:
      
      In function 'eir_append_data',
          inlined from 'read_local_oob_ext_data_complete' at net/bluetooth/mgmt.c:7210:12:
      ./include/linux/fortify-string.h:54:29: warning: '__builtin_memcpy' offset 5 is out of the bounds [0, 3] [-Warray-bounds]
      ...
      net/bluetooth/hci_request.h:133:2: note: in expansion of macro 'memcpy'
        133 |  memcpy(&eir[eir_len], data, data_len);
            |  ^~~~~~
      
      Cc: Marcel Holtmann <marcel@holtmann.org>
      Cc: Johan Hedberg <johan.hedberg@gmail.com>
      Cc: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: linux-bluetooth@vger.kernel.org
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      a31e5a41
    • Eli Cohen's avatar
      net: Fix offloading indirect devices dependency on qdisc order creation · 74fc4f82
      Eli Cohen authored
      
      Currently, when creating an ingress qdisc on an indirect device before
      the driver registered for callbacks, the driver will not have a chance
      to register its filter configuration callbacks.
      
      To fix that, modify the code such that it keeps track of all the ingress
      qdiscs that call flow_indr_dev_setup_offload(). When a driver calls
      flow_indr_dev_register(),  go through the list of tracked ingress qdiscs
      and call the driver callback entry point so as to give it a chance to
      register its callback.
      
      Reviewed-by: default avatarJiri Pirko <jiri@nvidia.com>
      Signed-off-by: default avatarEli Cohen <elic@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      74fc4f82
    • Eli Cohen's avatar
      net/core: Remove unused field from struct flow_indr_dev · c1c5cb3a
      Eli Cohen authored
      
      rcu field is not used. Remove it.
      
      Reviewed-by: default avatarJiri Pirko <jiri@nvidia.com>
      Signed-off-by: default avatarEli Cohen <elic@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c1c5cb3a
    • Matthieu Baerts's avatar
      mptcp: full fully established support after ADD_ADDR · 67b12f79
      Matthieu Baerts authored
      
      If directly after an MP_CAPABLE 3WHS, the client receives an ADD_ADDR
      with HMAC from the server, it is enough to switch to a "fully
      established" mode because it has received more MPTCP options.
      
      It was then OK to enable the "fully_established" flag on the MPTCP
      socket. Still, best to check if the ADD_ADDR looks valid by looking if
      it contains an HMAC (no 'echo' bit). If an ADD_ADDR echo is received
      while we are not in "fully established" mode, it is strange and then
      we should not switch to this mode now.
      
      But that is not enough. On one hand, the path-manager has be notified
      the state has changed. On the other hand, the "fully_established" flag
      on the subflow socket should be turned on as well not to re-send the
      MP_CAPABLE 3rd ACK content with the next ACK.
      
      Fixes: 84dfe367 ("mptcp: send out dedicated ADD_ADDR packet")
      Signed-off-by: default avatarMatthieu Baerts <matthieu.baerts@tessares.net>
      Signed-off-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      67b12f79
    • Paolo Abeni's avatar
      mptcp: fix memory leak on address flush · a0eea5f1
      Paolo Abeni authored
      
      The endpoint cleanup path is prone to a memory leak, as reported
      by syzkaller:
      
       BUG: memory leak
       unreferenced object 0xffff88810680ea00 (size 64):
         comm "syz-executor.6", pid 6191, jiffies 4295756280 (age 24.138s)
         hex dump (first 32 bytes):
           58 75 7d 3c 80 88 ff ff 22 01 00 00 00 00 ad de  Xu}<....".......
           01 00 02 00 00 00 00 00 ac 1e 00 07 00 00 00 00  ................
         backtrace:
           [<0000000072a9f72a>] kmalloc include/linux/slab.h:591 [inline]
           [<0000000072a9f72a>] mptcp_nl_cmd_add_addr+0x287/0x9f0 net/mptcp/pm_netlink.c:1170
           [<00000000f6e931bf>] genl_family_rcv_msg_doit.isra.0+0x225/0x340 net/netlink/genetlink.c:731
           [<00000000f1504a2c>] genl_family_rcv_msg net/netlink/genetlink.c:775 [inline]
           [<00000000f1504a2c>] genl_rcv_msg+0x341/0x5b0 net/netlink/genetlink.c:792
           [<0000000097e76f6a>] netlink_rcv_skb+0x148/0x430 net/netlink/af_netlink.c:2504
           [<00000000ceefa2b8>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:803
           [<000000008ff91aec>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
           [<000000008ff91aec>] netlink_unicast+0x537/0x750 net/netlink/af_netlink.c:1340
           [<0000000041682c35>] netlink_sendmsg+0x846/0xd80 net/netlink/af_netlink.c:1929
           [<00000000df3aa8e7>] sock_sendmsg_nosec net/socket.c:704 [inline]
           [<00000000df3aa8e7>] sock_sendmsg+0x14e/0x190 net/socket.c:724
           [<000000002154c54c>] ____sys_sendmsg+0x709/0x870 net/socket.c:2403
           [<000000001aab01d7>] ___sys_sendmsg+0xff/0x170 net/socket.c:2457
           [<00000000fa3b1446>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486
           [<00000000db2ee9c7>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
           [<00000000db2ee9c7>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
           [<000000005873517d>] entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      We should not require an allocation to cleanup stuff.
      
      Rework the code a bit so that the additional RCU work is no more needed.
      
      Fixes: 1729cf18 ("mptcp: create the listening socket for new port")
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a0eea5f1
  5. Aug 18, 2021
  6. Aug 17, 2021
Loading