linux-toradex.git/net/caif, branch v3.4.73

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08T15:29:41+00:00

[ Upstream commit f3d3342602f8bcbf37d7c46641cb9bca7618eb1c ]

This patch now always passes msg->msg_namelen as 0. recvmsg handlers must
set msg_namelen to the proper size <= sizeof(struct sockaddr_storage)
to return msg_name to the user.

This prevents numerous uninitialized memory leaks we had in the
recvmsg handlers and makes it harder for new code to accidentally leak
uninitialized memory.

Optimize for the case recvfrom is called with NULL as address. We don't
need to copy the address at all, so set it to NULL before invoking the
recvmsg handler. We can do so, because all the recvmsg handlers must
cope with the case a plain read() is called on them. read() also sets
msg_name to NULL.

Also document these changes in include/linux/net.h as suggested by David
Miller.

Changes since RFC:

Set msg->msg_name = NULL if user specified a NULL in msg_name but had a
non-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't
affect sendto as it would bail out earlier while trying to copy-in the
address. It also more naturally reflects the logic by the callers of
verify_iovec.

With this change in place I could remove "
if (!uaddr || msg_sys->msg_namelen == 0)
	msg->msg_name = NULL
".

This change does not alter the user visible error logic as we ignore
msg_namelen as long as msg_name is NULL.

Also remove two unnecessary curly brackets in ___sys_recvmsg and change
comments to netdev style.

Cc: David Miller 
Suggested-by: Eric Dumazet 
Signed-off-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

caif: Add missing braces to multiline if in cfctrl_linkup_request

2013-10-13T22:42:47+00:00

[ Upstream commit 0c1db731bfcf3a9fd6c58132134f8b0f423552f0 ]

The indentation here implies this was meant to be a multi-line if.

Introduced several years back in commit c85c2951d4da1236e32f1858db418221e624aba5
("caif: Handle dev_queue_xmit errors.")

Signed-off-by: Dave Jones 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

caif: Fix missing msg_namelen update in caif_seqpkt_recvmsg()

2013-05-01T16:41:04+00:00

[ Upstream commit 2d6fbfe733f35c6b355c216644e08e149c61b271 ]

The current code does not fill the msg_name member in case it is set.
It also does not set the msg_namelen member to 0 and therefore makes
net/socket.c leak the local, uninitialized sockaddr_storage variable
to userland -- 128 bytes of kernel stack memory.

Fix that by simply setting msg_namelen to 0 as obviously nobody cared
about caif_seqpkt_recvmsg() not filling the msg_name in case it was
set.

Signed-off-by: Mathias Krause 
Cc: Sjur Braendeland 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

caif: Fix access to freed pernet memory

2012-08-09T15:31:42+00:00

[ Upstream commit 96f80d123eff05c3cd4701463786b87952a6c3ac ]

unregister_netdevice_notifier() must be called before
unregister_pernet_subsys() to avoid accessing already freed
pernet memory. This fixes the following oops when doing rmmod:

Call Trace:
 [] caif_device_notify+0x4d/0x5a0 [caif]
 [] unregister_netdevice_notifier+0xb9/0x100
 [] caif_device_exit+0x1c/0x250 [caif]
 [] sys_delete_module+0x1a4/0x300
 [] ? trace_hardirqs_on_caller+0x15d/0x1e0
 [] ? trace_hardirqs_on_thunk+0x3a/0x3
 [] system_call_fastpath+0x1a/0x1f

RIP
 [] caif_get+0x51/0xb0 [caif]

Signed-off-by: Sjur Brændeland 
Acked-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

caif: Fix memory leakage in the chnl_net.c.

2012-04-13T15:01:44+00:00

Added kfree_skb() calls in the chnk_net.c file on
the error paths.

Signed-off-by: Sjur Brændeland 
Signed-off-by: David S. Miller

caif: make zero a legal caif connetion id.

2012-03-11T22:38:16+00:00

Connection ID configured through RTNL must allow zero as
connection id. If connection-id is not given when creating the
interface, configure a loopback interface using ifindex as
connection-id.

Signed-off-by: Sjur Brændeland 
Signed-off-by: David S. Miller

caif: Fix for a race in socket transmit with flow control.

2012-03-11T22:38:16+00:00

Kill faulty checks on flow-off leading to connection drop at race conditions.
caif_socket checks for flow-on before transmitting and goes to sleep or
return -EAGAIN upon flow stop. Remove faulty subsequent checks on flow-off
leading to connection drop. Also fix memory leaks on some of the errors paths.

Signed-off-by: Sjur Brændeland 
Signed-off-by: David S. Miller

caif: remove duplicate initialization

2012-02-07T18:39:37+00:00

"priv" is initialized twice.  I kept the second one, because it is next
to the check for NULL.

Signed-off-by: Dan Carpenter 
Signed-off-by: David S. Miller

caif: caifdev is never used in net/caif/caif_dev.c::transmit() - remove it.

2012-02-05T22:53:04+00:00

Signed-off-by: Jesper Juhl 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-02-04T21:39:32+00:00