linux-toradex.git/net/ieee802154, branch v4.4.57

net: fix percpu memory leaks

2015-11-03T03:47:14+00:00

This patch fixes following problems :

1) percpu_counter_init() can return an error, therefore
  init_frag_mem_limit() must propagate this error so that
  inet_frags_init_net() can do the same up to its callers.

2) If ip[46]_frags_ns_ctl_register() fail, we must unwind
   properly and free the percpu_counter.

Without this fix, we leave freed object in percpu_counters
global list (if CONFIG_HOTPLUG_CPU) leading to crashes.

This bug was detected by KASAN and syzkaller tool
(http://github.com/google/syzkaller)

Fixes: 6d7b857d541e ("net: use lib/percpu_counter API for fragmentation mem accounting")
Signed-off-by: Eric Dumazet 
Reported-by: Dmitry Vyukov 
Cc: Hannes Frederic Sowa 
Cc: Jesper Dangaard Brouer 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

ieee802154: 6lowpan: fix memory leak

2015-10-22T10:24:42+00:00

Looking at current situation of memory management in 6lowpan receive
function I detected some invalid handling. After calling
lowpan_invoke_rx_handlers we will do a kfree_skb and then NET_RX_DROP on
error handling. We don't do this before, also on
skb_share_check/skb_unshare which might manipulate the reference
counters.

After running some 'grep -r "dev_add_pack" net/' to look how others
packet-layer receive callbacks works I detected that every subsystem do
a kfree_skb, then NET_RX_DROP without calling skb functions which
might manipulate the skb reference counters. This is the reason why we
should do the same here like all others subsystems. I didn't find any
documentation how the packet-layer receive callbacks handle NET_RX_DROP
return values either.

This patch will add a kfree_skb, then NET_RX_DROP handling for the
"trivial checks", in case of skb_share_check/skb_unshare the kfree_skb
call will be done inside these functions.

Signed-off-by: Alexander Aring 
Signed-off-by: Marcel Holtmann

6lowpan: remove lowpan_is_addr_broadcast

2015-10-20T22:49:25+00:00

This macro is used at 802.15.4 6LoWPAN only and can be replaced by
memcmp with the interface broadcast address.

Signed-off-by: Alexander Aring 
Signed-off-by: Marcel Holtmann

6lowpan: move IPHC functionality defines

2015-10-20T22:49:25+00:00

This patch removes the IPHC related defines for doing bit manipulation
from global 6lowpan header to the iphc file which should the only one
implementation which use these defines.

Also move next header compression defines to their nhc implementation.

Signed-off-by: Alexander Aring 
Signed-off-by: Marcel Holtmann

6lowpan: cleanup lowpan_header_decompress

2015-10-20T22:49:24+00:00

This patch changes the lowpan_header_decompress function by removing
inklayer related information from parameters. This is currently for
supporting short and extended address for iphc handling in 802154.
We don't support short address handling anyway right now, but there
exists already code for handling short addresses in
lowpan_header_decompress.

The address parameters are also changed to a void pointer, so 6LoWPAN
linklayer specific code can put complex structures as these parameters
and cast it again inside the generic code by evaluating linklayer type
before. The order is also changed by destination address at first and
then source address, which is the same like all others functions where
destination is always the first, memcpy, dev_hard_header,
lowpan_header_compress, etc.

This patch also moves the fetching of iphc values from 6LoWPAN linklayer
specific code into the generic branch.

Signed-off-by: Alexander Aring 
Acked-by: Jukka Rissanen 
Signed-off-by: Marcel Holtmann

6lowpan: cleanup lowpan_header_compress

2015-10-20T22:49:24+00:00

This patch changes the lowpan_header_compress function by removing
unused parameters like "len" and drop static value parameters of
protocol type. Instead we really check the protocol type inside inside
the skb structure. Also we drop the use of IEEE802154_ADDR_LEN which is
link-layer specific. Instead we using EUI64_ADDR_LEN which should always
the default case for now.

Signed-off-by: Alexander Aring 
Acked-by: Jukka Rissanen 
Signed-off-by: Marcel Holtmann

6lowpan: move shared settings to lowpan_netdev_setup

2015-10-08T12:25:34+00:00

This patch moves values for all lowpan interface to the shared
implementation of 6lowpan. This patch also quietly fixes the forgotten
IFF_NO_QUEUE flag for the bluetooth 6LoWPAN interface. An identically
commit is 4afbc0d ("net: 6lowpan: convert to using IFF_NO_QUEUE") which
wasn't changed for bluetooth 6lowpan.

All 6lowpan interfaces should be virtual with IFF_NO_QUEUE, using EUI64
address length, the mtu size is 1280 (IPV6_MIN_MTU) and the netdev type
is ARPHRD_6LOWPAN.

Signed-off-by: Alexander Aring 
Acked-by: Jukka Rissanen 
Signed-off-by: Marcel Holtmann

nl802154: Missing return in nl802154_add_llsec_key()

2015-10-02T21:34:37+00:00

There was a missing return here so it meant that often
ieee802154_llsec_parse_key_id() was not called.

Fixes: a26c5fd7622d ('nl802154: add support for security layer')
Signed-off-by: Dan Carpenter 
Acked-by: Alexander Aring 
Signed-off-by: Marcel Holtmann

ieee802154: handle datagram variables as u16

2015-10-01T11:38:22+00:00

This reverts commit 9abc378c66e3d6f437eed77c1c534cbc183523f7
("ieee802154: 6lowpan: change datagram var types").

The reason is that I forgot the IPv6 fragmentation here. Our MTU of
lowpan interface is 1280 and skb->len should not above of that. If we
reach a payload above 1280 in IPv6 header then we have a IPv6
fragmentation above 802.15.4 6LoWPAN fragmentation. The type "u16" was
fine, instead I added now a WARN_ON_ONCE if skb->len is above MTU which
should never happen otherwise IPv6 on minimum MTU size is broken.

Signed-off-by: Alexander Aring 
Signed-off-by: Marcel Holtmann

ieee802154: 6lowpan: add tx/rx stats

2015-09-30T11:23:57+00:00

This patch adds support for increment transmit and receive stats. The
meaning of these stats are IPv6 based, which shows the stats after
running the 6lowpan adaptation layer (uncompression/compression,
fragmentation handling) on receive and before the adaptation layer
when transmit.

Signed-off-by: Alexander Aring 
Signed-off-by: Marcel Holtmann