• Taehee Yoo's avatar
    net: rmnet: fix bridge mode bugs · d939b6d3
    Taehee Yoo authored
    In order to attach a bridge interface to the rmnet interface,
    "master" operation is used.
    (e.g. ip link set dummy1 master rmnet0)
    But, in the rmnet_add_bridge(), which is a callback of ->ndo_add_slave()
    doesn't register lower interface.
    So, ->ndo_del_slave() doesn't work.
    There are other problems too.
    1. It couldn't detect circular upper/lower interface relationship.
    2. It couldn't prevent stack overflow because of too deep depth
    of upper/lower interface
    3. It doesn't check the number of lower interfaces.
    4. Panics because of several reasons.
    
    The root problem of these issues is actually the same.
    So, in this patch, these all problems will be fixed.
    
    Test commands:
        modprobe rmnet
        ip link add dummy0 type dummy
        ip link add rmnet0 link dummy0 type rmnet mux_id 1
        ip link add dummy1 master rmnet0 type dummy
        ip link add dummy2 master rmnet0 type dummy
        ip link del rmnet0
        ip link del dummy2
        ip link del dummy1
    
    Splat looks like:
    [   41.867595][ T1164] general protection fault, probably for non-canonical address 0xdffffc0000000101I
    [   41.869993][ T1164] KASAN: null-ptr-deref in range [0x0000000000000808-0x000000000000080f]
    [   41.872950][ T1164] CPU: 0 PID: 1164 Comm: ip Not tainted 5.6.0-rc1+ #447
    [   41.873915][ T1164] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
    [   41.875161][ T1164] RIP: 0010:rmnet_unregister_bridge.isra.6+0x71/0xf0 [rmnet]
    [   41.876178][ T1164] Code: 48 89 ef 48 89 c6 5b 5d e9 fc fe ff ff e8 f7 f3 ff ff 48 8d b8 08 08 00 00 48 ba 00 7
    [   41.878925][ T1164] RSP: 0018:ffff8880c4d0f188 EFLAGS: 00010202
    [   41.879774][ T1164] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000101
    [   41.887689][ T1164] RDX: dffffc0000000000 RSI: ffffffffb8cf64f0 RDI: 0000000000000808
    [   41.888727][ T1164] RBP: ffff8880c40e4000 R08: ffffed101b3c0e3c R09: 0000000000000001
    [   41.889749][ T1164] R10: 0000000000000001 R11: ffffed101b3c0e3b R12: 1ffff110189a1e3c
    [   41.890783][ T1164] R13: ffff8880c4d0f200 R14: ffffffffb8d56160 R15: ffff8880ccc2c000
    [   41.891794][ T1164] FS:  00007f4300edc0c0(0000) GS:ffff8880d9c00000(0000) knlGS:0000000000000000
    [   41.892953][ T1164] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [   41.893800][ T1164] CR2: 00007f43003bc8c0 CR3: 00000000ca53e001 CR4: 00000000000606f0
    [   41.894824][ T1164] Call Trace:
    [   41.895274][ T1164]  ? rcu_is_watching+0x2c/0x80
    [   41.895895][ T1164]  rmnet_config_notify_cb+0x1f7/0x590 [rmnet]
    [   41.896687][ T1164]  ? rmnet_unregister_bridge.isra.6+0xf0/0xf0 [rmnet]
    [   41.897611][ T1164]  ? rmnet_unregister_bridge.isra.6+0xf0/0xf0 [rmnet]
    [   41.898508][ T1164]  ? __module_text_address+0x13/0x140
    [   41.899162][ T1164]  notifier_call_chain+0x90/0x160
    [   41.899814][ T1164]  rollback_registered_many+0x660/0xcf0
    [   41.900544][ T1164]  ? netif_set_real_num_tx_queues+0x780/0x780
    [   41.901316][ T1164]  ? __lock_acquire+0xdfe/0x3de0
    [   41.901958][ T1164]  ? memset+0x1f/0x40
    [   41.902468][ T1164]  ? __nla_validate_parse+0x98/0x1ab0
    [   41.903166][ T1164]  unregister_netdevice_many.part.133+0x13/0x1b0
    [   41.903988][ T1164]  rtnl_delete_link+0xbc/0x100
    [ ... ]
    
    Fixes: 60d58f97 ("net: qualcomm: rmnet: Implement bridge mode")
    Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    d939b6d3
rmnet_config.c 10.7 KB