- 27 Apr, 2021 30 commits
-
-
Gong, Sishuai authored
l2tp_tunnel_register() registers a tunnel without fully initializing its attribute. This can allow another kernel thread running l2tp_xmit_core() to access the uninitialized data and then cause a kernel NULL pointer dereference error, as shown below. Thread 1 Thread 2 //l2tp_tunnel_register() list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list); //pppol2tp_connect() tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id); // Fetch the new tunnel ... //l2tp_xmit_core() struct sock *sk = tunnel->sock; ... bh_lock_sock(sk); //Null pointer error happens tunnel->sock = sk; Fix this bug by initializing tunnel->sock before adding the tunnel into l2tp_tunnel_list. Reviewed-by:Cong Wang <cong.wang@bytedance.com> Signed-off-by:
Sishuai Gong <sishuai@purdue.edu> Reported-by:
David S. Miller <davem@davemloft.net>
-
Jiapeng Chong authored
Variable rc is set to zero but this value is never read as it is overwritten with a new value later on, hence it is a redundant assignment and can be removed. Cleans up the following clang-analyzer warning: net/smc/af_smc.c:1079:3: warning: Value stored to 'rc' is never read [clang-analyzer-deadcode.DeadStores]. Reported-by:
Abaci Robot <abaci@linux.alibaba.com> Signed-off-by:
Jiapeng Chong <jiapeng.chong@linux.alibaba.com> Signed-off-by:
-
Jiapeng Chong authored
Variable err is set to -ENOMEM but this value is never read as it is overwritten with a new value later on, hence it is a redundant assignment and can be removed. Cleans up the following clang-analyzer warning: net/mpls/af_mpls.c:1022:2: warning: Value stored to 'err' is never read [clang-analyzer-deadcode.DeadStores]. Reported-by:
-
Jiapeng Chong authored
Variable rc is set to zero but this value is never read as it is overwritten with a new value later on, hence it is a redundant assignment and can be removed. Cleans up the following clang-analyzer warning: net/llc/llc_station.c:86:2: warning: Value stored to 'rc' is never read [clang-analyzer-deadcode.DeadStores]. Reported-by:
-
Jiapeng Chong authored
record is being initialized to ctx->open_record but this is never read as record is overwritten later on. Remove the redundant initialization. Cleans up the following clang-analyzer warning: net/tls/tls_device.c:421:26: warning: Value stored to 'record' during its initialization is never read [clang-analyzer-deadcode.DeadStores]. Reported-by:
-
Jiapeng Chong authored
Variable nr_sig is being assigned a value however the assignment is never read, so this redundant assignment can be removed. Cleans up the following clang-analyzer warning: net/rds/ib_send.c:297:2: warning: Value stored to 'nr_sig' is never read [clang-analyzer-deadcode.DeadStores]. Reported-by:
-
David S. Miller authored
Oleksij Rempel says: ==================== microchip: add support for ksz88x3 driver family changes v8: - add Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> - fix build issue on "net: dsa: microchip: ksz8795: move register offsets and shifts to separate struct" changes v7: - Reverse christmas tree fixes - remove IS_88X3 and use chip_id instead - drop own tag and use DSA_TAG_PROTO_KSZ9893 instead changes v6: - take over this patch set - rebase against latest netdev-next and fix regressions - disable VLAN support for KSZ8863. KSZ8863's VLAN is not compatible to the KSZ8795's. So disable it for now and mainline it separately. This series adds support for the ksz88x3 driver family to the dsa based ksz drivers. The driver is making use of the already available ksz8795 driver and moves it to an generic driver for the ksz8 based chips which have similar functions but an totaly different register layout. The mainlining discussion history of this branch: v1: https://lore.kernel.org/netdev/20191107110030.25199-1-m.grzeschik@pengutronix.de/ v2: https://lore.kernel.org/netdev/20191218200831.13796-1-m.grzeschik@pengutronix.de/ v3: https://lore.kernel.org/netdev/20200508154343.6074-1-m.grzeschik@pengutronix.de/ v4: https://lore.kernel.org/netdev/20200803054442.20089-1-m.grzeschik@pengutronix.de/ v5: https://lore.kernel.org/netdev/20201207125627.30843-1-m.grzeschik@pengutronix.de/ ==================== Signed-off-by:
-
Michael Grzeschik authored
Microchip SMI0 Mode is a special mode, where the MDIO Read/Write commands are part of the PHY Address and the OP Code is always 0. We add the compatible for this special mode of the bitbanged mdio driver. Cc: devicetree@vger.kernel.org Reviewed-by:
Andrew Lunn <andrew@lunn.ch> Reviewed-by:
Florian Fainelli <f.fainelli@gmail.com> Acked-by:
Rob Herring <robh@kernel.org> Signed-off-by:
Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by:
Oleksij Rempel <o.rempel@pengutronix.de> Signed-off-by:
-
Michael Grzeschik authored
Add KSZ88X3 driver support. We add support for the KXZ88X3 three port switches using the Microchip SMI Interface. They are supported using the MDIO-Bitbang Interface. Signed-off-by:
-
Andrew Lunn authored
SMI0 is a mangled version of MDIO. The main low level difference is the MDIO C22 OP code is always 0, not 0x2 or 0x1 for Read/Write. The read/write information is instead encoded in the PHY address. Extend the bit-bang code to allow the op code to be overridden, but default to normal C22 values. Add an extra compatible to the mdio-gpio driver, and when this compatible is present, set the op codes to 0. A higher level driver, sitting on top of the basic MDIO bus driver can then implement the rest of the microchip SMI0 odderties. Signed-off-by:
-
Michael Grzeschik authored
It is a 3-Port 10/100 Ethernet Switch. One CPU-Port and two Switch-Ports. Cc: devicetree@vger.kernel.org Reviewed-by:
-
Michael Grzeschik authored
Add KSZ88X3 driver support. We add support for the KXZ88X3 three port switches using the SPI Interface. Reviewed-by:
-
Oleksij Rempel authored
We add support for the ksz8863 and ksz8873 chips which are using the same register patterns but other offsets as the ksz8795. Signed-off-by:
-
Michael Grzeschik authored
In order to get this driver used with other switches the functions need to use different offsets and register shifts. This patch changes the direct use of the register defines to register description structures, which can be set depending on the chips register layout. Signed-off-by:
-
Michael Grzeschik authored
This patch moves the cpu interface selection code to a individual function specific for ksz8795. It will make it simpler to customize the code path for different switches supported by this driver. Signed-off-by:
-
Michael Grzeschik authored
The driver can be used on other chips of this type. To reflect this we rename the drivers prefix from ksz8795 to ksz8. Signed-off-by:
-
David S. Miller authored
Yangbo Lu says: ==================== Support Ocelot PTP Sync one-step timestamping This patch-set is to support Ocelot PTP Sync one-step timestamping. Actually before that, this patch-set cleans up and optimizes the DSA slave tx timestamp request handling process. Changes for v2: - Split tx timestamp optimization patch. - Updated doc patch. - Freed skb->cb usage in dsa core driver, and moved to device drivers. - Other minor fixes. Changes for v3: - Switched sequence of patch #3 and #4 with rebasing to fix build. - Replaced hard coded 48 of memset(skb->cb, 0, 48) with sizeof(). ==================== Signed-off-by: -
Yangbo Lu authored
Although HWTSTAMP_TX_ONESTEP_SYNC existed in ioctl for hardware timestamp configuration, the PTP Sync one-step timestamping had never been supported. This patch is to truely support it. - ocelot_port_txtstamp_request() This function handles tx timestamp request by storing ptp_cmd(tx timestamp type) in OCELOT_SKB_CB(skb)->ptp_cmd, and additionally for two-step timestamp storing ts_id in OCELOT_SKB_CB(clone)->ptp_cmd. - ocelot_ptp_rew_op() During xmit, this function is called to get rew_op (rewriter option) by checking skb->cb for tx timestamp request, and configure to transmitting. Non-onestep-Sync packet with one-step timestamp request falls back to use two-step timestamp. Signed-off-by:
Yangbo Lu <yangbo.lu@nxp.com> Acked-by:
Richard Cochran <richardcochran@gmail.com> Signed-off-by:
-
Yangbo Lu authored
Convert to a common ocelot_port_txtstamp_request() for TX timestamp request handling. Signed-off-by:
Vladimir Oltean <vladimir.oltean@nxp.com> Acked-by:
-
Yangbo Lu authored
Update timestamping doc for DSA switches to describe current implementation accurately. On TX, the skb cloning is no longer in DSA generic code. Signed-off-by:
-
Yangbo Lu authored
Free skb->cb usage in core driver and let device drivers decide to use or not. The reason having a DSA_SKB_CB(skb)->clone was because dsa_skb_tx_timestamp() which may set the clone pointer was called before p->xmit() which would use the clone if any, and the device driver has no way to initialize the clone pointer. This patch just put memset(skb->cb, 0, sizeof(skb->cb)) at beginning of dsa_slave_xmit(). Some new features in the future, like one-step timestamp may need more bytes of skb->cb to use in dsa_skb_tx_timestamp(), and p->xmit(). Signed-off-by:
-
Yangbo Lu authored
It was a waste to clone skb directly in dsa_skb_tx_timestamp(). For one-step timestamping, a clone was not needed. For any failure of port_txtstamp (this may usually happen), the skb clone had to be freed. So this patch moves skb cloning for tx timestamp out of dsa core, and let drivers clone skb in port_txtstamp if they really need. Signed-off-by:
Kurt Kanzenbach <kurt@linutronix.de> Acked-by:
-
Yangbo Lu authored
Move ptp_classify_raw out of dsa core driver for handling tx timestamp request. Let device drivers do this if they want. Not all drivers want to limit tx timestamping for only PTP packet. Signed-off-by:
-
Yangbo Lu authored
Check tx timestamp request in core driver at very beginning of dsa_skb_tx_timestamp(), so that most skbs not requiring tx timestamp just return. And drop such checking in device drivers. Signed-off-by:
-
qhjindev authored
change 'privae' to 'private' Signed-off-by:
qhjindev <qhjin_dev@163.com> Signed-off-by:
-
Tobias Waldekranz authored
The .serdes_get_lane op used the magic value 0xff to indicate a valid SERDES lane and 0 signaled that a non-SERDES mode was set on the port. Unfortunately, "0" is also a valid lane ID, so even when these ports where configured to e.g. RGMII the driver would set them up as SERDES ports. - Replace 0xff with 0 to indicate a valid lane ID. The number is on the one hand just as arbitrary, but it is at least the first valid one and therefore less of a surprise. - Follow the other .serdes_get_lane implementations and return -ENODEV in the case where no SERDES is assigned to the port. Fixes: f5be107c ("net: dsa: mv88e6xxx: Support serdes ports on MV88E6097/6095/6185") Signed-off-by:
Tobias Waldekranz <tobias@waldekranz.com> Reviewed-by:
-
Ivan Bornyakov authored
There is no real need for disabling autonigotiation in config_init(). Leave it enabled by default. Signed-off-by:
Ivan Bornyakov <i.bornyakov@metrotek.ru> Signed-off-by:
-
Jiapeng Chong authored
Variable offset is being assigned a value from a calculation however the variable is never read, so this redundant variable can be removed. Cleans up the following clang-analyzer warning: net/rxrpc/rxkad.c:579:2: warning: Value stored to 'offset' is never read [clang-analyzer-deadcode.DeadStores]. net/rxrpc/rxkad.c:485:2: warning: Value stored to 'offset' is never read [clang-analyzer-deadcode.DeadStores]. Reported-by:
-
Christophe JAILLET authored
Use 'hash_for_each_rcu' and 'hash_for_each_safe' instead of hand writing them. This saves some lines of code, reduce indentation and improve readability. Signed-off-by:
Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by:
-
Linus Lüssing authored
The IPv6 Multicast Router Advertisements parsing has the following two issues: For one thing, ICMPv6 MRD Advertisements are smaller than ICMPv6 MLD messages (ICMPv6 MRD Adv.: 8 bytes vs. ICMPv6 MLDv1/2: >= 24 bytes, assuming MLDv2 Reports with at least one multicast address entry). When ipv6_mc_check_mld_msg() tries to parse an Multicast Router Advertisement its MLD length check will fail - and it will wrongly return -EINVAL, even if we have a valid MRD Advertisement. With the returned -EINVAL the bridge code will assume a broken packet and will wrongly discard it, potentially leading to multicast packet loss towards multicast routers. The second issue is the MRD header parsing in br_ip6_multicast_mrd_rcv(): It wrongly checks for an ICMPv6 header immediately after the IPv6 header (IPv6 next header type). However according to RFC4286, section 2 all MRD messages contain a Router Alert option (just like MLD). So instead there is an IPv6 Hop-by-Hop option for the Router Alert between the IPv6 and ICMPv6 header, again leading to the bridge wrongly discarding Multicast Router Advertisements. To fix these two issues, introduce a new return value -ENODATA to ipv6_mc_check_mld() to indicate a valid ICMPv6 packet with a hop-by-hop option which is not an MLD but potentially an MRD packet. This also simplifies further parsing in the bridge code, as ipv6_mc_check_mld() already fully checks the ICMPv6 header and hop-by-hop option. These issues were found and fixed with the help of the mrdisc tool (https://github.com/troglobit/mrdisc). Fixes: 4b3087c7 ("bridge: Snoop Multicast Router Advertisements") Signed-off-by:
Linus Lüssing <linus.luessing@c0d3.blue> Signed-off-by:
-
- 26 Apr, 2021 10 commits
-
-
Lv Yunlong authored
In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd(). But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len). As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len, thus my patch assigns skb->len to 'len' before the possible free and use 'len' instead of skb->len later. Fixes: b9b17deb ("net: emac: emac gigabit ethernet controller driver") Signed-off-by:
Lv Yunlong <lyl2019@mail.ustc.edu.cn> Signed-off-by:
-
Davide Caratti authored
while testing re-assembly/re-fragmentation using act_ct, it's possible to observe a crash like the following one: KASAN: maybe wild-memory-access in range [0x0001000000000448-0x000100000000044f] CPU: 50 PID: 0 Comm: swapper/50 Tainted: G S 5.12.0-rc7+ #424 Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP: 0010:inet_frag_rbtree_purge+0x50/0xc0 Code: 00 fc ff df 48 89 c3 31 ed 48 89 df e8 a9 7a 38 ff 4c 89 fe 48 89 df 49 89 c6 e8 5b 3a 38 ff 48 8d 7b 40 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 75 59 48 8d bb d0 00 00 00 4c 8b 6b 40 48 89 f8 48 RSP: 0018:ffff888c31449db8 EFLAGS: 00010203 RAX: 0000200000000089 RBX: 000100000000040e RCX: ffffffff989eb960 RDX: 0000000000000140 RSI: ffffffff97cfb977 RDI: 000100000000044e RBP: 0000000000000900 R08: 0000000000000000 R09: ffffed1186289350 R10: 0000000000000003 R11: ffffed1186289350 R12: dffffc0000000000 R13: 000100000000040e R14: 0000000000000000 R15: ffff888155e02160 FS: 0000000000000000(0000) GS:ffff888c31440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005600cb70a5b8 CR3: 0000000a2c014005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> inet_frag_destroy+0xa9/0x150 call_timer_fn+0x2d/0x180 run_timer_softirq+0x4fe/0xe70 __do_softirq+0x197/0x5a0 irq_exit_rcu+0x1de/0x200 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ> when act_ct temporarily stores an IP fragment, restoring the skb qdisc cb results in putting random data in FRAG_CB(), and this causes those "wild" memory accesses later, when the rbtree is purged. Never overwrite the skb cb in case tcf_ct_handle_fragments() returns -EINPROGRESS. Fixes: ae372cb1 ("net/sched: act_ct: fix restore the qdisc_skb_cb after defrag") Fixes: 7baf2429 ("net/sched: cls_flower add CT_FLAGS_INVALID flag support") Reported-by:
Shuang Li <shuali@redhat.com> Signed-off-by:
Davide Caratti <dcaratti@redhat.com> Signed-off-by:
-
Arnaldo Carvalho de Melo authored
Ingo sent typo fixes for tools/ and this resulted in a warning when building the perf/core branch that will be sent upstream in the next merge window: Warning: Kernel ABI header at 'tools/perf/trace/beauty/include/linux/socket.h' differs from latest version at 'include/linux/socket.h' diff -u tools/perf/trace/beauty/include/linux/socket.h include/linux/socket.h Fix the typo on the kernel file to address this. Signed-off-by:
Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by:
-
Ezequiel Garcia authored
Convert Rockchip dwmac controller dt-bindings to YAML. Signed-off-by:
Ezequiel Garcia <ezequiel@collabora.com> Reviewed-by:
David Wu <david.wu@rock-chips.com> Signed-off-by:
-
Ezequiel Garcia authored
Add Rockchip DWMAC controllers, which are based on snps,dwmac. Some of the SoCs require up to eight clocks, so maxItems for clocks and clock-names need to be increased. Signed-off-by:
-
Ezequiel Garcia authored
Rockchip DWMAC glue driver uses the phy node (phy-handle) reset specifier, and not a "mac-phy" reset specifier. Remove it. Signed-off-by:
-
Johan Hovold authored
Commit 8a12f883 ("net: hso: fix null-ptr-deref during tty device unregistration") fixed the racy minor allocation reported by syzbot, but introduced an unconditional NULL-pointer dereference on every disconnect instead. Specifically, the serial device table must no longer be accessed after the minor has been released by hso_serial_tty_unregister(). Fixes: 8a12f883 ("net: hso: fix null-ptr-deref during tty device unregistration") Cc: stable@vger.kernel.org Cc: Anirudh Rayabharam <mail@anirudhrb.com> Reported-by:
Leonardo Antoniazzi <leoanto@aruba.it> Signed-off-by:
Johan Hovold <johan@kernel.org> Reviewed-by:
Anirudh Rayabharam <mail@anirudhrb.com> Signed-off-by:
-
David S. Miller authored
Merge tag 'linux-can-next-for-5.13-20210426' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2021-04-26 this is a pull request of 4 patches for net-next/master. the first two patches are from Colin Ian King and target the etas_es58x driver, they add a missing NULL pointer check and fix some typos. The next two patches are by Erik Flodin. The first one updates the CAN documentation regarding filtering, the other one fixes the header alignment in CAN related proc output on 64 bit systems. ==================== Signed-off-by:
-
Jiapeng Chong authored
Variable ret is set to zero but this value is never read as it is overwritten with a new value later on, hence it is a redundant assignment and can be removed. Cleans up the following clang-analyzer warning: drivers/net/ethernet/davicom/dm9000.c:1527:5: warning: Value stored to 'ret' is never read [clang-analyzer-deadcode.DeadStores]. Reported-by:
-
Jiapeng Chong authored
Variable prev_link and curr_link is being assigned a value from a calculation however the variable is never read, so this redundant variable can be removed. Cleans up the following clang-analyzer warning: drivers/net/ethernet/amd/pcnet32.c:2857:4: warning: Value stored to 'prev_link' is never read [clang-analyzer-deadcode.DeadStores]. drivers/net/ethernet/amd/pcnet32.c:2856:4: warning: Value stored to 'curr_link' is never read [clang-analyzer-deadcode.DeadStores]. Reported-by:
-
