- 13 12月, 2018 1 次提交
-
-
由 Vasyl Vavrychuk 提交于
commit a1881c9b8a1edef0a5ae1d5c1b61406fe3402114 upstream. Otherwise if network manager starts configuring Wi-Fi interface immidiatelly after getting notification of its creation, we will get NULL pointer dereference: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff95ae94c8>] hrtimer_active+0x28/0x50 ... Call Trace: [<ffffffff95ae9997>] ? hrtimer_try_to_cancel+0x27/0x110 [<ffffffff95ae9a95>] ? hrtimer_cancel+0x15/0x20 [<ffffffffc0803bf0>] ? mac80211_hwsim_config+0x140/0x1c0 [mac80211_hwsim] Cc: stable@vger.kernel.org Signed-off-by: NVasyl Vavrychuk <vasyl.vavrychuk@globallogic.com> Signed-off-by: NJohannes Berg <johannes.berg@intel.com> Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
-
- 26 9月, 2018 3 次提交
-
-
由 Martin Willi 提交于
The allocation of hwsim radio identifiers uses a post-increment from 0, so the first radio has idx 0. This idx is explicitly excluded from multicast announcements ever since, but it is unclear why. Drop that idx check and announce the first radio as well. This makes userspace happy if it relies on these events. Signed-off-by: NMartin Willi <martin@strongswan.org> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
由 Martin Willi 提交于
The asynchronous destruction from a work-queue of radios tagged with destroy-on-close may race with the owning namespace about to exit, resulting in potential use-after-free of that namespace. Instead of using a work-queue, move radios about to destroy to a temporary list, which can be worked on synchronously after releasing the lock. This should be safe to do from the netlink socket notifier, as the namespace is guaranteed to not get released. Signed-off-by: NMartin Willi <martin@strongswan.org> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
由 Martin Willi 提交于
The cleanup of radios during namespace exit has recently been reworked to directly delete a radio while temporarily releasing the spinlock, fixing a race condition between the work-queue execution and namespace exits. However, the temporary unlock allows unsafe modifications on the iterated list, resulting in a potential crash when continuing the iteration of additional radios. Move radios about to destroy to a temporary list, and clean that up after releasing the spinlock once iteration is complete. Fixes: 8cfd36a0 ("mac80211_hwsim: fix use-after-free bug in hwsim_exit_net") Signed-off-by: NMartin Willi <martin@strongswan.org> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 28 8月, 2018 2 次提交
-
-
由 Jinbum Park 提交于
User controls @idx which to be used as index of hwsim_world_regdom_custom. So, It can be exploited via Spectre-like attack. (speculative execution) This kind of attack leaks address of hwsim_world_regdom_custom, It leads an attacker to bypass security mechanism such as KASLR. So sanitize @idx before using it to prevent attack. I leveraged strategy [1] to find and exploit this gadget. [1] https://github.com/jinb-park/linux-exploit/tree/master/exploit-remaining-spectre-gadget/Signed-off-by: NJinbum Park <jinb.park7@gmail.com> [johannes: unwrap URL] Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
由 Danek Duvall 提交于
The mac80211_hwsim driver intends to say that it supports up to four STBC receive streams, but instead it ends up saying something undefined. The IEEE80211_VHT_CAP_RXSTBC_X macros aren't independent bits that can be ORed together, but values. In this case, _4 is the appropriate one to use. Signed-off-by: NDanek Duvall <duvall@comfychair.org> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 16 8月, 2018 1 次提交
-
-
由 Johannes Berg 提交于
Syzbot continues to try to create mac80211_hwsim radios, and manages to pass parameters that are later checked with WARN_ON in cfg80211 - catch another one in hwsim directly. Reported-by: syzbot+2a12f11c306afe871c1f@syzkaller.appspotmail.com Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 09 7月, 2018 1 次提交
-
-
由 Ilan Peer 提交于
Add support for HE in mac8011_hwsim, conforming with P802.11ax_D2.0. Signed-off-by: NLiad Kaufman <liad.kaufman@intel.com> Signed-off-by: NIlan Peer <ilan.peer@intel.com> Signed-off-by: NLuca Coelho <luciano.coelho@intel.com> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 15 6月, 2018 1 次提交
-
-
由 Johannes Berg 提交于
We didn't free the workqueue on any errors, nor did we correctly check for rhashtable allocation errors, nor did we free the hashtable on error. Reported-by: NColin King <colin.king@canonical.com> Reported-by: NDan Carpenter <dan.carpenter@oracle.com> Signed-off-by: NJohannes Berg <johannes.berg@intel.com> Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
-
- 29 5月, 2018 1 次提交
-
-
由 YueHaibing 提交于
the message be freed immediately, no need to trim it back to the previous size. Inspired by commit 7a9b3ec1 ("nl80211: remove unnecessary genlmsg_cancel() calls") Signed-off-by: NYueHaibing <yuehaibing@huawei.com> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
- 22 5月, 2018 1 次提交
-
-
由 Andrew Zaborowski 提交于
Since 6335698e the radio with idx of 0 will not get dumped in HWSIM_CMD_GET_RADIO because of the last_idx checks. Offset cb->args[0] by 1 similarly to what is done in nl80211.c. Fixes: 6335698e ("mac80211_hwsim: add generation count for netlink dump operation") Signed-off-by: NAndrew Zaborowski <andrew.zaborowski@intel.com> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 07 5月, 2018 1 次提交
-
-
由 YueHaibing 提交于
'hwname' should be freed before leaving from the error handling cases, otherwise it will cause mem leak Fixes: cb1a5bae ("mac80211_hwsim: add permanent mac address option for new radios") Signed-off-by: NYueHaibing <yuehaibing@huawei.com> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 19 4月, 2018 1 次提交
-
-
由 Bjoern Johansson 提交于
Without this, higher layers in the kernel will return an error code when trying to set the power state because the driver doesn't indicate power state support. This in turn causes VTS (Android Vendor Test Suite) failures because the WiFi HAL can't enable power saving mode. Signed-off-by: NBjoern Johansson <bjoernj@google.com> Signed-off-by: NLingfeng Yang <lfy@google.com> Signed-off-by: NRoman Kiryanov <rkir@google.com> [johannes: remove remaining code, it was useless even as a skeleton since it didn't even have the right function arguments] Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 12 4月, 2018 1 次提交
-
-
由 Matthew Wilcox 提交于
This is preferred to opencoding an IDA_INIT. Link: http://lkml.kernel.org/r/20180313132639.17387-2-willy@infradead.orgSigned-off-by: NMatthew Wilcox <mawilcox@microsoft.com> Signed-off-by: NAndrew Morton <akpm@linux-foundation.org> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
- 28 3月, 2018 1 次提交
-
-
由 Kirill Tkhai 提交于
Synchronous pernet_operations are not allowed anymore. All are asynchronous. So, drop the structure member. Signed-off-by: NKirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
- 21 3月, 2018 3 次提交
-
-
由 Andrew Zaborowski 提交于
Set the wmediumd to the net's wmediumd when the radio gets created. Radios created after HWSIM_CMD_REGISTER don't currently get their data->wmediumd set and the userspace would need to reconnect to netlink to be able to call HWSIM_CMD_REGISTER again. Alternatively I think data->netgroup and data->wmedium could be replaced with a pointer to hwsim_net. Signed-off-by: NAndrew Zaborowski <andrew.zaborowski@intel.com> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
由 Benjamin Beichler 提交于
When destroying a net namespace, all hwsim interfaces, which are not created in default namespace are deleted. But the async deletion of the interfaces could last longer than the actual destruction of the namespace, which results to an use after free bug. Therefore use synchronous deletion in this case. Fixes: 100cb9ff ("mac80211_hwsim: Allow managing radios from non-initial namespaces") Reported-by: syzbot+70ce058e01259de7bb1d@syzkaller.appspotmail.com Signed-off-by: NBenjamin Beichler <benjamin.beichler@uni-rostock.de> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
由 Johannes Berg 提交于
OR'ing in 0x40 before a memcpy() to overwrite the value doesn't do much good - flip the order of operations are reported and tested by Jouni. Fixes: cb1a5bae ("mac80211_hwsim: add permanent mac address option for new radios") Reported-by: NJouni Malinen <j@w1.fi> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 02 3月, 2018 2 次提交
-
-
由 Kirill Tkhai 提交于
These pernet_operations allocate and destroy IDA identifier, and these actions are synchronized by IDA subsystem locks. Exit method removes mac80211_hwsim_data enteries from the lists, and this is synchronized by hwsim_radio_lock with the rest parallel pernet_operations. Also it queues destroy_radio() work, and these work already may be executed in parallel with any pernet_operations (as it's a work :). So, we may mark these pernet_operations as async. Signed-off-by: NKirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
由 Kirill Tkhai 提交于
hwsim_netgroup counter is declarated as int, and it is incremented every time a new net is created. After sizeof(int) net are created, it will overflow, and different net namespaces will have the same identifier. This patch fixes the problem by introducing IDA instead of int counter. IDA guarantees, all the net namespaces have the uniq identifier. Note, that after we do ida_simple_remove() in hwsim_exit_net(), and we destroy the ID, later there may be executed destroy_radio() from the workqueue. But destroy_radio() does not use the ID, so it's OK. Out of bounds of this patch, just as a report to wireless subsystem maintainer, destroy_radio() increaments hwsim_radios_generation without hwsim_radio_lock, so this may need one more patch to fix. Signed-off-by: NKirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 19 2月, 2018 1 次提交
-
-
由 Johannes Berg 提交于
We're obviously not part of a memory reclaim path, so don't set the flag. This also causes a warning in check_flush_dependency() since we end up in a code path that flushes a non-reclaim workqueue, and we shouldn't do that if we were really part of reclaim. Reported-by: syzbot+41cdaf4232c50e658934@syzkaller.appspotmail.com Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 31 1月, 2018 3 次提交
-
-
由 Benjamin Beichler 提交于
Make the dump operation aware of changes on radio list and corresponding inconsistent dumps. Changed variable name for better understanding. Signed-off-by: NBenjamin Beichler <benjamin.beichler@uni-rostock.de> [compress ternary operator] Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
由 Benjamin Beichler 提交于
Add a NL_ERR_MSG in case of creating a radio by a netlink message to give clear output to the creating process instead of creating only a debug message in kernel log. The same function is used for the creation while module load, so keep the old message, although it should never be thrown while load, because the module controls all mac addresses. Signed-off-by: NBenjamin Beichler <benjamin.beichler@uni-rostock.de> [remove message, add missing braces] Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
由 Benjamin Beichler 提交于
If simulation needs predictable permanent mac addresses of hwsim wireless phy, this patch add the ability to create a new radio with a user defined permanent mac address. Allowed mac addresses needs to be locally administrated mac addresses (as also the former fixed 42:* and 02:* were). To do not break the operation with legacy software using hwsim, the new address is set twice. The problem here is, the netlink call backs use wiphy->addresses[1] as identification of a radio and not the proposed permanent address (wiphy->addresses[0]). This design decision is not documented in the kernel repo, therefore this patch simply reproduces this, but with the same address. Signed-off-by: NBenjamin Beichler <benjamin.beichler@uni-rostock.de> [make pointer const] Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 22 1月, 2018 1 次提交
-
-
由 weiyongjun (A) 提交于
'hwname' is malloced in hwsim_new_radio_nl() and should be freed before leaving from the error handling cases, otherwise it will cause memory leak. Fixes: ff4dd73d ("mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length") Signed-off-by: NWei Yongjun <weiyongjun1@huawei.com> Reviewed-by: NBen Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 15 1月, 2018 4 次提交
-
-
由 Benjamin Beichler 提交于
For correct interpretation of a tx rate, the corresponding rate flags are needed (e.g. whether a HT-MCS rate or a legacy rate) and moreover for more correct simulation the other infos of the flags are important (like short-GI). Keeping compatibility, the flags are not integrated into the existing hwsim_tx_rate, but transmitted as an additional netlink attribute. Signed-off-by: NBenjamin Beichler <benjamin.beichler@uni-rostock.de> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
由 Benjamin Beichler 提交于
This patch adds a rhastable for mac address lookup of hwsim radios. This especially improve the speed on reception of a netlink message with a new frame. Although redundant, we keep holding a normal list for all radios, since the rhashtable_walk interface adds a lot of overhead for iterating over all radios and the doc of rhashtable recommend a redundant structure for stable walks in such situations. Since rhashtable is rcu protected we do not need a lock for delivering frames and thus improving this scenario. Signed-off-by: NBenjamin Beichler <benjamin.beichler@uni-rostock.de> [remove hash function, it would cause alignment issues] Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
由 Johannes Berg 提交于
When creating a new radio on the fly, hwsim allows this to be done with an arbitrary number of channels, but cfg80211 only supports a limited number of simultaneous channels, leading to a warning. Fix this by validating the number - this requires moving the define for the maximum out to a visible header file. Reported-by: syzbot+8dd9051ff19940290931@syzkaller.appspotmail.com Fixes: b59ec8dd ("mac80211_hwsim: fix number of channels in interface combinations") Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
由 Benjamin Beichler 提交于
When closing multiple wmediumd instances with many radios and try to unload the mac80211_hwsim module, it may happen that the work items live longer than the module. To wait especially for this deletion work items, add a work queue, otherwise flush_scheduled_work would be necessary. Signed-off-by: NBenjamin Beichler <benjamin.beichler@uni-rostock.de> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 19 12月, 2017 2 次提交
-
-
由 Jia-Ju Bai 提交于
The driver may sleep under a spinlock. The function call path is: hwsim_get_radio_nl (acquire the spinlock) nlmsg_new(GFP_KERNEL) --> may sleep To fix it, GFP_KERNEL is replaced with GFP_ATOMIC. This bug is found by my static analysis tool(DSAC) and checked by my code review. Signed-off-by: NJia-Ju Bai <baijiaju1990@163.com> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
由 Adiel Aloni 提交于
Same as in ieee80211_nullfunc_get, enable the TODS bit, otherwise the nullfunc packet will not be handled in ap rx path. (will be dropped in ieee80211_accept_frame()). Signed-off-by: NAdiel Aloni <adiel.aloni@intel.com> Signed-off-by: NLuca Coelho <luciano.coelho@intel.com> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 11 12月, 2017 1 次提交
-
-
由 Adiel Aloni 提交于
Enforce using PS_MANUAL_POLL in ps hwsim debugfs to trigger a poll, only if PS_ENABLED was set before. This is required due to commit c9491367b759 ("mac80211: always update the PM state of a peer on MGMT / DATA frames") that enforces the ap to check only mgmt/data frames ps bit, and then update station's power save accordingly. When sending only ps-poll (control frame) the ap will not be aware that the station entered power save. Setting ps enable before triggering ps_poll, will send NDP with PM bit enabled first. Signed-off-by: NAdiel Aloni <adiel.aloni@intel.com> Signed-off-by: NLuca Coelho <luciano.coelho@intel.com> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 20 11月, 2017 1 次提交
-
-
由 Ben Hutchings 提交于
hwsim_new_radio_nl() now copies the name attribute in order to add a null-terminator. mac80211_hwsim_new_radio() (indirectly) copies it again into the net_device structure, so the first copy is not used or freed later. Free the first copy before returning. Fixes: ff4dd73d ("mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length") Signed-off-by: NBen Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 16 11月, 2017 1 次提交
-
-
由 Michal Kubecek 提交于
According to the description, first argument of genlmsg_nlhdr() points to what genlmsg_put() returns, i.e. beginning of user header. Therefore we should only subtract size of genetlink header and netlink message header, not user header. This also means we don't need to pass the pointer to genetlink family and the same is true for genl_dump_check_consistent() which is the only caller of genlmsg_nlhdr(). (Note that at the moment, these functions are only used for families which do not have user header so that they are not affected.) Fixes: 670dc283 ("netlink: advertise incomplete dumps") Signed-off-by: NMichal Kubecek <mkubecek@suse.cz> Reviewed-by: NJohannes Berg <johannes@sipsolutions.net> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
- 25 10月, 2017 1 次提交
-
-
由 Mark Rutland 提交于
locking/atomics: COCCINELLE/treewide: Convert trivial ACCESS_ONCE() patterns to READ_ONCE()/WRITE_ONCE() Please do not apply this to mainline directly, instead please re-run the coccinelle script shown below and apply its output. For several reasons, it is desirable to use {READ,WRITE}_ONCE() in preference to ACCESS_ONCE(), and new code is expected to use one of the former. So far, there's been no reason to change most existing uses of ACCESS_ONCE(), as these aren't harmful, and changing them results in churn. However, for some features, the read/write distinction is critical to correct operation. To distinguish these cases, separate read/write accessors must be used. This patch migrates (most) remaining ACCESS_ONCE() instances to {READ,WRITE}_ONCE(), using the following coccinelle script: ---- // Convert trivial ACCESS_ONCE() uses to equivalent READ_ONCE() and // WRITE_ONCE() // $ make coccicheck COCCI=/home/mark/once.cocci SPFLAGS="--include-headers" MODE=patch virtual patch @ depends on patch @ expression E1, E2; @@ - ACCESS_ONCE(E1) = E2 + WRITE_ONCE(E1, E2) @ depends on patch @ expression E; @@ - ACCESS_ONCE(E) + READ_ONCE(E) ---- Signed-off-by: NMark Rutland <mark.rutland@arm.com> Signed-off-by: NPaul E. McKenney <paulmck@linux.vnet.ibm.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: davem@davemloft.net Cc: linux-arch@vger.kernel.org Cc: mpe@ellerman.id.au Cc: shuah@kernel.org Cc: snitzer@redhat.com Cc: thor.thayer@linux.intel.com Cc: tj@kernel.org Cc: viro@zeniv.linux.org.uk Cc: will.deacon@arm.com Link: http://lkml.kernel.org/r/1508792849-3115-19-git-send-email-paulmck@linux.vnet.ibm.comSigned-off-by: NIngo Molnar <mingo@kernel.org>
-
- 21 9月, 2017 1 次提交
-
-
由 Lubomir Rintel 提交于
The mac80211_hwsim doesn't offer a way to disable the debugging output. Unfortunately, it's pretty chatty, dumping a lot of stuff into the message buffer. This patch changes it to use dyndbg for controlling the debug output. It's disabled by default, but can be enabled by a module parameter (1), at runtime (2) or persisted in modprobe.conf (3). (1) modprobe mac80211_hwsim dyndbg=+p (2) echo "module mac80211_hwsim +p" >/sys/kernel/debug/dynamic_debug/control (3) echo "options mac80211_hwsim dyndbg=+p" >>/etc/modprobe.d/my.conf Signed-off-by: NLubomir Rintel <lkundrak@v3.sk> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 05 9月, 2017 1 次提交
-
-
由 Beni Lev 提交于
In struct ieee80211_tx_info, control.vif pointer and rate_driver_data[0] falls on the same place, depending on the union usage. During the whole TX process, the union is referred to as a control struct, which holds the vif that is later used in the tx flow, especially in order to derive the used tx power. Referring direcly to rate_driver_data[0] and assigning a value to it, overwrites the vif pointer, hence making all later references irrelevant. Moreover, rate_driver_data[0] isn't used later in the flow in order to retrieve the channel that it is pointing to. Cc: stable@vger.kernel.org Signed-off-by: NBeni Lev <beni.lev@intel.com> Signed-off-by: NLuca Coelho <luciano.coelho@intel.com> Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
-
- 16 6月, 2017 3 次提交
-
-
由 Johannes Berg 提交于
It seems like a historic accident that these return unsigned char *, and in many places that means casts are required, more often than not. Make these functions return void * and remove all the casts across the tree, adding a (u8 *) cast only where the unsigned char pointer was used directly, all done with the following spatch: @@ expression SKB, LEN; typedef u8; identifier fn = { skb_push, __skb_push, skb_push_rcsum }; @@ - *(fn(SKB, LEN)) + *(u8 *)fn(SKB, LEN) @@ expression E, SKB, LEN; identifier fn = { skb_push, __skb_push, skb_push_rcsum }; type T; @@ - E = ((T *)(fn(SKB, LEN))) + E = fn(SKB, LEN) @@ expression SKB, LEN; identifier fn = { skb_push, __skb_push, skb_push_rcsum }; @@ - fn(SKB, LEN)[0] + *(u8 *)fn(SKB, LEN) Note that the last part there converts from push(...)[0] to the more idiomatic *(u8 *)push(...). Signed-off-by: NJohannes Berg <johannes.berg@intel.com> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
由 Johannes Berg 提交于
It seems like a historic accident that these return unsigned char *, and in many places that means casts are required, more often than not. Make these functions (skb_put, __skb_put and pskb_put) return void * and remove all the casts across the tree, adding a (u8 *) cast only where the unsigned char pointer was used directly, all done with the following spatch: @@ expression SKB, LEN; typedef u8; identifier fn = { skb_put, __skb_put }; @@ - *(fn(SKB, LEN)) + *(u8 *)fn(SKB, LEN) @@ expression E, SKB, LEN; identifier fn = { skb_put, __skb_put }; type T; @@ - E = ((T *)(fn(SKB, LEN))) + E = fn(SKB, LEN) which actually doesn't cover pskb_put since there are only three users overall. A handful of stragglers were converted manually, notably a macro in drivers/isdn/i4l/isdn_bsdcomp.c and, oddly enough, one of the many instances in net/bluetooth/hci_sock.c. In the former file, I also had to fix one whitespace problem spatch introduced. Signed-off-by: NJohannes Berg <johannes.berg@intel.com> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
由 Johannes Berg 提交于
A common pattern with skb_put() is to just want to memcpy() some data into the new space, introduce skb_put_data() for this. An spatch similar to the one for skb_put_zero() converts many of the places using it: @@ identifier p, p2; expression len, skb, data; type t, t2; @@ ( -p = skb_put(skb, len); +p = skb_put_data(skb, data, len); | -p = (t)skb_put(skb, len); +p = skb_put_data(skb, data, len); ) ( p2 = (t2)p; -memcpy(p2, data, len); | -memcpy(p, data, len); ) @@ type t, t2; identifier p, p2; expression skb, data; @@ t *p; ... ( -p = skb_put(skb, sizeof(t)); +p = skb_put_data(skb, data, sizeof(t)); | -p = (t *)skb_put(skb, sizeof(t)); +p = skb_put_data(skb, data, sizeof(t)); ) ( p2 = (t2)p; -memcpy(p2, data, sizeof(*p)); | -memcpy(p, data, sizeof(*p)); ) @@ expression skb, len, data; @@ -memcpy(skb_put(skb, len), data, len); +skb_put_data(skb, data, len); (again, manually post-processed to retain some comments) Reviewed-by: NStephen Hemminger <stephen@networkplumber.org> Signed-off-by: NJohannes Berg <johannes.berg@intel.com> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-