1. 05 6月, 2019 1 次提交
  2. 22 1月, 2019 1 次提交
  3. 07 12月, 2018 1 次提交
  4. 24 10月, 2018 1 次提交
    • D
      iov_iter: Separate type from direction and use accessor functions · aa563d7b
      David Howells 提交于
      In the iov_iter struct, separate the iterator type from the iterator
      direction and use accessor functions to access them in most places.
      
      Convert a bunch of places to use switch-statements to access them rather
      then chains of bitwise-AND statements.  This makes it easier to add further
      iterator types.  Also, this can be more efficient as to implement a switch
      of small contiguous integers, the compiler can use ~50% fewer compare
      instructions than it has to use bitwise-and instructions.
      
      Further, cease passing the iterator type into the iterator setup function.
      The iterator function can set that itself.  Only the direction is required.
      Signed-off-by: NDavid Howells <dhowells@redhat.com>
      aa563d7b
  5. 26 7月, 2017 1 次提交
  6. 20 7月, 2017 1 次提交
  7. 08 6月, 2017 1 次提交
    • D
      net: Fix inconsistent teardown and release of private netdev state. · cf124db5
      David S. Miller 提交于
      Network devices can allocate reasources and private memory using
      netdev_ops->ndo_init().  However, the release of these resources
      can occur in one of two different places.
      
      Either netdev_ops->ndo_uninit() or netdev->destructor().
      
      The decision of which operation frees the resources depends upon
      whether it is necessary for all netdev refs to be released before it
      is safe to perform the freeing.
      
      netdev_ops->ndo_uninit() presumably can occur right after the
      NETDEV_UNREGISTER notifier completes and the unicast and multicast
      address lists are flushed.
      
      netdev->destructor(), on the other hand, does not run until the
      netdev references all go away.
      
      Further complicating the situation is that netdev->destructor()
      almost universally does also a free_netdev().
      
      This creates a problem for the logic in register_netdevice().
      Because all callers of register_netdevice() manage the freeing
      of the netdev, and invoke free_netdev(dev) if register_netdevice()
      fails.
      
      If netdev_ops->ndo_init() succeeds, but something else fails inside
      of register_netdevice(), it does call ndo_ops->ndo_uninit().  But
      it is not able to invoke netdev->destructor().
      
      This is because netdev->destructor() will do a free_netdev() and
      then the caller of register_netdevice() will do the same.
      
      However, this means that the resources that would normally be released
      by netdev->destructor() will not be.
      
      Over the years drivers have added local hacks to deal with this, by
      invoking their destructor parts by hand when register_netdevice()
      fails.
      
      Many drivers do not try to deal with this, and instead we have leaks.
      
      Let's close this hole by formalizing the distinction between what
      private things need to be freed up by netdev->destructor() and whether
      the driver needs unregister_netdevice() to perform the free_netdev().
      
      netdev->priv_destructor() performs all actions to free up the private
      resources that used to be freed by netdev->destructor(), except for
      free_netdev().
      
      netdev->needs_free_netdev is a boolean that indicates whether
      free_netdev() should be done at the end of unregister_netdevice().
      
      Now, register_netdevice() can sanely release all resources after
      ndo_ops->ndo_init() succeeds, by invoking both ndo_ops->ndo_uninit()
      and netdev->priv_destructor().
      
      And at the end of unregister_netdevice(), we invoke
      netdev->priv_destructor() and optionally call free_netdev().
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      cf124db5
  8. 13 4月, 2017 12 次提交
  9. 14 1月, 2017 1 次提交
    • P
      locking/atomic, kref: Add kref_read() · 2c935bc5
      Peter Zijlstra 提交于
      Since we need to change the implementation, stop exposing internals.
      
      Provide kref_read() to read the current reference count; typically
      used for debug messages.
      
      Kills two anti-patterns:
      
      	atomic_read(&kref->refcount)
      	kref->refcount.counter
      Signed-off-by: NPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: NIngo Molnar <mingo@kernel.org>
      2c935bc5
  10. 23 11月, 2016 1 次提交
  11. 10 6月, 2016 1 次提交
  12. 08 6月, 2016 1 次提交
  13. 26 4月, 2016 1 次提交
    • G
      Bluetooth: 6lowpan: Fix memory corruption of ipv6 destination address · 55441070
      Glenn Ruben Bakke 提交于
      The memcpy of ipv6 header destination address to the skb control block
      (sbk->cb) in header_create() results in currupted memory when bt_xmit()
      is issued. The skb->cb is "released" in the return of header_create()
      making room for lower layer to minipulate the skb->cb.
      
      The value retrieved in bt_xmit is not persistent across header creation
      and sending, and the lower layer will overwrite portions of skb->cb,
      making the copied destination address wrong.
      
      The memory corruption will lead to non-working multicast as the first 4
      bytes of the copied destination address is replaced by a value that
      resolves into a non-multicast prefix.
      
      This fix removes the dependency on the skb control block between header
      creation and send, by moving the destination address memcpy to the send
      function path (setup_create, which is called from bt_xmit).
      Signed-off-by: NGlenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
      Acked-by: NJukka Rissanen <jukka.rissanen@linux.intel.com>
      Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
      Cc: stable@vger.kernel.org # 4.5+
      55441070
  14. 13 4月, 2016 1 次提交
    • A
      6lowpan: change naming for lowpan private data · 2e4d60cb
      Alexander Aring 提交于
      This patch changes the naming for interface private data for lowpan
      intefaces. The current private data scheme is:
      
      -------------------------------------------------
      |    6LoWPAN Generic   |    LinkLayer 6LoWPAN   |
      -------------------------------------------------
      
      the current naming schemes are:
      
      - 6LoWPAN Generic:
        - lowpan_priv
      - LinkLayer 6LoWPAN:
        - BTLE
          - lowpan_dev
        - 802.15.4:
          - lowpan_dev_info
      
      the new naming scheme with this patch will be:
      
      - 6LoWPAN Generic:
        - lowpan_dev
      - LinkLayer 6LoWPAN:
        - BTLE
          - lowpan_btle_dev
        - 802.15.4:
          - lowpan_802154_dev
      Signed-off-by: NAlexander Aring <aar@pengutronix.de>
      Reviewed-by: Stefan Schmidt<stefan@osg.samsung.com>
      Acked-by: NJukka Rissanen <jukka.rissanen@linux.intel.com>
      Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
      2e4d60cb
  15. 23 1月, 2016 2 次提交
    • L
      Bluetooth: 6lowpan: Fix handling of uncompressed IPv6 packets · 87f5fedb
      Lukasz Duda 提交于
      This patch fixes incorrect handling of the 6lowpan packets that contain
      uncompressed IPv6 header.
      
      RFC4944 specifies a special dispatch for 6lowpan to carry uncompressed
      IPv6 header. This dispatch (1 byte long) has to be removed during
      reception and skb data pointer has to be moved. To correctly point in
      the beginning of the IPv6 header the dispatch byte has to be pulled off
      before packet can be processed by netif_rx_in().
      
      Test scenario: IPv6 packets are not correctly interpreted by the network
      layer when IPv6 header is not compressed (e.g. ICMPv6 Echo Reply is not
      propagated correctly to the ICMPv6 layer because the extra byte will make
      the header look corrupted).
      
      Similar approach is done for IEEE 802.15.4.
      Signed-off-by: NLukasz Duda <lukasz.duda@nordicsemi.no>
      Signed-off-by: NGlenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
      Acked-by: NJukka Rissanen <jukka.rissanen@linux.intel.com>
      Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
      Cc: stable@vger.kernel.org # 4.4+
      87f5fedb
    • G
      Bluetooth: 6lowpan: Fix kernel NULL pointer dereferences · 4c58f328
      Glenn Ruben Bakke 提交于
      The fixes provided in this patch assigns a valid net_device structure to
      skb before dispatching it for further processing.
      
      Scenario #1:
      ============
      
      Bluetooth 6lowpan receives an uncompressed IPv6 header, and dispatches it
      to netif. The following error occurs:
      
      Null pointer dereference error #1 crash log:
      
      [  845.854013] BUG: unable to handle kernel NULL pointer dereference at
                     0000000000000048
      [  845.855785] IP: [<ffffffff816e3d36>] enqueue_to_backlog+0x56/0x240
      ...
      [  845.909459] Call Trace:
      [  845.911678]  [<ffffffff816e3f64>] netif_rx_internal+0x44/0xf0
      
      The first modification fixes the NULL pointer dereference error by
      assigning dev to the local_skb in order to set a valid net_device before
      processing the skb by netif_rx_ni().
      
      Scenario #2:
      ============
      
      Bluetooth 6lowpan receives an UDP compressed message which needs further
      decompression by nhc_udp. The following error occurs:
      
      Null pointer dereference error #2 crash log:
      
      [   63.295149] BUG: unable to handle kernel NULL pointer dereference at
                     0000000000000840
      [   63.295931] IP: [<ffffffffc0559540>] udp_uncompress+0x320/0x626
                     [nhc_udp]
      
      The second modification fixes the NULL pointer dereference error by
      assigning dev to the local_skb in the case of a udp compressed packet.
      The 6lowpan udp_uncompress function expects that the net_device is set in
      the skb when checking lltype.
      Signed-off-by: NGlenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
      Signed-off-by: NLukasz Duda <lukasz.duda@nordicsemi.no>
      Acked-by: NJukka Rissanen <jukka.rissanen@linux.intel.com>
      Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
      Cc: stable@vger.kernel.org # 4.4+
      4c58f328
  16. 10 12月, 2015 1 次提交
  17. 27 10月, 2015 1 次提交
  18. 22 10月, 2015 1 次提交
  19. 21 10月, 2015 3 次提交
  20. 08 10月, 2015 7 次提交