d939b6d30b
In order to attach a bridge interface to the rmnet interface,
"master" operation is used.
(e.g. ip link set dummy1 master rmnet0)
But, in the rmnet_add_bridge(), which is a callback of ->ndo_add_slave()
doesn't register lower interface.
So, ->ndo_del_slave() doesn't work.
There are other problems too.
1. It couldn't detect circular upper/lower interface relationship.
2. It couldn't prevent stack overflow because of too deep depth
of upper/lower interface
3. It doesn't check the number of lower interfaces.
4. Panics because of several reasons.
The root problem of these issues is actually the same.
So, in this patch, these all problems will be fixed.
Test commands:
modprobe rmnet
ip link add dummy0 type dummy
ip link add rmnet0 link dummy0 type rmnet mux_id 1
ip link add dummy1 master rmnet0 type dummy
ip link add dummy2 master rmnet0 type dummy
ip link del rmnet0
ip link del dummy2
ip link del dummy1
Splat looks like:
[ 41.867595][ T1164] general protection fault, probably for non-canonical address 0xdffffc0000000101I
[ 41.869993][ T1164] KASAN: null-ptr-deref in range [0x0000000000000808-0x000000000000080f]
[ 41.872950][ T1164] CPU: 0 PID: 1164 Comm: ip Not tainted 5.6.0-rc1+ #447
[ 41.873915][ T1164] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[ 41.875161][ T1164] RIP: 0010:rmnet_unregister_bridge.isra.6+0x71/0xf0 [rmnet]
[ 41.876178][ T1164] Code: 48 89 ef 48 89 c6 5b 5d e9 fc fe ff ff e8 f7 f3 ff ff 48 8d b8 08 08 00 00 48 ba 00 7
[ 41.878925][ T1164] RSP: 0018:ffff8880c4d0f188 EFLAGS: 00010202
[ 41.879774][ T1164] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000101
[ 41.887689][ T1164] RDX: dffffc0000000000 RSI: ffffffffb8cf64f0 RDI: 0000000000000808
[ 41.888727][ T1164] RBP: ffff8880c40e4000 R08: ffffed101b3c0e3c R09: 0000000000000001
[ 41.889749][ T1164] R10: 0000000000000001 R11: ffffed101b3c0e3b R12: 1ffff110189a1e3c
[ 41.890783][ T1164] R13: ffff8880c4d0f200 R14: ffffffffb8d56160 R15: ffff8880ccc2c000
[ 41.891794][ T1164] FS: 00007f4300edc0c0(0000) GS:ffff8880d9c00000(0000) knlGS:0000000000000000
[ 41.892953][ T1164] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 41.893800][ T1164] CR2: 00007f43003bc8c0 CR3: 00000000ca53e001 CR4: 00000000000606f0
[ 41.894824][ T1164] Call Trace:
[ 41.895274][ T1164] ? rcu_is_watching+0x2c/0x80
[ 41.895895][ T1164] rmnet_config_notify_cb+0x1f7/0x590 [rmnet]
[ 41.896687][ T1164] ? rmnet_unregister_bridge.isra.6+0xf0/0xf0 [rmnet]
[ 41.897611][ T1164] ? rmnet_unregister_bridge.isra.6+0xf0/0xf0 [rmnet]
[ 41.898508][ T1164] ? __module_text_address+0x13/0x140
[ 41.899162][ T1164] notifier_call_chain+0x90/0x160
[ 41.899814][ T1164] rollback_registered_many+0x660/0xcf0
[ 41.900544][ T1164] ? netif_set_real_num_tx_queues+0x780/0x780
[ 41.901316][ T1164] ? __lock_acquire+0xdfe/0x3de0
[ 41.901958][ T1164] ? memset+0x1f/0x40
[ 41.902468][ T1164] ? __nla_validate_parse+0x98/0x1ab0
[ 41.903166][ T1164] unregister_netdevice_many.part.133+0x13/0x1b0
[ 41.903988][ T1164] rtnl_delete_link+0xbc/0x100
[ ... ]
Fixes: 60d58f971c ("net: qualcomm: rmnet: Implement bridge mode")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
76 lines
1.7 KiB
C
76 lines
1.7 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/* Copyright (c) 2013-2014, 2016-2018 The Linux Foundation. All rights reserved.
|
|
*
|
|
* RMNET Data configuration engine
|
|
*/
|
|
|
|
#include <linux/skbuff.h>
|
|
#include <net/gro_cells.h>
|
|
|
|
#ifndef _RMNET_CONFIG_H_
|
|
#define _RMNET_CONFIG_H_
|
|
|
|
#define RMNET_MAX_LOGICAL_EP 255
|
|
|
|
struct rmnet_endpoint {
|
|
u8 mux_id;
|
|
struct net_device *egress_dev;
|
|
struct hlist_node hlnode;
|
|
};
|
|
|
|
/* One instance of this structure is instantiated for each real_dev associated
|
|
* with rmnet.
|
|
*/
|
|
struct rmnet_port {
|
|
struct net_device *dev;
|
|
u32 data_format;
|
|
u8 nr_rmnet_devs;
|
|
u8 rmnet_mode;
|
|
struct hlist_head muxed_ep[RMNET_MAX_LOGICAL_EP];
|
|
struct net_device *bridge_ep;
|
|
struct net_device *rmnet_dev;
|
|
};
|
|
|
|
extern struct rtnl_link_ops rmnet_link_ops;
|
|
|
|
struct rmnet_vnd_stats {
|
|
u64 rx_pkts;
|
|
u64 rx_bytes;
|
|
u64 tx_pkts;
|
|
u64 tx_bytes;
|
|
u32 tx_drops;
|
|
};
|
|
|
|
struct rmnet_pcpu_stats {
|
|
struct rmnet_vnd_stats stats;
|
|
struct u64_stats_sync syncp;
|
|
};
|
|
|
|
struct rmnet_priv_stats {
|
|
u64 csum_ok;
|
|
u64 csum_valid_unset;
|
|
u64 csum_validation_failed;
|
|
u64 csum_err_bad_buffer;
|
|
u64 csum_err_invalid_ip_version;
|
|
u64 csum_err_invalid_transport;
|
|
u64 csum_fragmented_pkt;
|
|
u64 csum_skipped;
|
|
u64 csum_sw;
|
|
};
|
|
|
|
struct rmnet_priv {
|
|
u8 mux_id;
|
|
struct net_device *real_dev;
|
|
struct rmnet_pcpu_stats __percpu *pcpu_stats;
|
|
struct gro_cells gro_cells;
|
|
struct rmnet_priv_stats stats;
|
|
};
|
|
|
|
struct rmnet_port *rmnet_get_port_rcu(struct net_device *real_dev);
|
|
struct rmnet_endpoint *rmnet_get_endpoint(struct rmnet_port *port, u8 mux_id);
|
|
int rmnet_add_bridge(struct net_device *rmnet_dev,
|
|
struct net_device *slave_dev,
|
|
struct netlink_ext_ack *extack);
|
|
int rmnet_del_bridge(struct net_device *rmnet_dev,
|
|
struct net_device *slave_dev);
|
|
#endif /* _RMNET_CONFIG_H_ */
|