[PATCH v2 net-next 0/2] some mac802154 fixes

[PATCH v2 net-next 0/2] some mac802154 fixes

[Phoebe Buckheister]

Recent llsec code introduced a memory leak on decryption failures during rx.
This fixes said leak, and optimizes the receive loops for monitor and wpan
devices to only deliver skbs to devices that are actually up.

---


Phoebe Buckheister (2):
      mac802154: properly free incoming skbs on decryption failure
      mac802154: don't deliver packets to devices that are down

 net/mac802154/monitor.c |    3 ++-
 net/mac802154/rx.c      |    9 ++++++---
 net/mac802154/wpan.c    |   14 +++++++++-----
 3 files changed, 17 insertions(+), 9 deletions(-)

[PATCH v2 net-next 1/2] mac802154: properly free incoming skbs on decryption failure

[Phoebe Buckheister]

mac802154 RX did not free skbs on decryption failure, assuming that the
caller would when the local rx handler returned _DROP. This was false.

Signed-off-by: Phoebe Buckheister <phoebe.buckheister@itwm.fraunhofer.de>
---
 net/mac802154/wpan.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/net/mac802154/wpan.c b/net/mac802154/wpan.c
index 23bc91c..c8cfd54 100644
--- a/net/mac802154/wpan.c
+++ b/net/mac802154/wpan.c
@@ -472,6 +472,7 @@ mac802154_subif_frame(struct mac802154_sub_if_data *sdata, struct sk_buff *skb,
 	rc = mac802154_llsec_decrypt(&sdata->sec, skb);
 	if (rc) {
 		pr_debug("decryption failed: %i\n", rc);
+		kfree_skb(skb);
 		return NET_RX_DROP;
 	}
 
-- 
1.7.9.5

[PATCH v2 net-next 2/2] mac802154: don't deliver packets to devices that are down

[Phoebe Buckheister]

Only one WPAN devices can be active at any given time, so only deliver
packets to that one interface that is actually up. Multiple monitors may
be up at any given time, but we don't have to deliver to monitors that
are down either.

Signed-off-by: Phoebe Buckheister <phoebe.buckheister@itwm.fraunhofer.de>
---
 net/mac802154/monitor.c |    3 ++-
 net/mac802154/rx.c      |    9 ++++++---
 net/mac802154/wpan.c    |   13 ++++++++-----
 3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/net/mac802154/monitor.c b/net/mac802154/monitor.c
index 434a26f..a68230e 100644
--- a/net/mac802154/monitor.c
+++ b/net/mac802154/monitor.c
@@ -70,7 +70,8 @@ void mac802154_monitors_rx(struct mac802154_priv *priv, struct sk_buff *skb)
 
 	rcu_read_lock();
 	list_for_each_entry_rcu(sdata, &priv->slaves, list) {
-		if (sdata->type != IEEE802154_DEV_MONITOR)
+		if (sdata->type != IEEE802154_DEV_MONITOR ||
+		    !netif_running(sdata->dev))
 			continue;
 
 		skb2 = skb_clone(skb, GFP_ATOMIC);
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index 0597b96..46440b9 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -64,19 +64,22 @@ mac802154_subif_rx(struct ieee802154_dev *hw, struct sk_buff *skb, u8 lqi)
 
 		if (skb->len < 2) {
 			pr_debug("got invalid frame\n");
-			goto out;
+			goto fail;
 		}
 		crc = crc_ccitt(0, skb->data, skb->len);
 		if (crc) {
 			pr_debug("CRC mismatch\n");
-			goto out;
+			goto fail;
 		}
 		skb_trim(skb, skb->len - 2); /* CRC */
 	}
 
 	mac802154_monitors_rx(priv, skb);
 	mac802154_wpans_rx(priv, skb);
-out:
+
+	return;
+
+fail:
 	dev_kfree_skb(skb);
 }
 
diff --git a/net/mac802154/wpan.c b/net/mac802154/wpan.c
index c8cfd54..3c3069f 100644
--- a/net/mac802154/wpan.c
+++ b/net/mac802154/wpan.c
@@ -567,7 +567,6 @@ static int mac802154_parse_frame_start(struct sk_buff *skb,
 void mac802154_wpans_rx(struct mac802154_priv *priv, struct sk_buff *skb)
 {
 	int ret;
-	struct sk_buff *sskb;
 	struct mac802154_sub_if_data *sdata;
 	struct ieee802154_hdr hdr;
 
@@ -579,12 +578,16 @@ void mac802154_wpans_rx(struct mac802154_priv *priv, struct sk_buff *skb)
 
 	rcu_read_lock();
 	list_for_each_entry_rcu(sdata, &priv->slaves, list) {
-		if (sdata->type != IEEE802154_DEV_WPAN)
+		if (sdata->type != IEEE802154_DEV_WPAN ||
+		    !netif_running(sdata->dev))
 			continue;
 
-		sskb = skb_clone(skb, GFP_ATOMIC);
-		if (sskb)
-			mac802154_subif_frame(sdata, sskb, &hdr);
+		mac802154_subif_frame(sdata, skb, &hdr);
+		skb = NULL;
+		break;
 	}
 	rcu_read_unlock();
+
+	if (skb)
+		kfree_skb(skb);
 }
-- 
1.7.9.5

Re: [PATCH v2 net-next 2/2] mac802154: don't deliver packets to devices that are down

[Eric Dumazet]

On Tue, 2014-06-10 at 18:11 +0200, Phoebe Buckheister wrote:
> Only one WPAN devices can be active at any given time, so only deliver
> packets to that one interface that is actually up. Multiple monitors may
> be up at any given time, but we don't have to deliver to monitors that
> are down either.



> diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
> index 0597b96..46440b9 100644
> --- a/net/mac802154/rx.c
> +++ b/net/mac802154/rx.c
> @@ -64,19 +64,22 @@ mac802154_subif_rx(struct ieee802154_dev *hw, struct sk_buff *skb, u8 lqi)
>  
>  		if (skb->len < 2) {
>  			pr_debug("got invalid frame\n");
> -			goto out;
> +			goto fail;
>  		}
>  		crc = crc_ccitt(0, skb->data, skb->len);
>  		if (crc) {
>  			pr_debug("CRC mismatch\n");
> -			goto out;
> +			goto fail;
>  		}
>  		skb_trim(skb, skb->len - 2); /* CRC */
>  	}
>  
>  	mac802154_monitors_rx(priv, skb);
>  	mac802154_wpans_rx(priv, skb);
> -out:
> +
> +	return;
> +
> +fail:
>  	dev_kfree_skb(skb);

This should be kfree_skb(), because we drop the packet, and should be
drop_monitor friendly