* [PATCH net 0/2] net/smc: fixes 2021-11-24
@ 2021-11-24 12:32 Karsten Graul
2021-11-24 12:32 ` [PATCH net 1/2] net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() Karsten Graul
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Karsten Graul @ 2021-11-24 12:32 UTC (permalink / raw)
To: David Miller, Jakub Kicinski
Cc: netdev, linux-s390, Heiko Carstens, Julian Wiedmann, Guo DaXing, Tony Lu
Patch 1 from DaXing fixes a possible loop in smc_listen().
Patch 2 prevents a NULL pointer dereferencing while iterating
over the lower network devices.
Guo DaXing (1):
net/smc: Fix loop in smc_listen
Karsten Graul (1):
net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
net/smc/af_smc.c | 4 +++-
net/smc/smc_core.c | 35 ++++++++++++++++++-----------------
2 files changed, 21 insertions(+), 18 deletions(-)
--
2.32.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH net 1/2] net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
2021-11-24 12:32 [PATCH net 0/2] net/smc: fixes 2021-11-24 Karsten Graul
@ 2021-11-24 12:32 ` Karsten Graul
2021-11-24 12:32 ` [PATCH net 2/2] net/smc: Fix loop in smc_listen Karsten Graul
2021-11-25 3:10 ` [PATCH net 0/2] net/smc: fixes 2021-11-24 patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Karsten Graul @ 2021-11-24 12:32 UTC (permalink / raw)
To: David Miller, Jakub Kicinski
Cc: netdev, linux-s390, Heiko Carstens, Julian Wiedmann, Guo DaXing, Tony Lu
Coverity reports a possible NULL dereferencing problem:
in smc_vlan_by_tcpsk():
6. returned_null: netdev_lower_get_next returns NULL (checked 29 out of 30 times).
7. var_assigned: Assigning: ndev = NULL return value from netdev_lower_get_next.
1623 ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower);
CID 1468509 (#1 of 1): Dereference null return value (NULL_RETURNS)
8. dereference: Dereferencing a pointer that might be NULL ndev when calling is_vlan_dev.
1624 if (is_vlan_dev(ndev)) {
Remove the manual implementation and use netdev_walk_all_lower_dev() to
iterate over the lower devices. While on it remove an obsolete function
parameter comment.
Fixes: cb9d43f67754 ("net/smc: determine vlan_id of stacked net_device")
Suggested-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
---
net/smc/smc_core.c | 35 ++++++++++++++++++-----------------
1 file changed, 18 insertions(+), 17 deletions(-)
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 25ebd30feecd..bb52c8b5f148 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -1672,14 +1672,26 @@ static void smc_link_down_work(struct work_struct *work)
mutex_unlock(&lgr->llc_conf_mutex);
}
-/* Determine vlan of internal TCP socket.
- * @vlan_id: address to store the determined vlan id into
- */
+static int smc_vlan_by_tcpsk_walk(struct net_device *lower_dev,
+ struct netdev_nested_priv *priv)
+{
+ unsigned short *vlan_id = (unsigned short *)priv->data;
+
+ if (is_vlan_dev(lower_dev)) {
+ *vlan_id = vlan_dev_vlan_id(lower_dev);
+ return 1;
+ }
+
+ return 0;
+}
+
+/* Determine vlan of internal TCP socket. */
int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
{
struct dst_entry *dst = sk_dst_get(clcsock->sk);
+ struct netdev_nested_priv priv;
struct net_device *ndev;
- int i, nest_lvl, rc = 0;
+ int rc = 0;
ini->vlan_id = 0;
if (!dst) {
@@ -1697,20 +1709,9 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
goto out_rel;
}
+ priv.data = (void *)&ini->vlan_id;
rtnl_lock();
- nest_lvl = ndev->lower_level;
- for (i = 0; i < nest_lvl; i++) {
- struct list_head *lower = &ndev->adj_list.lower;
-
- if (list_empty(lower))
- break;
- lower = lower->next;
- ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower);
- if (is_vlan_dev(ndev)) {
- ini->vlan_id = vlan_dev_vlan_id(ndev);
- break;
- }
- }
+ netdev_walk_all_lower_dev(ndev, smc_vlan_by_tcpsk_walk, &priv);
rtnl_unlock();
out_rel:
--
2.32.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH net 2/2] net/smc: Fix loop in smc_listen
2021-11-24 12:32 [PATCH net 0/2] net/smc: fixes 2021-11-24 Karsten Graul
2021-11-24 12:32 ` [PATCH net 1/2] net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() Karsten Graul
@ 2021-11-24 12:32 ` Karsten Graul
2021-11-25 3:10 ` [PATCH net 0/2] net/smc: fixes 2021-11-24 patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Karsten Graul @ 2021-11-24 12:32 UTC (permalink / raw)
To: David Miller, Jakub Kicinski
Cc: netdev, linux-s390, Heiko Carstens, Julian Wiedmann, Guo DaXing, Tony Lu
From: Guo DaXing <guodaxing@huawei.com>
The kernel_listen function in smc_listen will fail when all the available
ports are occupied. At this point smc->clcsock->sk->sk_data_ready has
been changed to smc_clcsock_data_ready. When we call smc_listen again,
now both smc->clcsock->sk->sk_data_ready and smc->clcsk_data_ready point
to the smc_clcsock_data_ready function.
The smc_clcsock_data_ready() function calls lsmc->clcsk_data_ready which
now points to itself resulting in an infinite loop.
This patch restores smc->clcsock->sk->sk_data_ready with the old value.
Fixes: a60a2b1e0af1 ("net/smc: reduce active tcp_listen workers")
Signed-off-by: Guo DaXing <guodaxing@huawei.com>
Acked-by: Tony Lu <tonylu@linux.alibaba.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
---
net/smc/af_smc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index b61c802e3bf3..53a617cbbec4 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -2134,8 +2134,10 @@ static int smc_listen(struct socket *sock, int backlog)
smc->clcsock->sk->sk_user_data =
(void *)((uintptr_t)smc | SK_USER_DATA_NOCOPY);
rc = kernel_listen(smc->clcsock, backlog);
- if (rc)
+ if (rc) {
+ smc->clcsock->sk->sk_data_ready = smc->clcsk_data_ready;
goto out;
+ }
sk->sk_max_ack_backlog = backlog;
sk->sk_ack_backlog = 0;
sk->sk_state = SMC_LISTEN;
--
2.32.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net 0/2] net/smc: fixes 2021-11-24
2021-11-24 12:32 [PATCH net 0/2] net/smc: fixes 2021-11-24 Karsten Graul
2021-11-24 12:32 ` [PATCH net 1/2] net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() Karsten Graul
2021-11-24 12:32 ` [PATCH net 2/2] net/smc: Fix loop in smc_listen Karsten Graul
@ 2021-11-25 3:10 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-11-25 3:10 UTC (permalink / raw)
To: Karsten Graul
Cc: davem, kuba, netdev, linux-s390, hca, jwi, guodaxing, tonylu
Hello:
This series was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 24 Nov 2021 13:32:36 +0100 you wrote:
> Patch 1 from DaXing fixes a possible loop in smc_listen().
> Patch 2 prevents a NULL pointer dereferencing while iterating
> over the lower network devices.
>
> Guo DaXing (1):
> net/smc: Fix loop in smc_listen
>
> [...]
Here is the summary with links:
- [net,1/2] net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
https://git.kernel.org/netdev/net/c/587acad41f1b
- [net,2/2] net/smc: Fix loop in smc_listen
https://git.kernel.org/netdev/net/c/9ebb0c4b27a6
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-11-25 3:12 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-24 12:32 [PATCH net 0/2] net/smc: fixes 2021-11-24 Karsten Graul
2021-11-24 12:32 ` [PATCH net 1/2] net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() Karsten Graul
2021-11-24 12:32 ` [PATCH net 2/2] net/smc: Fix loop in smc_listen Karsten Graul
2021-11-25 3:10 ` [PATCH net 0/2] net/smc: fixes 2021-11-24 patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.