kybaaz/linux-xiaomi-chiron
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
linux-xiaomi-chiron/drivers/net
History
Taehee Yoo 037f9cdf72 net: rmnet: use upper/lower device infrastructure 
netdev_upper_dev_link() is useful to manage lower/upper interfaces.
And this function internally validates looping, maximum depth.
All or most virtual interfaces that could have a real interface
(e.g. macsec, macvlan, ipvlan etc.) use lower/upper infrastructure.

Test commands:
    modprobe rmnet
    ip link add dummy0 type dummy
    ip link add rmnet1 link dummy0 type rmnet mux_id 1
    for i in {2..100}
    do
        let A=$i-1
        ip link add rmnet$i link rmnet$A type rmnet mux_id $i
    done
    ip link del dummy0

The purpose of the test commands is to make stack overflow.

Splat looks like:
[   52.411438][ T1395] BUG: KASAN: slab-out-of-bounds in find_busiest_group+0x27e/0x2c00
[   52.413218][ T1395] Write of size 64 at addr ffff8880c774bde0 by task ip/1395
[   52.414841][ T1395]
[   52.430720][ T1395] CPU: 1 PID: 1395 Comm: ip Not tainted 5.6.0-rc1+ #447
[   52.496511][ T1395] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[   52.513597][ T1395] Call Trace:
[   52.546516][ T1395]
[   52.558773][ T1395] Allocated by task 3171537984:
[   52.588290][ T1395] BUG: unable to handle page fault for address: ffffffffb999e260
[   52.589311][ T1395] #PF: supervisor read access in kernel mode
[   52.590529][ T1395] #PF: error_code(0x0000) - not-present page
[   52.591374][ T1395] PGD d6818067 P4D d6818067 PUD d6819063 PMD 0
[   52.592288][ T1395] Thread overran stack, or stack corrupted
[   52.604980][ T1395] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[   52.605856][ T1395] CPU: 1 PID: 1395 Comm: ip Not tainted 5.6.0-rc1+ #447
[   52.611764][ T1395] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[   52.621520][ T1395] RIP: 0010:stack_depot_fetch+0x10/0x30
[   52.622296][ T1395] Code: ff e9 f9 fe ff ff 48 89 df e8 9c 1d 91 ff e9 ca fe ff ff cc cc cc cc cc cc cc 89 f8 0
[   52.627887][ T1395] RSP: 0018:ffff8880c774bb60 EFLAGS: 00010006
[   52.628735][ T1395] RAX: 00000000001f8880 RBX: ffff8880c774d140 RCX: 0000000000000000
[   52.631773][ T1395] RDX: 000000000000001d RSI: ffff8880c774bb68 RDI: 0000000000003ff0
[   52.649584][ T1395] RBP: ffffea00031dd200 R08: ffffed101b43e403 R09: ffffed101b43e403
[   52.674857][ T1395] R10: 0000000000000001 R11: ffffed101b43e402 R12: ffff8880d900e5c0
[   52.678257][ T1395] R13: ffff8880c774c000 R14: 0000000000000000 R15: dffffc0000000000
[   52.694541][ T1395] FS:  00007fe867f6e0c0(0000) GS:ffff8880da000000(0000) knlGS:0000000000000000
[   52.764039][ T1395] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   52.815008][ T1395] CR2: ffffffffb999e260 CR3: 00000000c26aa005 CR4: 00000000000606e0
[   52.862312][ T1395] Call Trace:
[   52.887133][ T1395] Modules linked in: dummy rmnet veth openvswitch nsh nf_conncount nf_nat nf_conntrack nf_dex
[   52.936749][ T1395] CR2: ffffffffb999e260
[   52.965695][ T1395] ---[ end trace 7e32ca99482dbb31 ]---
[   52.966556][ T1395] RIP: 0010:stack_depot_fetch+0x10/0x30
[   52.971083][ T1395] Code: ff e9 f9 fe ff ff 48 89 df e8 9c 1d 91 ff e9 ca fe ff ff cc cc cc cc cc cc cc 89 f8 0
[   53.003650][ T1395] RSP: 0018:ffff8880c774bb60 EFLAGS: 00010006
[   53.043183][ T1395] RAX: 00000000001f8880 RBX: ffff8880c774d140 RCX: 0000000000000000
[   53.076480][ T1395] RDX: 000000000000001d RSI: ffff8880c774bb68 RDI: 0000000000003ff0
[   53.093858][ T1395] RBP: ffffea00031dd200 R08: ffffed101b43e403 R09: ffffed101b43e403
[   53.112795][ T1395] R10: 0000000000000001 R11: ffffed101b43e402 R12: ffff8880d900e5c0
[   53.139837][ T1395] R13: ffff8880c774c000 R14: 0000000000000000 R15: dffffc0000000000
[   53.141500][ T1395] FS:  00007fe867f6e0c0(0000) GS:ffff8880da000000(0000) knlGS:0000000000000000
[   53.143343][ T1395] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   53.152007][ T1395] CR2: ffffffffb999e260 CR3: 00000000c26aa005 CR4: 00000000000606e0
[   53.156459][ T1395] Kernel panic - not syncing: Fatal exception
[   54.213570][ T1395] Shutting down cpus with NMI
[   54.354112][ T1395] Kernel Offset: 0x33000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0x)
[   54.355687][ T1395] Rebooting in 5 seconds..

Fixes: b37f78f234 ("net: qualcomm: rmnet: Fix crash on real dev unregistration")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-02-27 11:45:07 -08:00
..
appletalk netdev: pass the stuck queue to the timeout handler 2019-12-12 21:38:57 -08:00
arcnet netdev: pass the stuck queue to the timeout handler 2019-12-12 21:38:57 -08:00
bonding bonding: fix lockdep warning in bond_get_stats() 2020-02-16 19:32:11 -08:00
caif net: caif: replace BUG_ON with recovery code 2019-12-16 16:29:05 -08:00
can ioremap changes for 5.6 2020-01-27 13:03:00 -08:00
dsa net: dsa: bcm_sf2: Forcibly configure IMP port for 1Gb/sec 2020-02-26 16:38:23 -08:00
ethernet net: rmnet: use upper/lower device infrastructure 2020-02-27 11:45:07 -08:00
fddi Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next 2020-01-28 16:02:33 -08:00
fjes Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next 2020-01-28 16:02:33 -08:00
hamradio Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-12-22 15:15:05 -08:00
hippi
hyperv hv_netvsc: Fix unwanted wakeup in netvsc_attach() 2020-02-23 16:32:37 -08:00
ieee802154 drivers: net: Fix Kconfig indentation, continued 2019-11-21 11:54:09 -08:00
ipvlan Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-11-02 13:54:56 -07:00
netdevsim netdevsim: fix ptr_ret.cocci warnings 2020-02-05 13:55:32 +01:00
phy net: phy: marvell: don't interpret PHY status unless resolved 2020-02-27 11:17:21 -08:00
plip
ppp pptp: support sockets bound to an interface 2020-01-15 23:13:09 +01:00
slip slip: not call free_netdev before rtnl_unlock in slip_open 2020-02-26 20:37:06 -08:00
team Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-11-02 13:54:56 -07:00
usb net: usb: qmi_wwan: restore mtu min/max values after raw_ip switch 2020-02-23 16:13:50 -08:00
vmxnet3 vmxnet3: Remove always false conditional statement 2020-01-08 16:07:21 -08:00
wan ARM: SoC-related driver updates 2020-02-08 14:04:19 -08:00
wimax netdev: pass the stuck queue to the timeout handler 2019-12-12 21:38:57 -08:00
wireguard wireguard: socket: remove extra call to synchronize_net 2020-02-16 19:21:56 -08:00
wireless wireless-drivers fixes for v5.6 2020-02-08 15:03:11 +01:00
xen-netback net: xen-netback: hash.c: Use built-in RCU list checking 2020-01-17 10:57:22 +01:00
dummy.c net: dummy: use standard dev_lstats_add() and dev_lstats_read() 2019-11-07 20:03:08 -08:00
eql.c
geneve.c treewide: Use sizeof_field() macro 2019-12-09 10:36:44 -08:00
gtp.c gtp: use icmp_ndo_send helper 2020-02-13 14:19:00 -08:00
ifb.c
Kconfig USB/Thunderbolt/PHY driver updates for 5.6-rc1 2020-01-29 10:09:44 -08:00
LICENSE.SRC
loopback.c net: use u64_stats_t in struct pcpu_lstats 2019-11-07 20:03:08 -08:00
macsec.c net: macsec: PN wrap callback 2020-01-14 11:31:41 -08:00
macvlan.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net 2020-01-19 22:10:04 +01:00
macvtap.c
Makefile USB/Thunderbolt/PHY driver updates for 5.6-rc1 2020-01-29 10:09:44 -08:00
mdio.c
mii.c
net_failover.c
netconsole.c
nlmon.c net: nlmon: use standard dev_lstats_add() and dev_lstats_read() 2019-11-07 20:03:08 -08:00
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tap.c net: tap: use skb_list_walk_safe helper for gso segments 2020-01-08 15:19:55 -08:00
thunderbolt.c
tun.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-01-26 10:40:21 +01:00
veth.c bpf, xdp: Remove no longer required rcu_read_{un}lock() 2020-01-27 11:16:25 +01:00
virtio_net.c bpf, xdp: virtio_net use access ptr macro for xdp enable check 2020-01-27 11:16:25 +01:00
vrf.c
vsockmon.c vsockmon: use standard dev_lstats_add() and dev_lstats_read() 2019-11-07 20:03:08 -08:00
vxlan.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-01-09 12:13:43 -08:00
xen-netfront.c