linux-stable.git/drivers/net/team, branch linux-3.10.y

team: fix memory leaks

2017-11-02T09:46:02+00:00

commit 72ec0bc64b9a5d8e0efcb717abfc757746b101b7 upstream.

In functions team_nl_send_port_list_get() and
team_nl_send_options_get(), pointer skb keeps the return value of
nlmsg_new(). When the call to genlmsg_put() fails, the memory is not
freed(). This will result in memory leak bugs.

Fixes: 9b00cf2d1024 ("team: implement multipart netlink messages for options transfers")
Signed-off-by: Pan Bian 
Acked-by: Jiri Pirko 
Signed-off-by: David S. Miller 
Signed-off-by: Willy Tarreau

team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid

2016-01-29T05:49:35+00:00

[ Upstream commit 60a6531bfe49555581ccd65f66a350cc5693fcde ]

We can't be within an RCU read-side critical section when deleting
VLANs, as underlying drivers might sleep during the hardware operation.
Therefore, replace the RCU critical section with a mutex. This is
consistent with team_vlan_rx_add_vid.

Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
Acked-by: Jiri Pirko 
Signed-off-by: Ido Schimmel 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

team: don't traverse port list using rcu in team_set_mac_address

2015-03-18T12:22:27+00:00

[ Upstream commit 9215f437b85da339a7dfe3db6e288637406f88b2 ]

Currently the list is traversed using rcu variant. That is not correct
since dev_set_mac_address can be called which eventually calls
rtmsg_ifinfo_build_skb and there, skb allocation can sleep. So fix this
by remove the rcu usage here.

Fixes: 3d249d4ca7 "net: introduce ethernet teaming device"
Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

team: fix possible null pointer dereference in team_handle_frame

2015-03-18T12:22:27+00:00

[ Upstream commit 57e595631904c827cfa1a0f7bbd7cc9a49da5745 ]

Currently following race is possible in team:

CPU0                                        CPU1
                                            team_port_del
                                              team_upper_dev_unlink
                                                priv_flags &= ~IFF_TEAM_PORT
team_handle_frame
  team_port_get_rcu
    team_port_exists
      priv_flags & IFF_TEAM_PORT == 0
    return NULL (instead of port got
                 from rx_handler_data)
                                              netdev_rx_handler_unregister

The thing is that the flag is removed before rx_handler is unregistered.
If team_handle_frame is called in between, team_port_exists returns 0
and team_port_get_rcu will return NULL.
So do not check the flag here. It is guaranteed by netdev_rx_handler_unregister
that team_handle_frame will always see valid rx_handler_data pointer.

Signed-off-by: Jiri Pirko 
Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

team: fix mtu setting

2014-06-26T19:12:38+00:00

[ Upstream commit 9d0d68faea6962d62dd501cd6e71ce5cc8ed262b ]

Now it is not possible to set mtu to team device which has a port
enslaved to it. The reason is that when team_change_mtu() calls
dev_set_mtu() for port device, notificator for NETDEV_PRECHANGEMTU
event is called and team_device_event() returns NOTIFY_BAD forbidding
the change. So fix this by returning NOTIFY_DONE here in case team is
changing mtu in team_change_mtu().

Introduced-by: 3d249d4c "net: introduce ethernet teaming device"
Signed-off-by: Jiri Pirko 
Acked-by: Flavio Leitner 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

team: fix master carrier set when user linkup is enabled

2013-12-08T15:29:26+00:00

[ Upstream commit f5e0d34382e18f396d7673a84df8e3342bea7eb6 ]

When user linkup is enabled and user sets linkup of individual port,
we need to recompute linkup (carrier) of master interface so the change
is reflected. Fix this by calling __team_carrier_check() which does the
needed work.

Please apply to all stable kernels as well. Thanks.

Reported-by: Jan Tluka 
Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

team: move add to port list before port enablement

2013-06-12T07:56:27+00:00

team_port_enable() adds port to port_hashlist. Reader sees port
in team_get_port_by_index_rcu() and returns it, but
team_get_first_port_txable_rcu() tries to go through port_list, where the
port is not inserted yet -> NULL pointer dereference.
Fix this by reordering port_list and port_hashlist insertion.
Panic is easily triggeable when txing packets and adding/removing port
in a loop.

Introduced by commit 3d249d4c "net: introduce ethernet teaming device"

Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller

team: check return value of team_get_port_by_index_rcu() for NULL

2013-06-12T07:56:27+00:00

team_get_port_by_index_rcu() might return NULL due to race between port
removal and skb tx path. Panic is easily triggeable when txing packets
and adding/removing port in a loop.

introduced by commit 3d249d4ca "net: introduce ethernet teaming device"
and commit 753f993911b "team: introduce random mode" (for random mode)

Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller

team: fix port list dump for big number of ports

2013-06-01T00:31:52+00:00

In case the port list dump does not fit into one skb currently the
dump would start over again. Fix this by continue from the last dumped
port.

Introduced by commit d90f889e9c (team: handle sending port list in the
same way option list is sent)

Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller

drivers/net: rename random32() to prandom_u32()

2013-05-08T01:38:27+00:00

Use preferable function name which implies using a pseudo-random number
generator.

[akpm@linux-foundation.org: convert team_mode_random.c]
Signed-off-by: Akinobu Mita 
Acked-by: Thomas Sailer 
Acked-by: Bing Zhao  [mwifiex]
Cc: "David S. Miller" 
Cc: Michael Chan 
Cc: Thomas Sailer 
Cc: Jean-Paul Roubelat 
Cc: Bing Zhao 
Cc: Brett Rudley 
Cc: Arend van Spriel 
Cc: "Franky (Zhenhui) Lin" 
Cc: Hante Meuleman 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds