linux-stable.git/drivers/net/team, branch linux-3.4.y

team: fix possible null pointer dereference in team_handle_frame

2015-06-19T03:40:18+00:00

commit 57e595631904c827cfa1a0f7bbd7cc9a49da5745 upstream.

Currently following race is possible in team:

CPU0                                        CPU1
                                            team_port_del
                                              team_upper_dev_unlink
                                                priv_flags &= ~IFF_TEAM_PORT
team_handle_frame
  team_port_get_rcu
    team_port_exists
      priv_flags & IFF_TEAM_PORT == 0
    return NULL (instead of port got
                 from rx_handler_data)
                                              netdev_rx_handler_unregister

The thing is that the flag is removed before rx_handler is unregistered.
If team_handle_frame is called in between, team_port_exists returns 0
and team_port_get_rcu will return NULL.
So do not check the flag here. It is guaranteed by netdev_rx_handler_unregister
that team_handle_frame will always see valid rx_handler_data pointer.

Signed-off-by: Jiri Pirko 
Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
Signed-off-by: David S. Miller 
Signed-off-by: Zefan Li

team: fix mtu setting

2014-06-26T19:10:28+00:00

[ Upstream commit 9d0d68faea6962d62dd501cd6e71ce5cc8ed262b ]

Now it is not possible to set mtu to team device which has a port
enslaved to it. The reason is that when team_change_mtu() calls
dev_set_mtu() for port device, notificator for NETDEV_PRECHANGEMTU
event is called and team_device_event() returns NOTIFY_BAD forbidding
the change. So fix this by returning NOTIFY_DONE here in case team is
changing mtu in team_change_mtu().

Introduced-by: 3d249d4c "net: introduce ethernet teaming device"
Signed-off-by: Jiri Pirko 
Acked-by: Flavio Leitner 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

team: check return value of team_get_port_by_index_rcu() for NULL

2013-06-27T18:27:32+00:00

[ Upstream commit 76c455decbbad31de21c727edb184a963f42b40b ]

team_get_port_by_index_rcu() might return NULL due to race between port
removal and skb tx path. Panic is easily triggeable when txing packets
and adding/removing port in a loop.

introduced by commit 3d249d4ca "net: introduce ethernet teaming device"
and commit 753f993911b "team: introduce random mode" (for random mode)

Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: use eth_hw_addr_random() and reset addr_assign_type

2012-02-15T20:34:17+00:00

Use eth_hw_addr_random() instead of calling random_ether_addr()
to set addr_assign_type correctly to NET_ADDR_RANDOM.

Reset the state to NET_ADDR_PERM as soon as the MAC get
changed via .ndo_set_mac_address.

v2: adapt to renamed eth_hw_addr_random()

Signed-off-by: Danny Kukawka 
Signed-off-by: David S. Miller

team: send only changed options/ports via netlink

2012-01-24T20:51:00+00:00

This patch changes event message behaviour to send only updated records
instead of whole list. This fixes bug on which userspace receives non-actual
data in case multiple events occur in row.

Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller

team: use vlan_vids_[addr/del]_by_dev

2011-12-09T00:52:43+00:00

So far when vlan id was added to team device befor port was added, this
vid was not added to port's vlan filter. Also after removal, vid stayed
in port device's vlan filter. Benefit of new vlan functions to handle
this work.

Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller

net: introduce vlan_vid_[add/del] and use them instead of direct [add/kill]_vid ndo calls

2011-12-09T00:52:42+00:00

This patch adds wrapper for ndo_vlan_rx_add_vid/ndo_vlan_rx_kill_vid
functions. Check for NETIF_F_HW_VLAN_FILTER feature is done in this
wrapper.

Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller

net: make vlan ndo_vlan_rx_[add/kill]_vid return error value

2011-12-09T00:52:37+00:00

Let caller know the result of adding/removing vlan id to/from vlan
filter.

In some drivers I make those functions to just return 0. But in those
where there is able to see if hw setup went correctly, return value is
set appropriately.

Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller

net: treewide use of RCU_INIT_POINTER

2011-11-23T23:48:19+00:00

rcu_assign_pointer(ptr, NULL) can be safely replaced by
RCU_INIT_POINTER(ptr, NULL)

(old rcu_assign_pointer() macro was testing the NULL value and could
omit the smp_wmb(), but this had to be removed because of compiler
warnings)

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

team: replace kmalloc+memcpy by kmemdup

2011-11-18T19:55:03+00:00

Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller