linux-stable.git/net/mac802154, branch v6.2

mac802154: Fix possible double free upon parsing error

2022-12-19T10:38:12+00:00

Commit 4d1c7d87030b ("mac802154: Move an skb free within the rx path")
tried to simplify error handling within the receive path by moving the
kfree_skb() call at the very end of the top-level function but missed
one kfree_skb() called upon frame parsing error. Prevent this possible
double free from happening.

Fixes: 4d1c7d87030b ("mac802154: Move an skb free within the rx path")
Reported-by: Dan Carpenter 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/r/20221216235742.646134-1-miquel.raynal@bootlin.com
Signed-off-by: Stefan Schmidt

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2022-12-09T02:19:59+00:00

No conflicts.

Signed-off-by: Jakub Kicinski

Merge tag 'ieee802154-for-net-next-2022-12-05' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next

2022-12-08T01:33:26+00:00

Stefan Schmidt says:

====================
ieee802154-next 2022-12-05

Miquel continued his work towards full scanning support. For this,
we now allow the creation of dedicated coordinator interfaces
to allow a PAN coordinator to serve in the network and set
the needed address filters with the hardware.

On top of this we have the first part to allow scanning for available
15.4 networks. A new netlink scan group, within the existing nl802154
API, was added.

In addition Miquel fixed two issues that have been introduced in the former
patches to free an skb correctly and clarifying an expression in the stack.

From David Girault we got tracing support when registering new PANs.

* tag 'ieee802154-for-net-next-2022-12-05' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next:
  mac802154: Trace the registration of new PANs
  ieee802154: Advertize coordinators discovery
  mac802154: Allow the creation of coordinator interfaces
  mac802154: Clarify an expression
  mac802154: Move an skb free within the rx path
====================

Link: https://lore.kernel.org/r/20221205131909.1871790-1-stefan@datenfreihafen.org
Signed-off-by: Jakub Kicinski

mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()

2022-12-05T08:53:08+00:00

Kernel fault injection test reports null-ptr-deref as follows:

BUG: kernel NULL pointer dereference, address: 0000000000000008
RIP: 0010:cfg802154_netdev_notifier_call+0x120/0x310 include/linux/list.h:114
Call Trace:
 
 raw_notifier_call_chain+0x6d/0xa0 kernel/notifier.c:87
 call_netdevice_notifiers_info+0x6e/0xc0 net/core/dev.c:1944
 unregister_netdevice_many_notify+0x60d/0xcb0 net/core/dev.c:1982
 unregister_netdevice_queue+0x154/0x1a0 net/core/dev.c:10879
 register_netdevice+0x9a8/0xb90 net/core/dev.c:10083
 ieee802154_if_add+0x6ed/0x7e0 net/mac802154/iface.c:659
 ieee802154_register_hw+0x29c/0x330 net/mac802154/main.c:229
 mcr20a_probe+0xaaa/0xcb1 drivers/net/ieee802154/mcr20a.c:1316

ieee802154_if_add() allocates wpan_dev as netdev's private data, but not
init the list in struct wpan_dev. cfg802154_netdev_notifier_call() manage
the list when device register/unregister, and may lead to null-ptr-deref.

Use INIT_LIST_HEAD() on it to initialize it correctly.

Fixes: fcf39e6e88e9 ("ieee802154: add wpan_dev_list")
Signed-off-by: Wei Yongjun 
Acked-by: Alexander Aring 

Link: https://lore.kernel.org/r/20221130091705.1831140-1-weiyongjun@huaweicloud.com
Signed-off-by: Stefan Schmidt

mac802154: Trace the registration of new PANs

2022-11-29T14:34:32+00:00

Add an internal trace when valid beacons are received.

Signed-off-by: David Girault 
Signed-off-by: Miquel Raynal 
Acked-by: Alexander Aring 
Link: https://lore.kernel.org/r/20221129135535.532513-3-miquel.raynal@bootlin.com
Signed-off-by: Stefan Schmidt

mac802154: Allow the creation of coordinator interfaces

2022-11-01T10:23:38+00:00

As a first strep in introducing proper PAN management and association,
we need to be able to create coordinator interfaces which might act as
coordinator or PAN coordinator.

Hence, let's add the minimum support to allow the creation of these
interfaces.

Even though the necessary logic to handle several interfaces on the same
device is added to make this future move easier, in practice only
several interfaces of type MONITOR are allowed at the same time. The
other combinations are not allowed (interface creation is possible but
only one can be opened at a time) because, with a single PHY featuring a
single set of address filters, we cannot afford handling two distinct
interfaces (with different address filters or filtering requirements):
* Having 2 NODEs, 2 COORDs or 1 NODE + 1 COORD
  -> cannot work because the address filters would be different
* Having 1 MONITOR + either 1 NODE or 1 COORD
  -> cannot work because the filtering levels are incompatible

Signed-off-by: Miquel Raynal 
Acked-by: Alexander Aring 
Link: https://lore.kernel.org/r/20221026093502.602734-4-miquel.raynal@bootlin.com
Signed-off-by: Stefan Schmidt

mac802154: Clarify an expression

2022-11-01T10:23:28+00:00

While going through the whole interface opening logic in my head I was
consistently bothered by the condition checking whether there was only
one interface of type NODE/COORD opened at the same time. What actually
bothered me was the fact that in one case we would use the wpan_dev
pointer directly while in the other case we would use the sdata pointer,
making it harder to differentiate both. In practice the condition should
be straightforward to read. IMHO dropping the wpan_dev indirection
allows to clarify the check.

Signed-off-by: Miquel Raynal 
Acked-by: Alexander Aring 
Link: https://lore.kernel.org/r/20221026093502.602734-3-miquel.raynal@bootlin.com
Signed-off-by: Stefan Schmidt

mac802154: Move an skb free within the rx path

2022-11-01T10:22:54+00:00

It may appear clearer to free the skb at the end of the path rather than
in the middle, within a helper.

Move kfree_skb() from the end of __ieee802154_rx_handle_packet() to
right after it in the calling function ieee802154_rx(). Doing so implies
reworking a little bit the exit path.

Suggested-by: Alexander Aring 
Signed-off-by: Miquel Raynal 
Acked-by: Alexander Aring 
Link: https://lore.kernel.org/r/20221026093502.602734-2-miquel.raynal@bootlin.com
Signed-off-by: Stefan Schmidt

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2022-10-27T23:56:36+00:00

drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
  2871edb32f46 ("can: kvaser_usb: Fix possible completions during init_completion")
  abb8670938b2 ("can: kvaser_usb_leaf: Ignore stale bus-off after start")
  8d21f5927ae6 ("can: kvaser_usb_leaf: Fix improved state not being reported")

Signed-off-by: Jakub Kicinski

Merge tag 'ieee802154-for-net-next-2022-10-26' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next

2022-10-27T01:14:33+00:00

Re-pull from Stefan to fix the warnings.

Stefan Schmidt says:

====================
pull-request v2: ieee802154-next 2022-10-26

* tag 'ieee802154-for-net-next-2022-10-26' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next:
  net: mac802154: Fixup function parameter name in docs
====================

Link: https://lore.kernel.org/r/20221026075638.578840-1-stefan@datenfreihafen.org
Signed-off-by: Jakub Kicinski