[PATCH bluetooth 0/5] mac802154: ieee802154: stable patches

[PATCH bluetooth 0/5] mac802154: ieee802154: stable patches

[Alexander Aring]

Hi Marcel,

these patches contains patches for the bluetooth branch.

This series includes memory leak fixes and an errno value fix.
Also there are two patches for sending and receiving 1280 6LoWPAN packets,
which makes the IEEE 802.15.4 6LoWPAN stack more RFC compliant.

- Alex

Alexander Aring (2):
  ieee802154: 6lowpan_rtnl: fix correct errno value
  ieee802154: 6lowpan: ensure of sending 1280 packets

Martin Townsend (3):
  mac802154: fixed potential skb leak with mac802154_parse_frame_start
  ieee802154: mac802154: handle the reserved dest mode by dropping the
    packet
  ieee802154: 6lowpan: ensure MTU of 1280 for 6lowpan

 include/net/netns/ieee802154_6lowpan.h |  1 -
 net/ieee802154/6lowpan_rtnl.c          |  4 ++--
 net/ieee802154/reassembly.c            | 13 +++----------
 net/mac802154/wpan.c                   |  6 +++++-
 4 files changed, 10 insertions(+), 14 deletions(-)

-- 
2.0.3

[PATCH bluetooth 1/5] mac802154: fixed potential skb leak with mac802154_parse_frame_start

[Alexander Aring]

From: Martin Townsend <martin.townsend@xsilon.com>

This patch fix a memory leak if received frame was not able to parse.

Signed-off-by: Martin Townsend <martin.townsend@xsilon.com>
Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/mac802154/wpan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/mac802154/wpan.c b/net/mac802154/wpan.c
index 3c3069f..4c13323 100644
--- a/net/mac802154/wpan.c
+++ b/net/mac802154/wpan.c
@@ -573,6 +573,7 @@ void mac802154_wpans_rx(struct mac802154_priv *priv, struct sk_buff *skb)
 	ret = mac802154_parse_frame_start(skb, &hdr);
 	if (ret) {
 		pr_debug("got invalid frame\n");
+		kfree_skb(skb);
 		return;
 	}
 
-- 
2.0.3

[PATCH bluetooth 2/5] ieee802154: 6lowpan_rtnl: fix correct errno value

[Alexander Aring]

This patch correct the return value of lowpan_alloc_frag if an error
occur. Errno numbers should always be negative.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/ieee802154/6lowpan_rtnl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ieee802154/6lowpan_rtnl.c b/net/ieee802154/6lowpan_rtnl.c
index 016b77e..71fa7d4 100644
--- a/net/ieee802154/6lowpan_rtnl.c
+++ b/net/ieee802154/6lowpan_rtnl.c
@@ -246,7 +246,7 @@ lowpan_alloc_frag(struct sk_buff *skb, int size,
 			return ERR_PTR(-rc);
 		}
 	} else {
-		frag = ERR_PTR(ENOMEM);
+		frag = ERR_PTR(-ENOMEM);
 	}
 
 	return frag;
-- 
2.0.3

[PATCH bluetooth 3/5] ieee802154: mac802154: handle the reserved dest mode by dropping the packet

[Alexander Aring]

From: Martin Townsend <martin.townsend@xsilon.com>

If received frame contains the reserved destination address mode. The
frame should be dropped and free the skb.

Signed-off-by: Martin Townsend <martin.townsend@xsilon.com>
Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/mac802154/wpan.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/mac802154/wpan.c b/net/mac802154/wpan.c
index 4c13323..5478388 100644
--- a/net/mac802154/wpan.c
+++ b/net/mac802154/wpan.c
@@ -462,7 +462,10 @@ mac802154_subif_frame(struct mac802154_sub_if_data *sdata, struct sk_buff *skb,
 			skb->pkt_type = PACKET_OTHERHOST;
 		break;
 	default:
-		break;
+		spin_unlock_bh(&sdata->mib_lock);
+		pr_debug("invalid dest mode\n");
+		kfree_skb(skb);
+		return NET_RX_DROP;
 	}
 
 	spin_unlock_bh(&sdata->mib_lock);
-- 
2.0.3

[PATCH bluetooth 4/5] ieee802154: 6lowpan: ensure of sending 1280 packets

[Alexander Aring]

This patch changes the 1281 MTU to 1280. Others stack have only a 1280
byte array for uncompressed 6LoWPAN packets, this avoid that these
stacks have an overflow. Sending 1281 uncompressed 6LoWPAN packets isn't
also rfc complaint.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/ieee802154/6lowpan_rtnl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ieee802154/6lowpan_rtnl.c b/net/ieee802154/6lowpan_rtnl.c
index 71fa7d4..6591d27 100644
--- a/net/ieee802154/6lowpan_rtnl.c
+++ b/net/ieee802154/6lowpan_rtnl.c
@@ -437,7 +437,7 @@ static void lowpan_setup(struct net_device *dev)
 	/* Frame Control + Sequence Number + Address fields + Security Header */
 	dev->hard_header_len	= 2 + 1 + 20 + 14;
 	dev->needed_tailroom	= 2; /* FCS */
-	dev->mtu		= 1281;
+	dev->mtu		= IPV6_MIN_MTU;
 	dev->tx_queue_len	= 0;
 	dev->flags		= IFF_BROADCAST | IFF_MULTICAST;
 	dev->watchdog_timeo	= 0;
-- 
2.0.3

[PATCH bluetooth 5/5] ieee802154: 6lowpan: ensure MTU of 1280 for 6lowpan

[Alexander Aring]

From: Martin Townsend <martin.townsend@xsilon.com>

This patch drops the userspace accessable sysfs entry for the maximum
datagram size of a 6LoWPAN fragment packet.

A fragment should not have a datagram size value greater than 1280 byte.
Instead of make this value configurable, we accept 1280 datagram size
fragment packets only.

Signed-off-by: Martin Townsend <martin.townsend@xsilon.com>
Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 include/net/netns/ieee802154_6lowpan.h |  1 -
 net/ieee802154/reassembly.c            | 13 +++----------
 2 files changed, 3 insertions(+), 11 deletions(-)

diff --git a/include/net/netns/ieee802154_6lowpan.h b/include/net/netns/ieee802154_6lowpan.h
index e207096..8170f8d 100644
--- a/include/net/netns/ieee802154_6lowpan.h
+++ b/include/net/netns/ieee802154_6lowpan.h
@@ -16,7 +16,6 @@ struct netns_sysctl_lowpan {
 struct netns_ieee802154_lowpan {
 	struct netns_sysctl_lowpan sysctl;
 	struct netns_frags	frags;
-	int			max_dsize;
 };
 
 #endif
diff --git a/net/ieee802154/reassembly.c b/net/ieee802154/reassembly.c
index ffec6ce..9dc85e5 100644
--- a/net/ieee802154/reassembly.c
+++ b/net/ieee802154/reassembly.c
@@ -366,8 +366,10 @@ int lowpan_frag_rcv(struct sk_buff *skb, const u8 frag_type)
 	if (err < 0)
 		goto err;
 
-	if (frag_info->d_size > ieee802154_lowpan->max_dsize)
+	if (frag_info->d_size > IPV6_MIN_MTU) {
+		net_warn_ratelimited("lowpan_frag_rcv: datagram size exceeds MTU\n");
 		goto err;
+	}
 
 	fq = fq_find(net, frag_info, &source, &dest);
 	if (fq != NULL) {
@@ -415,13 +417,6 @@ static struct ctl_table lowpan_frags_ns_ctl_table[] = {
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
-	{
-		.procname	= "6lowpanfrag_max_datagram_size",
-		.data		= &init_net.ieee802154_lowpan.max_dsize,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= proc_dointvec
-	},
 	{ }
 };
 
@@ -458,7 +453,6 @@ static int __net_init lowpan_frags_ns_sysctl_register(struct net *net)
 		table[1].data = &ieee802154_lowpan->frags.low_thresh;
 		table[1].extra2 = &ieee802154_lowpan->frags.high_thresh;
 		table[2].data = &ieee802154_lowpan->frags.timeout;
-		table[3].data = &ieee802154_lowpan->max_dsize;
 
 		/* Don't export sysctls to unprivileged users */
 		if (net->user_ns != &init_user_ns)
@@ -533,7 +527,6 @@ static int __net_init lowpan_frags_init_net(struct net *net)
 	ieee802154_lowpan->frags.high_thresh = IPV6_FRAG_HIGH_THRESH;
 	ieee802154_lowpan->frags.low_thresh = IPV6_FRAG_LOW_THRESH;
 	ieee802154_lowpan->frags.timeout = IPV6_FRAG_TIMEOUT;
-	ieee802154_lowpan->max_dsize = 0xFFFF;
 
 	inet_frags_init_net(&ieee802154_lowpan->frags);
 
-- 
2.0.3

Re: [PATCH bluetooth 0/5] mac802154: ieee802154: stable patches

[Marcel Holtmann]

Hi Alex,

> these patches contains patches for the bluetooth branch.
> 
> This series includes memory leak fixes and an errno value fix.
> Also there are two patches for sending and receiving 1280 6LoWPAN packets,
> which makes the IEEE 802.15.4 6LoWPAN stack more RFC compliant.
> 
> - Alex
> 
> Alexander Aring (2):
>  ieee802154: 6lowpan_rtnl: fix correct errno value
>  ieee802154: 6lowpan: ensure of sending 1280 packets
> 
> Martin Townsend (3):
>  mac802154: fixed potential skb leak with mac802154_parse_frame_start
>  ieee802154: mac802154: handle the reserved dest mode by dropping the
>    packet
>  ieee802154: 6lowpan: ensure MTU of 1280 for 6lowpan
> 
> include/net/netns/ieee802154_6lowpan.h |  1 -
> net/ieee802154/6lowpan_rtnl.c          |  4 ++--
> net/ieee802154/reassembly.c            | 13 +++----------
> net/mac802154/wpan.c                   |  6 +++++-
> 4 files changed, 10 insertions(+), 14 deletions(-)

all 5 patches have been applied to bluetooth tree.

However is it possible you introduced a compile warning.

  CC      net/ieee802154/reassembly.o
net/ieee802154/reassembly.c: In function ‘lowpan_frag_rcv’:
net/ieee802154/reassembly.c:358:34: warning: unused variable ‘ieee802154_lowpan’ [-Wunused-variable]
  struct netns_ieee802154_lowpan *ieee802154_lowpan =
                                  ^

Regards

Marcel

Re: [PATCH bluetooth 0/5] mac802154: ieee802154: stable patches

[Alexander Aring]

Hi Marcel,

On Tue, Aug 19, 2014 at 11:44:11AM -0500, Marcel Holtmann wrote:
> Hi Alex,
> 
> > these patches contains patches for the bluetooth branch.
> > 
> > This series includes memory leak fixes and an errno value fix.
> > Also there are two patches for sending and receiving 1280 6LoWPAN packets,
> > which makes the IEEE 802.15.4 6LoWPAN stack more RFC compliant.
> > 
> > - Alex
> > 
> > Alexander Aring (2):
> >  ieee802154: 6lowpan_rtnl: fix correct errno value
> >  ieee802154: 6lowpan: ensure of sending 1280 packets
> > 
> > Martin Townsend (3):
> >  mac802154: fixed potential skb leak with mac802154_parse_frame_start
> >  ieee802154: mac802154: handle the reserved dest mode by dropping the
> >    packet
> >  ieee802154: 6lowpan: ensure MTU of 1280 for 6lowpan
> > 
> > include/net/netns/ieee802154_6lowpan.h |  1 -
> > net/ieee802154/6lowpan_rtnl.c          |  4 ++--
> > net/ieee802154/reassembly.c            | 13 +++----------
> > net/mac802154/wpan.c                   |  6 +++++-
> > 4 files changed, 10 insertions(+), 14 deletions(-)
> 
> all 5 patches have been applied to bluetooth tree.
> 
> However is it possible you introduced a compile warning.
> 
>   CC      net/ieee802154/reassembly.o
> net/ieee802154/reassembly.c: In function ‘lowpan_frag_rcv’:
> net/ieee802154/reassembly.c:358:34: warning: unused variable ‘ieee802154_lowpan’ [-Wunused-variable]
>   struct netns_ieee802154_lowpan *ieee802154_lowpan =
>                                   ^

indeed, I will send a v2 of this series. Sorry.

I will integrate the "compile warning check" in my workflow for the next
time.

Thanks.

- Alex