* [PATCH AUTOSEL 4.14 2/9] mac80211: set up the fwd_skb->dev for mesh forwarding
[not found] <20211221020123.117380-1-sashal@kernel.org>
@ 2021-12-21 2:01 ` Sasha Levin
2021-12-21 2:01 ` [PATCH AUTOSEL 4.14 3/9] mac80211: fix a memory leak where sta_info is not freed Sasha Levin
` (4 subsequent siblings)
5 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2021-12-21 2:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Xing Song, Frank Wunderlich, Johannes Berg, Sasha Levin, johannes,
davem, kuba, matthias.bgg, linux-wireless, netdev,
linux-arm-kernel, linux-mediatek
From: Xing Song <xing.song@mediatek.com>
[ Upstream commit 942bd1070c3a39d1302fc5db73d60c86e3033c81 ]
Mesh forwarding requires that the fwd_skb->dev is set up for TX handling,
otherwise the following warning will be generated, so set it up for the
pending frames.
[ 72.835674 ] WARNING: CPU: 0 PID: 1193 at __skb_flow_dissect+0x284/0x1298
[ 72.842379 ] Modules linked in: ksmbd pppoe ppp_async l2tp_ppp ...
[ 72.962020 ] CPU: 0 PID: 1193 Comm: kworker/u5:1 Tainted: P S 5.4.137 #0
[ 72.969938 ] Hardware name: MT7622_MT7531 RFB (DT)
[ 72.974659 ] Workqueue: napi_workq napi_workfn
[ 72.979025 ] pstate: 60000005 (nZCv daif -PAN -UAO)
[ 72.983822 ] pc : __skb_flow_dissect+0x284/0x1298
[ 72.988444 ] lr : __skb_flow_dissect+0x54/0x1298
[ 72.992977 ] sp : ffffffc010c738c0
[ 72.996293 ] x29: ffffffc010c738c0 x28: 0000000000000000
[ 73.001615 ] x27: 000000000000ffc2 x26: ffffff800c2eb818
[ 73.006937 ] x25: ffffffc010a987c8 x24: 00000000000000ce
[ 73.012259 ] x23: ffffffc010c73a28 x22: ffffffc010a99c60
[ 73.017581 ] x21: 000000000000ffc2 x20: ffffff80094da800
[ 73.022903 ] x19: 0000000000000000 x18: 0000000000000014
[ 73.028226 ] x17: 00000000084d16af x16: 00000000d1fc0bab
[ 73.033548 ] x15: 00000000715f6034 x14: 000000009dbdd301
[ 73.038870 ] x13: 00000000ea4dcbc3 x12: 0000000000000040
[ 73.044192 ] x11: 000000000eb00ff0 x10: 0000000000000000
[ 73.049513 ] x9 : 000000000eb00073 x8 : 0000000000000088
[ 73.054834 ] x7 : 0000000000000000 x6 : 0000000000000001
[ 73.060155 ] x5 : 0000000000000000 x4 : 0000000000000000
[ 73.065476 ] x3 : ffffffc010a98000 x2 : 0000000000000000
[ 73.070797 ] x1 : 0000000000000000 x0 : 0000000000000000
[ 73.076120 ] Call trace:
[ 73.078572 ] __skb_flow_dissect+0x284/0x1298
[ 73.082846 ] __skb_get_hash+0x7c/0x228
[ 73.086629 ] ieee80211_txq_may_transmit+0x7fc/0x17b8 [mac80211]
[ 73.092564 ] ieee80211_tx_prepare_skb+0x20c/0x268 [mac80211]
[ 73.098238 ] ieee80211_tx_pending+0x144/0x330 [mac80211]
[ 73.103560 ] tasklet_action_common.isra.16+0xb4/0x158
[ 73.108618 ] tasklet_action+0x2c/0x38
[ 73.112286 ] __do_softirq+0x168/0x3b0
[ 73.115954 ] do_softirq.part.15+0x88/0x98
[ 73.119969 ] __local_bh_enable_ip+0xb0/0xb8
[ 73.124156 ] napi_workfn+0x58/0x90
[ 73.127565 ] process_one_work+0x20c/0x478
[ 73.131579 ] worker_thread+0x50/0x4f0
[ 73.135249 ] kthread+0x124/0x128
[ 73.138484 ] ret_from_fork+0x10/0x1c
Signed-off-by: Xing Song <xing.song@mediatek.com>
Tested-By: Frank Wunderlich <frank-w@public-files.de>
Link: https://lore.kernel.org/r/20211123033123.2684-1-xing.song@mediatek.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/rx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index cbe1177d95f9e..9fae6254c8d94 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2657,6 +2657,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
goto out;
}
+ fwd_skb->dev = sdata->dev;
fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
info = IEEE80211_SKB_CB(fwd_skb);
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH AUTOSEL 4.14 3/9] mac80211: fix a memory leak where sta_info is not freed
[not found] <20211221020123.117380-1-sashal@kernel.org>
2021-12-21 2:01 ` [PATCH AUTOSEL 4.14 2/9] mac80211: set up the fwd_skb->dev for mesh forwarding Sasha Levin
@ 2021-12-21 2:01 ` Sasha Levin
2021-12-21 2:01 ` [PATCH AUTOSEL 4.14 4/9] phonet: refcount leak in pep_sock_accep Sasha Levin
` (3 subsequent siblings)
5 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2021-12-21 2:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ahmed Zaki, Johannes Berg, Sasha Levin, johannes, davem, kuba,
linux-wireless, netdev
From: Ahmed Zaki <anzaki@gmail.com>
[ Upstream commit 8f9dcc29566626f683843ccac6113a12208315ca ]
The following is from a system that went OOM due to a memory leak:
wlan0: Allocated STA 74:83:c2:64:0b:87
wlan0: Allocated STA 74:83:c2:64:0b:87
wlan0: IBSS finish 74:83:c2:64:0b:87 (---from ieee80211_ibss_add_sta)
wlan0: Adding new IBSS station 74:83:c2:64:0b:87
wlan0: moving STA 74:83:c2:64:0b:87 to state 2
wlan0: moving STA 74:83:c2:64:0b:87 to state 3
wlan0: Inserted STA 74:83:c2:64:0b:87
wlan0: IBSS finish 74:83:c2:64:0b:87 (---from ieee80211_ibss_work)
wlan0: Adding new IBSS station 74:83:c2:64:0b:87
wlan0: moving STA 74:83:c2:64:0b:87 to state 2
wlan0: moving STA 74:83:c2:64:0b:87 to state 3
.
.
wlan0: expiring inactive not authorized STA 74:83:c2:64:0b:87
wlan0: moving STA 74:83:c2:64:0b:87 to state 2
wlan0: moving STA 74:83:c2:64:0b:87 to state 1
wlan0: Removed STA 74:83:c2:64:0b:87
wlan0: Destroyed STA 74:83:c2:64:0b:87
The ieee80211_ibss_finish_sta() is called twice on the same STA from 2
different locations. On the second attempt, the allocated STA is not
destroyed creating a kernel memory leak.
This is happening because sta_info_insert_finish() does not call
sta_info_free() the second time when the STA already exists (returns
-EEXIST). Note that the caller sta_info_insert_rcu() assumes STA is
destroyed upon errors.
Same fix is applied to -ENOMEM.
Signed-off-by: Ahmed Zaki <anzaki@gmail.com>
Link: https://lore.kernel.org/r/20211002145329.3125293-1-anzaki@gmail.com
[change the error path label to use the existing code]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/sta_info.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 0d5265adf5396..764175c0222dd 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -554,13 +554,13 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
/* check if STA exists already */
if (sta_info_get_bss(sdata, sta->sta.addr)) {
err = -EEXIST;
- goto out_err;
+ goto out_cleanup;
}
sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL);
if (!sinfo) {
err = -ENOMEM;
- goto out_err;
+ goto out_cleanup;
}
local->num_sta++;
@@ -609,8 +609,8 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
out_drop_sta:
local->num_sta--;
synchronize_net();
+ out_cleanup:
cleanup_single_sta(sta);
- out_err:
mutex_unlock(&local->sta_mtx);
kfree(sinfo);
rcu_read_lock();
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH AUTOSEL 4.14 4/9] phonet: refcount leak in pep_sock_accep
[not found] <20211221020123.117380-1-sashal@kernel.org>
2021-12-21 2:01 ` [PATCH AUTOSEL 4.14 2/9] mac80211: set up the fwd_skb->dev for mesh forwarding Sasha Levin
2021-12-21 2:01 ` [PATCH AUTOSEL 4.14 3/9] mac80211: fix a memory leak where sta_info is not freed Sasha Levin
@ 2021-12-21 2:01 ` Sasha Levin
2021-12-21 2:01 ` [PATCH AUTOSEL 4.14 5/9] net: bcmgenet: Fix NULL vs IS_ERR() checking Sasha Levin
` (2 subsequent siblings)
5 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2021-12-21 2:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hangyu Hua, Jakub Kicinski, Sasha Levin, courmisch, davem, netdev
From: Hangyu Hua <hbh25y@gmail.com>
[ Upstream commit bcd0f93353326954817a4f9fa55ec57fb38acbb0 ]
sock_hold(sk) is invoked in pep_sock_accept(), but __sock_put(sk) is not
invoked in subsequent failure branches(pep_accept_conn() != 0).
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Link: https://lore.kernel.org/r/20211209082839.33985-1-hbh25y@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/phonet/pep.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index bffcef58ebf5c..f1bdd4f1b1b43 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -881,6 +881,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp,
err = pep_accept_conn(newsk, skb);
if (err) {
+ __sock_put(sk);
sock_put(newsk);
newsk = NULL;
goto drop;
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH AUTOSEL 4.14 5/9] net: bcmgenet: Fix NULL vs IS_ERR() checking
[not found] <20211221020123.117380-1-sashal@kernel.org>
` (2 preceding siblings ...)
2021-12-21 2:01 ` [PATCH AUTOSEL 4.14 4/9] phonet: refcount leak in pep_sock_accep Sasha Levin
@ 2021-12-21 2:01 ` Sasha Levin
2021-12-21 2:01 ` [PATCH AUTOSEL 4.14 6/9] mac80211: Fix the size used for building probe request Sasha Levin
2021-12-21 2:01 ` [PATCH AUTOSEL 4.14 8/9] net: usb: lan78xx: add Allied Telesis AT29M2-AF Sasha Levin
5 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2021-12-21 2:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Miaoqian Lin, Florian Fainelli, David S . Miller, Sasha Levin,
opendmb, kuba, bcm-kernel-feedback-list, netdev
From: Miaoqian Lin <linmq006@gmail.com>
[ Upstream commit ab8eb798ddabddb2944401bf31ead9671cb97d95 ]
The phy_attach() function does not return NULL. It returns error pointers.
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/genet/bcmmii.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index 72fad2a63c625..e609154d1ac93 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -535,9 +535,9 @@ static int bcmgenet_mii_pd_init(struct bcmgenet_priv *priv)
* Internal or external PHY with MDIO access
*/
phydev = phy_attach(priv->dev, phy_name, pd->phy_interface);
- if (!phydev) {
+ if (IS_ERR(phydev)) {
dev_err(kdev, "failed to register PHY device\n");
- return -ENODEV;
+ return PTR_ERR(phydev);
}
} else {
/*
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH AUTOSEL 4.14 6/9] mac80211: Fix the size used for building probe request
[not found] <20211221020123.117380-1-sashal@kernel.org>
` (3 preceding siblings ...)
2021-12-21 2:01 ` [PATCH AUTOSEL 4.14 5/9] net: bcmgenet: Fix NULL vs IS_ERR() checking Sasha Levin
@ 2021-12-21 2:01 ` Sasha Levin
2021-12-21 2:01 ` [PATCH AUTOSEL 4.14 8/9] net: usb: lan78xx: add Allied Telesis AT29M2-AF Sasha Levin
5 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2021-12-21 2:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilan Peer, Luca Coelho, Johannes Berg, Sasha Levin, johannes,
davem, kuba, linux-wireless, netdev
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit f22d981386d12d1513bd2720fb4387b469124d4b ]
Instead of using the hard-coded value of '100' use the correct
scan IEs length as calculated during HW registration to mac80211.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211129152938.0a82d6891719.I8ded1f2e0bccb9e71222c945666bcd86537f2e35@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index cd3cdd1a0b576..e25d570479bf6 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1548,7 +1548,7 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
chandef.chan = chan;
skb = ieee80211_probereq_get(&local->hw, src, ssid, ssid_len,
- 100 + ie_len);
+ local->scan_ies_len + ie_len);
if (!skb)
return NULL;
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH AUTOSEL 4.14 8/9] net: usb: lan78xx: add Allied Telesis AT29M2-AF
[not found] <20211221020123.117380-1-sashal@kernel.org>
` (4 preceding siblings ...)
2021-12-21 2:01 ` [PATCH AUTOSEL 4.14 6/9] mac80211: Fix the size used for building probe request Sasha Levin
@ 2021-12-21 2:01 ` Sasha Levin
5 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2021-12-21 2:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Jesionowski, Jakub Kicinski, Sasha Levin, woojung.huh,
UNGLinuxDriver, davem, netdev, linux-usb
From: Greg Jesionowski <jesionowskigreg@gmail.com>
[ Upstream commit ef8a0f6eab1ca5d1a75c242c5c7b9d386735fa0a ]
This adds the vendor and product IDs for the AT29M2-AF which is a
lan7801-based device.
Signed-off-by: Greg Jesionowski <jesionowskigreg@gmail.com>
Link: https://lore.kernel.org/r/20211214221027.305784-1-jesionowskigreg@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/lan78xx.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 838b6fe9dfaaf..dc8afd5575fe2 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -74,6 +74,8 @@
#define LAN7801_USB_PRODUCT_ID (0x7801)
#define LAN78XX_EEPROM_MAGIC (0x78A5)
#define LAN78XX_OTP_MAGIC (0x78F3)
+#define AT29M2AF_USB_VENDOR_ID (0x07C9)
+#define AT29M2AF_USB_PRODUCT_ID (0x0012)
#define MII_READ 1
#define MII_WRITE 0
@@ -4015,6 +4017,10 @@ static const struct usb_device_id products[] = {
/* LAN7801 USB Gigabit Ethernet Device */
USB_DEVICE(LAN78XX_USB_VENDOR_ID, LAN7801_USB_PRODUCT_ID),
},
+ {
+ /* ATM2-AF USB Gigabit Ethernet Device */
+ USB_DEVICE(AT29M2AF_USB_VENDOR_ID, AT29M2AF_USB_PRODUCT_ID),
+ },
{},
};
MODULE_DEVICE_TABLE(usb, products);
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread