| Message ID | 20170420111651.10213-1-james.hughes@raspberrypi.org |
|---|---|
| State | Awaiting Upstream, archived |
| Delegated to: | David Miller |
| Headers | show |
+ linux-wireless James Hughes <james.hughes@raspberrypi.org> writes: > The driver was adding header information to incoming skb > without ensuring the head was uncloned and hence writable. > > skb_cow_head has been used to ensure they are writable, however, > this required some changes to error handling to ensure that > if skb_cow_head failed it was not ignored. > > This really needs to be reviewed by someone who is more familiar > with this code base to ensure any deallocation of skb's is > still correct. > > Signed-off-by: James Hughes <james.hughes@raspberrypi.org> You should also CC linux-wireless, otherwise patchwork won't see it.
On 20 April 2017 at 12:31, Kalle Valo <kvalo@codeaurora.org> wrote: > + linux-wireless > > James Hughes <james.hughes@raspberrypi.org> writes: > >> The driver was adding header information to incoming skb >> without ensuring the head was uncloned and hence writable. >> >> skb_cow_head has been used to ensure they are writable, however, >> this required some changes to error handling to ensure that >> if skb_cow_head failed it was not ignored. >> >> This really needs to be reviewed by someone who is more familiar >> with this code base to ensure any deallocation of skb's is >> still correct. >> >> Signed-off-by: James Hughes <james.hughes@raspberrypi.org> > > You should also CC linux-wireless, otherwise patchwork won't see it. > > -- > Kalle Valo Thanks Kalle, I wasn't subscribed to wireless, but have now done so. I also failed to read the MAINTAINERS list correctly.. With regard to this particular patch, this is related to the recent patches to use skb_cow_head in a number of USB net drivers to ensure they can write headers correctly, and I suspect the same fault is possible/likely in other drivers outside the USB net realm, as this patch shows. I'm not overly happy with the error handling in this patch, but that said, the error handling over this entire driver does strike me as suspect. Quite a few places where return codes are ignored, just in my quick examination. So not really sure how to proceed past this patch, if at all.
On Thu, 2017-04-20 at 12:16 +0100, James Hughes wrote: > The driver was adding header information to incoming skb > without ensuring the head was uncloned and hence writable. > > skb_cow_head has been used to ensure they are writable, however, > this required some changes to error handling to ensure that > if skb_cow_head failed it was not ignored. > > This really needs to be reviewed by someone who is more familiar > with this code base to ensure any deallocation of skb's is > still correct. > > Signed-off-by: James Hughes <james.hughes@raspberrypi.org> > --- You mention incoming skb in patch title, yet you change part of TX path. Please split your changes in individual ones, to ease future bisections, and ease backports as well. Also, while it is known that TX path can deal with cloned skbs, it is not clear why RX path has clones. Most drivers allocate an skb, fill it, and pass it to network stack. So please make sure all these changes are really needed. > diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c > index d138260..0e53c8a 100644 > --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c > +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c > @@ -2719,7 +2719,7 @@ static bool brcmf_sdio_prec_enq(struct pktq *q, struct sk_buff *pkt, int prec) > > static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt) > { > - int ret = -EBADE; > + int ret = -EBADE, err; > uint prec; > struct brcmf_bus *bus_if = dev_get_drvdata(dev); > struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio; > @@ -2729,6 +2729,11 @@ static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt) > if (sdiodev->state != BRCMF_SDIOD_DATA) > return -EIO; > > + err = skb_cow_head(pkt, bus->tx_hdrlen); > + > + if (err) > + return err; > + > /* Add space for the header */ > skb_push(pkt, bus->tx_hdrlen); > /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
On 4/20/2017 2:09 PM, James Hughes wrote: > On 20 April 2017 at 12:31, Kalle Valo <kvalo@codeaurora.org> wrote: >> + linux-wireless >> >> James Hughes <james.hughes@raspberrypi.org> writes: >> >>> The driver was adding header information to incoming skb >>> without ensuring the head was uncloned and hence writable. >>> >>> skb_cow_head has been used to ensure they are writable, however, >>> this required some changes to error handling to ensure that >>> if skb_cow_head failed it was not ignored. >>> >>> This really needs to be reviewed by someone who is more familiar >>> with this code base to ensure any deallocation of skb's is >>> still correct. >>> >>> Signed-off-by: James Hughes <james.hughes@raspberrypi.org> >> >> You should also CC linux-wireless, otherwise patchwork won't see it. >> >> -- >> Kalle Valo > > Thanks Kalle, I wasn't subscribed to wireless, but have now done so. I > also failed to read the MAINTAINERS list correctly.. > > With regard to this particular patch, this is related to the recent > patches to use skb_cow_head in a number of USB net drivers to ensure > they can write headers correctly, and I suspect the same fault is > possible/likely in other drivers outside the USB net realm, as this > patch shows. > > I'm not overly happy with the error handling in this patch, but that > said, the error handling over this entire driver does strike me as > suspect. Quite a few places where return codes are ignored, just in my > quick examination. So not really sure how to proceed past this patch, > if at all. I would appreciate it if you can provide details about the code you consider suspect. I will respond on the patches soon. Regards, Arend
+ linux-wireless On 4/20/2017 1:16 PM, James Hughes wrote: > The driver was adding header information to incoming skb > without ensuring the head was uncloned and hence writable. > > skb_cow_head has been used to ensure they are writable, however, > this required some changes to error handling to ensure that > if skb_cow_head failed it was not ignored. > > This really needs to be reviewed by someone who is more familiar > with this code base to ensure any deallocation of skb's is > still correct. > > Signed-off-by: James Hughes <james.hughes@raspberrypi.org> > --- > .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 15 ++++++++-- > .../wireless/broadcom/brcm80211/brcmfmac/core.c | 23 +++++----------- > .../broadcom/brcm80211/brcmfmac/fwsignal.c | 32 +++++++++++++++++----- > .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 ++++- > 4 files changed, 51 insertions(+), 26 deletions(-) > [...] > diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c > index 5eaac13..08272e8 100644 > --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c > +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c > @@ -198,7 +198,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, > int ret; > struct brcmf_if *ifp = netdev_priv(ndev); > struct brcmf_pub *drvr = ifp->drvr; > - struct ethhdr *eh = (struct ethhdr *)(skb->data); > + struct ethhdr *eh; > > brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx); > > @@ -212,23 +212,14 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, > } > > /* Make sure there's enough room for any header */ > - if (skb_headroom(skb) < drvr->hdrlen) { > - struct sk_buff *skb2; > - > - brcmf_dbg(INFO, "%s: insufficient headroom\n", > - brcmf_ifname(ifp)); > - drvr->bus_if->tx_realloc++; > - skb2 = skb_realloc_headroom(skb, drvr->hdrlen); > - dev_kfree_skb(skb); > - skb = skb2; > - if (skb == NULL) { > - brcmf_err("%s: skb_realloc_headroom failed\n", > - brcmf_ifname(ifp)); > - ret = -ENOMEM; > - goto done; > - } What you are throwing away here is code that assures there is sufficient headroom for protocol and bus layer in the tx path, because that is determined by drvr->hdrlen. This is where the skb is handed to the driver so if you could leave the functionality above *and* assure it is writeable that would be the best solution as there is no need for all the other changes down the tx path. > + ret = skb_cow_head(skb, drvr->hdrlen); > + if (ret) { So move the realloc code above here instead of simply freeing the skb. > + dev_kfree_skb_any(skb); > + goto done; > } > > + eh = (struct ethhdr *)(skb->data); Now this is actually a separate fix so I would like a separate patch for it. I have a RPi3 sitting on my desk so how can I replicate the issue. It was something about broadcast/multicast traffic when using AP mode and a bridge, right? Regards, Arend
On 20 April 2017 at 20:48, Arend van Spriel <arend.vanspriel@broadcom.com> wrote: > + linux-wireless > > On 4/20/2017 1:16 PM, James Hughes wrote: >> >> The driver was adding header information to incoming skb >> without ensuring the head was uncloned and hence writable. >> >> skb_cow_head has been used to ensure they are writable, however, >> this required some changes to error handling to ensure that >> if skb_cow_head failed it was not ignored. >> >> This really needs to be reviewed by someone who is more familiar >> with this code base to ensure any deallocation of skb's is >> still correct. >> >> Signed-off-by: James Hughes <james.hughes@raspberrypi.org> >> --- >> .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 15 ++++++++-- >> .../wireless/broadcom/brcm80211/brcmfmac/core.c | 23 +++++----------- >> .../broadcom/brcm80211/brcmfmac/fwsignal.c | 32 >> +++++++++++++++++----- >> .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 ++++- >> 4 files changed, 51 insertions(+), 26 deletions(-) >> > > [...] > >> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c >> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c >> index 5eaac13..08272e8 100644 >> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c >> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c >> @@ -198,7 +198,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct >> sk_buff *skb, >> int ret; >> struct brcmf_if *ifp = netdev_priv(ndev); >> struct brcmf_pub *drvr = ifp->drvr; >> - struct ethhdr *eh = (struct ethhdr *)(skb->data); >> + struct ethhdr *eh; >> brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx); >> @@ -212,23 +212,14 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct >> sk_buff *skb, >> } >> /* Make sure there's enough room for any header */ >> - if (skb_headroom(skb) < drvr->hdrlen) { >> - struct sk_buff *skb2; >> - >> - brcmf_dbg(INFO, "%s: insufficient headroom\n", >> - brcmf_ifname(ifp)); >> - drvr->bus_if->tx_realloc++; >> - skb2 = skb_realloc_headroom(skb, drvr->hdrlen); >> - dev_kfree_skb(skb); >> - skb = skb2; >> - if (skb == NULL) { >> - brcmf_err("%s: skb_realloc_headroom failed\n", >> - brcmf_ifname(ifp)); >> - ret = -ENOMEM; >> - goto done; >> - } > > > What you are throwing away here is code that assures there is sufficient > headroom for protocol and bus layer in the tx path, because that is > determined by drvr->hdrlen. This is where the skb is handed to the driver so > if you could leave the functionality above *and* assure it is writeable that > would be the best solution as there is no need for all the other changes > down the tx path. The skb_cow_head function takes the required headroom as a parameter and will ensure that there is enough space, so I don't think this code segment is required or have I misunderstood what you mean here? Is it safe to rely on the _cow_ being done here and not further down in the stack? Or at least checked further down in the stack. Previous comments from another patch requested that the _cow_ be done close to the actual addition of the header. I presume it is unlikely/impossible that the functions that add header information down the stack will be called without the above being done first? > >> + ret = skb_cow_head(skb, drvr->hdrlen); >> + if (ret) { > > > So move the realloc code above here instead of simply freeing the skb. > >> + dev_kfree_skb_any(skb); >> + goto done; >> } >> + eh = (struct ethhdr *)(skb->data); > > > Now this is actually a separate fix so I would like a separate patch for it. > No problem, but see final paragraph below. > I have a RPi3 sitting on my desk so how can I replicate the issue. It was > something about broadcast/multicast traffic when using AP mode and a bridge, > right? > > Regards, > Arend See this issue for details on replication. https://github.com/raspberrypi/firmware/issues/673 The bridge I use is setup using a similar procedure to that described here. https://www.raspberrypi.org/documentation/configuration/wireless/access-point.md I'm happy to pass over this work to you guys if you think it is appropriate, you are the experts on the codebase.
On 21-4-2017 11:22, James Hughes wrote: > On 20 April 2017 at 20:48, Arend van Spriel > <arend.vanspriel@broadcom.com> wrote: >> + linux-wireless >> >> On 4/20/2017 1:16 PM, James Hughes wrote: >>> >>> The driver was adding header information to incoming skb >>> without ensuring the head was uncloned and hence writable. >>> >>> skb_cow_head has been used to ensure they are writable, however, >>> this required some changes to error handling to ensure that >>> if skb_cow_head failed it was not ignored. >>> >>> This really needs to be reviewed by someone who is more familiar >>> with this code base to ensure any deallocation of skb's is >>> still correct. >>> >>> Signed-off-by: James Hughes <james.hughes@raspberrypi.org> >>> --- >>> .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 15 ++++++++-- >>> .../wireless/broadcom/brcm80211/brcmfmac/core.c | 23 +++++----------- >>> .../broadcom/brcm80211/brcmfmac/fwsignal.c | 32 >>> +++++++++++++++++----- >>> .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 ++++- >>> 4 files changed, 51 insertions(+), 26 deletions(-) >>> >> >> [...] >> >>> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c >>> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c >>> index 5eaac13..08272e8 100644 >>> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c >>> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c >>> @@ -198,7 +198,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct >>> sk_buff *skb, >>> int ret; >>> struct brcmf_if *ifp = netdev_priv(ndev); >>> struct brcmf_pub *drvr = ifp->drvr; >>> - struct ethhdr *eh = (struct ethhdr *)(skb->data); >>> + struct ethhdr *eh; >>> brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx); >>> @@ -212,23 +212,14 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct >>> sk_buff *skb, >>> } >>> /* Make sure there's enough room for any header */ >>> - if (skb_headroom(skb) < drvr->hdrlen) { >>> - struct sk_buff *skb2; >>> - >>> - brcmf_dbg(INFO, "%s: insufficient headroom\n", >>> - brcmf_ifname(ifp)); >>> - drvr->bus_if->tx_realloc++; >>> - skb2 = skb_realloc_headroom(skb, drvr->hdrlen); >>> - dev_kfree_skb(skb); >>> - skb = skb2; >>> - if (skb == NULL) { >>> - brcmf_err("%s: skb_realloc_headroom failed\n", >>> - brcmf_ifname(ifp)); >>> - ret = -ENOMEM; >>> - goto done; >>> - } >> >> >> What you are throwing away here is code that assures there is sufficient >> headroom for protocol and bus layer in the tx path, because that is >> determined by drvr->hdrlen. This is where the skb is handed to the driver so >> if you could leave the functionality above *and* assure it is writeable that >> would be the best solution as there is no need for all the other changes >> down the tx path. > > The skb_cow_head function takes the required headroom as a parameter > and will ensure that there is enough space, so I don't think this code > segment is > required or have I misunderstood what you mean here? I looked more into what skb_cow_head() and skb_realloc_headroom() actually do and it seems you are right. > Is it safe to rely on the _cow_ being done here and not further down > in the stack? > Or at least checked further down in the stack. Previous comments from > another patch > requested that the _cow_ be done close to the actual addition of the > header. I presume > it is unlikely/impossible that the functions that add header > information down the stack > will be called without the above being done first? It is safe. During probe sequence each layer in the driver stack increments drvr->hdrlen with headroom it needs. So drvr->hdrlen will indicate the total headroom needed when .start_xmit() is called. And yes, the .start_xmit() is the single point of entry in the transmit path. So the other locations where skb_push() is done are safe. >> >>> + ret = skb_cow_head(skb, drvr->hdrlen); >>> + if (ret) { >> >> >> So move the realloc code above here instead of simply freeing the skb. >> >>> + dev_kfree_skb_any(skb); >>> + goto done; >>> } >>> + eh = (struct ethhdr *)(skb->data); >> >> >> Now this is actually a separate fix so I would like a separate patch for it. >> > > No problem, but see final paragraph below. Let me see... >> I have a RPi3 sitting on my desk so how can I replicate the issue. It was >> something about broadcast/multicast traffic when using AP mode and a bridge, >> right? >> >> Regards, >> Arend > > See this issue for details on replication. > https://github.com/raspberrypi/firmware/issues/673 > > The bridge I use is setup using a similar procedure to that described > here. https://www.raspberrypi.org/documentation/configuration/wireless/access-point.md > > I'm happy to pass over this work to you guys if you think it is > appropriate, you are the > experts on the codebase. Sure. However, I must say you did an excellent job digging into the issue and root causing it. We always were under the impression that we could treat the skb as our own when handed to us in .start_xmit() callback. Regards, Arend
On 23 April 2017 at 20:34, Arend Van Spriel <arend.vanspriel@broadcom.com> wrote: > On 21-4-2017 11:22, James Hughes wrote: >> On 20 April 2017 at 20:48, Arend van Spriel >> <arend.vanspriel@broadcom.com> wrote: >>> + linux-wireless >>> >>> On 4/20/2017 1:16 PM, James Hughes wrote: >>>> >>>> The driver was adding header information to incoming skb >>>> without ensuring the head was uncloned and hence writable. >>>> >>>> skb_cow_head has been used to ensure they are writable, however, >>>> this required some changes to error handling to ensure that >>>> if skb_cow_head failed it was not ignored. >>>> >>>> This really needs to be reviewed by someone who is more familiar >>>> with this code base to ensure any deallocation of skb's is >>>> still correct. >>>> >>>> Signed-off-by: James Hughes <james.hughes@raspberrypi.org> >>>> --- >>>> .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 15 ++++++++-- >>>> .../wireless/broadcom/brcm80211/brcmfmac/core.c | 23 +++++----------- >>>> .../broadcom/brcm80211/brcmfmac/fwsignal.c | 32 >>>> +++++++++++++++++----- >>>> .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 ++++- >>>> 4 files changed, 51 insertions(+), 26 deletions(-) >>>> >>> >>> [...] >>> >>>> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c >>>> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c >>>> index 5eaac13..08272e8 100644 >>>> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c >>>> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c >>>> @@ -198,7 +198,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct >>>> sk_buff *skb, >>>> int ret; >>>> struct brcmf_if *ifp = netdev_priv(ndev); >>>> struct brcmf_pub *drvr = ifp->drvr; >>>> - struct ethhdr *eh = (struct ethhdr *)(skb->data); >>>> + struct ethhdr *eh; >>>> brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx); >>>> @@ -212,23 +212,14 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct >>>> sk_buff *skb, >>>> } >>>> /* Make sure there's enough room for any header */ >>>> - if (skb_headroom(skb) < drvr->hdrlen) { >>>> - struct sk_buff *skb2; >>>> - >>>> - brcmf_dbg(INFO, "%s: insufficient headroom\n", >>>> - brcmf_ifname(ifp)); >>>> - drvr->bus_if->tx_realloc++; >>>> - skb2 = skb_realloc_headroom(skb, drvr->hdrlen); >>>> - dev_kfree_skb(skb); >>>> - skb = skb2; >>>> - if (skb == NULL) { >>>> - brcmf_err("%s: skb_realloc_headroom failed\n", >>>> - brcmf_ifname(ifp)); >>>> - ret = -ENOMEM; >>>> - goto done; >>>> - } >>> >>> >>> What you are throwing away here is code that assures there is sufficient >>> headroom for protocol and bus layer in the tx path, because that is >>> determined by drvr->hdrlen. This is where the skb is handed to the driver so >>> if you could leave the functionality above *and* assure it is writeable that >>> would be the best solution as there is no need for all the other changes >>> down the tx path. >> >> The skb_cow_head function takes the required headroom as a parameter >> and will ensure that there is enough space, so I don't think this code >> segment is >> required or have I misunderstood what you mean here? > > I looked more into what skb_cow_head() and skb_realloc_headroom() > actually do and it seems you are right. > >> Is it safe to rely on the _cow_ being done here and not further down >> in the stack? >> Or at least checked further down in the stack. Previous comments from >> another patch >> requested that the _cow_ be done close to the actual addition of the >> header. I presume >> it is unlikely/impossible that the functions that add header >> information down the stack >> will be called without the above being done first? > > It is safe. During probe sequence each layer in the driver stack > increments drvr->hdrlen with headroom it needs. So drvr->hdrlen will > indicate the total headroom needed when .start_xmit() is called. And > yes, the .start_xmit() is the single point of entry in the transmit > path. So the other locations where skb_push() is done are safe. > OK, I will redo the patch (making it v3 + changelogs), taking this in to account. >>> >>>> + ret = skb_cow_head(skb, drvr->hdrlen); >>>> + if (ret) { >>> >>> >>> So move the realloc code above here instead of simply freeing the skb. >>> >>>> + dev_kfree_skb_any(skb); >>>> + goto done; >>>> } >>>> + eh = (struct ethhdr *)(skb->data); >>> >>> >>> Now this is actually a separate fix so I would like a separate patch for it. >>> >> >> No problem, but see final paragraph below. > > Let me see... I'll split this fix out, but should I issue it in the same patch set or as a separate patch? And for a different patch, should I base it on the _cow_ version patch or the original version? > >>> I have a RPi3 sitting on my desk so how can I replicate the issue. It was >>> something about broadcast/multicast traffic when using AP mode and a bridge, >>> right? >>> >>> Regards, >>> Arend >> >> See this issue for details on replication. >> https://github.com/raspberrypi/firmware/issues/673 >> >> The bridge I use is setup using a similar procedure to that described >> here. https://www.raspberrypi.org/documentation/configuration/wireless/access-point.md >> >> I'm happy to pass over this work to you guys if you think it is >> appropriate, you are the >> experts on the codebase. > > Sure. However, I must say you did an excellent job digging into the > issue and root causing it. We always were under the impression that we > could treat the skb as our own when handed to us in .start_xmit() callback. > > Regards, > Arend Thanks! I suspect that a few drivers are making the same mistake, Eric found 6 over and above the smsc95xx and this one that I originally found. Regards James
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c index 038a960..b9d7d08 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c @@ -249,14 +249,19 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd, return ret; } -static void +static int brcmf_proto_bcdc_hdrpush(struct brcmf_pub *drvr, int ifidx, u8 offset, struct sk_buff *pktbuf) { struct brcmf_proto_bcdc_header *h; + int err; brcmf_dbg(BCDC, "Enter\n"); + err = skb_cow_head(pktbuf, BCDC_HEADER_LEN); + if (err) + return err; + /* Push BDC header used to convey priority for buses that don't */ skb_push(pktbuf, BCDC_HEADER_LEN); @@ -271,6 +276,8 @@ brcmf_proto_bcdc_hdrpush(struct brcmf_pub *drvr, int ifidx, u8 offset, h->data_offset = offset; BCDC_SET_IF_IDX(h, ifidx); trace_brcmf_bcdchdr(pktbuf->data); + + return 0; } static int @@ -330,7 +337,11 @@ static int brcmf_proto_bcdc_txdata(struct brcmf_pub *drvr, int ifidx, u8 offset, struct sk_buff *pktbuf) { - brcmf_proto_bcdc_hdrpush(drvr, ifidx, offset, pktbuf); + int err = brcmf_proto_bcdc_hdrpush(drvr, ifidx, offset, pktbuf); + + if (err) + return err; + return brcmf_bus_txdata(drvr->bus_if, pktbuf); } diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c index 5eaac13..08272e8 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c @@ -198,7 +198,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, int ret; struct brcmf_if *ifp = netdev_priv(ndev); struct brcmf_pub *drvr = ifp->drvr; - struct ethhdr *eh = (struct ethhdr *)(skb->data); + struct ethhdr *eh; brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx); @@ -212,23 +212,14 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, } /* Make sure there's enough room for any header */ - if (skb_headroom(skb) < drvr->hdrlen) { - struct sk_buff *skb2; - - brcmf_dbg(INFO, "%s: insufficient headroom\n", - brcmf_ifname(ifp)); - drvr->bus_if->tx_realloc++; - skb2 = skb_realloc_headroom(skb, drvr->hdrlen); - dev_kfree_skb(skb); - skb = skb2; - if (skb == NULL) { - brcmf_err("%s: skb_realloc_headroom failed\n", - brcmf_ifname(ifp)); - ret = -ENOMEM; - goto done; - } + ret = skb_cow_head(skb, drvr->hdrlen); + if (ret) { + dev_kfree_skb_any(skb); + goto done; } + eh = (struct ethhdr *)(skb->data); + /* validate length for ether packet */ if (skb->len < sizeof(*eh)) { ret = -EINVAL; diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c index a190f53..2510408 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c @@ -877,12 +877,15 @@ static void brcmf_fws_cleanup(struct brcmf_fws_info *fws, int ifidx) brcmf_fws_hanger_cleanup(fws, matchfn, ifidx); } -static u8 brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb) +static int brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb, + u8 *offset) { struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac; u8 *wlh; u16 data_offset = 0; u8 fillers; + int err; + __le32 pkttag = cpu_to_le32(brcmf_skbcb(skb)->htod); __le16 pktseq = cpu_to_le16(brcmf_skbcb(skb)->htod_seq); @@ -899,6 +902,11 @@ static u8 brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb) fillers = round_up(data_offset, 4) - data_offset; data_offset += fillers; + err = skb_cow_head(skb, data_offset); + + if (err) + return err; + skb_push(skb, data_offset); wlh = skb->data; @@ -926,7 +934,9 @@ static u8 brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb) if (fillers) memset(wlh, BRCMF_FWS_TYPE_FILLER, fillers); - return (u8)(data_offset >> 2); + *offset = (u8)(data_offset >> 2); + + return 0; } static bool brcmf_fws_tim_update(struct brcmf_fws_info *fws, @@ -966,7 +976,8 @@ static bool brcmf_fws_tim_update(struct brcmf_fws_info *fws, skcb->state = BRCMF_FWS_SKBSTATE_TIM; skcb->htod = 0; skcb->htod_seq = 0; - data_offset = brcmf_fws_hdrpush(fws, skb); + if (brcmf_fws_hdrpush(fws, skb, &data_offset)) + return false; ifidx = brcmf_skb_if_flags_get_field(skb, INDEX); brcmf_fws_unlock(fws); err = brcmf_proto_txdata(fws->drvr, ifidx, data_offset, skb); @@ -1945,12 +1956,13 @@ void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb) fws->stats.header_only_pkt++; } -static u8 brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo, - struct sk_buff *p) +static int brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo, + struct sk_buff *p, u8 *offset) { struct brcmf_skbuff_cb *skcb = brcmf_skbcb(p); struct brcmf_fws_mac_descriptor *entry = skcb->mac; u8 flags; + int err; if (skcb->state != BRCMF_FWS_SKBSTATE_SUPPRESSED) brcmf_skb_htod_tag_set_field(p, GENERATION, entry->generation); @@ -1963,7 +1975,10 @@ static u8 brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo, flags |= BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED; } brcmf_skb_htod_tag_set_field(p, FLAGS, flags); - return brcmf_fws_hdrpush(fws, p); + + err = brcmf_fws_hdrpush(fws, p, offset); + + return err; } static void brcmf_fws_rollback_toq(struct brcmf_fws_info *fws, @@ -2039,7 +2054,9 @@ static int brcmf_fws_commit_skb(struct brcmf_fws_info *fws, int fifo, if (IS_ERR(entry)) return PTR_ERR(entry); - data_offset = brcmf_fws_precommit_skb(fws, fifo, skb); + if (!brcmf_fws_precommit_skb(fws, fifo, skb, &data_offset)) + return PTR_ERR(entry); + entry->transit_count++; if (entry->suppressed) entry->suppr_transit_count++; @@ -2100,6 +2117,7 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb) int rc = 0; brcmf_dbg(DATA, "tx proto=0x%X\n", ntohs(eh->h_proto)); + /* determine the priority */ if ((skb->priority == 0) || (skb->priority > 7)) skb->priority = cfg80211_classify8021d(skb, NULL); diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c index d138260..0e53c8a 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c @@ -2719,7 +2719,7 @@ static bool brcmf_sdio_prec_enq(struct pktq *q, struct sk_buff *pkt, int prec) static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt) { - int ret = -EBADE; + int ret = -EBADE, err; uint prec; struct brcmf_bus *bus_if = dev_get_drvdata(dev); struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio; @@ -2729,6 +2729,11 @@ static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt) if (sdiodev->state != BRCMF_SDIOD_DATA) return -EIO; + err = skb_cow_head(pkt, bus->tx_hdrlen); + + if (err) + return err; + /* Add space for the header */ skb_push(pkt, bus->tx_hdrlen); /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
The driver was adding header information to incoming skb without ensuring the head was uncloned and hence writable. skb_cow_head has been used to ensure they are writable, however, this required some changes to error handling to ensure that if skb_cow_head failed it was not ignored. This really needs to be reviewed by someone who is more familiar with this code base to ensure any deallocation of skb's is still correct. Signed-off-by: James Hughes <james.hughes@raspberrypi.org> --- .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 15 ++++++++-- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 23 +++++----------- .../broadcom/brcm80211/brcmfmac/fwsignal.c | 32 +++++++++++++++++----- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 ++++- 4 files changed, 51 insertions(+), 26 deletions(-)