[RESEND][PATCH] Fix MACsec kernel panics, oopses and bugs

misbehaviour I could find. As I am no kernel developer somebody with sufficient kernel network knowledge should verify and correct the patch where necessary. Signed-off-by: Andreas Steinmetz --- linux.orig/drivers/net/macsec.c 2019-05-17 11:00:13.631121950 +0200 +++ linux/drivers/net/macsec.c

bpf program loader doesn't honor CAP_NET_ADMIN

Quite simple "program": start as root configure rlimit_memlock drop root but keep CAP_NET_ADMIN and CAP_NET_RAW create network interface configure network interface create CLSACT qdisc for interface reconfigure eBPF program for interface call bpf(BPF_PROGLOAD, ...) with program type BPF_PROG_TYPE_

Re: [RESEND][PATCH] Fix MACsec kernel panics, oopses and bugs

Patch will be worked over and split. I'll need to investigate one more problem. Split patch will be resent when ready. On Thu, 2019-05-23 at 09:11 -0700, David Miller wrote: > From: Andreas Steinmetz > Date: Thu, 23 May 2019 09:46:15 +0200 > > > MACsec causes oopses follow

[RFC][PATCH kernel_bpf] honor CAP_NET_ADMIN for BPF_PROG_LOAD

does prevent the BPF program from doing harmful things anyway. Signed-off-by: Andreas Steinmetz --- a/kernel/bpf/syscall.c 2019-05-28 18:00:40.472841432 +0200 +++ b/kernel/bpf/syscall.c 2019-05-28 18:17:50.162811510 +0200 @@ -1561,8 +1561,13 @@ static int bpf_prog_load(union bpf_attr

Re: [RFC][PATCH kernel_bpf] honor CAP_NET_ADMIN for BPF_PROG_LOAD

== BPF_PROG_TYPE_XDP) && capable(CAP_NET_ADMIN))) return -EPERM; This is not really readable and I do prefer an easy to verify code when it comes to security, so how about the following version: Signed-off-by: Andreas Steinmetz --- a/kernel/bpf/syscall.c 201

Re: [RFC][PATCH kernel_bpf] honor CAP_NET_ADMIN for BPF_PROG_LOAD

On Mon, 2019-06-03 at 19:12 +0200, Nicolas Dichtel wrote: > It makes sense to me. > Do you plan to submit it formally? > > Looking a bit more at this topic, I see that most part of the bpf > code uses > capable(CAP_NET_ADMIN). I don't see why we cannot use > ns_capable(CAP_NET_ADMIN). If there is

[PATCH net 0/2] macsec: fix some bugs in the receive path

This series fixes some bugs in the receive path of macsec. The first is a use after free when processing macsec frames with a SecTAG that has the TCI E bit set but the C bit clear. In the 2nd bug, the driver leaves an invalid checksumming state after decrypting the packet. This is a combined effor

[PATCH net-next 1/3] macsec: remove superfluous function calls

Remove superfluous skb_share_check() and skb_unshare(). macsec_decrypt is only called by macsec_handle_frame which already does a skb_unshare(). Signed-off-by: Andreas Steinmetz --- a/drivers/net/macsec.c 2019-06-30 22:02:54.906908179 +0200 +++ b/drivers/net/macsec.c 2019-06-30 22:03

[PATCH net-next 3/3] macsec: add brackets and indentation after calling macsec_decrypt

At this point, skb could only be a valid pointer, so this patch does not introduce any functional change. Signed-off-by: Andreas Steinmetz --- a/drivers/net/macsec.c 2019-06-30 22:05:17.785683634 +0200 +++ b/drivers/net/macsec.c 2019-06-30 22:05:20.526171178 +0200 @@ -1205,21 +1205,22

[PATCH net-next 2/3] macsec: remove superfluous zeroing of skb reference

Remove superfluous zeroing of skb pointer for the RX_HANDLER_CONSUMED case, since in that case, __netif_receive_skb_core will simply ignore the value. Signed-off-by: Andreas Steinmetz --- a/drivers/net/macsec.c 2019-06-30 22:04:10.003613880 +0200 +++ b/drivers/net/macsec.c 2019-06-30

[PATCH net 2/2] macsec: fix checksumming after decryption

Fix checksumming after decryption. Signed-off-by: Andreas Steinmetz --- a/drivers/net/macsec.c 2019-06-30 22:14:10.250285314 +0200 +++ b/drivers/net/macsec.c 2019-06-30 22:15:11.931230417 +0200 @@ -869,6 +869,7 @@ static void macsec_finalize_skb(struct sk_buff *skb, u8 icv_len, u8

[PATCH net 1/2] macsec: fix use-after-free of skb during RX

Fix use-after-free of skb when rx_handler returns RX_HANDLER_PASS. Signed-off-by: Andreas Steinmetz --- a/drivers/net/macsec.c 2019-06-05 20:23:27.640154747 +0200 +++ b/drivers/net/macsec.c 2019-06-05 20:23:46.791565816 +0200 @@ -1103,10 +1103,9 @@ static rx_handler_result_t

[PATCH net-next 0/3] macsec: a few cleanups in the receive path

This patchset removes some unnecessary code in the receive path of the macsec driver, and re-indents the error handling after calling macsec_decrypt to make the post-processing clearer. This is a combined effort of Sabrina Dubroca and me.

Re: [PATCH net 2/2] macsec: fix checksumming after decryption

On Sun, 2019-06-30 at 21:47 -0400, Willem de Bruijn wrote: > On Sun, Jun 30, 2019 at 4:48 PM Andreas Steinmetz > wrote: > > Fix checksumming after decryption. > > > > Signed-off-by: Andreas Steinmetz > > > > --- a/drivers/net/macsec.c 2019-06-30 22:14:

Re: [PATCH net-next 3/3] macsec: add brackets and indentation after calling macsec_decrypt

g this, Willem. That patch should only move the > IS_ERR(skb) case under the block where macsec_decrypt() is called, but > not move the call to macsec_post_decrypt(). Updated patch below. Signed-off-by: Andreas Steinmetz --- a/drivers/net/macsec.c 2019-07-02 06:31:27.550120145 +0200

Re: [PATCH net 2/2] macsec: fix checksumming after decryption

On Tue, 2019-07-02 at 10:35 -0400, Willem de Bruijn wrote: > On Tue, Jul 2, 2019 at 12:25 AM Andreas Steinmetz wrote: > > On Sun, 2019-06-30 at 21:47 -0400, Willem de Bruijn wrote: > > > On Sun, Jun 30, 2019 at 4:48 PM Andreas Steinmetz > > > wrote: > > >

[PATCH net-next 0/3 v2] macsec: a few cleanups in the receive path

This patchset removes some unnecessary code in the receive path of the macsec driver, and re-indents the error handling after calling macsec_decrypt to make the post-processing clearer. This is a combined effort of Sabrina Dubroca and me. Change in 3/3: The patch now only moves the IS_ERR(skb)

[PATCH net-next 2/3 v2] macsec: remove superfluous zeroing of skb reference

Remove superfluous zeroing of skb pointer for the RX_HANDLER_CONSUMED case, since in that case, __netif_receive_skb_core will simply ignore the value. Signed-off-by: Andreas Steinmetz --- a/drivers/net/macsec.c 2019-06-30 22:04:10.003613880 +0200 +++ b/drivers/net/macsec.c 2019-06-30

[PATCH net-next 3/3 v2] macsec: add brackets and indentation after calling macsec_decrypt

At this point, skb could only be a valid pointer, so this patch does not introduce any functional change. Change: The patch now only moves the IS_ERR(skb) case under the block where macsec_decrypt() is called, but not the call to macsec_post_decrypt(). Signed-off-by: Andreas Steinmetz --- a

[PATCH net-next 1/3 v2] macsec: remove superfluous function calls

Remove superfluous skb_share_check() and skb_unshare(). macsec_decrypt is only called by macsec_handle_frame which already does a skb_unshare(). Signed-off-by: Andreas Steinmetz --- a/drivers/net/macsec.c 2019-06-30 22:02:54.906908179 +0200 +++ b/drivers/net/macsec.c 2019-06-30 22:03

[PATCH] Fix MACsec kernel panics, oopses and bugs

misbehaviour I could find. As I am no kernel developer somebody with sufficient kernel network knowledge should verify and correct the patch where necessary. Signed-off-by: Andreas Steinmetz --- linux.orig/drivers/net/macsec.c 2019-05-17 11:00:13.631121950 +0200 +++ linux/drivers/net/macsec.c

[2.6.20] net/ieee80211/ieee80211_crypt_tkip.c spams kernel message buffer

2e:94:84:c3 previous TSC 0200 received TSC 0002e626 -- Andreas Steinmetz SPAMmers use [EMAIL PROTECTED] - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://