This patch adds validation for IPv4 option lengths during packet processing
to prevent malformed packets from causing undefined behavior. The new
ipv4_check_opt() function verifies that option lengths are within valid
bounds before processing them.
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
This patch fixes the validation order in netdev ioctl handlers for
Bluetooth, IEEE 802.15.4, and packet radio devices. The command type
should be validated before checking the argument pointer to return
the correct error code (-ENOTTY vs -EINVAL).
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
d_len needs to include NET_LL_HDRLEN(dev) to avoid errors in
the verification of message length in ipv4_in/ipv6_in.
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
During the autoconfig process, if the user modifies the link local
address while waiting for the Router Advertisement message, a crash will
occur when sending the ICMPv6 Neighbor Advertisement message because
netdev_ipv6_lladdr returns NULL.
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
The can_datahandler() function calls iob_tryadd_queue() to enqueue
received CAN data. Since iob_tryadd_queue() may return a negative
value on failure, the error was previously not properly handled.
Update can_datahandler() to propagate the return value so callers
can detect and handle queueing failures correctly.
Signed-off-by: zhaohaiyang1 <zhaohaiyang1@xiaomi.com>
netdev:when network device is running status,the network protocol stack is allowed to send packet to the network device and to receive from the network device
Signed-off-by: wangchen <wangchen41@xiaomi.com>
optimize the current code format according to the previous net_xxx_wait
implementation to reduce multiple calls of similar code
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
the following code can be modified
conn_dev_unlock(&conn->sconn, conn->dev);
ret = net_sem_timedwait_uninterruptible(&conn->snd_sem,
tcp_send_gettimeout(start, timeout));
conn_dev_lock(&conn->sconn, conn->dev);
to
ret = conn_dev_sem_timedwait(&conn->snd_sem, false,
tcp_send_gettimeout(start, timeout), &conn->sconn, conn->dev);
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
modify functions that are simple but frequently called into inline
functions, thereby reducing CPU loading without significantly changing
the code size.
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
reduce the execution consumption of irrelevant code
testing the TX rates of TCP and UDP based on the Infineon board can
increase them by 13%.
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
when traversing g_netdevices, it is necessary to ensure that they are
not modified during the traversal.
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
two rmutexes can be passed in, and later the wait scenarios that require
break the conn and netdev locks will be replaced.
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
dup2 and setsockopt can use the lock in conn to protect resources,
the lock in accept is originally used to protect the connection status.
however, only the send, recv, netpoll, and connect processes will
check this flag. only when the interface returns will the corresponding
conn structure be exposed to the caller, and then the above operations
can be performed. Therefore, this net_lock is not necessary.
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
This reverts commit 696a94c8055dc59933457e8ce5c3c91dbecab980
first, when continuous ping from tester to vela, if ignore arp expire when ping response use arp_out to build L2 layer, this cause TC13 testing arp entry expire feature failed. second, the patch of support queue iob when arp_out failed can fix this bug.
Signed-off-by: wenquan1 <wenquan1@xiaomi.com>
arp_out will replace the dev->d_iob to arp request if the iob destination
address is not exist in arp table, this mechanism cause this iob lost
result in first received ping no response or first synack retransmit.
to fix this bug, we queue the iob if arp_out failed, allocate a new
iob to send arp request, after the arp request completed, then we retry
send the queue iob packet.
Signed-off-by: wenquan1 <wenquan1@xiaomi.com>
Improve the behavior of the ARP table so that the manually configured
ARP table has the highest priority, can only be manually modified to
other values, otherwise will never change again, and will not time out.
The modified behavior is consistent with that of Linux.
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
Bug Description:
The original code always used conn->pollinfo[0] (the first element) to store
new poll setup context, regardless of whether that slot was already in use.
This caused multiple poll operations on the same CAN socket to overwrite each
other's context, leading to:
- Lost poll waiters when multiple threads poll the same socket
- Memory corruption in pollfd structures
- Undefined behavior when poll_teardown tries to clean up
Root Cause:
The code directly assigned `info = conn->pollinfo` without checking if the
slot was available, effectively always using pollinfo[0]. When a second
thread called poll() on the same socket, it would overwrite the first
thread's poll context.
Solution:
1. Initialize info to NULL instead of conn->pollinfo
2. Before setting up poll, iterate through all CONFIG_NET_CAN_NPOLLWAITERS
slots to find the first free slot (where fds == NULL)
3. Return -EBUSY if no free slots are available
4. During teardown, properly mark the slot as free by setting fds = NULL
Additional Changes:
- Added CONFIG_NET_CAN_NPOLLWAITERS Kconfig option (default 4) to make the
maximum number of concurrent poll waiters configurable
- Changed hardcoded array size from 4 to CONFIG_NET_CAN_NPOLLWAITERS
- Fixed lock ordering in teardown to ensure fds is cleared before unlock
Impact:
- Enables multiple threads to safely poll the same CAN socket concurrently
- Prevents poll context corruption in multi-threaded applications
- Provides proper resource management with -EBUSY when all slots are full
- Makes the number of supported concurrent pollers configurable per use case
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
This commit removes unnecessary file duplication and memory allocation when
passing file descriptors through Unix domain sockets, leveraging the new
filep reference counting framework.
Background:
With the new filep framework, file structures (filep) can be safely shared
across processes using reference counting. When passing file descriptors
through SCM_RIGHTS control messages on local sockets, the previous
implementation unnecessarily duplicated the entire file structure.
Changes:
1. In local_sendctl() (sender side):
- Removed allocation of filep2 structure (kmm_zalloc)
- Removed file_dup2() call that copied the file structure
- Now directly stores the original filep with its reference count
- Eliminates memory allocation overhead and potential failure points
2. In local_recvctl() (receiver side):
- Changed from file_close() + kmm_free() to file_put()
- file_put() properly decrements reference count and handles cleanup
- Consistent with the new filep reference counting model
3. In local_freectl() (cleanup on error):
- Changed from file_close() + kmm_free() to file_put()
- Ensures proper reference count management during error paths
Technical Details:
The new filep framework ensures that:
- Multiple file descriptors across different processes can reference the
same underlying filep structure safely
- Reference counting (via file_get/file_put) manages lifetime correctly
- The underlying file object is only released when all references are gone
This change is safe because file_dup() in the receiver already calls
file_get() internally to increment the reference count for the new fd,
so the filep remains valid after the sender calls file_put().
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
According rfc793 p69, from state SYN-RECEIVED to state TIME-WAIT, if the incoming segment is not acceptable, an acknowledgment should be sent in reply (unless the RST bit is set):
<SEQ=SND.NXT><ACK=RCV.NXT><CTL=ACK>
Signed-off-by: wenquan1 <wenquan1@xiaomi.com>
According rfc793 p69, In SYN-RCVD state, if the incoming segment is not acceptable, an acknowledgment should be sent in reply (unless the RST bit is set):
<SEQ=SND.NXT><ACK=RCV.NXT><CTL=ACK>
Signed-off-by: wenquan1 <wenquan1@xiaomi.com>
According to RFC793, the flags of TCP reply packet should be as follows:
1. `RST` if flags of request packet has `ACK`
2. `RST|ACK` if flags of request packet has no `ACK`, at the same time, the sequence should be set to zero.
Signed-off-by: wenquan1 <wenquan1@xiaomi.com>
