1. 22 Mar, 2018 3 commits
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: do not hold reference on netdevice from preparation phase · 90d2723c
      Pablo Neira Ayuso authored
      The netfilter netdevice event handler hold the nfnl_lock mutex, this
      avoids races with a device going away while such device is being
      attached to hooks from the netlink control plane. Therefore, either
      control plane bails out with ENOENT or netdevice event path waits until
      the hook that is attached to net_device is registered.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      90d2723c
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: cache device name in flowtable object · d92191aa
      Pablo Neira Ayuso authored
      Devices going away have to grab the nfnl_lock from the netdev event path
      to avoid races with control plane updates.
      
      However, netlink dumps in netfilter do not hold nfnl_lock mutex. Cache
      the device name into the objects to avoid an use-after-free situation
      for a device that is going away.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      d92191aa
    • Paolo Abeni's avatar
      netfilter: drop template ct when conntrack is skipped. · aebfa52a
      Paolo Abeni authored
      The ipv4 nf_ct code currently skips the nf_conntrak_in() call
      for fragmented packets. As a results later matches/target can end
      up manipulating template ct entry instead of 'real' ones.
      
      Exploiting the above, syzbot found a way to trigger the following
      splat:
      
      WARNING: CPU: 1 PID: 4242 at net/netfilter/xt_cluster.c:55
      xt_cluster_mt+0x6c1/0x840 net/netfilter/xt_cluster.c:127
      Kernel panic - not syncing: panic_on_warn set ...
      
      CPU: 1 PID: 4242 Comm: syzkaller027971 Not tainted 4.16.0-rc2+ #243
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
      Google 01/01/2011
      Call Trace:
        __dump_stack lib/dump_stack.c:17 [inline]
        dump_stack+0x194/0x24d lib/dump_stack.c:53
        panic+0x1e4/0x41c kernel/panic.c:183
        __warn+0x1dc/0x200 kernel/panic.c:547
        report_bug+0x211/0x2d0 lib/bug.c:184
        fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
        fixup_bug arch/x86/kernel/traps.c:247 [inline]
        do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
        do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
        invalid_op+0x58/0x80 arch/x86/entry/entry_64.S:957
      RIP: 0010:xt_cluster_hash net/netfilter/xt_cluster.c:55 [inline]
      RIP: 0010:xt_cluster_mt+0x6c1/0x840 net/netfilter/xt_cluster.c:127
      RSP: 0018:ffff8801d2f6f2d0 EFLAGS: 00010293
      RAX: ffff8801af700540 RBX: 0000000000000000 RCX: ffffffff84a2d1e1
      RDX: 0000000000000000 RSI: ffff8801d2f6f478 RDI: ffff8801cafd336a
      RBP: ffff8801d2f6f2e8 R08: 0000000000000000 R09: 0000000000000001
      R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801b03b3d18
      R13: ffff8801cafd3300 R14: dffffc0000000000 R15: ffff8801d2f6f478
        ipt_do_table+0xa91/0x19b0 net/ipv4/netfilter/ip_tables.c:296
        iptable_filter_hook+0x65/0x80 net/ipv4/netfilter/iptable_filter.c:41
        nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]
        nf_hook_slow+0xba/0x1a0 net/netfilter/core.c:483
        nf_hook include/linux/netfilter.h:243 [inline]
        NF_HOOK include/linux/netfilter.h:286 [inline]
        raw_send_hdrinc.isra.17+0xf39/0x1880 net/ipv4/raw.c:432
        raw_sendmsg+0x14cd/0x26b0 net/ipv4/raw.c:669
        inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:763
        sock_sendmsg_nosec net/socket.c:629 [inline]
        sock_sendmsg+0xca/0x110 net/socket.c:639
        SYSC_sendto+0x361/0x5c0 net/socket.c:1748
        SyS_sendto+0x40/0x50 net/socket.c:1716
        do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287
        entry_SYSCALL_64_after_hwframe+0x42/0xb7
      RIP: 0033:0x441b49
      RSP: 002b:00007ffff5ca8b18 EFLAGS: 00000216 ORIG_RAX: 000000000000002c
      RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000441b49
      RDX: 0000000000000030 RSI: 0000000020ff7000 RDI: 0000000000000003
      RBP: 00000000006cc018 R08: 000000002066354c R09: 0000000000000010
      R10: 0000000000000000 R11: 0000000000000216 R12: 0000000000403470
      R13: 0000000000403500 R14: 0000000000000000 R15: 0000000000000000
      Dumping ftrace buffer:
          (ftrace buffer empty)
      Kernel Offset: disabled
      Rebooting in 86400 seconds..
      
      Instead of adding checks for template ct on every target/match
      manipulating skb->_nfct, simply drop the template ct when skipping
      nf_conntrack_in().
      
      Fixes: 7b4fdf77 ("netfilter: don't track fragmented packets")
      Reported-and-tested-by: syzbot+0346441ae0545cfcea3a@syzkaller.appspotmail.com
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Acked-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      aebfa52a
  2. 20 Mar, 2018 6 commits
    • Florian Westphal's avatar
      netfilter: nf_tables: add missing netlink attrs to policies · 467697d2
      Florian Westphal authored
      Fixes: 8aeff920 ("netfilter: nf_tables: add stateful object reference to set elements")
      Fixes: f25ad2e9 ("netfilter: nf_tables: prepare for expressions associated to set elements")
      Fixes: 1a94e38d ("netfilter: nf_tables: add NFTA_RULE_ID attribute")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      467697d2
    • Florian Westphal's avatar
      netfilter: nf_tables: permit second nat hook if colliding hook is going away · ae6153b5
      Florian Westphal authored
      Sergei Trofimovich reported that restoring an nft ruleset doesn't work
      anymore unless old rule content is flushed first.
      
      The problem stems from a recent change designed to prevent multiple nat
      hooks at the same hook point locations and nftables transaction model.
      
      A 'flush ruleset' won't take effect until the entire transaction has
      completed.
      
      So, if one has a nft.rules file that contains a 'flush ruleset',
      followed by a nat hook register request, then 'nft -f file' will work,
      but running 'nft -f file' again will fail with -EBUSY.
      
      Reason is that nftables will place the flush/removal requests in the
      transaction list, but it will not act on the removal until after all new
      rules are in place.
      
      The netfilter core will therefore get request to register a new nat
      hook before the old one is removed -- this now fails as the netfilter
      core can't know the existing hook is staged for removal.
      
      To fix this, we can search the transaction log when a hook collision
      is detected.  The collision is okay if
      
       1. there is a delete request pending for the nat hook that is already
          registered.
       2. there is no second add request for a matching nat hook.
          This is required to only apply the exception once.
      
      Fixes: f92b40a8 ("netfilter: core: only allow one nat hook per hook point")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      ae6153b5
    • Florian Westphal's avatar
      netfilter: nf_tables: meter: pick a set backend that supports updates · 4f2921ca
      Florian Westphal authored
      in nftables, 'meter' can be used to instantiate a hash-table at run
      time:
      
      rule add filter forward iif "internal" meter hostacct { ip saddr counter}
      nft list meter ip filter hostacct
      table ip filter {
        meter hostacct {
          type ipv4_addr
          elements = { 192.168.0.1 : counter packets 8 bytes 2672, ..
      
      because elemets get added on the fly, the kernel must chose a set
      backend type that implements the ->update() function, otherwise
      rule insertion fails with EOPNOTSUPP.
      
      Therefore, skip set types that lack ->update, and also
      make sure we do not discard a (bad) candidate when we did yet
      find any candidate at all.  This could happen when userspace prefers
      low memory footprint -- the set implementation currently checked might
      not be a fit at all.  Make sure we pick it anyway (!bops).  In
      case next candidate is a better fix, it will be chosen instead.
      
      But in case nothing else is found we at least have a non-ideal
      match rather than no match at all.
      
      Fixes: 6c03ae21 ("netfilter: nft_set_hash: add non-resizable hashtable implementation")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      4f2921ca
    • David S. Miller's avatar
      Merge branch 'phy-relax-error-checking' · 36fe0956
      David S. Miller authored
      Grygorii Strashko says:
      
      ====================
      net: phy: relax error checking when creating sysfs link netdev->phydev
      
      Some ethernet drivers (like TI CPSW) may connect and manage >1 Net PHYs per
      one netdevice, as result such drivers will produce warning during system
      boot and fail to connect second phy to netdevice when PHYLIB framework
      will try to create sysfs link netdev->phydev for second PHY
      in phy_attach_direct(), because sysfs link with the same name has been
      created already for the first PHY.
      As result, second CPSW external port will became unusable.
      This regression was introduced by commits:
      5568363f ("net: phy: Create sysfs reciprocal links for attached_dev/phydev"
      a3995460 ("net: phy: Relax error checking on sysfs_create_link()"
      
      Patch 1: exports sysfs_create_link_nowarn() function as preparation for Patch 2.
      Patch 2: relaxes error checking when PHYLIB framework is creating sysfs
      link netdev->phydev in phy_attach_direct(), suppresses warning by using
      sysfs_create_link_nowarn() and adds error message instead, so links creation
      failure is not fatal any more and system can continue working,
      which fixes TI CPSW issue and makes boot logs accessible
      in case of NFS boot, for example.
      
      This can be stable material 4.13+.
      
      Changes in v2:
      - commit messages updated.
      
      v1:
       https://patchwork.ozlabs.org/cover/886058/
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      36fe0956
    • Grygorii Strashko's avatar
      net: phy: relax error checking when creating sysfs link netdev->phydev · 4414b3ed
      Grygorii Strashko authored
      Some ethernet drivers (like TI CPSW) may connect and manage >1 Net PHYs per
      one netdevice, as result such drivers will produce warning during system
      boot and fail to connect second phy to netdevice when PHYLIB framework
      will try to create sysfs link netdev->phydev for second PHY
      in phy_attach_direct(), because sysfs link with the same name has been
      created already for the first PHY. As result, second CPSW external
      port will became unusable.
      
      Fix it by relaxing error checking when PHYLIB framework is creating sysfs
      link netdev->phydev in phy_attach_direct(), suppressing warning by using
      sysfs_create_link_nowarn() and adding error message instead.
      After this change links (phy->netdev and netdev->phy) creation failure is not
      fatal any more and system can continue working, which fixes TI CPSW issue.
      
      Cc: Florian Fainelli <f.fainelli@gmail.com>
      Cc: Andrew Lunn <andrew@lunn.ch>
      Fixes: a3995460 ("net: phy: Relax error checking on sysfs_create_link()")
      Signed-off-by: default avatarGrygorii Strashko <grygorii.strashko@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4414b3ed
    • Grygorii Strashko's avatar
      sysfs: symlink: export sysfs_create_link_nowarn() · 2399ac42
      Grygorii Strashko authored
      The sysfs_create_link_nowarn() is going to be used in phylib framework in
      subsequent patch which can be built as module. Hence, export
      sysfs_create_link_nowarn() to avoid build errors.
      
      Cc: Florian Fainelli <f.fainelli@gmail.com>
      Cc: Andrew Lunn <andrew@lunn.ch>
      Fixes: a3995460 ("net: phy: Relax error checking on sysfs_create_link()")
      Signed-off-by: default avatarGrygorii Strashko <grygorii.strashko@ti.com>
      Acked-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2399ac42
  3. 18 Mar, 2018 3 commits
  4. 17 Mar, 2018 10 commits
    • David S. Miller's avatar
      Merge branch 'tcf_foo_init-NULL-deref' · 78f1b04f
      David S. Miller authored
      Davide Caratti says:
      
      ====================
      net/sched: fix NULL dereference in the error path of .init()
      
      with several TC actions it's possible to see NULL pointer dereference,
      when the .init() function calls tcf_idr_alloc(), fails at some point and
      then calls tcf_idr_release(): this series fixes all them introducing
      non-NULL tests in the .cleanup() function.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      78f1b04f
    • Davide Caratti's avatar
      net/sched: fix NULL dereference on the error path of tcf_skbmod_init() · 2d433610
      Davide Caratti authored
      when the following command
      
       # tc action replace action skbmod swap mac index 100
      
      is run for the first time, and tcf_skbmod_init() fails to allocate struct
      tcf_skbmod_params, tcf_skbmod_cleanup() calls kfree_rcu(NULL), thus
      causing the following error:
      
       BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
       IP: __call_rcu+0x23/0x2b0
       PGD 8000000034057067 P4D 8000000034057067 PUD 74937067 PMD 0
       Oops: 0002 [#1] SMP PTI
       Modules linked in: act_skbmod(E) psample ip6table_filter ip6_tables iptable_filter binfmt_misc ext4 snd_hda_codec_generic snd_hda_intel snd_hda_codec crct10dif_pclmul mbcache jbd2 crc32_pclmul snd_hda_core ghash_clmulni_intel snd_hwdep pcbc snd_seq snd_seq_device snd_pcm aesni_intel snd_timer crypto_simd glue_helper snd cryptd virtio_balloon joydev soundcore pcspkr i2c_piix4 nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c ata_generic pata_acpi qxl drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm virtio_console virtio_net virtio_blk ata_piix libata crc32c_intel virtio_pci serio_raw virtio_ring virtio i2c_core floppy dm_mirror dm_region_hash dm_log dm_mod [last unloaded: act_skbmod]
       CPU: 3 PID: 3144 Comm: tc Tainted: G            E    4.16.0-rc4.act_vlan.orig+ #403
       Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
       RIP: 0010:__call_rcu+0x23/0x2b0
       RSP: 0018:ffffbd2e403e7798 EFLAGS: 00010246
       RAX: ffffffffc0872080 RBX: ffff981d34bff780 RCX: 00000000ffffffff
       RDX: ffffffff922a5f00 RSI: 0000000000000000 RDI: 0000000000000000
       RBP: 0000000000000000 R08: 0000000000000001 R09: 000000000000021f
       R10: 000000003d003000 R11: 0000000000aaaaaa R12: 0000000000000000
       R13: ffffffff922a5f00 R14: 0000000000000001 R15: ffff981d3b698c2c
       FS:  00007f3678292740(0000) GS:ffff981d3fd80000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 0000000000000008 CR3: 000000007c57a006 CR4: 00000000001606e0
       Call Trace:
        __tcf_idr_release+0x79/0xf0
        tcf_skbmod_init+0x1d1/0x210 [act_skbmod]
        tcf_action_init_1+0x2cc/0x430
        tcf_action_init+0xd3/0x1b0
        tc_ctl_action+0x18b/0x240
        rtnetlink_rcv_msg+0x29c/0x310
        ? _cond_resched+0x15/0x30
        ? __kmalloc_node_track_caller+0x1b9/0x270
        ? rtnl_calcit.isra.28+0x100/0x100
        netlink_rcv_skb+0xd2/0x110
        netlink_unicast+0x17c/0x230
        netlink_sendmsg+0x2cd/0x3c0
        sock_sendmsg+0x30/0x40
        ___sys_sendmsg+0x27a/0x290
        ? filemap_map_pages+0x34a/0x3a0
        ? __handle_mm_fault+0xbfd/0xe20
        __sys_sendmsg+0x51/0x90
        do_syscall_64+0x6e/0x1a0
        entry_SYSCALL_64_after_hwframe+0x3d/0xa2
       RIP: 0033:0x7f36776a3ba0
       RSP: 002b:00007fff4703b618 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
       RAX: ffffffffffffffda RBX: 00007fff4703b740 RCX: 00007f36776a3ba0
       RDX: 0000000000000000 RSI: 00007fff4703b690 RDI: 0000000000000003
       RBP: 000000005aaaba36 R08: 0000000000000002 R09: 0000000000000000
       R10: 00007fff4703b0a0 R11: 0000000000000246 R12: 0000000000000000
       R13: 00007fff4703b754 R14: 0000000000000001 R15: 0000000000669f60
       Code: 5d e9 42 da ff ff 66 90 0f 1f 44 00 00 41 57 41 56 41 55 49 89 d5 41 54 55 48 89 fd 53 48 83 ec 08 40 f6 c7 07 0f 85 19 02 00 00 <48> 89 75 08 48 c7 45 00 00 00 00 00 9c 58 0f 1f 44 00 00 49 89
       RIP: __call_rcu+0x23/0x2b0 RSP: ffffbd2e403e7798
       CR2: 0000000000000008
      
      Fix it in tcf_skbmod_cleanup(), ensuring that kfree_rcu(p, ...) is called
      only when p is not NULL.
      
      Fixes: 86da71b5 ("net_sched: Introduce skbmod action")
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2d433610
    • Davide Caratti's avatar
      net/sched: fix NULL dereference in the error path of tcf_sample_init() · 1f110e7c
      Davide Caratti authored
      when the following command
      
       # tc action add action sample rate 100 group 100 index 100
      
      is run for the first time, and psample_group_get(100) fails to create a
      new group, tcf_sample_cleanup() calls psample_group_put(NULL), thus
      causing the following error:
      
       BUG: unable to handle kernel NULL pointer dereference at 000000000000001c
       IP: psample_group_put+0x15/0x71 [psample]
       PGD 8000000075775067 P4D 8000000075775067 PUD 7453c067 PMD 0
       Oops: 0002 [#1] SMP PTI
       Modules linked in: act_sample(E) psample ip6table_filter ip6_tables iptable_filter binfmt_misc ext4 snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core mbcache jbd2 crct10dif_pclmul snd_hwdep crc32_pclmul snd_seq ghash_clmulni_intel pcbc snd_seq_device snd_pcm aesni_intel crypto_simd snd_timer glue_helper snd cryptd joydev pcspkr i2c_piix4 soundcore virtio_balloon nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c ata_generic pata_acpi qxl drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm virtio_net ata_piix virtio_console virtio_blk libata serio_raw crc32c_intel virtio_pci i2c_core virtio_ring virtio floppy dm_mirror dm_region_hash dm_log dm_mod [last unloaded: act_tunnel_key]
       CPU: 2 PID: 5740 Comm: tc Tainted: G            E    4.16.0-rc4.act_vlan.orig+ #403
       Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
       RIP: 0010:psample_group_put+0x15/0x71 [psample]
       RSP: 0018:ffffb8a80032f7d0 EFLAGS: 00010246
       RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000024
       RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffffc06d93c0
       RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000044
       R10: 00000000bd003000 R11: ffff979fba04aa59 R12: 0000000000000000
       R13: 0000000000000000 R14: 0000000000000000 R15: ffff979fbba3f22c
       FS:  00007f7638112740(0000) GS:ffff979fbfd00000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 000000000000001c CR3: 00000000734ea001 CR4: 00000000001606e0
       Call Trace:
        __tcf_idr_release+0x79/0xf0
        tcf_sample_init+0x125/0x1d0 [act_sample]
        tcf_action_init_1+0x2cc/0x430
        tcf_action_init+0xd3/0x1b0
        tc_ctl_action+0x18b/0x240
        rtnetlink_rcv_msg+0x29c/0x310
        ? _cond_resched+0x15/0x30
        ? __kmalloc_node_track_caller+0x1b9/0x270
        ? rtnl_calcit.isra.28+0x100/0x100
        netlink_rcv_skb+0xd2/0x110
        netlink_unicast+0x17c/0x230
        netlink_sendmsg+0x2cd/0x3c0
        sock_sendmsg+0x30/0x40
        ___sys_sendmsg+0x27a/0x290
        ? filemap_map_pages+0x34a/0x3a0
        ? __handle_mm_fault+0xbfd/0xe20
        __sys_sendmsg+0x51/0x90
        do_syscall_64+0x6e/0x1a0
        entry_SYSCALL_64_after_hwframe+0x3d/0xa2
       RIP: 0033:0x7f7637523ba0
       RSP: 002b:00007fff0473ef58 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
       RAX: ffffffffffffffda RBX: 00007fff0473f080 RCX: 00007f7637523ba0
       RDX: 0000000000000000 RSI: 00007fff0473efd0 RDI: 0000000000000003
       RBP: 000000005aaaac80 R08: 0000000000000002 R09: 0000000000000000
       R10: 00007fff0473e9e0 R11: 0000000000000246 R12: 0000000000000000
       R13: 00007fff0473f094 R14: 0000000000000001 R15: 0000000000669f60
       Code: be 02 00 00 00 48 89 df e8 a9 fe ff ff e9 7c ff ff ff 0f 1f 40 00 0f 1f 44 00 00 53 48 89 fb 48 c7 c7 c0 93 6d c0 e8 db 20 8c ef <83> 6b 1c 01 74 10 48 c7 c7 c0 93 6d c0 ff 14 25 e8 83 83 b0 5b
       RIP: psample_group_put+0x15/0x71 [psample] RSP: ffffb8a80032f7d0
       CR2: 000000000000001c
      
      Fix it in tcf_sample_cleanup(), ensuring that calls to psample_group_put(p)
      are done only when p is not NULL.
      
      Fixes: cadb9c9f ("net/sched: act_sample: Fix error path in init")
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1f110e7c
    • Davide Caratti's avatar
      net/sched: fix NULL dereference in the error path of tunnel_key_init() · abdadd3c
      Davide Caratti authored
      when the following command
      
       # tc action add action tunnel_key unset index 100
      
      is run for the first time, and tunnel_key_init() fails to allocate struct
      tcf_tunnel_key_params, tunnel_key_release() dereferences NULL pointers.
      This causes the following error:
      
       BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
       IP: tunnel_key_release+0xd/0x40 [act_tunnel_key]
       PGD 8000000033787067 P4D 8000000033787067 PUD 74646067 PMD 0
       Oops: 0000 [#1] SMP PTI
       Modules linked in: act_tunnel_key(E) act_csum ip6table_filter ip6_tables iptable_filter binfmt_misc ext4 mbcache jbd2 crct10dif_pclmul crc32_pclmul snd_hda_codec_generic ghash_clmulni_intel snd_hda_intel pcbc snd_hda_codec snd_hda_core snd_hwdep snd_seq aesni_intel snd_seq_device crypto_simd glue_helper snd_pcm cryptd joydev snd_timer pcspkr virtio_balloon snd i2c_piix4 soundcore nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c ata_generic pata_acpi qxl drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm virtio_net virtio_blk drm virtio_console crc32c_intel ata_piix serio_raw i2c_core virtio_pci libata virtio_ring virtio floppy dm_mirror dm_region_hash dm_log dm_mod
       CPU: 2 PID: 3101 Comm: tc Tainted: G            E    4.16.0-rc4.act_vlan.orig+ #403
       Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
       RIP: 0010:tunnel_key_release+0xd/0x40 [act_tunnel_key]
       RSP: 0018:ffffba46803b7768 EFLAGS: 00010286
       RAX: ffffffffc09010a0 RBX: 0000000000000000 RCX: 0000000000000024
       RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff99ee336d7480
       RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000044
       R10: 0000000000000220 R11: ffff99ee79d73131 R12: 0000000000000000
       R13: ffff99ee32d67610 R14: ffff99ee7671dc38 R15: 00000000fffffff4
       FS:  00007febcb2cd740(0000) GS:ffff99ee7fd00000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 0000000000000010 CR3: 000000007c8e4005 CR4: 00000000001606e0
       Call Trace:
        __tcf_idr_release+0x79/0xf0
        tunnel_key_init+0xd9/0x460 [act_tunnel_key]
        tcf_action_init_1+0x2cc/0x430
        tcf_action_init+0xd3/0x1b0
        tc_ctl_action+0x18b/0x240
        rtnetlink_rcv_msg+0x29c/0x310
        ? _cond_resched+0x15/0x30
        ? __kmalloc_node_track_caller+0x1b9/0x270
        ? rtnl_calcit.isra.28+0x100/0x100
        netlink_rcv_skb+0xd2/0x110
        netlink_unicast+0x17c/0x230
        netlink_sendmsg+0x2cd/0x3c0
        sock_sendmsg+0x30/0x40
        ___sys_sendmsg+0x27a/0x290
        __sys_sendmsg+0x51/0x90
        do_syscall_64+0x6e/0x1a0
        entry_SYSCALL_64_after_hwframe+0x3d/0xa2
       RIP: 0033:0x7febca6deba0
       RSP: 002b:00007ffe7b0dd128 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
       RAX: ffffffffffffffda RBX: 00007ffe7b0dd250 RCX: 00007febca6deba0
       RDX: 0000000000000000 RSI: 00007ffe7b0dd1a0 RDI: 0000000000000003
       RBP: 000000005aaa90cb R08: 0000000000000002 R09: 0000000000000000
       R10: 00007ffe7b0dcba0 R11: 0000000000000246 R12: 0000000000000000
       R13: 00007ffe7b0dd264 R14: 0000000000000001 R15: 0000000000669f60
       Code: 44 00 00 8b 0d b5 23 00 00 48 8b 87 48 10 00 00 48 8b 3c c8 e9 a5 e5 d8 c3 0f 1f 44 00 00 0f 1f 44 00 00 53 48 8b 9f b0 00 00 00 <83> 7b 10 01 74 0b 48 89 df 31 f6 5b e9 f2 fa 7f c3 48 8b 7b 18
       RIP: tunnel_key_release+0xd/0x40 [act_tunnel_key] RSP: ffffba46803b7768
       CR2: 0000000000000010
      
      Fix this in tunnel_key_release(), ensuring 'param' is not NULL before
      dereferencing it.
      
      Fixes: d0f6dd8a ("net/sched: Introduce act_tunnel_key")
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      abdadd3c
    • Davide Caratti's avatar
      net/sched: fix NULL dereference in the error path of tcf_csum_init() · aab378a7
      Davide Caratti authored
      when the following command
      
       # tc action add action csum udp continue index 100
      
      is run for the first time, and tcf_csum_init() fails allocating struct
      tcf_csum, tcf_csum_cleanup() calls kfree_rcu(NULL,...). This causes the
      following error:
      
       BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
       IP: __call_rcu+0x23/0x2b0
       PGD 80000000740b4067 P4D 80000000740b4067 PUD 32e7f067 PMD 0
       Oops: 0002 [#1] SMP PTI
       Modules linked in: act_csum(E) act_vlan ip6table_filter ip6_tables iptable_filter binfmt_misc ext4 mbcache jbd2 crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_codec_generic pcbc snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer aesni_intel crypto_simd glue_helper cryptd snd joydev pcspkr virtio_balloon i2c_piix4 soundcore nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c ata_generic pata_acpi qxl drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm virtio_blk drm virtio_net virtio_console ata_piix crc32c_intel libata virtio_pci serio_raw i2c_core virtio_ring virtio floppy dm_mirror dm_region_hash dm_log dm_mod [last unloaded: act_vlan]
       CPU: 2 PID: 5763 Comm: tc Tainted: G            E    4.16.0-rc4.act_vlan.orig+ #403
       Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
       RIP: 0010:__call_rcu+0x23/0x2b0
       RSP: 0018:ffffb275803e77c0 EFLAGS: 00010246
       RAX: ffffffffc057b080 RBX: ffff9674bc6f5240 RCX: 00000000ffffffff
       RDX: ffffffff928a5f00 RSI: 0000000000000008 RDI: 0000000000000008
       RBP: 0000000000000008 R08: 0000000000000001 R09: 0000000000000044
       R10: 0000000000000220 R11: ffff9674b9ab4821 R12: 0000000000000000
       R13: ffffffff928a5f00 R14: 0000000000000000 R15: 0000000000000001
       FS:  00007fa6368d8740(0000) GS:ffff9674bfd00000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 0000000000000010 CR3: 0000000073dec001 CR4: 00000000001606e0
       Call Trace:
        __tcf_idr_release+0x79/0xf0
        tcf_csum_init+0xfb/0x180 [act_csum]
        tcf_action_init_1+0x2cc/0x430
        tcf_action_init+0xd3/0x1b0
        tc_ctl_action+0x18b/0x240
        rtnetlink_rcv_msg+0x29c/0x310
        ? _cond_resched+0x15/0x30
        ? __kmalloc_node_track_caller+0x1b9/0x270
        ? rtnl_calcit.isra.28+0x100/0x100
        netlink_rcv_skb+0xd2/0x110
        netlink_unicast+0x17c/0x230
        netlink_sendmsg+0x2cd/0x3c0
        sock_sendmsg+0x30/0x40
        ___sys_sendmsg+0x27a/0x290
        ? filemap_map_pages+0x34a/0x3a0
        ? __handle_mm_fault+0xbfd/0xe20
        __sys_sendmsg+0x51/0x90
        do_syscall_64+0x6e/0x1a0
        entry_SYSCALL_64_after_hwframe+0x3d/0xa2
       RIP: 0033:0x7fa635ce9ba0
       RSP: 002b:00007ffc185b0fc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
       RAX: ffffffffffffffda RBX: 00007ffc185b10f0 RCX: 00007fa635ce9ba0
       RDX: 0000000000000000 RSI: 00007ffc185b1040 RDI: 0000000000000003
       RBP: 000000005aaa85e0 R08: 0000000000000002 R09: 0000000000000000
       R10: 00007ffc185b0a20 R11: 0000000000000246 R12: 0000000000000000
       R13: 00007ffc185b1104 R14: 0000000000000001 R15: 0000000000669f60
       Code: 5d e9 42 da ff ff 66 90 0f 1f 44 00 00 41 57 41 56 41 55 49 89 d5 41 54 55 48 89 fd 53 48 83 ec 08 40 f6 c7 07 0f 85 19 02 00 00 <48> 89 75 08 48 c7 45 00 00 00 00 00 9c 58 0f 1f 44 00 00 49 89
       RIP: __call_rcu+0x23/0x2b0 RSP: ffffb275803e77c0
       CR2: 0000000000000010
      
      fix this in tcf_csum_cleanup(), ensuring that kfree_rcu(param, ...) is
      called only when param is not NULL.
      
      Fixes: 9c5f69bb ("net/sched: act_csum: don't use spinlock in the fast path")
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      aab378a7
    • Davide Caratti's avatar
      net/sched: fix NULL dereference in the error path of tcf_vlan_init() · 1edf8abe
      Davide Caratti authored
      when the following command
      
       # tc actions replace action vlan pop index 100
      
      is run for the first time, and tcf_vlan_init() fails allocating struct
      tcf_vlan_params, tcf_vlan_cleanup() calls kfree_rcu(NULL, ...). This causes
      the following error:
      
       BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
       IP: __call_rcu+0x23/0x2b0
       PGD 80000000760a2067 P4D 80000000760a2067 PUD 742c1067 PMD 0
       Oops: 0002 [#1] SMP PTI
       Modules linked in: act_vlan(E) ip6table_filter ip6_tables iptable_filter binfmt_misc ext4 snd_hda_codec_generic snd_hda_intel mbcache snd_hda_codec jbd2 snd_hda_core crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc snd_hwdep snd_seq snd_seq_device snd_pcm aesni_intel crypto_simd snd_timer glue_helper snd cryptd joydev soundcore virtio_balloon pcspkr i2c_piix4 nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c ata_generic pata_acpi qxl drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm virtio_console virtio_blk virtio_net ata_piix crc32c_intel libata virtio_pci i2c_core virtio_ring serio_raw virtio floppy dm_mirror dm_region_hash dm_log dm_mod [last unloaded: act_vlan]
       CPU: 3 PID: 3119 Comm: tc Tainted: G            E    4.16.0-rc4.act_vlan.orig+ #403
       Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
       RIP: 0010:__call_rcu+0x23/0x2b0
       RSP: 0018:ffffaac3005fb798 EFLAGS: 00010246
       RAX: ffffffffc0704080 RBX: ffff97f2b4bbe900 RCX: 00000000ffffffff
       RDX: ffffffffabca5f00 RSI: 0000000000000010 RDI: 0000000000000010
       RBP: 0000000000000010 R08: 0000000000000001 R09: 0000000000000044
       R10: 00000000fd003000 R11: ffff97f2faab5b91 R12: 0000000000000000
       R13: ffffffffabca5f00 R14: ffff97f2fb80202c R15: 00000000fffffff4
       FS:  00007f68f75b4740(0000) GS:ffff97f2ffd80000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 0000000000000018 CR3: 0000000072b52001 CR4: 00000000001606e0
       Call Trace:
        __tcf_idr_release+0x79/0xf0
        tcf_vlan_init+0x168/0x270 [act_vlan]
        tcf_action_init_1+0x2cc/0x430
        tcf_action_init+0xd3/0x1b0
        tc_ctl_action+0x18b/0x240
        rtnetlink_rcv_msg+0x29c/0x310
        ? _cond_resched+0x15/0x30
        ? __kmalloc_node_track_caller+0x1b9/0x270
        ? rtnl_calcit.isra.28+0x100/0x100
        netlink_rcv_skb+0xd2/0x110
        netlink_unicast+0x17c/0x230
        netlink_sendmsg+0x2cd/0x3c0
        sock_sendmsg+0x30/0x40
        ___sys_sendmsg+0x27a/0x290
        ? filemap_map_pages+0x34a/0x3a0
        ? __handle_mm_fault+0xbfd/0xe20
        __sys_sendmsg+0x51/0x90
        do_syscall_64+0x6e/0x1a0
        entry_SYSCALL_64_after_hwframe+0x3d/0xa2
       RIP: 0033:0x7f68f69c5ba0
       RSP: 002b:00007fffd79c1118 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
       RAX: ffffffffffffffda RBX: 00007fffd79c1240 RCX: 00007f68f69c5ba0
       RDX: 0000000000000000 RSI: 00007fffd79c1190 RDI: 0000000000000003
       RBP: 000000005aaa708e R08: 0000000000000002 R09: 0000000000000000
       R10: 00007fffd79c0ba0 R11: 0000000000000246 R12: 0000000000000000
       R13: 00007fffd79c1254 R14: 0000000000000001 R15: 0000000000669f60
       Code: 5d e9 42 da ff ff 66 90 0f 1f 44 00 00 41 57 41 56 41 55 49 89 d5 41 54 55 48 89 fd 53 48 83 ec 08 40 f6 c7 07 0f 85 19 02 00 00 <48> 89 75 08 48 c7 45 00 00 00 00 00 9c 58 0f 1f 44 00 00 49 89
       RIP: __call_rcu+0x23/0x2b0 RSP: ffffaac3005fb798
       CR2: 0000000000000018
      
      fix this in tcf_vlan_cleanup(), ensuring that kfree_rcu(p, ...) is called
      only when p is not NULL.
      
      Fixes: 4c5b9d96 ("act_vlan: VLAN action rewrite to use RCU lock/unlock and update")
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Acked-by: default avatarManish Kurup <manish.kurup@verizon.com>
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1edf8abe
    • SZ Lin (林上智)'s avatar
      net: ethernet: ti: cpsw: add check for in-band mode setting with RGMII PHY interface · f9db5069
      SZ Lin (林上智) authored
      According to AM335x TRM[1] 14.3.6.2, AM437x TRM[2] 15.3.6.2 and
      DRA7 TRM[3] 24.11.4.8.7.3.3, in-band mode in EXT_EN(bit18) register is only
      available when PHY is configured in RGMII mode with 10Mbps speed. It will
      cause some networking issues without RGMII mode, such as carrier sense
      errors and low throughput. TI also mentioned this issue in their forum[4].
      
      This patch adds the check mechanism for PHY interface with RGMII interface
      type, the in-band mode can only be set in RGMII mode with 10Mbps speed.
      
      References:
      [1]: https://www.ti.com/lit/ug/spruh73p/spruh73p.pdf
      [2]: http://www.ti.com/lit/ug/spruhl7h/spruhl7h.pdf
      [3]: http://www.ti.com/lit/ug/spruic2b/spruic2b.pdf
      [4]: https://e2e.ti.com/support/arm/sitara_arm/f/791/p/640765/2392155Suggested-by: default avatarHolsety Chen (陳憲輝) <Holsety.Chen@moxa.com>
      Signed-off-by: default avatarSZ Lin (林上智) <sz.lin@moxa.com>
      Signed-off-by: default avatarSchuyler Patton <spatton@ti.com>
      Reviewed-by: default avatarGrygorii Strashko <grygorii.strashko@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f9db5069
    • Matthias Brugger's avatar
      net: hns: Fix ethtool private flags · d61d263c
      Matthias Brugger authored
      The driver implementation returns support for private flags, while
      no private flags are present. When asked for the number of private
      flags it returns the number of statistic flag names.
      
      Fix this by returning EOPNOTSUPP for not implemented ethtool flags.
      Signed-off-by: default avatarMatthias Brugger <mbrugger@suse.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d61d263c
    • Ido Schimmel's avatar
      mlxsw: spectrum_buffers: Set a minimum quota for CPU port traffic · bcdd5de8
      Ido Schimmel authored
      In commit 9ffcc372 ("mlxsw: spectrum: Allow packets to be trapped
      from any PG") I fixed a problem where packets could not be trapped to
      the CPU due to exceeded shared buffer quotas. The mentioned commit
      explains the problem in detail.
      
      The problem was fixed by assigning a minimum quota for the CPU port and
      the traffic class used for scheduling traffic to the CPU.
      
      However, commit 117b0dad ("mlxsw: Create a different trap group list
      for each device") assigned different traffic classes to different
      packet types and rendered the fix useless.
      
      Fix the problem by assigning a minimum quota for the CPU port and all
      the traffic classes that are currently in use.
      
      Fixes: 117b0dad ("mlxsw: Create a different trap group list for each device")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Reported-by: default avatarEddie Shklaer <eddies@mellanox.com>
      Tested-by: default avatarEddie Shklaer <eddies@mellanox.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bcdd5de8
    • Eric Dumazet's avatar
      net: sched: fix uses after free · cce6294c
      Eric Dumazet authored
      syzbot reported one use-after-free in pfifo_fast_enqueue() [1]
      
      Issue here is that we can not reuse skb after a successful skb_array_produce()
      since another cpu might have consumed it already.
      
      I believe a similar problem exists in try_bulk_dequeue_skb_slow()
      in case we put an skb into qdisc_enqueue_skb_bad_txq() for lockless qdisc.
      
      [1]
      BUG: KASAN: use-after-free in qdisc_pkt_len include/net/sch_generic.h:610 [inline]
      BUG: KASAN: use-after-free in qdisc_qstats_cpu_backlog_inc include/net/sch_generic.h:712 [inline]
      BUG: KASAN: use-after-free in pfifo_fast_enqueue+0x4bc/0x5e0 net/sched/sch_generic.c:639
      Read of size 4 at addr ffff8801cede37e8 by task syzkaller717588/5543
      
      CPU: 1 PID: 5543 Comm: syzkaller717588 Not tainted 4.16.0-rc4+ #265
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:17 [inline]
       dump_stack+0x194/0x24d lib/dump_stack.c:53
       print_address_description+0x73/0x250 mm/kasan/report.c:256
       kasan_report_error mm/kasan/report.c:354 [inline]
       kasan_report+0x23c/0x360 mm/kasan/report.c:412
       __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
       qdisc_pkt_len include/net/sch_generic.h:610 [inline]
       qdisc_qstats_cpu_backlog_inc include/net/sch_generic.h:712 [inline]
       pfifo_fast_enqueue+0x4bc/0x5e0 net/sched/sch_generic.c:639
       __dev_xmit_skb net/core/dev.c:3216 [inline]
      
      Fixes: c5ad119f ("net: sched: pfifo_fast use skb_array")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: syzbot+ed43b6903ab968b16f54@syzkaller.appspotmail.com
      Cc: John Fastabend <john.fastabend@gmail.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc:	Cong Wang <xiyou.wangcong@gmail.com>
      Cc:	Jiri Pirko <jiri@resnulli.us>
      Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cce6294c
  5. 16 Mar, 2018 13 commits
  6. 15 Mar, 2018 2 commits
    • Roman Mashak's avatar
      net sched actions: return explicit error when tunnel_key mode is not specified · 51d4740f
      Roman Mashak authored
      If set/unset mode of the tunnel_key action is not provided, ->init() still
      returns 0, and the caller proceeds with bogus 'struct tc_action *' object,
      this results in crash:
      
      % tc actions add action tunnel_key src_ip 1.1.1.1 dst_ip 2.2.2.1 id 7 index 1
      
      [   35.805515] general protection fault: 0000 [#1] SMP PTI
      [   35.806161] Modules linked in: act_tunnel_key kvm_intel kvm irqbypass
      crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64
      crypto_simd glue_helper cryptd serio_raw
      [   35.808233] CPU: 1 PID: 428 Comm: tc Not tainted 4.16.0-rc4+ #286
      [   35.808929] RIP: 0010:tcf_action_init+0x90/0x190
      [   35.809457] RSP: 0018:ffffb8edc068b9a0 EFLAGS: 00010206
      [   35.810053] RAX: 1320c000000a0003 RBX: 0000000000000001 RCX: 0000000000000000
      [   35.810866] RDX: 0000000000000070 RSI: 0000000000007965 RDI: ffffb8edc068b910
      [   35.811660] RBP: ffffb8edc068b9d0 R08: 0000000000000000 R09: ffffb8edc068b808
      [   35.812463] R10: ffffffffc02bf040 R11: 0000000000000040 R12: ffffb8edc068bb38
      [   35.813235] R13: 0000000000000000 R14: 0000000000000000 R15: ffffb8edc068b910
      [   35.814006] FS:  00007f3d0d8556c0(0000) GS:ffff91d1dbc40000(0000)
      knlGS:0000000000000000
      [   35.814881] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [   35.815540] CR2: 000000000043f720 CR3: 0000000019248001 CR4: 00000000001606a0
      [   35.816457] Call Trace:
      [   35.817158]  tc_ctl_action+0x11a/0x220
      [   35.817795]  rtnetlink_rcv_msg+0x23d/0x2e0
      [   35.818457]  ? __slab_alloc+0x1c/0x30
      [   35.819079]  ? __kmalloc_node_track_caller+0xb1/0x2b0
      [   35.819544]  ? rtnl_calcit.isra.30+0xe0/0xe0
      [   35.820231]  netlink_rcv_skb+0xce/0x100
      [   35.820744]  netlink_unicast+0x164/0x220
      [   35.821500]  netlink_sendmsg+0x293/0x370
      [   35.822040]  sock_sendmsg+0x30/0x40
      [   35.822508]  ___sys_sendmsg+0x2c5/0x2e0
      [   35.823149]  ? pagecache_get_page+0x27/0x220
      [   35.823714]  ? filemap_fault+0xa2/0x640
      [   35.824423]  ? page_add_file_rmap+0x108/0x200
      [   35.825065]  ? alloc_set_pte+0x2aa/0x530
      [   35.825585]  ? finish_fault+0x4e/0x70
      [   35.826140]  ? __handle_mm_fault+0xbc1/0x10d0
      [   35.826723]  ? __sys_sendmsg+0x41/0x70
      [   35.827230]  __sys_sendmsg+0x41/0x70
      [   35.827710]  do_syscall_64+0x68/0x120
      [   35.828195]  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
      [   35.828859] RIP: 0033:0x7f3d0ca4da67
      [   35.829331] RSP: 002b:00007ffc9f284338 EFLAGS: 00000246 ORIG_RAX:
      000000000000002e
      [   35.830304] RAX: ffffffffffffffda RBX: 00007ffc9f284460 RCX: 00007f3d0ca4da67
      [   35.831247] RDX: 0000000000000000 RSI: 00007ffc9f2843b0 RDI: 0000000000000003
      [   35.832167] RBP: 000000005aa6a7a9 R08: 0000000000000001 R09: 0000000000000000
      [   35.833075] R10: 00000000000005f1 R11: 0000000000000246 R12: 0000000000000000
      [   35.833997] R13: 00007ffc9f2884c0 R14: 0000000000000001 R15: 0000000000674640
      [   35.834923] Code: 24 30 bb 01 00 00 00 45 31 f6 eb 5e 8b 50 08 83 c2 07 83 e2
      fc 83 c2 70 49 8b 07 48 8b 40 70 48 85 c0 74 10 48 89 14 24 4c 89 ff <ff> d0 48
      8b 14 24 48 01 c2 49 01 d6 45 85 ed 74 05 41 83 47 2c
      [   35.837442] RIP: tcf_action_init+0x90/0x190 RSP: ffffb8edc068b9a0
      [   35.838291] ---[ end trace a095c06ee4b97a26 ]---
      
      Fixes: d0f6dd8a ("net/sched: Introduce act_tunnel_key")
      Signed-off-by: default avatarRoman Mashak <mrv@mojatatu.com>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      51d4740f
    • Ursula Braun's avatar
      net/smc: simplify wait when closing listen socket · 3d502067
      Ursula Braun authored
      Closing of a listen socket wakes up kernel_accept() of
      smc_tcp_listen_worker(), and then has to wait till smc_tcp_listen_worker()
      gives up the internal clcsock. The wait logic introduced with
      commit 127f4970 ("net/smc: release clcsock from tcp_listen_worker")
      might wait longer than necessary. This patch implements the idea to
      implement the wait just with flush_work(), and gets rid of the extra
      smc_close_wait_listen_clcsock() function.
      
      Fixes: 127f4970 ("net/smc: release clcsock from tcp_listen_worker")
      Reported-by: default avatarHans Wippel <hwippel@linux.vnet.ibm.com>
      Signed-off-by: default avatarUrsula Braun <ubraun@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3d502067
  7. 14 Mar, 2018 3 commits