1. 30 Dec, 2013 3 commits
    • Paul Durrant's avatar
      xen-netback: fix guest-receive-side array sizes · ac3d5ac2
      Paul Durrant authored
      The sizes chosen for the metadata and grant_copy_op arrays on the guest
      receive size are wrong;
      
      - The meta array is needlessly twice the ring size, when we only ever
        consume a single array element per RX ring slot
      - The grant_copy_op array is way too small. It's sized based on a bogus
        assumption: that at most two copy ops will be used per ring slot. This
        may have been true at some point in the past but it's clear from looking
        at start_new_rx_buffer() that a new ring slot is only consumed if a frag
        would overflow the current slot (plus some other conditions) so the actual
        limit is MAX_SKB_FRAGS grant_copy_ops per ring slot.
      
      This patch fixes those two sizing issues and, because grant_copy_ops grows
      so much, it pulls it out into a separate chunk of vmalloc()ed memory.
      Signed-off-by: default avatarPaul Durrant <paul.durrant@citrix.com>
      Acked-by: default avatarWei Liu <wei.liu2@citrix.com>
      Cc: Ian Campbell <ian.campbell@citrix.com>
      Cc: David Vrabel <david.vrabel@citrix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ac3d5ac2
    • Fabio Estevam's avatar
      fec: Do not assume that PHY reset is active low · 7a399e3a
      Fabio Estevam authored
      We should not assume that the PHY reset is always active low.
      
      Retrieve this information from the device tree instead, so that the PHY reset
      can work on both cases.
      Reported-by: default avatarPhilipp Zabel <p.zabel@pengutronix.de>
      Signed-off-by: default avatarFabio Estevam <fabio.estevam@freescale.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7a399e3a
    • Ying Xue's avatar
      tipc: fix deadlock during socket release · 84602761
      Ying Xue authored
      A deadlock might occur if name table is withdrawn in socket release
      routine, and while packets are still being received from bearer.
      
             CPU0                       CPU1
      T0:   recv_msg()               release()
      T1:   tipc_recv_msg()          tipc_withdraw()
      T2:   [grab node lock]         [grab port lock]
      T3:   tipc_link_wakeup_ports() tipc_nametbl_withdraw()
      T4:   [grab port lock]*        named_cluster_distribute()
      T5:   wakeupdispatch()         tipc_link_send()
      T6:                            [grab node lock]*
      
      The opposite order of holding port lock and node lock on above two
      different paths may result in a deadlock. If socket lock instead of
      port lock is used to protect port instance in tipc_withdraw(), the
      reverse order of holding port lock and node lock will be eliminated,
      as a result, the deadlock is killed as well.
      Reported-by: default avatarLars Everbrand <lars.everbrand@ericsson.com>
      Reviewed-by: default avatarErik Hugne <erik.hugne@ericsson.com>
      Signed-off-by: default avatarYing Xue <ying.xue@windriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      84602761
  2. 29 Dec, 2013 2 commits
    • David S. Miller's avatar
      Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge · 8eb9bff0
      David S. Miller authored
      Included changes:
      
      - reset netfilter-bridge state when removing the batman-adv
        header from an incoming packet. This prevents netfilter
        bridge from being fooled when the same packet enters a
        bridge twice (or more): the first time within the
        batman-adv header and the second time without.
      
      - adjust the packet layout to prevent any architecture from
        adding padding bytes. All the structs sent over the wire
        now have size multiple of 4bytes (unless pack(2) is used).
      
      - fix access to the inner vlan_eth header when reading the
        VID in the rx path.
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8eb9bff0
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · a72338a0
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter/IPVS fixes for net
      
      This patchset contains four nf_tables fixes, one IPVS fix due to
      missing updates in the interaction with the new sedadj conntrack
      extension that was added to support the netfilter synproxy code,
      and a couple of one-liners to fix netnamespace netfilter issues.
      More specifically, they are:
      
      * Fix ipv6_find_hdr() call without offset being explicitly initialized
        in nft_exthdr, as required by that function, from Daniel Borkmann.
      
      * Fix oops in nfnetlink_log when using netns and unloading the kernel
        module, from Gao feng.
      
      * Fix BUG_ON in nf_ct_timestamp extension after netns is destroyed,
        from Helmut Schaa.
      
      * Fix crash in IPVS due to missing sequence adjustment extension being
        allocated in the conntrack, from Jesper Dangaard Brouer.
      
      * Add bugtrap to spot a warning in case you deference sequence adjustment
        conntrack area when not available, this should help to catch similar
        invalid dereferences in the Netfilter tree, also from Jesper.
      
      * Fix incomplete dumping of sets in nf_tables when retrieving by family,
        from me.
      
      * Fix oops when updating the table state (dormant <-> active) and having
        user (not base ) chains, from me.
      
      * Fix wrong validation in set element data that results in returning
        -EINVAL when using the nf_tables dictionary feature with mappings,
        also from me.
      
      We don't usually have this amount of fixes by this time (as we're already
      in -rc5 of the development cycle), although half of them are related to
      nf_tables which is a relatively new thing, and I also believe that holidays
      have also delayed the flight of bugfixes to mainstream a bit.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a72338a0
  3. 28 Dec, 2013 10 commits
  4. 27 Dec, 2013 9 commits
    • Li RongQing's avatar
      ipv6: release dst properly in ipip6_tunnel_xmit · 6a9eadcc
      Li RongQing authored
      if a dst is not attached to anywhere, it should be released before
      exit ipip6_tunnel_xmit, otherwise cause dst memory leakage.
      
      Fixes: 61c1db7f ("ipv6: sit: add GSO/TSO support")
      Signed-off-by: default avatarLi RongQing <roy.qing.li@gmail.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6a9eadcc
    • David Gibson's avatar
      netxen: Correct off-by-one errors in bounds checks · 4710b2ba
      David Gibson authored
      netxen_process_lro() contains two bounds checks.  One for the ring number
      against the number of rings, and one for the Rx buffer ID against the
      array of receive buffers.
      
      Both of these have off-by-one errors, using > instead of >=. The correct
      versions are used in netxen_process_rcv(), they're just wrong in
      netxen_process_lro().
      Signed-off-by: default avatarDavid Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4710b2ba
    • David S. Miller's avatar
      net: Add some clarification to skb_tx_timestamp() comment. · 73409f3b
      David S. Miller authored
      We've seen so many instances of people invoking skb_tx_timestamp()
      after the device already has been given the packet, that it's worth
      being a little bit more verbose and explicit in this comment.
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      73409f3b
    • Eric Dumazet's avatar
      arc_emac: fix potential use after free · 37ec274e
      Eric Dumazet authored
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      
      skb_tx_timestamp(skb) should be called _before_ TX completion
      has a chance to trigger, otherwise it is too late and we access
      freed memory.
      
      Fixes: e4f2379d ("ethernet/arc/arc_emac - Add new driver")
      From: Eric Dumazet <edumazet@google.com>
      Cc: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
      Cc: Richard Cochran <richardcochran@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      37ec274e
    • Nithin Sujir's avatar
      tg3: Expand 4g_overflow_test workaround to skb fragments of any size. · 37567910
      Nithin Sujir authored
      The current driver assumes that an skb fragment can only be upto jumbo
      size. Presumably this was a fast-path optimization. This assumption is
      no longer true as fragments can be upto 32k.
      
      v2: Remove unnecessary parantheses per Eric Dumazet.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNithin Nayak Sujir <nsujir@broadcom.com>
      Signed-off-by: default avatarMichael Chan <mchan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      37567910
    • Jamal Hadi Salim's avatar
      net_sched: act: Dont increment refcnt on replace · 1a29321e
      Jamal Hadi Salim authored
       This is a bug fix. The existing code tries to kill many
       birds with one stone: Handling binding of actions to
       filters, new actions and replacing of action
       attributes. A simple test case to illustrate:
      
      XXXX
       moja@fe1:~$ sudo tc actions add action drop index 12
       moja@fe1:~$ actions get action gact index 12
       action order 1: gact action drop
        random type none pass val 0
        index 12 ref 1 bind 0
       moja@fe1:~$ sudo tc actions replace action ok index 12
       moja@fe1:~$ actions get action gact index 12
       action order 1: gact action drop
        random type none pass val 0
        index 12 ref 2 bind 0
      XXXX
      
      The above shows the refcounf being wrongly incremented on replace.
      There are more complex scenarios with binding of actions to filters
      that i am leaving out that didnt work as well...
      Signed-off-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1a29321e
    • Sasha Levin's avatar
      rds: prevent dereference of a NULL device · c2349758
      Sasha Levin authored
      Binding might result in a NULL device, which is dereferenced
      causing this BUG:
      
      [ 1317.260548] BUG: unable to handle kernel NULL pointer dereference at 000000000000097
      4
      [ 1317.261847] IP: [<ffffffff84225f52>] rds_ib_laddr_check+0x82/0x110
      [ 1317.263315] PGD 418bcb067 PUD 3ceb21067 PMD 0
      [ 1317.263502] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
      [ 1317.264179] Dumping ftrace buffer:
      [ 1317.264774]    (ftrace buffer empty)
      [ 1317.265220] Modules linked in:
      [ 1317.265824] CPU: 4 PID: 836 Comm: trinity-child46 Tainted: G        W    3.13.0-rc4-
      next-20131218-sasha-00013-g2cebb9b-dirty #4159
      [ 1317.267415] task: ffff8803ddf33000 ti: ffff8803cd31a000 task.ti: ffff8803cd31a000
      [ 1317.268399] RIP: 0010:[<ffffffff84225f52>]  [<ffffffff84225f52>] rds_ib_laddr_check+
      0x82/0x110
      [ 1317.269670] RSP: 0000:ffff8803cd31bdf8  EFLAGS: 00010246
      [ 1317.270230] RAX: 0000000000000000 RBX: ffff88020b0dd388 RCX: 0000000000000000
      [ 1317.270230] RDX: ffffffff8439822e RSI: 00000000000c000a RDI: 0000000000000286
      [ 1317.270230] RBP: ffff8803cd31be38 R08: 0000000000000000 R09: 0000000000000000
      [ 1317.270230] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
      [ 1317.270230] R13: 0000000054086700 R14: 0000000000a25de0 R15: 0000000000000031
      [ 1317.270230] FS:  00007ff40251d700(0000) GS:ffff88022e200000(0000) knlGS:000000000000
      0000
      [ 1317.270230] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      [ 1317.270230] CR2: 0000000000000974 CR3: 00000003cd478000 CR4: 00000000000006e0
      [ 1317.270230] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [ 1317.270230] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000090602
      [ 1317.270230] Stack:
      [ 1317.270230]  0000000054086700 5408670000a25de0 5408670000000002 0000000000000000
      [ 1317.270230]  ffffffff84223542 00000000ea54c767 0000000000000000 ffffffff86d26160
      [ 1317.270230]  ffff8803cd31be68 ffffffff84223556 ffff8803cd31beb8 ffff8800c6765280
      [ 1317.270230] Call Trace:
      [ 1317.270230]  [<ffffffff84223542>] ? rds_trans_get_preferred+0x42/0xa0
      [ 1317.270230]  [<ffffffff84223556>] rds_trans_get_preferred+0x56/0xa0
      [ 1317.270230]  [<ffffffff8421c9c3>] rds_bind+0x73/0xf0
      [ 1317.270230]  [<ffffffff83e4ce62>] SYSC_bind+0x92/0xf0
      [ 1317.270230]  [<ffffffff812493f8>] ? context_tracking_user_exit+0xb8/0x1d0
      [ 1317.270230]  [<ffffffff8119313d>] ? trace_hardirqs_on+0xd/0x10
      [ 1317.270230]  [<ffffffff8107a852>] ? syscall_trace_enter+0x32/0x290
      [ 1317.270230]  [<ffffffff83e4cece>] SyS_bind+0xe/0x10
      [ 1317.270230]  [<ffffffff843a6ad0>] tracesys+0xdd/0xe2
      [ 1317.270230] Code: 00 8b 45 cc 48 8d 75 d0 48 c7 45 d8 00 00 00 00 66 c7 45 d0 02 00
      89 45 d4 48 89 df e8 78 49 76 ff 41 89 c4 85 c0 75 0c 48 8b 03 <80> b8 74 09 00 00 01 7
      4 06 41 bc 9d ff ff ff f6 05 2a b6 c2 02
      [ 1317.270230] RIP  [<ffffffff84225f52>] rds_ib_laddr_check+0x82/0x110
      [ 1317.270230]  RSP <ffff8803cd31bdf8>
      [ 1317.270230] CR2: 0000000000000974
      Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c2349758
    • Jesper Dangaard Brouer's avatar
      ipvs: correct usage/allocation of seqadj ext in ipvs · b25adce1
      Jesper Dangaard Brouer authored
      The IPVS FTP helper ip_vs_ftp could trigger an OOPS in nf_ct_seqadj_set,
      after commit 41d73ec0 (netfilter: nf_conntrack: make sequence number
      adjustments usuable without NAT).
      
      This is because, the seqadj ext is now allocated dynamically, and the
      IPVS code didn't handle this situation.  Fix this in the IPVS nfct
      code by invoking the alloc function nfct_seqadj_ext_add().
      
      Fixes: 41d73ec0 (netfilter: nf_conntrack: make sequence number adjustments usuable without NAT)
      Suggested-by: default avatarJulian Anastasov <ja@ssi.bg>
      Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
      Signed-off-by: default avatarSimon Horman <horms@verge.net.au>
      b25adce1
    • Jesper Dangaard Brouer's avatar
      netfilter: WARN about wrong usage of sequence number adjustments · db12cf27
      Jesper Dangaard Brouer authored
      Since commit 41d73ec0 (netfilter: nf_conntrack: make sequence
      number adjustments usuable without NAT), the sequence number extension
      is dynamically allocated.
      
      Instead of dying, give a WARN splash, in case of wrong usage of the
      seqadj code, e.g. when forgetting to allocate via nfct_seqadj_ext_add().
      
      Wrong usage have been seen in the IPVS code path.
      Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
      Signed-off-by: default avatarSimon Horman <horms@verge.net.au>
      db12cf27
  5. 26 Dec, 2013 1 commit
    • Florian Westphal's avatar
      macvlan: fix netdev feature propagation from lower device · 797f87f8
      Florian Westphal authored
      There are inconsistencies wrt. feature propagation/inheritance between
      macvlan and the underlying interface.
      
      When a feature is turned off on the real device before a macvlan is
      created on top, these will remain enabled on the macvlan device, whereas
      turning off the feature on the lower device after macvlan creation the
      kernel will propagate the changes to the macvlan.
      
      The second issue is that, when propagating changes from underlying device
      to the macvlan interface, macvlan can erronously lose its NETIF_F_LLTX flag,
      as features are anded with the underlying device.
      
      However, LLTX should be kept since it has no dependencies on physical
      hardware (LLTX is set on macvlan creation regardless of the lower
      device properties, see 8ffab51b
      (macvlan: lockless tx path).
      
      The LLTX flag is now forced regardless of user settings in absence of
      layer2 hw acceleration (a6cc0cfa,
      net: Add layer 2 hardware acceleration operations for macvlan devices).
      
      Use netdev_increment_features to rebuild the feature set on capability
      changes on either the lower device or on the macvlan interface.
      
      As pointed out by Ben Hutchings, use netdev_update_features on
      NETDEV_FEAT_CHANGE event (it calls macvlan_fix_features/netdev_features_change
      if needed).
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      797f87f8
  6. 22 Dec, 2013 13 commits
  7. 20 Dec, 2013 2 commits
    • John W. Linville's avatar
      Merge branch 'master' of... · 76ae07df
      John W. Linville authored
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
      76ae07df
    • Helmut Schaa's avatar
      netfilter: nf_ct_timestamp: Fix BUG_ON after netns deletion · 443d20fd
      Helmut Schaa authored
      When having nf_conntrack_timestamp enabled deleting a netns
      can lead to the following BUG being triggered:
      
      [63836.660000] Kernel bug detected[#1]:
      [63836.660000] CPU: 0 PID: 0 Comm: swapper Not tainted 3.10.18 #14
      [63836.660000] task: 802d9420 ti: 802d2000 task.ti: 802d2000
      [63836.660000] $ 0   : 00000000 00000000 00000000 00000000
      [63836.660000] $ 4   : 00000001 00000004 00000020 00000020
      [63836.660000] $ 8   : 00000000 80064910 00000000 00000000
      [63836.660000] $12   : 0bff0002 00000001 00000000 0a0a0abe
      [63836.660000] $16   : 802e70a0 85f29d80 00000000 00000004
      [63836.660000] $20   : 85fb62a0 00000002 802d3bc0 85fb62a0
      [63836.660000] $24   : 00000000 87138110
      [63836.660000] $28   : 802d2000 802d3b40 00000014 871327cc
      [63836.660000] Hi    : 000005ff
      [63836.660000] Lo    : f2edd000
      [63836.660000] epc   : 87138794 __nf_ct_ext_add_length+0xe8/0x1ec [nf_conntrack]
      [63836.660000]     Not tainted
      [63836.660000] ra    : 871327cc nf_conntrack_in+0x31c/0x7b8 [nf_conntrack]
      [63836.660000] Status: 1100d403 KERNEL EXL IE
      [63836.660000] Cause : 00800034
      [63836.660000] PrId  : 0001974c (MIPS 74Kc)
      [63836.660000] Modules linked in: ath9k ath9k_common pppoe ppp_async iptable_nat ath9k_hw ath pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv4 mac80211 ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_quota xt_policy xt_pkttype xt_owner xt_nat xt_multiport xt_mark xh
      [63836.660000] Process swapper (pid: 0, threadinfo=802d2000, task=802d9420, tls=00000000)
      [63836.660000] Stack : 802e70a0 871323d4 00000005 87080234 802e70a0 86d2a840 00000000 00000000
      [63836.660000] Call Trace:
      [63836.660000] [<87138794>] __nf_ct_ext_add_length+0xe8/0x1ec [nf_conntrack]
      [63836.660000] [<871327cc>] nf_conntrack_in+0x31c/0x7b8 [nf_conntrack]
      [63836.660000] [<801ff63c>] nf_iterate+0x90/0xec
      [63836.660000] [<801ff730>] nf_hook_slow+0x98/0x164
      [63836.660000] [<80205968>] ip_rcv+0x3e8/0x40c
      [63836.660000] [<801d9754>] __netif_receive_skb_core+0x624/0x6a4
      [63836.660000] [<801da124>] process_backlog+0xa4/0x16c
      [63836.660000] [<801d9bb4>] net_rx_action+0x10c/0x1e0
      [63836.660000] [<8007c5a4>] __do_softirq+0xd0/0x1bc
      [63836.660000] [<8007c730>] do_softirq+0x48/0x68
      [63836.660000] [<8007c964>] irq_exit+0x54/0x70
      [63836.660000] [<80060830>] ret_from_irq+0x0/0x4
      [63836.660000] [<8006a9f8>] r4k_wait_irqoff+0x18/0x1c
      [63836.660000] [<8009cfb8>] cpu_startup_entry+0xa4/0x104
      [63836.660000] [<802eb918>] start_kernel+0x394/0x3ac
      [63836.660000]
      [63836.660000]
      Code: 00821021  8c420000  2c440001 <00040336> 90440011  92350010  90560010  2485ffff  02a5a821
      [63837.040000] ---[ end trace ebf660c3ce3b55e7 ]---
      [63837.050000] Kernel panic - not syncing: Fatal exception in interrupt
      [63837.050000] Rebooting in 3 seconds..
      
      Fix this by not unregistering the conntrack extension in the per-netns
      cleanup code.
      
      This bug was introduced in (73f4001a netfilter: nf_ct_tstamp: move
      initialization out of pernet_operations).
      Signed-off-by: default avatarHelmut Schaa <helmut.schaa@googlemail.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      443d20fd