Skip to content

L
linux
Switch branch/tag
  1. 26 May, 2014 1 commit
  3. 15 May, 2014 1 commit
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: fix trace of matching non-terminal rule · 3b084e99
      Pablo Neira Ayuso authored 
      Add the corresponding trace if we have a full match in a non-terminal
rule. Note that the traces will look slightly different than in
x_tables since the log message after all expressions have been
evaluated (contrary to x_tables, that emits it before the target
action). This manifests in two differences in nf_tables wrt. x_tables:

1) The rule that enables the tracing is included in the trace.

2) If the rule emits some log message, that is shown before the
   trace log message.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      3b084e99
  5. 12 May, 2014 4 commits
  7. 10 May, 2014 1 commit
  9. 09 May, 2014 1 commit
  11. 05 May, 2014 2 commits
    • Vasily Averin's avatar
      bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit · aff09ce3
      Vasily Averin authored 
      Currently bridge can silently drop ipv4 fragments.
If node have loaded nf_defrag_ipv4 module but have no nf_conntrack_ipv4,
br_nf_pre_routing defragments incoming ipv4 fragments
but nfct check in br_nf_dev_queue_xmit does not allow re-fragment combined
packet back, and therefore it is dropped in br_dev_queue_push_xmit without
incrementing of any failcounters

It seems the only way to hit the ip_fragment code in the bridge xmit
path is to have a fragment list whose reassembled fragments go over
the mtu. This only happens if nf_defrag is enabled. Thanks to
Florian Westphal for providing feedback to clarify this.

Defragmentation ipv4 is required not only in conntracks but at least in
TPROXY target and socket match, therefore #ifdef is changed from
NF_CONNTRACK_IPV4 to NF_DEFRAG_IPV4
Signed-off-by: default avatarVasily Averin <vvs@openvz.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      aff09ce3
    • Vasily Averin's avatar
      ipv4: fix "conntrack zones" support for defrag user check in ip_expire · 7c3d5ab1
      Vasily Averin authored 
      Defrag user check in ip_expire was not updated after adding support for
"conntrack zones".

This bug manifests as a RFC violation, since the router will send
the icmp time exceeeded message when using conntrack zones.
Signed-off-by: default avatarVasily Averin <vvs@openvz.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      7c3d5ab1
  13. 04 May, 2014 2 commits
    • Denys Fedoryshchenko's avatar
      netfilter: nfnetlink: Fix use after free when it fails to process batch · ecd15dd7
      Denys Fedoryshchenko authored 
      This bug manifests when calling the nft command line tool without
nf_tables kernel support.

kernel message:
[   44.071555] Netfilter messages via NETLINK v0.30.
[   44.072253] BUG: unable to handle kernel NULL pointer dereference at 0000000000000119
[   44.072264] IP: [<ffffffff8171db1f>] netlink_getsockbyportid+0xf/0x70
[   44.072272] PGD 7f2b74067 PUD 7f2b73067 PMD 0
[   44.072277] Oops: 0000 [#1] SMP
[...]
[   44.072369] Call Trace:
[   44.072373]  [<ffffffff8171fd81>] netlink_unicast+0x91/0x200
[   44.072377]  [<ffffffff817206c9>] netlink_ack+0x99/0x110
[   44.072381]  [<ffffffffa004b951>] nfnetlink_rcv+0x3c1/0x408 [nfnetlink]
[   44.072385]  [<ffffffff8171fde3>] netlink_unicast+0xf3/0x200
[   44.072389]  [<ffffffff817201ef>] netlink_sendmsg+0x2ff/0x740
[   44.072394]  [<ffffffff81044752>] ? __mmdrop+0x62/0x90
[   44.072398]  [<ffffffff816dafdb>] sock_sendmsg+0x8b/0xc0
[   44.072403]  [<ffffffff812f1af5>] ? copy_user_enhanced_fast_string+0x5/0x10
[   44.072406]  [<ffffffff816dbb6c>] ? move_addr_to_kernel+0x2c/0x50
[   44.072410]  [<ffffffff816db423>] ___sys_sendmsg+0x3c3/0x3d0
[   44.072415]  [<ffffffff811301ba>] ? handle_mm_fault+0xa9a/0xc60
[   44.072420]  [<ffffffff811362d6>] ? mmap_region+0x166/0x5a0
[   44.072424]  [<ffffffff817da84c>] ? __do_page_fault+0x1dc/0x510
[   44.072428]  [<ffffffff812b8b2c>] ? apparmor_capable+0x1c/0x60
[   44.072435]  [<ffffffff817d6e9a>] ? _raw_spin_unlock_bh+0x1a/0x20
[   44.072439]  [<ffffffff816dfc86>] ? release_sock+0x106/0x150
[   44.072443]  [<ffffffff816dc212>] __sys_sendmsg+0x42/0x80
[   44.072446]  [<ffffffff816dc262>] SyS_sendmsg+0x12/0x20
[   44.072450]  [<ffffffff817df616>] system_call_fastpath+0x1a/0x1f
Signed-off-by: default avatarDenys Fedoryshchenko <nuclearcat@nuclearcat.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      ecd15dd7
    • Florian Westphal's avatar
      netfilter: ipv4: defrag: set local_df flag on defragmented skb · 895162b1
      Florian Westphal authored 
      else we may fail to forward skb even if original fragments do fit
outgoing link mtu:

1. remote sends 2k packets in two 1000 byte frags, DF set
2. we want to forward but only see '2k > mtu and DF set'
3. we then send icmp error saying that outgoing link is 1500

But original sender never sent a packet that would not fit
the outgoing link.

Setting local_df makes outgoing path test size vs.
IPCB(skb)->frag_max_size, so we will still send the correct
error in case the largest original size did not fit
outgoing link mtu.
Reported-by: default avatarMaxime Bizon <mbizon@freebox.fr>
Suggested-by: default avatarMaxime Bizon <mbizon@freebox.fr>
Fixes: 5f2d04f1 (ipv4: fix path MTU discovery with connection tracking)
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      895162b1
  15. 29 Apr, 2014 1 commit
  17. 28 Apr, 2014 12 commits
  19. 27 Apr, 2014 5 commits
  21. 26 Apr, 2014 10 commits
    • Jacob Keller's avatar
      i40e: fix Timesync Tx interrupt handler code · cafa1fca
      Jacob Keller authored 
      This patch fixes the PTP Tx timestamp interrupt handler. The original
code misinterpreted the interrupt handler design. We were clearing the
ena_mask bit for the Timesync interrupts. This is done to indicate that
the interrupt will be handled in a scheduled work item (instead of
immediately) and that work item is responsible for re-enabling the
interrupts. However, the Tx timestamp was being handled immediately and
nothing was ever re-enabling it. This resulted in a single interrupt
working for the life of the driver.

This patch fixes the issue by instead clearing the bit from icr0 which
is used to indicate that the interrupt was immediately handled and can
be re-enabled right away. This patch also clears up a related issue due
to writing the PRTTSYN_STAT_0 register, which was unintentionally
clearing the cause bits for Timesync interrupts.

Change-ID: I057bd70d53c302f60fab78246989cbdfa469d83b
Signed-off-by: default avatarJacob Keller <jacob.e.keller@intel.com>
Acked-by: default avatarAnjali Singhai Jain <anjali.singhai@intel.com>
Acked-by: default avatarShannon Nelson <shannon.nelson@intel.com>
Tested-by: default avatarKavindya Deegala <kavindya.s.deegala@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cafa1fca
    • David S. Miller's avatar
      Merge tag 'linux-can-fixes-for-3.15-20140424' of git://gitorious.org/linux-can/linux-can · 69d268b7
      David S. Miller authored 
      Marc Kleine-Budde says:

====================
this is a pull request for net/master, for the v3.15 release cycle, consisting
of 26 patches.

Thomas Gleixner contributes 21 patches for the c_can driver, which address
several shortcomings in the driver like hardware initialisation, concurrency,
message ordering and poor performance. Two patches Oliver Hartkopp, one adds a
missing lock to the sja1000_isa driver, the other one fixes the return value in
the generic bit time configuration function. And finally a patch by Alexander
Stein, that fixes the slcan driver to use the correct spinlock variant.

To make it 26 patches, Wolfgang Grandegger patch for the c_can_pci
driver, which enables the bus master only for MSI and a patch by
Wolfram Sang, which converts the 'instance' in the c_can driver to the
proper type.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      69d268b7
    • David S. Miller's avatar
      Merge branch 'altera_tse' · 2b24f192
      David S. Miller authored 
      Vince Bridgers says:

====================
This series of patches addresses a handful of issues found in testing
and reported by users of the Altera Triple Speed Ethernet soft IP.

The patches address the following issues (in summary)

1) The SGDMA soft IP was found to incorrectly process receive packets
   when the target physical address of the receive buffer was on
   a boundary that's not 32-bit aligned. One of the patches addresses
   this issue.
2) The pause quanta was not being set by the driver, one patch of this
   series sets the pause quanta to the IEEE defined default value
   since the hardware reset value is 0.
3) An issue in a error recovery path of the probe routine caused a
   kernel panic in the event a phy was probed and could not be found.
   A patch addresses this issue.
4) A change was made to the driver name for Ethtool support, and
   comments added to support an addition to Ethtool to support
   the Altera Triple Speed Ethernet controller.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2b24f192
    • Vince Bridgers's avatar
      Altera TSE: Change driver name used by Ethtool · 99514e11
      Vince Bridgers authored 
      This patch changes the name used by Ethtool to something more
conventional in preparation for TSE Ethtool register dump
support to be added in the near future.
Signed-off-by: default avatarVince Bridgers <vbridgers2013@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      99514e11
    • Vince Bridgers's avatar
      Altera TSE: Fix Panic in probe routine when phy probe fails · a7642009
      Vince Bridgers authored 
      This patch addresses a fault in the error recovery path of the probe
routine where the netdev structure was not being unregistered properly
leading to a panic only when the phy probe failed.

Abbreviated panic stack seen is as follows:

(free_netdev+0xXX) from (altera_tse_probe+0xXX)
(altera_tse_probe+0xXX) from (platform_drv_probe+0xXX)
(platform_drv_probe+0xXX) from (driver_probe_device+0xXX)
(driver_probe_device+0xXX) from (__driver_attach+0xXX)
(__driver_attach+0xXX) from (bus_for_each_dev+0xXX)
(bus_for_each_dev+0xXX) from (driver_attach+0xXX)
(driver_attach+0xXX) from (bus_add_driver+0xXX)
(bus_add_driver+0xXX) from (driver_register+0xXX)
(driver_register+0xXX) from (__platform_driver_register+0xXX)
(__platform_driver_register+0xXX) from (altera_tse_driver_init+0xXX)
(altera_tse_driver_init+0xXX) from (do_one_initcall+0xXX)
(do_one_initcall+0xXX) from (kernel_init_freeable+0xXX)
(kernel_init_freeable+0xXX) from (kernel_init+0xXX)
(kernel_init+0xXX) from (ret_from_fork+0xXX)
Signed-off-by: default avatarVince Bridgers <vbridgers2013@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a7642009
    • Vince Bridgers's avatar
      Altera TSE: Set the Pause Quanta value to the IEEE default value · 5aec4ee3
      Vince Bridgers authored 
      This patch initializes the pause quanta set for transmitted pause frames
to the IEEE specified default of 0xffff.
Signed-off-by: default avatarVince Bridgers <vbridgers2013@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5aec4ee3
    • Vince Bridgers's avatar
      Altera TSE: Work around unaligned DMA receive packet issue with Altera SGDMA · 37c0ffaa
      Vince Bridgers authored 
      This patch works around a recently discovered unaligned receive dma problem
with the Altera SGMDA. The Altera SGDMA component cannot be configured to
DMA data to unaligned addresses for receive packet operations from the
Triple Speed Ethernet component because of a potential data transfer
corruption that can occur. This patch addresses this issue by
utilizing the shift 16 bits feature of the Altera Triple Speed Ethernet
component and modifying the receive buffer physical addresses accordingly
such that the target receive DMA address is always aligned on a 32-bit
boundary.
Signed-off-by: default avatarVince Bridgers <vbridgers2013@gmail.com>
Tested-by: default avatarMatthew Gerlach <mgerlach@altera.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      37c0ffaa
    • David S. Miller's avatar
      Merge branch 'bnx2x-net' · c2163260
      David S. Miller authored 
      Yuval Mintz says:

====================
bnx2x: SRIOV bug fixes

This series contains 3 SRIOV bug fixes, 2 of which are regressions starting
with commit 2dc33bbc "bnx2x: Remove the sriov VFOP mechanism".
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c2163260
    • Narender Kumar's avatar
      bnx2x: Fix failure to configure VF multicast filters · ab15f86b
      Narender Kumar authored 
      Commit 2dc33bbc "bnx2x: Remove the sriov VFOP mechanism" caused a regression,
preventing VFs from configuring multicast filters.
Signed-off-by: default avatarNaredner Kumar <narender.kumar@qlogic.com>
Signed-off-by: default avatarYuval Mintz <Yuval.Mintz@qlogic.com>
Signed-off-by: default avatarAriel Elior <Ariel.Elior@qlogic.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ab15f86b
    • Yuval Mintz's avatar
      bnx2x: Fix vlan credit issues for VFs · 1a3d9424
      Yuval Mintz authored 
      Starting with commit 2dc33bbc "bnx2x: Remove the sriov VFOP mechanism",
the bnx2x started enforcing vlan credits for all vlan configurations.
This exposed 2 issues:
  - Vlan credits are not returned once a VF is removed; this causes a leak
    of credits, and eventually will lead to VFs with no vlan credits.
  - A vlan credit must be set aside for the Hypervisor to use, and should
    not be visible to the VF.

Although linux VFs at the moment do not support vlan configuration [from the
VF side] which causes them to be resilient to this sort of issue, Windows VF
over linux hypervisors might fail to load as the vlan credits become depleted.
Signed-off-by: default avatarYuval Mintz <Yuval.Mintz@qlogic.com>
Signed-off-by: default avatarAriel Elior <Ariel.Elior@qlogic.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1a3d9424
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7