1. 03 Sep, 2020 6 commits
    • Ursula Braun's avatar
      net/smc: fix sock refcounting in case of termination · 5fb8642a
      Ursula Braun authored
      When an ISM device is removed, all its linkgroups are terminated,
      i.e. all the corresponding connections are killed.
      Connection killing invokes smc_close_active_abort(), which decreases
      the sock refcount for certain states to simulate passive closing.
      And it cancels the close worker and has to give up the sock lock for
      this timeframe. This opens the door for a passive close worker or a
      socket close to run in between. In this case smc_close_active_abort() and
      passive close worker resp. smc_release() might do a sock_put for passive
      closing. This causes:
      
      [ 1323.315943] refcount_t: underflow; use-after-free.
      [ 1323.316055] WARNING: CPU: 3 PID: 54469 at lib/refcount.c:28 refcount_warn_saturate+0xe8/0x130
      [ 1323.316069] Kernel panic - not syncing: panic_on_warn set ...
      [ 1323.316084] CPU: 3 PID: 54469 Comm: uperf Not tainted 5.9.0-20200826.rc2.git0.46328853ed20.300.fc32.s390x+debug #1
      [ 1323.316096] Hardware name: IBM 2964 NC9 702 (z/VM 6.4.0)
      [ 1323.316108] Call Trace:
      [ 1323.316125]  [<00000000c0d4aae8>] show_stack+0x90/0xf8
      [ 1323.316143]  [<00000000c15989b0>] dump_stack+0xa8/0xe8
      [ 1323.316158]  [<00000000c0d8344e>] panic+0x11e/0x288
      [ 1323.316173]  [<00000000c0d83144>] __warn+0xac/0x158
      [ 1323.316187]  [<00000000c1597a7a>] report_bug+0xb2/0x130
      [ 1323.316201]  [<00000000c0d36424>] monitor_event_exception+0x44/0xc0
      [ 1323.316219]  [<00000000c195c716>] pgm_check_handler+0x1da/0x238
      [ 1323.316234]  [<00000000c151844c>] refcount_warn_saturate+0xec/0x130
      [ 1323.316280] ([<00000000c1518448>] refcount_warn_saturate+0xe8/0x130)
      [ 1323.316310]  [<000003ff801f2e2a>] smc_release+0x192/0x1c8 [smc]
      [ 1323.316323]  [<00000000c169f1fa>] __sock_release+0x5a/0xe0
      [ 1323.316334]  [<00000000c169f2ac>] sock_close+0x2c/0x40
      [ 1323.316350]  [<00000000c1086de0>] __fput+0xb8/0x278
      [ 1323.316362]  [<00000000c0db1e0e>] task_work_run+0x76/0xb8
      [ 1323.316393]  [<00000000c0d8ab84>] do_exit+0x26c/0x520
      [ 1323.316408]  [<00000000c0d8af08>] do_group_exit+0x48/0xc0
      [ 1323.316421]  [<00000000c0d8afa8>] __s390x_sys_exit_group+0x28/0x38
      [ 1323.316433]  [<00000000c195c32c>] system_call+0xe0/0x2b4
      [ 1323.316446] 1 lock held by uperf/54469:
      [ 1323.316456]  #0: 0000000044125e60 (&sb->s_type->i_mutex_key#9){+.+.}-{3:3}, at: __sock_release+0x44/0xe0
      
      The patch rechecks sock state in smc_close_active_abort() after
      smc_close_cancel_work() to avoid duplicate decrease of sock
      refcount for the same purpose.
      
      Fixes: 611b63a1 ("net/smc: cancel tx worker in case of socket aborts")
      Reviewed-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
      Signed-off-by: default avatarUrsula Braun <ubraun@linux.ibm.com>
      Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5fb8642a
    • Ursula Braun's avatar
      net/smc: reset sndbuf_desc if freed · 1d8df41d
      Ursula Braun authored
      When an SMC connection is created, and there is a problem to
      create an RMB or DMB, the previously created send buffer is
      thrown away as well including buffer descriptor freeing.
      Make sure the connection no longer references the freed
      buffer descriptor, otherwise bugs like this are possible:
      
      [71556.835148] =============================================================================
      [71556.835168] BUG kmalloc-128 (Tainted: G    B      OE    ): Poison overwritten
      [71556.835172] -----------------------------------------------------------------------------
      
      [71556.835179] INFO: 0x00000000d20894be-0x00000000aaef63e9 @offset=2724. First byte 0x0 instead of 0x6b
      [71556.835215] INFO: Allocated in __smc_buf_create+0x184/0x578 [smc] age=0 cpu=5 pid=46726
      [71556.835234]     ___slab_alloc+0x5a4/0x690
      [71556.835239]     __slab_alloc.constprop.0+0x70/0xb0
      [71556.835243]     kmem_cache_alloc_trace+0x38e/0x3f8
      [71556.835250]     __smc_buf_create+0x184/0x578 [smc]
      [71556.835257]     smc_buf_create+0x2e/0xe8 [smc]
      [71556.835264]     smc_listen_work+0x516/0x6a0 [smc]
      [71556.835275]     process_one_work+0x280/0x478
      [71556.835280]     worker_thread+0x66/0x368
      [71556.835287]     kthread+0x17a/0x1a0
      [71556.835294]     ret_from_fork+0x28/0x2c
      [71556.835301] INFO: Freed in smc_buf_create+0xd8/0xe8 [smc] age=0 cpu=5 pid=46726
      [71556.835307]     __slab_free+0x246/0x560
      [71556.835311]     kfree+0x398/0x3f8
      [71556.835318]     smc_buf_create+0xd8/0xe8 [smc]
      [71556.835324]     smc_listen_work+0x516/0x6a0 [smc]
      [71556.835328]     process_one_work+0x280/0x478
      [71556.835332]     worker_thread+0x66/0x368
      [71556.835337]     kthread+0x17a/0x1a0
      [71556.835344]     ret_from_fork+0x28/0x2c
      [71556.835348] INFO: Slab 0x00000000a0744551 objects=51 used=51 fp=0x0000000000000000 flags=0x1ffff00000010200
      [71556.835352] INFO: Object 0x00000000563480a1 @offset=2688 fp=0x00000000289567b2
      
      [71556.835359] Redzone 000000006783cde2: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
      [71556.835363] Redzone 00000000e35b876e: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
      [71556.835367] Redzone 0000000023074562: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
      [71556.835372] Redzone 00000000b9564b8c: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
      [71556.835376] Redzone 00000000810c6362: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
      [71556.835380] Redzone 0000000065ef52c3: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
      [71556.835384] Redzone 00000000c5dd6984: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
      [71556.835388] Redzone 000000004c480f8f: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
      [71556.835392] Object 00000000563480a1: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      [71556.835397] Object 000000009c479d06: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      [71556.835401] Object 000000006e1dce92: 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b  kkkk....kkkkkkkk
      [71556.835405] Object 00000000227f7cf8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      [71556.835410] Object 000000009a701215: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      [71556.835414] Object 000000003731ce76: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      [71556.835418] Object 00000000f7085967: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      [71556.835422] Object 0000000007f99927: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  kkkkkkkkkkkkkkk.
      [71556.835427] Redzone 00000000579c4913: bb bb bb bb bb bb bb bb                          ........
      [71556.835431] Padding 00000000305aef82: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
      [71556.835435] Padding 00000000b1cdd722: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
      [71556.835438] Padding 00000000c7568199: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
      [71556.835442] Padding 00000000fad4c4d4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
      [71556.835451] CPU: 0 PID: 47939 Comm: kworker/0:15 Tainted: G    B      OE     5.9.0-rc1uschi+ #54
      [71556.835456] Hardware name: IBM 3906 M03 703 (LPAR)
      [71556.835464] Workqueue: events smc_listen_work [smc]
      [71556.835470] Call Trace:
      [71556.835478]  [<00000000d5eaeb10>] show_stack+0x90/0xf8
      [71556.835493]  [<00000000d66fc0f8>] dump_stack+0xa8/0xe8
      [71556.835499]  [<00000000d61a511c>] check_bytes_and_report+0x104/0x130
      [71556.835504]  [<00000000d61a57b2>] check_object+0x26a/0x2e0
      [71556.835509]  [<00000000d61a59bc>] alloc_debug_processing+0x194/0x238
      [71556.835514]  [<00000000d61a8c14>] ___slab_alloc+0x5a4/0x690
      [71556.835519]  [<00000000d61a9170>] __slab_alloc.constprop.0+0x70/0xb0
      [71556.835524]  [<00000000d61aaf66>] kmem_cache_alloc_trace+0x38e/0x3f8
      [71556.835530]  [<000003ff80549bbc>] __smc_buf_create+0x184/0x578 [smc]
      [71556.835538]  [<000003ff8054a396>] smc_buf_create+0x2e/0xe8 [smc]
      [71556.835545]  [<000003ff80540c16>] smc_listen_work+0x516/0x6a0 [smc]
      [71556.835549]  [<00000000d5f0f448>] process_one_work+0x280/0x478
      [71556.835554]  [<00000000d5f0f6a6>] worker_thread+0x66/0x368
      [71556.835559]  [<00000000d5f18692>] kthread+0x17a/0x1a0
      [71556.835563]  [<00000000d6abf3b8>] ret_from_fork+0x28/0x2c
      [71556.835569] INFO: lockdep is turned off.
      [71556.835573] FIX kmalloc-128: Restoring 0x00000000d20894be-0x00000000aaef63e9=0x6b
      
      [71556.835577] FIX kmalloc-128: Marking all objects used
      
      Fixes: fd7f3a74 ("net/smc: remove freed buffer from list")
      Reviewed-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
      Signed-off-by: default avatarUrsula Braun <ubraun@linux.ibm.com>
      Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1d8df41d
    • Ursula Braun's avatar
      net/smc: set rx_off for SMCR explicitly · 2d2bfeb8
      Ursula Braun authored
      SMC tries to make use of SMCD first. If a problem shows up,
      it tries to switch to SMCR. If the SMCD initializing problem shows
      up after the SMCD connection has already been initialized, field
      rx_off keeps the wrong SMCD value for SMCR, which results in corrupted
      data at the receiver.
      This patch adds an explicit (re-)setting of field rx_off to zero if the
      connection uses SMCR.
      
      Fixes: be244f28 ("net/smc: add SMC-D support in data transfer")
      Reviewed-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
      Signed-off-by: default avatarUrsula Braun <ubraun@linux.ibm.com>
      Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2d2bfeb8
    • Karsten Graul's avatar
      net/smc: fix toleration of fake add_link messages · fffe83c8
      Karsten Graul authored
      Older SMCR implementations had no link failover support and used one
      link only. Because the handshake protocol requires to try the
      establishment of a second link the old code sent a fake add_link message
      and declined any server response afterwards.
      The current code supports multiple links and inspects the received fake
      add_link message more closely. To tolerate the fake add_link messages
      smc_llc_is_local_add_link() needs an improved check of the message to
      be able to separate between locally enqueued and fake add_link messages.
      And smc_llc_cli_add_link() needs to check if the provided qp_mtu size is
      invalid and reject the add_link request in that case.
      
      Fixes: c48254fa ("net/smc: move add link processing for new device into llc layer")
      Reviewed-by: default avatarUrsula Braun <ubraun@linux.ibm.com>
      Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fffe83c8
    • Michael Chan's avatar
      tg3: Fix soft lockup when tg3_reset_task() fails. · 55669934
      Michael Chan authored
      If tg3_reset_task() fails, the device state is left in an inconsistent
      state with IFF_RUNNING still set but NAPI state not enabled.  A
      subsequent operation, such as ifdown or AER error can cause it to
      soft lock up when it tries to disable NAPI state.
      
      Fix it by bringing down the device to !IFF_RUNNING state when
      tg3_reset_task() fails.  tg3_reset_task() running from workqueue
      will now call tg3_close() when the reset fails.  We need to
      modify tg3_reset_task_cancel() slightly to avoid tg3_close()
      calling cancel_work_sync() to cancel tg3_reset_task().  Otherwise
      cancel_work_sync() will wait forever for tg3_reset_task() to
      finish.
      Reported-by: default avatarDavid Christensen <drc@linux.vnet.ibm.com>
      Reported-by: default avatarBaptiste Covolato <baptiste@arista.com>
      Fixes: db219973 ("tg3: Schedule at most one tg3_reset_task run")
      Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      55669934
    • Paul Barker's avatar
      doc: net: dsa: Fix typo in config code sample · af0ae997
      Paul Barker authored
      In the "single port" example code for configuring a DSA switch without
      tagging support from userspace the command to bring up the "lan2" link
      was typo'd.
      Signed-off-by: default avatarPaul Barker <pbarker@konsulko.com>
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      af0ae997
  2. 02 Sep, 2020 8 commits
  3. 01 Sep, 2020 4 commits
  4. 31 Aug, 2020 6 commits
    • Grygorii Strashko's avatar
      net: ethernet: ti: am65-cpsw: fix rmii 100Mbit link mode · c2f89219
      Grygorii Strashko authored
      In RMII link mode it's required to set bit 15 IFCTL_A in MAC_SL MAC_CONTROL
      register to enable support for 100Mbit link speed.
      
      Fixes: 93a76530 ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver")
      Signed-off-by: default avatarGrygorii Strashko <grygorii.strashko@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c2f89219
    • Potnuri Bharat Teja's avatar
      cxgb4: fix thermal zone device registration · 6b6382a8
      Potnuri Bharat Teja authored
      When multiple adapters are present in the system, pci hot-removing second
      adapter leads to the following warning as both the adapters registered
      thermal zone device with same thermal zone name/type.
      Therefore, use unique thermal zone name during thermal zone device
      initialization. Also mark thermal zone dev NULL once unregistered.
      
      [  414.370143] ------------[ cut here ]------------
      [  414.370944] sysfs group 'power' not found for kobject 'hwmon0'
      [  414.371747] WARNING: CPU: 9 PID: 2661 at fs/sysfs/group.c:281
       sysfs_remove_group+0x76/0x80
      [  414.382550] CPU: 9 PID: 2661 Comm: bash Not tainted 5.8.0-rc6+ #33
      [  414.383593] Hardware name: Supermicro X10SRA-F/X10SRA-F, BIOS 2.0a 06/23/2016
      [  414.384669] RIP: 0010:sysfs_remove_group+0x76/0x80
      [  414.385738] Code: 48 89 df 5b 5d 41 5c e9 d8 b5 ff ff 48 89 df e8 60 b0 ff ff
       eb cb 49 8b 14 24 48 8b 75 00 48 c7 c7 90 ae 13 bb e8 6a 27 d0 ff <0f> 0b 5b 5d
       41 5c c3 0f 1f 00 0f 1f 44 00 00 48 85 f6 74 31 41 54
      [  414.388404] RSP: 0018:ffffa22bc080fcb0 EFLAGS: 00010286
      [  414.389638] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
      [  414.390829] RDX: 0000000000000001 RSI: ffff8ee2de3e9510 RDI: ffff8ee2de3e9510
      [  414.392064] RBP: ffffffffbaef2ee0 R08: 0000000000000000 R09: 0000000000000000
      [  414.393224] R10: 0000000000000000 R11: 000000002b30006c R12: ffff8ee260720008
      [  414.394388] R13: ffff8ee25e0a40e8 R14: ffffa22bc080ff08 R15: ffff8ee2c3be5020
      [  414.395661] FS:  00007fd2a7171740(0000) GS:ffff8ee2de200000(0000)
       knlGS:0000000000000000
      [  414.396825] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  414.398011] CR2: 00007f178ffe5020 CR3: 000000084c5cc003 CR4: 00000000003606e0
      [  414.399172] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  414.400352] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [  414.401473] Call Trace:
      [  414.402685]  device_del+0x89/0x400
      [  414.403819]  device_unregister+0x16/0x60
      [  414.405024]  hwmon_device_unregister+0x44/0xa0
      [  414.406112]  thermal_remove_hwmon_sysfs+0x196/0x200
      [  414.407256]  thermal_zone_device_unregister+0x1b5/0x1f0
      [  414.408415]  cxgb4_thermal_remove+0x3c/0x4f [cxgb4]
      [  414.409668]  remove_one+0x212/0x290 [cxgb4]
      [  414.410875]  pci_device_remove+0x36/0xb0
      [  414.412004]  device_release_driver_internal+0xe2/0x1c0
      [  414.413276]  pci_stop_bus_device+0x64/0x90
      [  414.414433]  pci_stop_and_remove_bus_device_locked+0x16/0x30
      [  414.415609]  remove_store+0x75/0x90
      [  414.416790]  kernfs_fop_write+0x114/0x1b0
      [  414.417930]  vfs_write+0xcf/0x210
      [  414.419059]  ksys_write+0xa7/0xe0
      [  414.420120]  do_syscall_64+0x4c/0xa0
      [  414.421278]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [  414.422335] RIP: 0033:0x7fd2a686afd0
      [  414.423396] Code: Bad RIP value.
      [  414.424549] RSP: 002b:00007fffc1446148 EFLAGS: 00000246 ORIG_RAX:
       0000000000000001
      [  414.425638] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd2a686afd0
      [  414.426830] RDX: 0000000000000002 RSI: 00007fd2a7196000 RDI: 0000000000000001
      [  414.427927] RBP: 00007fd2a7196000 R08: 000000000000000a R09: 00007fd2a7171740
      [  414.428923] R10: 00007fd2a7171740 R11: 0000000000000246 R12: 00007fd2a6b43400
      [  414.430082] R13: 0000000000000002 R14: 0000000000000001 R15: 0000000000000000
      [  414.431027] irq event stamp: 76300
      [  414.435678] ---[ end trace 13865acb4d5ab00f ]---
      
      Fixes: b1871915 ("cxgb4: Add thermal zone support")
      Signed-off-by: default avatarPotnuri Bharat Teja <bharat@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6b6382a8
    • Xie He's avatar
      drivers/net/wan/hdlc_cisco: Add hard_header_len · 1a545ebe
      Xie He authored
      This driver didn't set hard_header_len. This patch sets hard_header_len
      for it according to its header_ops->create function.
      
      This driver's header_ops->create function (cisco_hard_header) creates
      a header of (struct hdlc_header), so hard_header_len should be set to
      sizeof(struct hdlc_header).
      
      Cc: Martin Schiller <ms@dev.tdt.de>
      Signed-off-by: default avatarXie He <xie.he.0141@gmail.com>
      Acked-by: default avatarKrzysztof Halasa <khc@pm.waw.pl>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1a545ebe
    • Shannon Nelson's avatar
      ionic: fix txrx work accounting · 9dda5110
      Shannon Nelson authored
      Take the tx accounting out of the work_done calculation to
      prevent a possible duplicate napi_schedule call when under
      high Tx stress but low Rx traffic.
      
      Fixes: b14e4e95 ("ionic: tx separate servicing")
      Signed-off-by: default avatarShannon Nelson <snelson@pensando.io>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9dda5110
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · e9d572d9
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for net:
      
      1) Do not delete clash entries on reply, let them expire instead,
         from Florian Westphal.
      
      2) Do not report EAGAIN to nfnetlink, otherwise this enters a busy loop.
         Update nfnetlink_unicast() to translate EAGAIN to ENOBUFS.
      
      3) Remove repeated words in code comments, from Randy Dunlap.
      
      4) Several patches for the flowtable selftests, from Fabian Frederick.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e9d572d9
    • Tuong Lien's avatar
      tipc: fix using smp_processor_id() in preemptible · bb8872a1
      Tuong Lien authored
      The 'this_cpu_ptr()' is used to obtain the AEAD key' TFM on the current
      CPU for encryption, however the execution can be preemptible since it's
      actually user-space context, so the 'using smp_processor_id() in
      preemptible' has been observed.
      
      We fix the issue by using the 'get/put_cpu_ptr()' API which consists of
      a 'preempt_disable()' instead.
      
      Fixes: fc1b6d6d ("tipc: introduce TIPC encryption & authentication")
      Acked-by: default avatarJon Maloy <jmaloy@redhat.com>
      Signed-off-by: default avatarTuong Lien <tuong.t.lien@dektech.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bb8872a1
  5. 29 Aug, 2020 1 commit
    • Florian Westphal's avatar
      netfilter: conntrack: do not auto-delete clash entries on reply · c4617214
      Florian Westphal authored
      Its possible that we have more than one packet with the same ct tuple
      simultaneously, e.g. when an application emits n packets on same UDP
      socket from multiple threads.
      
      NAT rules might be applied to those packets. With the right set of rules,
      n packets will be mapped to m destinations, where at least two packets end
      up with the same destination.
      
      When this happens, the existing clash resolution may merge the skb that
      is processed after the first has been received with the identical tuple
      already in hash table.
      
      However, its possible that this identical tuple is a NAT_CLASH tuple.
      In that case the second skb will be sent, but no reply can be received
      since the reply that is processed first removes the NAT_CLASH tuple.
      
      Do not auto-delete, this gives a 1 second window for replies to be passed
      back to originator.
      
      Packets that are coming later (udp stream case) will not be affected:
      they match the original ct entry, not a NAT_CLASH one.
      
      Also prevent NAT_CLASH entries from getting offloaded.
      
      Fixes: 6a757c07 ("netfilter: conntrack: allow insertion of clashing entries")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      c4617214
  6. 28 Aug, 2020 13 commits
  7. 27 Aug, 2020 2 commits
    • Dinghao Liu's avatar
      rxrpc: Fix memory leak in rxkad_verify_response() · b43c75ab
      Dinghao Liu authored
      Fix a memory leak in rxkad_verify_response() whereby the response buffer
      doesn't get freed if we fail to allocate a ticket buffer.
      
      Fixes: ef68622d ("rxrpc: Handle temporary errors better in rxkad security")
      Signed-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b43c75ab
    • David S. Miller's avatar
      Merge tag 'rxrpc-fixes-20200820' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs · 8d73a73a
      David S. Miller authored
      David Howells says:
      
      ====================
      rxrpc, afs: Fix probing issues
      
      Here are some fixes for rxrpc and afs to fix issues in the RTT measuring in
      rxrpc and thence the Volume Location server probing in afs:
      
       (1) Move the serial number of a received ACK into a local variable to
           simplify the next patch.
      
       (2) Fix the loss of RTT samples due to extra interposed ACKs causing
           baseline information to be discarded too early.  This is a particular
           problem for afs when it sends a single very short call to probe a
           server it hasn't talked to recently.
      
       (3) Fix rxrpc_kernel_get_srtt() to indicate whether it actually has seen
           any valid samples or not.
      
       (4) Remove a field that's set/woken, but never read/waited on.
      
       (5) Expose the RTT and other probe information through procfs to make
           debugging of this stuff easier.
      
       (6) Fix VL rotation in afs to only use summary information from VL probing
           and not the probe running state (which gets clobbered when next a
           probe is issued).
      
       (7) Fix VL rotation to actually return the error aggregated from the probe
           errors.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8d73a73a