linux-toradex.git, branch v4.14-rc7

Linux 4.14-rc7

2017-10-29T20:58:38+00:00

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-10-29T15:11:49+00:00

Pull networking fixes from David Miller:

 1) Fix route leak in xfrm_bundle_create().

 2) In mac80211, validate user rate mask before configuring it. From
    Johannes Berg.

 3) Properly enforce memory limits in fair queueing code, from Toke
    Hoiland-Jorgensen.

 4) Fix lockdep splat in inet_csk_route_req(), from Eric Dumazet.

 5) Fix TSO header allocation and management in mvpp2 driver, from Yan
    Markman.

 6) Don't take socket lock in BH handler in strparser code, from Tom
    Herbert.

 7) Don't show sockets from other namespaces in AF_UNIX code, from
    Andrei Vagin.

 8) Fix double free in error path of tap_open(), from Girish Moodalbail.

 9) Fix TX map failure path in igb and ixgbe, from Jean-Philippe Brucker
    and Alexander Duyck.

10) Fix DCB mode programming in stmmac driver, from Jose Abreu.

11) Fix err_count handling in various tunnels (ipip, ip6_gre). From Xin
    Long.

12) Properly align SKB head before building SKB in tuntap, from Jason
    Wang.

13) Avoid matching qdiscs with a zero handle during lookups, from Cong
    Wang.

14) Fix various endianness bugs in sctp, from Xin Long.

15) Fix tc filter callback races and add selftests which trigger the
    problem, from Cong Wang.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (73 commits)
  selftests: Introduce a new test case to tc testsuite
  selftests: Introduce a new script to generate tc batch file
  net_sched: fix call_rcu() race on act_sample module removal
  net_sched: add rtnl assertion to tcf_exts_destroy()
  net_sched: use tcf_queue_work() in tcindex filter
  net_sched: use tcf_queue_work() in rsvp filter
  net_sched: use tcf_queue_work() in route filter
  net_sched: use tcf_queue_work() in u32 filter
  net_sched: use tcf_queue_work() in matchall filter
  net_sched: use tcf_queue_work() in fw filter
  net_sched: use tcf_queue_work() in flower filter
  net_sched: use tcf_queue_work() in flow filter
  net_sched: use tcf_queue_work() in cgroup filter
  net_sched: use tcf_queue_work() in bpf filter
  net_sched: use tcf_queue_work() in basic filter
  net_sched: introduce a workqueue for RCU callbacks of tc filter
  sctp: fix some type cast warnings introduced since very beginning
  sctp: fix a type cast warnings that causes a_rwnd gets the wrong value
  sctp: fix some type cast warnings introduced by transport rhashtable
  sctp: fix some type cast warnings introduced by stream reconf
  ...

Merge branch 'net_sched-fix-races-with-RCU-callbacks'

2017-10-29T13:49:32+00:00

Cong Wang says:

====================
net_sched: fix races with RCU callbacks

Recently, the RCU callbacks used in TC filters and TC actions keep
drawing my attention, they introduce at least 4 race condition bugs:

1. A simple one fixed by Daniel:

commit c78e1746d3ad7d548bdf3fe491898cc453911a49
Author: Daniel Borkmann 
Date:   Wed May 20 17:13:33 2015 +0200

    net: sched: fix call_rcu() race on classifier module unloads

2. A very nasty one fixed by me:

commit 1697c4bb5245649a23f06a144cc38c06715e1b65
Author: Cong Wang 
Date:   Mon Sep 11 16:33:32 2017 -0700

    net_sched: carefully handle tcf_block_put()

3. Two more bugs found by Chris:
https://patchwork.ozlabs.org/patch/826696/
https://patchwork.ozlabs.org/patch/826695/

Usually RCU callbacks are simple, however for TC filters and actions,
they are complex because at least TC actions could be destroyed
together with the TC filter in one callback. And RCU callbacks are
invoked in BH context, without locking they are parallel too. All of
these contribute to the cause of these nasty bugs.

Alternatively, we could also:

a) Introduce a spinlock to serialize these RCU callbacks. But as I
said in commit 1697c4bb5245 ("net_sched: carefully handle
tcf_block_put()"), it is very hard to do because of tcf_chain_dump().
Potentially we need to do a lot of work to make it possible (if not
impossible).

b) Just get rid of these RCU callbacks, because they are not
necessary at all, callers of these call_rcu() are all on slow paths
and holding RTNL lock, so blocking is allowed in their contexts.
However, David and Eric dislike adding synchronize_rcu() here.

As suggested by Paul, we could defer the work to a workqueue and
gain the permission of holding RTNL again without any performance
impact, however, in tcf_block_put() we could have a deadlock when
flushing workqueue while hodling RTNL lock, the trick here is to
defer the work itself in workqueue and make it queued after all
other works so that we keep the same ordering to avoid any
use-after-free. Please see the first patch for details.

Patch 1 introduces the infrastructure, patch 2~12 move each
tc filter to the new tc filter workqueue, patch 13 adds
an assertion to catch potential bugs like this, patch 14
closes another rcu callback race, patch 15 and patch 16 add
new test cases.
====================

Reported-by: Chris Mi 
Cc: Daniel Borkmann 
Cc: Jiri Pirko 
Cc: John Fastabend 
Cc: Jamal Hadi Salim 
Cc: "Paul E. McKenney" 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

selftests: Introduce a new test case to tc testsuite

2017-10-29T13:49:31+00:00

In this patchset, we fixed a tc bug. This patch adds the test case
that reproduces the bug. To run this test case, user should specify
an existing NIC device:
  # sudo ./tdc.py -d enp4s0f0

This test case belongs to category "flower". If user doesn't specify
a NIC device, the test cases belong to "flower" will not be run.

In this test case, we create 1M filters and all filters share the same
action. When destroying all filters, kernel should not panic. It takes
about 18s to run it.

Acked-by: Jamal Hadi Salim 
Acked-by: Lucas Bates 
Signed-off-by: Chris Mi 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

selftests: Introduce a new script to generate tc batch file

2017-10-29T13:49:31+00:00

  # ./tdc_batch.py -h
  usage: tdc_batch.py [-h] [-n NUMBER] [-o] [-s] [-p] device file

  TC batch file generator

  positional arguments:
    device                device name
    file                  batch file name

  optional arguments:
    -h, --help            show this help message and exit
    -n NUMBER, --number NUMBER
                          how many lines in batch file
    -o, --skip_sw         skip_sw (offload), by default skip_hw
    -s, --share_action    all filters share the same action
    -p, --prio            all filters have different prio

Acked-by: Jamal Hadi Salim 
Acked-by: Lucas Bates 
Signed-off-by: Chris Mi 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

net_sched: fix call_rcu() race on act_sample module removal

2017-10-29T13:49:31+00:00

Similar to commit c78e1746d3ad
("net: sched: fix call_rcu() race on classifier module unloads"),
we need to wait for flying RCU callback tcf_sample_cleanup_rcu().

Cc: Yotam Gigi 
Cc: Daniel Borkmann 
Cc: Jiri Pirko 
Cc: Jamal Hadi Salim 
Cc: "Paul E. McKenney" 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

net_sched: add rtnl assertion to tcf_exts_destroy()

2017-10-29T13:49:31+00:00

After previous patches, it is now safe to claim that
tcf_exts_destroy() is always called with RTNL lock.

Cc: Daniel Borkmann 
Cc: Jiri Pirko 
Cc: John Fastabend 
Cc: Jamal Hadi Salim 
Cc: "Paul E. McKenney" 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

net_sched: use tcf_queue_work() in tcindex filter

2017-10-29T13:49:31+00:00

Defer the tcf_exts_destroy() in RCU callback to
tc filter workqueue and get RTNL lock.

Reported-by: Chris Mi 
Cc: Daniel Borkmann 
Cc: Jiri Pirko 
Cc: John Fastabend 
Cc: Jamal Hadi Salim 
Cc: "Paul E. McKenney" 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

net_sched: use tcf_queue_work() in rsvp filter

2017-10-29T13:49:31+00:00

Defer the tcf_exts_destroy() in RCU callback to
tc filter workqueue and get RTNL lock.

Reported-by: Chris Mi 
Cc: Daniel Borkmann 
Cc: Jiri Pirko 
Cc: John Fastabend 
Cc: Jamal Hadi Salim 
Cc: "Paul E. McKenney" 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

net_sched: use tcf_queue_work() in route filter

2017-10-29T13:49:31+00:00

Defer the tcf_exts_destroy() in RCU callback to
tc filter workqueue and get RTNL lock.

Reported-by: Chris Mi 
Cc: Daniel Borkmann 
Cc: Jiri Pirko 
Cc: John Fastabend 
Cc: Jamal Hadi Salim 
Cc: "Paul E. McKenney" 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller