<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/net/ppp, branch v4.11-rc1</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>sched/headers: Prepare to move signal wakeup &amp; sigpending methods from &lt;linux/sched.h&gt; into &lt;linux/sched/signal.h&gt;</title>
<updated>2017-03-02T07:42:32+00:00</updated>
<author>
<name>Ingo Molnar</name>
<email>mingo@kernel.org</email>
</author>
<published>2017-02-02T18:15:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=174cd4b1e5fbd0d74c68cf3a74f5bd4923485512'/>
<id>174cd4b1e5fbd0d74c68cf3a74f5bd4923485512</id>
<content type='text'>
Fix up affected files that include this signal functionality via sched.h.

Acked-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Cc: Mike Galbraith &lt;efault@gmx.de&gt;
Cc: Peter Zijlstra &lt;peterz@infradead.org&gt;
Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar &lt;mingo@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Fix up affected files that include this signal functionality via sched.h.

Acked-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Cc: Mike Galbraith &lt;efault@gmx.de&gt;
Cc: Peter Zijlstra &lt;peterz@infradead.org&gt;
Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar &lt;mingo@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: make ndo_get_stats64 a void function</title>
<updated>2017-01-08T22:51:44+00:00</updated>
<author>
<name>stephen hemminger</name>
<email>stephen@networkplumber.org</email>
</author>
<published>2017-01-07T03:12:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=bc1f44709cf27fb2a5766cadafe7e2ad5e9cb221'/>
<id>bc1f44709cf27fb2a5766cadafe7e2ad5e9cb221</id>
<content type='text'>
The network device operation for reading statistics is only called
in one place, and it ignores the return value. Having a structure
return value is potentially confusing because some future driver could
incorrectly assume that the return value was used.

Fix all drivers with ndo_get_stats64 to have a void function.

Signed-off-by: Stephen Hemminger &lt;sthemmin@microsoft.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The network device operation for reading statistics is only called
in one place, and it ignores the return value. Having a structure
return value is potentially confusing because some future driver could
incorrectly assume that the return value was used.

Fix all drivers with ndo_get_stats64 to have a void function.

Signed-off-by: Stephen Hemminger &lt;sthemmin@microsoft.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Replace &lt;asm/uaccess.h&gt; with &lt;linux/uaccess.h&gt; globally</title>
<updated>2016-12-24T19:46:01+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2016-12-24T19:46:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7c0f6ba682b9c7632072ffbedf8d328c8f3c42ba'/>
<id>7c0f6ba682b9c7632072ffbedf8d328c8f3c42ba</id>
<content type='text'>
This was entirely automated, using the script by Al:

  PATT='^[[:blank:]]*#[[:blank:]]*include[[:blank:]]*&lt;asm/uaccess.h&gt;'
  sed -i -e "s!$PATT!#include &lt;linux/uaccess.h&gt;!" \
        $(git grep -l "$PATT"|grep -v ^include/linux/uaccess.h)

to do the replacement at the end of the merge window.

Requested-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This was entirely automated, using the script by Al:

  PATT='^[[:blank:]]*#[[:blank:]]*include[[:blank:]]*&lt;asm/uaccess.h&gt;'
  sed -i -e "s!$PATT!#include &lt;linux/uaccess.h&gt;!" \
        $(git grep -l "$PATT"|grep -v ^include/linux/uaccess.h)

to do the replacement at the end of the merge window.

Requested-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>netns: make struct pernet_operations::id unsigned int</title>
<updated>2016-11-18T15:59:15+00:00</updated>
<author>
<name>Alexey Dobriyan</name>
<email>adobriyan@gmail.com</email>
</author>
<published>2016-11-17T01:58:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c7d03a00b56fc23c3a01a8353789ad257363e281'/>
<id>c7d03a00b56fc23c3a01a8353789ad257363e281</id>
<content type='text'>
Make struct pernet_operations::id unsigned.

There are 2 reasons to do so:

1)
This field is really an index into an zero based array and
thus is unsigned entity. Using negative value is out-of-bound
access by definition.

2)
On x86_64 unsigned 32-bit data which are mixed with pointers
via array indexing or offsets added or subtracted to pointers
are preffered to signed 32-bit data.

"int" being used as an array index needs to be sign-extended
to 64-bit before being used.

	void f(long *p, int i)
	{
		g(p[i]);
	}

  roughly translates to

	movsx	rsi, esi
	mov	rdi, [rsi+...]
	call 	g

MOVSX is 3 byte instruction which isn't necessary if the variable is
unsigned because x86_64 is zero extending by default.

Now, there is net_generic() function which, you guessed it right, uses
"int" as an array index:

	static inline void *net_generic(const struct net *net, int id)
	{
		...
		ptr = ng-&gt;ptr[id - 1];
		...
	}

And this function is used a lot, so those sign extensions add up.

Patch snipes ~1730 bytes on allyesconfig kernel (without all junk
messing with code generation):

	add/remove: 0/0 grow/shrink: 70/598 up/down: 396/-2126 (-1730)

Unfortunately some functions actually grow bigger.
This is a semmingly random artefact of code generation with register
allocator being used differently. gcc decides that some variable
needs to live in new r8+ registers and every access now requires REX
prefix. Or it is shifted into r12, so [r12+0] addressing mode has to be
used which is longer than [r8]

However, overall balance is in negative direction:

	add/remove: 0/0 grow/shrink: 70/598 up/down: 396/-2126 (-1730)
	function                                     old     new   delta
	nfsd4_lock                                  3886    3959     +73
	tipc_link_build_proto_msg                   1096    1140     +44
	mac80211_hwsim_new_radio                    2776    2808     +32
	tipc_mon_rcv                                1032    1058     +26
	svcauth_gss_legacy_init                     1413    1429     +16
	tipc_bcbase_select_primary                   379     392     +13
	nfsd4_exchange_id                           1247    1260     +13
	nfsd4_setclientid_confirm                    782     793     +11
		...
	put_client_renew_locked                      494     480     -14
	ip_set_sockfn_get                            730     716     -14
	geneve_sock_add                              829     813     -16
	nfsd4_sequence_done                          721     703     -18
	nlmclnt_lookup_host                          708     686     -22
	nfsd4_lockt                                 1085    1063     -22
	nfs_get_client                              1077    1050     -27
	tcf_bpf_init                                1106    1076     -30
	nfsd4_encode_fattr                          5997    5930     -67
	Total: Before=154856051, After=154854321, chg -0.00%

Signed-off-by: Alexey Dobriyan &lt;adobriyan@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Make struct pernet_operations::id unsigned.

There are 2 reasons to do so:

1)
This field is really an index into an zero based array and
thus is unsigned entity. Using negative value is out-of-bound
access by definition.

2)
On x86_64 unsigned 32-bit data which are mixed with pointers
via array indexing or offsets added or subtracted to pointers
are preffered to signed 32-bit data.

"int" being used as an array index needs to be sign-extended
to 64-bit before being used.

	void f(long *p, int i)
	{
		g(p[i]);
	}

  roughly translates to

	movsx	rsi, esi
	mov	rdi, [rsi+...]
	call 	g

MOVSX is 3 byte instruction which isn't necessary if the variable is
unsigned because x86_64 is zero extending by default.

Now, there is net_generic() function which, you guessed it right, uses
"int" as an array index:

	static inline void *net_generic(const struct net *net, int id)
	{
		...
		ptr = ng-&gt;ptr[id - 1];
		...
	}

And this function is used a lot, so those sign extensions add up.

Patch snipes ~1730 bytes on allyesconfig kernel (without all junk
messing with code generation):

	add/remove: 0/0 grow/shrink: 70/598 up/down: 396/-2126 (-1730)

Unfortunately some functions actually grow bigger.
This is a semmingly random artefact of code generation with register
allocator being used differently. gcc decides that some variable
needs to live in new r8+ registers and every access now requires REX
prefix. Or it is shifted into r12, so [r12+0] addressing mode has to be
used which is longer than [r8]

However, overall balance is in negative direction:

	add/remove: 0/0 grow/shrink: 70/598 up/down: 396/-2126 (-1730)
	function                                     old     new   delta
	nfsd4_lock                                  3886    3959     +73
	tipc_link_build_proto_msg                   1096    1140     +44
	mac80211_hwsim_new_radio                    2776    2808     +32
	tipc_mon_rcv                                1032    1058     +26
	svcauth_gss_legacy_init                     1413    1429     +16
	tipc_bcbase_select_primary                   379     392     +13
	nfsd4_exchange_id                           1247    1260     +13
	nfsd4_setclientid_confirm                    782     793     +11
		...
	put_client_renew_locked                      494     480     -14
	ip_set_sockfn_get                            730     716     -14
	geneve_sock_add                              829     813     -16
	nfsd4_sequence_done                          721     703     -18
	nlmclnt_lookup_host                          708     686     -22
	nfsd4_lockt                                 1085    1063     -22
	nfs_get_client                              1077    1050     -27
	tcf_bpf_init                                1106    1076     -30
	nfsd4_encode_fattr                          5997    5930     -67
	Total: Before=154856051, After=154854321, chg -0.00%

Signed-off-by: Alexey Dobriyan &lt;adobriyan@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ppp: declare PPP devices as LLTX</title>
<updated>2016-08-31T21:33:09+00:00</updated>
<author>
<name>Guillaume Nault</name>
<email>g.nault@alphalink.fr</email>
</author>
<published>2016-08-27T20:22:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=077127705acf80cdb9393b891d934509a7081d71'/>
<id>077127705acf80cdb9393b891d934509a7081d71</id>
<content type='text'>
ppp_xmit_process() already locks the xmit path. If HARD_TX_LOCK() tries
to hold the _xmit_lock we can get lock inversion.

[  973.726130] ======================================================
[  973.727311] [ INFO: possible circular locking dependency detected ]
[  973.728546] 4.8.0-rc2 #1 Tainted: G           O
[  973.728986] -------------------------------------------------------
[  973.728986] accel-pppd/1806 is trying to acquire lock:
[  973.728986]  (&amp;qdisc_xmit_lock_key){+.-...}, at: [&lt;ffffffff8146f6fe&gt;] sch_direct_xmit+0x8d/0x221
[  973.728986]
[  973.728986] but task is already holding lock:
[  973.728986]  (l2tp_sock){+.-...}, at: [&lt;ffffffffa0202c4a&gt;] l2tp_xmit_skb+0x1e8/0x5d7 [l2tp_core]
[  973.728986]
[  973.728986] which lock already depends on the new lock.
[  973.728986]
[  973.728986]
[  973.728986] the existing dependency chain (in reverse order) is:
[  973.728986]
-&gt; #3 (l2tp_sock){+.-...}:
[  973.728986]        [&lt;ffffffff810b3130&gt;] lock_acquire+0x150/0x217
[  973.728986]        [&lt;ffffffff815752f4&gt;] _raw_spin_lock+0x2d/0x3c
[  973.728986]        [&lt;ffffffffa0202c4a&gt;] l2tp_xmit_skb+0x1e8/0x5d7 [l2tp_core]
[  973.728986]        [&lt;ffffffffa01b2466&gt;] pppol2tp_xmit+0x1f2/0x25e [l2tp_ppp]
[  973.728986]        [&lt;ffffffffa0184f59&gt;] ppp_channel_push+0xb5/0x14a [ppp_generic]
[  973.728986]        [&lt;ffffffffa01853ed&gt;] ppp_write+0x104/0x11c [ppp_generic]
[  973.728986]        [&lt;ffffffff811b2ec6&gt;] __vfs_write+0x56/0x120
[  973.728986]        [&lt;ffffffff811b3f4c&gt;] vfs_write+0xbd/0x11b
[  973.728986]        [&lt;ffffffff811b4cb2&gt;] SyS_write+0x5e/0x96
[  973.728986]        [&lt;ffffffff81575ba5&gt;] entry_SYSCALL_64_fastpath+0x18/0xa8
[  973.728986]
-&gt; #2 (&amp;(&amp;pch-&gt;downl)-&gt;rlock){+.-...}:
[  973.728986]        [&lt;ffffffff810b3130&gt;] lock_acquire+0x150/0x217
[  973.728986]        [&lt;ffffffff81575334&gt;] _raw_spin_lock_bh+0x31/0x40
[  973.728986]        [&lt;ffffffffa01808e2&gt;] ppp_push+0xa7/0x82d [ppp_generic]
[  973.728986]        [&lt;ffffffffa0184675&gt;] __ppp_xmit_process+0x48/0x877 [ppp_generic]
[  973.728986]        [&lt;ffffffffa018505b&gt;] ppp_xmit_process+0x4b/0xaf [ppp_generic]
[  973.728986]        [&lt;ffffffffa01853f7&gt;] ppp_write+0x10e/0x11c [ppp_generic]
[  973.728986]        [&lt;ffffffff811b2ec6&gt;] __vfs_write+0x56/0x120
[  973.728986]        [&lt;ffffffff811b3f4c&gt;] vfs_write+0xbd/0x11b
[  973.728986]        [&lt;ffffffff811b4cb2&gt;] SyS_write+0x5e/0x96
[  973.728986]        [&lt;ffffffff81575ba5&gt;] entry_SYSCALL_64_fastpath+0x18/0xa8
[  973.728986]
-&gt; #1 (&amp;(&amp;ppp-&gt;wlock)-&gt;rlock){+.-...}:
[  973.728986]        [&lt;ffffffff810b3130&gt;] lock_acquire+0x150/0x217
[  973.728986]        [&lt;ffffffff81575334&gt;] _raw_spin_lock_bh+0x31/0x40
[  973.728986]        [&lt;ffffffffa0184654&gt;] __ppp_xmit_process+0x27/0x877 [ppp_generic]
[  973.728986]        [&lt;ffffffffa018505b&gt;] ppp_xmit_process+0x4b/0xaf [ppp_generic]
[  973.728986]        [&lt;ffffffffa01852da&gt;] ppp_start_xmit+0x21b/0x22a [ppp_generic]
[  973.728986]        [&lt;ffffffff8143f767&gt;] dev_hard_start_xmit+0x1a9/0x43d
[  973.728986]        [&lt;ffffffff8146f747&gt;] sch_direct_xmit+0xd6/0x221
[  973.728986]        [&lt;ffffffff814401e4&gt;] __dev_queue_xmit+0x62a/0x912
[  973.728986]        [&lt;ffffffff814404d7&gt;] dev_queue_xmit+0xb/0xd
[  973.728986]        [&lt;ffffffff81449978&gt;] neigh_direct_output+0xc/0xe
[  973.728986]        [&lt;ffffffff8150e62b&gt;] ip6_finish_output2+0x5a9/0x623
[  973.728986]        [&lt;ffffffff81512128&gt;] ip6_output+0x15e/0x16a
[  973.728986]        [&lt;ffffffff8153ef86&gt;] dst_output+0x76/0x7f
[  973.728986]        [&lt;ffffffff8153f737&gt;] mld_sendpack+0x335/0x404
[  973.728986]        [&lt;ffffffff81541c61&gt;] mld_send_initial_cr.part.21+0x99/0xa2
[  973.728986]        [&lt;ffffffff8154441d&gt;] ipv6_mc_dad_complete+0x42/0x71
[  973.728986]        [&lt;ffffffff8151c4bd&gt;] addrconf_dad_completed+0x1cf/0x2ea
[  973.728986]        [&lt;ffffffff8151e4fa&gt;] addrconf_dad_work+0x453/0x520
[  973.728986]        [&lt;ffffffff8107a393&gt;] process_one_work+0x365/0x6f0
[  973.728986]        [&lt;ffffffff8107aecd&gt;] worker_thread+0x2de/0x421
[  973.728986]        [&lt;ffffffff810816fb&gt;] kthread+0x121/0x130
[  973.728986]        [&lt;ffffffff81575dbf&gt;] ret_from_fork+0x1f/0x40
[  973.728986]
-&gt; #0 (&amp;qdisc_xmit_lock_key){+.-...}:
[  973.728986]        [&lt;ffffffff810b28d6&gt;] __lock_acquire+0x1118/0x1483
[  973.728986]        [&lt;ffffffff810b3130&gt;] lock_acquire+0x150/0x217
[  973.728986]        [&lt;ffffffff815752f4&gt;] _raw_spin_lock+0x2d/0x3c
[  973.728986]        [&lt;ffffffff8146f6fe&gt;] sch_direct_xmit+0x8d/0x221
[  973.728986]        [&lt;ffffffff814401e4&gt;] __dev_queue_xmit+0x62a/0x912
[  973.728986]        [&lt;ffffffff814404d7&gt;] dev_queue_xmit+0xb/0xd
[  973.728986]        [&lt;ffffffff81449978&gt;] neigh_direct_output+0xc/0xe
[  973.728986]        [&lt;ffffffff81487811&gt;] ip_finish_output2+0x5db/0x609
[  973.728986]        [&lt;ffffffff81489590&gt;] ip_finish_output+0x152/0x15e
[  973.728986]        [&lt;ffffffff8148a0d4&gt;] ip_output+0x8c/0x96
[  973.728986]        [&lt;ffffffff81489652&gt;] ip_local_out+0x41/0x4a
[  973.728986]        [&lt;ffffffff81489e7d&gt;] ip_queue_xmit+0x5a5/0x609
[  973.728986]        [&lt;ffffffffa0202fe4&gt;] l2tp_xmit_skb+0x582/0x5d7 [l2tp_core]
[  973.728986]        [&lt;ffffffffa01b2466&gt;] pppol2tp_xmit+0x1f2/0x25e [l2tp_ppp]
[  973.728986]        [&lt;ffffffffa0184f59&gt;] ppp_channel_push+0xb5/0x14a [ppp_generic]
[  973.728986]        [&lt;ffffffffa01853ed&gt;] ppp_write+0x104/0x11c [ppp_generic]
[  973.728986]        [&lt;ffffffff811b2ec6&gt;] __vfs_write+0x56/0x120
[  973.728986]        [&lt;ffffffff811b3f4c&gt;] vfs_write+0xbd/0x11b
[  973.728986]        [&lt;ffffffff811b4cb2&gt;] SyS_write+0x5e/0x96
[  973.728986]        [&lt;ffffffff81575ba5&gt;] entry_SYSCALL_64_fastpath+0x18/0xa8
[  973.728986]
[  973.728986] other info that might help us debug this:
[  973.728986]
[  973.728986] Chain exists of:
  &amp;qdisc_xmit_lock_key --&gt; &amp;(&amp;pch-&gt;downl)-&gt;rlock --&gt; l2tp_sock

[  973.728986]  Possible unsafe locking scenario:
[  973.728986]
[  973.728986]        CPU0                    CPU1
[  973.728986]        ----                    ----
[  973.728986]   lock(l2tp_sock);
[  973.728986]                                lock(&amp;(&amp;pch-&gt;downl)-&gt;rlock);
[  973.728986]                                lock(l2tp_sock);
[  973.728986]   lock(&amp;qdisc_xmit_lock_key);
[  973.728986]
[  973.728986]  *** DEADLOCK ***
[  973.728986]
[  973.728986] 6 locks held by accel-pppd/1806:
[  973.728986]  #0:  (&amp;(&amp;pch-&gt;downl)-&gt;rlock){+.-...}, at: [&lt;ffffffffa0184efa&gt;] ppp_channel_push+0x56/0x14a [ppp_generic]
[  973.728986]  #1:  (l2tp_sock){+.-...}, at: [&lt;ffffffffa0202c4a&gt;] l2tp_xmit_skb+0x1e8/0x5d7 [l2tp_core]
[  973.728986]  #2:  (rcu_read_lock){......}, at: [&lt;ffffffff81486981&gt;] rcu_lock_acquire+0x0/0x20
[  973.728986]  #3:  (rcu_read_lock_bh){......}, at: [&lt;ffffffff81486981&gt;] rcu_lock_acquire+0x0/0x20
[  973.728986]  #4:  (rcu_read_lock_bh){......}, at: [&lt;ffffffff814340e3&gt;] rcu_lock_acquire+0x0/0x20
[  973.728986]  #5:  (dev-&gt;qdisc_running_key ?: &amp;qdisc_running_key#2){+.....}, at: [&lt;ffffffff8144011e&gt;] __dev_queue_xmit+0x564/0x912
[  973.728986]
[  973.728986] stack backtrace:
[  973.728986] CPU: 2 PID: 1806 Comm: accel-pppd Tainted: G           O    4.8.0-rc2 #1
[  973.728986] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
[  973.728986]  ffff7fffffffffff ffff88003436f850 ffffffff812a20f4 ffffffff82156e30
[  973.728986]  ffffffff82156920 ffff88003436f890 ffffffff8115c759 ffff88003344ae00
[  973.728986]  ffff88003344b5c0 0000000000000002 0000000000000006 ffff88003344b5e8
[  973.728986] Call Trace:
[  973.728986]  [&lt;ffffffff812a20f4&gt;] dump_stack+0x67/0x90
[  973.728986]  [&lt;ffffffff8115c759&gt;] print_circular_bug+0x22e/0x23c
[  973.728986]  [&lt;ffffffff810b28d6&gt;] __lock_acquire+0x1118/0x1483
[  973.728986]  [&lt;ffffffff810b3130&gt;] lock_acquire+0x150/0x217
[  973.728986]  [&lt;ffffffff810b3130&gt;] ? lock_acquire+0x150/0x217
[  973.728986]  [&lt;ffffffff8146f6fe&gt;] ? sch_direct_xmit+0x8d/0x221
[  973.728986]  [&lt;ffffffff815752f4&gt;] _raw_spin_lock+0x2d/0x3c
[  973.728986]  [&lt;ffffffff8146f6fe&gt;] ? sch_direct_xmit+0x8d/0x221
[  973.728986]  [&lt;ffffffff8146f6fe&gt;] sch_direct_xmit+0x8d/0x221
[  973.728986]  [&lt;ffffffff814401e4&gt;] __dev_queue_xmit+0x62a/0x912
[  973.728986]  [&lt;ffffffff814404d7&gt;] dev_queue_xmit+0xb/0xd
[  973.728986]  [&lt;ffffffff81449978&gt;] neigh_direct_output+0xc/0xe
[  973.728986]  [&lt;ffffffff81487811&gt;] ip_finish_output2+0x5db/0x609
[  973.728986]  [&lt;ffffffff81486853&gt;] ? dst_mtu+0x29/0x2e
[  973.728986]  [&lt;ffffffff81489590&gt;] ip_finish_output+0x152/0x15e
[  973.728986]  [&lt;ffffffff8148a0bc&gt;] ? ip_output+0x74/0x96
[  973.728986]  [&lt;ffffffff8148a0d4&gt;] ip_output+0x8c/0x96
[  973.728986]  [&lt;ffffffff81489652&gt;] ip_local_out+0x41/0x4a
[  973.728986]  [&lt;ffffffff81489e7d&gt;] ip_queue_xmit+0x5a5/0x609
[  973.728986]  [&lt;ffffffff814c559e&gt;] ? udp_set_csum+0x207/0x21e
[  973.728986]  [&lt;ffffffffa0202fe4&gt;] l2tp_xmit_skb+0x582/0x5d7 [l2tp_core]
[  973.728986]  [&lt;ffffffffa01b2466&gt;] pppol2tp_xmit+0x1f2/0x25e [l2tp_ppp]
[  973.728986]  [&lt;ffffffffa0184f59&gt;] ppp_channel_push+0xb5/0x14a [ppp_generic]
[  973.728986]  [&lt;ffffffffa01853ed&gt;] ppp_write+0x104/0x11c [ppp_generic]
[  973.728986]  [&lt;ffffffff811b2ec6&gt;] __vfs_write+0x56/0x120
[  973.728986]  [&lt;ffffffff8124c11d&gt;] ? fsnotify_perm+0x27/0x95
[  973.728986]  [&lt;ffffffff8124d41d&gt;] ? security_file_permission+0x4d/0x54
[  973.728986]  [&lt;ffffffff811b3f4c&gt;] vfs_write+0xbd/0x11b
[  973.728986]  [&lt;ffffffff811b4cb2&gt;] SyS_write+0x5e/0x96
[  973.728986]  [&lt;ffffffff81575ba5&gt;] entry_SYSCALL_64_fastpath+0x18/0xa8
[  973.728986]  [&lt;ffffffff810ae0fa&gt;] ? trace_hardirqs_off_caller+0x121/0x12f

Signed-off-by: Guillaume Nault &lt;g.nault@alphalink.fr&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
ppp_xmit_process() already locks the xmit path. If HARD_TX_LOCK() tries
to hold the _xmit_lock we can get lock inversion.

[  973.726130] ======================================================
[  973.727311] [ INFO: possible circular locking dependency detected ]
[  973.728546] 4.8.0-rc2 #1 Tainted: G           O
[  973.728986] -------------------------------------------------------
[  973.728986] accel-pppd/1806 is trying to acquire lock:
[  973.728986]  (&amp;qdisc_xmit_lock_key){+.-...}, at: [&lt;ffffffff8146f6fe&gt;] sch_direct_xmit+0x8d/0x221
[  973.728986]
[  973.728986] but task is already holding lock:
[  973.728986]  (l2tp_sock){+.-...}, at: [&lt;ffffffffa0202c4a&gt;] l2tp_xmit_skb+0x1e8/0x5d7 [l2tp_core]
[  973.728986]
[  973.728986] which lock already depends on the new lock.
[  973.728986]
[  973.728986]
[  973.728986] the existing dependency chain (in reverse order) is:
[  973.728986]
-&gt; #3 (l2tp_sock){+.-...}:
[  973.728986]        [&lt;ffffffff810b3130&gt;] lock_acquire+0x150/0x217
[  973.728986]        [&lt;ffffffff815752f4&gt;] _raw_spin_lock+0x2d/0x3c
[  973.728986]        [&lt;ffffffffa0202c4a&gt;] l2tp_xmit_skb+0x1e8/0x5d7 [l2tp_core]
[  973.728986]        [&lt;ffffffffa01b2466&gt;] pppol2tp_xmit+0x1f2/0x25e [l2tp_ppp]
[  973.728986]        [&lt;ffffffffa0184f59&gt;] ppp_channel_push+0xb5/0x14a [ppp_generic]
[  973.728986]        [&lt;ffffffffa01853ed&gt;] ppp_write+0x104/0x11c [ppp_generic]
[  973.728986]        [&lt;ffffffff811b2ec6&gt;] __vfs_write+0x56/0x120
[  973.728986]        [&lt;ffffffff811b3f4c&gt;] vfs_write+0xbd/0x11b
[  973.728986]        [&lt;ffffffff811b4cb2&gt;] SyS_write+0x5e/0x96
[  973.728986]        [&lt;ffffffff81575ba5&gt;] entry_SYSCALL_64_fastpath+0x18/0xa8
[  973.728986]
-&gt; #2 (&amp;(&amp;pch-&gt;downl)-&gt;rlock){+.-...}:
[  973.728986]        [&lt;ffffffff810b3130&gt;] lock_acquire+0x150/0x217
[  973.728986]        [&lt;ffffffff81575334&gt;] _raw_spin_lock_bh+0x31/0x40
[  973.728986]        [&lt;ffffffffa01808e2&gt;] ppp_push+0xa7/0x82d [ppp_generic]
[  973.728986]        [&lt;ffffffffa0184675&gt;] __ppp_xmit_process+0x48/0x877 [ppp_generic]
[  973.728986]        [&lt;ffffffffa018505b&gt;] ppp_xmit_process+0x4b/0xaf [ppp_generic]
[  973.728986]        [&lt;ffffffffa01853f7&gt;] ppp_write+0x10e/0x11c [ppp_generic]
[  973.728986]        [&lt;ffffffff811b2ec6&gt;] __vfs_write+0x56/0x120
[  973.728986]        [&lt;ffffffff811b3f4c&gt;] vfs_write+0xbd/0x11b
[  973.728986]        [&lt;ffffffff811b4cb2&gt;] SyS_write+0x5e/0x96
[  973.728986]        [&lt;ffffffff81575ba5&gt;] entry_SYSCALL_64_fastpath+0x18/0xa8
[  973.728986]
-&gt; #1 (&amp;(&amp;ppp-&gt;wlock)-&gt;rlock){+.-...}:
[  973.728986]        [&lt;ffffffff810b3130&gt;] lock_acquire+0x150/0x217
[  973.728986]        [&lt;ffffffff81575334&gt;] _raw_spin_lock_bh+0x31/0x40
[  973.728986]        [&lt;ffffffffa0184654&gt;] __ppp_xmit_process+0x27/0x877 [ppp_generic]
[  973.728986]        [&lt;ffffffffa018505b&gt;] ppp_xmit_process+0x4b/0xaf [ppp_generic]
[  973.728986]        [&lt;ffffffffa01852da&gt;] ppp_start_xmit+0x21b/0x22a [ppp_generic]
[  973.728986]        [&lt;ffffffff8143f767&gt;] dev_hard_start_xmit+0x1a9/0x43d
[  973.728986]        [&lt;ffffffff8146f747&gt;] sch_direct_xmit+0xd6/0x221
[  973.728986]        [&lt;ffffffff814401e4&gt;] __dev_queue_xmit+0x62a/0x912
[  973.728986]        [&lt;ffffffff814404d7&gt;] dev_queue_xmit+0xb/0xd
[  973.728986]        [&lt;ffffffff81449978&gt;] neigh_direct_output+0xc/0xe
[  973.728986]        [&lt;ffffffff8150e62b&gt;] ip6_finish_output2+0x5a9/0x623
[  973.728986]        [&lt;ffffffff81512128&gt;] ip6_output+0x15e/0x16a
[  973.728986]        [&lt;ffffffff8153ef86&gt;] dst_output+0x76/0x7f
[  973.728986]        [&lt;ffffffff8153f737&gt;] mld_sendpack+0x335/0x404
[  973.728986]        [&lt;ffffffff81541c61&gt;] mld_send_initial_cr.part.21+0x99/0xa2
[  973.728986]        [&lt;ffffffff8154441d&gt;] ipv6_mc_dad_complete+0x42/0x71
[  973.728986]        [&lt;ffffffff8151c4bd&gt;] addrconf_dad_completed+0x1cf/0x2ea
[  973.728986]        [&lt;ffffffff8151e4fa&gt;] addrconf_dad_work+0x453/0x520
[  973.728986]        [&lt;ffffffff8107a393&gt;] process_one_work+0x365/0x6f0
[  973.728986]        [&lt;ffffffff8107aecd&gt;] worker_thread+0x2de/0x421
[  973.728986]        [&lt;ffffffff810816fb&gt;] kthread+0x121/0x130
[  973.728986]        [&lt;ffffffff81575dbf&gt;] ret_from_fork+0x1f/0x40
[  973.728986]
-&gt; #0 (&amp;qdisc_xmit_lock_key){+.-...}:
[  973.728986]        [&lt;ffffffff810b28d6&gt;] __lock_acquire+0x1118/0x1483
[  973.728986]        [&lt;ffffffff810b3130&gt;] lock_acquire+0x150/0x217
[  973.728986]        [&lt;ffffffff815752f4&gt;] _raw_spin_lock+0x2d/0x3c
[  973.728986]        [&lt;ffffffff8146f6fe&gt;] sch_direct_xmit+0x8d/0x221
[  973.728986]        [&lt;ffffffff814401e4&gt;] __dev_queue_xmit+0x62a/0x912
[  973.728986]        [&lt;ffffffff814404d7&gt;] dev_queue_xmit+0xb/0xd
[  973.728986]        [&lt;ffffffff81449978&gt;] neigh_direct_output+0xc/0xe
[  973.728986]        [&lt;ffffffff81487811&gt;] ip_finish_output2+0x5db/0x609
[  973.728986]        [&lt;ffffffff81489590&gt;] ip_finish_output+0x152/0x15e
[  973.728986]        [&lt;ffffffff8148a0d4&gt;] ip_output+0x8c/0x96
[  973.728986]        [&lt;ffffffff81489652&gt;] ip_local_out+0x41/0x4a
[  973.728986]        [&lt;ffffffff81489e7d&gt;] ip_queue_xmit+0x5a5/0x609
[  973.728986]        [&lt;ffffffffa0202fe4&gt;] l2tp_xmit_skb+0x582/0x5d7 [l2tp_core]
[  973.728986]        [&lt;ffffffffa01b2466&gt;] pppol2tp_xmit+0x1f2/0x25e [l2tp_ppp]
[  973.728986]        [&lt;ffffffffa0184f59&gt;] ppp_channel_push+0xb5/0x14a [ppp_generic]
[  973.728986]        [&lt;ffffffffa01853ed&gt;] ppp_write+0x104/0x11c [ppp_generic]
[  973.728986]        [&lt;ffffffff811b2ec6&gt;] __vfs_write+0x56/0x120
[  973.728986]        [&lt;ffffffff811b3f4c&gt;] vfs_write+0xbd/0x11b
[  973.728986]        [&lt;ffffffff811b4cb2&gt;] SyS_write+0x5e/0x96
[  973.728986]        [&lt;ffffffff81575ba5&gt;] entry_SYSCALL_64_fastpath+0x18/0xa8
[  973.728986]
[  973.728986] other info that might help us debug this:
[  973.728986]
[  973.728986] Chain exists of:
  &amp;qdisc_xmit_lock_key --&gt; &amp;(&amp;pch-&gt;downl)-&gt;rlock --&gt; l2tp_sock

[  973.728986]  Possible unsafe locking scenario:
[  973.728986]
[  973.728986]        CPU0                    CPU1
[  973.728986]        ----                    ----
[  973.728986]   lock(l2tp_sock);
[  973.728986]                                lock(&amp;(&amp;pch-&gt;downl)-&gt;rlock);
[  973.728986]                                lock(l2tp_sock);
[  973.728986]   lock(&amp;qdisc_xmit_lock_key);
[  973.728986]
[  973.728986]  *** DEADLOCK ***
[  973.728986]
[  973.728986] 6 locks held by accel-pppd/1806:
[  973.728986]  #0:  (&amp;(&amp;pch-&gt;downl)-&gt;rlock){+.-...}, at: [&lt;ffffffffa0184efa&gt;] ppp_channel_push+0x56/0x14a [ppp_generic]
[  973.728986]  #1:  (l2tp_sock){+.-...}, at: [&lt;ffffffffa0202c4a&gt;] l2tp_xmit_skb+0x1e8/0x5d7 [l2tp_core]
[  973.728986]  #2:  (rcu_read_lock){......}, at: [&lt;ffffffff81486981&gt;] rcu_lock_acquire+0x0/0x20
[  973.728986]  #3:  (rcu_read_lock_bh){......}, at: [&lt;ffffffff81486981&gt;] rcu_lock_acquire+0x0/0x20
[  973.728986]  #4:  (rcu_read_lock_bh){......}, at: [&lt;ffffffff814340e3&gt;] rcu_lock_acquire+0x0/0x20
[  973.728986]  #5:  (dev-&gt;qdisc_running_key ?: &amp;qdisc_running_key#2){+.....}, at: [&lt;ffffffff8144011e&gt;] __dev_queue_xmit+0x564/0x912
[  973.728986]
[  973.728986] stack backtrace:
[  973.728986] CPU: 2 PID: 1806 Comm: accel-pppd Tainted: G           O    4.8.0-rc2 #1
[  973.728986] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
[  973.728986]  ffff7fffffffffff ffff88003436f850 ffffffff812a20f4 ffffffff82156e30
[  973.728986]  ffffffff82156920 ffff88003436f890 ffffffff8115c759 ffff88003344ae00
[  973.728986]  ffff88003344b5c0 0000000000000002 0000000000000006 ffff88003344b5e8
[  973.728986] Call Trace:
[  973.728986]  [&lt;ffffffff812a20f4&gt;] dump_stack+0x67/0x90
[  973.728986]  [&lt;ffffffff8115c759&gt;] print_circular_bug+0x22e/0x23c
[  973.728986]  [&lt;ffffffff810b28d6&gt;] __lock_acquire+0x1118/0x1483
[  973.728986]  [&lt;ffffffff810b3130&gt;] lock_acquire+0x150/0x217
[  973.728986]  [&lt;ffffffff810b3130&gt;] ? lock_acquire+0x150/0x217
[  973.728986]  [&lt;ffffffff8146f6fe&gt;] ? sch_direct_xmit+0x8d/0x221
[  973.728986]  [&lt;ffffffff815752f4&gt;] _raw_spin_lock+0x2d/0x3c
[  973.728986]  [&lt;ffffffff8146f6fe&gt;] ? sch_direct_xmit+0x8d/0x221
[  973.728986]  [&lt;ffffffff8146f6fe&gt;] sch_direct_xmit+0x8d/0x221
[  973.728986]  [&lt;ffffffff814401e4&gt;] __dev_queue_xmit+0x62a/0x912
[  973.728986]  [&lt;ffffffff814404d7&gt;] dev_queue_xmit+0xb/0xd
[  973.728986]  [&lt;ffffffff81449978&gt;] neigh_direct_output+0xc/0xe
[  973.728986]  [&lt;ffffffff81487811&gt;] ip_finish_output2+0x5db/0x609
[  973.728986]  [&lt;ffffffff81486853&gt;] ? dst_mtu+0x29/0x2e
[  973.728986]  [&lt;ffffffff81489590&gt;] ip_finish_output+0x152/0x15e
[  973.728986]  [&lt;ffffffff8148a0bc&gt;] ? ip_output+0x74/0x96
[  973.728986]  [&lt;ffffffff8148a0d4&gt;] ip_output+0x8c/0x96
[  973.728986]  [&lt;ffffffff81489652&gt;] ip_local_out+0x41/0x4a
[  973.728986]  [&lt;ffffffff81489e7d&gt;] ip_queue_xmit+0x5a5/0x609
[  973.728986]  [&lt;ffffffff814c559e&gt;] ? udp_set_csum+0x207/0x21e
[  973.728986]  [&lt;ffffffffa0202fe4&gt;] l2tp_xmit_skb+0x582/0x5d7 [l2tp_core]
[  973.728986]  [&lt;ffffffffa01b2466&gt;] pppol2tp_xmit+0x1f2/0x25e [l2tp_ppp]
[  973.728986]  [&lt;ffffffffa0184f59&gt;] ppp_channel_push+0xb5/0x14a [ppp_generic]
[  973.728986]  [&lt;ffffffffa01853ed&gt;] ppp_write+0x104/0x11c [ppp_generic]
[  973.728986]  [&lt;ffffffff811b2ec6&gt;] __vfs_write+0x56/0x120
[  973.728986]  [&lt;ffffffff8124c11d&gt;] ? fsnotify_perm+0x27/0x95
[  973.728986]  [&lt;ffffffff8124d41d&gt;] ? security_file_permission+0x4d/0x54
[  973.728986]  [&lt;ffffffff811b3f4c&gt;] vfs_write+0xbd/0x11b
[  973.728986]  [&lt;ffffffff811b4cb2&gt;] SyS_write+0x5e/0x96
[  973.728986]  [&lt;ffffffff81575ba5&gt;] entry_SYSCALL_64_fastpath+0x18/0xa8
[  973.728986]  [&lt;ffffffff810ae0fa&gt;] ? trace_hardirqs_off_caller+0x121/0x12f

Signed-off-by: Guillaume Nault &lt;g.nault@alphalink.fr&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ppp: avoid dealock on recursive xmit</title>
<updated>2016-08-31T21:33:08+00:00</updated>
<author>
<name>Guillaume Nault</name>
<email>g.nault@alphalink.fr</email>
</author>
<published>2016-08-27T20:22:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=55454a565836e1cb002d433e901804dea4406a32'/>
<id>55454a565836e1cb002d433e901804dea4406a32</id>
<content type='text'>
In case of misconfiguration, a virtual PPP channel might send packets
back to their parent PPP interface. This typically happens in
misconfigured L2TP setups, where PPP's peer IP address is set with the
IP of the L2TP peer.
When that happens the system hangs due to PPP trying to recursively
lock its xmit path.

[  243.332155] BUG: spinlock recursion on CPU#1, accel-pppd/926
[  243.333272]  lock: 0xffff880033d90f18, .magic: dead4ead, .owner: accel-pppd/926, .owner_cpu: 1
[  243.334859] CPU: 1 PID: 926 Comm: accel-pppd Not tainted 4.8.0-rc2 #1
[  243.336010] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
[  243.336018]  ffff7fffffffffff ffff8800319a77a0 ffffffff8128de85 ffff880033d90f18
[  243.336018]  ffff880033ad8000 ffff8800319a77d8 ffffffff810ad7c0 ffffffff0000039e
[  243.336018]  ffff880033d90f18 ffff880033d90f60 ffff880033d90f18 ffff880033d90f28
[  243.336018] Call Trace:
[  243.336018]  [&lt;ffffffff8128de85&gt;] dump_stack+0x4f/0x65
[  243.336018]  [&lt;ffffffff810ad7c0&gt;] spin_dump+0xe1/0xeb
[  243.336018]  [&lt;ffffffff810ad7f0&gt;] spin_bug+0x26/0x28
[  243.336018]  [&lt;ffffffff810ad8b9&gt;] do_raw_spin_lock+0x5c/0x160
[  243.336018]  [&lt;ffffffff815522aa&gt;] _raw_spin_lock_bh+0x35/0x3c
[  243.336018]  [&lt;ffffffffa01a88e2&gt;] ? ppp_push+0xa7/0x82d [ppp_generic]
[  243.336018]  [&lt;ffffffffa01a88e2&gt;] ppp_push+0xa7/0x82d [ppp_generic]
[  243.336018]  [&lt;ffffffff810adada&gt;] ? do_raw_spin_unlock+0xc2/0xcc
[  243.336018]  [&lt;ffffffff81084962&gt;] ? preempt_count_sub+0x13/0xc7
[  243.336018]  [&lt;ffffffff81552438&gt;] ? _raw_spin_unlock_irqrestore+0x34/0x49
[  243.336018]  [&lt;ffffffffa01ac657&gt;] ppp_xmit_process+0x48/0x877 [ppp_generic]
[  243.336018]  [&lt;ffffffff81084962&gt;] ? preempt_count_sub+0x13/0xc7
[  243.336018]  [&lt;ffffffff81408cd3&gt;] ? skb_queue_tail+0x71/0x7c
[  243.336018]  [&lt;ffffffffa01ad1c5&gt;] ppp_start_xmit+0x21b/0x22a [ppp_generic]
[  243.336018]  [&lt;ffffffff81426af1&gt;] dev_hard_start_xmit+0x15e/0x32c
[  243.336018]  [&lt;ffffffff81454ed7&gt;] sch_direct_xmit+0xd6/0x221
[  243.336018]  [&lt;ffffffff814273a8&gt;] __dev_queue_xmit+0x52a/0x820
[  243.336018]  [&lt;ffffffff814276a9&gt;] dev_queue_xmit+0xb/0xd
[  243.336018]  [&lt;ffffffff81430a3c&gt;] neigh_direct_output+0xc/0xe
[  243.336018]  [&lt;ffffffff8146b5d7&gt;] ip_finish_output2+0x4d2/0x548
[  243.336018]  [&lt;ffffffff8146a8e6&gt;] ? dst_mtu+0x29/0x2e
[  243.336018]  [&lt;ffffffff8146d49c&gt;] ip_finish_output+0x152/0x15e
[  243.336018]  [&lt;ffffffff8146df84&gt;] ? ip_output+0x74/0x96
[  243.336018]  [&lt;ffffffff8146df9c&gt;] ip_output+0x8c/0x96
[  243.336018]  [&lt;ffffffff8146d55e&gt;] ip_local_out+0x41/0x4a
[  243.336018]  [&lt;ffffffff8146dd15&gt;] ip_queue_xmit+0x531/0x5c5
[  243.336018]  [&lt;ffffffff814a82cd&gt;] ? udp_set_csum+0x207/0x21e
[  243.336018]  [&lt;ffffffffa01f2f04&gt;] l2tp_xmit_skb+0x582/0x5d7 [l2tp_core]
[  243.336018]  [&lt;ffffffffa01ea458&gt;] pppol2tp_xmit+0x1eb/0x257 [l2tp_ppp]
[  243.336018]  [&lt;ffffffffa01acf17&gt;] ppp_channel_push+0x91/0x102 [ppp_generic]
[  243.336018]  [&lt;ffffffffa01ad2d8&gt;] ppp_write+0x104/0x11c [ppp_generic]
[  243.336018]  [&lt;ffffffff811a3c1e&gt;] __vfs_write+0x56/0x120
[  243.336018]  [&lt;ffffffff81239801&gt;] ? fsnotify_perm+0x27/0x95
[  243.336018]  [&lt;ffffffff8123ab01&gt;] ? security_file_permission+0x4d/0x54
[  243.336018]  [&lt;ffffffff811a4ca4&gt;] vfs_write+0xbd/0x11b
[  243.336018]  [&lt;ffffffff811a5a0a&gt;] SyS_write+0x5e/0x96
[  243.336018]  [&lt;ffffffff81552a1b&gt;] entry_SYSCALL_64_fastpath+0x13/0x94

The main entry points for sending packets over a PPP unit are the
.write() and .ndo_start_xmit() callbacks (simplified view):

.write(unit fd) or .ndo_start_xmit()
       \
        CALL ppp_xmit_process()
               \
                LOCK unit's xmit path (ppp-&gt;wlock)
                |
                CALL ppp_push()
                       \
                        LOCK channel's xmit path (chan-&gt;downl)
                        |
                        CALL lower layer's .start_xmit() callback
                               \
                                ... might recursively call .ndo_start_xmit() ...
                               /
                        RETURN from .start_xmit()
                        |
                        UNLOCK channel's xmit path
                       /
                RETURN from ppp_push()
                |
                UNLOCK unit's xmit path
               /
        RETURN from ppp_xmit_process()

Packets can also be directly sent on channels (e.g. LCP packets):

.write(channel fd) or ppp_output_wakeup()
       \
        CALL ppp_channel_push()
               \
                LOCK channel's xmit path (chan-&gt;downl)
                |
                CALL lower layer's .start_xmit() callback
                       \
                        ... might call .ndo_start_xmit() ...
                       /
                RETURN from .start_xmit()
                |
                UNLOCK channel's xmit path
               /
        RETURN from ppp_channel_push()

Key points about the lower layer's .start_xmit() callback:

  * It can be called directly by a channel fd .write() or by
    ppp_output_wakeup() or indirectly by a unit fd .write() or by
    .ndo_start_xmit().

  * In any case, it's always called with chan-&gt;downl held.

  * It might route the packet back to its parent unit using
    .ndo_start_xmit() as entry point.

This patch detects and breaks recursion in ppp_xmit_process(). This
function is a good candidate for the task because it's called early
enough after .ndo_start_xmit(), it's always part of the recursion
loop and it's on the path of whatever entry point is used to send
a packet on a PPP unit.

Recursion detection is done using the per-cpu ppp_xmit_recursion
variable.

Since ppp_channel_push() too locks the channel's xmit path and calls
the lower layer's .start_xmit() callback, we need to also increment
ppp_xmit_recursion there. However there's no need to check for
recursion, as it's out of the recursion loop.

Reported-by: Feng Gao &lt;gfree.wind@gmail.com&gt;
Signed-off-by: Guillaume Nault &lt;g.nault@alphalink.fr&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In case of misconfiguration, a virtual PPP channel might send packets
back to their parent PPP interface. This typically happens in
misconfigured L2TP setups, where PPP's peer IP address is set with the
IP of the L2TP peer.
When that happens the system hangs due to PPP trying to recursively
lock its xmit path.

[  243.332155] BUG: spinlock recursion on CPU#1, accel-pppd/926
[  243.333272]  lock: 0xffff880033d90f18, .magic: dead4ead, .owner: accel-pppd/926, .owner_cpu: 1
[  243.334859] CPU: 1 PID: 926 Comm: accel-pppd Not tainted 4.8.0-rc2 #1
[  243.336010] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
[  243.336018]  ffff7fffffffffff ffff8800319a77a0 ffffffff8128de85 ffff880033d90f18
[  243.336018]  ffff880033ad8000 ffff8800319a77d8 ffffffff810ad7c0 ffffffff0000039e
[  243.336018]  ffff880033d90f18 ffff880033d90f60 ffff880033d90f18 ffff880033d90f28
[  243.336018] Call Trace:
[  243.336018]  [&lt;ffffffff8128de85&gt;] dump_stack+0x4f/0x65
[  243.336018]  [&lt;ffffffff810ad7c0&gt;] spin_dump+0xe1/0xeb
[  243.336018]  [&lt;ffffffff810ad7f0&gt;] spin_bug+0x26/0x28
[  243.336018]  [&lt;ffffffff810ad8b9&gt;] do_raw_spin_lock+0x5c/0x160
[  243.336018]  [&lt;ffffffff815522aa&gt;] _raw_spin_lock_bh+0x35/0x3c
[  243.336018]  [&lt;ffffffffa01a88e2&gt;] ? ppp_push+0xa7/0x82d [ppp_generic]
[  243.336018]  [&lt;ffffffffa01a88e2&gt;] ppp_push+0xa7/0x82d [ppp_generic]
[  243.336018]  [&lt;ffffffff810adada&gt;] ? do_raw_spin_unlock+0xc2/0xcc
[  243.336018]  [&lt;ffffffff81084962&gt;] ? preempt_count_sub+0x13/0xc7
[  243.336018]  [&lt;ffffffff81552438&gt;] ? _raw_spin_unlock_irqrestore+0x34/0x49
[  243.336018]  [&lt;ffffffffa01ac657&gt;] ppp_xmit_process+0x48/0x877 [ppp_generic]
[  243.336018]  [&lt;ffffffff81084962&gt;] ? preempt_count_sub+0x13/0xc7
[  243.336018]  [&lt;ffffffff81408cd3&gt;] ? skb_queue_tail+0x71/0x7c
[  243.336018]  [&lt;ffffffffa01ad1c5&gt;] ppp_start_xmit+0x21b/0x22a [ppp_generic]
[  243.336018]  [&lt;ffffffff81426af1&gt;] dev_hard_start_xmit+0x15e/0x32c
[  243.336018]  [&lt;ffffffff81454ed7&gt;] sch_direct_xmit+0xd6/0x221
[  243.336018]  [&lt;ffffffff814273a8&gt;] __dev_queue_xmit+0x52a/0x820
[  243.336018]  [&lt;ffffffff814276a9&gt;] dev_queue_xmit+0xb/0xd
[  243.336018]  [&lt;ffffffff81430a3c&gt;] neigh_direct_output+0xc/0xe
[  243.336018]  [&lt;ffffffff8146b5d7&gt;] ip_finish_output2+0x4d2/0x548
[  243.336018]  [&lt;ffffffff8146a8e6&gt;] ? dst_mtu+0x29/0x2e
[  243.336018]  [&lt;ffffffff8146d49c&gt;] ip_finish_output+0x152/0x15e
[  243.336018]  [&lt;ffffffff8146df84&gt;] ? ip_output+0x74/0x96
[  243.336018]  [&lt;ffffffff8146df9c&gt;] ip_output+0x8c/0x96
[  243.336018]  [&lt;ffffffff8146d55e&gt;] ip_local_out+0x41/0x4a
[  243.336018]  [&lt;ffffffff8146dd15&gt;] ip_queue_xmit+0x531/0x5c5
[  243.336018]  [&lt;ffffffff814a82cd&gt;] ? udp_set_csum+0x207/0x21e
[  243.336018]  [&lt;ffffffffa01f2f04&gt;] l2tp_xmit_skb+0x582/0x5d7 [l2tp_core]
[  243.336018]  [&lt;ffffffffa01ea458&gt;] pppol2tp_xmit+0x1eb/0x257 [l2tp_ppp]
[  243.336018]  [&lt;ffffffffa01acf17&gt;] ppp_channel_push+0x91/0x102 [ppp_generic]
[  243.336018]  [&lt;ffffffffa01ad2d8&gt;] ppp_write+0x104/0x11c [ppp_generic]
[  243.336018]  [&lt;ffffffff811a3c1e&gt;] __vfs_write+0x56/0x120
[  243.336018]  [&lt;ffffffff81239801&gt;] ? fsnotify_perm+0x27/0x95
[  243.336018]  [&lt;ffffffff8123ab01&gt;] ? security_file_permission+0x4d/0x54
[  243.336018]  [&lt;ffffffff811a4ca4&gt;] vfs_write+0xbd/0x11b
[  243.336018]  [&lt;ffffffff811a5a0a&gt;] SyS_write+0x5e/0x96
[  243.336018]  [&lt;ffffffff81552a1b&gt;] entry_SYSCALL_64_fastpath+0x13/0x94

The main entry points for sending packets over a PPP unit are the
.write() and .ndo_start_xmit() callbacks (simplified view):

.write(unit fd) or .ndo_start_xmit()
       \
        CALL ppp_xmit_process()
               \
                LOCK unit's xmit path (ppp-&gt;wlock)
                |
                CALL ppp_push()
                       \
                        LOCK channel's xmit path (chan-&gt;downl)
                        |
                        CALL lower layer's .start_xmit() callback
                               \
                                ... might recursively call .ndo_start_xmit() ...
                               /
                        RETURN from .start_xmit()
                        |
                        UNLOCK channel's xmit path
                       /
                RETURN from ppp_push()
                |
                UNLOCK unit's xmit path
               /
        RETURN from ppp_xmit_process()

Packets can also be directly sent on channels (e.g. LCP packets):

.write(channel fd) or ppp_output_wakeup()
       \
        CALL ppp_channel_push()
               \
                LOCK channel's xmit path (chan-&gt;downl)
                |
                CALL lower layer's .start_xmit() callback
                       \
                        ... might call .ndo_start_xmit() ...
                       /
                RETURN from .start_xmit()
                |
                UNLOCK channel's xmit path
               /
        RETURN from ppp_channel_push()

Key points about the lower layer's .start_xmit() callback:

  * It can be called directly by a channel fd .write() or by
    ppp_output_wakeup() or indirectly by a unit fd .write() or by
    .ndo_start_xmit().

  * In any case, it's always called with chan-&gt;downl held.

  * It might route the packet back to its parent unit using
    .ndo_start_xmit() as entry point.

This patch detects and breaks recursion in ppp_xmit_process(). This
function is a good candidate for the task because it's called early
enough after .ndo_start_xmit(), it's always part of the recursion
loop and it's on the path of whatever entry point is used to send
a packet on a PPP unit.

Recursion detection is done using the per-cpu ppp_xmit_recursion
variable.

Since ppp_channel_push() too locks the channel's xmit path and calls
the lower layer's .start_xmit() callback, we need to also increment
ppp_xmit_recursion there. However there's no need to check for
recursion, as it's out of the recursion loop.

Reported-by: Feng Gao &lt;gfree.wind@gmail.com&gt;
Signed-off-by: Guillaume Nault &lt;g.nault@alphalink.fr&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>pptp: Refactor the struct and macros of PPTP codes</title>
<updated>2016-08-15T17:55:53+00:00</updated>
<author>
<name>Gao Feng</name>
<email>fgao@ikuai8.com</email>
</author>
<published>2016-08-12T16:30:48+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=03459345bc00da70a35fa39bcfcf13d779097074'/>
<id>03459345bc00da70a35fa39bcfcf13d779097074</id>
<content type='text'>
1. Use struct gre_base_hdr directly in pptp_gre_header instead of
duplicated members;
2. Use existing macros like GRE_KEY, GRE_SEQ, and so on instead of
duplicated macros defined by PPTP;
3. Add new macros like GRE_IS_ACK/SEQ and so on instead of
PPTP_GRE_IS_A/S and so on;

Signed-off-by: Gao Feng &lt;fgao@ikuai8.com&gt;
Reviewed-by: Philip Prindeville &lt;philipp@redfish-solutions.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
1. Use struct gre_base_hdr directly in pptp_gre_header instead of
duplicated members;
2. Use existing macros like GRE_KEY, GRE_SEQ, and so on instead of
duplicated macros defined by PPTP;
3. Add new macros like GRE_IS_ACK/SEQ and so on instead of
PPTP_GRE_IS_A/S and so on;

Signed-off-by: Gao Feng &lt;fgao@ikuai8.com&gt;
Reviewed-by: Philip Prindeville &lt;philipp@redfish-solutions.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rps: Inspect PPTP encapsulated by GRE to get flow hash</title>
<updated>2016-08-11T00:22:14+00:00</updated>
<author>
<name>Gao Feng</name>
<email>fgao@ikuai8.com</email>
</author>
<published>2016-08-09T04:38:24+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ab10dccb11608b96b43b557c12a5ad867723e503'/>
<id>ab10dccb11608b96b43b557c12a5ad867723e503</id>
<content type='text'>
The PPTP is encapsulated by GRE header with that GRE_VERSION bits
must contain one. But current GRE RPS needs the GRE_VERSION must be
zero. So RPS does not work for PPTP traffic.

In my test environment, there are four MIPS cores, and all traffic
are passed through by PPTP. As a result, only one core is 100% busy
while other three cores are very idle. After this patch, the usage
of four cores are balanced well.

Signed-off-by: Gao Feng &lt;fgao@ikuai8.com&gt;
Reviewed-by: Philip Prindeville &lt;philipp@redfish-solutions.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The PPTP is encapsulated by GRE header with that GRE_VERSION bits
must contain one. But current GRE RPS needs the GRE_VERSION must be
zero. So RPS does not work for PPTP traffic.

In my test environment, there are four MIPS cores, and all traffic
are passed through by PPTP. As a result, only one core is 100% busy
while other three cores are very idle. After this patch, the usage
of four cores are balanced well.

Signed-off-by: Gao Feng &lt;fgao@ikuai8.com&gt;
Reviewed-by: Philip Prindeville &lt;philipp@redfish-solutions.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ppp: build ifname using unit identifier for rtnl based devices</title>
<updated>2016-08-09T21:56:21+00:00</updated>
<author>
<name>Guillaume Nault</name>
<email>g.nault@alphalink.fr</email>
</author>
<published>2016-08-09T13:12:26+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=bb8082f6913889418b69a54e57b4a39d7128a700'/>
<id>bb8082f6913889418b69a54e57b4a39d7128a700</id>
<content type='text'>
Userspace programs generally need to know the name of the ppp devices
they create. Both ioctl and rtnl interfaces use the ppp&lt;suffix&gt; sheme
to name them. But although the suffix used by the ioctl interface can
be known by userspace (it's the PPP unit identifier returned by the
PPPIOCGUNIT ioctl), the one used by the rtnl is only known by the
kernel.

This patch brings more consistency between ioctl and rtnl based ppp
devices by generating device names using the PPP unit identifer as
suffix in both cases. This way, userspace can always infer the name of
the devices they create.

Signed-off-by: Guillaume Nault &lt;g.nault@alphalink.fr&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Userspace programs generally need to know the name of the ppp devices
they create. Both ioctl and rtnl interfaces use the ppp&lt;suffix&gt; sheme
to name them. But although the suffix used by the ioctl interface can
be known by userspace (it's the PPP unit identifier returned by the
PPPIOCGUNIT ioctl), the one used by the rtnl is only known by the
kernel.

This patch brings more consistency between ioctl and rtnl based ppp
devices by generating device names using the PPP unit identifer as
suffix in both cases. This way, userspace can always infer the name of
the devices they create.

Signed-off-by: Guillaume Nault &lt;g.nault@alphalink.fr&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net</title>
<updated>2016-07-24T04:53:32+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2016-07-23T23:31:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=de0ba9a0d8909996f9e293d311c2cc459fa77d67'/>
<id>de0ba9a0d8909996f9e293d311c2cc459fa77d67</id>
<content type='text'>
Just several instances of overlapping changes.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Just several instances of overlapping changes.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
</feed>
