linux-toradex.git/net/core/neighbour.c, branch v3.2.16

neighbour: Fixed race condition at tbl->nht

2012-03-19T16:02:21+00:00

[ Upstream commit 84338a6c9dbb6ff3de4749864020f8f25d86fc81 ]

When the fixed race condition happens:

1. While function neigh_periodic_work scans the neighbor hash table
pointed by field tbl->nht, it unlocks and locks tbl->lock between
buckets in order to call cond_resched.

2. Assume that function neigh_periodic_work calls cond_resched, that is,
the lock tbl->lock is available, and function neigh_hash_grow runs.

3. Once function neigh_hash_grow finishes, and RCU calls
neigh_hash_free_rcu, the original struct neigh_hash_table that function
neigh_periodic_work was using doesn't exist anymore.

4. Once back at neigh_periodic_work, whenever the old struct
neigh_hash_table is accessed, things can go badly.

Signed-off-by: Michel Machado 
CC: "David S. Miller" 
CC: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

netns: fix proxy ARP entries listing on a netns

2011-11-25T18:24:49+00:00

Skip entries from foreign network namespaces.

Signed-off-by: Jorge Boncompte [DTI2] 
Signed-off-by: David S. Miller

neigh: Kill bogus SMP protected debugging message.

2011-11-01T21:45:55+00:00

Whatever situations make this state legitimate when SMP
also would be legitimate when !SMP and f.e. preemption is
enabled.

This is dubious enough that we should just delete it entirely.  If we
want to add debugging for neigh timer races, better more thorough
mechanisms are needed.

Signed-off-by: David S. Miller

neigh: fix rcu splat in neigh_update()

2011-10-19T23:38:51+00:00

when use dst_get_neighbour to get neighbour, we need
rcu_read_lock to protect, since dst_get_neighbour uses
rcu_dereference.

The bug was reported by Ari Savolainen 

[  105.612095]
[  105.612096] ===================================================
[  105.612100] [ INFO: suspicious rcu_dereference_check() usage. ]
[  105.612101] ---------------------------------------------------
[  105.612103] include/net/dst.h:91 invoked rcu_dereference_check()
without protection!
[  105.612105]
[  105.612106] other info that might help us debug this:
[  105.612106]
[  105.612108]
[  105.612108] rcu_scheduler_active = 1, debug_locks = 0
[  105.612110] 1 lock held by dnsmasq/2618:
[  105.612111]  #0:  (rtnl_mutex){+.+.+.}, at: []
rtnl_lock+0x17/0x20
[  105.612120]
[  105.612121] stack backtrace:
[  105.612123] Pid: 2618, comm: dnsmasq Not tainted 3.1.0-rc1 #41
[  105.612125] Call Trace:
[  105.612129]  [] lockdep_rcu_dereference+0xbb/0xc0
[  105.612132]  [] neigh_update+0x4f9/0x5f0
[  105.612135]  [] ? neigh_lookup+0xe1/0x220
[  105.612139]  [] arp_req_set+0xb8/0x230
[  105.612142]  [] arp_ioctl+0x1bf/0x310
[  105.612146]  [] ? lock_hrtimer_base.isra.26+0x30/0x60
[  105.612150]  [] inet_ioctl+0x85/0x90
[  105.612154]  [] sock_do_ioctl+0x30/0x70
[  105.612157]  [] sock_ioctl+0x73/0x280
[  105.612162]  [] do_vfs_ioctl+0x98/0x570
[  105.612165]  [] ? fget_light+0x340/0x3a0
[  105.612168]  [] sys_ioctl+0x4f/0x80
[  105.612172]  [] system_call_fastpath+0x16/0x1b

Reported-by: Ari Savolainen 
Signed-off-by: RongQing 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

Merge branch 'master' of github.com:davem330/net

2011-09-22T07:23:13+00:00

Conflicts:
	MAINTAINERS
	drivers/net/Kconfig
	drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
	drivers/net/ethernet/broadcom/tg3.c
	drivers/net/wireless/iwlwifi/iwl-pci.c
	drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
	drivers/net/wireless/rt2x00/rt2800usb.c
	drivers/net/wireless/wl12xx/main.c

arp: fix rcu lockdep splat in arp_process()

2011-08-25T00:55:00+00:00

Dave Jones reported a lockdep splat triggered by an arp_process() call
from parp_redo().

Commit faa9dcf793be (arp: RCU changes) is the origin of the bug, since
it assumed arp_process() was called under rcu_read_lock(), which is not
true in this particular path.

Instead of adding rcu_read_lock() in parp_redo(), I chose to add it in
neigh_proxy_process() to take care of IPv6 side too.

 ===================================================
 [ INFO: suspicious rcu_dereference_check() usage. ]
 ---------------------------------------------------
 include/linux/inetdevice.h:209 invoked rcu_dereference_check() without
protection!

 other info that might help us debug this:

 rcu_scheduler_active = 1, debug_locks = 0
 4 locks held by setfiles/2123:
  #0:  (&sb->s_type->i_mutex_key#13){+.+.+.}, at: []
walk_component+0x1ef/0x3e8
  #1:  (&isec->lock){+.+.+.}, at: []
inode_doinit_with_dentry+0x3f/0x41f
  #2:  (&tbl->proxy_timer){+.-...}, at: []
run_timer_softirq+0x157/0x372
  #3:  (class){+.-...}, at: [] neigh_proxy_process
+0x36/0x103

 stack backtrace:
 Pid: 2123, comm: setfiles Tainted: G        W
3.1.0-0.rc2.git7.2.fc16.x86_64 #1
 Call Trace:
    [] lockdep_rcu_dereference+0xa7/0xaf
  [] __in_dev_get_rcu+0x55/0x5d
  [] arp_process+0x25/0x4d7
  [] parp_redo+0xe/0x10
  [] neigh_proxy_process+0x9a/0x103
  [] run_timer_softirq+0x218/0x372
  [] ? run_timer_softirq+0x157/0x372
  [] ? neigh_stat_seq_open+0x41/0x41
  [] ? mark_held_locks+0x6d/0x95
  [] __do_softirq+0x112/0x25a
  [] call_softirq+0x1c/0x30
  [] do_softirq+0x4b/0xa2
  [] irq_exit+0x5d/0xcf
  [] smp_apic_timer_interrupt+0x7c/0x8a
  [] apic_timer_interrupt+0x73/0x80
    [] ? trace_hardirqs_on_caller+0x121/0x158
  [] ? __slab_free+0x30/0x24c
  [] ? __slab_free+0x2e/0x24c
  [] ? inode_doinit_with_dentry+0x2e9/0x41f
  [] ? inode_doinit_with_dentry+0x2e9/0x41f
  [] ? inode_doinit_with_dentry+0x2e9/0x41f
  [] kfree+0x108/0x131
  [] inode_doinit_with_dentry+0x2e9/0x41f
  [] selinux_d_instantiate+0x1c/0x1e
  [] security_d_instantiate+0x21/0x23
  [] d_instantiate+0x5c/0x61
  [] d_splice_alias+0xbc/0xd2
  [] ext4_lookup+0xba/0xeb
  [] d_alloc_and_lookup+0x45/0x6b
  [] walk_component+0x215/0x3e8
  [] lookup_last+0x3b/0x3d
  [] path_lookupat+0x82/0x2af
  [] ? might_fault+0xa5/0xac
  [] ? might_fault+0x5c/0xac
  [] ? getname_flags+0x31/0x1ca
  [] do_path_lookup+0x28/0x97
  [] user_path_at+0x59/0x96
  [] ? cp_new_stat+0xf7/0x10d
  [] vfs_fstatat+0x44/0x6e
  [] vfs_lstat+0x1e/0x20
  [] sys_newlstat+0x1a/0x33
  [] ? trace_hardirqs_on_caller+0x121/0x158
  [] ? trace_hardirqs_on_thunk+0x3a/0x3f
  [] system_call_fastpath+0x16/0x1b

Reported-by: Dave Jones 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

neigh: reduce arp latency

2011-08-12T09:55:28+00:00

Remove the artificial HZ latency on arp resolution.

Instead of firing a timer in one jiffy (up to 10 ms if HZ=100), lets
send the ARP message immediately.

Before patch :

# arp -d 192.168.20.108 ; ping -c 3 192.168.20.108
PING 192.168.20.108 (192.168.20.108) 56(84) bytes of data.
64 bytes from 192.168.20.108: icmp_seq=1 ttl=64 time=9.91 ms
64 bytes from 192.168.20.108: icmp_seq=2 ttl=64 time=0.065 ms
64 bytes from 192.168.20.108: icmp_seq=3 ttl=64 time=0.061 ms

After patch :

$ arp -d 192.168.20.108 ; ping -c 3 192.168.20.108
PING 192.168.20.108 (192.168.20.108) 56(84) bytes of data.
64 bytes from 192.168.20.108: icmp_seq=1 ttl=64 time=0.152 ms
64 bytes from 192.168.20.108: icmp_seq=2 ttl=64 time=0.064 ms
64 bytes from 192.168.20.108: icmp_seq=3 ttl=64 time=0.074 ms

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: Abstract dst->neighbour accesses behind helpers.

2011-07-18T06:11:35+00:00

dst_{get,set}_neighbour()

Signed-off-by: David S. Miller

neigh: Pass neighbour entry to output ops.

2011-07-18T06:11:17+00:00

This will get us closer to being able to do "neigh stuff"
completely independent of the underlying dst_entry for
protocols (ipv4/ipv6) that wish to do so.

We will also be able to make dst entries neigh-less.

Signed-off-by: David S. Miller

neigh: Kill ndisc_ops->queue_xmit

2011-07-17T01:30:59+00:00

It is always dev_queue_xmit().

Signed-off-by: David S. Miller