linux-toradex.git/net/core, branch v2.6.16.42

[PKTGEN]: Fix module load/unload races.

2007-01-04T00:02:58+00:00

Adrian Bunk:
Backported to 2.6.16.

Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

NET_SCHED: Fix fallout from dev->qdisc RCU change

2007-01-03T23:38:10+00:00

The move of qdisc destruction to a rcu callback broke locking in the
entire qdisc layer by invalidating previously valid assumptions about
the context in which changes to the qdisc tree occur.

The two assumptions were:

- since changes only happen in process context, read_lock doesn't need
  bottem half protection. Now invalid since destruction of inner qdiscs,
  classifiers, actions and estimators happens in the RCU callback unless
  they're manually deleted, resulting in dead-locks when read_lock in
  process context is interrupted by write_lock_bh in bottem half context.

- since changes only happen under the RTNL, no additional locking is
  necessary for data not used during packet processing (f.e. u32_list).
  Again, since destruction now happens in the RCU callback, this assumption
  is not valid anymore, causing races while using this data, which can
  result in corruption or use-after-free.

Instead of "fixing" this by disabling bottem halfs everywhere and adding
new locks/refcounting, this patch makes these assumptions valid again by
moving destruction back to process context. Since only the dev->qdisc
pointer is protected by RCU, but ->enqueue and the qdisc tree are still
protected by dev->qdisc_lock, destruction of the tree can be performed
immediately and only the final free needs to happen in the rcu callback
to make sure dev_queue_xmit doesn't access already freed memory.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[RTNETLINK]: Fix IFLA_ADDRESS handling.

2006-11-19T23:21:04+00:00

The ->set_mac_address handlers expect a pointer to a
sockaddr which contains the MAC address, whereas
IFLA_ADDRESS provides just the MAC address itself.

So whip up a sockaddr to wrap around the netlink
attribute for the ->set_mac_address call.

Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

Fix timer race in dst GC code

2006-11-17T16:53:07+00:00

Replace add_timer() by mod_timer() in dst_run_gc
in order to avoid BUG message.

   CPU1                            CPU2
dst_run_gc()  entered           dst_run_gc() entered
spin_lock(&dst_lock)                   .....
del_timer(&dst_gc_timer)         fail to get lock
   ....                         mod_timer() <--- puts
                                             timer back
                                             to the list
add_timer(&dst_gc_timer) <--- BUG because timer is in list already.

Found during OpenVZ internal testing.

At first we thought that it is OpenVZ specific as we
added dst_run_gc(0) call in dst_dev_event(),
but as Alexey pointed to me it is possible to trigger
this condition in mainstream kernel.

F.e. timer has fired on CPU2, but the handler was preeempted
by an irq before dst_lock is tried.
Meanwhile, someone on CPU1 adds an entry to gc list and
starts the timer.
If CPU2 was preempted long enough, this timer can expire
simultaneously with resuming timer handler on CPU1, arriving
exactly to the situation described.

Signed-off-by: Dmitry Mishin 
Signed-off-by: Kirill Korotaev 
Signed-off-by: Adrian Bunk

[NET]: Update frag_list in pskb_trim

2006-11-10T23:15:10+00:00

When pskb_trim has to defer to ___pksb_trim to trim the frag_list part of
the packet, the frag_list is not updated to reflect the trimming.  This
will usually work fine until you hit something that uses the packet length
or tail from the frag_list.

Examples include esp_output and ip_fragment.

Another problem caused by this is that you can end up with a linear packet
with a frag_list attached.

It is possible to get away with this if we audit everything to make sure
that they always consult skb->len before going down onto frag_list.  In
fact we can do the samething for the paged part as well to avoid copying
the data area of the skb.  For now though, let's do the conservative fix
and update frag_list.

Many thanks to Marco Berizzi for helping me to track down this bug.

This 4-year old bug took 3 months to track down.  Marco was very patient
indeed :)

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[NET]: __alloc_pages() failures reported due to fragmentation

2006-11-09T10:05:38+00:00

We have seen a couple of __alloc_pages() failures due to
fragmentation, there is plenty of free memory but no large order pages
available.  I think the problem is in sock_alloc_send_pskb(), the
gfp_mask includes __GFP_REPEAT but its never used/passed to the page
allocator.  Shouldnt the gfp_mask be passed to alloc_skb() ?

Signed-off-by: Larry Woodman 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[NET]: Set truesize in pskb_copy

2006-11-09T10:03:56+00:00

Since pskb_copy tacks on the non-linear bits from the original
skb, it needs to count them in the truesize field of the new skb.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[NET]: Add missing UFO initialisations

2006-11-08T06:47:29+00:00

This bug was unknowingly fixed the GSO patches (or rather, its effect was
unknown at the time).

Thanks to Marco Berizzi's persistence which is documented in the thread
"ipsec tunnel asymmetrical mtu", we now know that it can have highly
non-obvious symptoms.

What happens is that uninitialised uso_size fields can cause packets to
be incorrectly identified as UFO, which means that it does not get
fragmented even if it's over the MTU.

The fix is simple enough.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[PKTGEN]: Make sure skb->{nh,h} are initialized in fill_packet_ipv6() too.

2006-09-06T17:35:53+00:00

Mirror the bug fix from fill_packet_ipv4()

Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[PKTGEN]: Fix oops when used with balance-tlb bonding

2006-09-06T17:34:53+00:00

Signed-off-by: Chen-Li Tien 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk