linux-toradex.git/net/core, branch v3.0.52

net: Fix skb_under_panic oops in neigh_resolve_output

2012-10-28T17:02:12+00:00

[ Upstream commit e1f165032c8bade3a6bdf546f8faf61fda4dd01c ]

The retry loop in neigh_resolve_output() and neigh_connected_output()
call dev_hard_header() with out reseting the skb to network_header.
This causes the retry to fail with skb_under_panic. The fix is to
reset the network_header within the retry loop.

Signed-off-by: Ramesh Nagappa 
Reviewed-by: Shawn Lu 
Reviewed-by: Robert Coulson 
Reviewed-by: Billie Alsup 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

pktgen: fix crash when generating IPv6 packets

2012-10-21T16:17:11+00:00

commit 5aa8b572007c4bca1e6d3dd4c4820f1ae49d6bb2 upstream.

For IPv6, sizeof(struct ipv6hdr) = 40, thus the following
expression will result negative:

        datalen = pkt_dev->cur_pkt_size - 14 -
                  sizeof(struct ipv6hdr) - sizeof(struct udphdr) -
                  pkt_dev->pkt_overhead;

And,  the check "if (datalen < sizeof(struct pktgen_hdr))" will be
passed as "datalen" is promoted to unsigned, therefore will cause
a crash later.

This is a quick fix by checking if "datalen" is negative. The following
patch will increase the default value of 'min_pkt_size' for IPv6.

This bug should exist for a long time, so Cc -stable too.

Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: do not disable sg for packets requiring no checksum

2012-10-12T20:28:08+00:00

[ Upstream commit c0d680e577ff171e7b37dbdb1b1bf5451e851f04 ]

A change in a series of VLAN-related changes appears to have
inadvertently disabled the use of the scatter gather feature of
network cards for transmission of non-IP ethernet protocols like ATA
over Ethernet (AoE).  Below is a reference to the commit that
introduces a "harmonize_features" function that turns off scatter
gather when the NIC does not support hardware checksumming for the
ethernet protocol of an sk buff.

  commit f01a5236bd4b140198fbcc550f085e8361fd73fa
  Author: Jesse Gross 
  Date:   Sun Jan 9 06:23:31 2011 +0000

      net offloading: Generalize netif_get_vlan_features().

The can_checksum_protocol function is not equipped to consider a
protocol that does not require checksumming.  Calling it for a
protocol that requires no checksum is inappropriate.

The patch below has harmonize_features call can_checksum_protocol when
the protocol needs a checksum, so that the network layer is not forced
to perform unnecessary skb linearization on the transmission of AoE
packets.  Unnecessary linearization results in decreased performance
and increased memory pressure, as reported here:

  http://www.spinics.net/lists/linux-mm/msg15184.html

The problem has probably not been widely experienced yet, because
only recently has the kernel.org-distributed aoe driver acquired the
ability to use payloads of over a page in size, with the patchset
recently included in the mm tree:

  https://lkml.org/lkml/2012/8/28/140

The coraid.com-distributed aoe driver already could use payloads of
greater than a page in size, but its users generally do not use the
newest kernels.

Signed-off-by: Ed Cashin 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: guard tcp_set_keepalive() to tcp sockets

2012-10-12T20:28:07+00:00

[ Upstream commit 3e10986d1d698140747fcfc2761ec9cb64c1d582 ]

Its possible to use RAW sockets to get a crash in
tcp_set_keepalive() / sk_reset_timer()

Fix is to make sure socket is a SOCK_STREAM one.

Reported-by: Dave Jones 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: small bug on rxhash calculation

2012-10-12T20:28:07+00:00

[ Upstream commit 6862234238e84648c305526af2edd98badcad1e0 ]

In the current rxhash calculation function, while the
sorting of the ports/addrs is coherent (you get the
same rxhash for packets sharing the same 4-tuple, in
both directions), ports and addrs are sorted
independently. This implies packets from a connection
between the same addresses but crossed ports hash to
the same rxhash.

For example, traffic between A=S:l and B=L:s is hashed
(in both directions) from {L, S, {s, l}}. The same
rxhash is obtained for packets between C=S:s and D=L:l.

This patch ensures that you either swap both addrs and ports,
or you swap none. Traffic between A and B, and traffic
between C and D, get their rxhash from different sources
({L, S, {l, s}} for A<->B, and {L, S, {s, l}} for C<->D)

The patch is co-written with Eric Dumazet 

Signed-off-by: Chema Gonzalez 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

drop_monitor: dont sleep in atomic context

2012-10-02T16:47:42+00:00

commit bec4596b4e6770c7037f21f6bd27567b152dc0d6 upstream.

drop_monitor calls several sleeping functions while in atomic context.

 BUG: sleeping function called from invalid context at mm/slub.c:943
 in_atomic(): 1, irqs_disabled(): 0, pid: 2103, name: kworker/0:2
 Pid: 2103, comm: kworker/0:2 Not tainted 3.5.0-rc1+ #55
 Call Trace:
  [] __might_sleep+0xca/0xf0
  [] kmem_cache_alloc_node+0x1b3/0x1c0
  [] ? queue_delayed_work_on+0x11c/0x130
  [] __alloc_skb+0x4b/0x230
  [] ? reset_per_cpu_data+0x160/0x160 [drop_monitor]
  [] reset_per_cpu_data+0x2f/0x160 [drop_monitor]
  [] send_dm_alert+0x4b/0xb0 [drop_monitor]
  [] process_one_work+0x130/0x4c0
  [] worker_thread+0x159/0x360
  [] ? manage_workers.isra.27+0x240/0x240
  [] kthread+0x93/0xa0
  [] kernel_thread_helper+0x4/0x10
  [] ? kthread_freezable_should_stop+0x80/0x80
  [] ? gs_change+0xb/0xb

Rework the logic to call the sleeping functions in right context.

Use standard timer/workqueue api to let system chose any cpu to perform
the allocation and netlink send.

Also avoid a loop if reset_per_cpu_data() cannot allocate memory :
use mod_timer() to wait 1/10 second before next try.

Signed-off-by: Eric Dumazet 
Cc: Neil Horman 
Reviewed-by: Neil Horman 
Signed-off-by: David S. Miller 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

drop_monitor: prevent init path from scheduling on the wrong cpu

2012-10-02T16:47:42+00:00

commit 4fdcfa12843bca38d0c9deff70c8720e4e8f515f upstream.

I just noticed after some recent updates, that the init path for the drop
monitor protocol has a minor error.  drop monitor maintains a per cpu structure,
that gets initalized from a single cpu.  Normally this is fine, as the protocol
isn't in use yet, but I recently made a change that causes a failed skb
allocation to reschedule itself .  Given the current code, the implication is
that this workqueue reschedule will take place on the wrong cpu.  If drop
monitor is used early during the boot process, its possible that two cpus will
access a single per-cpu structure in parallel, possibly leading to data
corruption.

This patch fixes the situation, by storing the cpu number that a given instance
of this per-cpu data should be accessed from.  In the case of a need for a
reschedule, the cpu stored in the struct is assigned the rescheule, rather than
the currently executing cpu

Tested successfully by myself.

Signed-off-by: Neil Horman 
CC: David Miller 
Signed-off-by: David S. Miller 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

drop_monitor: Make updating data->skb smp safe

2012-10-02T16:47:42+00:00

commit 3885ca785a3618593226687ced84f3f336dc3860 upstream.

Eric Dumazet pointed out to me that the drop_monitor protocol has some holes in
its smp protections.  Specifically, its possible to replace data->skb while its
being written.  This patch corrects that by making data->skb an rcu protected
variable.  That will prevent it from being overwritten while a tracepoint is
modifying it.

Signed-off-by: Neil Horman 
Reported-by: Eric Dumazet 
CC: David Miller 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

drop_monitor: fix sleeping in invalid context warning

2012-10-02T16:47:42+00:00

commit cde2e9a651b76d8db36ae94cd0febc82b637e5dd upstream.

Eric Dumazet pointed out this warning in the drop_monitor protocol to me:

[   38.352571] BUG: sleeping function called from invalid context at kernel/mutex.c:85
[   38.352576] in_atomic(): 1, irqs_disabled(): 0, pid: 4415, name: dropwatch
[   38.352580] Pid: 4415, comm: dropwatch Not tainted 3.4.0-rc2+ #71
[   38.352582] Call Trace:
[   38.352592]  [] ? trace_napi_poll_hit+0xd0/0xd0
[   38.352599]  [] __might_sleep+0xca/0xf0
[   38.352606]  [] mutex_lock+0x26/0x50
[   38.352610]  [] ? trace_napi_poll_hit+0xd0/0xd0
[   38.352616]  [] tracepoint_probe_register+0x29/0x90
[   38.352621]  [] set_all_monitor_traces+0x105/0x170
[   38.352625]  [] net_dm_cmd_trace+0x2a/0x40
[   38.352630]  [] genl_rcv_msg+0x21a/0x2b0
[   38.352636]  [] ? zone_statistics+0x99/0xc0
[   38.352640]  [] ? genl_rcv+0x30/0x30
[   38.352645]  [] netlink_rcv_skb+0xa9/0xd0
[   38.352649]  [] genl_rcv+0x20/0x30
[   38.352653]  [] netlink_unicast+0x1ae/0x1f0
[   38.352658]  [] netlink_sendmsg+0x2b6/0x310
[   38.352663]  [] sock_sendmsg+0x10f/0x130
[   38.352668]  [] ? move_addr_to_kernel+0x60/0xb0
[   38.352673]  [] ? verify_iovec+0x64/0xe0
[   38.352677]  [] __sys_sendmsg+0x386/0x390
[   38.352682]  [] ? handle_mm_fault+0x139/0x210
[   38.352687]  [] ? do_page_fault+0x1ec/0x4f0
[   38.352693]  [] ? set_next_entity+0x9d/0xb0
[   38.352699]  [] ? tty_ldisc_deref+0x9/0x10
[   38.352703]  [] ? pick_next_task_fair+0x63/0x140
[   38.352708]  [] sys_sendmsg+0x44/0x80
[   38.352713]  [] system_call_fastpath+0x16/0x1b

It stems from holding a spinlock (trace_state_lock) while attempting to register
or unregister tracepoint hooks, making in_atomic() true in this context, leading
to the warning when the tracepoint calls might_sleep() while its taking a mutex.
Since we only use the trace_state_lock to prevent trace protocol state races, as
well as hardware stat list updates on an rcu write side, we can just convert the
spinlock to a mutex to avoid this problem.

Signed-off-by: Neil Horman 
Reported-by: Eric Dumazet 
CC: David Miller 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

net: Statically initialize init_net.dev_base_head

2012-10-02T16:47:41+00:00

commit 734b65417b24d6eea3e3d7457e1f11493890ee1d upstream.

This change eliminates an initialization-order hazard most
recently seen when netprio_cgroup is built into the kernel.

With thanks to Eric Dumazet for catching a bug.

Signed-off-by: Mark Rustad 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman