linux-toradex.git/net/core, branch v3.12.2

net: flow_dissector: fail on evil iph->ihl

2013-11-20T20:37:36+00:00

[ Upstream commit 6f092343855a71e03b8d209815d8c45bf3a27fcd ]

We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
is evil (less than 5).

This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae
(rps: support IPIP encapsulation).

Signed-off-by: Jason Wang 
Cc: Eric Dumazet 
Cc: Petr Matousek 
Cc: Michael S. Tsirkin 
Cc: Daniel Borkmann 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: secure_seq: Fix warning when CONFIG_IPV6 and CONFIG_INET are not selected

2013-10-09T16:59:57+00:00

net_secret() is only used when CONFIG_IPV6 or CONFIG_INET are selected.

Building a defconfig with both of these symbols unselected (Using the ARM
at91sam9rl_defconfig, for example) leads to the following build warning:

$ make at91sam9rl_defconfig
#
# configuration written to .config
#

$ make net/core/secure_seq.o
scripts/kconfig/conf --silentoldconfig Kconfig
  CHK     include/config/kernel.release
  CHK     include/generated/uapi/linux/version.h
  CHK     include/generated/utsrelease.h
make[1]: `include/generated/mach-types.h' is up to date.
  CALL    scripts/checksyscalls.sh
  CC      net/core/secure_seq.o
net/core/secure_seq.c:17:13: warning: 'net_secret_init' defined but not used [-Wunused-function]

Fix this warning by protecting the definition of net_secret() with these
symbols.

Reported-by: Olof Johansson 
Signed-off-by: Fabio Estevam 
Signed-off-by: David S. Miller

pkt_sched: fq: fix non TCP flows pacing

2013-10-09T01:54:01+00:00

Steinar reported FQ pacing was not working for UDP flows.

It looks like the initial sk->sk_pacing_rate value of 0 was
a wrong choice. We should init it to ~0U (unlimited)

Then, TCA_FQ_FLOW_DEFAULT_RATE should be removed because it makes
no real sense. The default rate is really unlimited, and we
need to avoid a zero divide.

Reported-by: Steinar H. Gunderson 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: fix unsafe set_memory_rw from softirq

2013-10-07T19:16:45+00:00

on x86 system with net.core.bpf_jit_enable = 1

sudo tcpdump -i eth1 'tcp port 22'

causes the warning:
[   56.766097]  Possible unsafe locking scenario:
[   56.766097]
[   56.780146]        CPU0
[   56.786807]        ----
[   56.793188]   lock(&(&vb->lock)->rlock);
[   56.799593]   
[   56.805889]     lock(&(&vb->lock)->rlock);
[   56.812266]
[   56.812266]  *** DEADLOCK ***
[   56.812266]
[   56.830670] 1 lock held by ksoftirqd/1/13:
[   56.836838]  #0:  (rcu_read_lock){.+.+..}, at: [] vm_unmap_aliases+0x8c/0x380
[   56.849757]
[   56.849757] stack backtrace:
[   56.862194] CPU: 1 PID: 13 Comm: ksoftirqd/1 Not tainted 3.12.0-rc3+ #45
[   56.868721] Hardware name: System manufacturer System Product Name/P8Z77 WS, BIOS 3007 07/26/2012
[   56.882004]  ffffffff821944c0 ffff88080bbdb8c8 ffffffff8175a145 0000000000000007
[   56.895630]  ffff88080bbd5f40 ffff88080bbdb928 ffffffff81755b14 0000000000000001
[   56.909313]  ffff880800000001 ffff880800000000 ffffffff8101178f 0000000000000001
[   56.923006] Call Trace:
[   56.929532]  [] dump_stack+0x55/0x76
[   56.936067]  [] print_usage_bug+0x1f7/0x208
[   56.942445]  [] ? save_stack_trace+0x2f/0x50
[   56.948932]  [] ? check_usage_backwards+0x150/0x150
[   56.955470]  [] mark_lock+0x282/0x2c0
[   56.961945]  [] __lock_acquire+0x45d/0x1d50
[   56.968474]  [] ? __lock_acquire+0x2de/0x1d50
[   56.975140]  [] ? cpumask_next_and+0x55/0x90
[   56.981942]  [] lock_acquire+0x92/0x1d0
[   56.988745]  [] ? vm_unmap_aliases+0x16a/0x380
[   56.995619]  [] _raw_spin_lock+0x41/0x50
[   57.002493]  [] ? vm_unmap_aliases+0x16a/0x380
[   57.009447]  [] vm_unmap_aliases+0x16a/0x380
[   57.016477]  [] ? vm_unmap_aliases+0x8c/0x380
[   57.023607]  [] change_page_attr_set_clr+0xc0/0x460
[   57.030818]  [] ? trace_hardirqs_on+0xd/0x10
[   57.037896]  [] ? kmem_cache_free+0xb0/0x2b0
[   57.044789]  [] ? free_object_rcu+0x93/0xa0
[   57.051720]  [] set_memory_rw+0x2f/0x40
[   57.058727]  [] bpf_jit_free+0x2c/0x40
[   57.065577]  [] sk_filter_release_rcu+0x1a/0x30
[   57.072338]  [] rcu_process_callbacks+0x202/0x7c0
[   57.078962]  [] __do_softirq+0xf7/0x3f0
[   57.085373]  [] run_ksoftirqd+0x35/0x70

cannot reuse jited filter memory, since it's readonly,
so use original bpf insns memory to hold work_struct

defer kfree of sk_filter until jit completed freeing

tested on x86_64 and i386

Signed-off-by: Alexei Starovoitov 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

netif_set_xps_queue: make cpu mask const

2013-10-07T16:29:26+00:00

virtio wants to pass in cpumask_of(cpu), make parameter
const to avoid build warnings.

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller

net: flow_dissector: fix thoff for IPPROTO_AH

2013-09-30T19:32:05+00:00

In commit 8ed781668dd49 ("flow_keys: include thoff into flow_keys for
later usage"), we missed that existing code was using nhoff as a
temporary variable that could not always contain transport header
offset.

This is not a problem for TCP/UDP because port offset (@poff)
is 0 for these protocols.

Signed-off-by: Eric Dumazet 
Cc: Daniel Borkmann 
Cc: Nikolay Aleksandrov 
Acked-by: Nikolay Aleksandrov 
Acked-by: Daniel Borkmann 
Signed-off-by: David S. Miller

net: net_secret should not depend on TCP

2013-09-28T22:19:40+00:00

A host might need net_secret[] and never open a single socket.

Problem added in commit aebda156a570782
("net: defer net_secret[] initialization")

Based on prior patch from Hannes Frederic Sowa.

Reported-by: Hannes Frederic Sowa 
Signed-off-by: Eric Dumazet 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

net: Delay default_device_exit_batch until no devices are unregistering v2

2013-09-28T22:09:15+00:00

There is currently serialization network namespaces exiting and
network devices exiting as the final part of netdev_run_todo does not
happen under the rtnl_lock.  This is compounded by the fact that the
only list of devices unregistering in netdev_run_todo is local to the
netdev_run_todo.

This lack of serialization in extreme cases results in network devices
unregistering in netdev_run_todo after the loopback device of their
network namespace has been freed (making dst_ifdown unsafe), and after
the their network namespace has exited (making the NETDEV_UNREGISTER,
and NETDEV_UNREGISTER_FINAL callbacks unsafe).

Add the missing serialization by a per network namespace count of how
many network devices are unregistering and having a wait queue that is
woken up whenever the count is decreased.  The count and wait queue
allow default_device_exit_batch to wait until all of the unregistration
activity for a network namespace has finished before proceeding to
unregister the loopback device and then allowing the network namespace
to exit.

Only a single global wait queue is used because there is a single global
lock, and there is a single waiter, per network namespace wait queues
would be a waste of resources.

The per network namespace count of unregistering devices gives a
progress guarantee because the number of network devices unregistering
in an exiting network namespace must ultimately drop to zero (assuming
network device unregistration completes).

The basic logic remains the same as in v1.  This patch is now half
comment and half rtnl_lock_unregistering an expanded version of
wait_event performs no extra work in the common case where no network
devices are unregistering when we get to default_device_exit_batch.

Reported-by: Francesco Ruggeri 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

netpoll: fix NULL pointer dereference in netpoll_cleanup

2013-09-19T18:15:53+00:00

I've been hitting a NULL ptr deref while using netconsole because the
np->dev check and the pointer manipulation in netpoll_cleanup are done
without rtnl and the following sequence happens when having a netconsole
over a vlan and we remove the vlan while disabling the netconsole:
	CPU 1					CPU2
					removes vlan and calls the notifier
enters store_enabled(), calls
netdev_cleanup which checks np->dev
and then waits for rtnl
					executes the netconsole netdev
					release notifier making np->dev
					== NULL and releases rtnl
continues to dereference a member of
np->dev which at this point is == NULL

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

netpoll: Should handle ETH_P_ARP other than ETH_P_IP in netpoll_neigh_reply

2013-09-12T21:19:14+00:00

The received ARP request type in the Ethernet packet head is ETH_P_ARP other than ETH_P_IP.

[ Bug introduced by commit b7394d2429c198b1da3d46ac39192e891029ec0f
  ("netpoll: prepare for ipv6") ]

Signed-off-by: Sonic Zhang 
Signed-off-by: David S. Miller