linux-toradex.git/net/phonet, branch v3.2.48

phonet: Check input from user before allocating

2012-05-11T12:14:19+00:00

[ Upstream commit bcf1b70ac6eb0ed8286c66e6bf37cb747cbaa04c ]

A phonet packet is limited to USHRT_MAX bytes, this is never checked during
tx which means that the user can specify any size he wishes, and the kernel
will attempt to allocate that size.

In the good case, it'll lead to the following warning, but it may also cause
the kernel to kick in the OOM and kill a random task on the server.

[ 8921.744094] WARNING: at mm/page_alloc.c:2255 __alloc_pages_slowpath+0x65/0x730()
[ 8921.749770] Pid: 5081, comm: trinity Tainted: G        W    3.4.0-rc1-next-20120402-sasha #46
[ 8921.756672] Call Trace:
[ 8921.758185]  [] warn_slowpath_common+0x87/0xb0
[ 8921.762868]  [] warn_slowpath_null+0x15/0x20
[ 8921.765399]  [] __alloc_pages_slowpath+0x65/0x730
[ 8921.769226]  [] ? zone_watermark_ok+0x1a/0x20
[ 8921.771686]  [] ? get_page_from_freelist+0x625/0x660
[ 8921.773919]  [] __alloc_pages_nodemask+0x1f8/0x240
[ 8921.776248]  [] kmalloc_large_node+0x70/0xc0
[ 8921.778294]  [] __kmalloc_node_track_caller+0x34/0x1c0
[ 8921.780847]  [] ? sock_alloc_send_pskb+0xbc/0x260
[ 8921.783179]  [] __alloc_skb+0x75/0x170
[ 8921.784971]  [] sock_alloc_send_pskb+0xbc/0x260
[ 8921.787111]  [] ? release_sock+0x7e/0x90
[ 8921.788973]  [] sock_alloc_send_skb+0x10/0x20
[ 8921.791052]  [] pep_sendmsg+0x60/0x380
[ 8921.792931]  [] ? pn_socket_bind+0x156/0x180
[ 8921.794917]  [] ? pn_socket_autobind+0x3f/0x90
[ 8921.797053]  [] pn_socket_sendmsg+0x4f/0x70
[ 8921.798992]  [] sock_aio_write+0x187/0x1b0
[ 8921.801395]  [] ? sub_preempt_count+0xae/0xf0
[ 8921.803501]  [] ? __lock_acquire+0x42c/0x4b0
[ 8921.805505]  [] ? __sock_recv_ts_and_drops+0x140/0x140
[ 8921.807860]  [] do_sync_readv_writev+0xbc/0x110
[ 8921.809986]  [] ? might_fault+0x97/0xa0
[ 8921.811998]  [] ? security_file_permission+0x1e/0x90
[ 8921.814595]  [] do_readv_writev+0xe2/0x1e0
[ 8921.816702]  [] ? do_setitimer+0x1ac/0x200
[ 8921.818819]  [] ? get_parent_ip+0x11/0x50
[ 8921.820863]  [] ? sub_preempt_count+0xae/0xf0
[ 8921.823318]  [] vfs_writev+0x46/0x60
[ 8921.825219]  [] sys_writev+0x4f/0xb0
[ 8921.827127]  [] system_call_fastpath+0x16/0x1b
[ 8921.829384] ---[ end trace dffe390f30db9eb7 ]---

Signed-off-by: Sasha Levin 
Acked-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

net: reintroduce missing rcu_assign_pointer() calls

2012-02-03T17:22:20+00:00

[ Upstream commit cf778b00e96df6d64f8e21b8395d1f8a859ecdc7 ]

commit a9b3cd7f32 (rcu: convert uses of rcu_assign_pointer(x, NULL) to
RCU_INIT_POINTER) did a lot of incorrect changes, since it did a
complete conversion of rcu_assign_pointer(x, y) to RCU_INIT_POINTER(x,
y).

We miss needed barriers, even on x86, when y is not NULL.

Signed-off-by: Eric Dumazet 
CC: Stephen Hemminger 
CC: Paul E. McKenney 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules

2011-10-31T23:30:30+00:00

These files are non modular, but need to export symbols using
the macros now living in export.h -- call out the include so
that things won't break when we remove the implicit presence
of module.h from everywhere.

Signed-off-by: Paul Gortmaker

net: Fix files explicitly needing to include module.h

2011-10-31T23:30:28+00:00

With calls to modular infrastructure, these files really
needs the full module.h header.  Call it out so some of the
cleanups of implicit and unrequired includes elsewhere can be
cleaned up.

Signed-off-by: Paul Gortmaker

rcu: convert uses of rcu_assign_pointer(x, NULL) to RCU_INIT_POINTER

2011-08-02T11:29:23+00:00

When assigning a NULL value to an RCU protected pointer, no barrier
is needed. The rcu_assign_pointer, used to handle that but will soon
change to not handle the special case.

Convert all rcu_assign_pointer of NULL value.

//smpl
@@ expression P; @@

- rcu_assign_pointer(P, NULL)
+ RCU_INIT_POINTER(P, NULL)

// 

Signed-off-by: Stephen Hemminger 
Acked-by: Paul E. McKenney 
Signed-off-by: David S. Miller

rtnetlink: Compute and store minimum ifinfo dump size

2011-06-10T03:38:07+00:00

The message size allocated for rtnl ifinfo dumps was limited to
a single page.  This is not enough for additional interface info
available with devices that support SR-IOV and caused a bug in
which VF info would not be displayed if more than approximately
40 VFs were created per interface.

Implement a new function pointer for the rtnl_register service that will
calculate the amount of data required for the ifinfo dump and allocate
enough data to satisfy the request.

Signed-off-by: Greg Rose 
Signed-off-by: Jeff Kirsher

net: convert %p usage to %pK

2011-05-24T05:13:12+00:00

The %pK format specifier is designed to hide exposed kernel pointers,
specifically via /proc interfaces.  Exposing these pointers provides an
easy target for kernel write vulnerabilities, since they reveal the
locations of writable structures containing easily triggerable function
pointers.  The behavior of %pK depends on the kptr_restrict sysctl.

If kptr_restrict is set to 0, no deviation from the standard %p behavior
occurs.  If kptr_restrict is set to 1, the default, if the current user
(intended to be a reader via seq_printf(), etc.) does not have CAP_SYSLOG
(currently in the LSM tree), kernel pointers using %pK are printed as 0's.
 If kptr_restrict is set to 2, kernel pointers using %pK are printed as
0's regardless of privileges.  Replacing with 0's was chosen over the
default "(null)", which cannot be parsed by userland %p, which expects
"(nil)".

The supporting code for kptr_restrict and %pK are currently in the -mm
tree.  This patch converts users of %p in net/ to %pK.  Cases of printing
pointers to the syslog are not covered, since this would eliminate useful
information for postmortem debugging and the reading of the syslog is
already optionally protected by the dmesg_restrict sysctl.

Signed-off-by: Dan Rosenberg 
Cc: James Morris 
Cc: Eric Dumazet 
Cc: Thomas Graf 
Cc: Eugene Teo 
Cc: Kees Cook 
Cc: Ingo Molnar 
Cc: David S. Miller 
Cc: Peter Zijlstra 
Cc: Eric Paris 
Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

2011-05-20T20:43:21+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1446 commits)
  macvlan: fix panic if lowerdev in a bond
  tg3: Add braces around 5906 workaround.
  tg3: Fix NETIF_F_LOOPBACK error
  macvlan: remove one synchronize_rcu() call
  networking: NET_CLS_ROUTE4 depends on INET
  irda: Fix error propagation in ircomm_lmp_connect_response()
  irda: Kill set but unused variable 'bytes' in irlan_check_command_param()
  irda: Kill set but unused variable 'clen' in ircomm_connect_indication()
  rxrpc: Fix set but unused variable 'usage' in rxrpc_get_transport()
  be2net: Kill set but unused variable 'req' in lancer_fw_download()
  irda: Kill set but unused vars 'saddr' and 'daddr' in irlan_provider_connect_indication()
  atl1c: atl1c_resume() is only used when CONFIG_PM_SLEEP is defined.
  rxrpc: Fix set but unused variable 'usage' in rxrpc_get_peer().
  rxrpc: Kill set but unused variable 'local' in rxrpc_UDP_error_handler()
  rxrpc: Kill set but unused variable 'sp' in rxrpc_process_connection()
  rxrpc: Kill set but unused variable 'sp' in rxrpc_rotate_tx_window()
  pkt_sched: Kill set but unused variable 'protocol' in tc_classify()
  isdn: capi: Use pr_debug() instead of ifdefs.
  tg3: Update version to 3.119
  tg3: Apply rx_discards fix to 5719/5720
  ...

Fix up trivial conflicts in arch/x86/Kconfig and net/mac80211/agg-tx.c
as per Davem.

net,rcu: convert call_rcu(phonet_device_rcu_free) to kfree_rcu()

2011-05-08T05:51:10+00:00

The rcu callback phonet_device_rcu_free() just calls a kfree(),
so we use kfree_rcu() instead of the call_rcu(phonet_device_rcu_free).

Signed-off-by: Lai Jiangshan 
Acked-by: David S. Miller 
Signed-off-by: Paul E. McKenney 
Reviewed-by: Josh Triplett

net: dont hold rtnl mutex during netlink dump callbacks

2011-05-02T22:26:28+00:00

Four years ago, Patrick made a change to hold rtnl mutex during netlink
dump callbacks.

I believe it was a wrong move. This slows down concurrent dumps, making
good old /proc/net/ files faster than rtnetlink in some situations.

This occurred to me because one "ip link show dev ..." was _very_ slow
on a workload adding/removing network devices in background.

All dump callbacks are able to use RCU locking now, so this patch does
roughly a revert of commits :

1c2d670f366 : [RTNETLINK]: Hold rtnl_mutex during netlink dump callbacks
6313c1e0992 : [RTNETLINK]: Remove unnecessary locking in dump callbacks

This let writers fight for rtnl mutex and readers going full speed.

It also takes care of phonet : phonet_route_get() is now called from rcu
read section. I renamed it to phonet_route_get_rcu()

Signed-off-by: Eric Dumazet 
Cc: Patrick McHardy 
Cc: Remi Denis-Courmont 
Acked-by: Stephen Hemminger 
Signed-off-by: David S. Miller