<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/net/sched, branch v2.6.18.3</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>PKT_SCHED: cls_basic: Use unsigned int when generating handle</title>
<updated>2006-10-13T20:23:27+00:00</updated>
<author>
<name>David Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2006-09-27T23:25:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f2fb7f11c1dc0cf66f290671f4a7b427e63da64c'/>
<id>f2fb7f11c1dc0cf66f290671f4a7b427e63da64c</id>
<content type='text'>
gcc-4.1 and later take advantage of the fact that in the
C language certain types of overflow/underflow are undefined,
and this is completely legitimate.

Prevents filters from being added if the first generated
handle already exists.

Signed-off-by: Kim Nordlund &lt;kim.nordlund@nokia.com&gt;
Signed-off-by: Thomas Graf &lt;tgraf@suug.ch&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
gcc-4.1 and later take advantage of the fact that in the
C language certain types of overflow/underflow are undefined,
and this is completely legitimate.

Prevents filters from being added if the first generated
handle already exists.

Signed-off-by: Kim Nordlund &lt;kim.nordlund@nokia.com&gt;
Signed-off-by: Thomas Graf &lt;tgraf@suug.ch&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>NET_SCHED: Fix fallout from dev-&gt;qdisc RCU change</title>
<updated>2006-10-13T20:23:20+00:00</updated>
<author>
<name>Patrick McHardy</name>
<email>kaber@trash.net</email>
</author>
<published>2006-10-10T04:16:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=5f804c752ba4e4e85457bf0e4da9f8521720328b'/>
<id>5f804c752ba4e4e85457bf0e4da9f8521720328b</id>
<content type='text'>
The move of qdisc destruction to a rcu callback broke locking in the
entire qdisc layer by invalidating previously valid assumptions about
the context in which changes to the qdisc tree occur.

The two assumptions were:

- since changes only happen in process context, read_lock doesn't need
  bottem half protection. Now invalid since destruction of inner qdiscs,
  classifiers, actions and estimators happens in the RCU callback unless
  they're manually deleted, resulting in dead-locks when read_lock in
  process context is interrupted by write_lock_bh in bottem half context.

- since changes only happen under the RTNL, no additional locking is
  necessary for data not used during packet processing (f.e. u32_list).
  Again, since destruction now happens in the RCU callback, this assumption
  is not valid anymore, causing races while using this data, which can
  result in corruption or use-after-free.

Instead of "fixing" this by disabling bottem halfs everywhere and adding
new locks/refcounting, this patch makes these assumptions valid again by
moving destruction back to process context. Since only the dev-&gt;qdisc
pointer is protected by RCU, but -&gt;enqueue and the qdisc tree are still
protected by dev-&gt;qdisc_lock, destruction of the tree can be performed
immediately and only the final free needs to happen in the rcu callback
to make sure dev_queue_xmit doesn't access already freed memory.

Signed-off-by: Patrick McHardy &lt;kaber@trash.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The move of qdisc destruction to a rcu callback broke locking in the
entire qdisc layer by invalidating previously valid assumptions about
the context in which changes to the qdisc tree occur.

The two assumptions were:

- since changes only happen in process context, read_lock doesn't need
  bottem half protection. Now invalid since destruction of inner qdiscs,
  classifiers, actions and estimators happens in the RCU callback unless
  they're manually deleted, resulting in dead-locks when read_lock in
  process context is interrupted by write_lock_bh in bottem half context.

- since changes only happen under the RTNL, no additional locking is
  necessary for data not used during packet processing (f.e. u32_list).
  Again, since destruction now happens in the RCU callback, this assumption
  is not valid anymore, causing races while using this data, which can
  result in corruption or use-after-free.

Instead of "fixing" this by disabling bottem halfs everywhere and adding
new locks/refcounting, this patch makes these assumptions valid again by
moving destruction back to process context. Since only the dev-&gt;qdisc
pointer is protected by RCU, but -&gt;enqueue and the qdisc tree are still
protected by dev-&gt;qdisc_lock, destruction of the tree can be performed
immediately and only the final free needs to happen in the rcu callback
to make sure dev_queue_xmit doesn't access already freed memory.

Signed-off-by: Patrick McHardy &lt;kaber@trash.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>[NET]: Drop tx lock in dev_watchdog_up</title>
<updated>2006-09-18T07:22:30+00:00</updated>
<author>
<name>Herbert Xu</name>
<email>herbert@gondor.apana.org.au</email>
</author>
<published>2006-09-18T07:22:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=d7811e623dd4be3e3bdba2d6330f7f15541ee45f'/>
<id>d7811e623dd4be3e3bdba2d6330f7f15541ee45f</id>
<content type='text'>
Fix lockdep warning with GRE, iptables and Speedtouch ADSL, PPP over ATM.

On Sat, Sep 02, 2006 at 08:39:28PM +0000, Krzysztof Halasa wrote:
&gt; 
&gt; =======================================================
&gt; [ INFO: possible circular locking dependency detected ]
&gt; -------------------------------------------------------
&gt; swapper/0 is trying to acquire lock:
&gt;  (&amp;dev-&gt;queue_lock){-+..}, at: [&lt;c02c8c46&gt;] dev_queue_xmit+0x56/0x290
&gt; 
&gt; but task is already holding lock:
&gt;  (&amp;dev-&gt;_xmit_lock){-+..}, at: [&lt;c02c8e14&gt;] dev_queue_xmit+0x224/0x290
&gt; 
&gt; which lock already depends on the new lock.

This turns out to be a genuine bug.  The queue lock and xmit lock are
intentionally taken out of order.  Two things are supposed to prevent
dead-locks from occuring:

1) When we hold the queue_lock we're supposed to only do try_lock on the
tx_lock.

2) We always drop the queue_lock after taking the tx_lock and before doing
anything else.

&gt; 
&gt; the existing dependency chain (in reverse order) is:
&gt; 
&gt; -&gt; #1 (&amp;dev-&gt;_xmit_lock){-+..}:
&gt;        [&lt;c012e7b6&gt;] lock_acquire+0x76/0xa0
&gt;        [&lt;c0336241&gt;] _spin_lock_bh+0x31/0x40
&gt;        [&lt;c02d25a9&gt;] dev_activate+0x69/0x120

This path obviously breaks assumption 1) and therefore can lead to ABBA
dead-locks.

I've looked at the history and there seems to be no reason for the lock
to be held at all in dev_watchdog_up.  The lock appeared in day one and
even there it was unnecessary.  In fact, people added __dev_watchdog_up
precisely in order to get around the tx lock there.

The function dev_watchdog_up is already serialised by rtnl_lock since
its only caller dev_activate is always called under it.

So here is a simple patch to remove the tx lock from dev_watchdog_up.
In 2.6.19 we can eliminate the unnecessary __dev_watchdog_up and
replace it with dev_watchdog_up.

Signed-off-by: Herbert Xu &lt;herbert@gondor.apana.org.au&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Fix lockdep warning with GRE, iptables and Speedtouch ADSL, PPP over ATM.

On Sat, Sep 02, 2006 at 08:39:28PM +0000, Krzysztof Halasa wrote:
&gt; 
&gt; =======================================================
&gt; [ INFO: possible circular locking dependency detected ]
&gt; -------------------------------------------------------
&gt; swapper/0 is trying to acquire lock:
&gt;  (&amp;dev-&gt;queue_lock){-+..}, at: [&lt;c02c8c46&gt;] dev_queue_xmit+0x56/0x290
&gt; 
&gt; but task is already holding lock:
&gt;  (&amp;dev-&gt;_xmit_lock){-+..}, at: [&lt;c02c8e14&gt;] dev_queue_xmit+0x224/0x290
&gt; 
&gt; which lock already depends on the new lock.

This turns out to be a genuine bug.  The queue lock and xmit lock are
intentionally taken out of order.  Two things are supposed to prevent
dead-locks from occuring:

1) When we hold the queue_lock we're supposed to only do try_lock on the
tx_lock.

2) We always drop the queue_lock after taking the tx_lock and before doing
anything else.

&gt; 
&gt; the existing dependency chain (in reverse order) is:
&gt; 
&gt; -&gt; #1 (&amp;dev-&gt;_xmit_lock){-+..}:
&gt;        [&lt;c012e7b6&gt;] lock_acquire+0x76/0xa0
&gt;        [&lt;c0336241&gt;] _spin_lock_bh+0x31/0x40
&gt;        [&lt;c02d25a9&gt;] dev_activate+0x69/0x120

This path obviously breaks assumption 1) and therefore can lead to ABBA
dead-locks.

I've looked at the history and there seems to be no reason for the lock
to be held at all in dev_watchdog_up.  The lock appeared in day one and
even there it was unnecessary.  In fact, people added __dev_watchdog_up
precisely in order to get around the tx lock there.

The function dev_watchdog_up is already serialised by rtnl_lock since
its only caller dev_activate is always called under it.

So here is a simple patch to remove the tx lock from dev_watchdog_up.
In 2.6.19 we can eliminate the unnecessary __dev_watchdog_up and
replace it with dev_watchdog_up.

Signed-off-by: Herbert Xu &lt;herbert@gondor.apana.org.au&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[PKT_SCHED] cls_u32: Fix typo.</title>
<updated>2006-08-17T23:29:54+00:00</updated>
<author>
<name>Ralf Hildebrandt</name>
<email>Ralf.Hildebrandt@charite.de</email>
</author>
<published>2006-08-15T09:12:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c0956bd25161bff45304d482cda51ca4b3b572f1'/>
<id>c0956bd25161bff45304d482cda51ca4b3b572f1</id>
<content type='text'>
Signed-off-by: Ralf Hildebrandt &lt;Ralf.Hildebrandt@charite.de&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Ralf Hildebrandt &lt;Ralf.Hildebrandt@charite.de&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[PKT_SCHED]: Return ENOENT if qdisc module is unavailable</title>
<updated>2006-08-05T05:59:49+00:00</updated>
<author>
<name>Jamal Hadi Salim</name>
<email>hadi@cyberus.ca</email>
</author>
<published>2006-08-03T23:36:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=b9e2cc0f0e47ad351349156018ef8a365e9c6d25'/>
<id>b9e2cc0f0e47ad351349156018ef8a365e9c6d25</id>
<content type='text'>
Return ENOENT if qdisc module is unavailable

Signed-off-by: Jamal Hadi Salim &lt;hadi@cyberus.ca&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Return ENOENT if qdisc module is unavailable

Signed-off-by: Jamal Hadi Salim &lt;hadi@cyberus.ca&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[NET]: Conversions from kmalloc+memset to k(z|c)alloc.</title>
<updated>2006-07-21T21:51:30+00:00</updated>
<author>
<name>Panagiotis Issaris</name>
<email>takis@issaris.org</email>
</author>
<published>2006-07-21T21:51:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=0da974f4f303a6842516b764507e3c0a03f41e5a'/>
<id>0da974f4f303a6842516b764507e3c0a03f41e5a</id>
<content type='text'>
Signed-off-by: Panagiotis Issaris &lt;takis@issaris.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Panagiotis Issaris &lt;takis@issaris.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>[PKT_SCHED] netem: Fix slab corruption with netem (2nd try)</title>
<updated>2006-07-21T21:45:25+00:00</updated>
<author>
<name>Guillaume Chazarain</name>
<email>guichaz@yahoo.fr</email>
</author>
<published>2006-07-21T21:45:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=89e1df74f841fc31e81838d30594c4eff01859f8'/>
<id>89e1df74f841fc31e81838d30594c4eff01859f8</id>
<content type='text'>
CONFIG_DEBUG_SLAB found the following bug:
netem_enqueue() in sch_netem.c gets a pointer inside a slab object:
struct netem_skb_cb *cb = (struct netem_skb_cb *)skb-&gt;cb;
But then, the slab object may be freed:
skb = skb_unshare(skb, GFP_ATOMIC)
cb is still pointing inside the freed skb, so here is a patch to
initialize cb later, and make it clear that initializing it sooner
is a bad idea.

[From Stephen Hemminger: leave cb unitialized in order to let gcc
complain in case of use before initialization]

Signed-off-by: Guillaume Chazarain &lt;guichaz@yahoo.fr&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
CONFIG_DEBUG_SLAB found the following bug:
netem_enqueue() in sch_netem.c gets a pointer inside a slab object:
struct netem_skb_cb *cb = (struct netem_skb_cb *)skb-&gt;cb;
But then, the slab object may be freed:
skb = skb_unshare(skb, GFP_ATOMIC)
cb is still pointing inside the freed skb, so here is a patch to
initialize cb later, and make it clear that initializing it sooner
is a bad idea.

[From Stephen Hemminger: leave cb unitialized in order to let gcc
complain in case of use before initialization]

Signed-off-by: Guillaume Chazarain &lt;guichaz@yahoo.fr&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[PATCH] sch_htb compile fix.</title>
<updated>2006-07-15T18:40:20+00:00</updated>
<author>
<name>Dave Jones</name>
<email>davej@redhat.com</email>
</author>
<published>2006-07-15T07:41:12+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2724a1a55f847e2b5007cf294e03cfa09d0d22f3'/>
<id>2724a1a55f847e2b5007cf294e03cfa09d0d22f3</id>
<content type='text'>
net/sched/sch_htb.c: In function 'htb_change_class':
net/sched/sch_htb.c:1605: error: expected ';' before 'do_gettimeofday'

Signed-off-by: Dave Jones &lt;davej@redhat.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@osdl.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
net/sched/sch_htb.c: In function 'htb_change_class':
net/sched/sch_htb.c:1605: error: expected ';' before 'do_gettimeofday'

Signed-off-by: Dave Jones &lt;davej@redhat.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@osdl.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[PKT_SCHED] HTB: initialize upper bound properly</title>
<updated>2006-07-14T23:32:27+00:00</updated>
<author>
<name>Stephen Hemminger</name>
<email>shemminger@osdl.org</email>
</author>
<published>2006-07-14T23:32:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=b3a6251915df9e3d80d4a0d32bd8d24223906688'/>
<id>b3a6251915df9e3d80d4a0d32bd8d24223906688</id>
<content type='text'>
The upper bound for HTB time diff needs to be scaled to PSCHED
units rather than just assuming usecs.  The field mbuffer is used
in TDIFF_SAFE(), as an upper bound.

Signed-off-by: Stephen Hemminger &lt;shemminger@osdl.org&gt;
Acked-by: Jamal Hadi Salim &lt;hadi@cyberus.ca&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The upper bound for HTB time diff needs to be scaled to PSCHED
units rather than just assuming usecs.  The field mbuffer is used
in TDIFF_SAFE(), as an upper bound.

Signed-off-by: Stephen Hemminger &lt;shemminger@osdl.org&gt;
Acked-by: Jamal Hadi Salim &lt;hadi@cyberus.ca&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[MAINTAINERS]: Add proper entry for TC classifier</title>
<updated>2006-07-12T20:58:48+00:00</updated>
<author>
<name>Stephen Hemminger</name>
<email>shemminger@osdl.org</email>
</author>
<published>2006-07-11T03:25:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=781b456a980ec987a4be248f236c59658f651240'/>
<id>781b456a980ec987a4be248f236c59658f651240</id>
<content type='text'>
Acked-by: Jamal Hadi Salim &lt;hadi@cyberus.ca&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Acked-by: Jamal Hadi Salim &lt;hadi@cyberus.ca&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
</feed>
